fix(ingestion): the switch walk also skips any input named with "negative"

#90's rule matches only whole underscore-separated words, so negative2,
negativeprompt and NegativePrompt counted as positive inputs and an off
node wired only to one of them blocked the file. The walk skips those too;
follows_input is unchanged.

.github/branch-protection.json

@@ -3,17 +3,10 @@
     "strict": false,
     "contexts": [
       "py3.12 on ubuntu-latest",
-      "py3.13 on ubuntu-latest",
-      "py3.14 on ubuntu-latest",
-      "py3.12 on windows-latest",
-      "py3.13 on windows-latest",
-      "py3.14 on windows-latest",
-      "py3.12 on macos-latest",
-      "py3.13 on macos-latest",
-      "py3.14 on macos-latest",
       "coverage gate (85%)",
       "black and flake8",
       "frontend modules",
+      "all tests",
       "viewerjs",
       "real ComfyUI compatibility",
       "bandit (high severity)"

.github/workflows/portability.yml

@@ -0,0 +1,55 @@
+name: Windows and macOS
+
+permissions:
+  contents: read
+
+# Non-blocking portability runs (#420): never on pull requests or in the merge queue, and no context
+# here is a required check. A red run is fixed at its cause before the workspace cutover (#334).
+on:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "17 3 * * *"
+  workflow_dispatch:
+
+# Every run gets its own group (run_id), so no main commit's run is ever cancelled or dropped as pending.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.run_id }}
+  cancel-in-progress: false
+
+env:
+  PYTHONFAULTHANDLER: "1"
+
+# Time limit rule as in test.yml: ceil(1.5 x the slowest of three recent green runs on main) + 3
+# minutes, never under 5. Measured 2026-10-26 in test.yml on runs 40257217681 (3be0ada),
+# 40240706568 (fb9134f), 40228167328 (f9835aa), before these legs moved here in #420:
+#   slowest py3.10 on windows-latest: 12m43s / 15m54s / 14m53s -> 27 min
+#     (macos 6m14s-8m30s, windows 11m42s-15m54s)
+jobs:
+  test:
+    name: py${{ matrix.python-version }} on ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 27
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-latest, macos-latest]
+        python-version: ["3.12", "3.13", "3.14"]
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v7
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+          cache-dependency-path: requirements-dev.txt
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements-dev.txt
+
+      - name: Run tests
+        run: python -m tests.run_suite -v

.github/workflows/test.yml

@@ -28,10 +28,18 @@ env:
 #   py matrix, slowest py3.10 on windows-latest: 12m43s / 15m54s / 14m53s -> 27 min
 #     (ubuntu 5m27s-6m27s, macos 6m14s-8m30s, windows 11m42s-15m54s)
 #     3.10 and 3.11 left the matrix and 3.14 joined it in #356; re-measure after three green main runs.
+#     Windows and macOS moved to portability.yml (#420), which keeps this 27-minute limit; this
+#     Linux-only matrix keeps it too until it is re-measured.
 #   real ComfyUI compatibility: 13m32s / 8m55s / 11m46s -> 24 min
 #   coverage gate (85%): 7m26s / 7m22s / 7m54s -> 15 min
 #   perf budget 30s / 29s / 27s, black and flake8 39s / 37s / 39s,
 #   frontend modules 23s / 19s / 29s -> 5 min (the floor)
+#   all tests: a result check without setup, 5 min (the floor)
+#
+# Pull requests run a fast subset (#420): Python 3.12 on ubuntu-latest, coverage, lint and frontend
+# modules. The merge queue (merge_group), pushes to main and manual runs add Python 3.13 and 3.14 on
+# Linux and the real ComfyUI job. "all tests" is the required gate that holds the queue to that set.
+# Windows and macOS run in portability.yml (push to main, nightly, on demand) and never gate a merge.
 jobs:
   test:
     name: py${{ matrix.python-version }} on ${{ matrix.os }}
@@ -40,8 +48,8 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
-        python-version: ["3.12", "3.13", "3.14"]
+        os: [ubuntu-latest]
+        python-version: ${{ github.event_name == 'pull_request' && fromJSON('["3.12"]') || fromJSON('["3.12", "3.13", "3.14"]') }}
 
     steps:
       - uses: actions/checkout@v7
@@ -63,6 +71,9 @@ jobs:
 
   comfyui:
     name: real ComfyUI compatibility
+    # Merge queue, main and manual runs only. A job skipped by its condition reports Success, so this
+    # required context never blocks a pull request; "all tests" fails if it is skipped anywhere else.
+    if: github.event_name != 'pull_request'
     runs-on: ubuntu-latest
     # Chromium and its system libraries come from the pinned Playwright image (tag = @playwright/test in
     # tools/vendor/package-lock.json; tests/vendor/browser-image.test.mjs checks it). The runner install
@@ -253,3 +264,32 @@ jobs:
 
       - name: Run JS tests
         run: node --test tests/js/*.test.js
+
+  # The required context "all tests". A dropped matrix leg never reports a check at all, so the eight
+  # legs that pull requests skip cannot be required by name; this gate requires them instead. Every
+  # job must succeed; real ComfyUI must be skipped on a pull request and succeed on every other event.
+  all-tests:
+    name: all tests
+    needs: [test, comfyui, coverage, lint, js-test]
+    if: always()
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Require every test job for this event
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          TEST_RESULT: ${{ needs.test.result }}
+          COMFYUI_RESULT: ${{ needs.comfyui.result }}
+          COVERAGE_RESULT: ${{ needs.coverage.result }}
+          LINT_RESULT: ${{ needs.lint.result }}
+          JS_RESULT: ${{ needs.js-test.result }}
+        run: |
+          queue_only=success
+          if [ "$EVENT_NAME" = pull_request ]; then queue_only=skipped; fi
+          echo "event: $EVENT_NAME (real ComfyUI must be $queue_only)"
+          echo "test matrix: $TEST_RESULT"
+          echo "comfyui: $COMFYUI_RESULT"
+          echo "coverage: $COVERAGE_RESULT"
+          echo "lint: $LINT_RESULT"
+          echo "js-test: $JS_RESULT"
+          test "$TEST_RESULT" = success && test "$COVERAGE_RESULT" = success && test "$LINT_RESULT" = success && test "$JS_RESULT" = success && test "$COMFYUI_RESULT" = "$queue_only"

.github/workflows/viewerjs-check.yml

@@ -27,6 +27,15 @@ concurrency:
 # coverage shards 7m34s/6m04s/5m22s (tests 6m38s/4m53s/4m04s), merge 54s, firefox 7m57s/5m21s (tests
 # 7m08s/4m34s), webkit 8m16s/5m03s (tests 7m26s/3m58s); a cache miss adds up to 5m to npm ci, which
 # the 20-minute limits absorb.
+# Hangs (#425): a job killed at its limit keeps no log and skips its upload steps, so each browser
+# test step has its own timeout-minutes (18) below the job's 20. At the step limit, SIGTERM makes
+# tools/vendor/running-tests-reporter.mjs print the tests still running and hand over to Playwright's
+# interrupt, which writes the blob report; the always() uploads then run.
+# Measured on main (runs 40725289094, 40719375442, 40700439399): setup before the test step <= 52s,
+# uploads <= 35s; test steps up to 14m42s (webkit shard 1/2) and 13m05s for coverage (shard 1/3:
+# 12m53s, node units and the viewer suite before 11.8m of workflows), so coverage is the tight one
+# in its 18 minutes. This holds only when the npm cache hits: a cold cache adds up to 5m to npm ci,
+# and then the job limit can still end the job before the step limit does.
 jobs:
   frontend-coverage:
     name: frontend coverage (shard ${{ matrix.shard }}/3)
@@ -79,6 +88,7 @@ jobs:
       - if: matrix.shard == 3
         run: npm run --prefix tools/vendor test
       - name: Page workflows with coverage, shard ${{ matrix.shard }}/3
+        timeout-minutes: 18
         run: npm run --prefix tools/vendor test:coverage:shard -- ${{ matrix.shard }}/3
       - name: Upload raw coverage
         uses: actions/upload-artifact@v7
@@ -87,6 +97,7 @@ jobs:
           path: coverage/js/raw/
           if-no-files-found: error
           retention-days: 3
+      # Traces and the blob report (test-results/blob/) of a failed, timed-out or cancelled step.
       - name: Upload Chromium and touch traces
         if: always()
         uses: actions/upload-artifact@v7
@@ -165,6 +176,8 @@ jobs:
 
   browser-workflows:
     name: page workflows (${{ matrix.browser }}, shard ${{ matrix.shard }}/2)
+    # Merge queue, main and manual runs only (#420); pull requests run the Chromium/touch coverage shards.
+    if: github.event_name != 'pull_request'
     runs-on: ubuntu-latest
     # Layout comparisons depend on the fonts each browser falls back to, so browser jobs run in the
     # same pinned Playwright image as local runs (tag = @playwright/test in tools/vendor/package-lock.json;
@@ -209,7 +222,9 @@ jobs:
           key: npm-${{ runner.os }}-playwright-v1.64.1-${{ hashFiles('tools/vendor/package-lock.json') }}
       - run: npm ci --prefix tools/vendor --ignore-scripts
       - name: Page workflows in ${{ matrix.browser }}, shard ${{ matrix.shard }}/2
+        timeout-minutes: 18
         run: npm run --prefix tools/vendor test:workflows -- --project ${{ matrix.browser }} --shard ${{ matrix.shard }}/2
+      # Traces and the blob report (test-results/blob/) of a failed, timed-out or cancelled step.
       - name: Upload browser traces
         if: always()
         uses: actions/upload-artifact@v7
@@ -219,8 +234,9 @@ jobs:
           retention-days: 14
 
   # Branch protection requires the exact context "viewerjs". This job keeps that
-  # name and fails unless every frontend job above succeeded (every shard, the
-  # coverage merge and every browser shard), including when one was cancelled or skipped.
+  # name and fails unless every coverage shard and the coverage merge succeeded and
+  # the browser shards succeeded, or, on a pull request only, were skipped (#420).
+  # Any failure, cancellation or other skip fails it.
   viewerjs:
     needs: [frontend-coverage, frontend-coverage-merge, browser-workflows]
     if: always()
@@ -229,11 +245,15 @@ jobs:
     steps:
       - name: Require every frontend job to succeed
         env:
+          EVENT_NAME: ${{ github.event_name }}
           COVERAGE_RESULT: ${{ needs.frontend-coverage.result }}
           MERGE_RESULT: ${{ needs.frontend-coverage-merge.result }}
           WORKFLOWS_RESULT: ${{ needs.browser-workflows.result }}
         run: |
+          queue_only=success
+          if [ "$EVENT_NAME" = pull_request ]; then queue_only=skipped; fi
+          echo "event: $EVENT_NAME (browser-workflows must be $queue_only)"
           echo "frontend-coverage: $COVERAGE_RESULT"
           echo "frontend-coverage-merge: $MERGE_RESULT"
           echo "browser-workflows: $WORKFLOWS_RESULT"
-          test "$COVERAGE_RESULT" = success && test "$MERGE_RESULT" = success && test "$WORKFLOWS_RESULT" = success
+          test "$COVERAGE_RESULT" = success && test "$MERGE_RESULT" = success && test "$WORKFLOWS_RESULT" = "$queue_only"

README.md

@@ -56,7 +56,7 @@ Both nodes include the complete PromptManager feature set:
 - **📊 Analytics**: Track prompt usage patterns and effectiveness over time
 - **🔬 Workflow Analysis**: Extract and analyze ComfyUI workflow data from PNG images
 - **📋 Metadata Viewer**: Standalone tool for analyzing ComfyUI-generated images
-- **🛠️ System Management**: Built-in diagnostics, backup/restore, and maintenance tools
+- **🛠️ System Management**: Built-in diagnostics, backup/restore, and maintenance tools in System
 - **🏷️ AI AutoTag**: Automatically tag your image collection using WD14 or JoyCaption vision models
 - **🔗 LoRA Manager Integration**: Import LoRA metadata and preview images from [ComfyUI-Lora-Manager](https://github.com/willmiao/ComfyUI-Lora-Manager)
 
@@ -206,14 +206,11 @@ match Classic and Focused.
 - **Responsive Design**: Works on desktop, tablet, and mobile devices
 - **Real-time Search**: Instant search results as you type
 - **Bulk Operations**: Edit multiple prompts simultaneously with batch tools
-- **Settings Panel**: Configure behavior and display options
-- **System Management**: Complete toolset for database operations:
+- **Settings and System tools live in System**: the dashboard's **Settings** opens System › Overview, **Maintenance** opens System › Maintenance, **Backup DB** and **Restore DB** open System › Backup & export, and **Diagnostics** and **View Logs** open System › Diagnostics & logs, each in a new tab. System reviews every destructive operation before it runs it as an Activity job.
+- **Page options**: the list header's **Page options** keeps the prompt list's Infinite Scrolling default
+- **Dashboard tools**:
   - **🔍 Metadata Viewer**: Launch standalone PNG analysis tool
-  - **📸 Scan Images**: Bulk scan output directories for ComfyUI images
-  - **💾 Backup/Restore**: Database backup and recovery operations
-  - **🔧 Maintenance**: Database optimization and cleanup tools including orphaned prompt removal
-  - **📋 Logs**: Comprehensive logging system with download capability
-  - **🔍 Diagnostics**: System health checks and troubleshooting
+  - **📸 Scan Images**: Bulk scan output directories for ComfyUI images (with a quick backup first)
 - **Export Tools**: Download prompts and metadata in various formats
 - **Progress Tracking**: Real-time progress indicators for long operations
 - **Error Handling**: Graceful error display with recovery suggestions
@@ -315,6 +312,12 @@ Both nodes support the same metadata fields:
 
 Both nodes will automatically save prompts to the database and link any generated images to the prompt.
 
+- **Save to library** (`save_to_library`, on by default; "Save to library" in the Focused, Split and Pair editors):
+  turn it off while iterating and PromptManager ignores that node's runs. The prompt is not saved, the run is not
+  counted and its images are not linked (a scan skips them too), while the node's output is unchanged. Workflows
+  saved before this switch existed load with it on. If any PromptManager node feeding a sampler's positive input
+  has it off, none of that run's images are linked, because the image cannot show which sampler produced it.
+
 ### 🖼️ Using the Output-Wide Gallery
 
 The comprehensive gallery system provides complete access to all your ComfyUI output:
@@ -333,14 +336,11 @@ The comprehensive gallery system provides complete access to all your ComfyUI ou
 
 #### **⚙️ Gallery Settings**
 
-Configure your viewing experience in the settings panel:
+The gallery's **Settings** opens System › Appearance in a new tab: image quality, details on cards, collapsed viewer details, video autoplay/mute/loop, metadata loading and file paths are set there and apply to this page too.
 
-- **Display Settings**: Default view, items per page, grid columns, media info, infinite scrolling
-- **Performance Settings**: Image quality, lazy loading
-- **Video Settings**: Autoplay, mute by default, loop videos
-- **Thumbnail Management**: Generate optimized thumbnails for faster loading (runs on the configured worker threads; a run that stops at the per-run cap tells you how many remain)
-- **Find Duplicate Images**: Hashes every file on the worker threads with a progress bar; close the window and it keeps running, results wait in a pill
-- **Rescan Output Folder**: Drops the server-side listing cache and rewalks the folders
+The gallery's **Page options** keep the page's own settings: the thumbnail check at startup, lazy loading, items per page, grid columns, infinite scrolling, debug mode and API timeout. Reset puts back only these.
+
+Thumbnail generation, the server thumbnail and browser cache clears, refreshing the file listing and finding duplicate images are in System › Sources & scans and System › Maintenance (Page options links both); each runs as an Activity job you can follow after closing the page.
 
 #### **🖼️ Image Viewing Experience**
 
@@ -398,7 +398,7 @@ Import existing ComfyUI images into your database:
    - Any errors or issues encountered
 5. **Access imported data** through the normal gallery interface
 
-The scan reads PNG text chunks and A1111-style parameters, and, when `ffprobe` is installed, the prompt ComfyUI's video savers embed in MP4/MOV/WebM files. Files are read on the number of **worker threads** set in Settings → Performance (default: half your cores), which makes a large library several times faster.
+The scan reads PNG text chunks and A1111-style parameters, and, when `ffprobe` is installed, the prompt ComfyUI's video savers embed in MP4/MOV/WebM files. Files are read on the number of **worker threads** set in System › Sources & scans (default: half your cores), which makes a large library several times faster.
 
 ### 🏷️ AI AutoTag
 
@@ -414,7 +414,7 @@ Automatically tag your entire image collection using AI vision models:
 
 1. **AutoTag (Batch Mode)**: Tag your entire collection automatically
    - Click **"🏷️ AutoTag"** in the admin dashboard
-   - Choose your model type (FP16 or GGUF)
+   - Choose your model type (FP16 or GGUF). A model that is not downloaded yet shows **Manage in System**: download (or unload) it in System › Auto-tagging, then reopen the dialog
    - Select how to handle already-tagged images:
      - **Skip images with existing tags**: Preserve your meticulous manual tagging work
      - **Re-tag all images**: Overwrite existing tags with fresh AI analysis
@@ -445,7 +445,7 @@ Adjust the system prompt to match your tagging style:
 #### **Requirements**
 
 - Sufficient VRAM for the chosen model (FP16 requires more, GGUF is lighter)
-- Models are downloaded automatically on first use
+- Models are downloaded in System › Auto-tagging
 - Feature requests and improvements are welcome!
 
 ### 📁 Folder Filter
@@ -470,18 +470,18 @@ If you use [ComfyUI-Lora-Manager](https://github.com/willmiao/ComfyUI-Lora-Manag
 
 #### **Enabling the Integration**
 
-1. Open the admin dashboard and click **Settings**
-2. Scroll to the **Integrations** section — PromptManager will auto-detect if LoRA Manager is installed
+1. Open System › Integrations (the admin dashboard's **Settings** opens System)
+2. PromptManager auto-detects whether LoRA Manager is installed
 
 ![LoRA Enabled](images/pm-lora-enabled.png)
 
 3. Toggle the **LoraManager** switch to enable
 4. Optionally enable **Auto-inject trigger words** to automatically append LoRA trigger words when `<lora:name:weight>` is detected in your prompts
-5. Click **Save Settings** (requires a ComfyUI restart to take effect)
+5. Click **Save preferences** (requires a ComfyUI restart to take effect)
 
 #### **Importing LoRA Data**
 
-Click **Import LoRA Data** in the settings panel to start the import. A progress popup shows real-time status as each LoRA is processed:
+Click **Review import** in System › Integrations; Start runs the import as an Activity job:
 
 - Reads LoRA Manager's own settings the way LoRA Manager does: from the folder in `LORA_MANAGER_SETTINGS_DIR`, from the plugin's `settings.json` in portable mode, or from your user config folder, and only the keys that say where its files are
 - Finds each LoRA's metadata in both storage modes: beside the model (the default) or in the central sidecar folder, and imports only LoRAs whose model file still exists in a LoRA folder (the review says how many metadata files it skipped)
@@ -502,7 +502,7 @@ A CivitAI API key is **required if your library contains NSFW LoRAs** — CivitA
 
 To add your key:
 1. Get your API key from [civitai.com/user/account](https://civitai.com/user/account)
-2. Paste it into the **CivitAI API Key** field in the Integrations settings
+2. Paste it into the **CivitAI API key** field in System › Integrations
 3. Save and re-import to download any previously skipped images
 
 The key is sent only over HTTPS to CivitAI's own hosts. CivitAI serves images through a redirect to its storage host; PromptManager follows such a redirect only over HTTPS to a host on CivitAI's own `civitai.com`, `civitai.red` or `civitai.green` domains, at most three hops, and never sends the key with it. When downloads fail, the import's status line says how many; when none could be downloaded, it starts with a warning. The server log has one warning per failed image with the reason (HTTP status, refused redirect, size cap, unreadable image, timeout or network error).
@@ -517,23 +517,20 @@ The comprehensive web interface provides:
 - **Filter Options**: Filter by category, tags, rating, and date
 - **Bulk Operations**: Select multiple prompts for batch editing
 - **Export Tools**: Download your prompt collection
-- **Settings Panel**: Configure auto-save and display options
-- **Diagnostics**: System health checks and troubleshooting
+- **Settings**: System (new tab) for settings, maintenance, backups and diagnostics; **Page options** for the page's own display settings
 
 ### 🔧 Database Maintenance
 
-Keep your database optimized with built-in maintenance tools:
+Keep your database optimized in System › Maintenance (the admin dashboard's **Maintenance** opens it in a new tab):
 
-1. **Open the admin dashboard** and click **"🔧 Maintenance"**
-2. **Select maintenance operations**:
-   - **Remove Duplicates**: Find and merge duplicate prompts while preserving images
-   - **Vacuum Database**: Optimize database file size and performance
-   - **Clean Orphaned Images**: Remove image records for missing files
-   - **🚮 Prune Orphaned Prompts**: Remove prompts that have no linked images
-   - **Check Consistency**: Verify database integrity and relationships
-   - **Database Statistics**: Generate detailed database reports
-3. **Run selected operations** and monitor progress in real-time
-4. **Review results** showing detailed information about each operation
+- **Duplicate prompt text**: merge duplicate prompts while preserving images
+- **Optimize database**: reclaim unused SQLite space
+- **Missing-file links**: remove image records for missing files
+- **Unused prompt components**: remove prompts nothing uses
+- **Run health checks**: verify database integrity and relationships (the Health report)
+- **Database size and prompt counts**: System › Diagnostics & logs (Database) and the Overview's Statistics
+
+Each operation opens a review that shows what it will change and the safety backup it takes, then runs as an Activity job.
 
 ### Database Location
 
@@ -835,8 +832,8 @@ Before upgrading or changing this setting:
 1. Identify the database your current installation actually uses and confirm its
    library contents. Check both the configured path and the prior fallback
    `<extension>/prompts.db`; keep track of which existing file you intend to use.
-2. Preserve a consistent backup of the active database with the dashboard's
-   Backup/Restore backup action or SQLite's online backup API. Do not copy only
+2. Preserve a consistent backup of the active database with
+   System › Backup & export's Back up or SQLite's online backup API. Do not copy only
    the main file of a live SQLite database: committed data may still be in its
    `-wal` file. For a filesystem copy, stop ComfyUI cleanly first and preserve any
    remaining `-wal` file together with the main database.

TESTING.md

@@ -181,10 +181,12 @@ check, so run it before pushing a new or deleted frontend file instead of
 waiting for the `frontend coverage` jobs.
 
 The `viewerjs` check runs on every PR, including backend-only changes. It is an
-aggregate job that passes only when every frontend job succeeds: the three
-`frontend coverage (shard N/3)` jobs, `frontend coverage (merge)`, and the four
-`page workflows (firefox|webkit, shard N/2)` jobs. A failed, cancelled or skipped
-job fails it. Every browser job runs with `PM_TEST_WORKERS: 3` (the public
+aggregate job. It requires the three `frontend coverage (shard N/3)` jobs and
+`frontend coverage (merge)` to succeed on every event. The four
+`page workflows (firefox|webkit, shard N/2)` jobs run only in the merge queue,
+on `main` and on `workflow_dispatch` (see "Pull requests and the merge queue").
+`viewerjs` requires them to be skipped on a pull request and to succeed
+everywhere else. Any other failed, cancelled or skipped job fails it. Every browser job runs with `PM_TEST_WORKERS: 3` (the public
 runners have 4 vCPUs). Each coverage shard runs `test:coverage:shard -- N/3`
 (shard 1 also runs the node units and the viewer suite, shard 3 the vendor pins
 and tooling tests) and uploads its raw V8 files as `coverage-raw-N` (kept 3
@@ -260,6 +262,31 @@ watchdog dump, is a failure like any other: read the dump, find the blocking
 call, fix it. Never raise a limit or rerun to get green; a limit changes only
 with new measurements written next to it.
 
+Browser jobs (#425): GitHub keeps no log of a job killed at its limit and skips
+its upload steps, so the test step in each browser job in `viewerjs-check.yml`
+has its own `timeout-minutes` (18, below the job's 20). At the step limit
+GitHub sends SIGTERM, which would end Playwright without any report; under `CI`
+`tools/vendor/running-tests-reporter.mjs` catches the first one, prints
+`Still running when the run ended (SIGTERM): N` and one line per unfinished
+test (path relative to the suite's `rootDir`), then sends Playwright its own
+SIGINT, so the workers stop, the run ends interrupted and the blob report is
+written to `tools/vendor/test-results/blob/`. In the coverage job npm signals
+only `frontend-coverage.mjs`, which forwards SIGTERM and SIGINT to the child it
+is running (started in its own process group, so a group-wide signal still
+arrives once). Delivery is proven locally in the pinned image for a SIGTERM to
+the whole process group (`timeout -s TERM`). A SIGTERM to npm alone
+(`timeout --foreground`) reaches nothing: npm forwards it to the `sh -c` that
+runs the script, and that shell exits without passing it on. Delivery in CI,
+where the step runs through `docker exec`, is not yet observed; the next real
+step timeout will show it. That directory and the traces
+upload with `if: always()`; `npx playwright merge-reports` opens the blob.
+Each test keeps the 30 s default and there is no `globalTimeout`. Two limits
+of this: it assumes the npm cache hits (a cold cache adds up to 5 minutes to
+`npm ci`, and the job limit can then still win), and coverage shard 1 (12m53s
+measured) is the tight one in its 18-minute step. Local runs keep the `list`
+reporter only; reproduce with `CI=1 timeout -s TERM 40 npm run --prefix
+tools/vendor test:workflows -- --project=firefox`.
+
 ### After a push
 
 Follow the run for the commit you pushed, never an older one:
@@ -271,6 +298,13 @@ gh run view <run id> --json jobs                          # shows a job that alr
 gh run view --job <job id> --log-failed                   # that job's failed log, at once
 ```
 
+Python 3.13/3.14, real ComfyUI and Firefox/WebKit failures first show up in the
+merge queue, on the merge-group commit rather than the
+pushed one. Find that run with `gh run list --event merge_group --workflow test.yml`
+(or `viewerjs-check.yml`) and match its head branch
+(`gh-readonly-queue/main/pr-<N>-...`). Windows and macOS failures show up only
+after the merge, in `gh run list --workflow portability.yml`.
+
 Start fixing as soon as a failed log shows the cause, but push the fix only after
 the run for that commit has finished: pull-request runs use `cancel-in-progress`,
 so a push cancels the running jobs and can hide a second failure.
@@ -313,6 +347,26 @@ from the tests' package unload (`cleanup_package`), and it removes its own
 ComfyUI-Manager restart through `os.execv`, a closed Windows console, or
 ComfyUI Desktop stopping its server. SQLite's WAL journal covers those.
 
+Jobs running at exit (#376): before any `atexit` callback, Python joins every
+executor thread (`concurrent.futures` registers that join with
+`threading._register_atexit`). The package registers its own callback there
+(`utils/exit_signal.install`, after `concurrent.futures`, so it runs first):
+it sets the exit signal and kills the running encoder processes
+(`shutdown_encoders`, the ffmpeg that never sees Ctrl+C on Windows). The call in
+flight then stops at its next safe point: `Job.cancelled` is True, so every
+check a job already makes between files stops it, `map_parallel` starts no
+further item (`ExitRequested`), the scan walk stops between folders, LoRA
+import staging stops before its next sidecar (also for the legacy scan) and a
+tagging model download stops before its next chunk where huggingface_hub takes
+`tqdm_class` (1.x removes its temp file; 0.x `hf_hub_download` does not take it
+and finishes the file). Xet transfers ignore that checkpoint, so the hook also
+calls hub's own `abort_xet_session` when huggingface_hub is loaded. The
+trigger-word cache load (small JSON sidecars) has no checkpoint. No check sits
+inside a library write. That hook is
+CPython-internal; without it (or when it is refused) `install` returns False and
+exit waits for the call in flight, as before. `tests/test_exit_cancel.py` runs a
+child process with three such calls running and requires its exit within 15 s.
+
 Stop contract: `PromptTracker.shutdown(timeout)`,
 `ImageGenerationHandler.shutdown(timeout)` (restartable),
 `ImageGenerationHandler.close(timeout)` (final: `schedule()` refuses and a
@@ -362,6 +416,10 @@ A spec performance budget gets two tests:
   `test_filter_budget` (Images filters, spec D12: p95 < 150 ms at 50,000 files
   and 20,000 links).
 
+A hot SQLite read that returns many rows aggregates them into one step
+(`json_group_array`) instead of stepping once per row, so it does not wait for
+the GIL once per row while ComfyUI generates (#354, `get_image_link_matches`).
+
 The `perf budget` job in `.github/workflows/test.yml` is the reference
 measurement: `ubuntu-latest`, one Python, no coverage, only the wall-clock tests.
 It runs on every push to `main` and on `workflow_dispatch`, never on pull
@@ -519,29 +577,95 @@ Before changing paths, SQLite, streams, restore or cleanup:
   open with `FirstWriterHold`) and give peers that must all succeed the
   ordinary busy timeout; cross-thread handoffs wait on events with generous
   ceilings, never a short wall clock (#242).
-- Run native Windows CI early for these changes and include a Windows impact and
-  evidence note in the PR. All twelve OS/Python combinations and every applicable
+- Run native Windows CI early for these changes. Pull requests and the merge
+  queue run only Linux, so start Windows and macOS on the branch with
+  `gh workflow run portability.yml --ref <branch>`.
+  Include a Windows impact and evidence note in the PR. All six Windows/macOS
+  combinations in that run, every Linux leg and every applicable
   exact-head check must pass before merge. Portable `ntpath`/`PureWindowsPath`
   controls do not establish native filesystem, locking or cleanup success.
 
+## Pull requests and the merge queue
+
+Each PR runs the full matrix once, in the merge queue (#420). The event decides
+what runs:
+
+| Job | `pull_request` | `merge_group`, push to `main`, `workflow_dispatch` |
+| --- | --- | --- |
+| `py3.12 on ubuntu-latest` | runs | runs |
+| `py3.13 on ubuntu-latest`, `py3.14 on ubuntu-latest` | not created | run |
+| `real ComfyUI compatibility` | skipped | runs |
+| `coverage gate (85%)`, `black and flake8`, `frontend modules`, `bandit (high severity)` | run | run |
+| `frontend coverage (shard N/3)`, `frontend coverage (merge)` (vendor pins and tooling tests on shard 3) | run | run |
+| `page workflows (firefox\|webkit, shard N/2)` | skipped | run |
+| `all tests`, `viewerjs` (gates) | run | run |
+| `perf budget` | skipped | push and dispatch only (not in the queue) |
+| `py3.12-3.14 on windows-latest/macos-latest` (`portability.yml`) | not run | push to `main`, nightly, `workflow_dispatch` only; never required |
+
+GitHub has one required set for pull requests and the queue. A job skipped by
+its `if:` reports Success. A dropped matrix leg never reports, so it would stay
+pending. That is why `all tests` (in `test.yml`) and `viewerjs` carry the
+guarantee:
+- On a pull request they require the subset to succeed and the queue-only jobs
+  to be skipped.
+- On every other event they require every job to succeed.
+
+So a merge group cannot turn green unless all three Linux Python legs, real
+ComfyUI and the four browser shards passed.
+
+Windows and macOS (Python 3.12-3.14) are out of the blocking path for now
+(maintainer, 2026-10-28). They run in `portability.yml` on every push to `main`,
+nightly and on demand, and no context there is required. A red portability run
+is still a failure: fix it at its cause, not by rerunning, and have every one
+green before the workspace cutover (#334). `tests/vendor/ci-workflow.test.mjs` pins the
+event split and runs both gate scripts for each event.
+
 ## Required merge checks
 
-`.github/branch-protection.json` records the required checks: all twelve Python/OS
-combinations, Python coverage, formatting, frontend modules, `viewerjs`, `real ComfyUI compatibility`,
-and `bandit (high severity)`.
-The branch must be current with main, and administrators follow the same checks.
+`.github/branch-protection.json` records the required checks:
+`py3.12 on ubuntu-latest`, `coverage gate (85%)`, `black and flake8`,
+`frontend modules`, `all tests`, `viewerjs`, `real ComfyUI compatibility` and
+`bandit (high severity)`. Each one reports on a pull request.
+The same set lives in two places, and both must change together: the `main`
+ruleset (25960526, which also holds the merge queue) and the classic branch
+protection on `main`, which the manifest mirrors. GitHub requires the union of
+the two, so a context left in either one blocks every PR that does not report it.
 It does not require an additional human approval.
 
 A repository administrator applies the configuration after the new workflow is
 passing, then verifies it:
 
+```sh
+gh api repos/ComfyAssets/ComfyUI_PromptManager/rulesets/25960526 \
+  | jq '.rules[] | select(.type == "required_status_checks") | [.parameters.required_status_checks[].context]'
+```
+
+A PUT replaces the whole `rules` array, so edit the current ruleset in place.
+Keep the `deletion`, `non_fast_forward` and `merge_queue` rules, and give every
+context `integration_id` 15368 (GitHub Actions), so no other integration can
+post a required check. Save the current ruleset first; it is the rollback:
+
+```sh
+gh api repos/ComfyAssets/ComfyUI_PromptManager/rulesets/25960526 > ruleset-before.json
+jq '{name, target, enforcement, conditions, bypass_actors, rules: [.rules[]
+     | if .type == "required_status_checks"
+       then .parameters.required_status_checks = [$ARGS.positional[] | {context: ., integration_id: 15368}]
+       else . end]}' ruleset-before.json --args "py3.12 on ubuntu-latest" "..." > ruleset-new.json
+gh api --method PUT repos/ComfyAssets/ComfyUI_PromptManager/rulesets/25960526 --input ruleset-new.json
+```
+
+Afterwards, read it back. Check that the `merge_queue` rule is still there and
+that every context keeps its `integration_id`. Then apply the manifest to the
+classic protection and read both back:
+
 ```sh
 gh api --method PUT repos/ComfyAssets/ComfyUI_PromptManager/branches/main/protection \
   --input .github/branch-protection.json
 gh api repos/ComfyAssets/ComfyUI_PromptManager/branches/main/protection/required_status_checks
+gh api repos/ComfyAssets/ComfyUI_PromptManager/rules/branches/main
 ```
-
-Update the manifest whenever required job names change. Keep the frontend check
+ Update the manifest whenever
+required job names change. Keep the frontend check
 free of path filters so a required check is never silently skipped.
 
 ## Unified workspace
@@ -794,6 +918,25 @@ unattributed stage, when it is a plain first stage: not a detailer, no prompt ov
 set, and no listed sampler in its own latent ancestry (else it stays unattributed) (`tests/test_resolver_saver_anchor.py`, shapes in
 `tests/saver_anchor_graphs.py` from the maintainer's `gpu_unlock_bench`, dataset and
 ANIMA runs; browser parity through the `anchor-*` cases, which carry `__file_name`).
+Recorded run history (#386): both inspect routes (Images and a history occurrence)
+ask `database.run_attribution.recorded_output` inside the file's stat window. It
+answers only for a file that exactly one recorded run reported and that was written
+during that run (the #342 rules): the one output node that run reported it from (none
+when several did) and, per sampler anchor, the effective texts PromptManager recorded
+at execution (a role only inferred from the graph is none). Only when the file alone
+leaves the prompt open (`ambiguous` or `unresolved`) the inspector resolves again
+anchored on that node (`recorded_saver_id`, walked like a file-name match; a file
+name naming a different saver contradicts history and anchors nothing), and keeps
+that result only when history's saver chose its samplers (`recorded_anchor`) and it
+names the positive (resolved, or a guider with no negative); its `graph-inferred`
+sides read `recorded-run` ("Recorded run" badge, ranked below every "Workflow
+inferred" source). Still open at the one sampler that saver leads to, with that
+sampler's positive text recorded (a language model's output feeding PromptManager),
+the recorded texts show as `execution`. Outputs and texts are read in one
+transaction. A result the file resolves alone never changes; a lookup failure is
+logged and judges the file alone; local Inspect and ingestion are unchanged
+(`tests/test_recorded_saver_anchor.py`, `tests/test_run_attribution.py`,
+`tests/test_api_history_outputs.py`).
 
 `tools/inspection_corpus.py --root DIR --out JSONL [--workers N] [--baseline JSONL]
 [--summary TXT] [--code TREE]` measures a media folder read-only against the #240
@@ -1226,7 +1369,7 @@ How the earlier workspace Images filters moved (old → new). The legacy `/galle
 | Folder | "Refine this view" → Folder (D14); shown in the scope chip |
 | Media (All media / Images / Videos) | "Refine this view" → Media (D14) |
 | Sort: Newest first / Oldest first / Filename A–Z / Filename Z–A | toolbar sort: Recently added / Oldest first / Name A–Z / Name Z–A, plus Highest rated (D13, D14) |
-| (none) | toolbar category and "Refine this view" → Tags, through the linked positive (D13, D14) |
+| (none) | toolbar category (the effective category, D141) and "Refine this view" → Tags, through the linked positive (D13, D14) |
 | Refresh | Import → "Scan an output folder" → Rescan (D15) |
 | Grid / List / Masonry, Comfortable / Large / Compact | the same choices in the concept filter row |
 | Card image → side panel; preview icon → viewer | image → viewer; Info → side panel (D19) |
@@ -1309,7 +1452,8 @@ Recorded deviations on this page (spec §8):
   `overscroll-behavior: contain`.
 - **D35**: counts pluralize ("1 positive prompt", "1 image", "1 more image loaded").
 - **D36**: the category list is the Library's, sorted alphabetically (case-insensitive)
-  by the page, whatever order the server sends.
+  by the page, whatever order the server sends (amended by D141: Images adds its
+  image categories).
 - **D37**: production loads 40 images per page (the concept 12), so the continuation
   and toast use 40; after Escape production returns focus to the opening image.
 - **D44** (#249 PR E): Filters reads "Filters · N" while N of Source, Folder, Media and
@@ -1395,15 +1539,46 @@ Recorded deviations on this page (spec §8):
 - **D39** (ruled 2026-10-21: fallback): a recipe-linked image shows its recipe's own
   category when set, otherwise the linked positive prompt's, and its recipe's own tags
   when it has any, otherwise the positive's; each field falls back on its own and the
-  two tag sets are never merged. Set category (#259) writes the positive's category and
-  the Images category and Tags filters match the positive's, so the panel now agrees
-  with them whenever the recipe adds nothing. The inspection response names each
+  two tag sets are never merged. The Images Tags filter matches the positive's tags.
+  The category filter matches the same inherited category as the panel (D142, #332), and
+  an image's own category overrides both (D141, D146). The inspection response names each
   field's source (`library.category_scope`, `library.tags_scope`: `pair`, `positive` or
   null); the category chip's visually hidden prefix (D21) says "Recipe category: " or
   "Positive prompt category: " from it, and tag chips are Tags filter buttons only when
   they are the positive's (#260 D2). History's media inspector uses the same rule. The
   concept shows the prompt's category and tags for every image and the concept
   fixture's recipes have neither, so the inspector comparison needs no mapping for it.
+- **D141** (#332, amends D13 and D36): the Images category filter matches each image's
+  effective category: its own category (Images Set category, PR 3) when it has one,
+  else its inherited one (D142), else none. An image whose own category differs never
+  matches its prompt's category, and an unlinked or ambiguous image with an own
+  category is listed under it (the members-only gate now applies to the Tags filter
+  only). "Select all N matching" and saved views use the same value. The caption's
+  positive-prompt count still counts the linked positives of the images shown. With a
+  category set the listing reads the own categories once per source (a primary-key
+  range); a failed read is the existing 500 `listing-failed`, never an unfiltered page.
+  The link read then keeps only links whose raw recipe or positive category is the
+  value (a superset of those that inherit it; Python decides), and reads the links of
+  files whose own category is the value by path, so their rating and positive count.
+  `test_filter_budget` seeds 2,000 own categories on its 50,000-file fixture.
+  The option list adds the image categories of listed files
+  (`GET /prompt_manager/images/categories`, PR 3).
+- **D142** (#332 MC4, amends D39's filter note): the inherited category is one rule,
+  `inherited_category` in `utils/inspection_response.py`: a linked recipe's own
+  category when it is not blank, else the linked positive's. Before #332 the filter
+  matched the positive's even when the chip showed the recipe's. The link reads select
+  the raw recipe and positive categories and never decide inheritance in SQL
+  (`tests/test_api_workspace_image_categories.py` checks the filter and the chip agree
+  on blank values stored as spaces, tabs, U+00A0 and BLOB). The concept has no recipe
+  categories, so this is behavior only.
+- **D145** (#332, DC4): History's media inspector shows an image's own category with
+  the chip rule of the side panel and viewer. Only the inspection request reads it, once,
+  inside the History snapshot: the file is the symlink-resolved output folder plus the
+  receipt's subfolder and filename, keyed with `image_category_key` over the configured
+  output sources, as Images keys it. A temp output or a file no source holds has none;
+  a failed read hides the chip (DC5). The outputs list and media requests read nothing
+  new. The chip's hidden prefix reads "Image category: " for an own category; the
+  visible origin text and its comparison are D146 (PR 3).
 - **D42**: the concept never shows a toast and a page alert together. Production keeps
   the concept's fixed toast (centred, 22px from the bottom, 12px at 700px and below)
   and, when an Import → Rescan toast leaves the Images discovery alert
@@ -2439,6 +2614,14 @@ production hub `#/overview` is unchanged (D28); its System card opens
 the pressed section button and disposes the previous section's scope, so its reads,
 listeners and dialogs never outlive it.
 
+System is the home for settings and maintenance (#330 System S13). The legacy pages keep
+their prompt list, tags, Scan Images, auto-tag batch and review and gallery browsing; their
+Settings, Diagnostics, View Logs, Maintenance, Backup DB, Restore DB, the gallery's
+thumbnail, cache, rescan and duplicate tools and the auto-tag model downloads open the
+System section that owns them in a new tab (`legacy-system-links.spec.mjs`). Each page
+keeps only its own settings in Page options. What left the legacy pages is listed in
+"Legacy System UI removed by S13".
+
 Drafts (`system-state.mjs`) live for the page session (Q10). Save writes the dirty
 browser fields, then the host fields (`POST /prompt_manager/settings` with
 `expected_revision`, #220), then the runtime fields. A failed domain keeps its drafts and
@@ -4053,6 +4236,9 @@ auto-tag / review", which the Images selection bar owns, not a System section. A
 is not `covered` names none (`—`). Test is the exact title of a test that runs, then its
 file. Anchors are line numbers on `main` at this PR.
 
+S13 (#330) removed the legacy copy of the `covered` rows the legacy pages linked to System;
+"Legacy System UI removed by S13" below lists every removed element against its row.
+
 `tests/vendor/legacy-coverage.test.mjs` fails on a row with any of these problems:
 - no owner, or a status outside the three;
 - a malformed Native control cell;
@@ -4133,7 +4319,11 @@ opens `workspace#/system/<id>` in a new tab) and removes the legacy copy of a ca
 only when its row above is `covered`. One row per removed capability: Capability is the
 exact Capability cell of its coverage row, Page is `admin` or `gallery`, Removed ids and
 Removed methods list what went (`—` for none), and Native test copies that row's Test
-cell. An id that stays on a System link is not listed, only its handler.
+cell. An id that stays on a System link is not listed, only its handler. The gallery's
+Default View Mode left Page options too: System › Appearance's Default layout is the one
+default-layout control. Nothing writes the legacy `defaultViewMode` any more; a stored
+value still picks the view the legacy gallery opens in (grid otherwise), and Page options
+Save and Reset keep it.
 
 `tests/vendor/legacy-coverage.test.mjs` fails when a row cites a capability that is not
 `covered` or copies another test, when an id or method is listed twice for one page, or
@@ -4152,6 +4342,31 @@ legacy page workflows), not by this check.
 | Log files list and download | admin | `#downloadLogsBtn`, `#logFilesList` | `loadLogFiles()`, `downloadLogs()`, `downloadLogFile()` | each listed file downloads by its returned name and a link has no Download (workspace-system-diagnostics.spec.mjs) |
 | Clear/truncate logs | admin | `#clearLogsBtn` | `clearLogs()` | Clear all logs states both counts, confirms first and reads everything again (workspace-system-diagnostics.spec.mjs) |
 | Set log level (incl. CRITICAL), console logging | admin | `#updateLogConfigBtn`, `#setLogLevel`, `#consoleLogging` | `loadLogConfig()`, `updateLogConfig()` | runtime level (including CRITICAL) and console logging save and say they apply until the server restarts (workspace-system-diagnostics.spec.mjs) |
+| Image scan directories add/remove | admin | `#scanPathsList`, `#addScanPathBtn` | `renderScanPaths()`, `addScanPath()`, `removeScanPath()`, `_collectScanPaths()` | Add source validates on the server, then marks the host draft dirty; Save persists (workspace-system-sources.spec.mjs) |
+| Currently monitoring list + Refresh | admin | `#refreshMonitoringStatus`, `#monitoringStatus` | `updateMonitoringStatus()` | watching only with a live observer; restart pending otherwise (workspace-system-sources.spec.mjs) |
+| Search results auto-hide `result_timeout` | admin | `#resultTimeout` | — | host fields round-trip through /settings with revision (workspace-system.spec.mjs) |
+| Web UI display mode | admin | `#webuiDisplayMode` | — | host fields round-trip through /settings with revision (workspace-system.spec.mjs) |
+| Worker threads | admin | `#workerThreads`, `#workerThreadsValue` | `renderWorkerThreads()` | worker range max is cpu_count (workspace-system-sources.spec.mjs) |
+| LoraManager badge, enable, path, trigger words, CivitAI key, clear key | admin | `#loraDetectionBadge`, `#loraEnabled`, `#loraSettings`, `#loraManagerPath`, `#loraTriggerWords`, `#civitaiApiKey`, `#clearCivitaiKey` | `detectLoraManager()`, `_bindLoraEvents()`, `saveLoraSettings()` | LoRA rows show detected / enabled / cache-loaded separately (workspace-system-integrations.spec.mjs) |
+| LoRA data import with progress | admin | `#loraImportModal`, `#loraImportBtn`, `#loraImportStatus`, `#loraImportPercent`, `#loraImportBar`, `#loraImportProcessed`, `#loraImportImported` | `runLoraImport()` | Review import shows replacement, blocked items and network effects with the backup box; Start opens the job (D107) (workspace-system-integrations.spec.mjs) |
+| Maintenance cleanup_duplicates, vacuum, cleanup_orphaned_images, prune_orphaned_prompts | admin | `#maintenanceModal`, `#cleanup_duplicates`, `#vacuum`, `#cleanup_orphaned_images`, `#prune_orphaned_prompts`, `#runMaintenanceBtn`, `#maintenanceResults` | `showMaintenanceModal()`, `closeMaintenance()`, `runMaintenance()`, `renderMaintenanceResults()` | Apply reviewed operation closes, toasts, opens the job in Activity (workspace-system-maintenance.spec.mjs) |
+| Maintenance check_hash_duplicates, check_consistency | admin | `#check_hash_duplicates`, `#check_consistency` | — | Run health checks opens Health report and updates metric 4 (workspace-system.spec.mjs) |
+| Maintenance statistics (database info) | admin | `#statistics` | — | meta-grid shows real database and source status, the pinned Viewer.js version and the host renderers (workspace-system-diagnostics.spec.mjs) |
+| Maintenance select all / clear all / run | admin | `#selectAllMaintenanceBtn`, `#clearAllMaintenanceBtn` | `selectAllMaintenance()`, `clearAllMaintenance()` | plan dialog shows the server's scope, protected, backup policy and media lines with the backup box (D100); Cancel writes nothing (workspace-system-maintenance.spec.mjs) |
+| Database backup | admin | — | `backupDatabase()` | Back up downloads through the api client and revokes the object URL (D103) (workspace-system-backups.spec.mjs) |
+| Restore from file | admin | `#restoreModal`, `#restoreFileInput`, `#confirmRestore`, `#cancelRestore` | `showRestoreModal()`, `confirmRestore()` | Review restore stages the chosen file and shows the real summary with the backup box (D105) (workspace-system-backups.spec.mjs) |
+| Gallery thumbnail generation | gallery | `#generateThumbnailsBtn`, `#thumbnailStatus`, `#thumbnailProgress`, `#progressText`, `#progressPercent`, `#cancelThumbnailsBtn`, `#progressBar`, `#progressDetails`, `#progressETA` | `generateThumbnails()`, `generateThumbnailsWithProgress()` | Start closes the dialog, toasts, and opens the job in Activity (workspace-system-sources.spec.mjs) |
+| Default view mode, image quality | gallery | `#defaultViewModeSelect`, `#imageQualitySelect` | — | defaults apply to a new visit but not to the current view or a saved view (workspace-system.spec.mjs) |
+| Image info on cards; sidebar collapsed | gallery | `#showImageInfoToggle`, `#sidebarCollapsedByDefaultToggle` | — | added rows reach their consumers (workspace-system.spec.mjs) |
+| Video autoplay, mute, loop | gallery | `#videoAutoplayToggle`, `#videoMuteToggle`, `#videoLoopToggle` | — | video defaults reach the viewer (workspace-system.spec.mjs) |
+| Auto-load metadata, cache metadata, show file paths | gallery | `#autoLoadMetadataToggle`, `#cacheMetadataToggle`, `#showFilePathsToggle` | — | metadata off shows an explicit load and loads once on request (workspace-system.spec.mjs) |
+| Browser cache clear | gallery | `#clearCacheBtn` | `clearCache()` | Metadata cache reviews and clears only owned browser entries when there are some (D102) (workspace-system-maintenance.spec.mjs) |
+| Clear server thumbnails | gallery | — | — | Thumbnail cache opens the S5 dialog (workspace-system-maintenance.spec.mjs) |
+| Refresh file listing | gallery | `#rescanFolderBtn` | `rescanFolder()` | Refresh files calls /gallery/rescan and toasts its counts (workspace-system-sources.spec.mjs) |
+| Duplicate image scan, review, delete | gallery | `#scanDuplicatesBtn`, `#dupScanPill`, `#dupScanPillText`, `#duplicatesModal`, `#closeDuplicatesBtn`, `#duplicatesScanStatus`, `#dupProgressText`, `#dupProgressBar`, `#duplicatesContent`, `#duplicatesList`, `#duplicatesFooter`, `#duplicatesCount`, `#selectAllBtn`, `#removeDuplicatesBtn` | `scanDuplicates()`, `attachDuplicateStream()`, `resumeDuplicateScan()`, `applyDuplicateEvent()`, `renderDuplicateProgress()`, `setDuplicateButton()`, `showDuplicatePill()`, `hideDuplicatePill()`, `openDuplicatesModal()`, `showDuplicatesModal()`, `hideDuplicatesModal()`, `displayDuplicates()`, `selectAllDuplicates()`, `removeDuplicates()` | Find duplicates starts a job; its view links Review groups; Keep radios build a duplicate_files plan (D101) (workspace-system-maintenance.spec.mjs) |
+| Auto-tag model download | admin | `#autoTagDownloadModal`, `#downloadModelName`, `#downloadStatus`, `#downloadProgressPercent`, `#downloadProgressBar`, `#cancelDownloadBtn` | `downloadModel()`, `cancelDownload()` | Download starts the job and Activity shows it without Cancel (workspace-system-tagging.spec.mjs) |
+| Auto-tag model download | gallery | `#autoTagDownloadModal`, `#downloadModelName`, `#downloadStatus`, `#downloadProgressPercent`, `#downloadProgressBar`, `#cancelDownloadBtn` | `downloadModel()`, `cancelDownload()` | Download starts the job and Activity shows it without Cancel (workspace-system-tagging.spec.mjs) |
+| Unload model | gallery | — | `unloadModel()` | Unload is enabled only while a model is loaded, and a held gate's refusal names the operation (workspace-system-tagging.spec.mjs) |
 
 ### Browser cache ownership (#222)
 
@@ -4170,17 +4385,15 @@ page writes a key that is neither a preference nor inventoried, writes one it ca
 CacheStorage or IndexedDB; `the storage scan reports every way of writing browser
 storage` pins those patterns. It skips `web/lib` (third-party builds) and the pinned
 Toolkit build (`web/js/shared/toolkit`, never hand-edited, verified by `npm run check`;
-its storage belongs to the Toolkit repository and a new pin is reviewed on its own). The
-gallery's server thumbnail clear stays its own request and runs first: refused or
-unreachable, it changes nothing and says so (the old code toasted success when the
-request failed); refused browser storage is reported, never hidden
-(`tests/js/legacy-refusals.test.js`; the browser case `the gallery cache clear keeps
-preferences and other tools caches` in `workflows.spec.mjs`).
+its storage belongs to the Toolkit repository and a new pin is reviewed on its own). Since
+System S13 (#330) the legacy gallery no longer offers Clear cache: System › Maintenance's
+Metadata cache and Thumbnail cache reviews own both parts (removal table above), and
+`cache-ownership.js` serves the native review.
 
-The legacy duplicates dialog's View Full now names its source (`?root=<index>`, with the
-path URL-encoded) when the gallery's output folder is a listed source; before, the serve
-route opened the first source holding a file at that path
-(`test_view_full_names_the_gallery_folder_source`).
+The duplicates dialog's View Full named its source (`?root=<index>`, with the path
+URL-encoded) when the gallery's output folder is a listed source
+(`test_view_full_names_the_gallery_folder_source`); S13 removed the legacy dialog, and the
+route keeps that behaviour for System › Maintenance's duplicate review.
 
 ### Library location contract (#249 System S6b)
 
@@ -4472,8 +4685,18 @@ Filters (`mode=workspace`; anything invalid is 400 "Invalid gallery filters"):
   rating 5 to 1, then linked but unrated, then unlinked and ambiguous; ties break
   newest first. A signed cursor covers every filter and the sort, so reusing it
   with a change is 400.
-- One link read (`get_image_link_matches`, streamed and bounded to the listed
-  paths) serves the filters, the rating sort and the count.
+- One link read (`get_image_link_matches`) serves the filters, the rating sort
+  and the count. SQLite returns its rows as one JSON value in one step (#354):
+  Python's `sqlite3` releases and retakes the GIL around every step, and while
+  ComfyUI generates each retake can wait on the busy thread, so a read that
+  stepped once per linked row took seconds. The result keeps only the listed
+  paths; peak memory grows with the database's matching linked rows (about
+  530 bytes each, freed on return). When the JSON step fails (a SQLite without
+  JSON functions, a BLOB value, a JSON text over SQLite's length limit) the read
+  streams the rows as before and logs one warning per process; a missing JSON
+  function stops the attempt for the rest of the process. An interrupted read
+  (Move library) raises as before. `tests/test_database_link_matches.py` proves both reads
+  equal on every filter and on odd values.
 
 `positive_count` is the number of distinct linked positives over the full matching
 set, not the page:
@@ -4524,6 +4747,70 @@ concept fixture stars the concept's favorites (each other prompt's first image).
   restore. Old backups without the table restore, and backup plus restore keeps
   WAL-resident favorites and closes every handle (`tests/test_database_backup.py`).
 
+Image categories (#332, store and routes): an image file may carry its own
+category; without one it shows the category its link supplies.
+
+- The table is `image_categories(root_key, relative_path, category, updated_at)`
+  with primary key `(root_key, relative_path)` and the index
+  `idx_image_categories_category`. `migrate_image_categories` creates both empty
+  inside a savepoint, with no backfill. It reads only `sqlite_master` and its own
+  table's PRAGMAs, and writes only its two objects. `tests/test_image_categories.py`
+  checks this with an SQLite authorizer on a 23,000-link library, and checks that
+  `prompts` and `prompt_pairs` `(id, category, updated_at)` are byte-for-byte equal
+  afterwards.
+- The **file key** is `image_category_key(sources, absolute path)` in
+  `py/api/images.py`: the deepest output source that contains the path (compared
+  lexically, never resolving the path, so a symlinked subfolder keeps its listed
+  spelling) and the path below it, keyed with the favorites helpers. A source
+  matches by its real path or its configured spelling (a detected output folder
+  can be a symlink). Without nested sources it equals a favorite's key. Every write and read uses it. A path
+  that no source contains has no key, so it has no own category.
+- `image_categories_schema_error` checks the structure at startup (a value saved
+  under older rules never stops the library opening; a table without its index,
+  which this code never leaves, is repaired by the install). Restore also checks the
+  values: text columns, keys within the favorites bound, `category` 1 to 100
+  characters with no character below U+0020 and no leading or trailing space, and
+  `updated_at` of at most 64 bytes. Backups made before #332 restore without the
+  table; a migrated restore stage must have it (`require_library_state`).
+- `PUT /prompt_manager/images/category` `{items, category}` answers
+  `{success, category, updated, unchanged, not_found}`.
+  `DELETE /prompt_manager/images/category` `{items}` answers `{success, cleared}`.
+  `GET /prompt_manager/images/categories` answers `{success, categories}`: the
+  sorted distinct own values whose file is in some source's listing.
+- `items` are 1 to 500 Images targets `{root_index, root_scope, path}`, checked by
+  `py/api/media_target.py` (shared with Collections, #331). Refusals:
+  - 400: a malformed body, a field other than `items` and `category`, a
+    `root_index` outside the output sources (a LoRA folder), or a category that is
+    blank after stripping, over 100 characters, or holds a control character;
+  - 403: traversal, a drive, a backslash, a non-media name ("Only media files can
+    have a category") or a key over the stored bound;
+  - 409 `source-changed`: a stale `root_scope`;
+  - 413: a body over 1 MiB.
+  Any invalid item fails the whole request before a write. Targets that fold to one
+  key are written and counted once. Instead of `items` a request may send `filter`,
+  the Images listing's own query ("Select all N matching", #392, keys as in
+  `parse_listing_filter`), resolved now: over 500 matches is a 400
+  `too-many-images` ("Select at most 500 images."), a renumbered source a 409
+  `source-changed`.
+- PUT writes only files the source's listing holds and counts the rest in
+  `not_found`; when none is listed it answers 404 `files-not-found` and writes
+  nothing. A file that already has the value counts as `unchanged` and keeps its
+  `updated_at`. DELETE accepts any well-formed target, so a missing file's
+  category can still be removed. An unexpected failure is a logged 500 ("The
+  category could not be changed." / "Image categories could not be read.") without
+  the exception text. The routes never read or write `prompts`, `prompt_pairs` or
+  `generated_images`; `POST /prompt_manager/bulk/category` is unchanged.
+- Duplicate cleanup (System › Maintenance): the kept copy's own category wins. A
+  kept copy without one receives the removed copy's (`COPY_SQL`, part of the
+  cleanup's query-plan check). The removed copy's row is never deleted, so a
+  give-back (the kept copy changed) and a failed delete lose nothing. The job log
+  says "Kept N image categories on the kept copies".
+  `tests/test_duplicate_image_categories.py` covers nested sources in both orders.
+- A moved, renamed or deleted file's row stays and is hidden; a file that later
+  appears at the same path shows it. The real-host check is the last test in
+  `tests/comfyui/image-attribution.spec.mjs`: PUT, list, DELETE on a generated
+  output.
+
 Image annotations schema (#249, `database/annotation_schema.py`): the group
 `media_annotation_metadata` (one row: schema version, `image_index_revision`),
 `media_annotation_files` (one private locator per physical file,
@@ -4987,6 +5274,75 @@ same as a file the scan could not attribute, so the file stays on disk and in th
 gallery as unlinked, and its favorite and tags (kept by file) are untouched. Every
 run prints this. Queue-linked batch images can't be proven after the fact and read
 `unlink`, so review before applying. Stop ComfyUI first.
+
+### Foreign workflows (#247): the shared per-file decision
+
+The output scan decides each file through `utils/file_prompt.py`
+(`decide_file_prompt`, the ladder), which the monitor will share for outputs of
+workflows without a PromptManager node. It does no file or database I/O.
+
+- **Save to library (#90).** Before anything else, a file whose PromptManager
+  node had Save to library off is `not_saved`, and one whose switch is wired
+  from a node the file cannot show is `not_saved_wired`: nothing is written, no
+  recorded-run fallback, no Needs review item. A resolved pair whose negative's
+  node is off stores the positive alone (source `opted-out-negative`). The
+  #90 graph walk follows only prompt-like inputs, so the ladder also walks
+  every input upstream of each sampler or guider positive (not negative, model,
+  clip, latent or image inputs; every PromptManager node of a graph without a
+  sampler) and checks the text later steps name: a resolved or inspected
+  positive whose path passes such a node (`side_opted_out`), or a legacy answer
+  that is such a node's text (resolved, else literal). A switch that is off
+  makes the file `not_saved`; one wired from a node the graph cannot read makes
+  it `not_saved_wired`, as #90's direct check does.
+- **Order.** The default profile decides first, exactly as before (resolved
+  pair, A1111, sampler-less). Only a graph it leaves ambiguous or unresolved
+  reaches the inspector's resolve (`inspection_resolution` in
+  `utils/prompt_inspector.py`, the inspection profile, then the recorded saver
+  anchor of #386; `name_anchor=False`: the file-name anchor never decides a
+  link; the scan's legacy floor may still link the file, as before #247, and a
+  file nothing links is queued with the anchor's choice per #390), and only that positive's `storage_text` is stored (never
+  prepend or append text, never `recorded_texts`). Then the #170 browser parser
+  (`graph_prompt_text`), the legacy floor, then the recorded run's stored
+  prompt. The legacy answer is refused when a PromptManager-family node has a
+  prepend or append part and the answer is not that node's own `text` (the
+  parser joins the parts, so the stored text cannot be told from it). History is asked once per file and only at that step; the scan's
+  batch lookup stays lazy and makes one `recorded_runs` pass for the stored
+  prompt and the saver (`_BatchHistory`).
+- **Policies.** `SCAN` keeps the legacy floor for every undecided file.
+  `MONITOR` waits for history inside the output folder (`history`) and stores
+  nothing for a file the inspector calls ambiguous; an untraceable or
+  malformed one still gets the legacy floor.
+- **Junk.** `junk_text` refuses `blank`, `number` (the #252 `_numeric` rule),
+  `lora-only` (only `<lora:...>` tags and separators) and `model-file` (one
+  token ending in a model extension) at whichever step found the text and
+  nothing later is tried; the file reports `found`, except at the undecided
+  graph step, which keeps its own status (an ambiguous file is still queued).
+- **One prompt per file.** `database/scanned_prompts.py` stores a positive in
+  one `BEGIN IMMEDIATE` transaction: a file already linked to another prompt
+  (either spelling, `file_link_rows`/`link_conflict`, the pair ingester's rule)
+  is `conflict` and nothing is written; a failed link rolls the new prompt back
+  (`found`); two writers of one text store one prompt. A recorded run's stored
+  prompt links the same way (`link_stored_prompt_or_raise`). A rescan therefore
+  never adds a second link to a file an older scan linked to the legacy answer;
+  the row reads "Kept: already linked to a different prompt". Link rows are
+  matched under the path and its `realpath` spelling (`file_link_rows`), so a
+  file the scan stored through the resolved folder is found when it arrives
+  through a symlinked or junction folder. The reverse order (a row stored under
+  the watcher's raw spelling, then a scan whose root resolves differently) is
+  matched only when that raw spelling equals the realpath. Every scan write
+  runs through `survive_library_switch`, so a library move reruns it.
+- **Marks.** Every prompt ingestion creates, pair components included, carries
+  category `scanned`, tag `auto-scanned` and the note `Auto-scanned from
+  <file>` (`SCAN_MARKS`); a reused prompt keeps its fields. Run counts are
+  never touched.
+
+Tests: `tests/test_file_prompt.py` (one test per ladder step and junk class),
+`tests/test_scanned_prompts.py` (store, conflict, rollback, concurrency with
+`FirstWriterHold`, pair marks), `tests/test_pair_scan.py` `TestScanDecision`,
+`tests/test_run_attribution.py` (dataset branches linked by the recorded
+saver, a legacy-linked file left as it is, `_BatchHistory.recorded`) and
+`tests/test_recorded_saver_anchor.py` `TestInspectionResolution`.
+
 ## Linked prompt text (#343)
 
 A link drives `text` on every PromptManager node, and `negative_text` on the Pair,
@@ -5053,7 +5409,7 @@ which used to save `null` under a link.
   Primitive or through `PreviewAny`, for PromptManager, PromptManagerText, Focused, Split
   and the Pair (positive, negative, both, neither linked, and a Primitive negative). A
   wildcard Primitive on PromptManager (queued as written) and Focused (one choice) saves
-  and counts what was queued. The linked text is saved, counted once, recorded as
+  and counts what was queued. The linked text is saved, counted once per job, recorded as
   the run's raw positive/negative, and after a scan the run's image links to it. Text
   only known at run time (`PreviewAny`) cannot be read from the image; the case only
   requires that it is never linked to another prompt (its attribution from the recorded
@@ -5067,6 +5423,39 @@ PM_COMFY_ROOT=... PM_TEST_PYTHON=... npm run --prefix tools/vendor test:comfyui
 PM_COMFY_ROOT=... PM_TEST_PYTHON=... npm run --prefix tools/vendor test:executions -- execution-text-link
 ```
 
+## Cached runtime-linked runs (#347)
+
+Text only known at run time (a `PreviewAny` or LLM link, a list node) is counted by the
+node when it executes; the queue hook cannot read it. When ComfyUI serves such a node from
+its output cache, `utils/cached_runs.py` counts the job instead: every execution records
+a receipt (digests of its STRING outputs and hashes of the text it stores, per run key and
+queue item), and on `execution_cached` the receipt whose digests equal the cache entry's
+text is replayed once. The role (positive, negative, which Pair outputs are used) and what
+the hook already saw are recomputed from the job's own graph, and the node and replay
+decide through the same `own_counts`.
+
+- Fail closed: no receipt in this process (after a restart, an external cache provider),
+  changed cached text, more than 64 list values, a node the job's outputs do not need, or
+  a host without the queue/executor interfaces: nothing is counted, as before #347.
+- A cached node counts at job start like the hook: a job failing later still counts it.
+  A node that executes after its replay in the same job (RAM-pressure freed the entry)
+  skips its own count but still consumes the pending first-use catch-up.
+- No backfill: earlier cached jobs keep their counts. The history page's "tracked runs"
+  can stay below the Library count for these prompts (#403).
+- Tests: `tests/test_cached_runs.py` (whole jobs with the real nodes, a real database,
+  fake host caches); `tests/comfyui/execution-text-link.spec.mjs` "#347" cases on the
+  managed host: PreviewAny into each node kind, 3 jobs changing only the sampler seed,
+  count 3 in both renderers; in one renderer the Classic, LRU, RAM-pressure and no-cache
+  modes, A, B, A from the owned `PMCycledText` under LRU, typed text, a downstream
+  failure, a "run selected output" job that does not need the node, and a rewire to the
+  negative input. The RAM-pressure eviction path cannot be forced on a real host and is
+  covered by the Python tests.
+
+```sh
+python3 -m unittest discover -s tests -p "test_cached_runs.py"
+PM_COMFY_ROOT=... PM_TEST_PYTHON=... npm run --prefix tools/vendor test:executions -- execution-text-link --grep "#347"
+```
+
 ## Durable execution ledger
 
 `npm run --prefix tools/vendor test:executions` runs 52 real execution cases
@@ -5486,6 +5875,20 @@ rotates the epoch, so a pre-restore `expected_epoch` is refused with `storage-ch
 Owner rows and their timestamps never change on a tag command; a category apply only
 touches rows carrying the exact source.
 
+Image categories (#332 §7, MC9, MC10, DC7): each `GET categories` row also carries
+`image_count`, the stored `image_categories` rows holding that exact value (files
+missing on disk included). A value prompts and images share appears once, ordered by
+its oldest positive; a value only images hold appears once after every prompt-backed
+value (`first_pid` 9223372036854775807 in the keyset cursor), ordered by value, with
+`prompt_count` 0. `/library/options` keeps its own query and never lists image-only
+values. Category preview and apply report `impact.images` (rows holding the source),
+the target exists when an image row holds it, an image-only value can be renamed, the
+apply renames the image rows in the same transaction (file keys and rowids kept, so a
+merge cannot collide), and the impact token hashes the sorted image rowids, so an image
+row gaining or losing the value between preview and apply is 409
+`vocabulary-conflict` with nothing written. Every image-category statement reads
+`idx_image_categories_category` (`test_category_reads_use_the_image_category_index`).
+
 Two legacy routes change additively: `GET /tags` now lists unused registry tags, and
 `/tags/suggest` without context appends unused names at count 0. Unused tags become
 deletable only through the native Delete tag (vocabulary UI PR), not on the legacy

__init__.py

@@ -195,6 +195,26 @@ except Exception as e:
             f"Failed to register usage hook: {e}"
         )
 
+# A cached node counts what its last execution of the same text counted (#347).
+try:
+    from .py.config import server_instance
+    from .utils.cached_runs import register_cached_runs
+
+    register_cached_runs(server_instance, _db_factory)
+except Exception as e:
+    try:
+        from .utils.logging_config import get_logger
+
+        get_logger("prompt_manager.init").error(
+            f"Failed to register cached-run counting: {e}"
+        )
+    except Exception:
+        import logging
+
+        logging.getLogger("prompt_manager.init").error(
+            f"Failed to register cached-run counting: {e}"
+        )
+
 
 def _history_db_factory() -> "PromptDatabase":
     """Initialize history on its worker even if monitoring initialization failed."""
@@ -355,6 +375,44 @@ async def _stop_background_work_on_cleanup(app):
     _stop_background_work()
 
 
+def _kill_encoders_at_exit():
+    """Run by the exit hook before Python joins the executor threads (#376):
+    a JPEG XL or ffmpeg encoder (no console on Windows, so Ctrl+C never
+    reaches it) is killed instead of being waited for."""
+    from .py.api.thumbnail_encode import shutdown_encoders
+
+    shutdown_encoders()
+
+
+def _abort_downloads_at_exit():
+    """Run by the exit hook (#376): huggingface_hub's Xet transfers ignore
+    the chunk checkpoint, so they are aborted the way hub aborts on Ctrl+C."""
+    import sys
+
+    if "huggingface_hub" not in sys.modules:
+        return  # no download ever ran: import nothing at exit
+    from .py.autotag import abort_hub_downloads
+
+    abort_hub_downloads()
+
+
+try:
+    # Before the executor join: running jobs stop at their next file, item or
+    # chunk (#376). The teardown below still runs from atexit afterwards.
+    from .utils import exit_signal as _exit_signal
+
+    _exit_signal.install(_kill_encoders_at_exit)
+    _exit_signal.install(_abort_downloads_at_exit)
+except Exception as e:
+    try:
+        from .utils.logging_config import get_logger
+
+        get_logger("prompt_manager.init").error(
+            f"Failed to register the exit signal: {e}"
+        )
+    except Exception:
+        pass
+
 try:
     atexit.register(_stop_background_work)
     from .py.config import server_instance as _teardown_server

database/duplicate_copies.py

@@ -11,6 +11,8 @@ IMMEDIATE`` transaction, so no row ever names a deleted file:
 - its favorite;
 - its image tags (``media_image_tags`` of its byte record), joined onto the
   kept copy's byte record as their union, in order;
+- its own image category (#332), copied to the kept copy when that copy has
+  none; the removed copy's row is kept, so a give-back loses nothing;
 - its pending Needs review items, settled: only an item still ``pending`` at
   revision 0 with no decision row is removed (``review._SETTLE_ITEM``), so a
   decided item is never touched.
@@ -22,6 +24,8 @@ import os
 
 from .annotation_schema import BYTES_TABLE, FILES_TABLE
 from .annotations import _BUMP_INDEX
+from .image_categories import COPY_SQL as COPY_CATEGORY_SQL
+from .image_categories import copy_image_category
 from .models import normalize_image_path, utc_now_iso
 from .review import _BUMP_REVIEW_INDEX, _PENDING_OF_LOCATOR, _SETTLE_ITEM
 from .review_changes import notify_review_change
@@ -76,6 +80,7 @@ FILE_LINK_SQL = (
     COPY_BYTE_SQL,
     COPY_TAG_COUNT_SQL,
     PENDING_COUNT_SQL,
+    COPY_CATEGORY_SQL,
 )
 
 
@@ -137,8 +142,10 @@ class DuplicateCopyOperations:
         removed key, kept root key, kept key)`` per listed root holding the
         file), ``removed_locator``,
         ``kept_locator``, ``sha256`` and the kept copy's ``kept_size`` and
-        ``kept_mtime_ns``. Returns ``{moved, merged, favorites, tags,
-        review}``.
+        ``kept_mtime_ns``; ``categories``: ``(removed file key, kept file
+        key)`` pairs of the image categories (#332). Returns ``{moved,
+        merged, favorites, tags, review, categories}`` (``categories``: the
+        image categories copied to the kept copy).
         """
         counts = dict.fromkeys(("moved", "merged", "favorites", "tags", "review"), 0)
         kept_keys = [normalize_image_path(path) for path in move["kept"]]
@@ -174,6 +181,10 @@ class DuplicateCopyOperations:
             for favorite in move.get("favorites", ()):
                 counts["favorites"] += _move_favorite(conn, *favorite)
             counts["tags"] = self._move_copy_tags(conn, move)
+            counts["categories"] = sum(
+                copy_image_category(conn, removed, kept)
+                for removed, kept in move.get("categories", ())
+            )
             for (item_id,) in conn.execute(
                 _PENDING_OF_LOCATOR, (move["removed_locator"],)
             ).fetchall():

database/image_categories.py

@@ -0,0 +1,249 @@
+"""Image categories (#332): an image file's own category.
+
+An image shows its own category when it has one, otherwise the category its
+link supplies (its recipe's, else its positive prompt's); this table holds
+only the own values. A row is keyed by the file key: the deepest configured
+output source that contains the file (its real, case-normalized path) and the
+path below it, case-folded where the OS folds case
+(``py/api/images.py`` ``image_category_key``). Without nested sources the key
+equals a favorite's key. Nothing follows a moved file: its row stays and is
+hidden until a file appears at the same path again.
+
+Writes validate strictly (the route strips the value and applies
+``validate_category``). Startup checks the structure only, so a value saved
+under older rules never stops the library opening; restore also checks the
+values. Optional in old backups, required once a database is current.
+"""
+
+import re
+import sqlite3
+from typing import Iterable
+
+TABLE = "image_categories"
+INDEX = "idx_image_categories_category"
+MAX_KEY_LENGTH = 4096
+MAX_CATEGORY_LENGTH = 100
+_DDL = (
+    f"CREATE TABLE {TABLE} (root_key TEXT NOT NULL, relative_path TEXT NOT NULL, "
+    "category TEXT NOT NULL, updated_at TEXT NOT NULL, "
+    "PRIMARY KEY (root_key, relative_path))"
+)
+_INDEX_DDL = f"CREATE INDEX {INDEX} ON {TABLE}(category)"
+_AUTOINDEX = f"sqlite_autoindex_{TABLE}_1"
+_COLUMNS = (
+    ("root_key", "TEXT", 1, 1),
+    ("relative_path", "TEXT", 1, 2),
+    ("category", "TEXT", 1, 0),
+    ("updated_at", "TEXT", 1, 0),
+)
+# A category may not hold a character below U+0020 (validate_category).
+_CONTROL_GLOB = "*[" + "".join(chr(code) for code in range(1, 32)) + "]*"
+
+CATEGORY_OF_SQL = (
+    f"SELECT category FROM {TABLE} WHERE root_key = ? AND relative_path = ?"
+)
+CATEGORIES_OF_ROOT_SQL = (
+    f"SELECT relative_path, category FROM {TABLE} WHERE root_key = ?"
+)
+UPSERT_SQL = (
+    f"INSERT INTO {TABLE} (root_key, relative_path, category, updated_at) "
+    "VALUES (?, ?, ?, ?) ON CONFLICT(root_key, relative_path) "
+    "DO UPDATE SET category = excluded.category, updated_at = excluded.updated_at"
+)
+DELETE_SQL = f"DELETE FROM {TABLE} WHERE root_key = ? AND relative_path = ?"
+# The duplicate cleanup's copy (#332 MC11): the removed copy's row is copied
+# to the kept copy only when the kept copy has none; it is never deleted.
+COPY_SQL = (
+    f"INSERT OR IGNORE INTO {TABLE} (root_key, relative_path, category, updated_at) "
+    f"SELECT ?, ?, category, updated_at FROM {TABLE} "
+    "WHERE root_key = ? AND relative_path = ?"
+)
+STATEMENTS = (CATEGORY_OF_SQL, CATEGORIES_OF_ROOT_SQL, UPSERT_SQL, DELETE_SQL, COPY_SQL)
+
+
+def _compact(sql: str) -> str:
+    return re.sub(r"\s+", "", sql or "").lower()
+
+
+def _structure_error(
+    conn: sqlite3.Connection, allow_missing: bool, allow_missing_index: bool = False
+) -> str | None:
+    objects = conn.execute(
+        "SELECT type,name,sql FROM sqlite_master WHERE name=? "
+        "OR (type IN ('index','trigger') AND tbl_name=?)",
+        (TABLE, TABLE),
+    ).fetchall()
+    if not objects:
+        return None if allow_missing else "Missing image categories schema"
+    tables = [sql for kind, _name, sql in objects if kind == "table"]
+    others = {(kind, name) for kind, name, _sql in objects if kind != "table"}
+    expected = {("index", _AUTOINDEX), ("index", INDEX)}
+    # Before its install, a table without the category index is repaired by
+    # CREATE INDEX IF NOT EXISTS rather than refused.
+    if allow_missing_index and others == {("index", _AUTOINDEX)}:
+        expected = others
+    if len(tables) != 1 or others != expected:
+        return "Image categories name is reserved by an unsupported schema object"
+    if _compact(tables[0]) != _compact(_DDL):
+        return "Image categories has an invalid table definition"
+    index_sql = next((sql for kind, name, sql in objects if name == INDEX), None)
+    if ("index", INDEX) in expected and _compact(index_sql) != _compact(_INDEX_DDL):
+        return "Image categories has an invalid index"
+    autoindex_sql = next(sql for kind, name, sql in objects if name == _AUTOINDEX)
+    if autoindex_sql is not None:
+        return "Image categories has an invalid index"
+    columns = tuple(
+        (row[1], row[2].upper(), row[3], row[5])
+        for row in conn.execute(f"PRAGMA table_info({TABLE})")
+    )
+    if columns != _COLUMNS:
+        return "Image categories has invalid columns"
+    return None
+
+
+def _values_error(conn: sqlite3.Connection) -> str | None:
+    # Bytes bound characters from above (UTF-8 is at most 4 bytes each).
+    limit = MAX_KEY_LENGTH * 4
+    if conn.execute(
+        f"SELECT 1 FROM {TABLE} WHERE typeof(root_key) != 'text' "  # nosec B608
+        "OR typeof(relative_path) != 'text' OR typeof(category) != 'text' "
+        "OR typeof(updated_at) != 'text' "
+        f"OR length(CAST(root_key AS BLOB)) > {limit} "
+        f"OR length(CAST(relative_path AS BLOB)) > {limit} "
+        "OR length(CAST(updated_at AS BLOB)) > 64 "
+        "OR instr(CAST(category AS BLOB), x'00') > 0 "
+        f"OR length(category) < 1 OR length(category) > {MAX_CATEGORY_LENGTH} "
+        "OR category != TRIM(category) OR category GLOB ? LIMIT 1",
+        (_CONTROL_GLOB,),
+    ).fetchone():
+        return "Image categories contains invalid values"
+    for root, path in conn.execute(
+        f"SELECT CAST(root_key AS BLOB), CAST(relative_path AS BLOB) "  # nosec B608
+        f"FROM {TABLE} WHERE length(CAST(root_key AS BLOB)) > {MAX_KEY_LENGTH} "
+        f"OR length(CAST(relative_path AS BLOB)) > {MAX_KEY_LENGTH}"
+    ):
+        for raw in (root, path):
+            if len(bytes(raw).decode("utf-8", "replace")) > MAX_KEY_LENGTH:
+                return "Image categories contains invalid values"
+    return None
+
+
+def image_categories_schema_error(
+    conn: sqlite3.Connection,
+    *,
+    allow_missing: bool = True,
+    check_values: bool = True,
+) -> str | None:
+    """Reject an unsupported image categories schema (and, optionally, values).
+
+    Reads only. A missing table is acceptable for backups that predate it
+    unless ``allow_missing`` is false. ``check_values`` also refuses a stored
+    value the write path could never have written.
+    """
+    error = _structure_error(conn, allow_missing)
+    if error is not None or not check_values:
+        return error
+    exists = conn.execute(
+        "SELECT 1 FROM sqlite_master WHERE type='table' AND name=?", (TABLE,)
+    ).fetchone()
+    return _values_error(conn) if exists else None
+
+
+def migrate_image_categories(conn: sqlite3.Connection) -> None:
+    """Install the table and its index atomically; structure is checked
+    before and after. Reads only ``sqlite_master`` and this table's PRAGMAs
+    and writes only its own two objects (no backfill)."""
+    conn.execute("SAVEPOINT image_categories_schema")
+    try:
+        error = _structure_error(conn, True, allow_missing_index=True)
+        if error:
+            raise sqlite3.DatabaseError(error)
+        conn.execute(_DDL.replace("CREATE TABLE", "CREATE TABLE IF NOT EXISTS", 1))
+        conn.execute(
+            _INDEX_DDL.replace("CREATE INDEX", "CREATE INDEX IF NOT EXISTS", 1)
+        )
+        error = image_categories_schema_error(
+            conn, allow_missing=False, check_values=False
+        )
+        if error:
+            raise sqlite3.DatabaseError(error)
+        conn.execute("RELEASE image_categories_schema")
+    except BaseException:
+        conn.execute("ROLLBACK TO image_categories_schema")
+        conn.execute("RELEASE image_categories_schema")
+        raise
+
+
+def copy_image_category(conn: sqlite3.Connection, removed_key, kept_key) -> int:
+    """Give the kept copy the removed copy's category when it has none.
+
+    Runs inside the caller's transaction; never deletes the removed copy's
+    row, so a give-back or a failed delete loses nothing. Returns 1 when a
+    row was inserted, else 0.
+    """
+    if tuple(removed_key) == tuple(kept_key):
+        return 0
+    return max(conn.execute(COPY_SQL, (*kept_key, *removed_key)).rowcount, 0)
+
+
+class ImageCategoryOperations:
+    """PromptDatabase mixin: set, clear and read images' own categories.
+
+    Never reads or writes ``prompts``, ``prompt_pairs`` or
+    ``generated_images``.
+    """
+
+    def image_category(self, root_key: str, relative_key: str) -> str | None:
+        """One file's own category, or None."""
+        row = (
+            self.model.get_connection()
+            .execute(CATEGORY_OF_SQL, (root_key, relative_key))
+            .fetchone()
+        )
+        return row[0] if row else None
+
+    def own_categories_of(self, root_keys: Iterable[str]) -> dict:
+        """``{(root key, relative key): category}`` under the given sources.
+
+        One primary-key range read per source.
+        """
+        found = {}
+        conn = self.model.get_connection()
+        for root_key in dict.fromkeys(root_keys):
+            for relative, category in conn.execute(CATEGORIES_OF_ROOT_SQL, (root_key,)):
+                found[(root_key, relative)] = category
+        return found
+
+    def set_image_categories(self, file_keys, category: str) -> dict:
+        """Set *category* on every file key, in one transaction.
+
+        ``file_keys``: ``(root key, relative key)`` pairs from any number of
+        sources. Returns ``{updated, unchanged}``; a file that already had
+        exactly this value is ``unchanged`` and keeps its ``updated_at``.
+        """
+        from .models import utc_now_iso  # models imports this module's schema
+
+        keys = list(dict.fromkeys(tuple(key) for key in file_keys))
+        counts = {"updated": 0, "unchanged": 0}
+        now = utc_now_iso()
+        with self._pair_transaction() as conn:
+            for key in keys:
+                row = conn.execute(CATEGORY_OF_SQL, key).fetchone()
+                if row is not None and row[0] == category:
+                    counts["unchanged"] += 1
+                    continue
+                conn.execute(UPSERT_SQL, (*key, category, now))
+                counts["updated"] += 1
+        return counts
+
+    def clear_image_categories(self, file_keys) -> int:
+        """Remove the own category of every file key (one transaction).
+
+        Returns the number of rows removed.
+        """
+        keys = list(dict.fromkeys(tuple(key) for key in file_keys))
+        removed = 0
+        with self._pair_transaction() as conn:
+            for key in keys:
+                removed += conn.execute(DELETE_SQL, key).rowcount
+        return removed

database/models.py

@@ -34,6 +34,7 @@ from .review_schema import (
     review_without_annotations_error,
 )
 from .saved_views import migrate_saved_views, saved_views_schema_error
+from .image_categories import image_categories_schema_error, migrate_image_categories
 from .workflow_documents import (
     DOCUMENT_ID_COLUMNS,
     migrate_workflow_documents,
@@ -350,6 +351,8 @@ class PromptModel:
         migrate_annotation_state(conn)
         migrate_review_state(conn)
         migrate_autotag_state(conn)
+        # Image categories (#332): independent of every table above.
+        migrate_image_categories(conn)
         # Last: the older generated_images rebuilds run only before file_path.
         migrate_workflow_documents(conn)
 
@@ -1155,8 +1158,9 @@ class PromptModel:
         Args:
             path: File to inspect
             require_library_state: Also require the tables every current
-                database has (Library state, image favorites, saved views,
-                image annotations and the review queue), as a migrated
+                database has (Library state, image favorites, image
+                categories, saved views, image annotations and the review
+                queue), as a migrated
                 restore stage must; old backups may lack them.
             documents: Read every workflow document and refuse a damaged
                 one. A restore checks its upload without it and repairs
@@ -1220,6 +1224,11 @@ class PromptModel:
             )
             if favorites_error:
                 return False, favorites_error
+            categories_error = image_categories_schema_error(
+                conn, allow_missing=not require_library_state
+            )
+            if categories_error:
+                return False, categories_error
             views_error = saved_views_schema_error(
                 conn, allow_missing=not require_library_state
             )

database/operations.py

@@ -7,7 +7,12 @@ import json
 import math
 import datetime
 import os
-from typing import Optional, List, Dict, Any, Set, Tuple
+from typing import Any, Dict, Iterable, List, Optional, Sequence, Set, Tuple
+
+try:
+    from ..utils.inspection_response import inherited_category
+except ImportError:
+    from utils.inspection_response import inherited_category
 
 from .models import PromptModel, normalize_image_path, utc_now_iso
 from .pairs import PairDependencyError, PairOperations  # noqa: F401 (re-exported)
@@ -27,6 +32,7 @@ from .health import HealthOperations, iter_consistency_issues
 from .duplicate_copies import DuplicateCopyOperations
 from .workflow_storage import WorkflowStorageOperations
 from .category_import import CategoryImportOperations, EmptyReplacement  # noqa: F401
+from .image_categories import ImageCategoryOperations
 from .workflow_documents import (
     DocumentReader,
     documents_of_rows,
@@ -237,12 +243,17 @@ LEFT JOIN prompt_library_state pls ON pls.prompt_id = pp.positive_prompt_id
 WHERE gi.image_path IN ({marks}) OR gi.file_path IN ({marks}){fallback}"""
 # One image row describes a card only when no other row claims the same file
 # (as in get_image_link_summaries, several rows are ambiguous). The pair scope
-# and the linked positive follow _LINK_SUMMARY_SQL; category, rating, tags and
-# the searchable text and titles come from that positive (spec D12/D13). Every
+# and the linked positive follow _LINK_SUMMARY_SQL; rating, tags and the
+# searchable text and titles come from that positive (spec D12/D13). The raw
+# recipe and positive categories are read for the inherited category, which
+# Python decides (``inherited_category``, #332 MC4); SQL never filters by
+# category. Every
 # writer since the 3.2.4 migration stores file_path, so it is the path key.
 # The prompt-level conditions are uncorrelated IN sets SQLite builds once, and
 # the CASE evaluates the per-row ambiguity probe only for admitted rows.
-_LINK_FILTER_SQL = """SELECT gi.file_path, p.rating, {hit}, p.id
+_LINK_FILTER_SQL = """SELECT gi.file_path AS file_path, p.rating AS rating,
+       {hit} AS matched, p.id AS positive, pp.id IS NOT NULL AS has_pair,
+       pp.category AS pair_category, p.category AS category
 FROM generated_images gi
 LEFT JOIN prompt_pairs pp ON pp.id = (
     SELECT CASE WHEN COUNT(DISTINCT ip.pair_id) = 1 THEN MIN(ip.pair_id) END
@@ -251,10 +262,31 @@ JOIN prompts p ON p.id = COALESCE(pp.positive_prompt_id, gi.prompt_id)
 WHERE gi.file_path IS NOT NULL AND CASE WHEN {admit} THEN NOT EXISTS (
     SELECT 1 FROM generated_images other
     WHERE other.file_path = gi.file_path AND other.id <> gi.id) ELSE 0 END"""
+# _LINK_FILTER_SQL's rows as one JSON array, built by SQLite in one step (#354).
+# Python's sqlite3 releases and retakes the GIL around every step, so a read
+# that steps once per linked row waits on a busy ComfyUI thread thousands of
+# times. A BLOB value (no writer stores one) makes the value NULL (or
+# json_array refuses it), and the read streams instead. The raw categories are
+# put in only for a category read (#332), so plain reads stay as small as #354
+# measured them.
+_LINK_MATCHES_JSON_SQL = """SELECT CASE
+    WHEN max({blob}) THEN NULL
+    ELSE json_group_array(json_array({columns})) END
+FROM ({select})"""
+_LINK_PLAIN_COLUMNS = ("file_path", "rating", "matched", "positive")
+_LINK_CATEGORY_COLUMNS = _LINK_PLAIN_COLUMNS + ("has_pair", "pair_category", "category")
+# The columns a BLOB can reach: matched, positive and has_pair are computed.
+_LINK_STORED_COLUMNS = ("file_path", "rating", "pair_category", "category")
+# Set when this SQLite has no JSON functions: every later read streams.
+_one_step_unsupported = False
+# One warning per process when a read falls back to streaming.
+_one_step_warned = False
 # The linked positive of each given path (one unambiguous link, pair scope as
-# in _LINK_FILTER_SQL) with its category; {hit} as in link_filter_query. Used
-# for the few files whose current image tags meet a Tags filter (#249 B3).
-_LINK_FACTS_SQL = """SELECT gi.file_path, p.rating, {hit}, p.id, p.category
+# in _LINK_FILTER_SQL) with the raw categories of its inherited category; {hit}
+# as in link_filter_query. Used for the few files whose current image tags meet
+# a Tags filter (#249 B3).
+_LINK_FACTS_SQL = """SELECT gi.file_path, p.rating, {hit}, p.id,
+pp.id IS NOT NULL, pp.category, p.category
 FROM generated_images gi
 LEFT JOIN prompt_pairs pp ON pp.id = (
     SELECT CASE WHEN COUNT(DISTINCT ip.pair_id) = 1 THEN MIN(ip.pair_id) END
@@ -283,8 +315,24 @@ _LINK_FILTER_TAG = (
 )
 
 
+# One unambiguously linked image's facts for the Images filters, a plain tuple
+# (hit, rating, positive id, inherited category): built per linked row, so no
+# NamedTuple. The category is the inherited one (#332 MC4: the recipe's when
+# set, else the positive's), never the image's own category.
+LinkMatch = Tuple[bool, Optional[int], int, Any]
+
+
+def _link_match(rating, matched, positive, has_pair, pair_category, category):
+    inherited, _scope = inherited_category(category, pair_category, bool(has_pair))
+    return (bool(matched), rating, positive, inherited)
+
+
 def link_filter_query(
-    q: str, category: Optional[str], tags: List[str], *, every_link: bool = False
+    q: str,
+    tags: List[str],
+    *,
+    every_link: bool = False,
+    category: Optional[str] = None,
 ) -> Tuple[str, Dict[str, Any]]:
     """The workspace filter SELECT and its named parameters (all bound).
 
@@ -298,7 +346,9 @@ def link_filter_query(
         params["pattern"] = f"%{escape_like(q)}%"
     admitted = []
     if category is not None:
-        admitted.append("p.category = :category")
+        # Only narrows: an inherited category is one of the two raw values;
+        # which one is decided in Python (inherited_category, #332 MC4).
+        admitted.append("(p.category = :category OR pp.category = :category)")
         params["category"] = category
     for index, tag in enumerate(tags):
         admitted.append(_LINK_FILTER_TAG.format(index=index))
@@ -309,6 +359,50 @@ def link_filter_query(
     return sql, params
 
 
+def link_matches_json_query(sql: str, categories: bool = False) -> str:
+    """*sql* from link_filter_query, wrapped to return its rows as one JSON value.
+
+    With *categories* each row also carries the raw values the inherited
+    category is decided from; otherwise only path, rating, hit and positive.
+    """
+    columns = _LINK_CATEGORY_COLUMNS if categories else _LINK_PLAIN_COLUMNS
+    blob = " OR ".join(
+        f"typeof({name}) = 'blob'" for name in _LINK_STORED_COLUMNS if name in columns
+    )
+    return _LINK_MATCHES_JSON_SQL.format(
+        blob=blob, columns=", ".join(columns), select=sql
+    )
+
+
+def _link_matches_from_rows(
+    rows: Iterable[Sequence[Any]], categories: bool, wanted: Optional[Set[str]]
+) -> Dict[str, LinkMatch]:
+    """LinkMatch per wanted path from link rows (one-step or streamed).
+
+    Without *categories* the inherited category is None, as the caller then
+    never compares it.
+    """
+    matches: Dict[str, LinkMatch] = {}
+    for path, rating, matched, positive, *raw in rows:
+        if wanted is None or path in wanted:
+            if categories:
+                matches[path] = _link_match(rating, matched, positive, *raw[:3])
+            else:
+                matches[path] = (bool(matched), rating, positive, None)
+    return matches
+
+
+def _streamed_link_matches(
+    conn: sqlite3.Connection,
+    sql: str,
+    params: Dict[str, Any],
+    wanted: Optional[Set[str]],
+    categories: bool = False,
+) -> Dict[str, LinkMatch]:
+    """The link read stepped once per row (the fallback of the one-step read)."""
+    return _link_matches_from_rows(conn.execute(sql, params), categories, wanted)
+
+
 _ASCII_FOLD = str.maketrans("ABCDEFGHIJKLMNOPQRSTUVWXYZ", "abcdefghijklmnopqrstuvwxyz")
 
 
@@ -368,6 +462,7 @@ class PromptDatabase(
     DuplicateCopyOperations,
     WorkflowStorageOperations,
     CategoryImportOperations,
+    ImageCategoryOperations,
 ):
     """Database operations class for managing prompts."""
 
@@ -2541,38 +2636,94 @@ class PromptDatabase(
     def get_image_link_matches(
         self,
         q: str,
-        category: Optional[str],
         tags: List[str],
         *,
         every_link: bool = False,
         wanted: Optional[Set[str]] = None,
-    ) -> Dict[str, Tuple[bool, Optional[int], int]]:
-        """Map normalized paths of unambiguously linked images to
-        (hit, rating, positive id).
+        category: Optional[str] = None,
+    ) -> Dict[str, LinkMatch]:
+        """Map normalized paths of unambiguously linked images to a LinkMatch
+        (hit, rating, positive id, inherited category).
 
-        Rows are limited to images whose linked positive has *category* and
-        every tag in *tags* (exact names). ``hit`` says whether *q* occurs in
+        Rows are limited to images whose linked positive has every tag in
+        *tags* (exact names). The category filter is applied by the caller to
+        the effective category (#332). ``hit`` says whether *q* occurs in
         the positive's text, Library title or a tag name; a pair's own title
         names its negative variant and is not searched.
-        Without category or tags only hits are returned, unless *every_link*
+        Without tags only hits are returned, unless *every_link*
         asks for every linked image (the rating sort and the positive count).
-        The positive id is the card's linked positive. One SELECT whose rows
-        are streamed; with *wanted* (the listing's normalized paths) only those
-        paths are kept, so memory is bounded by the listing, not the database.
+        The positive id is the card's linked positive. With *category* only
+        links whose raw recipe or positive category is that value are read (a
+        superset of the links that inherit it; the caller compares the
+        inherited value) and the inherited category is decided per row;
+        otherwise it is None, which keeps the plain reads cheap.
+
+        One SELECT, returned as one JSON value (#354): SQLite steps once, so
+        the read takes the GIL back a constant two or three times instead of
+        once per linked row while ComfyUI generates. Peak memory therefore
+        grows with the database's matching linked rows (about 530 bytes each,
+        more with the raw categories of a category read, freed on return); the
+        result is bounded by *wanted* (the listing's normalized paths) when
+        given. Where the JSON step fails (no JSON functions, a BLOB value, a
+        JSON text over SQLite's length limit) the rows are streamed as before.
         """
-        sql, params = link_filter_query(q, category, tags, every_link=every_link)
-        matches: Dict[str, Tuple[bool, Optional[int], int]] = {}
+        sql, params = link_filter_query(
+            q, tags, every_link=every_link, category=category
+        )
+        categories = category is not None
         with self.model.get_connection() as conn:
-            for path, rating, matched, positive in conn.execute(sql, params):
-                if wanted is None or path in wanted:
-                    matches[path] = (bool(matched), rating, positive)
-        return matches
+            rows = None
+            if not _one_step_unsupported:
+                rows = self._one_step_link_rows(conn, sql, params, categories)
+            if rows is None:
+                return _streamed_link_matches(conn, sql, params, wanted, categories)
+        return _link_matches_from_rows(rows, categories, wanted)
+
+    def _one_step_link_rows(
+        self,
+        conn: sqlite3.Connection,
+        sql: str,
+        params: Dict[str, Any],
+        categories: bool = False,
+    ) -> Optional[List[List[Any]]]:
+        """*sql*'s rows from one JSON value, or None when this read must stream.
+
+        An interrupted read (Move library retiring the connection) is raised
+        as before, never retried row by row.
+        """
+        global _one_step_unsupported, _one_step_warned
+        error: Optional[str] = None
+        try:
+            cursor = conn.execute(link_matches_json_query(sql, categories), params)
+            try:
+                ((document,),) = cursor.fetchall()
+            finally:
+                cursor.close()  # resets the statement: its snapshot ends now
+        except (sqlite3.OperationalError, sqlite3.DataError) as failure:
+            # DataError: the JSON text is longer than SQLITE_LIMIT_LENGTH.
+            error = str(failure)
+            if error == "interrupted":
+                raise
+            if error.startswith("no such function"):
+                _one_step_unsupported = True
+        else:
+            if document is not None:
+                return json.loads(document)
+            error = "a BLOB value"
+        if not _one_step_warned:
+            _one_step_warned = True
+            self.logger.warning(
+                "Reading image links row by row (slower while ComfyUI "
+                "generates); the one-step read failed: %s",
+                error,
+            )
+        return None
 
     def get_image_link_facts(
         self, paths: List[str], q: str = ""
-    ) -> Dict[str, Tuple[bool, Optional[int], int, Optional[str], Tuple[str, ...]]]:
+    ) -> Dict[str, Tuple[bool, Optional[int], int, Any, Tuple[str, ...]]]:
         """Map each normalized path with one unambiguous link to its positive's
-        (hit, rating, positive id, category, tag names).
+        (hit, rating, positive id, inherited category, tag names).
 
         The link is resolved as in get_image_link_matches, and ``hit`` says
         whether *q* occurs in the positive's text, Library title or a tag
@@ -2583,7 +2734,7 @@ class PromptDatabase(
         if q:
             hit = _LINK_FILTER_HIT
             params["pattern"] = f"%{escape_like(q)}%"
-        rows: Dict[str, Tuple[bool, Optional[int], int, Optional[str]]] = {}
+        rows: Dict[str, LinkMatch] = {}
         names: Dict[int, List[str]] = {}
         unique = list(dict.fromkeys(paths))
         with self.model.get_connection() as conn:
@@ -2592,10 +2743,8 @@ class PromptDatabase(
                 bound = {f"path{i}": path for i, path in enumerate(chunk)}
                 marks = ",".join(f":{key}" for key in bound)
                 sql = _LINK_FACTS_SQL.format(hit=hit, marks=marks)
-                for path, rating, matched, positive, category in conn.execute(
-                    sql, {**params, **bound}
-                ):
-                    rows[path] = (bool(matched), rating, positive, category)
+                for path, *row in conn.execute(sql, {**params, **bound}):
+                    rows[path] = _link_match(*row)
             positives = sorted({row[2] for row in rows.values()})
             for start in range(0, len(positives), _FACTS_CHUNK):
                 chunk = positives[start : start + _FACTS_CHUNK]
@@ -2608,20 +2757,16 @@ class PromptDatabase(
             path: (*row, tuple(names.get(row[2], ()))) for path, row in rows.items()
         }
 
-    def get_image_paths_matching(
-        self, q: str, category: Optional[str], tags: List[str]
-    ) -> Set[str]:
-        """Normalized paths whose linked positive matches *q*, *category* and *tags*.
+    def get_image_paths_matching(self, q: str, tags: List[str]) -> Set[str]:
+        """Normalized paths whose linked positive matches *q* and *tags*.
 
         See get_image_link_matches; an empty *q* matches every linked image
-        the category and tags admit.
+        the tags admit.
         """
         return {
             path
-            for path, (hit, _rating, _positive) in self.get_image_link_matches(
-                q, category, tags
-            ).items()
-            if hit or not q
+            for path, match in self.get_image_link_matches(q, tags).items()
+            if match[0] or not q
         }
 
     def get_prompt_id_for_image(self, image_path: str) -> Optional[int]:

database/pair_ingestion.py

@@ -1,7 +1,14 @@
-"""Atomic metadata enrichment for a single known generation context."""
+"""Atomic metadata enrichment for a single known generation context.
+
+Also the helpers both ingestion store paths share (#247): the file's link
+rows and the one-prompt-per-file rule (``file_link_rows``,
+``link_conflict``) and the marks a prompt created by ingestion carries
+(``Marks``, ``mark_created``).
+"""
 
 import os
-from typing import Any, Dict
+from dataclasses import dataclass
+from typing import Any, Dict, List, Optional, Tuple
 
 from .models import normalize_image_path
 from .operations import _coerce_file_info
@@ -37,16 +44,85 @@ def blank_positive(resolution: Dict[str, Any]) -> bool:
     return not (isinstance(text, str) and text.strip())
 
 
+@dataclass(frozen=True)
+class Marks:
+    """What a prompt ingestion creates carries, so it can be found and removed.
+
+    ``note`` is formatted with ``name``, the file's name.
+    """
+
+    category: str
+    tags: Tuple[str, ...]
+    note: str
+
+
+SCAN_MARKS = Marks("scanned", ("auto-scanned",), "Auto-scanned from {name}")
+RUN_MARKS = Marks("scanned", ("auto-scanned",), "Saved from a workflow run: {name}")
+
+
+def mark_created(conn: Any, db: Any, prompt_id: int, marks: Marks, name: str) -> None:
+    """Apply ``marks`` to a prompt row the caller just created on ``conn``."""
+    conn.execute(
+        "UPDATE prompts SET category = ?, notes = ? WHERE id = ?",
+        (marks.category, marks.note.format(name=name), prompt_id),
+    )
+    db._sync_prompt_tags(conn, prompt_id, list(marks.tags))
+
+
+def file_link_rows(conn: Any, image_path: str) -> List[Any]:
+    """The file's link rows, each with its prompt's hash.
+
+    Matched under the path and its resolved spelling (an output folder
+    reached through a symlink or junction), each normalized and raw;
+    deduplicated by row id.
+    """
+    rows: Dict[Any, Any] = {}
+    for spelling in dict.fromkeys((image_path, _resolved(image_path))):
+        for row in conn.execute(
+            "SELECT gi.*,p.hash AS positive_hash FROM generated_images gi "
+            "JOIN prompts p ON p.id=gi.prompt_id "
+            "WHERE gi.file_path=? OR gi.image_path=?",
+            (normalize_image_path(spelling), spelling),
+        ).fetchall():
+            rows.setdefault(row["id"], row)
+    return list(rows.values())
+
+
+def _resolved(path: str) -> str:
+    try:
+        return os.path.realpath(path)
+    except (OSError, ValueError):
+        return path
+
+
+def link_conflict(rows: List[Any], prompt_hash: str) -> bool:
+    """One prompt per file: more than one row, or a row of another prompt."""
+    return len(rows) > 1 or bool(rows and rows[0]["positive_hash"] != prompt_hash)
+
+
 def ingest_resolved_pair(
-    db: Any, image_path: str, metadata: Dict[str, Any], resolution: Dict[str, Any]
+    db: Any,
+    image_path: str,
+    metadata: Dict[str, Any],
+    resolution: Dict[str, Any],
+    *,
+    marks: Optional[Marks] = None,
 ) -> Dict[str, Any]:
+    """Store a resolved pair and link the file to it in one transaction.
+
+    With ``marks`` (ingestion from files), each pair component this call
+    creates carries them; without (the PromptManager node path) components
+    are created bare, as always.
+    """
     state = resolution.get("state", "unresolved")
     if state == "resolved" and blank_positive(resolution):
         state = "unresolved"
     if state != "resolved":
         return {"status": state, "pairs_added": 0, "links_added": 0}
     with db._pair_transaction() as conn:
-        return _ingest_resolved_pair_in(conn, db, image_path, metadata, resolution)
+        return _ingest_resolved_pair_in(
+            conn, db, image_path, metadata, resolution, marks=marks
+        )
 
 
 def _conflict() -> Dict[str, Any]:
@@ -61,6 +137,7 @@ def _ingest_resolved_pair_in(
     resolution: Dict[str, Any],
     *,
     provenance: Dict[str, Any] | None = None,
+    marks: Optional[Marks] = None,
 ) -> Dict[str, Any]:
     """``ingest_resolved_pair`` inside the caller's open ``_pair_transaction``.
 
@@ -69,7 +146,8 @@ def _ingest_resolved_pair_in(
     negative is a ``conflict`` and nothing is written. The caller owns the
     transaction, so its own later failure rolls the link back too.
     ``provenance`` replaces the link's default resolver provenance (Needs
-    review records the user's selection there).
+    review records the user's selection there). ``marks`` as in
+    ``ingest_resolved_pair``.
     """
     positive, negative = resolution["positive"], resolution["negative"]
     positive_text = positive.get("storage_text", positive["text"])
@@ -82,15 +160,8 @@ def _ingest_resolved_pair_in(
             "negative": negative,
         }
     encoded = dumps_strict(provenance, sort_keys=True, separators=(",", ":"))
-    images = conn.execute(
-        "SELECT gi.*,p.hash AS positive_hash FROM generated_images gi "
-        "JOIN prompts p ON p.id=gi.prompt_id "
-        "WHERE gi.file_path=? OR gi.image_path=?",
-        (normalized, image_path),
-    ).fetchall()
-    if len(images) > 1 or (
-        images and images[0]["positive_hash"] != generate_prompt_hash(positive_text)
-    ):
+    images = file_link_rows(conn, image_path)
+    if link_conflict(images, generate_prompt_hash(positive_text)):
         return _conflict()
     existing = images[0] if images else None
     if existing:
@@ -115,7 +186,12 @@ def _ingest_resolved_pair_in(
             generate_prompt_hash(negative_text) if negative_text.strip() else None,
         ),
     ).fetchone()
-    pair_id = db._save_pair(conn, positive_text, negative_text)
+    if marks is None:
+        pair_id = db._save_pair(conn, positive_text, negative_text)
+    else:
+        pair_id = _save_marked_pair(
+            conn, db, positive_text, negative_text, marks, os.path.basename(image_path)
+        )
     pair = conn.execute("SELECT * FROM prompt_pairs WHERE id=?", (pair_id,)).fetchone()
     pairs_added = int(prior_pair is None)
     file_size, width, height, image_format = _coerce_file_info(metadata)
@@ -197,6 +273,26 @@ def _ingest_resolved_pair_in(
     }
 
 
+def _save_marked_pair(
+    conn: Any,
+    db: Any,
+    positive_text: str,
+    negative_text: str,
+    marks: Marks,
+    name: str,
+) -> int:
+    """``_save_pair`` that marks each component it creates."""
+    texts = [positive_text] + ([negative_text] if negative_text.strip() else [])
+    ids = []
+    for text in texts:
+        prompt_id, created = db._pair_component_outcome(conn, text)
+        if created:
+            mark_created(conn, db, prompt_id, marks, name)
+        ids.append(prompt_id)
+    negative_id = ids[1] if len(ids) > 1 else None
+    return db._save_pair_components(conn, ids[0], negative_id)[0]
+
+
 def _document_form(conn: Any, values: Dict[str, Any]) -> Dict[str, Any]:
     """``values`` with the workflow and prompt graph texts stored once.
 

database/run_attribution.py

@@ -15,6 +15,10 @@ only when all of this holds:
 
 Anything else returns None: the caller leaves the file unlinked. Read-only.
 
+``recorded_output`` applies the first two rules and returns, for the
+inspector (#386), the one output node (save node) that run reported the file
+from and the texts PromptManager recorded at execution per sampler.
+
 Lookups are batched (``stored_run_prompts``): one parameterized query per
 chunk of at most ``LOOKUP_CHUNK`` distinct file names, matched in memory. The
 history schema is left exactly as it is (no extra index), so older builds can
@@ -26,6 +30,7 @@ import os
 import sqlite3
 import threading
 import weakref
+from dataclasses import dataclass
 from typing import Any, Callable, Dict, Iterable, List, Optional
 
 try:
@@ -45,7 +50,8 @@ LOOKUP_CHUNK = 500
 
 _RUNS_FOR_NAMES = (
     "SELECT DISTINCT o.filename, o.subfolder, o.root_key, o.path_style, o.run_id, "
-    "r.observed_dequeue_at, COALESCE(r.terminal_event_at, r.observed_callback_at) "
+    "r.observed_dequeue_at, COALESCE(r.terminal_event_at, r.observed_callback_at), "
+    "o.output_node_id "
     "FROM execution_run_outputs o JOIN execution_runs r ON r.run_id = o.run_id "
     "WHERE o.folder_type = 'output' AND o.filename IN ({marks})"
 )
@@ -138,9 +144,10 @@ def stored_run_prompt(
 
 
 def _runs_by_location(db: Any, names: List[str]) -> Optional[Dict[tuple, dict]]:
-    """``{(filename, subfolder, root_key, style): {run_id: (start, end)}}``.
+    """``{(filename, subfolder, root_key, style): {run_id: (start, end, nodes)}}``.
 
-    One query per ``LOOKUP_CHUNK`` names; None without history tables.
+    ``nodes`` is the set of output node ids that reported the location in that
+    run. One query per ``LOOKUP_CHUNK`` names; None without history tables.
     """
     found: Dict[tuple, dict] = {}
     conn = db.model.get_connection()
@@ -151,13 +158,51 @@ def _runs_by_location(db: Any, names: List[str]) -> Optional[Dict[tuple, dict]]:
             rows = conn.execute(query, chunk).fetchall()  # nosec B608
         except sqlite3.Error:
             return None  # no history tables (a library without history)
-        for name, subfolder, root_key, style, run_id, began, ended in rows:
+        for name, subfolder, root_key, style, run_id, began, ended, node in rows:
             runs = found.setdefault((name, subfolder, root_key, style), {})
-            runs[run_id] = (began, ended)
+            runs.setdefault(run_id, (began, ended, set()))[2].add(node)
     return found
 
 
-def _named_prompt(db: Any, run_id: str) -> Optional[int]:
+def recorded_runs(
+    db: Any,
+    image_paths: Iterable[str],
+    output_root: Optional[str],
+    path_style: Optional[str],
+) -> Dict[str, tuple]:
+    """``{path: (run_id, output node ids)}`` for each file history attributes.
+
+    A file is attributed when exactly one recorded run reported its location
+    and it was last written while that run executed.
+    """
+    paths = list(dict.fromkeys(path for path in image_paths if path))
+    if not paths or not output_root:
+        return {}
+    style = path_style or ("windows" if os.name == "nt" else "posix")
+    located = {}
+    for path in paths:
+        location = _location(path, output_root, style)
+        if location is not None:
+            located[path] = location
+    if not located:
+        return {}
+    names = sorted({filename for _key, _sub, filename in located.values()})
+    runs = _runs_by_location(db, names)
+    if not runs:
+        return {}
+    attributed = {}
+    for path, (root_key, subfolder, filename) in located.items():
+        reported = runs.get((filename, subfolder, root_key, style), {})
+        if len(reported) != 1:
+            continue
+        ((run_id, (began, ended, nodes)),) = reported.items()
+        if _written_during(path, began, ended):
+            attributed[path] = (run_id, nodes)
+    return attributed
+
+
+def named_prompt(db: Any, run_id: str) -> Optional[int]:
+    """The one stored prompt every positive context of ``run_id`` names, else None."""
     contexts = db.get_execution_contexts(run_id).get("contexts") or []
     named = {
         context.get("positive_prompt_id")
@@ -183,35 +228,115 @@ def stored_run_prompts(
     """
     paths = list(dict.fromkeys(path for path in image_paths if path))
     result: Dict[str, Optional[int]] = dict.fromkeys(paths)
-    if not paths or not output_root:
-        return result
-    style = path_style or ("windows" if os.name == "nt" else "posix")
-    located = {}
-    for path in paths:
-        location = _location(path, output_root, style)
-        if location is not None:
-            located[path] = location
-    if not located:
-        return result
-    names = sorted({filename for _key, _sub, filename in located.values()})
-    runs = _runs_by_location(db, names)
-    if not runs:
-        return result
     prompts: Dict[str, Optional[int]] = {}
-    for path, (root_key, subfolder, filename) in located.items():
-        reported = runs.get((filename, subfolder, root_key, style), {})
-        if len(reported) != 1:
-            continue
-        ((run_id, (began, ended)),) = reported.items()
-        if not _written_during(path, began, ended):
-            continue
+    for path, (run_id, _nodes) in recorded_runs(
+        db, paths, output_root, path_style
+    ).items():
         if run_id not in prompts:
-            prompts[run_id] = _named_prompt(db, run_id)
+            prompts[run_id] = named_prompt(db, run_id)
         result[path] = prompts[run_id]
     return result
 
 
+@dataclass(frozen=True)
+class RecordedOutput:
+    """What recorded history knows about the run that wrote one file (#386).
+
+    ``saver_id`` is the one output node the run reported the file from (None
+    when several did). ``texts`` maps each sampler anchor of the run to the
+    effective texts PromptManager recorded at execution for its roles
+    (``{"positive": text or None, "negative": text or None}``); a role whose
+    text was only inferred from the graph is None.
+    """
+
+    saver_id: Optional[str]
+    texts: Dict[str, Dict[str, Optional[str]]]
+
+
+def _recorded_texts(db: Any, run_id: str) -> Dict[str, Dict[str, Optional[str]]]:
+    texts = {}
+    for context in db.get_execution_contexts(run_id).get("contexts") or []:
+        evidence = context.get("evidence") or {}
+        roles = {}
+        for role in ("positive", "negative"):
+            values = context.get(role) or {}
+            proof = (evidence.get(role) or {}).get("effective") or {}
+            value = values.get("effective")
+            recorded = proof.get("provenance") == "recorded"
+            roles[role] = value if recorded and isinstance(value, str) else None
+        texts[context["anchor_id"]] = roles
+    return texts
+
+
+def recorded_output(
+    db: Any,
+    image_path: str,
+    output_root: Optional[str],
+    path_style: Optional[str] = None,
+) -> Optional[RecordedOutput]:
+    """The recorded run facts for ``image_path``, else None (#386).
+
+    The file must be attributed to one run (``recorded_runs``: one run
+    reported its location and it was written during that run). Read-only; it
+    never links anything.
+    """
+    if not image_path:
+        return None
+    conn = db.model.get_connection()
+    own_transaction = not conn.in_transaction
+    if own_transaction:  # outputs and texts from one state of history
+        conn.execute("BEGIN")
+    try:
+        found = recorded_runs(db, [image_path], output_root, path_style)
+        if image_path not in found:
+            return None
+        run_id, nodes = found[image_path]
+        saver = next(iter(nodes)) if len(nodes) == 1 else None
+        return RecordedOutput(saver, _recorded_texts(db, run_id))
+    finally:
+        if own_transaction:
+            conn.rollback()
+
+
 _LOGGER = logging.getLogger("prompt_manager.run_attribution")
+
+
+def recorded_output_lookup(
+    db: Any, *, close: bool = False, reference: Optional[dict] = None
+) -> Callable[[Any], Any]:
+    """``lookup(path) -> RecordedOutput or None`` for the inspect routes (#386).
+
+    Uses ComfyUI's output folder. Any failure (no history, a locked library)
+    is logged and names no node, so the file is judged from its own metadata.
+    ``close`` closes the calling thread's connection afterwards, for routes
+    that close theirs after reading. ``reference`` (a history occurrence's
+    output reference) spells the file as history recorded it: the route's
+    target is case-normalized on Windows, and history matches names exactly.
+    """
+
+    def lookup(path: Any) -> Optional[RecordedOutput]:
+        root = host_output_directory()
+        if reference is not None:
+            if reference.get("folder_type") != "output" or not root:
+                return None
+            path = os.path.join(
+                root, reference.get("subfolder") or "", reference.get("filename") or ""
+            )
+        try:
+            return recorded_output(db, str(path), root)
+        except (sqlite3.Error, OSError, ValueError):
+            _LOGGER.warning("Recorded run lookup failed", exc_info=True)
+            return None
+        except Exception:
+            _LOGGER.exception("Recorded run lookup failed unexpectedly")
+            return None
+        finally:
+            if close:
+                db.model.close()
+
+    return lookup
+
+
 _SEALED_LISTENERS: List[weakref.WeakMethod] = []
 _SEALED_LOCK = threading.Lock()
 

database/scanned_prompts.py

@@ -0,0 +1,87 @@
+"""Link an output file to the prompt of one text, creating it when new (#247).
+
+The store step of ingestion from file metadata when the decision is a
+positive text (``utils.file_prompt``). The prompt insert and the link run in
+one ``BEGIN IMMEDIATE`` transaction: two writers never store one text twice,
+a failed link leaves no new prompt behind, and a file stays linked to one
+prompt (a file already linked to another prompt is a ``conflict``).
+"""
+
+import logging
+import os
+from typing import Any, Dict, Optional, Tuple
+
+from .pair_ingestion import Marks, file_link_rows, link_conflict, mark_created
+
+try:
+    from ..utils.hashing import generate_prompt_hash
+except ImportError:
+    from utils.hashing import generate_prompt_hash
+
+_LOGGER = logging.getLogger("prompt_manager.database.scanned_prompts")
+
+
+def store_scanned_prompt_or_raise(
+    db: Any, path: str, canonical: Dict[str, Any], text: str, marks: Marks
+) -> Tuple[str, Optional[int]]:
+    """``(status, prompt id)`` after linking ``path`` to ``text``'s prompt.
+
+    ``added`` (prompt created, carrying ``marks``), ``linked`` (stored text
+    reused), ``unchanged`` (already linked to it) or ``conflict`` (linked to
+    another prompt; nothing written, id None). Database errors are raised
+    and roll the whole store back, so a caller can run it again.
+    """
+    with db._pair_transaction() as conn:
+        rows = file_link_rows(conn, path)
+        if link_conflict(rows, generate_prompt_hash(text)):
+            return "conflict", None
+        if rows:
+            return "unchanged", rows[0]["prompt_id"]
+        prompt_id, created = db._pair_component_outcome(conn, text)
+        if created:
+            mark_created(conn, db, prompt_id, marks, os.path.basename(path))
+        db._insert_image_link(conn, prompt_id, path, canonical)
+        return ("added" if created else "linked"), prompt_id
+
+
+def store_scanned_prompt(
+    db: Any, path: str, canonical: Dict[str, Any], text: str, marks: Marks
+) -> Tuple[str, Optional[int]]:
+    """The scan's form: an error is logged and reported as ``("found", None)``.
+
+    A write that failed because Move library switched runs again on the new
+    library (``survive_library_switch``); the rerun re-checks the link rows.
+    """
+    try:
+        return db.survive_library_switch(
+            lambda: store_scanned_prompt_or_raise(db, path, canonical, text, marks)
+        )
+    except Exception as error:
+        _LOGGER.error(
+            f"Failed to store the prompt of {os.path.basename(path)}: {error}"
+        )
+        return "found", None
+
+
+def link_stored_prompt_or_raise(
+    db: Any, path: str, canonical: Dict[str, Any], prompt_id: int
+) -> Optional[str]:
+    """Link ``path`` to the stored prompt ``prompt_id`` (recorded history, #342).
+
+    ``linked``, ``unchanged`` (already linked to it), ``conflict`` (linked to
+    another prompt; nothing written) or None when the prompt is gone. One
+    ``BEGIN IMMEDIATE`` transaction; database errors are raised.
+    """
+    with db._pair_transaction() as conn:
+        rows = file_link_rows(conn, path)
+        if len(rows) > 1 or (rows and rows[0]["prompt_id"] != prompt_id):
+            return "conflict"
+        if rows:
+            return "unchanged"
+        exists = conn.execute(
+            "SELECT 1 FROM prompts WHERE id = ?", (prompt_id,)
+        ).fetchone()
+        if exists is None:
+            return None
+        db._insert_image_link(conn, prompt_id, path, canonical)
+        return "linked"

database/vocabulary.py

@@ -13,7 +13,9 @@ same connection before commit. Owner rows and their timestamps never change.
 
 Category consolidation is previewed in one ``library_snapshot`` and applied in
 one ``_pair_transaction`` that recomputes the owner projection and requires the
-preview's ``impact_token``; only rows carrying the exact source change.
+preview's ``impact_token``; only rows carrying the exact source change. Image
+rows holding the source (``image_categories``, #332) are owners too: they are
+counted, hashed into the token and renamed with the prompts and pairs.
 """
 
 import sqlite3
@@ -97,16 +99,30 @@ def _validate_tag_id(tag_id: object) -> None:
         raise ValueError("Invalid tag ID")
 
 
-# The /library/options universe: nonblank values on eligible parents or on
-# active pairs, grouped exactly (whitespace and case variants stay distinct).
-_CATEGORY_GROUPS = (
+# Category values in Tags & categories (#332 §7): the prompt-backed values
+# (nonblank values on eligible parents or on active pairs, grouped exactly, so
+# whitespace and case variants stay distinct; /library/options lists the same
+# prompt-backed set with its own query) plus the values only image rows hold.
+# A prompt-backed value is ordered by its oldest owning positive; an image-only
+# value sorts after all of them (first_pid is SQLite's INTEGER maximum, above
+# any prompt id), then by value. ``image_count`` counts stored rows, including
+# files missing on disk. No FULL OUTER JOIN, so it runs on SQLite 3.31+.
+_IMAGE_ONLY_FIRST_PID = 2**63 - 1
+_CATEGORY_ROWS = (
     "WITH owners(value,pid) AS ("
     "SELECT p.category,p.id FROM prompts p WHERE p.category IS NOT NULL "
     "AND TRIM(p.category)!='' AND " + _ELIGIBLE + " "
     "UNION SELECT pp.category,pp.positive_prompt_id FROM prompt_pairs pp "
     "WHERE pp.archived=0 AND pp.category IS NOT NULL AND TRIM(pp.category)!=''),"
-    "grouped AS (SELECT value,MIN(pid) AS first_pid,"
-    "COUNT(DISTINCT pid) AS prompt_count FROM owners GROUP BY value) "
+    "image_values(value,image_count) AS ("
+    "SELECT category,COUNT(*) FROM image_categories GROUP BY category),"
+    "grouped(value,first_pid,prompt_count) AS ("
+    "SELECT value,MIN(pid),COUNT(DISTINCT pid) FROM owners GROUP BY value "
+    "UNION ALL SELECT value," + str(_IMAGE_ONLY_FIRST_PID) + ",0 FROM image_values "
+    "WHERE value NOT IN (SELECT value FROM owners)),"
+    "counted AS (SELECT g.value,g.first_pid,g.prompt_count,"
+    "COALESCE(i.image_count,0) AS image_count FROM grouped g "
+    "LEFT JOIN image_values i ON i.value=g.value) "
 )
 
 
@@ -117,15 +133,23 @@ _CATEGORY_COMPONENTS = (
     "WHERE p.category=? ORDER BY p.id"
 )
 _CATEGORY_PAIRS = "SELECT id,archived FROM prompt_pairs WHERE category=? ORDER BY id"
+# Image rows holding one exact value (#332 DC7), an index search.
+_IMAGE_CATEGORY_ROWIDS = (
+    "SELECT rowid FROM image_categories WHERE category=? ORDER BY rowid"
+)
 _CATEGORY_EXISTS = (
     "SELECT EXISTS(SELECT 1 FROM prompts WHERE category=:v)"
     " OR EXISTS(SELECT 1 FROM prompt_pairs WHERE category=:v)"
+    " OR EXISTS(SELECT 1 FROM image_categories WHERE category=:v)"
 )
 
-# Pairs after components, so a failing pair update rolls both back.
+# Pairs after components and image rows last, so a failing update rolls every
+# earlier one back. An image row is keyed by its file, never by its value, so
+# merging into a value other files already hold cannot conflict.
 _CATEGORY_UPDATES = (
     "UPDATE prompts SET category=?,updated_at=? WHERE category=?",
     "UPDATE prompt_pairs SET category=?,updated_at=? WHERE category=?",
+    "UPDATE image_categories SET category=?,updated_at=? WHERE category=?",
 )
 
 
@@ -136,8 +160,15 @@ def category_impact_token(
     target_exists: bool,
     components: list,
     pairs: list,
+    *,
+    images: list = (),
 ) -> str:
-    """Hash a category projection like ``library_edit_token`` (no secret)."""
+    """Hash a category projection like ``library_edit_token`` (no secret).
+
+    ``images`` are the rowids of the image rows holding ``source`` (#332 DC7).
+    With none the preimage has no ``images`` key, so a prompt-only token keeps
+    the value it had before image categories existed.
+    """
     preimage = {
         "epoch": epoch,
         "source": source,
@@ -146,6 +177,8 @@ def category_impact_token(
         "components": sorted([int(i), bool(flag)] for i, flag in components),
         "pairs": sorted([int(i), bool(flag)] for i, flag in pairs),
     }
+    if images:
+        preimage["images"] = sorted(int(i) for i in images)
     return canonical_token(_CATEGORY_DOMAIN, preimage)
 
 
@@ -325,7 +358,8 @@ class VocabularyOperations:
         pairs = [
             [row[0], bool(row[1])] for row in conn.execute(_CATEGORY_PAIRS, (source,))
         ]
-        if not components and not pairs:
+        images = [row[0] for row in conn.execute(_IMAGE_CATEGORY_ROWIDS, (source,))]
+        if not components and not pairs and not images:
             raise LibraryCommandError("vocabulary-conflict", epoch)
         target_exists = bool(
             conn.execute(_CATEGORY_EXISTS, {"v": target}).fetchone()[0]
@@ -339,9 +373,10 @@ class VocabularyOperations:
                 "other_prompts": len(components) - eligible,
                 "negative_variants": len(pairs) - archived,
                 "archived_negative_variants": archived,
+                "images": len(images),
             },
             "impact_token": category_impact_token(
-                epoch, source, target, target_exists, components, pairs
+                epoch, source, target, target_exists, components, pairs, images=images
             ),
         }
 
@@ -365,7 +400,8 @@ class VocabularyOperations:
     def apply_vocabulary_category(
         self, *, expected_epoch: str, source: str, target: str, impact_token: str
     ) -> dict:
-        """Set the exact ``source`` to ``target`` on every component and pair.
+        """Set the exact ``source`` to ``target`` on every component, pair
+        and image row.
 
         The recomputed projection must still match the preview's token; a
         mismatch is ``vocabulary-conflict`` with nothing written.
@@ -422,15 +458,15 @@ class VocabularyOperations:
         _limit(limit)
         key = _category_after(after)
         total = conn.execute(
-            _CATEGORY_GROUPS + "SELECT COUNT(*) FROM grouped"
+            _CATEGORY_ROWS + "SELECT COUNT(*) FROM counted"
         ).fetchone()[0]
         where, params = "", []
         if key is not None:
             where = " WHERE first_pid>? OR (first_pid=? AND value>?)"
             params = [key[0], key[0], key[1]]
         rows = conn.execute(
-            _CATEGORY_GROUPS
-            + "SELECT value,first_pid,prompt_count FROM grouped"
+            _CATEGORY_ROWS
+            + "SELECT value,first_pid,prompt_count,image_count FROM counted"
             + where
             + " ORDER BY first_pid,value LIMIT ?",
             [*params, limit + 1],
@@ -440,7 +476,11 @@ class VocabularyOperations:
         return {
             "library_epoch": epoch,
             "categories": [
-                {"value": row["value"], "prompt_count": row["prompt_count"]}
+                {
+                    "value": row["value"],
+                    "prompt_count": row["prompt_count"],
+                    "image_count": row["image_count"],
+                }
                 for row in rows
             ],
             "total": total,

prompt_manager.py

@@ -26,13 +26,13 @@ except ImportError:
     InputTypeDict = dict
 
 try:
-    from .prompt_manager_base import PromptManagerBase
+    from .prompt_manager_base import SAVE_TO_LIBRARY_INPUT, PromptManagerBase
 except ImportError:
     import os
     import sys
 
     sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
-    from prompt_manager_base import PromptManagerBase
+    from prompt_manager_base import SAVE_TO_LIBRARY_INPUT, PromptManagerBase
 
 
 class PromptManager(PromptManagerBase, ComfyNodeABC):
@@ -115,6 +115,7 @@ class PromptManager(PromptManagerBase, ComfyNodeABC):
                         )
                     },
                 ),
+                "save_to_library": SAVE_TO_LIBRARY_INPUT,
             },
             "hidden": {
                 # The queued graph and this node's id: used to tell the positive
@@ -152,6 +153,7 @@ class PromptManager(PromptManagerBase, ComfyNodeABC):
         append_text: str = "",
         prompt: Optional[Dict[str, Any]] = None,
         unique_id: Optional[str] = None,
+        save_to_library: bool = True,
     ) -> Tuple[Any]:
         """
         Encode the text prompt and save it to the database.
@@ -164,6 +166,7 @@ class PromptManager(PromptManagerBase, ComfyNodeABC):
             search_text: Text to search for in past prompts
             prepend_text: Text to prepend to the main prompt
             append_text: Text to append to the main prompt
+            save_to_library: Off: nothing is saved, counted or tracked (#90)
 
         Returns:
             Tuple containing the conditioning for the diffusion model and the final
@@ -205,7 +208,9 @@ class PromptManager(PromptManagerBase, ComfyNodeABC):
         # Save prompt to database and set execution context for gallery tracking
         prompt_id = None
         extended_tags = []
-        if storage_text and storage_text.strip():
+        if not save_to_library:
+            self._skip_not_saved(prompt, unique_id)
+        elif storage_text and storage_text.strip():
             self.logger.debug(f"Processing prompt text: {storage_text[:100]}...")
 
             # Add prepend/append info to tags if they exist
@@ -249,6 +254,11 @@ class PromptManager(PromptManagerBase, ComfyNodeABC):
         tokens = clip.tokenize(encoding_text)
         conditioning = clip.encode_from_tokens_scheduled(tokens)
 
+        self.logger.info(f"CLIP encoding completed, text: {repr(encoding_text)[:80]}")
+        result = (conditioning, encoding_text)
+        if not save_to_library:
+            return result  # #90: no metadata registration, no history text
+
         # Register with ComfyUI integration for standard metadata compatibility
         node_id = f"promptmanager_{int(time.time() * 1000)}"
         self.comfyui_integration.register_prompt(
@@ -262,12 +272,10 @@ class PromptManager(PromptManagerBase, ComfyNodeABC):
                 "append_text": append_text.strip() if append_text else None,
             },
         )
-
-        self.logger.info(f"CLIP encoding completed, text: {repr(encoding_text)[:80]}")
-        result = (conditioning, encoding_text)
         record_runtime_context(
             type(self).__name__, text, prepend_text, append_text, encoding_text
         )
+        self._record_cached_item(unique_id, (encoding_text,), storage_text)
         return result
 
     @classmethod

prompt_manager_base.py

@@ -23,9 +23,16 @@ try:
     from .utils.image_monitor import get_image_monitor
     from .utils.prompt_tracker import get_prompt_tracker
     from .utils.hashing import generate_prompt_hash
-    from .utils.prompt_graph import resolve_text, run_prompt_nodes
+    from .utils.prompt_graph import resolve_text, run_prompt_nodes, save_setting
     from .utils.run_keys import executing_run_id, prompt_node_key
     from .utils.usage_tracking import PENDING_FIRST_USE
+    from .utils.cached_runs import (
+        CACHED_RUNS,
+        Role,
+        Seen,
+        own_counts,
+        stored_facts,
+    )
 except ImportError:
     import sys
 
@@ -35,9 +42,32 @@ except ImportError:
     from utils.image_monitor import get_image_monitor
     from utils.prompt_tracker import get_prompt_tracker
     from utils.hashing import generate_prompt_hash
-    from utils.prompt_graph import resolve_text, run_prompt_nodes
+    from utils.prompt_graph import resolve_text, run_prompt_nodes, save_setting
     from utils.run_keys import executing_run_id, prompt_node_key
     from utils.usage_tracking import PENDING_FIRST_USE
+    from utils.cached_runs import (
+        CACHED_RUNS,
+        Role,
+        Seen,
+        own_counts,
+        stored_facts,
+    )
+
+
+# The optional input every PromptManager node declares last (#90): declared
+# last so no widget value of a workflow saved before it shifts.
+SAVE_TO_LIBRARY_INPUT = (
+    "BOOLEAN",
+    {
+        "default": True,
+        "label_on": "save",
+        "label_off": "skip",
+        "tooltip": (
+            "Save this node's prompt to the library, count its runs and link its "
+            "images. Off: PromptManager ignores the run; the output is unchanged."
+        ),
+    },
+)
 
 
 class PromptManagerBase:
@@ -71,8 +101,10 @@ class PromptManagerBase:
         """Save the prompt to the SQLite database.
 
         Runs are normally counted by the queue hook (utils/usage_tracking.py), so a
-        save only counts one when asked to (batch items whose text the hook could not
-        see) or when the hook queued this prompt before it existed.
+        save only counts one when asked to (text the hook could not see, unless
+        this job already counted the node from ComfyUI's cache) or when the hook
+        queued this prompt before it existed. The two are independent: the
+        pending catch-up is written even when ``count_run`` is False.
 
         Args:
             text: The prompt text
@@ -140,7 +172,9 @@ class PromptManagerBase:
         resolved = resolve_text(prompt_graph, node_id)
         return {
             "is_run_prompt": node_id in run_prompt_nodes(prompt_graph),
+            # The hook skips a switch it cannot read (#90): the node counts
             "seen_at_queue": resolved is not None
+            and save_setting(prompt_graph, node_id) is True
             and generate_prompt_hash(resolved) == generate_prompt_hash(text),
             "known": True,
         }
@@ -167,8 +201,19 @@ class PromptManagerBase:
         batch_item = (
             role["known"] and role["is_run_prompt"] and not role["seen_at_queue"]
         )
+        counts = own_counts(
+            type(self).__name__,
+            stored_facts(text),
+            Role(
+                frozenset({"text"} if role["known"] and role["is_run_prompt"] else ())
+            ),
+            Seen(text=role["seen_at_queue"]),
+        )
         prompt_id = self._save_prompt_to_database(
-            text=text, category=category, tags=tags, count_run=batch_item
+            text=text,
+            category=category,
+            tags=tags,
+            count_run=bool(counts) and not self._replayed(unique_id),
         )
         if role["is_run_prompt"] and not prompt_id:
             # The save failed: an older entry of this key must not stand in (#342)
@@ -182,6 +227,34 @@ class PromptManagerBase:
             )
         return prompt_id
 
+    def _cached_runs(self) -> Any:
+        return getattr(self, "cached_runs", CACHED_RUNS)
+
+    def _replayed(self, unique_id: Any) -> bool:
+        """This job already counted the node from ComfyUI's cache (#347).
+
+        A RAM-pressure cache can free the entry after ``execution_cached``, so
+        the node executes in a job that replayed it: its own count is skipped.
+        """
+        try:
+            return unique_id is not None and self._cached_runs().replayed(unique_id)
+        except Exception as error:
+            self.logger.debug(f"Could not check the cached-run replay: {error}")
+            return False
+
+    def _record_cached_item(
+        self, unique_id: Any, outputs: tuple, text: Any, negative_text: Any = None
+    ) -> None:
+        """Remember this execution's outputs and stored text for cached jobs (#347)."""
+        if unique_id is None:
+            return
+        try:
+            self._cached_runs().record_item(
+                unique_id, outputs, stored_facts(text, negative_text)
+            )
+        except Exception as error:
+            self.logger.debug(f"Could not record the cached-run receipt: {error}")
+
     @staticmethod
     def _run_identity(prompt_graph: Any, unique_id: Any) -> Dict[str, Any]:
         """The tracker's proof that an image belongs to this execution (#342)."""
@@ -190,6 +263,24 @@ class PromptManagerBase:
             "run_id": executing_run_id(),
         }
 
+    def _skip_not_saved(self, prompt_graph: Any = None, unique_id: Any = None) -> None:
+        """``save_to_library`` is off: nothing is saved, counted or tracked (#90).
+
+        A literal off makes the node no run prompt (``utils.prompt_graph``), so
+        no image looks up its run key. A switch wired from a node the graph
+        cannot read keeps the node a run prompt: its run key is marked like an
+        empty editor's, so an earlier run's entry of that key never links this
+        run's images.
+        """
+        message = (
+            "Save to library is off for this node: its prompt is not saved, the "
+            "run is not counted and its images are not linked"
+        )
+        if isinstance(prompt_graph, dict) and unique_id is not None:
+            self._mark_untracked(prompt_graph, unique_id, message)
+        else:
+            self.logger.info(message)
+
     def _skip_empty_prompt(self, prompt_graph: Any, unique_id: Any) -> None:
         """The ``text`` editor is empty: save and track nothing (#342).
 

prompt_manager_pair.py

@@ -12,9 +12,21 @@ else:
 
 try:
     from .prompt_manager import IO, InputTypeDict, PromptManagerFocused
+    from .utils.cached_runs import (
+        PAIR,
+        Role,
+        Seen,
+        own_counts,
+        pair_components,
+        stored_facts,
+    )
     from .utils.hashing import generate_prompt_hash
     from .utils.pair_execution import record_pair_execution
-    from .utils.prompt_graph import intrinsic_pair_nodes, run_prompt_components
+    from .utils.prompt_graph import (
+        intrinsic_pair_nodes,
+        run_prompt_components,
+        save_setting,
+    )
     from .utils.prompt_pair_resolver import resolve_text_input
     from .utils.usage_tracking import (
         PENDING_FIRST_USE,
@@ -23,9 +35,21 @@ try:
     )
 except ImportError:
     from prompt_manager import IO, InputTypeDict, PromptManagerFocused
+    from utils.cached_runs import (
+        PAIR,
+        Role,
+        Seen,
+        own_counts,
+        pair_components,
+        stored_facts,
+    )
     from utils.hashing import generate_prompt_hash
     from utils.pair_execution import record_pair_execution
-    from utils.prompt_graph import intrinsic_pair_nodes, run_prompt_components
+    from utils.prompt_graph import (
+        intrinsic_pair_nodes,
+        run_prompt_components,
+        save_setting,
+    )
     from utils.prompt_pair_resolver import resolve_text_input
     from utils.usage_tracking import (
         PENDING_FIRST_USE,
@@ -74,8 +98,13 @@ class PromptManagerPair(PromptManagerFocused):
         prompt: Optional[Dict[str, Any]] = None,
         unique_id: Optional[str] = None,
         extra_pnginfo: Optional[Dict[str, Any]] = None,
+        save_to_library: bool = True,
     ) -> Tuple[Any, Any, str, str]:
-        """Encode both sides once; database and tracking failures never block CLIP."""
+        """Encode both sides once; database and tracking failures never block CLIP.
+
+        With ``save_to_library`` off nothing is saved, counted, tracked or
+        recorded (#90); the four outputs are the same.
+        """
         if clip is None:
             raise RuntimeError("ERROR: clip input is invalid: None")
         if not isinstance(text, str) or not isinstance(negative_text, str):
@@ -93,6 +122,10 @@ class PromptManagerPair(PromptManagerFocused):
         negative_conditioning = clip.encode_from_tokens_scheduled(
             clip.tokenize(negative_text)
         )
+        result = positive_conditioning, negative_conditioning, positive, negative_text
+        if not save_to_library:
+            self._skip_not_saved(prompt, unique_id)
+            return result
         record_pair_execution(
             extra_pnginfo,
             unique_id,
@@ -153,7 +186,6 @@ class PromptManagerPair(PromptManagerFocused):
             )
         except Exception as error:
             self.logger.warning(f"Could not register paired metadata: {error}")
-        result = positive_conditioning, negative_conditioning, positive, negative_text
         record_runtime_context(
             type(self).__name__,
             text,
@@ -165,6 +197,9 @@ class PromptManagerPair(PromptManagerFocused):
         record_runtime_context(
             type(self).__name__, negative_text, "", "", negative_text, role="negative"
         )
+        self._record_cached_item(
+            unique_id, (positive, negative_text), text, negative_text
+        )
         return result
 
     def _save_and_track_pair(
@@ -200,6 +235,9 @@ class PromptManagerPair(PromptManagerFocused):
         resolved_negative = (
             resolve_text_input(prompt, node_id, "negative_text") if known else None
         )
+        if known and save_setting(prompt, node_id) is not True:
+            # The hook skips a switch it cannot read (#90): the node counts
+            resolved_positive = resolved_negative = None
         positive_seen = resolved_positive is not None and generate_prompt_hash(
             resolved_positive
         ) == generate_prompt_hash(text)
@@ -209,36 +247,35 @@ class PromptManagerPair(PromptManagerFocused):
             and generate_prompt_hash(resolved_negative)
             == generate_prompt_hash(negative_text)
         )
+        negative_seen = resolved_negative is not None and generate_prompt_hash(
+            resolved_negative
+        ) == generate_prompt_hash(negative_text)
         positive_pending = getattr(self, "pending_first_use", PENDING_FIRST_USE)
         pair_pending = getattr(self, "pending_pair_first_use", PENDING_PAIR_FIRST_USE)
-        counted = set()
-        for field, component_text, resolved_text, component_id in (
-            ("text", text, resolved_positive, prompt_id),
-            (
-                "negative_text",
-                negative_text,
-                resolved_negative,
-                pair["negative_prompt_id"],
-            ),
-        ):
-            component_hash = generate_prompt_hash(component_text)
-            if (
-                field not in used_fields
-                or not component_id
-                or component_hash in counted
-            ):
+        facts = stored_facts(text, negative_text)
+        role = Role(frozenset(used_fields), pair_used)
+        # Own counts are skipped when this job already counted the node from
+        # ComfyUI's cache (#347); the pending first-use catch-up never is.
+        counts = (
+            []
+            if self._replayed(unique_id)
+            else own_counts(
+                PAIR, facts, role, Seen(positive_seen, negative_seen, pair_seen)
+            )
+        )
+        component_ids = {"text": prompt_id, "negative_text": pair["negative_prompt_id"]}
+        for field, component_hash in pair_components(facts, role):
+            component_id = component_ids[field]
+            if not component_id:
                 continue
-            counted.add(component_hash)
-            seen_at_queue = (
-                resolved_text is not None
-                and generate_prompt_hash(resolved_text) == component_hash
+            runs = positive_pending.consume(component_hash) + int(
+                ("prompt", component_hash) in counts
             )
-            runs = positive_pending.consume(component_hash) + int(not seen_at_queue)
             if runs:
                 self.db.record_prompt_use(component_id, times=runs)
         if pair_used:
             runs = pair_pending.consume(pair_run_key(text, negative_text)) + int(
-                not pair_seen
+                ("pair", facts.positive_hash, facts.negative_hash) in counts
             )
             if runs:
                 self.db.record_prompt_pair_use(pair_id, times=runs)

prompt_manager_text.py

@@ -26,13 +26,13 @@ except ImportError:
     InputTypeDict = dict
 
 try:
-    from .prompt_manager_base import PromptManagerBase
+    from .prompt_manager_base import SAVE_TO_LIBRARY_INPUT, PromptManagerBase
 except ImportError:
     import os
     import sys
 
     sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
-    from prompt_manager_base import PromptManagerBase
+    from prompt_manager_base import SAVE_TO_LIBRARY_INPUT, PromptManagerBase
 
 
 class PromptManagerText(PromptManagerBase, ComfyNodeABC):
@@ -115,6 +115,7 @@ class PromptManagerText(PromptManagerBase, ComfyNodeABC):
                         ),
                     },
                 ),
+                "save_to_library": SAVE_TO_LIBRARY_INPUT,
             },
             "hidden": {
                 # The queued graph and this node's id: used to tell the positive
@@ -149,6 +150,7 @@ class PromptManagerText(PromptManagerBase, ComfyNodeABC):
         append_text: str = "",
         prompt: Optional[Dict[str, Any]] = None,
         unique_id: Optional[str] = None,
+        save_to_library: bool = True,
     ) -> Tuple[str]:
         """
         Process the text prompt and save it to the database.
@@ -160,6 +162,7 @@ class PromptManagerText(PromptManagerBase, ComfyNodeABC):
             search_text: Text to search for in past prompts
             prepend_text: Text to prepend to the main prompt
             append_text: Text to append to the main prompt
+            save_to_library: Off: nothing is saved, counted or tracked (#90)
 
         Returns:
             Tuple containing the final processed text string
@@ -184,7 +187,9 @@ class PromptManagerText(PromptManagerBase, ComfyNodeABC):
         # Save prompt to database and set execution context for gallery tracking
         prompt_id = None
         extended_tags = []
-        if storage_text and storage_text.strip():
+        if not save_to_library:
+            self._skip_not_saved(prompt, unique_id)
+        elif storage_text and storage_text.strip():
             self.logger.debug(f"Processing prompt text: {storage_text[:100]}...")
 
             # Add prepend/append info to tags if they exist
@@ -220,6 +225,11 @@ class PromptManagerText(PromptManagerBase, ComfyNodeABC):
         else:
             self._skip_empty_prompt(prompt, unique_id)
 
+        self.logger.debug(f"Text processing completed: {final_text[:100]}...")
+        result = (final_text,)
+        if not save_to_library:
+            return result  # #90: no metadata registration, no history text
+
         # Register with ComfyUI integration for standard metadata compatibility
         node_id = f"promptmanagertext_{int(time.time() * 1000)}"
         self.comfyui_integration.register_prompt(
@@ -233,12 +243,10 @@ class PromptManagerText(PromptManagerBase, ComfyNodeABC):
                 "append_text": append_text.strip() if append_text else None,
             },
         )
-
-        self.logger.debug(f"Text processing completed: {final_text[:100]}...")
-        result = (final_text,)
         record_runtime_context(
             type(self).__name__, text, prepend_text, append_text, final_text
         )
+        self._record_cached_item(unique_id, (final_text,), storage_text)
         return result
 
     @classmethod

py/api/__init__.py

@@ -72,9 +72,11 @@ from .diagnostics_report import DiagnosticsReportMixin
 from .autotag_routes import AutotagRoutesMixin
 from .lora_integration import LoraIntegrationMixin
 from .lora_import_routes import LoraImportRoutesMixin
+from .image_categories import ImageCategoryRoutesMixin
 
 try:
     from ...database.operations import PromptDatabase
+    from ...utils.file_prompt import parse_comfyui_prompt
     from ...utils.logging_config import get_logger
     from ...utils.video_metadata import is_video_path, read_video_metadata
 except ImportError:
@@ -84,6 +86,7 @@ except ImportError:
         0, os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
     )
     from database.operations import PromptDatabase
+    from utils.file_prompt import parse_comfyui_prompt
     from utils.logging_config import get_logger
     from utils.video_metadata import is_video_path, read_video_metadata
 
@@ -336,6 +339,7 @@ class PromptManagerAPI(
     AutotagRoutesMixin,
     LoraIntegrationMixin,
     LoraImportRoutesMixin,
+    ImageCategoryRoutesMixin,
 ):
     """REST API handler for PromptManager operations and web interface.
 
@@ -700,6 +704,7 @@ class PromptManagerAPI(
         self._register_autotag_routes(routes)
         self._register_lora_routes(routes)
         self._register_lora_import_routes(routes)
+        self._register_image_category_routes(routes)
 
         # Register gzip compression middleware (once)
         global _gzip_registered
@@ -1025,85 +1030,4 @@ class PromptManagerAPI(
 
     def _parse_comfyui_prompt(self, metadata):
         """Parse ComfyUI and A1111 prompt data from metadata."""
-        result = {
-            "prompt": None,
-            "workflow": None,
-            "parameters": {},
-            "positive_prompt": None,
-            "negative_prompt": None,
-        }
-
-        # Check for A1111/Forge style parameters first.
-        # The chunk is one block: a possibly multi-line positive prompt, then a
-        # "Negative prompt:" section, then a trailing "Steps: ..." settings line.
-        # Taking lines[0] as the positive prompt truncates any multi-line prompt
-        # to one line, so split on the settings line instead.
-        if "parameters" in metadata:
-            import re as _re
-
-            params = metadata["parameters"]
-            body = params
-            settings = ""
-            _sm = _re.search(r"\nSteps:\s", body)
-            if _sm:
-                settings = body[_sm.start() + 1 :].strip()
-                body = body[: _sm.start()]
-            negative = None
-            _nm = _re.search(r"(?im)^\s*negative prompt:\s*", body)
-            if _nm:
-                negative = body[_nm.end() :].strip()
-                body = body[: _nm.start()]
-            elif body.lower().lstrip().startswith("negative prompt:"):
-                negative = body.lower().lstrip()[len("negative prompt:") :].strip()
-                body = ""
-            result["positive_prompt"] = body.strip() or None
-            if negative:
-                result["negative_prompt"] = negative
-            # Store raw parameters too
-            result["parameters"]["parameters"] = params
-            if settings:
-                for _f in ("Steps", "Sampler", "Schedule type", "CFG scale", "Seed"):
-                    _fm = _re.search(
-                        r"(?i)(?:^|,\s*)" + _re.escape(_f) + r":\s*([^,]+)", settings
-                    )
-                    if _fm:
-                        result["parameters"][_f.lower().replace(" ", "_")] = _fm.group(
-                            1
-                        ).strip()
-
-        # If no A1111 format found, proceed with ComfyUI parsing
-        if result["positive_prompt"] is None:
-            # Check for direct prompt field
-            if "prompt" in metadata:
-                try:
-                    prompt_data = json.loads(metadata["prompt"])
-                    result["prompt"] = prompt_data
-                except json.JSONDecodeError:
-                    result["prompt"] = metadata["prompt"]
-
-            # Check for workflow
-            if "workflow" in metadata:
-                try:
-                    workflow_data = json.loads(metadata["workflow"])
-                    result["workflow"] = workflow_data
-                except json.JSONDecodeError:
-                    result["workflow"] = metadata["workflow"]
-
-            # Check for other common ComfyUI fields
-            common_fields = [
-                "positive",
-                "negative",
-                "steps",
-                "cfg",
-                "sampler",
-                "scheduler",
-                "seed",
-            ]
-            for field in common_fields:
-                if field in metadata:
-                    try:
-                        result["parameters"][field] = json.loads(metadata[field])
-                    except json.JSONDecodeError:
-                        result["parameters"][field] = metadata[field]
-
-        return result
+        return parse_comfyui_prompt(metadata)

py/api/admin.py

@@ -35,43 +35,56 @@ except ImportError:
     from utils.parallel import map_parallel
 
 try:
-    from ...database.pair_ingestion import blank_positive, ingest_resolved_pair
-    from ...database.run_attribution import (
-        host_output_directory,
-        stored_run_prompt,
-        stored_run_prompts,
-    )
-    from ...utils.generation_params import (
-        PLACEHOLDERS,
-        GenerationParamsError,
-        extract_generation_params,
-        parse_page_json,
-    )
-    from ...utils.prompt_pair_resolver import resolve_prompt_pair, sampler_less_prompt
-    from ...utils.review_capture import reviewable
+    from ...utils import exit_signal
 except ImportError:
-    from database.pair_ingestion import blank_positive, ingest_resolved_pair
-    from database.run_attribution import (
+    from utils import exit_signal
+
+try:
+    from ...database.pair_ingestion import SCAN_MARKS, ingest_resolved_pair
+    from ...database.run_attribution import (
+        RecordedOutput,
         host_output_directory,
-        stored_run_prompt,
-        stored_run_prompts,
+        named_prompt,
+        recorded_runs,
     )
-    from utils.generation_params import (
-        PLACEHOLDERS,
-        GenerationParamsError,
-        extract_generation_params,
-        parse_page_json,
+    from ...database.scanned_prompts import (
+        link_stored_prompt_or_raise,
+        store_scanned_prompt,
+    )
+    from ...utils.file_prompt import (
+        NEVER,
+        NOT_SAVED,
+        NOT_SAVED_WIRED,
+        PAIR,
+        Policy,
+        decide_file_prompt,
+    )
+except ImportError:
+    from database.pair_ingestion import SCAN_MARKS, ingest_resolved_pair
+    from database.run_attribution import (
+        RecordedOutput,
+        host_output_directory,
+        named_prompt,
+        recorded_runs,
+    )
+    from database.scanned_prompts import (
+        link_stored_prompt_or_raise,
+        store_scanned_prompt,
+    )
+    from utils.file_prompt import (
+        NEVER,
+        NOT_SAVED,
+        NOT_SAVED_WIRED,
+        PAIR,
+        Policy,
+        decide_file_prompt,
     )
-    from utils.prompt_pair_resolver import resolve_prompt_pair, sampler_less_prompt
-    from utils.review_capture import reviewable
 
 
 try:
     from ...database.library import display_title
-    from ...utils.hashing import generate_prompt_hash
 except ImportError:
     from database.library import display_title
-    from utils.hashing import generate_prompt_hash
 
 IMAGE_EXTENSIONS = (".png", ".jpg", ".jpeg", ".gif", ".webp", ".bmp", ".tiff")
 VIDEO_EXTENSIONS = (".mp4", ".avi", ".mov", ".mkv", ".webm", ".m4v", ".wmv")
@@ -118,6 +131,7 @@ def _collect_media_files(output_dirs, extensions):
         if not os.path.isdir(root):
             continue
         for current, dirnames, filenames in os.walk(root, followlinks=False):
+            exit_signal.checkpoint()  # #376: stop between directories at exit
             depth = 0 if current == root else len(Path(current).relative_to(root).parts)
             dirnames[:] = sorted(
                 d
@@ -250,10 +264,15 @@ SCAN_DETAILS = {
     "skipped": "Skipped · already linked",
     "ambiguous": "Needs review: more than one prompt could match",
     "unresolved": "Needs review: the prompt could not be traced in the workflow",
-    "conflict": "Needs review: already linked to a different prompt",
+    "conflict": "Kept: already linked to a different prompt",
     "failed": "Error: the prompt could not be stored",
     "error": "Error: the file could not be processed (see the server log)",
     "found": "Metadata found, but no prompt text to store",
+    "not_saved": "Skipped · its PromptManager node does not save to the library",
+    "not_saved_wired": (
+        "Skipped · its Save to library switch is wired from another node, so only "
+        "the run itself can link it"
+    ),
     None: "No prompt metadata in the file",
 }
 
@@ -312,22 +331,6 @@ def _file_size(path):
         return None
 
 
-def _with_file_size(canonical, media_file):
-    """Record the file's size in ``file_info`` unless the metadata carries one.
-
-    Stored as ``generated_images.file_size``; the "new" scan scope skips a known
-    file only while its size is unchanged.
-    """
-    info = canonical.get("file_info")
-    info = dict(info) if isinstance(info, dict) else {}
-    if info.get("size") is None:
-        size = _file_size(media_file)
-        if size is not None:
-            info["size"] = size
-    if info:
-        canonical["file_info"] = info
-
-
 def _scan_roots(output_dirs):
     """(absolute root, public label, listing index), the most specific first.
 
@@ -583,18 +586,56 @@ class _BatchHistory:
     """A scan batch's recorded-history lookup, made on the first file needing it.
 
     Most files link through their metadata and never ask; the first one that
-    does triggers one lookup for the whole batch (``_recorded_runs_for``).
+    does triggers one ``recorded_runs`` pass for the whole batch, from which
+    both the stored prompt (``get``) and the recorded saver (``recorded``)
+    of every file are read. A failure is logged and names nothing.
     """
 
     def __init__(self, api, media_files):
         self._api = api
-        self._files = media_files
-        self._found = None
+        self._files = [str(path) for path in media_files]
+        self._runs = None
+        self._prompts = {}
+
+    def _found(self):
+        if self._runs is None:
+            try:
+                self._runs = recorded_runs(
+                    self._api.db, self._files, host_output_directory(), None
+                )
+            except Exception:
+                self._api.logger.warning(
+                    "History attribution failed for a scan batch", exc_info=True
+                )
+                self._runs = {}
+        return self._runs
 
     def get(self, path):
-        if self._found is None:
-            self._found = self._api._recorded_runs_for(self._files)
-        return self._found.get(path)
+        """The stored prompt id history attributes to ``path``, else None."""
+        found = self._found().get(path)
+        if found is None:
+            return None
+        run_id = found[0]
+        if run_id not in self._prompts:
+            try:
+                self._prompts[run_id] = named_prompt(self._api.db, run_id)
+            except Exception:
+                self._api.logger.warning(
+                    "History attribution failed for a scan batch", exc_info=True
+                )
+                self._prompts[run_id] = None
+        return self._prompts[run_id]
+
+    def recorded(self, path):
+        """``RecordedOutput(saver, {})`` for an attributed file, else None.
+
+        ``saver`` is set only when the run reported the file from one node.
+        """
+        found = self._found().get(path)
+        if found is None:
+            return None
+        nodes = found[1]
+        return RecordedOutput(next(iter(nodes)) if len(nodes) == 1 else None, {})
 
 
 class AdminRoutesMixin:
@@ -1659,24 +1700,6 @@ class AdminRoutesMixin:
                 note(media_file, status)
         return counts
 
-    @staticmethod
-    def _graph_prompt_text(metadata):
-        """The positive prompt the browser parser traces from the graphs, or None.
-
-        Records parse as the legacy pages parsed them (NaN reads as null).
-        """
-        records = {}
-        for key in ("prompt", "workflow"):
-            value = metadata.get(key)
-            records[key] = parse_page_json(value) if isinstance(value, str) else value
-        try:
-            positive = extract_generation_params(records)["positivePrompt"]
-        except GenerationParamsError:
-            return None
-        if not isinstance(positive, str) or positive == PLACEHOLDERS["positivePrompt"]:
-            return None
-        return positive.strip() or None
-
     def _ingest_scanned_file(
         self,
         media_file,
@@ -1687,124 +1710,81 @@ class AdminRoutesMixin:
         records=None,
         history=None,
     ):
-        """Enrich exact pairs; retain legacy positive-only import for absent pairs.
+        """Store the prompt the shared per-file decision names (#247).
 
-        Returns the file's scan status, or None without prompt metadata. With
-        ``detailed``, a stored or linked file returns a dict instead: its
-        ``status``, the prompt's display ``title`` and, for a resolved pair,
-        the pair counts. When the resolver finds the file ambiguous (whether
-        or not the browser parser then links it) and ``ambiguous`` is a list,
-        ``media_file`` is appended to it; only a file that then returns
-        ``"ambiguous"`` (nothing linked it) is a Needs review case. An
-        ambiguous result with nothing to choose (``reviewable`` is False: fewer
-        than two candidates carry a prompt) that nothing links returns
-        ``"unresolved"`` instead, and ``media_file`` goes to ``untraced``.
-        The parsed records of either ambiguous file go to
-        ``records["canonical"]`` when ``records`` is a dict.
+        ``utils.file_prompt.decide_file_prompt`` (scan policy) decides; this
+        stores the result. Returns the file's scan status, or None without
+        prompt metadata. With ``detailed``, a stored or linked file returns a
+        dict instead: its ``status``, the prompt's display ``title`` and, for
+        a resolved pair, the pair counts. When the resolver finds the file
+        ambiguous (whether or not a later step then links it) and
+        ``ambiguous`` is a list, ``media_file`` is appended to it; only a file
+        that then returns ``"ambiguous"`` (nothing linked it) is a Needs
+        review case. An ambiguous result with nothing to choose
+        (``reviewable`` is False: fewer than two candidates carry a prompt)
+        goes to ``untraced`` instead and returns ``"unresolved"`` when nothing
+        links it. The parsed records of either ambiguous file go to
+        ``records["canonical"]`` when ``records`` is a dict. ``history`` is
+        the batch's lazy recorded-history lookup.
         """
-        if not metadata:
-            # No prompt metadata (--disable-metadata, bare savers): only the
-            # recorded run can say which prompt made it (#342)
-            return self._link_recorded_run(media_file, {}, detailed, history)
-        canonical = dict(metadata)
-        for key in ("prompt", "workflow"):
-            if isinstance(canonical.get(key), str):
-                try:
-                    canonical[key] = json.loads(canonical[key])
-                except (ValueError, TypeError):
-                    # Preserve malformed metadata for conservative resolver rejection.
-                    pass
-        if not canonical.get("prompt") and not canonical.get("parameters"):
-            return self._link_recorded_run(media_file, canonical, detailed, history)
-        _with_file_size(canonical, media_file)
-        resolution = resolve_prompt_pair(canonical)
-        if blank_positive(resolution):
-            # Only prepend/append text: no stored prompt can own it (#342)
-            resolution = {**resolution, "state": "unresolved"}
-        # Ambiguous without a choice: unresolved unless something links it.
-        unchoosable = resolution["state"] == "ambiguous" and not reviewable(resolution)
-        if unchoosable:
-            if untraced is not None:
-                untraced.append(media_file)
-            if records is not None:
-                records["canonical"] = canonical
-        elif resolution["state"] == "ambiguous" and ambiguous is not None:
-            ambiguous.append(media_file)
-            if records is not None:
-                records["canonical"] = canonical
-        if resolution["state"] == "resolved":
-            result = ingest_resolved_pair(
-                self.db, str(media_file), canonical, resolution
+        path = str(media_file)
+        if history is None:  # one file: history is still asked once
+            history = _BatchHistory(self, [media_file])
+        decision = decide_file_prompt(
+            metadata,
+            file_name=Path(path).name,
+            file_size=functools.partial(_file_size, media_file),
+            in_output=False,  # only the monitor policy reads it
+            lookup=functools.partial(history.recorded, path),
+            policy=Policy.SCAN,
+        )
+        if decision.kind in (NOT_SAVED, NOT_SAVED_WIRED):
+            # Save to library off (#90): no write, recorded-run fallback or
+            # Needs review item
+            return decision.kind
+        self._note_review(media_file, decision, ambiguous, untraced, records)
+        if decision.kind == NEVER:
+            if decision.try_recorded_run:
+                linked = self._link_recorded_run(
+                    media_file, decision.canonical, detailed, history
+                )
+                if linked is not None:
+                    return linked
+            return decision.unlinked_status
+        if decision.kind == PAIR:
+            # A rerun after a library move re-checks the link rows.
+            result = self.db.survive_library_switch(
+                lambda: ingest_resolved_pair(
+                    self.db,
+                    path,
+                    decision.canonical,
+                    decision.resolution,
+                    marks=SCAN_MARKS,
+                )
             )
             if not detailed:
                 return result["status"]
-            return {
-                **result,
-                "title": self._scan_title(media_file, resolution["positive"]["text"]),
-            }
-        if canonical.get("prompt") and resolution["state"] in (
-            "ambiguous",
-            "unresolved",
-        ):
-            # The resolver could not decide: link the prompt the inspector and the
-            # legacy pages show for this file (the browser parser, in Python).
-            # Graphs without a recognized sampler keep the legacy extractor below.
-            prompt_text = self._graph_prompt_text(metadata)
-            if not prompt_text:
-                linked = self._link_recorded_run(
-                    media_file, canonical, detailed, history
-                )
-                if linked is not None:
-                    return linked
-                return "unresolved" if unchoosable else resolution["state"]
-        elif resolution["state"] == "ambiguous":
-            return "unresolved" if unchoosable else "ambiguous"
-        elif resolution["state"] == "unresolved" and not isinstance(
-            canonical.get("parameters"), str
-        ):
-            return resolution["state"]
-        elif canonical.get("prompt"):
-            # No node takes a positive or negative input (a guider or wrapper
-            # graph): the one wired text, never a guess (#252).
-            found = sampler_less_prompt(canonical["prompt"])
-            prompt_text = found["text"]
-            if prompt_text is None and isinstance(canonical.get("parameters"), str):
-                # A metadata saver also wrote A1111 text: its positive prompt.
-                parsed = self._parse_comfyui_prompt(metadata)["positive_prompt"]
-                prompt_text = parsed.strip() if parsed and parsed.strip() else None
-            if prompt_text is None:
-                linked = self._link_recorded_run(
-                    media_file, canonical, detailed, history
-                )
-                if linked is not None:
-                    return linked
-                return "unresolved" if found["state"] == "ambiguous" else "found"
-        else:
-            prompt_text = self._parse_comfyui_prompt(metadata)["positive_prompt"]
-            if not (prompt_text and prompt_text.strip()):
-                return "found"
-            prompt_text = prompt_text.strip()
-
-        status = self._store_scanned_prompt(media_file, canonical, prompt_text)
+            title_text = decision.resolution["positive"]["text"]
+            return {**result, "title": self._scan_title(media_file, title_text)}
+        status, _prompt_id = store_scanned_prompt(
+            self.db, path, decision.canonical, decision.text, SCAN_MARKS
+        )
         if not detailed or status not in SCAN_TITLED_DETAILS:
             return status
-        return {"status": status, "title": self._scan_title(media_file, prompt_text)}
+        return {"status": status, "title": self._scan_title(media_file, decision.text)}
 
-    def _recorded_runs_for(self, media_files):
-        """``{path: prompt id or None}`` from recorded history for a scan batch.
-
-        One output lookup per chunk of names (``stored_run_prompts``), so a
-        batch never queries history once per file. An empty dict on failure.
-        """
-        try:
-            return stored_run_prompts(
-                self.db, [str(path) for path in media_files], host_output_directory()
-            )
-        except Exception:
-            self.logger.warning(
-                "History attribution failed for a scan batch", exc_info=True
-            )
-            return {}
+    @staticmethod
+    def _note_review(media_file, decision, ambiguous, untraced, records):
+        """Hand an ambiguous file to the batch's Needs review lists."""
+        if decision.review == "untraced":
+            if untraced is not None:
+                untraced.append(media_file)
+            if records is not None:
+                records["canonical"] = decision.canonical
+        elif decision.review == "ambiguous" and ambiguous is not None:
+            ambiguous.append(media_file)
+            if records is not None:
+                records["canonical"] = decision.canonical
 
     def _link_recorded_run(self, media_file, canonical, detailed=False, history=None):
         """Link a file recorded history attributes to one stored prompt (#342).
@@ -1813,31 +1793,25 @@ class AdminRoutesMixin:
         ``{"status", "title"}``), or None when history names no single stored
         prompt for the file (``database.run_attribution``). Never creates a
         prompt. Works without any prompt metadata in the file. ``history`` is
-        the batch's precomputed lookup; without it the file is looked up alone.
+        the batch's lookup (``_BatchHistory``). A file already linked to
+        another prompt is a ``conflict``: one prompt per file.
         """
-        if history is not None:
-            prompt_id = history.get(str(media_file))
-        else:
-            try:
-                prompt_id = stored_run_prompt(
-                    self.db, str(media_file), host_output_directory()
-                )
-            except Exception:
-                self.logger.warning(
-                    f"History attribution failed for {media_file.name}",
-                    exc_info=True,
-                )
-                return None
+        if history is None:
+            history = _BatchHistory(self, [media_file])
+        prompt_id = history.get(str(media_file))
         if prompt_id is None:
             return None
         try:
-            image_id = self.db.link_image_to_prompt(
-                prompt_id, str(media_file), metadata=canonical
+            status = self.db.survive_library_switch(
+                lambda: link_stored_prompt_or_raise(
+                    self.db, str(media_file), canonical, prompt_id
+                )
             )
         except Exception as e:
             self.logger.error(f"Failed to link {media_file.name} from history: {e}")
             return "found"
-        status = "linked" if image_id else "unchanged"
+        if status is None:
+            return None
         if not detailed or status not in SCAN_TITLED_DETAILS:
             return status
         prompt = self.db.get_prompt_by_id(prompt_id) or {}
@@ -1857,35 +1831,3 @@ class AdminRoutesMixin:
         except Exception:
             self.logger.warning("Scan row title could not be read; using its text")
         return display_title((), text)
-
-    def _store_scanned_prompt(self, media_file, canonical, prompt_text):
-        """Link ``media_file`` to ``prompt_text``'s prompt, saving it when new."""
-        prompt_hash = generate_prompt_hash(prompt_text)
-        existing = self.db.get_prompt_by_hash(prompt_hash)
-        if existing:
-            try:
-                image_id = self.db.link_image_to_prompt(
-                    existing["id"], str(media_file), metadata=canonical
-                )
-            except Exception as e:
-                self.logger.error(
-                    f"Failed to link {media_file.name} to existing prompt: {e}"
-                )
-                return "found"
-            return "linked" if image_id else "unchanged"
-
-        prompt_id = self.db.save_prompt(
-            prompt_text,
-            "scanned",
-            ["auto-scanned"],
-            None,
-            f"Auto-scanned from {media_file.name}",
-            prompt_hash,
-        )
-        if not prompt_id:
-            return "found"
-        try:
-            self.db.link_image_to_prompt(prompt_id, str(media_file), metadata=canonical)
-        except Exception as e:
-            self.logger.error(f"Failed to link {media_file.name} to new prompt: {e}")
-        return "added"

py/api/annotations.py

@@ -27,7 +27,12 @@ from .annotation_suggest import (
     validate_options,
 )
 from .autotag_routes import model_busy_response
-from .images import _forbidden, _has_traversal, _unavailable_link, _verified_title
+
+# The target check is shared with the collection routes (#331); both names
+# stay importable from here.
+from .media_target import MAX_TARGET_PATH  # noqa: F401
+from .media_target import media_target as _target
+from .images import _unavailable_link, _verified_title
 from .prompts import bad_request
 from .. import model_gate
 
@@ -40,7 +45,7 @@ try:
     )
     from ...database.execution_history import subscribe_history_restore
     from ...database.library_commands import LibraryCommandError
-    from ...utils.media_capture import CAPTURE_EXTENSIONS, CaptureError, CaptureStore
+    from ...utils.media_capture import CaptureError, CaptureStore
 except ImportError:
     from database.annotations import (
         MAX_IMAGE_TAGS,
@@ -50,15 +55,13 @@ except ImportError:
     )
     from database.execution_history import subscribe_history_restore
     from database.library_commands import LibraryCommandError
-    from utils.media_capture import CAPTURE_EXTENSIONS, CaptureError, CaptureStore
+    from utils.media_capture import CaptureError, CaptureStore
 
 # Request bodies of the annotation routes are small (a target plus a tag set).
 MAX_BODY_BYTES = 64 * 1024
-MAX_TARGET_PATH = 1024
 CAPTURE_URL = "/prompt_manager/image-annotations/capture/"
 _PREVIEW_CHUNK = 64 * 1024
 
-_TARGET_FIELDS = frozenset({"root_index", "root_scope", "path"})
 _OBSERVE_FIELDS = frozenset({"target"})
 _SAVE_FIELDS = frozenset(
     {
@@ -188,37 +191,6 @@ def _capture_error(exc: CaptureError) -> web.Response:
     return _coded(exc.code, _MESSAGES.get(exc.code) or str(exc))
 
 
-def _target(data: object):
-    """``((index, scope, relative), None)`` for a target, else ``(None, error)``.
-
-    Only the listing identity is accepted: an int root index, the root's
-    64-hex scope and a bounded root-relative POSIX media path, never an
-    absolute, drive-qualified, backslash or ``..`` path. Nothing here touches
-    the filesystem or the database.
-    """
-    if not isinstance(data, dict) or set(data) != _TARGET_FIELDS:
-        return None, bad_request("target must name root_index, root_scope and path")
-    index, scope, relative = data["root_index"], data["root_scope"], data["path"]
-    if type(index) is not int or index < 0:
-        return None, bad_request("Invalid gallery root")
-    if not isinstance(scope, str) or _HEX64.fullmatch(scope) is None:
-        return None, bad_request("Invalid gallery root scope")
-    if not isinstance(relative, str) or not relative or len(relative) > MAX_TARGET_PATH:
-        return None, bad_request("path must be a relative media path")
-    parts = relative.split("/")
-    if (
-        "\0" in relative
-        or "\\" in relative
-        or relative.startswith("/")
-        or _has_traversal(relative)
-        or any(part in ("", ".", "..") or ":" in part for part in parts)
-    ):
-        return None, _forbidden()
-    if os.path.splitext(parts[-1])[1].lower() not in CAPTURE_EXTENSIONS:
-        return None, _forbidden("Only media files can be tagged")
-    return (index, scope, relative), None
-
-
 def _expires_at(seconds: float | None) -> str:
     moment = datetime.datetime.now(datetime.timezone.utc) + datetime.timedelta(
         seconds=max(0.0, seconds or 0.0)

py/api/duplicate_files.py

@@ -589,6 +589,7 @@ class DuplicateFilesMixin:
         spellings = await self._run_in_executor(self._source_spellings)
         removed, failure, keepers = 0, None, {}
         totals = dict.fromkeys(("moved", "merged", "favorites", "tags", "review"), 0)
+        totals["categories"] = 0  # image categories kept on the kept copies (#332)
         for done, target in enumerate(targets, start=1):
             if failure is not None:
                 self._record_target(job, "kept", target, NOT_ATTEMPTED)
@@ -635,6 +636,9 @@ class DuplicateFilesMixin:
             job.log_line(
                 f"Added {_plural(totals['tags'], 'image tag')} to the kept copies"
             )
+        if totals.get("categories"):
+            kept = _plural(totals["categories"], "image category", "image categories")
+            job.log_line(f"Kept {kept} on the kept copies")
         if totals["review"]:
             job.log_line(
                 f"Settled {_plural(totals['review'], 'Needs review item')} "

py/api/duplicate_spellings.py

@@ -18,7 +18,7 @@ Blocking: each lookup stats the file's folders once (cached).
 import os
 from pathlib import Path
 
-from .images import _favorite_relative_key, _favorite_root_key
+from .images import _favorite_relative_key, _favorite_root_key, image_category_key
 
 
 def _identity(path):
@@ -78,6 +78,15 @@ class Spellings:
                 )
         return spelled
 
+    @property
+    def listed_roots(self):
+        """The listed roots (the output sources), in order."""
+        return [root for root, _identity in self._listed]
+
+    def category_key(self, path):
+        """*path*'s image category file key (#332), or None outside every source."""
+        return image_category_key(self.listed_roots, path)
+
     def favorites(self, path):
         """``{listed root: path below it (POSIX)}`` for each listed root holding it."""
         path = os.path.abspath(str(path))
@@ -125,9 +134,23 @@ def copy_move(target, kept_stat, spellings):
         "targets": targets,
         "kept_path": target["keeper_abs"],
         "favorites": favorites,
+        "categories": _category_pairs(target, spellings),
         "removed_locator": target["locator"],
         "kept_locator": target["keeper_locator"],
         "sha256": target["hash"],
         "kept_size": kept_stat.st_size,
         "kept_mtime_ns": kept_stat.st_mtime_ns,
     }
+
+
+def _category_pairs(target, spellings):
+    """``[(removed file key, kept file key)]`` for the image category (#332).
+
+    From the two absolute paths, not the favorites tuples: those follow the
+    listed root, which differs from the file key when sources nest.
+    """
+    removed = spellings.category_key(target["abs"])
+    kept = spellings.category_key(target["keeper_abs"])
+    if removed is None or kept is None:
+        return []
+    return [(removed, kept)]

py/api/history.py

@@ -5,6 +5,7 @@ import base64
 import binascii
 from functools import wraps
 import json
+import os
 import re
 import sqlite3
 from typing import Callable
@@ -27,10 +28,12 @@ from .history_current import (
     snapshot_current_output_scope,
 )
 from .inspection_service import CurrentFileChanged, inspect_current_file
+from .images import image_category_key
 
 try:
     from ...database.execution_history import HistoryEpochChanged
     from ...database.history_gallery import read_history_gallery
+    from ...database.run_attribution import recorded_output_lookup
     from ...database.history_reads import (
         HistoryCaptureChanged,
         OutputPosition,
@@ -38,10 +41,15 @@ try:
         WindowPosition,
     )
     from ...utils.history_read_fence import HistoryReadFence
-    from ...utils.inspection_response import encode_history_inspection_response
+    from ...utils.inspection_response import (
+        OWN_CATEGORY_UNREAD,
+        apply_own_category,
+        encode_history_inspection_response,
+    )
 except ImportError:
     from database.execution_history import HistoryEpochChanged
     from database.history_gallery import read_history_gallery
+    from database.run_attribution import recorded_output_lookup
     from database.history_reads import (
         HistoryCaptureChanged,
         OutputPosition,
@@ -49,7 +57,11 @@ except ImportError:
         WindowPosition,
     )
     from utils.history_read_fence import HistoryReadFence
-    from utils.inspection_response import encode_history_inspection_response
+    from utils.inspection_response import (
+        OWN_CATEGORY_UNREAD,
+        apply_own_category,
+        encode_history_inspection_response,
+    )
 
 
 _RUN_MAX_BYTES = 8 * 1024 * 1024
@@ -675,6 +687,32 @@ class HistoryRoutesMixin:
     ) -> web.Response:
         return await self._history_current(request, "inspection")
 
+    def _history_own_category(self, reference: dict, scope):
+        """The recorded output's own category (#332), inside the snapshot.
+
+        The path is the symlink-resolved output folder plus the receipt's
+        subfolder and filename, keyed by ``image_category_key`` over the
+        configured output sources as Images keys it. A temp output or a path
+        no source holds has none. A failed read is OWN_CATEGORY_UNREAD.
+        """
+        if (
+            reference.get("folder_type") != "output"
+            or scope.canonical_output is None
+            or candidate_locator(reference, scope) is None
+        ):
+            return None
+        path = os.path.join(
+            str(scope.canonical_output), reference["subfolder"], reference["filename"]
+        )
+        try:
+            key = image_category_key(self._get_all_output_dirs(), path)
+            return None if key is None else self.db.image_category(*key)
+        except Exception:
+            self.logger.warning(
+                "History image category could not be read", exc_info=True
+            )
+            return OWN_CATEGORY_UNREAD
+
     async def _history_current(
         self, request: web.Request, kind: str
     ) -> web.StreamResponse:
@@ -699,6 +737,7 @@ class HistoryRoutesMixin:
                     if scope.current_scope != current_scope:
                         raise _current_stale()
                     result = db.get_history_occurrence(run_id, node, ordinal)
+                    own = None
                     if result is not None:
                         receipt = result["receipt"]
                         path = candidate_locator(receipt["reference"], scope)
@@ -706,6 +745,10 @@ class HistoryRoutesMixin:
                             db.model.get_connection(),
                             (path,) if path is not None else (),
                         )
+                        if kind == "inspection":
+                            own = self._history_own_category(
+                                receipt["reference"], scope
+                            )
             finally:
                 db.model.close()
             if result is None:
@@ -724,9 +767,19 @@ class HistoryRoutesMixin:
                         resolved.canonical_target,
                         source_label=resolved.public["source_label"],
                         saved=saved.get("saved"),
-                        library=saved.get(
-                            "library",
-                            {"status": "unavailable" if saved_unavailable else "none"},
+                        library=apply_own_category(
+                            saved.get(
+                                "library",
+                                {
+                                    "status": (
+                                        "unavailable" if saved_unavailable else "none"
+                                    )
+                                },
+                            ),
+                            own,
+                        ),
+                        recorded=recorded_output_lookup(
+                            db, close=True, reference=receipt["reference"]
                         ),
                     )
                     _reauthorize_current_target(resolved, scope)

py/api/image_categories.py

@@ -0,0 +1,374 @@
+"""Image category routes (#332): an image file's own category.
+
+``PUT /prompt_manager/images/category`` sets the own category of up to 500
+listed files; ``DELETE`` removes it (listed or not, so a missing file's
+category can still be removed); ``GET /prompt_manager/images/categories``
+lists the own-category values of files the sources list. Targets are the
+Images listing identity (``{root_index, root_scope, path}``, checked by
+``media_target``) of an output source; LoRA folders are not sources here.
+Instead of ``items`` a request may name ``filter``, the Images listing's own
+query ("Select all N matching", #392), resolved now up to 500 images.
+Each file is stored under its file key (``images.image_category_key``).
+These routes never read or write prompts, recipes or image links.
+"""
+
+import os
+from pathlib import Path
+
+from aiohttp import web
+
+from .image_tag_jobs import MAX_JOB_TARGETS, _parse_targets
+from .images import (
+    _favorite_relative_key,
+    _favorite_root_key,
+    _forbidden,
+    _json_body_or_error,
+    image_category_key,
+)
+from .prompts import bad_request
+
+try:
+    from ...database.image_categories import MAX_CATEGORY_LENGTH, MAX_KEY_LENGTH
+    from ...database.models import normalize_image_path
+    from ...utils.validators import validate_category
+except ImportError:
+    from database.image_categories import MAX_CATEGORY_LENGTH, MAX_KEY_LENGTH
+    from database.models import normalize_image_path
+    from utils.validators import validate_category
+
+CATEGORY_MEDIA_MESSAGE = "Only media files can have a category"
+_PUT_FIELDS = frozenset({"category"})
+_DELETE_FIELDS = frozenset()
+TOO_MANY = f"Select at most {MAX_JOB_TARGETS} images."
+SOURCE_CHANGED_MESSAGE = "The sources changed. Refresh the images and try again."
+WRITE_FAILED = "The category could not be changed."
+READ_FAILED = "Image categories could not be read."
+
+
+def _coded(status: int, code: str, message: str) -> web.Response:
+    return web.json_response(
+        {"success": False, "code": code, "error": message},
+        status=status,
+        headers={"Cache-Control": "no-store"},
+    )
+
+
+def _category_value(raw) -> tuple[str | None, web.Response | None]:
+    """The stripped category, or a 400 (an empty value is a 400: use DELETE)."""
+    if not isinstance(raw, str):
+        return None, bad_request("category must be a string")
+    value = raw.strip()
+    if not value:
+        return None, bad_request("category must not be empty")
+    if len(value) > MAX_CATEGORY_LENGTH:
+        return None, bad_request(
+            f"Category cannot exceed {MAX_CATEGORY_LENGTH} characters"
+        )
+    try:
+        value.encode("utf-8")
+        validate_category(value)
+    except UnicodeEncodeError:
+        return None, bad_request("category must be valid text")
+    except ValueError as exc:
+        return None, bad_request(str(exc))
+    return value, None
+
+
+class _KeyRefused(Exception):
+    """A target has no storable file key (outside every source, or too long)."""
+
+    def __init__(self, message: str = "Access denied"):
+        super().__init__(message)
+        self.message = message
+
+
+def _file_key(roots, root, relative) -> tuple[str, str]:
+    """The target's file key (blocking: resolves the sources)."""
+    key = image_category_key(roots, Path(root) / relative)
+    if key is None:
+        raise _KeyRefused()
+    if max(len(key[0]), len(key[1])) > MAX_KEY_LENGTH:
+        raise _KeyRefused("Path is too long")
+    return key
+
+
+def _nested_sources(root: Path, sources) -> list[tuple[str, str]]:
+    """``[(relative key prefix, source root key)]`` of sources inside *root*.
+
+    Deepest first, so the first prefix that matches is the file's source.
+    """
+    base = os.path.join(os.path.normcase(os.path.realpath(str(root))), "")
+    nested = []
+    for source in sources:
+        real = os.path.realpath(str(source))
+        if not os.path.normcase(real).startswith(base):
+            continue
+        relative = os.path.relpath(real, os.path.realpath(str(root)))
+        nested.append(
+            (
+                _favorite_relative_key(relative.replace(os.sep, "/")),
+                _favorite_root_key(source),
+            )
+        )
+    nested.sort(key=lambda item: item[0].count("/"), reverse=True)
+    return nested
+
+
+def _source_prefix(relative_key: str, nested) -> str | None:
+    """The prefix of the deepest nested source holding *relative_key*."""
+    for prefix, _source_key in nested:
+        if relative_key.startswith(prefix + "/"):
+            return prefix
+    return None
+
+
+class ImageCategoryRoutesMixin:
+    """Routes for images' own categories (#332)."""
+
+    def _register_image_category_routes(self, routes):
+        # Fixed paths beside DELETE /prompt_manager/images/{image_id}, as the
+        # favorite routes are. Registered after it, they still win: aiohttp
+        # (3.10+) looks fixed paths up before dynamic resources
+        # (test_delete_category_never_reaches_delete_image).
+        @routes.put("/prompt_manager/images/category")
+        async def set_image_category_route(request):
+            return await self.set_image_category(request)
+
+        @routes.delete("/prompt_manager/images/category")
+        async def clear_image_category_route(request):
+            return await self.clear_image_category(request)
+
+        @routes.get("/prompt_manager/images/categories")
+        async def list_image_categories_route(request):
+            return await self.list_image_categories(request)
+
+    # -- reading ---------------------------------------------------------------
+
+    def _own_category_map(self, sources, listings) -> dict:
+        """``{normalized listed path: own category}`` for the listed files (blocking).
+
+        One primary-key range read per source; each stored row is matched to
+        the listing of every selected root that holds its source, so the work
+        follows the stored rows, not the files. A file under a nested source
+        is keyed by the deepest one (``image_category_key``). A row whose file
+        is gone matches nothing. A failed read raises.
+        """
+        sources = list(sources)
+        rows = self.db.own_categories_of(_favorite_root_key(s) for s in sources)
+        if not rows:
+            return {}
+        by_source: dict[str, dict[str, str]] = {}
+        for (root_key, relative), category in rows.items():
+            by_source.setdefault(root_key, {})[relative] = category
+        found = {}
+        for _index, root, files in listings:
+            listing = self._favorite_listing(root, files)
+            root_key = _favorite_root_key(root)
+            # normalize_image_path(root / listed) without a call per file: the
+            # listed spellings are clean relative POSIX paths. Windows abspath
+            # also drops a component's trailing dots and spaces, so it keeps
+            # the call there.
+            base = os.path.join(normalize_image_path(str(root)), "")
+
+            def normalized(listed, base=base, root=root):
+                if os.name == "nt":
+                    return normalize_image_path(str(root / listed))
+                return base + os.path.normcase(listed.replace("/", os.sep))
+
+            nested = [
+                item for item in _nested_sources(root, sources) if item[1] != root_key
+            ]
+            for relative, category in by_source.get(root_key, {}).items():
+                listed = listing.get(relative)
+                if listed is not None and _source_prefix(relative, nested) is None:
+                    found[normalized(listed)] = category
+            for prefix, source_key in nested:
+                for relative, category in by_source.get(source_key, {}).items():
+                    full = f"{prefix}/{relative}"
+                    listed = listing.get(full)
+                    if listed is not None and _source_prefix(full, nested) == prefix:
+                        found[normalized(listed)] = category
+        return found
+
+    async def _source_listings(self, roots) -> list[tuple]:
+        return [
+            (index, root, await self._get_gallery_files(root))
+            for index, root in enumerate(roots)
+        ]
+
+    async def list_image_categories(self, request):
+        """GET: the own-category values of listed files, sorted."""
+        try:
+            roots = list(self._get_all_output_dirs())
+            listings = await self._source_listings(roots)
+            found = await self._run_in_executor(self._own_category_map, roots, listings)
+        except Exception:
+            self.logger.exception("Image categories read failed")
+            return _coded(500, "categories-failed", READ_FAILED)
+        return web.json_response(
+            {"success": True, "categories": sorted(set(found.values()))},
+            headers={"Cache-Control": "no-store"},
+        )
+
+    # -- writing ---------------------------------------------------------------
+
+    async def _filter_targets(self, raw):
+        """``(targets, None)`` for an Images listing filter, else ``(None, error)``.
+
+        "Select all N matching" (#392) sends the listing's own query; it is
+        resolved now, up to 500 images (a 400 ``too-many-images`` above).
+        """
+        from .images import ListingSourceChanged, parse_listing_filter
+
+        try:
+            selection = await self.resolve_listing_filter(
+                parse_listing_filter(raw), MAX_JOB_TARGETS
+            )
+        except ListingSourceChanged:
+            return None, _coded(409, "source-changed", SOURCE_CHANGED_MESSAGE)
+        except ValueError as exc:
+            return None, bad_request(str(exc))
+        if selection.truncated:
+            return None, _coded(400, "too-many-images", TOO_MANY)
+        return tuple(selection.targets), None
+
+    async def _category_request(self, request, fields: frozenset):
+        """``(data, targets, roots, None)`` or ``(None, None, None, error)``.
+
+        The images are ``items`` (1 to 500 targets) or ``filter`` (all images
+        an Images listing filter admits), besides *fields*.
+        """
+        data, error = await _json_body_or_error(request)
+        if error is not None:
+            return None, None, None, error
+        names = set(data) - fields
+        if set(data) & fields != fields or names not in ({"items"}, {"filter"}):
+            return (
+                None,
+                None,
+                None,
+                bad_request(
+                    "Request must contain "
+                    + ", ".join(sorted(fields))
+                    + (" and " if fields else "")
+                    + "either items or filter"
+                ),
+            )
+        if "filter" in data:
+            targets, error = await self._filter_targets(data["filter"])
+            if error is not None:
+                return None, None, None, error
+            return data, targets, list(self._get_all_output_dirs()), None
+        items = data["items"]
+        if not isinstance(items, list) or not 1 <= len(items) <= MAX_JOB_TARGETS:
+            return (
+                None,
+                None,
+                None,
+                bad_request(f"items must list 1 to {MAX_JOB_TARGETS} images"),
+            )
+        targets, error = _parse_targets(items, media_message=CATEGORY_MEDIA_MESSAGE)
+        if error is not None:
+            return None, None, None, error
+        try:
+            for _index, _scope, relative in targets:
+                relative.encode("utf-8")
+        except UnicodeEncodeError:
+            return None, None, None, bad_request("path must be valid text")
+        roots = list(self._get_all_output_dirs())
+        for index, scope in dict.fromkeys((t[0], t[1]) for t in targets):
+            if index >= len(roots):
+                return None, None, None, bad_request("Invalid gallery root")
+            error = self._gallery_scope_error(
+                {"root_scope": scope, "root": str(index)}, roots
+            )
+            if error is not None:
+                if error.status == 409:
+                    error = _coded(409, "source-changed", SOURCE_CHANGED_MESSAGE)
+                return None, None, None, error
+        return data, targets, roots, None
+
+    def _listed_file_keys(self, roots, targets, files) -> tuple[list, list]:
+        """``(listed keys, unlisted keys)`` of the targets (blocking).
+
+        A target counts as listed when its source's listing holds it; its key
+        then follows the listed spelling. Targets folding to one key count
+        once, and a key that is listed through any target is listed.
+        """
+        listings, listed, missing = {}, {}, {}
+        for index, _scope, relative in targets:
+            root = roots[index]
+            if index not in listings:
+                listings[index] = self._favorite_listing(root, files[index])
+            spelled = listings[index].get(_favorite_relative_key(relative))
+            key = _file_key(roots, root, spelled or relative)
+            (missing if spelled is None else listed)[key] = True
+        return list(listed), [key for key in missing if key not in listed]
+
+    async def set_image_category(self, request):
+        """PUT ``{items, category}``: set the own category of listed files."""
+        data, targets, roots, error = await self._category_request(request, _PUT_FIELDS)
+        if error is not None:
+            return error
+        category, error = _category_value(data["category"])
+        if error is not None:
+            return error
+        try:
+            files = {}
+            for index in dict.fromkeys(t[0] for t in targets):
+                files[index] = await self._get_gallery_files(roots[index])
+            listed_keys, missing_keys = await self._run_in_executor(
+                self._listed_file_keys, roots, targets, files
+            )
+        except _KeyRefused as refused:
+            return _forbidden(refused.message)
+        except Exception:
+            self.logger.exception("Image category update failed")
+            return _coded(500, "category-failed", WRITE_FAILED)
+        try:
+            if not listed_keys:
+                return _coded(
+                    404,
+                    "files-not-found",
+                    "None of the selected images could be found.",
+                )
+            counts = await self._run_in_executor(
+                self.db.set_image_categories, listed_keys, category
+            )
+        except Exception:
+            self.logger.exception("Image category update failed")
+            return _coded(500, "category-failed", WRITE_FAILED)
+        return web.json_response(
+            {
+                "success": True,
+                "category": category,
+                "updated": counts["updated"],
+                "unchanged": counts["unchanged"],
+                "not_found": len(missing_keys),
+            },
+            headers={"Cache-Control": "no-store"},
+        )
+
+    async def clear_image_category(self, request):
+        """DELETE ``{items}``: remove the own category, listed or not."""
+        _data, targets, roots, error = await self._category_request(
+            request, _DELETE_FIELDS
+        )
+        if error is not None:
+            return error
+        try:
+            keys = await self._run_in_executor(
+                lambda: list(
+                    dict.fromkeys(_file_key(roots, roots[i], r) for i, _s, r in targets)
+                )
+            )
+            cleared = await self._run_in_executor(self.db.clear_image_categories, keys)
+        except _KeyRefused as refused:
+            return _forbidden(refused.message)
+        except Exception:
+            self.logger.exception("Image category removal failed")
+            return _coded(500, "category-failed", WRITE_FAILED)
+        return web.json_response(
+            {"success": True, "cleared": cleared},
+            headers={"Cache-Control": "no-store"},
+        )

py/api/image_tag_jobs.py

@@ -193,13 +193,17 @@ class _Spec:
         return scope
 
 
-def _parse_targets(raw):
-    """Unique validated targets in request order, or ``(None, error)``."""
+def _parse_targets(raw, **target_options):
+    """Unique validated targets in request order, or ``(None, error)``.
+
+    ``target_options`` reach the target check (the image category routes
+    pass their own ``media_message``, #332).
+    """
     if not isinstance(raw, list) or not 1 <= len(raw) <= MAX_JOB_TARGETS:
         return None, bad_request(f"targets must list 1 to {MAX_JOB_TARGETS} images")
     seen, targets = set(), []
     for item in raw:
-        target, error = _target(item)
+        target, error = _target(item, **target_options)
         if error is not None:
             return None, error
         if target not in seen:

py/api/images.py

@@ -61,10 +61,13 @@ try:
     from ...database.image_favorites import MAX_KEY_LENGTH
     from ...database.library import display_title
     from ...database.models import normalize_image_path
+    from ...database.run_attribution import recorded_output_lookup
     from ...utils.card_seed import card_seed, header_params, parsed_positive
     from ...utils.parallel import map_parallel
     from ...utils.json_strict import dumps_strict
     from ...utils.inspection_response import (
+        OWN_CATEGORY_UNREAD,
+        apply_own_category,
         encode_inspection_response,
         library_metadata,
     )
@@ -81,10 +84,13 @@ except ImportError:
     from database.image_favorites import MAX_KEY_LENGTH
     from database.library import display_title
     from database.models import normalize_image_path
+    from database.run_attribution import recorded_output_lookup
     from utils.card_seed import card_seed, header_params, parsed_positive
     from utils.parallel import map_parallel
     from utils.json_strict import dumps_strict
     from utils.inspection_response import (
+        OWN_CATEGORY_UNREAD,
+        apply_own_category,
         encode_inspection_response,
         library_metadata,
     )
@@ -563,7 +569,8 @@ class _ImageTagMatch(NamedTuple):
 
     tags: bool  # every filter tag is in its image tags or linked positive tags
     query: bool  # ``q`` is a case-folded substring of one image tag name
-    link: tuple | None  # (hit, rating, positive id) of its unambiguous link
+    # (hit, rating, positive id, inherited category) of its unambiguous link
+    link: tuple | None
 
 
 def _current_fingerprint(path: Path) -> tuple[int, int] | None:
@@ -800,6 +807,53 @@ def _favorite_root_key(root) -> str:
     return _favorite_relative_key(os.path.realpath(str(root)))
 
 
+def _source_depth(source: str) -> int:
+    return len([part for part in re.split(r"[\\/]+", source) if part])
+
+
+def deepest_source(sources, absolute_path):
+    """``(source, POSIX path below it)`` of the deepest source holding the path.
+
+    A source matches by its real path or by its spelling as configured (a
+    detected output folder can be a symlink), and the deepest real path wins.
+    The path is compared lexically after ``normpath`` and never resolved, so a
+    symlinked subfolder keeps its listed spelling. Containment folds case
+    where the OS does. *source* is the real path. None when no source
+    contains the path.
+    """
+    path = os.path.normpath(str(absolute_path))
+    folded = os.path.normcase(path)
+    best = None
+    for source in sources:
+        real = os.path.normpath(os.path.realpath(str(source)))
+        for spelling in dict.fromkeys((real, os.path.normpath(str(source)))):
+            prefix = os.path.join(os.path.normcase(spelling), "")
+            if not folded.startswith(prefix):
+                continue
+            if best is None or _source_depth(real) > _source_depth(best[0]):
+                best = (real, spelling)
+            break
+    if best is None:
+        return None
+    relative = os.path.relpath(path, best[1])
+    return best[0], relative.replace(os.sep, "/")
+
+
+def image_category_key(sources, absolute_path):
+    """The file key of an image's own category (#332), or None.
+
+    ``(root key, relative key)``: the deepest output source that contains the
+    file and the path below it, keyed with the favorites helpers. Without
+    nested sources it equals the file's favorite key. A path no source
+    contains has no key (and so no own category).
+    """
+    found = deepest_source(sources, absolute_path)
+    if found is None:
+        return None
+    source, relative = found
+    return _favorite_root_key(source), _favorite_relative_key(relative)
+
+
 def _name_suffix(name):
     """``Path(name).suffix`` as Python 3.10-3.13 compute it.
 
@@ -1171,20 +1225,27 @@ def _admitted_entries(
     links: dict | None,
     favorites: frozenset | None = None,
     image_tags: dict | None = None,
+    own_categories: dict | None = None,
 ):
     """Yield ``(position, entry, link match)`` for each entry the filters admit.
 
-    *links* maps normalized paths to (hit, rating, positive id) for every
-    unambiguously linked image (see PromptDatabase.get_image_link_matches); a
-    category or tag filter admits only those, and ``q`` admits a filename match
-    or a linked-positive hit. *favorites*, when given, admits only those listed
+    *links* maps normalized paths to (hit, rating, positive id, inherited
+    category) for every unambiguously linked image (see
+    PromptDatabase.get_image_link_matches); a tag filter admits only those,
+    and ``q`` admits a filename match or a linked-positive hit. A category
+    admits a file whose effective category equals it (#332 MC5): its own
+    category (*own_categories*, ``{normalized path: category}``) when it has one,
+    else the inherited one, so an unlinked file with its own category is
+    admitted. *favorites*, when given, admits only those listed
     paths (``favorites=1``). *image_tags* maps normalized paths to their
     _ImageTagMatch: a tag filter also admits a file whose current image tags
     (with its linked positive's tags) carry every tag, and ``q`` also admits an
     image tag name hit.
     """
     query, media, folder = filters["query"], filters["media"], filters["folder"]
-    members_only = filters["category"] is not None or bool(filters["tags"])
+    category = filters["category"]
+    members_only = bool(filters["tags"])
+    own = own_categories or {}
     native_folder = folder.replace("/", os.sep)
     nested = native_folder + os.sep
     exact = filters.get("path", "")
@@ -1203,6 +1264,12 @@ def _admitted_entries(
         image = None if image_tags is None else image_tags.get(entry.normalized)
         if members_only and match is None and not (image and image.tags):
             continue
+        if category is not None:
+            effective = own.get(entry.normalized) if own else None
+            if effective is None and match is not None:
+                effective = match[3]
+            if effective != category:
+                continue
         if (
             query
             and query not in entry.folded
@@ -1221,6 +1288,7 @@ def _filtered_page(
     links: dict | None,
     favorites: frozenset | None = None,
     image_tags: dict | None = None,
+    own_categories: dict | None = None,
 ) -> tuple[int, list, int | None]:
     """Count the *entries* the filters admit and take *size* from *start* on.
 
@@ -1230,7 +1298,7 @@ def _filtered_page(
     """
     total, page, positives = 0, [], set()
     for position, entry, match in _admitted_entries(
-        entries, filters, links, favorites, image_tags
+        entries, filters, links, favorites, image_tags, own_categories
     ):
         total += 1
         if match is not None:
@@ -2170,9 +2238,10 @@ class ImageRoutesMixin:
         stat'ed (never every listed file), and a candidate's tags count only
         while a byte record is verified at its present ``(size, mtime_ns)``
         (spec amendment S1). Under a Tags filter the candidates' linked
-        positives are read too, so their tags and category combine.
+        positives are read too, so their tags combine; the category is checked
+        once, on the effective category, by _admitted_entries (#332).
         """
-        tags, query, category = filters["tags"], filters["query"], filters["category"]
+        tags, query = filters["tags"], filters["query"]
         wanted = set(tags)
         located = self._workspace_locators(listings)
         # The tag index answers which files carry a relevant name (#379); no
@@ -2202,11 +2271,9 @@ class ImageRoutesMixin:
             link = facts.get(entry.normalized)
             carried = set(names).union(link[4] if link else ())
             matches[entry.normalized] = _ImageTagMatch(
-                bool(wanted)
-                and wanted <= carried
-                and (category is None or (link is not None and link[3] == category)),
+                bool(wanted) and wanted <= carried,
                 bool(query) and any(query in name.casefold() for name in names),
-                link[:3] if link else None,
+                tuple(link[:4]) if link else None,
             )
         return matches
 
@@ -2215,10 +2282,14 @@ class ImageRoutesMixin:
     ) -> tuple:
         """The ordered entries and what admits them (blocking; run in executor).
 
-        Returns ``(entries, key, links, image_tags, favorites)``: the listing in
-        the filters' order, its keyset key, and the link, image-tag and favorite
-        maps _admitted_entries reads. One SELECT (get_image_link_matches) reads
-        every linked positive when *read_links*. A failed read raises when the
+        Returns ``(entries, key, links, image_tags, favorites, own)``: the
+        listing in the filters' order, its keyset key, and the link, image-tag,
+        favorite and own-category maps _admitted_entries reads. One SELECT
+        (get_image_link_matches) reads every linked positive when *read_links*;
+        under a category it keeps only links whose raw recipe or positive
+        category is that value (the inherited one is decided in Python), and
+        the links of files whose own category is that value are read by path,
+        so their rating and positive still count (#332). A failed read raises when the
         filters need it (category, tags, the rating sort) or *strict*; else the
         listing stays usable without links (a search then matches filenames
         only). A failed image-tag read raises under a Tags filter; a search then
@@ -2230,10 +2301,10 @@ class ImageRoutesMixin:
             try:
                 links = self.db.get_image_link_matches(
                     filters["text"],
-                    category,
                     tags,
                     every_link=True,
                     wanted=self._workspace_wanted(listings),
+                    category=category,
                 )
             except Exception:
                 if strict or category is not None or tags or order == "rating":
@@ -2247,6 +2318,13 @@ class ImageRoutesMixin:
                     ),
                     exc_info=True,
                 )
+        own = None
+        if category is not None:
+            # A failed read raises: an unfiltered page must never pass for the
+            # category (DC6).
+            own = self._own_category_map(self._get_all_output_dirs(), listings)
+            if links is not None:
+                links = self._own_category_links(links, own, filters)
         image_tags = None
         if filters["query"] or tags:
             try:
@@ -2293,7 +2371,30 @@ class ImageRoutesMixin:
         favorites = (
             self._workspace_favorite_paths(listings) if filters["favorites"] else None
         )
-        return entries, key, links, image_tags, favorites
+        return entries, key, links, image_tags, favorites, own
+
+    def _own_category_links(self, links: dict, own: dict, filters: dict) -> dict:
+        """*links* plus the links of files whose own category is the filter's.
+
+        Their inherited category differs, so the category's link read left
+        them out; read by path (get_image_link_facts), kept only when their
+        positive has every filter tag, as the link read would.
+        """
+        category, wanted = filters["category"], set(filters["tags"])
+        missing = [
+            path
+            for path, value in own.items()
+            if value == category and path not in links
+        ]
+        if not missing:
+            return links
+        facts = self.db.get_image_link_facts(missing, filters["text"])
+        extra = {
+            path: tuple(fact[:4])
+            for path, fact in facts.items()
+            if wanted <= set(fact[4])
+        }
+        return {**links, **extra} if extra else links
 
     def _select_workspace_page(
         self,
@@ -2322,7 +2423,7 @@ class ImageRoutesMixin:
             or bool(filters["tags"])
             or order == "rating"
         )
-        entries, key, links, image_tags, favorites = self._workspace_admission(
+        entries, key, links, image_tags, favorites, own = self._workspace_admission(
             listings, filters, read_links=needed or after is None
         )
         start = 0
@@ -2333,7 +2434,7 @@ class ImageRoutesMixin:
             else:
                 start = bisect_right(entries, after, key=key)
         total, page, positive_count = _filtered_page(
-            entries, start, limit + 1, filters, links, favorites, image_tags
+            entries, start, limit + 1, filters, links, favorites, image_tags, own
         )
         if not needed and after is not None:
             positive_count = _COUNT_OMITTED
@@ -2355,12 +2456,12 @@ class ImageRoutesMixin:
 
         The links are read strictly: the positives must be the listing's own.
         """
-        entries, _key, links, image_tags, favorites = self._workspace_admission(
+        entries, _key, links, image_tags, favorites, own = self._workspace_admission(
             listings, filters, read_links=True, strict=True
         )
         targets, positives, unlinked, scopes = [], {}, 0, {}
         for _position, entry, match in _admitted_entries(
-            entries, filters, links, favorites, image_tags
+            entries, filters, links, favorites, image_tags, own
         ):
             if len(targets) == cap:
                 return ListingSelection(targets, list(positives), unlinked, True)
@@ -3679,17 +3780,25 @@ class ImageRoutesMixin:
                     except Exception:
                         # The link stays known; only its title is withheld.
                         self.logger.warning("Inspection link title could not be read")
+                # An output file's own category (#332); LoRA roots have none.
+                own = (
+                    self._read_own_category(outputs, path)
+                    if index < len(outputs)
+                    else None
+                )
                 try:
                     observed = inspect_current_file(
                         path,
                         source_label=_public_path(roots[index]),
                         saved=saved,
-                        library=self._inspection_library(
-                            saved, unavailable=unavailable
+                        library=apply_own_category(
+                            self._inspection_library(saved, unavailable=unavailable),
+                            own,
                         ),
                         image_tags=self._inspection_image_tags(
                             roots[index], Path(relative).parts
                         ),
+                        recorded=recorded_output_lookup(self.db),
                     )
                 except CurrentFileChanged:
                     return None
@@ -3752,6 +3861,19 @@ class ImageRoutesMixin:
 
         return read
 
+    def _read_own_category(self, sources, path):
+        """One file's own category, None, or OWN_CATEGORY_UNREAD (blocking).
+
+        Keyed by ``image_category_key`` over the output sources, as Images
+        writes it. A failed read is logged and hides the category (DC5).
+        """
+        try:
+            key = image_category_key(sources, path)
+            return None if key is None else self.db.image_category(*key)
+        except Exception:
+            self.logger.warning("Image category could not be read", exc_info=True)
+            return OWN_CATEGORY_UNREAD
+
     def _inspection_library(self, saved: dict | None, *, unavailable: bool) -> dict:
         """The inspector's Library facts; the route sets the title afterwards."""
         result = {

py/api/inspection_service.py

@@ -3,7 +3,7 @@
 import os
 import stat
 from pathlib import Path
-from typing import Callable
+from typing import Any, Callable
 
 try:
     from ...utils.prompt_inspector import (
@@ -100,18 +100,23 @@ def inspect_current_file(
     saved: dict | None,
     library: dict,
     image_tags: Callable[[int, int], dict] | None = None,
+    recorded: Callable[[Path], Any] | None = None,
 ) -> dict:
     """Current-file evidence read between two equal stats of *path*.
 
     *image_tags*, when given, is called once with that stable
     ``(st_size, st_mtime_ns)`` and its facet is returned as ``image_tags``
     (spec amendment S1: tags of a byte record verified at exactly that stat).
+    *recorded*, when given, is asked within the same stat window for what
+    recorded run history knows about *path* (``RecordedOutput`` or None: the
+    save node that wrote it and the texts PromptManager recorded, #386).
     """
     before = _current_file_facts(path)
     try:
         inspection = read_inspection_file(path)
     except MetadataReadError:
         inspection = None
+    run = recorded(path) if recorded is not None and inspection is not None else None
     after = _current_file_facts(path)
     fields = ("st_dev", "st_ino", "st_mode", "st_size", "st_mtime_ns", "st_ctime_ns")
     if any(getattr(before, key) != getattr(after, key) for key in fields):
@@ -129,9 +134,15 @@ def inspect_current_file(
         profile = (
             PREVIEW_INSPECTION_PROFILE if _in_host_temp(path) else INSPECTION_PROFILE
         )
-        # The file name anchors on the saver that wrote it (#381).
+        # The file name anchors on the saver that wrote it (#381); recorded run
+        # history names that saver when the file alone cannot (#386).
         evidence = inspect_prompt_evidence(
-            inspection.metadata, role_saved, profile=profile, file_name=path.name
+            inspection.metadata,
+            role_saved,
+            profile=profile,
+            file_name=path.name,
+            recorded_saver_id=run.saver_id if run is not None else None,
+            recorded_texts=run.texts if run is not None else None,
         )
     return {
         "file": {

py/api/jobs.py

@@ -47,6 +47,11 @@ import time
 import uuid
 from pathlib import PurePosixPath, PureWindowsPath
 
+try:
+    from ...utils import exit_signal
+except ImportError:  # tests import the package top-level
+    from utils import exit_signal
+
 logger = logging.getLogger(__name__)
 # Start and finish order: wall-clock times can tie (coarse Windows clocks).
 _sequence = itertools.count()
@@ -195,11 +200,21 @@ class Job:
         self.counters = dict.fromkeys(groups, 0)
         self.outcomes = {group: [] for group in groups}
         self.log = []
-        self.cancelled = False
+        self._cancel_requested = False
         self.last_event = None
         self.task = None
         self._subscribers = set()
 
+    @property
+    def cancelled(self):
+        """Cancel was requested, or the interpreter is exiting (#376): every
+        check a job already makes between files also stops it at exit."""
+        return self._cancel_requested or exit_signal.requested()
+
+    @cancelled.setter
+    def cancelled(self, value):
+        self._cancel_requested = bool(value)
+
     @property
     def record_changing(self):
         return self.admission == "records"

py/api/media_target.py

@@ -0,0 +1,54 @@
+"""The listing identity of one media file, as a request names it.
+
+Shared by the image-annotation routes and the collection routes (#331): a
+target is ``{root_index, root_scope, path}``, checked here without touching
+the filesystem or the database. The scope is compared with the current roots
+by the caller.
+"""
+
+import os
+import re
+
+from .images import _forbidden, _has_traversal
+from .prompts import bad_request
+
+try:
+    from ...utils.media_capture import CAPTURE_EXTENSIONS
+except ImportError:
+    from utils.media_capture import CAPTURE_EXTENSIONS
+
+MAX_TARGET_PATH = 1024
+TARGET_FIELDS = frozenset({"root_index", "root_scope", "path"})
+_HEX64 = re.compile(r"[0-9a-f]{64}")
+TAGGING_MEDIA_MESSAGE = "Only media files can be tagged"
+
+
+def media_target(data: object, *, media_message: str = TAGGING_MEDIA_MESSAGE):
+    """``((index, scope, relative), None)`` for a target, else ``(None, error)``.
+
+    Only the listing identity is accepted: an int root index, the root's
+    64-hex scope and a bounded root-relative POSIX media path, never an
+    absolute, drive-qualified, backslash or ``..`` path (a 400 for a malformed
+    shape, a 403 for an unsafe or non-media path, carrying *media_message*).
+    """
+    if not isinstance(data, dict) or set(data) != TARGET_FIELDS:
+        return None, bad_request("target must name root_index, root_scope and path")
+    index, scope, relative = data["root_index"], data["root_scope"], data["path"]
+    if type(index) is not int or index < 0:
+        return None, bad_request("Invalid gallery root")
+    if not isinstance(scope, str) or _HEX64.fullmatch(scope) is None:
+        return None, bad_request("Invalid gallery root scope")
+    if not isinstance(relative, str) or not relative or len(relative) > MAX_TARGET_PATH:
+        return None, bad_request("path must be a relative media path")
+    parts = relative.split("/")
+    if (
+        "\0" in relative
+        or "\\" in relative
+        or relative.startswith("/")
+        or _has_traversal(relative)
+        or any(part in ("", ".", "..") or ":" in part for part in parts)
+    ):
+        return None, _forbidden()
+    if os.path.splitext(parts[-1])[1].lower() not in CAPTURE_EXTENSIONS:
+        return None, _forbidden(media_message)
+    return (index, scope, relative), None

py/api/review_recording.py

@@ -3,7 +3,7 @@
 The rule (maintainer test of #284/#288): a file is queued only when its
 final outcome is ambiguous and unlinked. The strict resolver must find it
 ``ambiguous``, the scan's legacy fallback (the browser parser,
-``_graph_prompt_text``) must not link it, and no saved row may link it
+``graph_prompt_text``) must not link it, and no saved row may link it
 already. A file the fallback links, an exact pair the ingester stored and an
 already linked file are never queued. Neither is an ambiguous file with
 nothing to choose: fewer than two of its candidates carry a prompt

py/api/thumbnail_auto.py

@@ -92,6 +92,11 @@ try:
 except ImportError:  # tests import the package top-level
     from utils.parallel import map_parallel, note_refusal, refused_at_shutdown
 
+try:
+    from ...utils.exit_signal import ExitRequested
+except ImportError:  # tests import the package top-level
+    from utils.exit_signal import ExitRequested
+
 # The placeholder frame a video without a preview is answered with (JPEG
 # bytes, never written to disk); written previews follow the settings.
 PLACEHOLDER_SIZE = (thumbnail_settings.DEFAULT_EDGE, thumbnail_settings.DEFAULT_EDGE)
@@ -460,6 +465,8 @@ class AutoThumbnailer:
     def _run(self):
         try:
             self._drain()
+        except ExitRequested:
+            pass  # #376: the interpreter is exiting; queued files are dropped
         except Exception:
             self._logger.warning("The automatic preview worker stopped", exc_info=True)
         finally:

py/autotag.py

@@ -7,6 +7,7 @@ Refactored from standalone_tagger.py for integration with PromptManager API.
 
 import errno
 import gc
+import inspect
 import os
 import sys
 from pathlib import Path
@@ -32,6 +33,54 @@ try:
 except ImportError:
     from py.tagging_defaults import DEFAULT_TAG_TEMPLATE
 
+try:
+    from ..utils import exit_signal
+except ImportError:
+    from utils import exit_signal
+
+
+def abort_hub_downloads() -> None:
+    """Abort huggingface_hub's Xet transfers (run by the exit hook, #376).
+
+    Xet downloads report progress from native code, which ignores an
+    exception raised in ``tqdm.update``; huggingface_hub aborts them itself
+    on Ctrl+C with ``abort_xet_session``. Nothing happens when
+    huggingface_hub was never imported or has no Xet support.
+    """
+    if "huggingface_hub" not in sys.modules:
+        return
+    try:
+        from huggingface_hub.utils import _xet
+    except ImportError:
+        return
+    abort = getattr(_xet, "abort_xet_session", None)
+    if callable(abort):
+        abort()
+
+
+def _stop_at_exit(download) -> Dict[str, Any]:
+    """Keyword arguments that stop a huggingface_hub download at its next
+    chunk once the interpreter is exiting (#376), or none when this
+    huggingface_hub does not take ``tqdm_class``.
+
+    huggingface_hub 1.x removes its partial temp file on any failure; older
+    versions keep their resumable ``.incomplete`` file. The model's own path
+    is only written by the final rename either way.
+    """
+    try:
+        if "tqdm_class" not in inspect.signature(download).parameters:
+            return {}
+        from huggingface_hub.utils import tqdm as hub_tqdm
+    except (ImportError, TypeError, ValueError):
+        return {}
+
+    class StopAtExit(hub_tqdm):
+        def update(self, n=1):
+            exit_signal.checkpoint()
+            return super().update(n)
+
+    return {"tqdm_class": StopAtExit}
+
 
 def _autotag_config():
     """The saved defaults; imported late, as config needs ComfyUI's server."""
@@ -397,6 +446,7 @@ class AutoTagService:
                     filename=filename,
                     local_dir=str(model_dir),
                     local_dir_use_symlinks=False,
+                    **_stop_at_exit(hf_hub_download),
                 )
 
         if progress_callback:
@@ -541,6 +591,13 @@ class AutoTagService:
             else:
                 return self._download_hf_model(progress_callback)
         except Exception as e:
+            if exit_signal.requested():
+                # ExitRequested between chunks, or the Xet session aborted
+                # by the exit hook (abort_hub_downloads).
+                self.logger.info(
+                    f"Model download stopped: ComfyUI is exiting ({model_type})"
+                )
+                return False
             self.logger.error(f"Download failed: {e}")
             if progress_callback:
                 progress_callback(f"Error: {str(e)}", 0)
@@ -570,6 +627,7 @@ class AutoTagService:
                 filename=config["filename"],
                 local_dir=str(gguf_dir),
                 local_dir_use_symlinks=False,
+                **_stop_at_exit(hf_hub_download),
             )
             self.logger.info("GGUF model downloaded")
 
@@ -587,6 +645,7 @@ class AutoTagService:
                 filename=config["mmproj_filename"],
                 local_dir=str(gguf_dir),
                 local_dir_use_symlinks=False,
+                **_stop_at_exit(hf_hub_download),
             )
             self.logger.info("mmproj downloaded")
 
@@ -613,6 +672,7 @@ class AutoTagService:
                 repo_id=config["repo"],
                 local_dir=str(model_dir),
                 local_dir_use_symlinks=False,
+                **_stop_at_exit(snapshot_download),
             )
             self.logger.info("HF model downloaded")
 

py/lora_import.py

@@ -44,8 +44,10 @@ from .lora_manager_layout import (
 )
 
 try:
+    from ..utils import exit_signal
     from ..utils.hashing import generate_prompt_hash
 except ImportError:  # pragma: no cover - flat test imports
+    from utils import exit_signal
     from utils.hashing import generate_prompt_hash
 
 LORA_CATEGORY = "lora-manager"
@@ -189,14 +191,15 @@ def stage(
     downloads its CivitAI example images. A sidecar that cannot be read, or
     whose record fails to build, is skipped by its name, as are the
     centralized sidecars discovery could not parse. ``cancelled()`` is asked
-    before each sidecar (raises ImportCancelled); ``on_record(index,
+    before each sidecar, and so is the exit signal (#376: the legacy scan's
+    ``cancelled`` does not read it); either raises ImportCancelled. ``on_record(index,
     record_or_None, staged)`` follows each one.
     """
     sidecars = discovery.sidecars
     staged = StagedImport(total=len(sidecars))
     staged.skipped.extend(discovery.unreadable)
     for index, sidecar in enumerate(sidecars):
-        if cancelled():
+        if cancelled() or exit_signal.requested():
             raise ImportCancelled()
         record = None
         path = sidecar.metadata_path

tests/browser/classic-node.spec.mjs

@@ -19,7 +19,7 @@ test.beforeEach(async ({page, browserName}) => {
         await import('/extensions/promptmanager/prompt_manager.js');
         class Node {
             constructor(){
-                this.widgets=['text','category','tags','search_text'].map(name=>({name,value:'',inputEl:document.createElement('textarea')}));
+                this.widgets=[...['text','category','tags','search_text'].map(name=>({name,value:'',inputEl:document.createElement('textarea')})),{name:'save_to_library',type:'toggle',value:true}];
                 this.widgets_values=[]; this.inputs=[];
             }
             addDOMWidget(name,type,element){document.body.append(element);return {element};}
@@ -36,6 +36,14 @@ test.afterEach(async ({page,browserName}) => {
     expect(page.classicErrors).toEqual([]);
 });
 
+test('Classic loads an older workflow with Save to library on and keeps a saved off (#90)',async({page})=>{
+    // A workflow saved before the switch held the search UI's slot ('') at the switch's index
+    const loaded=await page.evaluate(()=>{const widget=node.widgets.find(w=>w.name==='save_to_library');widget.value='';node.configure({});return widget.value;});
+    expect(loaded).toBe(true);
+    const off=await page.evaluate(()=>{const widget=node.widgets.find(w=>w.name==='save_to_library');widget.value=false;node.configure({});return [widget.value,node.serialize().widgets_values[4]];});
+    expect(off).toEqual([false,false]);
+});
+
 test('Classic keeps immediate selection, search query and metadata serialization',async({page})=>{
     await page.route('**/prompt_manager/search?**', route=>route.fulfill({json:{success:true,results:[{text:'A new portrait',category:'Portrait',tags:['film grain'],rating:5}]}}));
     await page.evaluate(()=>{node.widgets.find(w=>w.name==='search_text').value='tag:"film grain" portrait';});

tests/browser/focused-node.spec.mjs

@@ -26,7 +26,7 @@ test.beforeEach(async({page,browserName})=>{
         window.fixtureApp={registerExtension(extension){this.extension=extension;},ui:{settings:new EventTarget()},graph:{setDirtyCanvas(){}},canvas:{}};
         await import('/extensions/promptmanager/prompt_manager.js');
         class Node {
-            constructor(){this.widgets=['text','category','tags','search_text'].map(name=>({name,type:'text',value:'',options:{},inputEl:document.createElement('textarea')}));this.inputs=[...['clip','prepend_text','append_text'].map(name=>({name,type:name==='clip'?'CLIP':'STRING',link:null})),...['text','category','tags','search_text'].map(name=>({name,type:'STRING',link:null,widget:{name}}))];this.properties={};this.size=[550,700];}
+            constructor(){this.widgets=[...['text','category','tags','search_text'].map(name=>({name,type:'text',value:'',options:{},inputEl:document.createElement('textarea')})),{name:'save_to_library',type:'toggle',value:true,options:{}}];this.inputs=[...['clip','prepend_text','append_text'].map(name=>({name,type:name==='clip'?'CLIP':'STRING',link:null})),...['text','category','tags','search_text'].map(name=>({name,type:'STRING',link:null,widget:{name}})),{name:'save_to_library',type:'BOOLEAN',link:null,widget:{name:'save_to_library'}}];this.properties={};this.size=[550,700];}
             findInputByType(type){const index=this.inputs.findIndex(input=>input.type===type&&input.link==null);return index<0?undefined:{index,slot:this.inputs[index]};}
             addWidget(type,name,value,callback,options){const widget={type,name,value,callback,options};this.widgets.push(widget);return widget;}
             addDOMWidget(name,type,element){const host=document.createElement('div');host.style.height='650px';host.className='fixture-dom-widget';host.append(element);document.body.append(host);return {element};}
@@ -41,6 +41,32 @@ test.beforeEach(async({page,browserName})=>{
 });
 test.afterEach(async({page,browserName})=>{await saveCoverage(page,browserName);expect(page.focusedErrors).toEqual([]);});
 
+test(`${variant} Save to library switch saves its value and loads older workflows on (#90)`, async ({page}) => {
+    const toggle=page.getByRole('checkbox',{name:'Save to library',exact:true});
+    await expect(toggle).toBeChecked();
+    expect(await page.evaluate(()=>node.widgets.map(widget=>widget.name))).toEqual(['text','category','tags','search_text','prepend_text','append_text','save_to_library']);
+    // The native switch is drawn in the toolbar only: the host keeps it hidden and zero-height, like the text fallbacks
+    expect(await page.evaluate(()=>{const widget=node.widgets.find(item=>item.name==='save_to_library');return {type:widget.type,hidden:widget.hidden,size:widget.computeSize()};})).toEqual({type:'hidden',hidden:true,size:[0,-4]});
+    expect(await page.evaluate(()=>node.widgets.find(item=>item.name==='text').computeSize())).toEqual([0,-4]);
+    await toggle.uncheck();
+    await expect(page.locator('.pm-focused > .pm-editor-status[role=status]')).toHaveText('Save to library is off: runs of this node are not added to the library.');
+    const saved=await page.evaluate(()=>node.serialize());
+    expect(saved.widgets_values[6]).toBe(false);
+    await page.evaluate(saved=>node.configure(saved),saved);
+    await expect(toggle).not.toBeChecked();
+    await page.getByLabel('Main prompt',{exact:true}).fill('Typed while off');
+    await expect(page.locator('.pm-focused > .pm-editor-status[role=status]')).toHaveText('Save to library is off: runs of this node are not added to the library.');
+    // A workflow saved before the switch held the editor's own slot ('') at its index
+    await page.evaluate(()=>node.configure({widgets_values:['Old text','','','','','',''],properties:{}}));
+    await expect(toggle).toBeChecked();
+    expect(await page.evaluate(()=>node.widgets.find(widget=>widget.name==='save_to_library').value)).toBe(true);
+    await toggle.check();
+    await page.getByLabel('Main prompt',{exact:true}).fill('Typed while on');
+    await expect(page.locator('.pm-focused > .pm-editor-status[role=status]')).toHaveText('Main prompt is saved when this node runs.');
+    await page.evaluate(()=>{node.inputs.find(input=>input.name==='save_to_library').link=9;node.onConnectionsChange?.();});
+    await expect(toggle).toBeDisabled();
+});
+
 test(`${variant} library autocompletes filters and searches without changing editor metadata`, async ({page}) => {
     const requests=[];
     await page.route('**/prompt_manager/categories',route=>route.fulfill({json:{success:true,categories:['Portrait']}}));
@@ -257,7 +283,7 @@ test(`${variant} restores workflow values and disclosures and protects connected
 test(`${variant} offers text as a link socket, keeps typed text while linked and through a reload (#343)`,async({page})=>{
     const sockets=()=>page.evaluate(()=>Object.fromEntries(node.inputs.map(input=>[input.name,input.widget?.name??null])));
     // The hidden text widget no longer owns the input, so the host draws it as a socket; the other widget inputs are unchanged.
-    expect(await sockets()).toEqual({clip:null,prepend_text:null,append_text:null,text:null,category:'category',tags:'tags',search_text:'search_text'});
+    expect(await sockets()).toEqual({clip:null,prepend_text:null,append_text:null,text:null,category:'category',tags:'tags',search_text:'search_text',save_to_library:'save_to_library'});
     expect(await page.evaluate(()=>node.findInputByType('STRING').slot.name)).toBe('text');
     expect(await page.evaluate(()=>node.findInputByType('CLIP').slot.name)).toBe('clip');
     const main=page.getByRole('textbox',{name:'Main prompt',exact:true});

tests/browser/legacy-autotag.spec.mjs

@@ -1,11 +1,9 @@
-// #328: the legacy admin and gallery auto-tag tools keep working beside System › Auto-tagging. The model download is
-// the `model_download` Activity job; the pages' stream attaches to it. No model is ever downloaded: the fixture's
-// fake download waits until the test releases it (`/__test__/tagging/download`).
+// #328: the legacy admin and gallery auto-tag batch and review keep working beside System › Auto-tagging. Since #330
+// the pages download and unload models only through System (legacy-system-links.spec.mjs); a batch never downloads
+// one. The fixture's fake download (`/__test__/tagging/download`) is held so nothing is ever fetched.
 import { startCoverage, saveCoverage } from '../../tools/vendor/browser-coverage.mjs';
 import { test, expect } from './fixtures.mjs';
 
-const TITLE = 'Tagging model download · WD14 ViT';
-
 async function post(request, url, data) {
     await expect(await request.post(url, data === undefined ? {} : { data })).toBeOK();
 }
@@ -33,61 +31,6 @@ test.afterEach(async ({ page, request, browserName }) => {
     await post(request, '/__test__/jobs/restart');
 });
 
-async function startDownload(page, request) {
-    await page.locator('#autoTagBtn').click();
-    const status = page.locator('#wd14VitModelStatus');
-    await status.getByRole('button', { name: 'Download', exact: true }).click();
-    const modal = page.locator('#autoTagDownloadModal');
-    await expect(modal).toBeVisible();
-    await expect(page.locator('#downloadStatus')).toHaveText('Downloading…');
-    await expect(page.locator('#downloadProgressBar')).toHaveClass(/animate-pulse/);
-    await expect(modal).toContainText('The download continues in Activity.');
-    await expect(page.locator('#cancelDownloadBtn')).toHaveText('Close');
-    const running = (await downloads(request)).filter(job => job.state === 'running');
-    expect(running.map(job => [job.title, job.cancellable])).toEqual([[TITLE, false]]);
-    return { modal, status };
-}
-
-test('admin download modal closes on complete and Activity lists the job without Cancel', async ({ page, request }) => {
-    await page.goto('/prompt_manager/admin');
-    const { modal, status } = await startDownload(page, request);
-
-    await page.goto('/prompt_manager/workspace#/activity');
-    const item = page.locator('#workspace-main section.surface > .activity-item')
-        .filter({ has: page.getByRole('link', { name: new RegExp(`${TITLE}$`) }) });
-    await expect(item.locator('.chip')).toHaveText('Running');
-    await expect(item.locator('progress')).not.toHaveAttribute('value');
-    await expect(item.getByRole('button', { name: 'Cancel job', exact: true })).toHaveCount(0);
-
-    // Back on the admin page a second download of the same model attaches to the running job.
-    await page.goto('/prompt_manager/admin');
-    await startDownload(page, request);
-    await post(request, '/__test__/tagging/download', { mode: 'succeed' });
-    await expect(modal).toBeHidden();
-    await expect(status).toContainText('Downloaded');
-    expect((await downloads(request)).map(job => [job.title, job.state])).toEqual([[TITLE, 'finished']]);
-});
-
-test('gallery download modal closes on complete', async ({ page, request }) => {
-    await page.goto('/prompt_manager/gallery');
-    const { modal, status } = await startDownload(page, request);
-    await post(request, '/__test__/tagging/download', { mode: 'succeed' });
-    await expect(modal).toBeHidden();
-    await expect(page.locator('#autoTagModal')).toBeVisible();
-    await expect(status).toContainText('Downloaded');
-    expect((await downloads(request)).map(job => job.state)).toEqual(['finished']);
-});
-
-test('a failed download closes the modal and says so', async ({ page, request }) => {
-    await page.goto('/prompt_manager/gallery');
-    const { modal, status } = await startDownload(page, request);
-    await post(request, '/__test__/tagging/download', { mode: 'fail' });
-    await expect(modal).toBeHidden();
-    await expect(page.getByText('Download failed: Download failed')).toBeVisible();
-    await expect(status.getByRole('button', { name: 'Download', exact: true })).toBeVisible();
-    expect((await downloads(request)).map(job => job.state)).toEqual(['failed']);
-});
-
 // (wd14-vit is not downloaded in these tests: beforeEach marks it so the download tests can offer it.)
 // The gallery's batch reader keyed on `data.status` values the server never sends, so its modal never moved or
 // closed (#328 Problem 5). It now reads `type` frames as the admin page does.
@@ -171,25 +114,6 @@ test('admin review opens the first image', async ({ page }) => {
     await expect(page.getByText('Failed to start review mode')).toHaveCount(0);
 });
 
-test('gallery unload works and is refused while the gate is held', async ({ page, request }) => {
-    await page.goto('/prompt_manager/gallery');
-    await runGalleryBatch(page); // keeps the model in memory
-    await page.locator('#autoTagBtn').click();
-    const unload = page.locator('#unloadModelBtn');
-    await expect(unload).toBeVisible();
-
-    // A held download owns the model gate: Unload is refused with the server's error.
-    const held = await request.post('/prompt_manager/jobs/model-download', { data: { model_type: 'gguf' } });
-    expect(held.status()).toBe(202);
-    await unload.click();
-    await expect(page.getByText(/^Failed to unload model: A tagging model is busy/)).toBeVisible();
-
-    await post(request, '/__test__/tagging/download', { mode: 'succeed' });
-    await expect.poll(async () => (await downloads(request)).map(job => job.state)).toEqual(['finished']);
-    await unload.click();
-    await expect(page.getByText('WD14-SWINV2 model unloaded successfully')).toBeVisible();
-});
-
 /** The admin review lists every row, videos too: Skip any image that is not one until the confirmation shows. */
 async function untilAutoTagged(page, confirm) {
     // Each image's skip check answers before its confirmation or its error shows.

tests/browser/legacy-system-links.spec.mjs

@@ -15,9 +15,40 @@ const LABELS = Object.freeze({
     diagnostics: 'Diagnostics & logs',
 });
 
+async function openPageOptions(page) {
+    await page.locator('#pageOptionsBtn').click();
+    await expect(page.locator('#settingsModal')).toBeVisible();
+}
+
+/** The auto-tag modal with its model rows read from /autotag/models. */
+async function openAutoTag(page) {
+    const read = page.waitForResponse(item => item.url().endsWith('/prompt_manager/autotag/models'));
+    await page.locator('#autoTagBtn').click();
+    await read;
+    await expect(page.locator('#autoTagModal')).toBeVisible();
+}
+
+const notDownloaded = (page, request) => post(request, '/__test__/tagging/models', { unavailable: ['gguf'] });
+const modelLoaded = (page, request) => post(request, '/__test__/tagging/loaded', { model: 'wd14-vit' });
+
 // One row per System link of the design's §2 map: the page, the control's label, how to find it, the section it opens
 // and what a test must arrange before the control shows.
 const LINKS = Object.freeze([
+    { page: 'admin', label: 'Settings', locate: page => page.locator('#settingsBtn'), section: 'overview' },
+    { page: 'admin', label: 'Maintenance', locate: page => page.locator('#maintenanceBtn'), section: 'maintenance' },
+    { page: 'admin', label: 'Backup DB', locate: page => page.locator('#backupBtn'), section: 'backups' },
+    { page: 'admin', label: 'Restore DB', locate: page => page.locator('#restoreBtn'), section: 'backups' },
+    { page: 'gallery', label: 'Settings', locate: page => page.locator('#settingsBtn'), section: 'appearance' },
+    { page: 'admin', label: 'Manage in System (model row)', arrange: notDownloaded, reveal: openAutoTag,
+        locate: page => page.locator('#ggufModelStatus a'), section: 'tagging' },
+    { page: 'gallery', label: 'Manage in System (model row)', arrange: notDownloaded, reveal: openAutoTag,
+        locate: page => page.locator('#ggufModelStatus a'), section: 'tagging' },
+    { page: 'gallery', label: 'Manage in System (Unload Model)', arrange: modelLoaded, reveal: openAutoTag,
+        locate: page => page.locator('#unloadModelBtn'), section: 'tagging' },
+    { page: 'gallery', label: 'Page options Maintenance', reveal: openPageOptions,
+        locate: page => page.locator('#pageOptionsMaintenanceLink'), section: 'maintenance' },
+    { page: 'gallery', label: 'Page options Sources & scans', reveal: openPageOptions,
+        locate: page => page.locator('#pageOptionsSourcesLink'), section: 'sources' },
     { page: 'admin', label: 'Diagnostics', locate: page => page.locator('#diagnosticsBtn'), section: 'diagnostics' },
     { page: 'admin', label: 'View Logs', locate: page => page.locator('#logsBtn'), section: 'diagnostics' },
 ]);
@@ -54,17 +85,31 @@ async function openLink(page, request, link) {
     return control;
 }
 
+// Each row opens its section in a new tab and sends no request from the legacy page (the design's `a System link sends
+// no request from the legacy page`, checked per row so one slow page never times out the whole table).
 for (const link of LINKS) {
     test(`legacy ${link.page} ${link.label} opens System ${link.section}`, async ({ page, context, request }) => {
+        // The gallery's thumbnail startup check (K9) reads its status on a timer of its own; it is off here.
+        await page.addInitScript(() => {
+            localStorage.setItem('gallerySettings', JSON.stringify({ checkThumbnailsAtStartup: false }));
+        });
         const control = await openLink(page, request, link);
         const legacyUrl = page.url();
         await expect(control).toHaveAttribute('href', `workspace#/system/${link.section}`);
         await expect(control).toHaveAttribute('target', '_blank');
         await expect(control).toHaveAttribute('rel', 'noopener');
+        // The page's own start-up reads (list, film strips, settings) finish first; then the click must add none.
+        // Lazy thumbnails may still load whenever the layout changes; they are not the click's.
+        await page.waitForLoadState('networkidle');
+        const sent = [];
+        const record = item => { if (item.resourceType() !== 'image') sent.push(`${item.method()} ${item.url()}`); };
+        page.on('request', record);
         const opened = context.waitForEvent('page');
         await control.click();
         const system = await opened;
         await expect(system).toHaveURL(new RegExp(`/prompt_manager/workspace#/system/${link.section}$`));
+        page.off('request', record);
+        expect(sent, 'a System link sends no request from the legacy page').toEqual([]);
         // System's page heading is "System"; the open section is the pressed button of its section switcher.
         const main = system.locator('#workspace-main');
         await expect(main.getByRole('heading', { level: 1, name: 'System', exact: true })).toBeVisible();
@@ -75,24 +120,6 @@ for (const link of LINKS) {
     });
 }
 
-test('a System link sends no request from the legacy page', async ({ page, context, request }) => {
-    for (const link of LINKS) {
-        const control = await openLink(page, request, link);
-        // The page's own start-up reads (list, film strips, settings) finish first; then the click must add none.
-        await page.waitForLoadState('networkidle');
-        const sent = [];
-        const record = item => sent.push(`${item.method()} ${item.url()}`);
-        page.on('request', record);
-        const opened = context.waitForEvent('page');
-        await control.click();
-        const system = await opened;
-        await system.waitForLoadState('domcontentloaded');
-        page.off('request', record);
-        expect(sent, `${link.page} ${link.label}`).toEqual([]);
-        await system.close();
-    }
-});
-
 test('kept admin flows still work', async ({ page, context }) => {
     await page.goto(PAGES.admin);
     const texts = page.locator('#resultsList .prompt-text');
@@ -161,3 +188,99 @@ test('kept admin flows still work', async ({ page, context }) => {
         await tab.close();
     }
 });
+
+test('Page options keeps the page-only settings admin', async ({ page, request }) => {
+    const before = (await (await request.get('/prompt_manager/settings')).json()).settings;
+    await page.goto(PAGES.admin);
+    await expect(page.locator('#resultsList .prompt-text').first()).toBeVisible();
+    await page.locator('#pageOptionsBtn').click();
+    const dialog = page.locator('#settingsModal');
+    await expect(dialog).toBeVisible();
+    await expect(dialog.locator('h3')).toHaveText('Page options');
+    // Exactly the page-only setting (G5): the list's Infinite Scrolling default.
+    expect(await dialog.locator('input, select, textarea').evaluateAll(fields => fields.map(field => field.id)))
+        .toEqual(['infiniteScrollDefault']);
+    await expect(page.locator('#infiniteScrollDefault')).not.toBeChecked();
+    await page.locator('#infiniteScrollDefault').check();
+    const saved = page.waitForRequest(item => item.method() === 'POST' && item.url().endsWith('/prompt_manager/settings'));
+    await page.locator('#saveSettings').click();
+    expect((await saved).postDataJSON()).toEqual({ infinite_scroll: true });
+    await expect(dialog).toBeHidden();
+    // The list header follows the saved default at once; nothing else changed.
+    await expect(page.locator('#infiniteScrollSession')).toBeChecked();
+    const after = (await (await request.get('/prompt_manager/settings')).json()).settings;
+    expect(after).toEqual({ ...before, infinite_scroll: true });
+    await page.reload();
+    // The dialog shows the saved default once the page has read it (the header follows it first).
+    await expect(page.locator('#infiniteScrollSession')).toBeChecked();
+    await page.locator('#pageOptionsBtn').click();
+    await expect(page.locator('#infiniteScrollDefault')).toBeChecked();
+});
+
+test('Page options keeps the page-only settings gallery', async ({ page }) => {
+    // Native Appearance keys and the startup prompt's own keys are in the shared object before the page opens.
+    const stored = { imageQuality: 'high', showImageInfo: false, videoMute: false,
+        autoLoadMetadata: false, workspaceLayout: 'masonry', thumbnailPromptDismissed: 'sig', thumbnailsGenerated: true,
+        checkThumbnailsAtStartup: false, defaultViewMode: 'list' };
+    await page.addInitScript(value => {
+        if (!sessionStorage.getItem('seeded')) {
+            sessionStorage.setItem('seeded', '1');
+            localStorage.setItem('gallerySettings', value);
+        }
+    }, JSON.stringify(stored));
+    const listed = page.waitForResponse(item => item.url().includes('/prompt_manager/images/output?'));
+    await page.goto(PAGES.gallery);
+    await listed;
+    // With no Page options control, a stored default view still opens the page in it.
+    await expect(page.locator('#listViewBtn')).toHaveClass(/bg-pm-accent/);
+    await openPageOptions(page);
+    const dialog = page.locator('#settingsModal');
+    await expect(dialog.locator('h3')).toHaveText('Page options');
+    // Exactly the page-only settings (G5); the default view is System › Appearance's Default layout.
+    expect(await dialog.locator('input, select, textarea').evaluateAll(fields => fields.map(field => field.id))).toEqual([
+        'checkThumbnailsAtStartup', 'lazyLoadingToggle', 'defaultLimitSelect', 'gridColumnsSelect',
+        'infiniteScrollToggle', 'debugModeToggle', 'apiTimeoutInput']);
+    await expect(dialog.getByText('Default View Mode')).toHaveCount(0);
+    await page.locator('#defaultLimitSelect').selectOption('50');
+    await page.locator('#debugModeToggle').check();
+    await page.locator('#saveSettingsBtn').click();
+    await expect(dialog).toBeHidden();
+    const read = () => page.evaluate(() => JSON.parse(localStorage.getItem('gallerySettings')));
+    let saved = await read();
+    expect(saved).toMatchObject({ ...stored, defaultLimit: 50, debugMode: true });
+
+    // Reset puts back only the page options' defaults; the Appearance, startup-prompt and default-view keys stay.
+    await openPageOptions(page);
+    page.once('dialog', dialog => dialog.accept());
+    await page.locator('#resetSettingsBtn').click();
+    await expect(page.getByText('Page options reset to defaults')).toBeVisible();
+    await expect(page.locator('#defaultLimitSelect')).toHaveValue('100');
+    saved = await read();
+    expect(saved).toMatchObject({ defaultViewMode: 'list', imageQuality: 'high', showImageInfo: false, videoMute: false,
+        autoLoadMetadata: false, workspaceLayout: 'masonry', thumbnailPromptDismissed: 'sig', thumbnailsGenerated: true,
+        defaultLimit: 100, debugMode: false, checkThumbnailsAtStartup: true, lazyLoading: true, gridColumns: 8,
+        infiniteScroll: false, apiTimeout: 30 });
+});
+
+test('the legacy auto-tag modal stays open after Manage in System', async ({ page, context, request }) => {
+    for (const legacy of ['admin', 'gallery']) {
+        await post(request, '/__test__/tagging/models', { unavailable: ['gguf'] });
+        await page.goto(PAGES[legacy]);
+        await openAutoTag(page);
+        const link = page.locator('#ggufModelStatus').getByRole('link', { name: 'Manage in System', exact: true });
+        await expect(link).toHaveAttribute('title', 'Opens System › Auto-tagging in a new tab');
+        // A downloaded model keeps its status text.
+        await expect(page.locator('#wd14VitModelStatus')).toHaveText('\u2713 Downloaded');
+        const opened = context.waitForEvent('page');
+        await link.click();
+        const system = await opened;
+        await expect(system).toHaveURL(/#\/system\/tagging$/);
+        await expect(page.locator('#autoTagModal')).toBeVisible();
+        await system.close();
+        // Downloaded in System meanwhile: reopening the modal reads the models again (CUJ 4).
+        await post(request, '/__test__/tagging/models', { unavailable: [] });
+        await page.goto(PAGES[legacy]);
+        await openAutoTag(page);
+        await expect(page.locator('#ggufModelStatus')).toHaveText('\u2713 Downloaded');
+    }
+});

tests/browser/pair-node.spec.mjs

@@ -17,7 +17,7 @@ test.beforeEach(async({page,browserName})=>{
         window.fixtureApp={registerExtension(extension){this.extension=extension;},ui:{settings},graph:{_nodes:[],setDirtyCanvas(){}},canvas:{},graphToPrompt:async()=>({})};
         await import('/extensions/promptmanager/prompt_manager.js');
         class Node {
-            constructor(){this.id=1;this.type='PromptManagerPair';this.widgets=['text','negative_text','category','tags','search_text'].map(name=>({name,type:'text',value:'',options:{},inputEl:document.createElement('textarea')}));this.inputs=[...['clip','prepend_text','append_text'].map(name=>({name,type:name==='clip'?'CLIP':'STRING',link:null})),...['text','negative_text','category','tags','search_text'].map(name=>({name,type:'STRING',link:null,widget:{name}}))];this.properties={};this.size=[1100,700];}
+            constructor(){this.id=1;this.type='PromptManagerPair';this.widgets=[...['text','negative_text','category','tags','search_text'].map(name=>({name,type:'text',value:'',options:{},inputEl:document.createElement('textarea')})),{name:'save_to_library',type:'toggle',value:true,options:{}}];this.inputs=[...['clip','prepend_text','append_text'].map(name=>({name,type:name==='clip'?'CLIP':'STRING',link:null})),...['text','negative_text','category','tags','search_text'].map(name=>({name,type:'STRING',link:null,widget:{name}})),{name:'save_to_library',type:'BOOLEAN',link:null,widget:{name:'save_to_library'}}];this.properties={};this.size=[1100,700];}
             findInputByType(type){const index=this.inputs.findIndex(input=>input.type===type&&input.link==null);return index<0?undefined:{index,slot:this.inputs[index]};}
             addWidget(type,name,value,callback,options){const widget={type,name,value,callback,options};this.widgets.push(widget);return widget;}
             addDOMWidget(name,type,element){const host=document.createElement('div');host.style.cssText='height:700px;width:1100px;max-width:100%';host.className='fixture-dom-widget';host.append(element);document.body.append(host);return {element};}
@@ -34,6 +34,18 @@ test.afterEach(async({page,browserName})=>{await saveCoverage(page,browserName);
 async function selectPair(page){await page.getByRole('button',{name:'Recent',exact:true}).click();await page.locator('.pm-editor-result').click();}
 async function draft(page,positive='Draft positive',negative='Draft negative'){await page.getByRole('textbox',{name:'Positive prompt',exact:true}).fill(positive);await page.getByRole('textbox',{name:'Negative prompt',exact:true}).fill(negative);}
 
+test('paired editor Save to library switch keeps the widget order and loads older workflows on (#90)',async({page})=>{
+    await expect(page.locator('.pm-pair')).toBeVisible();
+    const toggle=page.getByRole('checkbox',{name:'Save to library',exact:true});
+    await expect(toggle).toBeChecked();
+    expect(await page.evaluate(()=>node.widgets.map(widget=>widget.name))).toEqual(['text','negative_text','category','tags','search_text','prepend_text','append_text','save_to_library']);
+    await toggle.uncheck();
+    expect(await page.evaluate(()=>node.serialize().widgets_values[7])).toBe(false);
+    await expect(page.locator('.pm-pair > .pm-editor-status[role=status]').last()).toHaveText('Save to library is off: runs of this node are not added to the library.');
+    await page.evaluate(()=>node.configure({widgets_values:['P','N','','','','','',''],properties:{}}));
+    await expect(toggle).toBeChecked();
+});
+
 test('paired editor previews both texts before explicitly replacing both',async({page})=>{
     await expect(page.locator('.pm-pair')).toBeVisible();
     await draft(page);

tests/browser/server.py

@@ -268,6 +268,7 @@ def create_app(root: Path) -> web.Application:
                 "media_image_tags",
                 "media_annotation_bytes",
                 "media_annotation_files",
+                "image_categories",
                 "image_prompt_pairs",
                 "prompt_pair_tags",
                 "prompt_pairs",

tests/browser/workflows.spec.mjs

@@ -104,33 +104,6 @@ for (const leave of ['beforeunload', 'pagehide']) {
     });
 }
 
-// #222: the gallery's Clear cache clears the server's thumbnails by its own request and keeps this browser's
-// preferences and other tools' storage; nothing of Prompt Manager's is cached in a browser, and the toast says so.
-test('the gallery cache clear keeps preferences and other tools caches', async ({ page }) => {
-    await page.addInitScript(() => {
-        if (sessionStorage.getItem('seeded')) return;
-        sessionStorage.setItem('seeded', '1');
-        localStorage.setItem('pm_workspace_theme', 'light');
-        localStorage.setItem('other-tool-setting', 'keep');
-        localStorage.setItem('pm_other_tool', 'keep');
-    });
-    await page.goto('/prompt_manager/gallery');
-    await expect(page.locator('#galleryGrid .image-item')).toHaveCount(2);
-    await page.evaluate(async () => { await (await caches.open('other-tool-gallery-thumbnails')).put('/x', new Response('x')); });
-    const clears = [];
-    page.on('request', req => { if (req.url().includes('/clear-thumbnails')) clears.push(req.method()); });
-    page.once('dialog', dialog => dialog.accept());
-    await page.locator('#settingsBtn').click();
-    await page.locator('#clearCacheBtn').click();
-    await expect(page.getByText("Thumbnails cleared; original images untouched. Nothing of Prompt Manager's is cached in this browser."))
-        .toBeVisible();
-    expect(clears).toEqual(['POST']);
-    expect(await page.evaluate(async () => ({
-        theme: localStorage.getItem('pm_workspace_theme'), other: localStorage.getItem('other-tool-setting'),
-        prefixed: localStorage.getItem('pm_other_tool'), notice: localStorage.getItem('pm_update_notice_dismissed'),
-        caches: await caches.keys(),
-    }))).toEqual({ theme: 'light', other: 'keep', prefixed: 'keep', notice: '3.2.0', caches: ['other-tool-gallery-thumbnails'] });
-});
 
 // #379: the reviewed tags are that image's own tags; no prompt changes.
 test('actual gallery review generates and persists tags for the selected root\'s image', async ({ page, request }) => {
@@ -226,7 +199,7 @@ test('gallery infinite scroll appends a real backend page while retaining existi
     await expect(await request.post('/__test__/reset', { data: { extra_images: 108 } })).toBeOK();
     await page.goto('/prompt_manager/gallery');
     await expect(page.locator('#galleryGrid .image-item')).toHaveCount(100);
-    await page.locator('#settingsBtn').click();
+    await page.locator('#pageOptionsBtn').click();
     await page.locator('#infiniteScrollToggle').check();
     await page.locator('#saveSettingsBtn').click();
     await expect(page.locator('#settingsModal')).toBeHidden();
@@ -246,37 +219,6 @@ async function promptSnapshot(request) {
     })).sort((a, b) => a.id - b.id);
 }
 
-async function downloadBackup(page) {
-    const downloading = page.waitForEvent('download');
-    await page.locator('#backupBtn').click();
-    const download = await downloading;
-    expect(download.suggestedFilename()).toMatch(/^prompts_backup_.*\.db$/);
-    expect(await download.failure()).toBeNull();
-    const chunks = [];
-    for await (const chunk of await download.createReadStream()) chunks.push(chunk);
-    const buffer = Buffer.concat(chunks);
-    expect(buffer.subarray(0, 16).toString()).toBe('SQLite format 3\0');
-    return { name: download.suggestedFilename(), mimeType: 'application/octet-stream', buffer };
-}
-
-async function chooseRestore(page, file) {
-    await page.locator('#restoreBtn').click();
-    await expect(page.locator('#restoreModal')).toBeVisible();
-    await page.locator('#restoreFileInput').setInputFiles(file);
-}
-
-// Confirms the chosen restore and waits for the server's answer, not for a timer: a restore is disk-bound and can take
-// longer than an expect timeout on a slow runner (#359). The modal closes only after that answer.
-async function confirmRestoreAndWait(page) {
-    const restored = page.waitForResponse(response => response.url().endsWith('/prompt_manager/restore'));
-    await page.locator('#confirmRestore').click();
-    const response = await restored;
-    const body = await response.text();
-    expect(response.status(), body).toBe(200);
-    expect(JSON.parse(body)).toMatchObject({ success: true, prompt_count: 2, backup_created: expect.any(String) });
-    await expect(page.locator('#restoreModal')).toBeHidden();
-}
-
 function confirmNextDialog(page, accept, message) {
     page.once('dialog', async dialog => {
         expect(dialog.type()).toBe('confirm');
@@ -292,88 +234,6 @@ async function deletePromptButton(page, text) {
     return page.locator(`[data-action="delete"][data-prompt-id="${id}"]`);
 }
 
-test('downloaded backup restores deleted prompts, tags, and image links through the actual upload form', async ({ page, request }) => {
-    await page.goto('/prompt_manager/admin');
-    await expect(page.locator('.prompt-text')).toHaveCount(2);
-    const before = await promptSnapshot(request);
-    expect(before.map(prompt => prompt.tags)).toEqual([['cats'], ['dogs']]);
-    expect(before.every(prompt => prompt.images.length === 1)).toBe(true);
-    const backup = await downloadBackup(page);
-    const button = await deletePromptButton(page, 'Cat portrait');
-    confirmNextDialog(page, true, 'delete this prompt');
-    await button.click();
-    await expect(page.locator('.prompt-text')).toHaveCount(1);
-    await expect(await request.post('/prompt_manager/save', { data: { text: 'Added after backup', tags: ['temporary'] } })).toBeOK();
-    expect(await promptSnapshot(request)).not.toEqual(before);
-    await chooseRestore(page, backup);
-    confirmNextDialog(page, true, backup.name);
-    await confirmRestoreAndWait(page);
-    await expect(page.locator('.prompt-text')).toHaveCount(2);
-    await page.reload();
-    await expect(page.locator('.prompt-text').filter({ hasText: 'Cat portrait' })).toBeVisible();
-    await expect(page.locator('.prompt-text').filter({ hasText: 'Added after backup' })).toHaveCount(0);
-    expect(await promptSnapshot(request)).toEqual(before);
-    await page.goto('/prompt_manager/admin#/tags');
-    await page.locator('[data-tag-name="cats"]').click();
-    await expect(page.locator('#tagPromptsGrid')).toContainText('Cat portrait');
-    await page.locator('#tagPromptsGrid img').first().click();
-    await expect(page.locator('.viewer-canvas img')).toBeVisible();
-    await expect.poll(() => page.locator('.viewer-canvas img').evaluate(image => image.complete && image.naturalWidth > 0)).toBe(true);
-});
-
-test('restore validation and cancellation preserve live data and allow a valid retry', async ({ page, request }) => {
-    await page.goto('/prompt_manager/admin');
-    const before = await promptSnapshot(request);
-    const backup = await downloadBackup(page);
-    let uploads = 0;
-    page.on('request', request => { if (request.url().endsWith('/prompt_manager/restore')) uploads++; });
-    await page.locator('#restoreBtn').click();
-    await page.locator('#confirmRestore').click();
-    await expect(page.getByText('Please select a database file to restore', { exact: true })).toBeVisible();
-    await page.locator('#restoreFileInput').setInputFiles({ ...backup, name: 'backup.txt' });
-    await page.locator('#confirmRestore').click();
-    await expect(page.getByText('Please select a valid .db file', { exact: true })).toBeVisible();
-    expect(uploads).toBe(0);
-    await page.locator('#restoreFileInput').setInputFiles(backup);
-    confirmNextDialog(page, false, 'replace your current database');
-    await page.locator('#confirmRestore').click();
-    await expect(page.locator('#restoreModal')).toBeVisible();
-    expect(uploads).toBe(0);
-    await page.locator('#restoreFileInput').setInputFiles({ name: 'corrupt.db', mimeType: 'application/octet-stream', buffer: Buffer.from('not a SQLite database') });
-    confirmNextDialog(page, true, 'corrupt.db');
-    const rejected = page.waitForResponse(response => response.url().endsWith('/prompt_manager/restore'));
-    await page.locator('#confirmRestore').click();
-    expect((await rejected).status()).toBe(400);
-    await expect(page.getByText(/Restore failed:/)).toBeVisible();
-    await expect(page.locator('#restoreModal')).toBeVisible();
-    await expect(page.locator('#confirmRestore')).toBeEnabled();
-    expect(await promptSnapshot(request)).toEqual(before);
-    await page.locator('#restoreFileInput').setInputFiles(backup);
-    confirmNextDialog(page, true, backup.name);
-    await confirmRestoreAndWait(page);
-    expect(await promptSnapshot(request)).toEqual(before);
-});
-
-test('backup and restore recover from interrupted network requests without losing data', async ({ page, request }) => {
-    await page.goto('/prompt_manager/admin');
-    const before = await promptSnapshot(request);
-    await page.route('**/prompt_manager/backup', route => route.abort('failed'), { times: 1 });
-    await page.locator('#backupBtn').click();
-    await expect(page.getByText(/Backup failed:/)).toBeVisible();
-    const backup = await downloadBackup(page);
-    await chooseRestore(page, backup);
-    await page.route('**/prompt_manager/restore', route => route.abort('failed'), { times: 1 });
-    confirmNextDialog(page, true, backup.name);
-    await page.locator('#confirmRestore').click();
-    await expect(page.getByText(/Restore failed:/)).toBeVisible();
-    await expect(page.locator('#confirmRestore')).toBeEnabled();
-    await expect(page.locator('#restoreModal')).toBeVisible();
-    expect(await promptSnapshot(request)).toEqual(before);
-    confirmNextDialog(page, true, backup.name);
-    await confirmRestoreAndWait(page);
-    expect(await promptSnapshot(request)).toEqual(before);
-});
-
 test('prompt deletion requires confirmation and can retry after a network failure', async ({ page, request }) => {
     await page.goto('/prompt_manager/admin');
     const before = await promptSnapshot(request);
@@ -401,98 +261,3 @@ test('prompt deletion requires confirmation and can retry after a network failur
         await expect(await request.get(url)).toBeOK();
     }
 });
-
-// The duplicate scan reads the output root only, but the fixture's input root holds a different
-// shared/same.png. A bare /images/serve/<path> URL tries every gallery root in turn, so once the
-// output copy is deleted it answers 200 with the input copy: check each file in its own root.
-const serveIn = (root, path) => `/prompt_manager/images/serve/${path.split(/[\\/]/).map(encodeURIComponent).join('/')}?root=${root}`;
-const rootOf = url => new URL(url, 'http://gallery.test').searchParams.get('root');
-
-// Which copy the scan keeps depends on file times: the fixture stamps shared/same.png with the
-// wall clock, and the kernel can stamp its bulk copies a fraction of a millisecond earlier.
-// listOrder rewrites the finished scan's groups so a test can pick the order it needs.
-async function openDuplicateScan(page, request, listOrder = null) {
-    await expect(await request.post('/__test__/reset', { data: { extra_images: 2 } })).toBeOK();
-    if (listOrder) {
-        await page.route('**/prompt_manager/scan_duplicates/stream', async route => {
-            const response = await route.fetch();
-            const body = (await response.text()).replace(/^data: (.*)$/gm, (line, json) => {
-                const event = JSON.parse(json);
-                if (event.type !== 'complete') return line;
-                for (const group of event.duplicates) group.images = listOrder(group.images);
-                return `data: ${JSON.stringify(event)}`;
-            });
-            await route.fulfill({ response, body });
-        });
-    }
-    await page.goto('/prompt_manager/gallery');
-    await expect(page.locator('#galleryGrid .image-item')).toHaveCount(4);
-    const originals = await page.locator('#galleryGrid img[data-original]').evaluateAll(images => images.map(image => image.dataset.original));
-    const output = rootOf(originals.find(url => url.includes('/bulk/')));
-    const input = rootOf(originals.find(url => url.includes('/shared/same.png') && rootOf(url) !== output));
-    expect(output).not.toBeNull();
-    expect(input).not.toBeNull();
-    await page.locator('#settingsBtn').click();
-    await page.locator('#scanDuplicatesBtn').click();
-    await expect(page.locator('#duplicatesCount')).toHaveText('1');
-    const candidates = page.locator('.duplicate-checkbox');
-    await expect(candidates).toHaveCount(2);
-    return { originals, output, input, candidates };
-}
-
-async function expectOnlySelectedGone(page, request, { originals, output, input }, selected, retained) {
-    expect((await request.get(serveIn(output, selected))).status()).toBe(404);
-    await expect(await request.get(serveIn(output, retained))).toBeOK();
-    await expect(await request.get(serveIn(input, 'shared/same.png'))).toBeOK();
-    await page.reload();
-    await expect(page.locator('#galleryGrid .image-item')).toHaveCount(3);
-    const remaining = await page.locator('#galleryGrid img[data-original]').evaluateAll(images => images.map(image => image.dataset.original));
-    expect(remaining).toHaveLength(originals.length - 1);
-    for (const url of remaining) {
-        expect(originals).toContain(url);
-        await expect(await request.get(url)).toBeOK();
-    }
-}
-
-test('duplicate cleanup cancels safely and deletes only the selected file after a retry', async ({ page, request }) => {
-    const scan = await openDuplicateScan(page, request);
-    const { output, candidates } = scan;
-    const selected = await candidates.first().getAttribute('data-image-path');
-    const retained = await candidates.last().getAttribute('data-image-path');
-    await candidates.first().check();
-    let deletes = 0;
-    page.on('request', request => { if (request.url().endsWith('/delete_duplicate_images')) deletes++; });
-    confirmNextDialog(page, false, 'permanently delete 1 duplicate image files');
-    await page.locator('#removeDuplicatesBtn').click();
-    expect(deletes).toBe(0);
-    await expect(await request.get(serveIn(output, selected))).toBeOK();
-    await page.route('**/prompt_manager/delete_duplicate_images', route => route.abort('failed'), { times: 1 });
-    confirmNextDialog(page, true, 'permanently delete 1 duplicate image files');
-    await page.locator('#removeDuplicatesBtn').click();
-    await expect(page.getByText('Failed to delete duplicate images', { exact: true })).toBeVisible();
-    await expect(page.locator('#removeDuplicatesBtn')).toBeEnabled();
-    await expect(await request.get(serveIn(output, selected))).toBeOK();
-    confirmNextDialog(page, true, 'permanently delete 1 duplicate image files');
-    const deleted = page.waitForResponse(response => response.url().endsWith('/delete_duplicate_images'));
-    await page.locator('#removeDuplicatesBtn').click();
-    expect((await (await deleted).json())).toMatchObject({ success: true, deleted_count: 1, failed_count: 0 });
-    await expect(page.locator('#duplicatesModal')).toBeHidden();
-    await expectOnlySelectedGone(page, request, scan, selected, retained);
-});
-
-test('deleting a duplicate whose path another gallery root also holds removes only the scanned copy', async ({ page, request }) => {
-    // The order CI saw: a bulk copy stamped first, so shared/same.png is the first Delete candidate.
-    const ciOrder = ['bulk/0000.png', 'shared/same.png', 'bulk/0001.png'];
-    const rank = image => ciOrder.indexOf(image.path.replace(/\\/g, '/'));
-    const scan = await openDuplicateScan(page, request, images => [...images].sort((a, b) => rank(a) - rank(b)));
-    const selected = await scan.candidates.first().getAttribute('data-image-path');
-    const retained = await scan.candidates.last().getAttribute('data-image-path');
-    expect(selected.replace(/\\/g, '/')).toBe('shared/same.png');
-    await scan.candidates.first().check();
-    confirmNextDialog(page, true, 'permanently delete 1 duplicate image files');
-    const deleted = page.waitForResponse(response => response.url().endsWith('/delete_duplicate_images'));
-    await page.locator('#removeDuplicatesBtn').click();
-    expect((await (await deleted).json())).toMatchObject({ success: true, deleted_count: 1, failed_count: 0 });
-    await expect(page.locator('#duplicatesModal')).toBeHidden();
-    await expectOnlySelectedGone(page, request, scan, selected, retained);
-});

tests/browser/workspace-system-backups.spec.mjs

@@ -395,14 +395,15 @@ test('a failed settings read leaves the policy disabled with the reason', async
     await expect(row.locator('input')).toBeDisabled();
 });
 
-test('the legacy admin Backup and Restore keep working', async ({ page, request }) => {
+test('the legacy Backup and Restore routes keep working and the admin page links to System', async ({ page, request }) => {
     const bytes = await backupBytes(request);
     const restored = await request.post('/prompt_manager/restore', { multipart: { database_file: {
         name: 'prompts_backup.db', mimeType: 'application/octet-stream', buffer: bytes } } });
     await expect(restored).toBeOK();
     expect((await restored.json()).success).toBe(true);
+    // #330: the admin page's Backup DB and Restore DB open System › Backup & export.
     await page.goto('/prompt_manager/admin');
-    await expect(page.locator('#restoreFileInput')).toHaveCount(1);
+    for (const id of ['#backupBtn', '#restoreBtn']) await expect(page.locator(id)).toHaveAttribute('href', 'workspace#/system/backups');
 });
 
 /** Start a fake running job (a metadata scan another tab started), which an exclusive restore must wait for. */

tests/browser/workspace_concept_fixture.py

@@ -181,6 +181,7 @@ _TABLES = (
     "media_image_tags",
     "media_annotation_bytes",
     "media_annotation_files",
+    "image_categories",
     "image_prompt_pairs",
     "prompt_pair_tags",
     "prompt_pairs",

tests/browser/workspace_library_editor_fixture.py

@@ -33,6 +33,7 @@ _TABLES = (
     "media_image_tags",
     "media_annotation_bytes",
     "media_annotation_files",
+    "image_categories",
     "image_prompt_pairs",
     "prompt_pair_tags",
     "prompt_pairs",

tests/browser/workspace_review_fixture.py

@@ -85,6 +85,7 @@ _TABLES = (
     "media_image_tags",
     "media_annotation_bytes",
     "media_annotation_files",
+    "image_categories",
     "image_prompt_pairs",
     "prompt_pair_tags",
     "prompt_pairs",

tests/browser/workspace_tagging_fixture.py

@@ -51,6 +51,7 @@ _TABLES = (
     "media_image_tags",
     "media_annotation_bytes",
     "media_annotation_files",
+    "image_categories",
     "image_prompt_pairs",
     "prompt_pair_tags",
     "prompt_pairs",
@@ -247,6 +248,22 @@ def register_tagging_commands(
         model.unavailable = set(data["unavailable"])
         return web.json_response({"success": True})
 
+    @routes.post("/__test__/tagging/loaded")
+    async def loaded(request: web.Request) -> web.Response:
+        """Mark one fake model loaded (``{"model": "<key>"}``), as a batch that
+        kept it in memory leaves it; ``/autotag/models`` then reports
+        ``model_loaded``. Reset unloads it."""
+        data = await request.json() if request.can_read_body else None
+        if (
+            request.query
+            or not isinstance(data, dict)
+            or set(data) != {"model"}
+            or data["model"] not in MODELS
+        ):
+            raise web.HTTPBadRequest()
+        model.loaded = data["model"]
+        return web.json_response({"success": True})
+
     @routes.post("/__test__/tagging/download")
     async def download_mode(request: web.Request) -> web.Response:
         """Switch the model's download to a fake (never a real download).

tests/browser/workspace_visual_fixture.py

@@ -119,6 +119,7 @@ def seed_workspace_visual(api: PromptManagerAPI, root: Path) -> None:
             "media_image_tags",
             "media_annotation_bytes",
             "media_annotation_files",
+            "image_categories",
             "image_prompt_pairs",
             "prompt_pair_tags",
             "prompt_pairs",

tests/browser/workspace_vocabulary_fixture.py

@@ -86,6 +86,7 @@ _TABLES = (
     "media_image_tags",
     "media_annotation_bytes",
     "media_annotation_files",
+    "image_categories",
     "image_prompt_pairs",
     "prompt_pair_tags",
     "prompt_pairs",

tests/comfyui/execution-text-link.spec.mjs

@@ -11,13 +11,13 @@ import { installHostHooks } from './host-fixture.mjs';
 
 // The worker's owned host must be up before the shared host hooks open the page.
 test.beforeEach(async ({ execution }) => { expect(execution.databasePath).toBeTruthy(); });
-installHostHooks(test, ['PromptManager', 'PromptManagerText', 'PromptManagerFocused', 'PromptManagerPair', 'PMHistoryInputs']);
+installHostHooks(test, ['PromptManager', 'PromptManagerText', 'PromptManagerFocused', 'PromptManagerPair', 'PMHistoryInputs', 'PMCycledText']);
 
 // `primitive`: a core string node the queue-time resolver follows. `legacy`: the frontend's virtual Primitive node,
 // whose value is queued as literal text. `preview`: PrimitiveString -> PreviewAny, the shape of the maintainer's
 // TextGenerate -> PreviewAny chain, whose text is only known when the node runs.
-function build(page, { kind, positive, negative, prefix }) {
-    return page.evaluate(async ({ kind, positive, negative, prefix }) => {
+function build(page, { kind, positive, negative, prefix, saveToLibrary }) {
+    return page.evaluate(async ({ kind, positive, negative, prefix, saveToLibrary }) => {
         const { app } = await import('/scripts/app.js');
         app.graph.clear();
         const add = (type, x, y) => { const node = LiteGraph.createNode(type); app.graph.add(node); node.pos = [x, y]; return node; };
@@ -28,6 +28,7 @@ function build(page, { kind, positive, negative, prefix }) {
         const set = (name, value) => { const widget = prompt.widgets.find(item => item.name === name); widget.value = value; if (widget.inputEl) widget.inputEl.value = value; };
         set('text', positive.typed);
         if (negative) set('negative_text', negative.typed);
+        if (saveToLibrary !== undefined) prompt.widgets.find(item => item.name === 'save_to_library').value = saveToLibrary;
         const drive = (name, side, y) => {
             if (!side.via) return;
             if (side.via === 'legacy') {
@@ -37,6 +38,7 @@ function build(page, { kind, positive, negative, prefix }) {
                 primitive.widgets[0].value = side.text;
                 return;
             }
+            if (side.via === 'cycled') { connect(add('PMCycledText', 0, y), 0, prompt, name); return; }
             const text = add('PrimitiveString', 0, y);
             text.widgets.find(widget => widget.name === 'value').value = side.text;
             let source = text;
@@ -72,12 +74,12 @@ function build(page, { kind, positive, negative, prefix }) {
         await prompt._pmTextSerializerReady;
         const { output, workflow } = await app.graphToPrompt();
         return { output, workflow, promptNode: String(prompt.id) };
-    }, { kind, positive, negative, prefix });
+    }, { kind, positive, negative, prefix, saveToLibrary });
 }
 
-async function run(execution, page, testCase) {
+async function run(execution, page, testCase, built) {
     const prefix = `textlink/${randomUUID()}`;
-    const { output, workflow, promptNode } = await build(page, { ...testCase, prefix });
+    const { output, workflow, promptNode } = built ?? await build(page, { ...testCase, prefix });
     const id = randomUUID();
     const response = await execution.request.post('/prompt', { data: { prompt: output, prompt_id: id, extra_data: { extra_pnginfo: { workflow } } } });
     expect(response.ok(), await response.text()).toBe(true);
@@ -193,3 +195,205 @@ for (const [label, linked, negativeVia] of [['positive', ['text'], 'primitive'],
         await expectImagesLinked(execution, evidence, sides.text.via === 'preview');
     });
 }
+
+// #90: with Save to library off the run still produces its image, but PromptManager saves, counts and links nothing,
+// and the run's history records no prompt text for it.
+for (const kind of ['PromptManager', 'PromptManagerText', 'PromptManagerFocused', 'PromptManagerSplit', 'PromptManagerPair']) {
+    test(`${kind} with Save to library off saves, counts and links nothing (#90)`, async ({ execution, page }) => {
+        test.setTimeout(90000);
+        const text = unique(`Not saved ${kind}`);
+        const negative = kind === 'PromptManagerPair' ? { typed: unique('Not saved negative') } : undefined;
+        const prefix = `notsaved/${randomUUID()}`;
+        const { output, workflow, promptNode } = await build(page, { kind, positive: { typed: text }, negative, prefix, saveToLibrary: false });
+        expect(output[promptNode].inputs.save_to_library).toBe(false);
+        const id = randomUUID();
+        const response = await execution.request.post('/prompt', { data: { prompt: output, prompt_id: id, extra_data: { extra_pnginfo: { workflow } } } });
+        expect(response.ok(), await response.text()).toBe(true);
+        let item;
+        await expect.poll(async () => {
+            item = (await (await execution.request.get(`/history/${id}`)).json())[id];
+            return item?.status?.status_str ?? null;
+        }, { timeout: 20000 }).toBe('success');
+        let result;
+        await expect.poll(async () => {
+            result = await readExecutionRuns(execution.databasePath, id);
+            const run = result.rows[0];
+            return Boolean(run && result.captures[run.run_id]);
+        }, { timeout: 10000, message: 'the run reaches SQLite' }).toBe(true);
+        const run = result.rows[0];
+        for (const context of result.captures[run.run_id].contexts || []) {
+            expect(context.positive_prompt_id ?? null).toBeNull();
+            expect(context.pair_id ?? null).toBeNull();
+        }
+        expect((result.usage[run.run_id] || []).every(entry => entry.run_count === 0)).toBe(true);
+        const files = Object.values(item.outputs).flatMap(value => value.images || []).map(image => image.filename);
+        expect(files.length).toBeGreaterThan(0);
+        await scan(execution);
+        expect(Object.values(await linkedPrompts(execution, files))).toEqual(files.map(() => null));
+        for (const query of [text, negative?.typed].filter(Boolean)) {
+            const found = await (await execution.request.get(`/prompt_manager/search?text=${encodeURIComponent(query)}`)).json();
+            expect(found.results ?? [], query).toEqual([]);
+        }
+    });
+}
+
+// #347: a cached PromptManager node counts every job, as an executing one does. Jobs after the first change only
+// the sampler seed, so ComfyUI serves the PromptManager node (and its PreviewAny source) from its output cache.
+const COUNTS = `import json, sqlite3, sys, pathlib
+db = sqlite3.connect(pathlib.Path(sys.argv[1]).resolve().as_uri() + "?mode=ro", uri=True)
+one = lambda sql, key: (db.execute(sql, (int(key),)).fetchone() or [None])[0] if key != "-" else None
+print(json.dumps({"positive": one("SELECT run_count FROM prompts WHERE id=?", sys.argv[2]),
+    "negative": one("SELECT run_count FROM prompts WHERE id=?", sys.argv[3]),
+    "pair": one("SELECT run_count FROM prompt_pairs WHERE id=?", sys.argv[4])}))`;
+async function runCounts(execution, context) {
+    const key = value => value == null ? '-' : String(value);
+    const { stdout } = await promisify(execFile)(process.env.PM_TEST_PYTHON || 'python',
+        ['-c', COUNTS, execution.databasePath, key(context.positive_prompt_id), key(context.negative_prompt_id), key(context.pair_id)], { timeout: 5000 });
+    return JSON.parse(stdout);
+}
+
+async function setCache(execution, mode) {
+    expect((await execution.request.post('/pm_execution_fixture/cache', { data: { mode } })).ok()).toBe(true);
+}
+
+// Queue an already built workflow again with another sampler seed; returns the job's history item and cached nodes.
+async function queueAgain(execution, first, { seed, edit, targets, status = 'success' } = {}) {
+    const output = structuredClone(first.output);
+    const sampler = Object.values(output).find(node => node.class_type === 'KSampler');
+    sampler.inputs.seed = seed;
+    edit?.(output);
+    const id = randomUUID();
+    const data = { prompt: output, prompt_id: id, extra_data: { extra_pnginfo: { workflow: first.workflow } } };
+    if (targets) data.partial_execution_targets = targets;
+    const response = await execution.request.post('/prompt', { data });
+    expect(response.ok(), await response.text()).toBe(true);
+    let item;
+    await expect.poll(async () => {
+        item = (await (await execution.request.get(`/history/${id}`)).json())[id];
+        return item?.status?.status_str ?? null;
+    }, { timeout: 20000 }).toBe(status);
+    const cached = item.status.messages.find(([event]) => event === 'execution_cached')?.[1]?.nodes ?? [];
+    return { id, item, cached };
+}
+
+// The recorded context of one job, once its capture reached SQLite.
+async function capturedContext(execution, id) {
+    let result;
+    await expect.poll(async () => {
+        result = await readExecutionRuns(execution.databasePath, id);
+        const row = result.rows[0];
+        return row ? result.captures[row.run_id].state : null;
+    }, { timeout: 10000 }).toMatch(/^(complete|partial)$/);
+    return result.captures[result.rows[0].run_id].contexts[0];
+}
+
+async function firstRun(execution, page, testCase) {
+    const prefix = `textlink/${randomUUID()}`;
+    const built = await build(page, { ...testCase, prefix });
+    const evidence = await run(execution, page, testCase, built);
+    return { ...evidence, workflow: built.workflow };
+}
+
+for (const kind of ['PromptManager', 'PromptManagerFocused', 'PromptManagerSplit', 'PromptManagerText', 'PromptManagerPair']) {
+    test(`${kind} counts each cached re-run of text linked from PreviewAny (#347)`, async ({ execution, page }) => {
+        test.setTimeout(90000);
+        await setCache(execution, 'RAM_PRESSURE');
+        const pair = kind === 'PromptManagerPair';
+        const testCase = { kind, positive: { typed: 'Typed under the link', text: unique(`Cached ${kind}`), via: 'preview' },
+            negative: pair ? { typed: unique('Typed negative') } : undefined };
+        const first = await firstRun(execution, page, testCase);
+        for (const seed of [2, 3]) {
+            const again = await queueAgain(execution, first, { seed });
+            expect(again.cached, 'ComfyUI served the PromptManager node from its cache').toContain(first.promptNode);
+        }
+        const counts = await runCounts(execution, first.context);
+        expect(counts.positive).toBe(3);
+        if (pair) expect(counts).toMatchObject({ negative: 0, pair: 3 });
+    });
+}
+
+test.describe('cached runs in one renderer (#347)', () => {
+    // Cache behavior does not depend on the renderer: one project runs these.
+    test.beforeEach(({}, testInfo) => { test.skip(testInfo.project.name !== 'classic-start', 'covered in classic-start'); });
+    const linked = () => ({ kind: 'PromptManager', positive: { typed: 'Typed under the link', text: unique('Cached'), via: 'preview' } });
+
+    for (const mode of ['CLASSIC', 'LRU', 'RAM_PRESSURE', 'NONE']) {
+        test(`counts 3 jobs under the ${mode} cache`, async ({ execution, page }) => {
+            test.setTimeout(90000);
+            await setCache(execution, mode);
+            try {
+                const first = await firstRun(execution, page, linked());
+                for (const seed of [2, 3]) {
+                    const again = await queueAgain(execution, first, { seed });
+                    if (mode === 'NONE') expect(again.cached).not.toContain(first.promptNode);
+                    else expect(again.cached).toContain(first.promptNode);
+                }
+                expect((await runCounts(execution, first.context)).positive).toBe(3);
+            } finally { await setCache(execution, 'RAM_PRESSURE'); }
+        });
+    }
+
+    test('alternating upstream values A, B, A under LRU each count their own prompt', async ({ execution, page }) => {
+        test.setTimeout(90000);
+        await setCache(execution, 'LRU');
+        try {
+            const [a, b] = [unique('Cycled A'), unique('Cycled B')];
+            const cycle = async value => expect((await execution.request.post('/pm_execution_fixture/cycled', { data: { value } })).ok()).toBe(true);
+            await cycle(a);
+            const first = await firstRun(execution, page, { kind: 'PromptManager', positive: { typed: 'Typed under the link', text: a, via: 'cycled' } });
+            expect(first.context.positive.raw).toBe(a);
+            await cycle(b);
+            const second = await queueAgain(execution, first, { seed: 2 });
+            expect(second.cached).not.toContain(first.promptNode);
+            await cycle(a);
+            const third = await queueAgain(execution, first, { seed: 3 });
+            expect(third.cached, 'LRU kept A').toContain(first.promptNode);
+            expect((await runCounts(execution, first.context)).positive).toBe(2);
+            const bContext = await capturedContext(execution, second.id);
+            expect(bContext.positive.raw).toBe(b);
+            expect((await runCounts(execution, bContext)).positive).toBe(1);
+        } finally { await setCache(execution, 'RAM_PRESSURE'); }
+    });
+
+    test('typed text served from the cache still counts once per job', async ({ execution, page }) => {
+        test.setTimeout(90000);
+        await setCache(execution, 'RAM_PRESSURE');
+        const first = await firstRun(execution, page, { kind: 'PromptManager', positive: { typed: unique('Typed cached') } });
+        for (const seed of [2, 3]) expect((await queueAgain(execution, first, { seed })).cached).toContain(first.promptNode);
+        expect((await runCounts(execution, first.context)).positive).toBe(3);
+    });
+
+    test('a job failing downstream of a cached node counts it once; a job that does not need it, never', async ({ execution, page }) => {
+        test.setTimeout(90000);
+        await setCache(execution, 'RAM_PRESSURE');
+        const first = await firstRun(execution, page, linked());
+        const failing = await queueAgain(execution, first, { seed: 2, status: 'error', edit: output => {
+            output.pm_failure = { class_type: 'PMHistoryOutput', inputs: { value: [Object.keys(output).find(id => output[id].class_type === 'KSampler'), 0], mode: 'failure' } };
+        } });
+        expect(failing.cached).toContain(first.promptNode);
+        expect((await runCounts(execution, first.context)).positive).toBe(2);
+        // "Run selected output": only an unrelated output node; ComfyUI still reports the cached PromptManager node
+        const unrelated = await queueAgain(execution, first, { seed: 2, targets: ['pm_unrelated'], edit: output => {
+            output.pm_unrelated = { class_type: 'PMHistoryCached', inputs: { value: unique('unrelated') } };
+        } });
+        expect(unrelated.cached).toContain(first.promptNode);
+        expect((await runCounts(execution, first.context)).positive).toBe(2);
+    });
+
+    test('a cached node rewired to the negative input does not count the positive prompt', async ({ execution, page }) => {
+        test.setTimeout(90000);
+        await setCache(execution, 'RAM_PRESSURE');
+        const first = await firstRun(execution, page, linked());
+        const rewired = await queueAgain(execution, first, { seed: 2, edit: output => {
+            const sampler = Object.values(output).find(node => node.class_type === 'KSampler');
+            [sampler.inputs.positive, sampler.inputs.negative] = [sampler.inputs.negative, sampler.inputs.positive];
+        } });
+        expect(rewired.cached).toContain(first.promptNode);
+        expect((await runCounts(execution, first.context)).positive).toBe(1);
+        // The history capture of a cached job is unchanged: effective text from the cache, no stored-prompt hint
+        const cachedContext = await capturedContext(execution, (await queueAgain(execution, first, { seed: 3 })).id);
+        expect(cachedContext.positive.effective).toBe(first.context.positive.effective);
+        expect(cachedContext.positive_prompt_id).toBeNull();
+        expect((await runCounts(execution, first.context)).positive).toBe(2);
+    });
+});

tests/comfyui/fixtures/ledger_nodes.py

@@ -201,6 +201,39 @@ NODE_CLASS_MAPPINGS.update(
     {"PMHistoryImages": PMHistoryImages, "PMHistoryImageOutput": PMHistoryImageOutput}
 )
 
+# #347: text whose value (and cache signature) follows a value the test sets, so
+# one queued graph can serve A, then B, then A again (each cached under LRU).
+_CYCLED = {"value": "cycled"}
+
+
+class PMCycledText:
+    @classmethod
+    def INPUT_TYPES(cls) -> dict:
+        return {"required": {}}
+
+    RETURN_TYPES = ("STRING",)
+    FUNCTION = "execute"
+    CATEGORY = "testing/execution-history"
+
+    @classmethod
+    def IS_CHANGED(cls, **kwargs: object) -> str:
+        return _CYCLED["value"]
+
+    def execute(self) -> tuple:
+        return (_CYCLED["value"],)
+
+
+NODE_CLASS_MAPPINGS["PMCycledText"] = PMCycledText
+
+
+@PromptServer.instance.routes.post("/pm_execution_fixture/cycled")
+async def cycled_text(request: web.Request) -> web.Response:
+    value = (await request.json())["value"]
+    if type(value) is not str:
+        raise web.HTTPBadRequest()
+    _CYCLED["value"] = value
+    return web.json_response({"value": value})
+
 
 @PromptServer.instance.routes.post("/pm_execution_fixture/metadata")
 async def metadata(request: web.Request) -> web.Response:

tests/comfyui/image-attribution.spec.mjs

@@ -140,3 +140,26 @@ test('an output saved without metadata links once its recorded run names a store
         expect((await request.post('/pm_execution_fixture/metadata', { data: { disabled: false } })).ok()).toBe(true);
     }
 });
+
+// #332 on the real host: the migration ran at startup and the image category routes
+// set, list and remove an own category on a generated output.
+test('an output gets its own image category and loses it again', async ({ execution }, testInfo) => {
+    const request = execution.request;
+    const filename = await saved(request, graph({ text: `category host ${randomUUID()}`, prefix: 'pm332/category' }));
+    let image;
+    await expect.poll(async () => {
+        const listing = await (await request.get('/prompt_manager/images/output?mode=workspace&q=pm332&rescan=1')).json();
+        image = (listing.images || []).find(entry => entry.filename === filename || entry.path?.endsWith(`/${filename}`));
+        return Boolean(image);
+    }, { timeout: 20000, message: `${filename} is listed by Images` }).toBe(true);
+    const items = [{ root_index: image.root_index, root_scope: image.root_scope, path: image.path }];
+    const value = `PM332 host ${testInfo.project.name}`;
+    const set = await request.put('/prompt_manager/images/category', { data: { items, category: value } });
+    expect(set.status()).toBe(200);
+    expect(await set.json()).toEqual({ success: true, category: value, updated: 1, unchanged: 0, not_found: 0 });
+    expect((await (await request.get('/prompt_manager/images/categories')).json()).categories).toContain(value);
+    const cleared = await request.delete('/prompt_manager/images/category', { data: { items } });
+    expect(cleared.status()).toBe(200);
+    expect(await cleared.json()).toEqual({ success: true, cleared: 1 });
+    expect((await (await request.get('/prompt_manager/images/categories')).json()).categories).not.toContain(value);
+});

tests/comfyui/text-link.spec.mjs

@@ -370,6 +370,7 @@ test('workflows saved before #343 load unchanged and their linked text keeps wor
         const nodes = Object.fromEntries(app.graph._nodes.map(node => [node.id, node]));
         const reloaded = app.graph.serialize();
         return {
+            saves: Object.fromEntries(Object.entries(output).filter(([, node]) => node.class_type.startsWith('PromptManager')).map(([id, node]) => [id, node.inputs.save_to_library])),
             values: Object.fromEntries(reloaded.nodes.map(node => [node.id, node.widgets_values])),
             links: Object.fromEntries(Object.entries(output).map(([id, node]) => [id, { text: node.inputs.text, negative_text: node.inputs.negative_text }])),
             widgetBound: Object.fromEntries(Object.values(nodes).filter(node => node.type.startsWith('PromptManager')).map(node => [node.id, node.inputs.filter(input => ['text', 'negative_text'].includes(input.name) && input.widget).map(input => input.name)])),
@@ -377,8 +378,16 @@ test('workflows saved before #343 load unchanged and their linked text keeps wor
     }, workflow);
     for (const node of workflow.nodes) {
         // Every saved widget value comes back as it was saved, except the typed text main lost under a link (null).
-        if (node.widgets_values?.[0] !== null) expect(result.values[node.id], `${node.type} ${node.id}`).toEqual(node.widgets_values);
+        // #90: the last saved value is the editor's own slot (''), where the Save to library switch is now: it loads on.
+        if (node.widgets_values?.[0] === null) continue;
+        if (!node.type.startsWith('PromptManager')) { expect(result.values[node.id], `${node.type} ${node.id}`).toEqual(node.widgets_values); continue; }
+        const saved = node.widgets_values.length - 1;
+        expect(result.values[node.id].slice(0, saved), `${node.type} ${node.id}`).toEqual(node.widgets_values.slice(0, saved));
+        expect(result.values[node.id][saved], `${node.type} ${node.id} save_to_library`).toBe(true);
     }
+    // Every PromptManager node of the old workflow queues with Save to library on.
+    for (const save of Object.values(result.saves)) expect(save).toBe(true);
+    expect(Object.keys(result.saves).length).toBeGreaterThan(0);
     expect(result.links).toMatchObject({
         1: { text: 'Saved PromptManager text' }, 2: { text: 'Saved PromptManagerText text' }, 3: { text: 'Saved PromptManagerFocused text' },
         4: { text: 'Saved PromptManagerSplit text' }, 5: { text: 'Saved PromptManagerPair text', negative_text: 'Saved pair negative' },

tests/fixtures/legacy_contract_snapshot.json

@@ -2,6 +2,7 @@
   "routes": [
     "DELETE /prompt_manager/delete/{prompt_id}",
     "DELETE /prompt_manager/image-annotations/capture/{token}",
+    "DELETE /prompt_manager/images/category",
     "DELETE /prompt_manager/images/favorite",
     "DELETE /prompt_manager/images/{image_id}",
     "DELETE /prompt_manager/pairs/{pair_id}",
@@ -26,6 +27,7 @@
     "GET /prompt_manager/history/runs/{run_id}/outputs",
     "GET /prompt_manager/image-annotations/capture/{token}",
     "GET /prompt_manager/images/all",
+    "GET /prompt_manager/images/categories",
     "GET /prompt_manager/images/inspect/{image_path}",
     "GET /prompt_manager/images/output",
     "GET /prompt_manager/images/prompt/{image_path}",
@@ -156,6 +158,7 @@
     "POST /prompt_manager/vocabulary/tags",
     "POST /prompt_manager/vocabulary/tags/{tag_id}/delete",
     "PUT /prompt_manager/image-annotations/tags",
+    "PUT /prompt_manager/images/category",
     "PUT /prompt_manager/images/favorite",
     "PUT /prompt_manager/prompts/{prompt_id}",
     "PUT /prompt_manager/prompts/{prompt_id}/rating",

tests/js/gallery-settings.test.js

@@ -76,35 +76,101 @@ test("the workspace keys have their own defaults and validation", () => {
     assert.equal(normalizeGallerySettings({ defaultViewMode: "masonry" }).defaultViewMode, "grid");
 });
 
-test("a legacy gallery Save keeps the workspace keys and every other stored key", () => {
+// #330 S13: the legacy gallery's Page options edit only the page-only keys (PAGE_OPTION_KEYS); System › Appearance owns the rest, so a Save
+// or a Reset from the legacy page keeps every other stored key.
+function legacyGallery(stored, controls, extra = {}) {
     const fs = require("node:fs");
     const path = require("node:path");
     const vm = require("node:vm");
     const settings = require("../../web/js/gallery-settings.js");
-    const storage = new Map([["gallerySettings", JSON.stringify({ workspaceLayout: "masonry", workspaceDensity: "compact", someOtherTool: 1 })]]);
-    const controls = {
-        lazyLoadingToggle: { checked: true }, imageQualitySelect: { value: "high" }, defaultViewModeSelect: { value: "list" },
-        defaultLimitSelect: { value: "200" }, gridColumnsSelect: { value: "6" }, showImageInfoToggle: { checked: false },
-        autoLoadMetadataToggle: { checked: true }, cacheMetadataToggle: { checked: true }, showFilePathsToggle: { checked: false },
-        sidebarCollapsedByDefaultToggle: { checked: true }, infiniteScrollToggle: { checked: false }, debugModeToggle: { checked: false },
-        apiTimeoutInput: { value: "30" }, checkThumbnailsAtStartup: { checked: true }, videoAutoplayToggle: { checked: true },
-        videoMuteToggle: { checked: false }, videoLoopToggle: { checked: true },
-    };
+    const storage = new Map([["gallerySettings", JSON.stringify(stored)]]);
     const context = vm.createContext({
         document: { addEventListener() {}, getElementById: id => controls[id] },
         window: {}, console: { debug() {}, warn() {}, error() {} }, GallerySettings: settings,
-        localStorage: { getItem: key => storage.get(key) ?? null, setItem: (key, value) => storage.set(key, value) },
+        localStorage: { getItem: key => storage.get(key) ?? null, setItem: (key, value) => storage.set(key, value),
+            removeItem: key => storage.delete(key) },
+        ...extra,
     });
     const file = path.join(__dirname, "../../web/js/gallery.js");
     const Manager = vm.runInContext(`${fs.readFileSync(file, "utf8")}\nGalleryManager;`, context, { filename: file });
     const manager = Object.create(Manager.prototype);
-    Object.assign(manager, { showNotification() {}, hideSettings() {}, applySettings() {} });
+    const calls = [];
+    Object.assign(manager, { showNotification: (message, type) => calls.push([type, message]), hideSettings() {},
+        applySettings: applied => calls.push(["apply", applied.lazyLoading]) });
+    return { manager, storage, calls, saved: () => JSON.parse(storage.get("gallerySettings")) };
+}
+
+const PAGE_OPTION_CONTROLS = () => ({
+    checkThumbnailsAtStartup: { checked: false }, lazyLoadingToggle: { checked: false },
+    defaultLimitSelect: { value: "200" },
+    gridColumnsSelect: { value: "6" }, infiniteScrollToggle: { checked: true }, debugModeToggle: { checked: true },
+    apiTimeoutInput: { value: "45" },
+});
+
+test("a legacy gallery Save keeps the workspace keys and every other stored key", () => {
+    const { manager, saved } = legacyGallery({ workspaceLayout: "masonry", workspaceDensity: "compact", someOtherTool: 1,
+        imageQuality: "high", showImageInfo: false, videoMute: false, thumbnailPromptDismissed: "sig", defaultViewMode: "list" },
+        PAGE_OPTION_CONTROLS());
     manager.saveSettings();
-    const saved = JSON.parse(storage.get("gallerySettings"));
-    assert.equal(saved.workspaceLayout, "masonry");
-    assert.equal(saved.workspaceDensity, "compact");
-    assert.equal(saved.someOtherTool, 1);
-    assert.equal(saved.defaultViewMode, "list");
-    assert.equal(saved.showImageInfo, false);
-    assert.equal(saved.videoMute, false);
+    const result = saved();
+    assert.equal(result.workspaceLayout, "masonry");
+    assert.equal(result.workspaceDensity, "compact");
+    assert.equal(result.someOtherTool, 1);
+    assert.equal(result.imageQuality, "high");
+    assert.equal(result.showImageInfo, false);
+    assert.equal(result.videoMute, false);
+    assert.equal(result.thumbnailPromptDismissed, "sig");
+    // Page options no longer edit the default view (S13 G5), so a stored one stays.
+    assert.equal(result.defaultViewMode, "list");
+    // The page-only keys come from the dialog.
+    assert.equal(result.lazyLoading, false);
+    assert.equal(result.debugMode, true);
+    assert.equal(result.checkThumbnailsAtStartup, false);
+    assert.equal(result.defaultLimit, 200);
+    assert.equal(result.gridColumns, 6);
+    assert.equal(result.infiniteScroll, true);
+    assert.equal(result.apiTimeout, 45);
+});
+
+test("a legacy gallery Reset restores only the page options and keeps every other stored key", () => {
+    const controls = PAGE_OPTION_CONTROLS();
+    const { manager, saved, calls } = legacyGallery({ workspaceLayout: "masonry", imageQuality: "high", videoMute: false,
+        thumbnailPromptDismissed: "sig", thumbnailsGenerated: true, lazyLoading: false, debugMode: true, defaultLimit: 200,
+        gridColumns: 6, infiniteScroll: true, apiTimeout: 45, checkThumbnailsAtStartup: false, defaultViewMode: "list" }, controls,
+    { confirm: message => (calls.push(["confirm", message]), true) });
+    manager.resetSettings();
+    const result = saved();
+    const { DEFAULT_SETTINGS } = require("../../web/js/gallery-settings.js");
+    for (const key of ["checkThumbnailsAtStartup", "lazyLoading", "defaultLimit", "gridColumns",
+        "infiniteScroll", "debugMode", "apiTimeout"]) {
+        assert.equal(result[key], DEFAULT_SETTINGS[key], key);
+    }
+    // The default view is not a page option (S13 G5): Reset keeps a stored one.
+    assert.equal(result.defaultViewMode, "list");
+    assert.equal(result.workspaceLayout, "masonry");
+    assert.equal(result.imageQuality, "high");
+    assert.equal(result.videoMute, false);
+    assert.equal(result.thumbnailPromptDismissed, "sig");
+    assert.equal(result.thumbnailsGenerated, true);
+    // The dialog shows the defaults again and the page applies them.
+    assert.equal(controls.lazyLoadingToggle.checked, DEFAULT_SETTINGS.lazyLoading);
+    assert.equal(controls.apiTimeoutInput.value, DEFAULT_SETTINGS.apiTimeout);
+    assert.deepEqual(calls, [["confirm", "Reset these page options to their defaults?"], ["apply", DEFAULT_SETTINGS.lazyLoading],
+        ["success", "Page options reset to defaults"]]);
+});
+
+test("Page options no longer hold the default view; System › Appearance's Default layout is the one control", () => {
+    const { manager } = legacyGallery({}, {});
+    assert.deepEqual([...manager.constructor.PAGE_OPTION_KEYS], ["checkThumbnailsAtStartup", "lazyLoading", "defaultLimit",
+        "gridColumns", "infiniteScroll", "debugMode", "apiTimeout"]);
+});
+
+test("a viewer mute or loop click remembers only that key and never reads the Page options dialog", () => {
+    const { manager, saved, calls } = legacyGallery({ defaultLimit: 200, lazyLoading: false, videoMute: true }, {});
+    manager.storeSetting("videoMute", false);
+    const result = saved();
+    assert.equal(result.videoMute, false);
+    assert.equal(result.defaultLimit, 200);
+    assert.equal(result.lazyLoading, false);
+    assert.deepEqual(calls, []);
 });

tests/js/gallery-thumbnails.test.js

@@ -112,11 +112,12 @@ test('saving gallery settings retains the remembered thumbnail dismissal', () =>
 });
 
 // #249 System S5: the stream's work is now an Activity job that outlives the page's connection, so the gallery's
-// Cancel asks the server to stop the job. The stream's first frame, `job {id, started}`, names the job; the gallery
+// Cancel asks the server to stop the job. Since #330 the startup dialog is the gallery's only thumbnail stream (System
+// › Sources & scans generates the rest). The stream's first frame, `job {id, started}`, names the job; the gallery
 // cancels by that id, only a job this stream started, and a Cancel before the id waits for it (review I1).
 const JOB = 'b'.repeat(32);
 
-function streamFixture({ modal = false, postFails = false } = {}) {
+function streamFixture({ postFails = false } = {}) {
     const posts = [];
     const warnings = [];
     const gets = [];
@@ -146,18 +147,20 @@ function streamFixture({ modal = false, postFails = false } = {}) {
                 return { success: true };
             } } });
     const emit = (type, data) => (listeners[type] || []).forEach(handler => handler({ data: JSON.stringify(data) }));
+    // The dialog's Cancel runs the handler and from then on reads as cancelled, as the startup dialog does.
+    let cancelled = false;
     const ui = { addStatusMessage() {}, progressText: element(), progressPercent: element(), progressBar: element(),
-        progressDetails: element(), progressETA: element(), isCancelled: () => false,
-        onCancel: handler => { ui.cancel = handler; } };
-    const result = modal ? manager.generateThumbnailsWithProgressInModal(ui)
-        : manager.generateThumbnailsWithProgress({ quality: 'medium' });
+        progressDetails: element(), progressETA: element(), isCancelled: () => cancelled,
+        onCancel: handler => { ui.cancel = () => { cancelled = true; handler(); }; } };
+    const result = manager.generateThumbnailsWithProgressInModal(ui);
     const outcome = result.then(value => ({ value }), error => ({ error: error.message }));
-    const cancel = () => (modal ? ui.cancel() : elements.cancelThumbnailsBtn.click());
+    const cancel = () => ui.cancel();
     const settle = () => new Promise(resolve => setImmediate(resolve));
     return { emit, source, posts, gets, warnings, outcome, cancel, settle };
 }
 
 const cancelUrl = id => `/prompt_manager/jobs/${id}/cancel`;
+const CANCELLED = 'Thumbnail generation cancelled; previews already written are kept';
 
 test('Cancel before the job id arrives cancels that job once it does', async () => {
     const f = streamFixture();
@@ -165,8 +168,8 @@ test('Cancel before the job id arrives cancels that job once it does', async ()
     await f.settle();
     assert.deepEqual(f.posts, []);
     assert.equal(f.source.closed, 0); // kept open until the stream names its job
-    assert.deepEqual(await f.outcome, { error: 'Thumbnail generation cancelled by user' });
-    f.emit('status', { phase: 'scanning', message: 'Scanning…' });
+    assert.deepEqual(await f.outcome, { error: CANCELLED });
+    // The job frame is the stream's first (the dialog closes the stream on any later frame once cancelled).
     f.emit('job', { id: JOB, started: true });
     await f.settle();
     assert.equal(JSON.stringify(f.posts), JSON.stringify([[cancelUrl(JOB), {}]]));
@@ -185,7 +188,7 @@ test('Cancel after the id cancels it at once, and a double Cancel posts once', a
     await f.settle();
     assert.equal(JSON.stringify(f.posts), JSON.stringify([[cancelUrl(JOB), {}]]));
     assert.equal(f.source.closed, 1);
-    assert.deepEqual(await f.outcome, { error: 'Thumbnail generation cancelled by user' });
+    assert.deepEqual(await f.outcome, { error: CANCELLED });
     assert.deepEqual(f.gets, []);
 });
 
@@ -216,11 +219,11 @@ test('a cancel post that fails is reported, not thrown', async () => {
     await f.settle();
     assert.equal(f.posts.length, 1);
     assert.equal(f.warnings.length, 1);
-    assert.deepEqual(await f.outcome, { error: 'Thumbnail generation cancelled by user' });
+    assert.deepEqual(await f.outcome, { error: CANCELLED });
 });
 
 test('the startup dialog cancels its own job by id too', async () => {
-    const f = streamFixture({ modal: true });
+    const f = streamFixture();
     f.cancel();
     await f.settle();
     assert.deepEqual(f.posts, []);

tests/js/legacy-refusals.test.js

@@ -65,109 +65,12 @@ function load(file, className, fetchUrl, extra = {}, dom = elements()) {
 
 const BUSY = 'Scan for metadata already running';
 
-test('gallery cache clear reports a refused server clear and never claims success', async () => {
-    const calls = [];
-    const { page, dom, notifications, storage } = load('gallery.js', 'GalleryManager', async url => {
-        calls.push(url);
-        return jsonResponse(409, { success: false, error: BUSY });
-    });
-    page.getSettings = () => ({ thumbnailsGenerated: true });
-    dom.getElementById('thumbnailStatus').textContent = 'Generated';
-
-    await page.clearCache();
-
-    assert.deepEqual(calls, ['/prompt_manager/images/clear-thumbnails']);
-    assert.deepEqual(notifications, [['error', `Thumbnails were not cleared: ${BUSY}`]]);
-    assert.equal(dom.nodes.thumbnailStatus.textContent, 'Generated');
-    assert.equal(storage.get('gallerySettings'), undefined); // thumbnailsGenerated is not reset
-});
-
-test('gallery cache clear says what it cleared and keeps preferences and other data (#222)', async () => {
-    const calls = [];
-    const { page, dom, notifications, storage } = load('gallery.js', 'GalleryManager', async url => {
-        calls.push(url);
-        return jsonResponse(200, { success: true, cleared_count: 3 });
-    });
-    page.getSettings = () => ({ thumbnailsGenerated: true });
-
-    await page.clearCache();
-
-    // The server's thumbnails are cleared by their own explicit call; nothing Prompt Manager owns is cached in this
-    // browser, so no browser entry is removed and the toast says exactly that.
-    assert.deepEqual(calls, ['/prompt_manager/images/clear-thumbnails']);
-    assert.deepEqual(notifications, [['success',
-        "Thumbnails cleared; original images untouched. Nothing of Prompt Manager's is cached in this browser."]]);
-    assert.equal(dom.nodes.thumbnailStatus.textContent, 'Not generated');
-    assert.equal(JSON.parse(storage.get('gallerySettings')).thumbnailsGenerated, false);
-    assert.equal(storage.get('userData'), 'keep');
-    assert.equal(storage.get('pm_cached'), '1');
-    assert.equal(storage.get('pm_workspace_theme'), 'light');
-    assert.equal(storage.get('pm_update_notice_dismissed'), '3.3.0');
-});
-
-test("gallery cache clear never deletes another tool's gallery or thumbnail caches (#222)", async () => {
-    const names = new Set(['comfy-gallery', 'thumbnail-cache']);
-    const caches = { keys: async () => [...names], delete: async name => names.delete(name) };
-    const { page, notifications } = load('gallery.js', 'GalleryManager',
-        async () => jsonResponse(200, { success: true }), { caches, window: { caches } });
-    page.getSettings = () => ({});
-
-    await page.clearCache();
-
-    assert.deepEqual([...names], ['comfy-gallery', 'thumbnail-cache']);
-    assert.equal(notifications.at(-1)[0], 'success');
-});
-
-test('gallery cache clear reports a lost server clear instead of success', async () => {
-    const { page, dom, notifications, storage } = load('gallery.js', 'GalleryManager', async () => {
-        throw new TypeError('Failed to fetch');
-    });
-    page.getSettings = () => ({ thumbnailsGenerated: true });
-    dom.getElementById('thumbnailStatus').textContent = 'Generated';
-
-    await page.clearCache();
-
-    assert.deepEqual(notifications, [['error', 'Thumbnails were not cleared: the server could not be reached.']]);
-    assert.equal(dom.nodes.thumbnailStatus.textContent, 'Generated');
-    assert.equal(storage.get('gallerySettings'), undefined);
-});
-
-test('gallery cache clear says so when browser storage is denied', async () => {
-    const denied = { get length() { throw new Error('SecurityError'); }, key() { throw new Error('SecurityError'); },
-        getItem() { throw new Error('SecurityError'); }, setItem() { throw new Error('SecurityError'); },
-        removeItem() { throw new Error('SecurityError'); } };
-    const { page, notifications } = load('gallery.js', 'GalleryManager',
-        async () => jsonResponse(200, { success: true }), { localStorage: denied });
-    page.getSettings = () => ({});
-
-    await page.clearCache();
-
-    assert.deepEqual(notifications, [['warning',
-        'Thumbnails cleared; original images untouched. This browser refused access to its storage, so nothing there was cleared.']]);
-});
-
-test('admin LoRA import shows a refusal frame and closes its modal', async () => {
-    const { page, dom, timers, notifications } = load('admin.js', 'PromptAdmin',
-        async () => sseResponse([{ type: 'error', status: BUSY, progress: 0, message: BUSY }]));
-    page.saveLoraSettings = async () => true;
-    page.loadStatistics = () => assert.fail('a refused import must not reload statistics');
-
-    await page.runLoraImport();
-
-    assert.equal(dom.nodes.loraImportStatus.textContent, `Error: ${BUSY}`);
-    assert.deepEqual(notifications.filter(([type]) => type === 'error'), [['error', `LoRA import failed: ${BUSY}`]]);
-    assert.equal(timers.length, 1);
-    timers[0]();
-    assert.deepEqual(notifications.at(-1), ['hide', 'loraImportModal']);
-});
-
 test('admin settings save shows why config.json refused it', async () => {
     const message = 'config.json cannot be read, so nothing was saved. Fix or remove the file, then save again.';
     const { page, notifications } = load('admin.js', 'PromptAdmin',
         async () => jsonResponse(409, { success: false, persisted: false, code: 'config-unreadable', error: message }));
     page.settings = {};
-    page._collectScanPaths = () => [];
-    page.saveLoraSettings = async () => assert.fail('nothing else is saved after a refusal');
+    page.setInfiniteScroll = () => assert.fail('nothing changes after a refusal');
 
     await page.saveSettings();
 
@@ -178,27 +81,30 @@ test('admin settings save keeps its plain message when the reply has no reason',
     const { page, notifications } = load('admin.js', 'PromptAdmin', async () => ({ ok: false, status: 500,
         json: async () => { throw new SyntaxError('not json'); } }));
     page.settings = {};
-    page._collectScanPaths = () => [];
 
     await page.saveSettings();
 
     assert.deepEqual(notifications, [['error', 'Failed to save settings']]);
 });
 
-test('admin maintenance names the job that refused it', async () => {
-    const { page, dom, notifications } = load('admin.js', 'PromptAdmin',
-        async () => jsonResponse(409, { success: false, error: BUSY }), {
-            escapeHtml: text => String(text),
-            document: { readyState: 'loading', addEventListener() {}, getElementById: id => dom.getElementById(id),
-                querySelectorAll: selector => (selector === '.maintenance-option:checked' ? [{ id: 'vacuum' }] : []) },
-        });
+// #330 S13-9: the admin page's reduced Page options save sends only the list's scroll default, so a stale legacy form
+// can no longer overwrite scan folders or other settings edited in System.
+test('admin Page options save posts only infinite_scroll', async () => {
+    const sent = [];
+    const { page, dom, notifications } = load('admin.js', 'PromptAdmin', async (url, init) => {
+        sent.push([url, init.method, JSON.parse(init.body)]);
+        return jsonResponse(200, { success: true, restart_required: true });
+    });
+    page.settings = { infiniteScroll: false };
+    const scrolled = [];
+    page.setInfiniteScroll = (on, options) => scrolled.push([on, { ...options }]);
+    dom.getElementById('infiniteScrollDefault').checked = true;
 
-    await page.runMaintenance();
+    await page.saveSettings();
 
-    const results = dom.nodes.maintenanceResults.innerHTML;
-    assert.match(results, /Maintenance Failed/);
-    assert.match(results, new RegExp(BUSY));
-    assert.doesNotMatch(results, /HTTP 409/);
-    assert.deepEqual(notifications, [['error', '❌ Maintenance failed']]);
-    assert.equal(dom.nodes.runMaintenanceBtn.disabled, false);
+    assert.deepEqual(sent, [['/prompt_manager/settings', 'POST', { infinite_scroll: true }]]);
+    assert.deepEqual(scrolled, [[true, { session: false }]]);
+    assert.equal(page.settings.infiniteScroll, true);
+    assert.deepEqual(notifications, [['success', 'Page options saved'], ['hide', 'settingsModal']]);
 });
+

tests/js/save-to-library.test.js

@@ -0,0 +1,68 @@
+// #90: the node's save_to_library switch (web/js/save-to-library.js).
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const source = import('../../web/js/save-to-library.js');
+
+function classicNode(saved) {
+    const names = ['text', 'category', 'tags', 'search_text', 'prepend_text', 'append_text', 'save_to_library', 'prompt_manager_search_ui'];
+    const widgets = names.map(name => ({name, value: name === 'save_to_library' ? true : ''}));
+    const node = {widgets, widgets_values: saved ? [...saved] : undefined};
+    // What a host configure does: each saved value goes to the widget at its index.
+    (saved || []).forEach((value, index) => { if (widgets[index]) widgets[index].value = value; });
+    return node;
+}
+
+test('an older workflow stored the editor slot where the switch is now: it loads on', async () => {
+    const {normalizeSaveWidget, savesToLibrary} = await source;
+    const node = classicNode(['a cat', 'c', 't', '', '', '', '']);
+    assert.equal(node.widgets[6].value, '', 'the host put the old DOM slot value into the switch');
+    assert.equal(normalizeSaveWidget(node), true);
+    assert.equal(node.widgets[6].value, true);
+    assert.equal(node.widgets_values[6], true);
+    assert.equal(savesToLibrary(node), true);
+    assert.deepEqual(node.widgets_values.slice(0, 6), ['a cat', 'c', 't', '', '', ''], 'no earlier value moved');
+});
+
+test('null, undefined and missing slots load on; saved booleans are kept', async () => {
+    const {normalizeSaveWidget, savesToLibrary} = await source;
+    for (const value of [null, undefined, 0, 'false']) {
+        const node = classicNode(['a', '', '', '', '', '', value]);
+        normalizeSaveWidget(node);
+        assert.equal(savesToLibrary(node), true, String(value));
+    }
+    const short = classicNode(['a', '', '', '', '', '']);
+    assert.equal(normalizeSaveWidget(short), false);
+    assert.equal(savesToLibrary(short), true);
+    const off = classicNode(['a', '', '', '', '', '', false]);
+    assert.equal(normalizeSaveWidget(off), false);
+    assert.equal(savesToLibrary(off), false);
+});
+
+test('a node without the widget (an older backend) saves', async () => {
+    const {normalizeSaveWidget, savesToLibrary} = await source;
+    assert.equal(savesToLibrary({widgets: [{name: 'text', value: ''}]}), true);
+    assert.equal(normalizeSaveWidget({widgets: []}), false);
+    assert.equal(savesToLibrary(undefined), true);
+});
+
+test('the switch moves after the editor fallbacks so every frontend has one order', async () => {
+    const {placeSaveWidgetLast} = await source;
+    const widgets = ['text', 'category', 'tags', 'search_text', 'save_to_library', 'prepend_text', 'append_text'].map(name => ({name}));
+    const node = {widgets};
+    assert.equal(placeSaveWidgetLast(node), true);
+    assert.deepEqual(node.widgets.map(widget => widget.name), ['text', 'category', 'tags', 'search_text', 'prepend_text', 'append_text', 'save_to_library']);
+    assert.equal(placeSaveWidgetLast(node), false, 'already last');
+    assert.equal(placeSaveWidgetLast({widgets: [{name: 'text'}]}), false);
+});
+
+test('setting the switch updates the widget, its saved value and notifies the host', async () => {
+    const {setSaveToLibrary, savesToLibrary} = await source;
+    const calls = [];
+    const node = classicNode(['a', '', '', '', '', '', true]);
+    node.widgets[6].callback = value => calls.push(value);
+    setSaveToLibrary(node, false);
+    assert.equal(savesToLibrary(node), false);
+    assert.equal(node.widgets_values[6], false);
+    assert.deepEqual(calls, [false]);
+    setSaveToLibrary({widgets: []}, false);
+});

tests/js/workspace-file-inspector.test.js

@@ -185,6 +185,26 @@ test('legacy fill applies to local records', async () => {
     assert.notEqual(zeroed.prompts.positive.text, '');
 });
 
+test('a branch named by recorded run history shows the Recorded run badge', async () => {
+    // #386: the server labels sides whose save node recorded history named; Execution recorded stays stronger.
+    const base = await localRecord(new File([fs.readFileSync(new URL('f09.png', PARITY))], 'f09.png'));
+    const recorded = {...base, prompts:{positive:{...base.prompts.positive, source:'recorded-run'}, negative:{...base.prompts.negative, source:'recorded-run'}}};
+    let view = renderFull(recorded);
+    try {
+        assert.deepEqual(view.texts(n => n.className === 'chip blue'), ['Recorded run']);
+        assert.ok(view.texts(n => n.tagName === 'p').includes('Prompt evidence: recorded run'));
+    } finally { view.done(); }
+    view = renderFull({...recorded, prompts:{...recorded.prompts, negative:{...recorded.prompts.negative, source:'execution'}}});
+    try {
+        assert.deepEqual(view.texts(n => n.className === 'chip blue'), ['Execution recorded']);
+    } finally { view.done(); }
+    // A recorded branch whose negative left out a run-time part is still inferred from the workflow.
+    view = renderFull({...recorded, prompts:{...recorded.prompts, negative:{...recorded.prompts.negative, source:'runtime-parts-omitted'}}});
+    try {
+        assert.deepEqual(view.texts(n => n.className === 'chip blue'), ['Workflow inferred']);
+    } finally { view.done(); }
+});
+
 // #249 PR C Task C3 (D88): one chip row, the file's current image tags first, then D21's linked tags not already shown.
 function tagged(imageTags, library = {status:'linked', tags:['Minimal', 'warm_light', 'editorial'], tags_scope:'positive'}) {
     return {...record(), imageTags, library};
@@ -363,3 +383,32 @@ test('the D117 wrap rule targets only the settings summary button', async () =>
     assert.deepEqual(rules.map(line => line.trim()), ['.ca-tools #viewer-details .settings-summary { white-space: normal; /* D117 */ }']);
     assert.doesNotMatch(css, /#viewer-details > div > button/);
 });
+
+test('category chip names its origin and shows an own category for any link status (#332)', async () => {
+    const base = await localRecord(localPng('a.png'));
+    const chipTexts = record => {
+        const {f, done} = renderFull(record);
+        try {
+            return f.walk(f.container, n => /(^| )chip( |$)/.test(n.className ?? '')).map(n => n.textContent);
+        } finally { done(); }
+    };
+    const cases = [
+        [{status:'none', category:'Scans', category_scope:'image'}, 'Image category: Scans'],
+        [{status:'ambiguous', category:'Scans', category_scope:'image'}, 'Image category: Scans'],
+        [{status:'linked', category:'Portraits', category_scope:'image'}, 'Image category: Portraits'],
+        [{status:'linked', category:'Landscapes', category_scope:'positive'}, 'Positive prompt category: Landscapes'],
+        [{status:'linked', category:'Recipes', category_scope:'pair'}, 'Recipe category: Recipes'],
+    ];
+    for (const [library, text] of cases) {
+        const chips = chipTexts({...base, library:{...base.library, tags:[], tags_scope:null, ...library}});
+        assert.ok(chips.includes(text), `${JSON.stringify(library)} -> ${chips}`);
+    }
+    for (const library of [
+        {status:'none', category:'Inherited', category_scope:'positive'},
+        {status:'linked', category:null, category_scope:null},
+        {status:'none', category:null, category_scope:null},
+    ]) {
+        const chips = chipTexts({...base, library:{...base.library, tags:[], tags_scope:null, ...library}});
+        assert.equal(chips.some(chip => /category: /.test(chip)), false, JSON.stringify(library));
+    }
+});

tests/js/workspace-inspection-state.test.js

@@ -278,6 +278,7 @@ test('record rejects root path media and invalid versioned fields with retryable
         data => { data.resolution.sampler_id = {}; },
         data => { data.library.tags_scope = 'recipe'; },
         data => { data.library.category_scope = 'recipe'; },
+        data => { data.library.tags_scope = 'image'; },
         data => { delete data.library.category_scope; },
         data => { delete data.library.tags_scope; },
     ]) {
@@ -942,3 +943,14 @@ test("names the server quotes (parentheses, '!*') still match their original and
     assert.equal(record.download.url, entry.url);
     assert.deepEqual(record.preview, { url: entry.thumbnail_url });
 });
+
+test('record accepts an image\'s own category on any link status (#332)', () => {
+    const toRecord = contract('toInspectionRecord');
+    for (const status of ['linked', 'none', 'ambiguous', 'unavailable']) {
+        const data = envelope();
+        Object.assign(data.library, { status, category: 'Scans', category_scope: 'image' });
+        const record = toRecord(data, image(), extractGenerationFacts);
+        assert.equal(record.library.category, 'Scans');
+        assert.equal(record.library.category_scope, 'image');
+    }
+});

tests/test_api_admin.py

@@ -2205,24 +2205,30 @@ class TestOutputScanInternals(AdminAPITestCase):
         self.assertEqual(self.api._ingest_scanned_file(f, meta), "unchanged")
 
     def test_ingest_link_failures_are_tolerated(self):
+        """A failed link rolls the new prompt back: found, nothing left behind."""
         f = Path("gen.png")
         meta = {"prompt": json.dumps(_wired_prompt("a dog"))}
-        self.api.db.link_image_to_prompt = _raise
-        self.assertEqual(self.api._ingest_scanned_file(f, meta), "added")
-        self.assertEqual(self.api._ingest_scanned_file(f, meta), "found")
+        self.api.db._insert_image_link = _raise
+        with self.assertLogs("prompt_manager.database.scanned_prompts", "ERROR"):
+            self.assertEqual(self.api._ingest_scanned_file(f, meta), "found")
+            self.assertEqual(self.api._ingest_scanned_file(f, meta), "found")
+        self.assertEqual(self.api.db.get_recent_prompts()["prompts"], [])
 
     def test_ingest_save_failure_counts_as_found(self):
         f = Path("gen.png")
         meta = {"prompt": json.dumps(_wired_prompt("a bird"))}
-        self.api.db.save_prompt = lambda *a, **k: None
-        self.assertEqual(self.api._ingest_scanned_file(f, meta), "found")
+        with patch(
+            "py.api.admin.store_scanned_prompt", return_value=("found", None)
+        ) as store:
+            self.assertEqual(self.api._ingest_scanned_file(f, meta), "found")
+        self.assertEqual(store.call_args.args[3], "a bird")
 
     def test_batch_counts_and_per_file_errors(self):
         meta = {"prompt": json.dumps(_wired_prompt("a fish"))}
-        self.api.db.get_prompt_by_hash = _raise
-        counts = self.api._ingest_scan_batch_sync(
-            [(Path("a.png"), meta), (Path("b.png"), {})]
-        )
+        with patch("py.api.admin.store_scanned_prompt", side_effect=_raise):
+            counts = self.api._ingest_scan_batch_sync(
+                [(Path("a.png"), meta), (Path("b.png"), {})]
+            )
         self.assertEqual(
             counts,
             {

tests/test_api_backup_restore.py

@@ -264,6 +264,41 @@ class TestRestoreRoute(BackupRestoreTestCase):
         texts = sorted(p["text"] for p in self.api.db.search_prompts())
         self.assertEqual(texts, ["restored a", "restored b"])
 
+    async def test_restore_round_trip_keeps_tags_and_image_links(self):
+        """A downloaded backup brings back every prompt with its tags and images.
+
+        The legacy admin page's Restore form left for System (#330); this keeps
+        its browser test's data check at the route.
+        """
+        db = self.api.db
+        originals = {}
+        for text, tags, image in (
+            ("round trip cat", ["cats", "pets"], "cat.png"),
+            ("round trip dog", ["dogs"], "dog.png"),
+        ):
+            prompt_id = db.save_prompt(
+                text=text, tags=tags, prompt_hash=generate_prompt_hash(text)
+            )
+            path = self._write(image, b"\x89PNG\r\n\x1a\n")
+            self.assertTrue(db.link_image_to_prompt(str(prompt_id), path))
+            originals[text] = (prompt_id, sorted(tags), [path])
+
+        resp = await self.client.get("/prompt_manager/backup")
+        self.assertEqual(resp.status, 200)
+        backup = self._write("downloaded.db", await resp.read())
+        self.assertTrue(db.delete_prompt(originals["round trip dog"][0]))
+
+        resp = await self._restore(backup)
+        self.assertEqual(resp.status, 200, await resp.text())
+
+        restored = {p["text"]: p for p in self.api.db.search_prompts()}
+        self.assertEqual(sorted(restored), sorted(originals))
+        for text, (prompt_id, tags, paths) in originals.items():
+            self.assertEqual(restored[text]["id"], prompt_id)
+            self.assertEqual(sorted(restored[text]["tags"]), tags)
+            images = self.api.db.get_prompt_images(str(prompt_id))
+            self.assertEqual([image["image_path"] for image in images], paths)
+
     async def test_restore_leaves_no_temp_files_behind(self):
         upload = self._make_db_file(["restored"])
         created = []

tests/test_api_history_outputs.py

@@ -21,6 +21,8 @@ from tests.test_api_images import ImageAPITestCase, make_png
 from tests.test_api_prompt_inspector import graph, png
 from tests.test_execution_context_database import bundle as context_bundle
 from tests.test_execution_history_database import JOB, SESSION
+from tests.saver_anchor_graphs import BRANCH_TEXTS, shared_prefix
+from tests.test_recorded_saver_anchor import LLM_TEXT, text_generate_run
 from utils.execution_contexts import ContextBundle
 from utils.execution_history_events import make_finish, make_start
 from utils.execution_outputs import OutputBundle, OutputReference, snapshot_output_roots
@@ -1505,3 +1507,88 @@ class HistoryOutputAPITests(ImageAPITestCase):
         body = await response.json()
         self.assertEqual(response.status, 200, body)
         self.assertEqual(body["prompts"]["positive"]["text"], "Readable portrait")
+
+    async def recorded_shared_prefix_run(self):
+        """#386: the dataset shape, branch 3's saver wrote the file in a run."""
+        path = png(self.output_dir / "IMG_GEN_00371_.png", prompt=shared_prefix())
+        # make_start/make_finish observe the run at 0 ms: the file was written then.
+        os.utime(path, ns=(1_000_000, 1_000_000))
+        start = self.capture(
+            [self.ref(node="33", filename=path.name), self.ref("43", 1, "other.png")]
+        )
+        return start
+
+    async def test_both_inspect_routes_name_the_branch_recorded_history_saved(self):
+        start = await self.recorded_shared_prefix_run()
+        _, body = await self.outputs(start)
+        descriptor = next(
+            item["current_candidate"]["media"]
+            for item in body["items"]
+            if item["occurrence"]["output_node_id"] == "33"
+        )
+        response = await self.current(descriptor["inspection_url"])
+        recorded = await response.json()
+        self.assertEqual(response.status, 200, recorded)
+        response = await self.client.get(
+            "/prompt_manager/images/inspect/IMG_GEN_00371_.png", params={"root": "0"}
+        )
+        images = await response.json()
+        self.assertEqual(response.status, 200, images)
+        for result in (recorded, images):
+            self.assertEqual(result["resolution"]["state"], "resolved")
+            self.assertEqual(
+                result["prompts"]["positive"],
+                {
+                    "status": "resolved",
+                    "text": BRANCH_TEXTS[2],
+                    "source": "recorded-run",
+                },
+            )
+
+    async def test_a_file_rewritten_after_its_run_keeps_several_prompts(self):
+        await self.recorded_shared_prefix_run()
+        os.utime(self.output_dir / "IMG_GEN_00371_.png")  # written now: not that run
+        response = await self.client.get(
+            "/prompt_manager/images/inspect/IMG_GEN_00371_.png", params={"root": "0"}
+        )
+        body = await response.json()
+        self.assertEqual(response.status, 200, body)
+        self.assertEqual(body["resolution"]["state"], "ambiguous")
+        self.assertEqual(body["prompts"]["positive"]["status"], "ambiguous")
+
+    async def test_a_failing_history_lookup_judges_the_file_alone(self):
+        await self.recorded_shared_prefix_run()
+        with (
+            patch(
+                "database.run_attribution.recorded_output",
+                side_effect=sqlite3.OperationalError("locked"),
+            ),
+            self.assertLogs("prompt_manager.run_attribution", "WARNING"),
+        ):
+            response = await self.client.get(
+                "/prompt_manager/images/inspect/IMG_GEN_00371_.png",
+                params={"root": "0"},
+            )
+            body = await response.json()
+        self.assertEqual(response.status, 200, body)
+        self.assertEqual(body["resolution"]["state"], "ambiguous")
+
+    async def test_a_language_model_text_shows_what_promptmanager_recorded(self):
+        path = png(self.output_dir / "moss_00026_.png", prompt=text_generate_run())
+        os.utime(path, ns=(1_000_000, 1_000_000))
+        start = self.capture([self.ref(node="9", filename=path.name)])
+        self.api.db.write_execution_contexts(
+            start.run_id,
+            start.storage_epoch,
+            context_bundle("", LLM_TEXT, anchor="7"),
+        )
+        response = await self.client.get(
+            "/prompt_manager/images/inspect/moss_00026_.png", params={"root": "0"}
+        )
+        body = await response.json()
+        self.assertEqual(response.status, 200, body)
+        self.assertEqual(
+            body["prompts"]["positive"],
+            {"status": "resolved", "text": LLM_TEXT, "source": "execution"},
+        )
+        self.assertEqual(body["prompts"]["negative"]["text"], "")

tests/test_api_image_categories.py

@@ -0,0 +1,375 @@
+"""Image category routes (#332): PUT/DELETE /images/category, GET /images/categories."""
+
+import json
+import ntpath
+import sqlite3
+from unittest.mock import patch
+
+try:
+    from test_api_images import ImageAPITestCase, make_png
+    from open_handles import assert_closed
+    from test_image_categories import category_checksum
+except ImportError:
+    from tests.test_api_images import ImageAPITestCase, make_png
+    from tests.open_handles import assert_closed
+    from tests.test_image_categories import category_checksum
+
+from database.image_categories import MAX_KEY_LENGTH, TABLE
+from py.api.images import _favorite_root_key, image_category_key
+
+CATEGORY = "/prompt_manager/images/category"
+CATEGORIES = "/prompt_manager/images/categories"
+
+
+class ImageCategoryTestCase(ImageAPITestCase):
+    async def tearDownAsync(self):
+        self.api.db.close_all()
+        assert_closed(self, self._temp_db.name, self._output_tmp.name)
+        await super().tearDownAsync()
+
+    def target(self, path, index=0):
+        roots = self.api._get_all_output_dirs()
+        return {
+            "root_index": index,
+            "root_scope": self.api._gallery_root_scope(roots[index], index),
+            "path": path,
+        }
+
+    async def send(self, method, body, status=200):
+        response = await self.client.request(method, CATEGORY, json=body)
+        text = await response.text()
+        self.assertEqual(response.status, status, text)
+        return json.loads(text)
+
+    async def put(self, paths, category, status=200):
+        items = [p if isinstance(p, dict) else self.target(p) for p in paths]
+        return await self.send("PUT", {"items": items, "category": category}, status)
+
+    async def delete(self, paths, status=200):
+        items = [p if isinstance(p, dict) else self.target(p) for p in paths]
+        return await self.send("DELETE", {"items": items}, status)
+
+    async def listed(self, status=200):
+        response = await self.client.get(CATEGORIES)
+        text = await response.text()
+        self.assertEqual(response.status, status, text)
+        return json.loads(text)
+
+    def rows(self):
+        return [
+            tuple(row)
+            for row in self.api.db.model.get_connection().execute(
+                f"SELECT root_key, relative_path, category FROM {TABLE} "
+                "ORDER BY root_key, relative_path"
+            )
+        ]
+
+    def key(self, relative, root=None):
+        roots = self.api._get_all_output_dirs()
+        return image_category_key(roots, (root or self.output_dir) / relative)
+
+
+class TestSetAndClear(ImageCategoryTestCase):
+    async def test_put_sets_listed_and_counts_missing(self):
+        make_png(self.output_dir / "a.png")
+        make_png(self.output_dir / "sub" / "b.png")
+        data = await self.put(["a.png", "sub/b.png", "missing.png"], "  Portraits ")
+        self.assertEqual(
+            data,
+            {
+                "success": True,
+                "category": "Portraits",
+                "updated": 2,
+                "unchanged": 0,
+                "not_found": 1,
+            },
+        )
+        root_key = _favorite_root_key(self.output_dir)
+        self.assertEqual(
+            self.rows(),
+            [(root_key, "a.png", "Portraits"), (root_key, "sub/b.png", "Portraits")],
+        )
+        data = await self.put(["a.png", "sub/b.png"], "Portraits")
+        self.assertEqual((data["updated"], data["unchanged"]), (0, 2))
+        data = await self.put(["a.png"], "Scans")
+        self.assertEqual((data["updated"], data["unchanged"]), (1, 0))
+        self.assertEqual(self.api.db.image_category(*self.key("a.png")), "Scans")
+
+    async def test_put_with_no_listed_file_is_404_and_writes_nothing(self):
+        data = await self.put(["missing.png", "gone/x.png"], "Scans", status=404)
+        self.assertEqual(data["code"], "files-not-found")
+        self.assertEqual(self.rows(), [])
+
+    async def test_duplicate_targets_are_written_and_counted_once(self):
+        make_png(self.output_dir / "a.png")
+        item = self.target("a.png")
+        data = await self.put([item, dict(item)], "Scans")
+        self.assertEqual((data["updated"], data["not_found"]), (1, 0))
+
+    async def test_delete_clears_listed_and_missing_files(self):
+        make_png(self.output_dir / "a.png")
+        await self.put(["a.png"], "Scans")
+        self.api.db.set_image_categories([self.key("gone.png")], "Scans")
+        data = await self.delete(["a.png", "gone.png", "never.png"])
+        self.assertEqual(data, {"success": True, "cleared": 2})
+        self.assertEqual(self.rows(), [])
+        self.assertEqual((await self.delete(["a.png"]))["cleared"], 0)
+
+    async def test_put_never_writes_prompts(self):
+        make_png(self.output_dir / "a.png")
+        make_png(self.output_dir / "b.png")
+        positive = self._save_prompt("castle at dusk", category="Landscapes")
+        self.api.db.link_image_to_prompt(positive, str(self.output_dir / "a.png"))
+        negative = self._save_prompt("blurry", category="Negatives")
+        self.api.db.save_prompt_pair("castle at dusk", "blurry", category="Recipes")
+        conn = self.api.db.model.get_connection()
+        before = category_checksum(conn)
+        links = conn.execute("SELECT * FROM generated_images").fetchall()
+        await self.put(["a.png", "b.png"], "Portraits")
+        await self.listed()
+        await self.delete(["a.png"])
+        self.assertEqual(category_checksum(conn), before)
+        self.assertEqual(
+            conn.execute("SELECT * FROM generated_images").fetchall(), links
+        )
+        self.assertIsNotNone(negative)
+
+    async def test_two_sources_in_one_request(self):
+        second = self.comfy_dir / "renders"
+        make_png(self.output_dir / "a.png")
+        make_png(second / "a.png")
+        self.api._get_all_output_dirs = lambda: [self.output_dir, second]
+        data = await self.put([self.target("a.png", 0), self.target("a.png", 1)], "X")
+        self.assertEqual(data["updated"], 2)
+        self.assertEqual(
+            {row[0] for row in self.rows()},
+            {_favorite_root_key(self.output_dir), _favorite_root_key(second)},
+        )
+        self.assertEqual((await self.delete([self.target("a.png", 1)]))["cleared"], 1)
+
+    async def test_nested_sources_key_by_the_deepest(self):
+        inner = self.output_dir / "nested"
+        make_png(inner / "a.png")
+        self.api._get_all_output_dirs = lambda: [self.output_dir, inner]
+        # Named through the outer source, stored under the inner one.
+        data = await self.put([self.target("nested/a.png", 0)], "Scans")
+        self.assertEqual(data["updated"], 1)
+        self.assertEqual(self.rows(), [(_favorite_root_key(inner), "a.png", "Scans")])
+        # The same file through the inner source is the same key.
+        data = await self.put([self.target("a.png", 1)], "Scans")
+        self.assertEqual(data["unchanged"], 1)
+        self.assertEqual((await self.listed())["categories"], ["Scans"])
+        self.assertEqual((await self.delete([self.target("a.png", 1)]))["cleared"], 1)
+
+    async def test_video_files_can_have_a_category(self):
+        (self.output_dir / "clip.mp4").write_bytes(b"\x00\x00\x00\x18ftypmp42")
+        data = await self.put(["clip.mp4"], "Clips")
+        self.assertEqual(data["updated"], 1)
+
+    async def test_windows_case_folds_the_key(self):
+        make_png(self.output_dir / "Sub" / "A.png")
+        with patch("py.api.images._path_flavor", ntpath):
+            data = await self.put(["Sub/A.png"], "Scans")
+            self.assertEqual(data["updated"], 1)
+            data = await self.put(["sub/a.PNG"], "Scans")
+            self.assertEqual(data["unchanged"], 1)
+            self.assertEqual(self.rows()[0][1], "sub/a.png")
+            self.assertEqual((await self.delete(["SUB/A.png"]))["cleared"], 1)
+
+    async def test_a_key_beyond_the_stored_bound_is_403(self):
+        make_png(self.output_dir / "a.png")
+        too_long = "/" + "r" * MAX_KEY_LENGTH
+        with patch("py.api.images._favorite_root_key", return_value=too_long):
+            data = await self.put(["a.png"], "Scans", status=403)
+            self.assertNotIn(too_long, json.dumps(data))
+            await self.delete(["a.png"], status=403)
+        self.assertEqual(self.rows(), [])
+
+    async def test_an_unexpected_failure_is_a_logged_500(self):
+        make_png(self.output_dir / "a.png")
+
+        def broken(*_args, **_kwargs):
+            raise sqlite3.OperationalError("secret detail")
+
+        self.api.db.set_image_categories = broken
+        self.api.db.clear_image_categories = broken
+        with self.assertLogs("prompt_manager", level="ERROR"):
+            data = await self.put(["a.png"], "Scans", status=500)
+        self.assertEqual(data["error"], "The category could not be changed.")
+        self.assertNotIn("secret", json.dumps(data))
+        with self.assertLogs("prompt_manager", level="ERROR"):
+            data = await self.delete(["a.png"], status=500)
+        self.assertNotIn("secret", json.dumps(data))
+
+    async def test_a_symlinked_output_folder_keys_like_its_favorites(self):
+        """A detected output folder can be a symlink: keys use its real path."""
+        real = self.comfy_dir / "real-output"
+        make_png(real / "a.png")
+        link = self.comfy_dir / "linked-output"
+        self._make_symlink(real, link, target_is_directory=True)
+        self.api._get_all_output_dirs = lambda: [link]
+        data = await self.put(["a.png"], "Scans")
+        self.assertEqual(data["updated"], 1)
+        self.assertEqual(self.rows(), [(_favorite_root_key(link), "a.png", "Scans")])
+        self.assertEqual((await self.listed())["categories"], ["Scans"])
+        self.assertEqual((await self.delete(["a.png"]))["cleared"], 1)
+
+    async def test_lone_surrogates_are_400_not_500(self):
+        make_png(self.output_dir / "a.png")
+        await self.send(
+            "PUT", {"items": [self.target("a.png")], "category": "x\ud800"}, 400
+        )
+        await self.send("DELETE", {"items": [self.target("a\ud800.png")]}, 400)
+        self.assertEqual(self.rows(), [])
+
+    async def test_delete_category_never_reaches_delete_image(self):
+        make_png(self.output_dir / "a.png")
+        calls = []
+
+        async def recorded(request):
+            calls.append(request.match_info)
+            raise AssertionError("delete_image reached")
+
+        self.api.delete_image = recorded
+        await self.put(["a.png"], "Scans")
+        data = await self.delete(["a.png"])
+        self.assertEqual(data["cleared"], 1)
+        self.assertEqual(calls, [])
+
+
+class TestRefusals(ImageCategoryTestCase):
+    async def test_malformed_bodies_are_400(self):
+        make_png(self.output_dir / "a.png")
+        item = self.target("a.png")
+        cases = [
+            {"items": [item]},
+            {"category": "x"},
+            {"items": [item], "category": "x", "extra": 1},
+            {"items": item, "category": "x"},
+            {"items": [], "category": "x"},
+            {"items": [item] * 501, "category": "x"},
+            {"items": [item], "category": 3},
+            {"items": [item], "category": None},
+            {"items": [item], "category": " \t "},
+            {"items": [item], "category": "x" * 101},
+            {"items": [item], "category": "a\x07b"},
+            {"items": [{**item, "root_index": "0"}], "category": "x"},
+            {"items": [{**item, "root_scope": "nothex"}], "category": "x"},
+            {"items": [{"root_index": 0, "path": "a.png"}], "category": "x"},
+            {"items": [{**item, "root_index": 1}], "category": "x"},
+        ]
+        for body in cases:
+            with self.subTest(body=str(body)[:80]):
+                data = await self.send("PUT", body, status=400)
+                self.assertFalse(data["success"])
+        await self.send("DELETE", {"items": [item], "category": "x"}, status=400)
+        await self.send("DELETE", {"items": []}, status=400)
+        response = await self.client.request(
+            "PUT", CATEGORY, data="not json", headers={"Content-Type": "text/plain"}
+        )
+        self.assertEqual(response.status, 400)
+        self.assertEqual(self.rows(), [])
+
+    async def test_unsafe_paths_are_403(self):
+        (self.output_dir / "notes.txt").write_text("not media")
+        for path in ("../outside.png", "/a.png", "C:/a.png", "a\\b.png", "a/./b.png"):
+            with self.subTest(path=path):
+                await self.put([self.target(path)], "x", status=403)
+        data = await self.put([self.target("notes.txt")], "x", status=403)
+        self.assertEqual(data["error"], "Only media files can have a category")
+        await self.delete([self.target("notes.txt")], status=403)
+
+    async def test_a_stale_scope_is_409(self):
+        make_png(self.output_dir / "a.png")
+        item = {**self.target("a.png"), "root_scope": "0" * 64}
+        data = await self.put([item], "x", status=409)
+        self.assertEqual(data["code"], "source-changed")
+        data = await self.delete([item], status=409)
+        self.assertEqual(data["code"], "source-changed")
+
+    async def test_an_oversized_body_is_413(self):
+        response = await self.client.request(
+            "PUT",
+            CATEGORY,
+            data=b'{"items": [], "category": "' + b"x" * (2 * 1024 * 1024) + b'"}',
+            headers={"Content-Type": "application/json"},
+        )
+        self.assertEqual(response.status, 413)
+
+
+class TestCategoryList(ImageCategoryTestCase):
+    async def test_lists_only_values_whose_file_is_listed(self):
+        make_png(self.output_dir / "a.png")
+        make_png(self.output_dir / "c.png")
+        await self.put(["a.png"], "B")
+        await self.put(["c.png"], "A")
+        self.api.db.set_image_categories([self.key("gone.png")], "Z")
+        self.assertEqual(
+            await self.listed(), {"success": True, "categories": ["A", "B"]}
+        )
+
+    async def test_empty_library_lists_nothing(self):
+        self.assertEqual((await self.listed())["categories"], [])
+
+    async def test_a_failed_read_is_500(self):
+        make_png(self.output_dir / "a.png")
+
+        def broken(*_args, **_kwargs):
+            raise sqlite3.OperationalError("secret detail")
+
+        self.api.db.own_categories_of = broken
+        with self.assertLogs("prompt_manager", level="ERROR"):
+            data = await self.listed(status=500)
+        self.assertEqual(data["error"], "Image categories could not be read.")
+        self.assertNotIn("secret", json.dumps(data))
+
+
+class TestAllMatchingFilter(ImageCategoryTestCase):
+    """#392 "Select all N matching": the listing filter, resolved now."""
+
+    async def test_filter_sets_and_clears_every_match(self):
+        for name in ("bulk/a.png", "bulk/b.png", "other/c.png"):
+            make_png(self.output_dir / name)
+        data = await self.send(
+            "PUT", {"filter": {"subfolder": "bulk"}, "category": "Scans"}
+        )
+        self.assertEqual((data["updated"], data["not_found"]), (2, 0))
+        self.assertEqual(
+            sorted(row[1] for row in self.rows()), ["bulk/a.png", "bulk/b.png"]
+        )
+        data = await self.send("DELETE", {"filter": {"subfolder": "bulk"}})
+        self.assertEqual(data["cleared"], 2)
+        data = await self.send(
+            "PUT", {"filter": {"subfolder": "none"}, "category": "Scans"}, 404
+        )
+        self.assertEqual(data["code"], "files-not-found")
+        self.assertEqual(
+            (await self.send("DELETE", {"filter": {"q": "zz"}}))["cleared"], 0
+        )
+
+    async def test_filter_refusals(self):
+        make_png(self.output_dir / "a.png")
+        item = self.target("a.png")
+        for body in (
+            {"filter": {}, "items": [item], "category": "x"},
+            {"filter": {"unknown": "1"}, "category": "x"},
+            {"filter": "q=a", "category": "x"},
+            {"filter": {"root": "0", "root_scope": "nothex"}, "category": "x"},
+        ):
+            with self.subTest(body=body):
+                await self.send("PUT", body, 400)
+        data = await self.send(
+            "PUT",
+            {"filter": {"root": "0", "root_scope": "0" * 64}, "category": "x"},
+            409,
+        )
+        self.assertEqual(data["code"], "source-changed")
+        self.assertEqual(self.rows(), [])
+
+    async def test_more_than_500_matching_is_refused(self):
+        for number in range(501):
+            make_png(self.output_dir / f"many/{number:03}.png", size=(1, 1))
+        data = await self.send("PUT", {"filter": {}, "category": "x"}, 400)
+        self.assertEqual(data["code"], "too-many-images")
+        self.assertEqual(data["error"], "Select at most 500 images.")
+        self.assertEqual(self.rows(), [])

tests/test_api_vocabulary.py

@@ -62,12 +62,16 @@ class TestVocabularyAPI(ImageAPITestCase):
             },
         )
         self.assertEqual(
-            categories["categories"], [{"value": "Animal", "prompt_count": 1}]
+            categories["categories"],
+            [{"value": "Animal", "prompt_count": 1, "image_count": 0}],
         )
         _, rest = await self.get(
             "categories", limit=1, cursor=categories["next_cursor"]
         )
-        self.assertEqual(rest["categories"], [{"value": "Pet", "prompt_count": 1}])
+        self.assertEqual(
+            rest["categories"],
+            [{"value": "Pet", "prompt_count": 1, "image_count": 0}],
+        )
         self.assertFalse(rest["has_more"])
 
     async def test_vocabulary_cursor_is_signed_epoch_scoped(self):
@@ -488,6 +492,7 @@ class TestVocabularyAPI(ImageAPITestCase):
             "other_prompts": 0,
             "negative_variants": 1,
             "archived_negative_variants": 0,
+            "images": 0,
         }
         self.assertEqual(
             preview,
@@ -528,6 +533,73 @@ class TestVocabularyAPI(ImageAPITestCase):
         self.assertEqual(response.status, 409)
         self.assertEqual(replay["code"], "vocabulary-conflict")
 
+    async def test_category_rows_report_images_and_image_only_values(self):
+        self._save_prompt("Owner", category="Prompt value")
+        _, options_before = await self.get_options()
+        self.api.db.set_image_categories(
+            [("root", "a.png"), ("root", "b.png")], "Prompt value"
+        )
+        self.api.db.set_image_categories([("root", "c.png")], "Image value")
+        response, first = await self.get("categories", limit=1)
+        self.assertEqual(response.status, 200)
+        self.assertEqual(
+            first["categories"],
+            [{"value": "Prompt value", "prompt_count": 1, "image_count": 2}],
+        )
+        self.assertEqual(first["total"], 2)
+        _, rest = await self.get("categories", limit=1, cursor=first["next_cursor"])
+        self.assertEqual(
+            rest["categories"],
+            [{"value": "Image value", "prompt_count": 0, "image_count": 1}],
+        )
+        self.assertFalse(rest["has_more"])
+        # The Prompt library's category list does not gain image values.
+        _, options_after = await self.get_options()
+        self.assertEqual(options_after, options_before)
+        self.assertEqual(options_after["categories"], ["Prompt value"])
+
+    async def get_options(self):
+        response = await self.client.get("/prompt_manager/library/options")
+        return response, await response.json()
+
+    async def test_category_routes_rename_image_only_value(self):
+        epoch = self.api.db.get_execution_epoch()
+        self._save_prompt("Bystander", category="Kept")
+        self.api.db.set_image_categories(
+            [("root", "a.png"), ("second", "b.png")], "Image value"
+        )
+        prompts_before = self.category_rows()
+        body = {"expected_epoch": epoch, "source": "Image value", "target": "Moved"}
+        response, preview = await self.send("POST", "categories/preview", body)
+        self.assertEqual(response.status, 200, preview)
+        impact = {
+            "positive_prompts": 0,
+            "other_prompts": 0,
+            "negative_variants": 0,
+            "archived_negative_variants": 0,
+            "images": 2,
+        }
+        self.assertEqual(preview["impact"], impact)
+        stale = preview["impact_token"]
+        self.api.db.set_image_categories([("root", "late.png")], "Image value")
+        response, refused = await self.send(
+            "POST", "categories/apply", {**body, "impact_token": stale}
+        )
+        self.assertEqual(response.status, 409)
+        self.assertEqual(refused["code"], "vocabulary-conflict")
+        self.assertEqual(self.api.db.image_category("root", "a.png"), "Image value")
+        _, preview = await self.send("POST", "categories/preview", body)
+        response, applied = await self.send(
+            "POST",
+            "categories/apply",
+            {**body, "impact_token": preview["impact_token"]},
+        )
+        self.assertEqual(response.status, 200, applied)
+        self.assertEqual(applied["impact"], {**impact, "images": 3})
+        for key in (("root", "a.png"), ("second", "b.png"), ("root", "late.png")):
+            self.assertEqual(self.api.db.image_category(*key), "Moved")
+        self.assertEqual(self.category_rows(), prompts_before)
+
     async def test_preview_validation(self):
         epoch = self.api.db.get_execution_epoch()
         self._save_prompt("Owner", category="Scenery")

tests/test_api_workspace_image_categories.py

@@ -0,0 +1,262 @@
+"""Images filters by the effective category (#332 MC4, MC5, DC6).
+
+An image's effective category is its own category when it has one, else the
+category its link supplies (the recipe's when set, else the positive's), else
+none. The category filter, "select all N matching" and saved views match it.
+"""
+
+import os
+import sqlite3
+from unittest.mock import patch
+
+try:
+    import test_api_workspace_images as workspace
+    from test_image_categories import category_checksum
+except ImportError:
+    from tests import test_api_workspace_images as workspace
+    from tests.test_image_categories import category_checksum
+
+from py.api.images import image_category_key, parse_listing_filter
+
+
+class WorkspaceCategoryCase(workspace.ImageAPITestCase):
+    """Listing helpers plus own-category writes keyed as the routes key them."""
+
+    media = workspace.TestWorkspaceImages.media
+    get = workspace.TestWorkspaceImages.get
+    tag = workspace.TestWorkspaceImageTags.tag
+    names = workspace.TestWorkspaceImageTags.names
+
+    async def tearDownAsync(self):
+        self.api.db.close_all()
+        workspace.assert_closed(self, self._temp_db.name, self._output_tmp.name)
+        await super().tearDownAsync()
+
+    def own(self, path, value, sources=None):
+        sources = sources or self.api._get_all_output_dirs()
+        self.api.db.set_image_categories([image_category_key(sources, path)], value)
+
+    async def listed(self, **params):
+        response, body = await self.get(sort="name", **params)
+        self.assertEqual(response.status, 200, body)
+        return self.names(body), body
+
+
+class TestEffectiveCategoryFilter(WorkspaceCategoryCase):
+    def batch(self):
+        """Four images of "castle at dusk" (Landscapes); one is overridden."""
+        castle = self._save_prompt("castle at dusk", category="Landscapes", rating=4)
+        files = [self.media(f"castle_{n}.png", mtime=100 + n) for n in range(4)]
+        for path in files:
+            self.api.db.link_image_to_prompt(castle, str(path))
+        self.own(files[0], "Portraits")
+        return castle, files
+
+    async def test_category_filter_prefers_own_category(self):
+        castle, _files = self.batch()
+        conn = self.api.db.model.get_connection()
+        before = category_checksum(conn)
+        names, body = await self.listed(category="Portraits")
+        self.assertEqual(names, ["castle_0.png"])
+        # The caption still counts the prompt behind the image shown.
+        self.assertEqual(body["positive_count"], 1)
+        names, body = await self.listed(category="Landscapes")
+        self.assertEqual(names, ["castle_1.png", "castle_2.png", "castle_3.png"])
+        self.assertEqual(body["total"], 3)
+        names, _ = await self.listed()
+        self.assertEqual(len(names), 4)
+        self.assertEqual(category_checksum(conn), before)
+        self.assertEqual(self.api.db.get_prompt_by_id(castle)["category"], "Landscapes")
+
+    async def test_category_filter_lists_unlinked_with_own(self):
+        scans = [self.media(f"scan_{n}.png", mtime=100 + n) for n in range(2)]
+        self.media("plain.png", mtime=50)
+        for path in scans:
+            self.own(path, "Scans")
+        names, body = await self.listed(category="Scans")
+        self.assertEqual(names, ["scan_0.png", "scan_1.png"])
+        self.assertEqual(body["positive_count"], 0)
+
+    async def test_recipe_category_is_inherited(self):
+        """MC4: a recipe's own category, not the positive's, is inherited."""
+        db = self.api.db
+        self._save_prompt("Pair positive", category="Night")
+        pair = db.save_prompt_pair("Pair positive", "Noise", category="Recipes")
+        blank = db.save_prompt_pair("Pair positive", "Other noise", category="  ")
+        recipe = self.media("recipe.png", mtime=103)
+        blank_recipe = self.media("blank_recipe.png", mtime=102)
+        positive = db.get_prompt_pair(pair)["positive_prompt_id"]
+        for path, pair_id in ((recipe, pair), (blank_recipe, blank)):
+            image = db.link_image_to_prompt(positive, str(path))
+            db.link_image_to_pair(pair_id, image, {"source": "fixture"})
+        self.assertEqual((await self.listed(category="Recipes"))[0], ["recipe.png"])
+        # A blank recipe category falls back to the positive's.
+        self.assertEqual((await self.listed(category="Night"))[0], ["blank_recipe.png"])
+        # An own category still wins over the recipe's.
+        self.own(recipe, "Mine")
+        self.assertEqual((await self.listed(category="Recipes"))[0], [])
+        self.assertEqual((await self.listed(category="Mine"))[0], ["recipe.png"])
+
+    async def test_ambiguous_files_inherit_nothing_but_keep_their_own(self):
+        first = self._save_prompt("Owner one", category="Night")
+        second = self._save_prompt("Owner two", category="Night")
+        ambiguous = self.media("ambiguous.png")
+        for owner in (first, second):
+            self.api.db.link_image_to_prompt(owner, str(ambiguous))
+        self.assertEqual((await self.listed(category="Night"))[0], [])
+        self.own(ambiguous, "Night")
+        self.assertEqual((await self.listed(category="Night"))[0], ["ambiguous.png"])
+
+    async def test_combines_with_tags_search_and_rating(self):
+        stone = self._save_prompt(
+            "castle at dusk", category="Landscapes", tags=["stone"], rating=4
+        )
+        files = [self.media(f"castle_{n}.png", mtime=100 + n) for n in range(2)]
+        for path in files:
+            self.api.db.link_image_to_prompt(stone, str(path))
+        self.own(files[0], "Portraits")
+        other = self._save_prompt("harbor at noon", category="Portraits", rating=2)
+        harbor = self.media("harbor.png", mtime=90)
+        self.api.db.link_image_to_prompt(other, str(harbor))
+        names, _ = await self.listed(category="Portraits", tags="stone")
+        self.assertEqual(names, ["castle_0.png"])
+        names, _ = await self.listed(category="Portraits", q="harbor")
+        self.assertEqual(names, ["harbor.png"])
+        names, _ = await self.listed(category="Portraits", q="castle_0")
+        self.assertEqual(names, ["castle_0.png"])
+        response, body = await self.get(category="Portraits", sort="rating")
+        self.assertEqual(response.status, 200, body)
+        self.assertEqual(self.names(body), ["castle_0.png", "harbor.png"])
+        self.assertEqual(body["positive_count"], 2)
+
+    async def test_image_tag_admitted_file_keeps_its_inherited_category(self):
+        night = self._save_prompt("Night owl", category="Night", tags=["a"])
+        tagged = self.media("tagged.png", mtime=103)
+        unlinked = self.media("unlinked.png", mtime=102)
+        self.api.db.link_image_to_prompt(night, str(tagged))
+        self.tag(tagged, ["b"])
+        self.tag(unlinked, ["a", "b"])
+        names, _ = await self.listed(tags="a,b", category="Night")
+        self.assertEqual(names, ["tagged.png"])
+        self.own(unlinked, "Night")
+        names, _ = await self.listed(tags="a,b", category="Night")
+        self.assertEqual(names, ["tagged.png", "unlinked.png"])
+
+    async def test_cursor_pages_walk_only_the_category(self):
+        files = [self.media(f"img_{n:02}.png", mtime=100 + n) for n in range(7)]
+        for path in files[::2]:
+            self.own(path, "Even")
+        seen, cursor = [], None
+        while True:
+            params = {"category": "Even", "limit": 2, "sort": "name"}
+            if cursor:
+                params["cursor"] = cursor
+            response, body = await self.get(**params)
+            self.assertEqual(response.status, 200, body)
+            seen += self.names(body)
+            self.assertEqual(body["total"], 4)
+            cursor = body["next_cursor"]
+            if not cursor:
+                break
+        self.assertEqual(seen, ["img_00.png", "img_02.png", "img_04.png", "img_06.png"])
+
+    async def test_an_outer_source_lists_a_nested_sources_own_category(self):
+        inner = self.output_dir / "nested"
+        nested = self.media("nested/a.png")
+        self.media("b.png")
+        self.api._get_all_output_dirs = lambda: [self.output_dir, inner]
+        self.own(nested, "Scans")
+        names, _ = await self.listed(category="Scans", root="0")
+        self.assertEqual(names, ["nested/a.png"])
+        names, _ = await self.listed(category="Scans", root="1")
+        self.assertEqual(names, ["a.png"])
+        # The outer source's own key for that path is not the file's key.
+        from py.api.images import _favorite_root_key
+
+        self.api.db.clear_image_categories([image_category_key([inner], nested)])
+        self.api.db.set_image_categories(
+            [(_favorite_root_key(self.output_dir), "nested/a.png")], "Stale"
+        )
+        self.assertEqual((await self.listed(category="Stale"))[0], [])
+
+    async def test_a_gone_files_category_is_not_listed(self):
+        gone = self.media("gone.png")
+        self.own(gone, "Scans")
+        os.unlink(gone)
+        self.api.invalidate_gallery_cache()
+        self.assertEqual((await self.listed(category="Scans"))[0], [])
+
+    async def test_a_failed_own_category_read_is_listing_failed(self):
+        self.media("a.png")
+
+        def broken(*_args, **_kwargs):
+            raise sqlite3.OperationalError("secret detail")
+
+        with patch.object(self.api.db, "own_categories_of", side_effect=broken):
+            with self.assertLogs("prompt_manager", level="ERROR"):
+                response, body = await self.get(category="Scans")
+            self.assertEqual(response.status, 500)
+            self.assertNotIn("secret", str(body))
+            # Without a category nothing new is read.
+            response, body = await self.get()
+            self.assertEqual(response.status, 200, body)
+
+    async def test_select_all_matching_uses_the_effective_category(self):
+        _castle, files = self.batch()
+        resolved = await self.api.resolve_listing_filter(
+            parse_listing_filter({"category": "Portraits"}), 100
+        )
+        self.assertEqual([t[2] for t in resolved.targets], ["castle_0.png"])
+        resolved = await self.api.resolve_listing_filter(
+            parse_listing_filter({"category": "Landscapes"}), 100
+        )
+        self.assertEqual(len(resolved.targets), 3)
+        self.assertEqual(len(files), 4)
+
+    async def test_saved_view_category_means_the_effective_category(self):
+        """CUJ 8: a saved view's category is the listing's query value."""
+        _castle, files = self.batch()
+        self.own(files[1], "Portraits")
+        names, _ = await self.listed(category="Portraits")
+        self.assertEqual(names, ["castle_0.png", "castle_1.png"])
+
+
+class TestFilterAndChipAgreeOnBlanks(WorkspaceCategoryCase):
+    """The filter and the inspector use one inherited-category rule."""
+
+    async def chip(self, path):
+        response = await self.client.get(
+            f"/prompt_manager/images/inspect/{path}", params={"root": "0"}
+        )
+        body = await response.json()
+        self.assertEqual(response.status, 200, body)
+        return body["library"]["category"]
+
+    async def test_blank_recipe_values_agree(self):
+        db = self.api.db
+        positive = self._save_prompt("Pair positive", category="Night")
+        blanks = {"spaces": "   ", "tab": "\t", "nbsp": " ", "set": "Recipes"}
+        for index, (label, value) in enumerate(blanks.items()):
+            pair = db.save_prompt_pair("Pair positive", f"noise {label}")
+            path = self.media(f"{label}.png", mtime=100 + index)
+            image = db.link_image_to_prompt(positive, str(path))
+            db.link_image_to_pair(pair, image, {"source": "fixture"})
+            with db.model.get_connection() as conn:
+                conn.execute(
+                    "UPDATE prompt_pairs SET category=? WHERE id=?", (value, pair)
+                )
+        blob = db.save_prompt_pair("Pair positive", "noise blob")
+        path = self.media("blob.png", mtime=90)
+        image = db.link_image_to_prompt(positive, str(path))
+        db.link_image_to_pair(blob, image, {"source": "fixture"})
+        with db.model.get_connection() as conn:
+            conn.execute(
+                "UPDATE prompt_pairs SET category=CAST(' ' AS BLOB) WHERE id=?",
+                (blob,),
+            )
+        for name in ("spaces", "tab", "nbsp", "set", "blob"):
+            with self.subTest(name=name):
+                shown = await self.chip(f"{name}.png")
+                for value in ("Night", "Recipes"):
+                    listed = f"{name}.png" in (await self.listed(category=value))[0]
+                    self.assertEqual(listed, shown == value, (name, value, shown))

tests/test_api_workspace_images.py

@@ -1347,7 +1347,7 @@ class TestWorkspaceImages(ImageAPITestCase):
         _, data = await self.get(q="harbor")
         self.assertEqual(self._names(data), ["night_a.png"])
         self.assertEqual(
-            self.api.db.get_image_paths_matching("zebra", None, []),
+            self.api.db.get_image_paths_matching("zebra", []),
             {
                 normalize_image_path(str(files[name]))
                 for name in ("night_ab", "day_ab", "titled")
@@ -1407,8 +1407,10 @@ class TestWorkspaceImages(ImageAPITestCase):
             for query in statements
             if query.lstrip().upper().startswith(("SELECT", "WITH"))
         ]
-        # Plus the one stream of tagged image records q and tags read (B3).
-        self.assertEqual(len(selects), 4, selects)
+        # Plus the one stream of tagged image records q and tags read (B3),
+        # and the category's own-category read of the one source (#332).
+        self.assertEqual(len(selects), 5, selects)
+        self.assertEqual(sum("image_categories" in q for q in selects), 1, selects)
         self.assertEqual(sum("image_favorites" in q for q in selects), 1, selects)
         self.assertEqual(sum("media_image_tags" in q for q in selects), 1, selects)
 
@@ -1528,15 +1530,16 @@ class TestWorkspaceImages(ImageAPITestCase):
         elsewhere = self.api.db.get_prompt_id_for_image("/elsewhere/7.png")
         self.assertEqual(
             self.api.db.get_image_link_matches(
-                "", "Night", [], every_link=True, wanted=wanted
+                "", [], every_link=True, wanted=wanted, category="Night"
             ),
             {
                 normalize_image_path(str(files["night_ab"])): (
                     True,
                     5,
                     self.api.db.get_prompt_id_for_image(str(files["night_ab"])),
+                    "Night",
                 ),
-                "/elsewhere/7.png": (True, 5, elsewhere),
+                "/elsewhere/7.png": (True, 5, elsewhere, "Night"),
             },
         )
 
@@ -1588,6 +1591,24 @@ class TestWorkspaceImages(ImageAPITestCase):
                     for i in range(links)
                 ],
             )
+        # 2,000 images (one in 25 at 50,000 files) carry their own category
+        # (#332), so a category filter also reads and matches those.
+        from py.api.images import _favorite_root_key
+
+        root_key = _favorite_root_key(self.output_dir)
+        with self.api.db.model.get_connection() as conn:
+            conn.executemany(
+                "INSERT INTO image_categories VALUES(?,?,?,?)",
+                [
+                    (
+                        root_key,
+                        listed[i][0].relative_to(self.output_dir).as_posix(),
+                        f"cat-{i % 10}",
+                        "2026-10-27T00:00:00+00:00",
+                    )
+                    for i in range(1, files, 25)[:2_000]
+                ],
+            )
         return listed
 
     _BUDGET_REQUESTS = (
@@ -1615,7 +1636,7 @@ class TestWorkspaceImages(ImageAPITestCase):
         import math
 
         from py.api import images as images_module
-        from database.operations import link_filter_query
+        from database.operations import link_filter_query, link_matches_json_query
 
         listed = await asyncio.get_running_loop().run_in_executor(
             None, self._budget_fixture, 5_000, 2_000
@@ -1678,7 +1699,13 @@ class TestWorkspaceImages(ImageAPITestCase):
                     # q and tags also stream the tagged image records once
                     # (#249 B3); none are tagged here, so nothing is stat'ed.
                     streamed = "q" in params or "tags" in params
-                    self.assertEqual(len(found), 2 if streamed else 1, found)
+                    # A category also reads the own categories, one primary
+                    # key range per source (#332).
+                    own = "category" in params
+                    self.assertEqual(len(found), 1 + streamed + own, found)
+                    self.assertEqual(
+                        sum("image_categories" in query for query in found), int(own)
+                    )
                     self.assertEqual(
                         sum("media_image_tags" in query for query in found),
                         int(streamed),
@@ -1738,13 +1765,42 @@ class TestWorkspaceImages(ImageAPITestCase):
             self.assertEqual(self.api._workspace_listed_cache, {})
             self.assertEqual(self.api._workspace_order_cache, {})
         # The per-row ambiguity probe is an index search, never a scan.
-        sql, params = link_filter_query("lantern", "cat-3", ["tag-1"], every_link=True)
-        with self.api.db.model.get_connection() as conn:
-            plan = [row[3] for row in conn.execute("EXPLAIN QUERY PLAN " + sql, params)]
-        self.assertIn(
-            "SEARCH other USING COVERING INDEX idx_image_file_path (file_path=?)", plan
+        # The read runs it wrapped in one JSON aggregate (#354): same plan.
+        sql, params = link_filter_query("lantern", ["tag-1"], every_link=True)
+        for query in (sql, link_matches_json_query(sql)):
+            with self.subTest(wrapped=query is not sql):
+                with self.api.db.model.get_connection() as conn:
+                    plan = [
+                        row[3]
+                        for row in conn.execute("EXPLAIN QUERY PLAN " + query, params)
+                    ]
+                self.assertIn(
+                    "SEARCH other USING COVERING INDEX idx_image_file_path "
+                    "(file_path=?)",
+                    plan,
+                )
+                self.assertFalse(
+                    [step for step in plan if step.startswith("SCAN other")]
+                )
+        # The category's narrowing clause (#332) keeps every join an index
+        # search, plain and wrapped with the raw categories.
+        sql, params = link_filter_query(
+            "", ["tag-1"], every_link=True, category="cat-3"
         )
-        self.assertFalse([step for step in plan if step.startswith("SCAN other")])
+        for query in (sql, link_matches_json_query(sql, categories=True)):
+            with self.subTest(category_wrapped=query is not sql):
+                with self.api.db.model.get_connection() as conn:
+                    plan = [
+                        row[3]
+                        for row in conn.execute("EXPLAIN QUERY PLAN " + query, params)
+                    ]
+                self.assertIn(
+                    "SEARCH other USING COVERING INDEX idx_image_file_path "
+                    "(file_path=?)",
+                    plan,
+                )
+                scans = [step for step in plan if step.startswith("SCAN")]
+                self.assertTrue(all(step.startswith("SCAN gi") for step in scans), plan)
 
     @unittest.skipUnless(
         PERF_BUDGET and not TRACED,

tests/test_cached_runs.py

@@ -0,0 +1,863 @@
+"""Cached re-runs of runtime-linked prompt text count once per job (#347).
+
+Jobs are simulated end to end: the queue hook (submit + dequeue), the
+``execution_cached`` replay, the real node executions and ComfyUI's output
+cache (fakes of ``execution`` and ``comfy_execution.caching``, as in
+tests/test_execution_context_host.py).
+"""
+
+import logging
+import os
+import sys
+import tempfile
+import threading
+import types
+import unittest
+from collections import namedtuple
+from unittest import mock
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+try:
+    from tests.open_handles import assert_closed
+except ImportError:  # discovered with tests/ as the top-level directory
+    from open_handles import assert_closed
+
+from database.operations import PromptDatabase
+from utils import cached_runs as module
+from utils.cached_runs import (
+    CachedRuns,
+    Facts,
+    Role,
+    Seen,
+    graph_role,
+    graph_seen,
+    own_counts,
+    register_cached_runs,
+    stored_facts,
+)
+from utils.execution_context_host import cached_string_outputs
+from utils.hashing import generate_prompt_hash
+from utils.run_keys import prompt_node_key, upstream_closure, upstream_nodes
+from utils.usage_tracking import (
+    PendingFirstUse,
+    QueuedRuns,
+    find_pair_id,
+    find_pair_id_by_hashes,
+    handle_queued_prompt,
+    on_dequeue,
+)
+
+Entry = namedtuple("CacheEntry", "ui outputs")
+LLM = "a lighthouse the LLM wrote"
+
+
+class _Cache:
+    def __init__(self):
+        self.entries = {}
+
+    def get_local(self, node_id):
+        return self.entries.get(node_id)
+
+
+class HierarchicalCache(_Cache):
+    pass
+
+
+class LRUCache(_Cache):
+    pass
+
+
+class RAMPressureCache(LRUCache):
+    pass
+
+
+class NullCache(_Cache):
+    pass
+
+
+def host_modules():
+    """Fake ``execution`` and ``comfy_execution.caching`` for the cache reader."""
+    execution = types.ModuleType("execution")
+    execution.CacheEntry = Entry
+
+    class PromptExecutor:
+        def add_message(self, event, data, broadcast):
+            return None
+
+    execution.PromptExecutor = PromptExecutor
+    caching = types.ModuleType("comfy_execution.caching")
+    for cls in (HierarchicalCache, LRUCache, RAMPressureCache, NullCache):
+        setattr(caching, cls.__name__, cls)
+    package = types.ModuleType("comfy_execution")
+    package.caching = caching
+    return {
+        "execution": execution,
+        "comfy_execution": package,
+        "comfy_execution.caching": caching,
+    }
+
+
+def graph(
+    kind="PromptManager",
+    text=None,
+    role="positive",
+    sampler=True,
+    negative_text="",
+    seed=1,
+):
+    """PrimitiveString -> PreviewAny -> ``kind`` -> KSampler (runtime text).
+
+    ``text`` set: typed text instead of the runtime link. ``role`` "negative":
+    the node feeds the sampler's negative input. Pair: its negative editor holds
+    ``negative_text`` and it feeds both sampler inputs.
+    """
+    g = {
+        "str": {"class_type": "PrimitiveString", "inputs": {"value": "seed text"}},
+        "llm": {"class_type": "PreviewAny", "inputs": {"source": ["str", 0]}},
+        "ckpt": {"class_type": "CheckpointLoaderSimple", "inputs": {"ckpt": "m"}},
+        "pm": {
+            "class_type": kind,
+            "inputs": {"text": ["llm", 0] if text is None else text},
+        },
+        "other": {
+            "class_type": "CLIPTextEncode",
+            "inputs": {"text": "", "clip": ["ckpt", 1]},
+        },
+        "save": {"class_type": "SaveImage", "inputs": {"images": ["ks", 0]}},
+    }
+    if kind != "PromptManagerText":
+        g["pm"]["inputs"]["clip"] = ["ckpt", 1]
+    if kind == "PromptManagerPair":
+        g["pm"]["inputs"]["negative_text"] = negative_text
+    source = ["pm", 0]
+    if kind == "PromptManagerText":
+        g["enc"] = {
+            "class_type": "CLIPTextEncode",
+            "inputs": {"text": ["pm", 0], "clip": ["ckpt", 1]},
+        }
+        source = ["enc", 0]
+    positive, negative = (source, ["other", 0])
+    if role == "negative":
+        positive, negative = negative, positive
+    if kind == "PromptManagerPair":
+        positive, negative = ["pm", 0], ["pm", 1]
+    if sampler:
+        g["ks"] = {
+            "class_type": "KSampler",
+            "inputs": {
+                "model": ["ckpt", 0],
+                "positive": positive,
+                "negative": negative,
+                "seed": seed,
+            },
+        }
+    else:
+        g["save"]["inputs"]["images"] = positive
+    return g
+
+
+class JobCase(unittest.TestCase):
+    """A database, the queue hook stashes and one ``CachedRuns`` per test."""
+
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.tmp.cleanup)
+        self.addCleanup(assert_closed, self, self.tmp.name)
+        self.db = PromptDatabase(os.path.join(self.tmp.name, "runs.db"))
+        self.addCleanup(self.db.close_all)
+        patcher = mock.patch.dict(sys.modules, host_modules())
+        patcher.start()
+        self.addCleanup(patcher.stop)
+        self.queued, self.pair_queued = QueuedRuns(), QueuedRuns()
+        self.pending, self.pair_pending = PendingFirstUse(), PendingFirstUse()
+        self.context = (None, None)
+        self.runs = CachedRuns(context=lambda: self.context)
+        self.queue = object()
+        self.executor = types.SimpleNamespace(
+            server=types.SimpleNamespace(prompt_queue=self.queue),
+            caches=types.SimpleNamespace(outputs=HierarchicalCache()),
+        )
+        self.item_id = 0
+        self.trackers = []
+
+    # -- nodes ----------------------------------------------------------------
+
+    def node(self, kind):
+        if kind == "PromptManagerPair":
+            from prompt_manager_pair import PromptManagerPair as cls
+        elif kind == "PromptManagerText":
+            from prompt_manager_text import PromptManagerText as cls
+        else:
+            import prompt_manager
+
+            cls = getattr(prompt_manager, kind)
+        node = cls.__new__(cls)
+        node.db = self.db
+        node.logger = logging.getLogger("test.cached_runs")
+        node.prompt_tracker = mock.Mock()
+        self.trackers.append(node.prompt_tracker)
+        node.comfyui_integration = mock.Mock()
+        node._inject_lora_trigger_words = lambda text: text
+        node.pending_first_use = self.pending
+        node.pending_pair_first_use = self.pair_pending
+        node.cached_runs = self.runs
+        return node
+
+    def execute(self, g, node_id="pm", text=LLM, negative="", index=None):
+        """Run the node as ComfyUI would; returns its STRING outputs."""
+        kind = g[node_id]["class_type"]
+        node = self.node(kind)
+        self.context = (self.context[0], index)
+        clip = mock.Mock()
+        # The node receives its switch as the queued graph holds it (#90)
+        save = g[node_id]["inputs"].get("save_to_library", True)
+        if kind == "PromptManagerText":
+            return node.process_text(
+                text, prompt=g, unique_id=node_id, save_to_library=save
+            )
+        if kind == "PromptManagerPair":
+            return node.encode_prompt(
+                clip,
+                text,
+                negative_text=negative,
+                prompt=g,
+                unique_id=node_id,
+                save_to_library=save,
+            )
+        return node.encode_prompt(
+            clip, text, prompt=g, unique_id=node_id, save_to_library=save
+        )
+
+    def cache(self, node_id, *results):
+        """Store executed results (one per list index) as ComfyUI's cache entry."""
+        width = len(results[0])
+        outputs = [[result[slot] for result in results] for slot in range(width)]
+        self.executor.caches.outputs.entries[node_id] = Entry({}, outputs)
+
+    # -- jobs -----------------------------------------------------------------
+
+    def job(self, g, cached=(), run=None, outputs=("save",), prompt_id=None):
+        """One queued job: hook, dequeue, ``execution_cached``, executions, done."""
+        self.item_id += 1
+        prompt_id = prompt_id or f"job-{self.item_id}"
+        request = handle_queued_prompt(
+            {"prompt": g, "prompt_id": prompt_id},
+            self.queued,
+            pair_queued=self.pair_queued,
+        )
+        on_dequeue(
+            request["prompt_id"],
+            self.queued,
+            lambda: self.db,
+            self.pending,
+            pair_queued=self.pair_queued,
+            pair_pending=self.pair_pending,
+        )
+        self.runs.begin_attempt(
+            ((self.item_id, prompt_id, g, {}, list(outputs), {}), self.item_id)
+        )
+        self.context = (prompt_id, None)
+        self.runs.replay(self.executor, prompt_id, list(cached), lambda: self.db)
+        result = run() if run else None
+        self.runs.end_attempt(self.item_id)
+        self.context = (None, None)
+        return result
+
+    def first(self, g, text=LLM, negative="", node_id="pm"):
+        """A job that executes the node and fills the cache."""
+        result = self.job(
+            g, run=lambda: self.execute(g, node_id, text=text, negative=negative)
+        )
+        self.cache(node_id, result)
+        return result
+
+    def count(self, text):
+        row = self.db.get_prompt_by_hash(generate_prompt_hash(text))
+        return row["run_count"] if row else None
+
+    def pair_count(self, positive, negative):
+        pair_id = find_pair_id(self.db, positive, negative)
+        return self.db.get_prompt_pair(pair_id)["run_count"] if pair_id else None
+
+
+class TestCachedJobsCount(JobCase):
+    def test_runtime_text_counts_every_cached_job_for_each_node_kind(self):
+        for kind in (
+            "PromptManager",
+            "PromptManagerFocused",
+            "PromptManagerSplit",
+            "PromptManagerText",
+        ):
+            with self.subTest(kind=kind):
+                text = f"{LLM} for {kind}"
+                g = graph(kind)
+                self.first(g, text=text)
+                self.job(graph(kind, seed=2), cached=["pm"])
+                self.job(graph(kind, seed=3), cached=["pm"])
+                self.assertEqual(self.count(text), 3)
+
+    def test_typed_text_still_counts_once_per_job(self):
+        g = graph(text="typed castle")
+        self.first(g, text="typed castle")
+        self.job(g, cached=["pm"])
+        self.job(g, cached=["pm"])
+        self.assertEqual(self.count("typed castle"), 3)
+
+    def test_rewired_to_negative_while_cached_counts_nothing(self):
+        self.first(graph())
+        self.job(graph(role="negative"), cached=["pm"])
+        self.assertEqual(self.count(LLM), 1)
+        # Rewired back to positive: the receipt still proves the text
+        self.job(graph(), cached=["pm"])
+        self.assertEqual(self.count(LLM), 2)
+
+    def test_no_sampler_counts_every_node_on_replay(self):
+        g = graph(sampler=False)
+        self.first(g)
+        self.job(g, cached=["pm"])
+        self.assertEqual(self.count(LLM), 2)
+
+    def test_empty_editor_replays_nothing(self):
+        g = graph()
+        self.first(g, text="")
+        self.job(g, cached=["pm"])
+        self.assertEqual(self.db.search_prompts(), [])
+
+    def test_disabled_node_then_cached_jobs_counts_0(self):
+        # #90 x #347: a node with Save to library off records no receipt and is
+        # no run prompt, so its cached jobs replay nothing. The prompt exists
+        # (an enabled run saved it), so any replayed count would show.
+        for kind in (
+            "PromptManager",
+            "PromptManagerFocused",
+            "PromptManagerSplit",
+            "PromptManagerText",
+            "PromptManagerPair",
+        ):
+            with self.subTest(kind=kind):
+                text = f"{LLM} not saved by {kind}"
+                negative = "blurry" if kind == "PromptManagerPair" else ""
+                self.first(graph(kind, negative_text=negative), text, negative)
+                before = (self.count(text), self.pair_count(text, negative))
+
+                def off(seed):
+                    g = graph(kind, negative_text=negative, seed=seed)
+                    g["pm"]["inputs"]["save_to_library"] = False
+                    return g
+
+                self.first(off(1), text, negative)
+                self.job(off(2), cached=["pm"])
+                self.job(off(3), cached=["pm"])
+                after = (self.count(text), self.pair_count(text, negative))
+                self.assertEqual(before[0], 1)
+                self.assertEqual(after, before)
+
+    def test_alternating_upstream_values_each_count_their_own_prompt(self):
+        g = graph()
+        self.first(g, text="value A")
+        self.first(g, text="value B")
+        self.cache("pm", self.execute_outputs("value A"))
+        self.job(g, cached=["pm"])
+        self.assertEqual((self.count("value A"), self.count("value B")), (2, 1))
+
+    def execute_outputs(self, text):
+        return (mock.ANY, text)
+
+    def test_list_items_replay_each_item_in_order(self):
+        g = graph()
+        results = []
+
+        def run():
+            for index, text in enumerate(("one", "two", "three")):
+                results.append(self.execute(g, text=text, index=index))
+
+        self.job(g, run=run)
+        self.cache("pm", *results)
+        self.job(g, cached=["pm"])
+        self.assertEqual([self.count(t) for t in ("one", "two", "three")], [2, 2, 2])
+
+    def test_a_repeated_id_or_message_never_counts_a_node_twice(self):
+        g = graph()
+        self.first(g)
+        self.job(g, cached=["pm", "pm"])
+        self.assertEqual(self.count(LLM), 2)
+        self.item_id += 1
+        self.runs.begin_attempt(((1, "again", g, {}, ["save"], {}), self.item_id))
+        for _ in range(2):
+            self.runs.replay(self.executor, "again", ["pm"], lambda: self.db)
+        self.assertEqual(self.count(LLM), 3)
+
+    def test_a_shorter_list_keeps_its_receipt_after_a_longer_one(self):
+        g = graph()
+        self.first(g, text="alpha")
+        results = []
+
+        def run():
+            for index, text in enumerate(("alpha", "beta")):
+                results.append(self.execute(g, text=text, index=index))
+
+        self.job(g, run=run)
+        self.cache("pm", (mock.ANY, "alpha"))
+        self.job(g, cached=["pm"])
+        self.assertEqual((self.count("alpha"), self.count("beta")), (3, 1))
+
+    def test_a_job_reusing_a_prompt_id_counts_and_executes_normally(self):
+        g = graph()
+        self.first(g)
+        self.job(g, cached=["pm"], prompt_id="same")
+        self.job(g, run=lambda: self.execute(g), prompt_id="same")
+        self.job(g, cached=["pm"], prompt_id="same")
+        self.assertEqual(self.count(LLM), 4)
+
+
+class TestFailClosed(JobCase):
+    def setUp(self):
+        super().setUp()
+        self.g = graph()
+        self.first(self.g)
+
+    def assertNotCounted(self):
+        self.assertEqual(self.count(LLM), 1)
+
+    def test_changed_cached_text_is_not_counted(self):
+        self.cache("pm", (mock.ANY, LLM + " edited"))
+        self.job(self.g, cached=["pm"])
+        self.assertNotCounted()
+
+    def test_no_receipt_in_this_process_is_not_counted(self):
+        self.runs = CachedRuns(context=lambda: self.context)
+        self.job(self.g, cached=["pm"])
+        self.assertNotCounted()
+
+    def test_missing_cache_entry_is_not_counted(self):
+        self.executor.caches.outputs.entries.clear()
+        self.job(self.g, cached=["pm"])
+        self.assertNotCounted()
+
+    def test_unsupported_cache_is_not_counted(self):
+        entries = self.executor.caches.outputs.entries
+        self.executor.caches.outputs = NullCache()
+        self.executor.caches.outputs.entries = entries
+        self.job(self.g, cached=["pm"])
+        self.assertNotCounted()
+
+    def test_more_list_values_than_the_bound_are_not_counted(self):
+        self.cache("pm", *[(mock.ANY, LLM)] * 65)
+        self.job(self.g, cached=["pm"])
+        self.assertNotCounted()
+
+    def test_missing_list_index_is_not_counted(self):
+        self.cache("pm", (mock.ANY, LLM), (mock.ANY, LLM))
+        self.job(self.g, cached=["pm"])
+        self.assertNotCounted()
+
+    def test_node_the_job_does_not_run_is_not_counted(self):
+        self.job(self.g, cached=["pm"], outputs=("other",))
+        self.assertNotCounted()
+
+    def test_message_for_another_job_is_not_counted(self):
+        self.item_id += 1
+        self.runs.begin_attempt(((1, "this", self.g, {}, ["save"], {}), self.item_id))
+        self.runs.replay(self.executor, "another", ["pm"], lambda: self.db)
+        self.assertNotCounted()
+
+    def test_unkeyable_node_is_not_counted(self):
+        g = graph()
+        g["pm"]["inputs"]["extra"] = ["missing", 0]
+        self.job(g, cached=["pm"])
+        self.assertIsNone(prompt_node_key(g, "pm"))
+        self.assertNotCounted()
+
+    def test_deleted_prompt_is_skipped(self):
+        self.db.delete_prompt(
+            self.db.get_prompt_by_hash(generate_prompt_hash(LLM))["id"]
+        )
+        self.job(self.g, cached=["pm"])
+        self.assertIsNone(self.count(LLM))
+
+    def test_database_errors_never_raise(self):
+        def broken():
+            raise RuntimeError("database unavailable")
+
+        self.item_id += 1
+        self.runs.begin_attempt(((1, "j", self.g, {}, ["save"], {}), self.item_id))
+        self.runs.replay(self.executor, "j", ["pm"], broken)
+        self.assertNotCounted()
+
+    def test_malformed_messages_and_results_are_ignored(self):
+        self.runs.begin_attempt(None)
+        self.runs.begin_attempt((("x",), "not an int"))
+        self.runs.replay(self.executor, None, ["pm"], lambda: self.db)
+        self.item_id += 1
+        self.runs.begin_attempt(((1, "j", self.g, {}, ["save"], {}), self.item_id))
+        self.runs.replay(self.executor, "j", "pm", lambda: self.db)
+        self.runs.replay(self.executor, "j", ["pm"] * 501, lambda: self.db)
+        self.runs.replay(self.executor, "j", [7, None], lambda: self.db)
+        self.assertNotCounted()
+
+
+class TestReplayThenExecution(JobCase):
+    def test_execution_after_replay_in_the_same_job_is_not_counted_again(self):
+        # RAM-pressure frees the entry after execution_cached: the node executes
+        g = graph()
+        self.first(g)
+        self.job(g, cached=["pm"], run=lambda: self.execute(g))
+        self.assertEqual(self.count(LLM), 2)
+        # The suppressed execution still leaves a receipt: the next job counts
+        self.job(g, cached=["pm"])
+        self.assertEqual(self.count(LLM), 3)
+
+    def test_suppression_keeps_the_pending_catch_up_and_the_tracker_queue(self):
+        g = graph()
+        self.first(g)
+        prompt_id = self.db.get_prompt_by_hash(generate_prompt_hash(LLM))["id"]
+
+        def run():
+            # The replay counted, then the prompt was deleted and re-saved
+            self.db.delete_prompt(prompt_id)
+            self.pending.add(generate_prompt_hash(LLM))
+            return self.execute(g)
+
+        self.job(g, cached=["pm"], run=run)
+        self.assertEqual(self.count(LLM), 1)  # the catch-up, not the own count
+        push = self.trackers[-1].set_current_prompt.call_args.kwargs["push_to_queue"]
+        self.assertTrue(push)
+
+    def test_without_host_context_the_node_counts_as_before(self):
+        g = graph()
+        self.runs = CachedRuns(context=lambda: (None, None))
+        self.first(g)
+        self.job(g, cached=["pm"])
+        self.job(g, run=lambda: self.execute(g))
+        self.assertEqual(self.count(LLM), 2)
+
+
+class TestPairReplay(JobCase):
+    def test_runtime_positive_counts_positive_and_pair_every_job(self):
+        g = graph("PromptManagerPair", negative_text="blurry")
+        self.first(g, negative="blurry")
+        self.job(graph("PromptManagerPair", negative_text="blurry", seed=2), ["pm"])
+        self.job(graph("PromptManagerPair", negative_text="blurry", seed=3), ["pm"])
+        self.assertEqual(self.count(LLM), 3)
+        self.assertEqual(self.pair_count(LLM, "blurry"), 3)
+        self.assertEqual(self.count("blurry"), 0)
+
+    def test_empty_negative_pair_replays_its_pair_count(self):
+        g = graph("PromptManagerPair")
+        self.first(g)
+        self.job(g, cached=["pm"])
+        self.assertEqual(self.pair_count(LLM, ""), 2)
+        self.assertEqual(self.count(LLM), 2)
+
+    def test_pair_execution_after_replay_is_not_counted_again(self):
+        g = graph("PromptManagerPair", negative_text="blurry")
+        self.first(g, negative="blurry")
+        self.job(g, ["pm"], run=lambda: self.execute(g, negative="blurry"))
+        self.assertEqual(self.count(LLM), 2)
+        self.assertEqual(self.pair_count(LLM, "blurry"), 2)
+
+    def test_pair_role_follows_the_current_graph(self):
+        g = graph("PromptManagerPair", negative_text="blurry")
+        self.first(g, negative="blurry")
+        rewired = graph("PromptManagerPair", negative_text="blurry")
+        rewired["ks"]["inputs"]["positive"] = ["other", 0]
+        self.job(rewired, cached=["pm"])
+        self.assertEqual(self.count(LLM), 1)
+        self.assertEqual(self.pair_count(LLM, "blurry"), 1)
+
+
+class TestOwnCounts(unittest.TestCase):
+    """The node path and replay decide through the same function."""
+
+    def test_single_node_table(self):
+        facts = Facts("p")
+        for used, seen, expected in (
+            ({"text"}, False, [("prompt", "p")]),
+            ({"text"}, True, []),
+            (set(), False, []),
+        ):
+            with self.subTest(used=used, seen=seen):
+                counts = own_counts(
+                    "PromptManager", facts, Role(frozenset(used)), Seen(text=seen)
+                )
+                self.assertEqual(counts, expected)
+        self.assertEqual(
+            own_counts("PromptManager", Facts(None), Role(frozenset({"text"})), Seen()),
+            [],
+        )
+
+    def test_pair_table(self):
+        both = Role(frozenset({"text", "negative_text"}), True)
+        self.assertEqual(
+            own_counts("PromptManagerPair", Facts("p", "n"), both, Seen()),
+            [("prompt", "p"), ("prompt", "n"), ("pair", "p", "n")],
+        )
+        self.assertEqual(
+            own_counts("PromptManagerPair", Facts("p", "p"), both, Seen()),
+            [("prompt", "p"), ("pair", "p", "p")],
+        )
+        self.assertEqual(
+            own_counts("PromptManagerPair", Facts("p"), both, Seen(text=True)),
+            [("pair", "p", None)],
+        )
+        self.assertEqual(
+            own_counts(
+                "PromptManagerPair", Facts("p", "n"), both, Seen(True, True, True)
+            ),
+            [],
+        )
+
+    def test_node_and_replay_agree_on_role_and_seen(self):
+        for g, node_id in (
+            (graph(), "pm"),
+            (graph(text="typed"), "pm"),
+            (graph(role="negative"), "pm"),
+            (graph(sampler=False), "pm"),
+            (graph("PromptManagerPair", negative_text="n"), "pm"),
+            (graph("PromptManagerPair", text="typed", negative_text="n"), "pm"),
+        ):
+            kind = g[node_id]["class_type"]
+            text = "typed" if isinstance(g[node_id]["inputs"]["text"], str) else LLM
+            facts = stored_facts(text, g[node_id]["inputs"].get("negative_text"))
+            with self.subTest(kind=kind, inputs=g[node_id]["inputs"]):
+                replay = own_counts(
+                    kind,
+                    facts,
+                    graph_role(g, node_id, kind),
+                    graph_seen(g, node_id, kind, facts),
+                )
+                self.assertEqual(replay, self.node_counts(g, node_id, kind, text))
+
+    @staticmethod
+    def node_counts(g, node_id, kind, text):
+        """What the executing node counted itself, from a recording database."""
+        db = mock.Mock()
+        db.get_prompt_by_hash.side_effect = lambda h: {"id": h}
+        db.save_prompt_pair.return_value = 1
+        negative = g[node_id]["inputs"].get("negative_text", "")
+        db.get_prompt_pair.return_value = {
+            "positive_prompt_id": generate_prompt_hash(text),
+            "negative_prompt_id": (
+                generate_prompt_hash(negative) if negative.strip() else None
+            ),
+        }
+        case = JobCase()
+        case.db = db
+        case.pending, case.pair_pending = PendingFirstUse(), PendingFirstUse()
+        case.runs = CachedRuns(context=lambda: (None, None))
+        case.trackers = []
+        case.context = (None, None)
+        if kind == "PromptManagerPair":
+            node = case.node(kind)
+            node.encode_prompt(
+                mock.Mock(), text, negative_text=negative, prompt=g, unique_id=node_id
+            )
+        else:
+            node = case.node(kind)
+            node._track_prompt_execution(text, text, None, None, {}, g, node_id)
+        counts = [("prompt", c.args[0]) for c in db.record_prompt_use.call_args_list]
+        if kind == "PromptManagerPair":
+            counts += [
+                ("pair", generate_prompt_hash(text), db.get_prompt_pair()[k])
+                for k in ["negative_prompt_id"]
+                if db.record_prompt_pair_use.called
+            ]
+        return counts
+
+
+class TestReceipts(unittest.TestCase):
+    def setUp(self):
+        self.context = ("j1", None)
+        self.runs = CachedRuns(
+            context=lambda: self.context, max_keys=2, max_receipts=2, max_items=3
+        )
+        self.g = {
+            name: {"class_type": "PromptManager", "inputs": {"text": name}}
+            for name in ("a", "b", "c")
+        }
+
+    def begin(self, item_id, prompt_id="j1"):
+        self.context = (prompt_id, None)
+        self.runs.begin_attempt(
+            ((item_id, prompt_id, self.g, {}, ["a", "b", "c"], {}), item_id)
+        )
+
+    def keys(self):
+        return list(self.runs._receipts)
+
+    def test_least_recently_used_run_keys_are_dropped(self):
+        self.begin(1)
+        for name in ("a", "b", "c"):
+            self.runs.record_item(name, (name,), Facts("h"))
+        self.assertEqual(self.keys(), [prompt_node_key(self.g, n) for n in ("b", "c")])
+
+    def test_receipts_per_key_are_bounded_and_equal_outputs_replace(self):
+        key = prompt_node_key(self.g, "a")
+        for item_id, text in ((1, "x"), (2, "y"), (3, "z"), (4, "y")):
+            self.begin(item_id)
+            self.runs.record_item("a", (text,), Facts(text))
+            self.runs.end_attempt(item_id)
+        receipts = self.runs._receipts[key]
+        self.assertEqual([r.item_id for r in receipts], [4, 3])
+
+    def test_list_indices_past_the_bound_are_not_recorded(self):
+        self.begin(1)
+        self.context = ("j1", 3)
+        self.runs.record_item("a", ("x",), Facts("x"))
+        self.assertEqual(self.keys(), [])
+
+    def test_non_string_outputs_and_unknown_nodes_are_not_recorded(self):
+        self.begin(1)
+        self.runs.record_item("a", (None,), Facts("x"))
+        self.runs.record_item("zzz", ("x",), Facts("x"))
+        self.assertEqual(self.keys(), [])
+
+    def test_task_done_clears_only_its_own_attempt(self):
+        self.begin(1)
+        self.runs.end_attempt(2)
+        self.runs.record_item("a", ("x",), Facts("x"))
+        self.runs.end_attempt(1)
+        self.runs.record_item("b", ("x",), Facts("x"))
+        self.assertEqual(self.keys(), [prompt_node_key(self.g, "a")])
+
+    def test_job_nodes_follow_the_outputs_to_execute(self):
+        self.runs.begin_attempt(((1, "j1", self.g, {}, ["b"], {}), 1))
+        self.assertEqual(list(self.runs._attempt.nodes), ["b"])
+
+
+class TestCacheReader(unittest.TestCase):
+    def setUp(self):
+        patcher = mock.patch.dict(sys.modules, host_modules())
+        patcher.start()
+        self.addCleanup(patcher.stop)
+        self.cache = LRUCache()
+        self.executor = types.SimpleNamespace(
+            caches=types.SimpleNamespace(outputs=self.cache)
+        )
+
+    def read(self, outputs, kind="PromptManager"):
+        self.cache.entries["n"] = Entry({}, outputs)
+        return cached_string_outputs(self.executor, "n", kind)
+
+    def test_reads_each_string_slot_in_order(self):
+        self.assertEqual(self.read([["c"], ["a", "b"]]), (("a", "b"),))
+        self.assertEqual(self.read([["t"]], "PromptManagerText"), (("t",),))
+        self.assertEqual(
+            self.read([[1], [2], ["p"], ["n"]], "PromptManagerPair"), (("p",), ("n",))
+        )
+
+    def test_fails_closed(self):
+        for outputs, kind in (
+            ([["c"], ["a", 1]], "PromptManager"),
+            ([["c"]], "PromptManager"),
+            ([["c"], ["a"] * 65], "PromptManager"),
+            ([[1], [2], ["p", "q"], ["n"]], "PromptManagerPair"),
+            ([["c"], "text"], "PromptManager"),
+            ([["c"], ["a"]], "CLIPTextEncode"),
+            ([[]] * 5, "PromptManager"),
+        ):
+            with self.subTest(outputs=outputs, kind=kind):
+                self.assertIsNone(self.read(outputs, kind))
+        self.cache.entries["m"] = ({}, [["c"], ["a"]])  # not a CacheEntry
+        self.assertIsNone(cached_string_outputs(self.executor, "m", "PromptManager"))
+        self.executor.caches.outputs = NullCache()
+        self.assertIsNone(self.read([["c"], ["a"]]))
+
+
+class TestGraphHelpers(unittest.TestCase):
+    def test_upstream_nodes_and_closure(self):
+        g = graph()
+        self.assertEqual(
+            set(upstream_nodes(g, ["save"])),
+            {"save", "ks", "pm", "llm", "str", "ckpt", "other"},
+        )
+        self.assertEqual(upstream_nodes(g, ["missing"]), [])
+        self.assertEqual(upstream_nodes(None, ["save"]), [])
+        self.assertIsNone(upstream_closure(g, ["save"], limit=2))
+        self.assertIsNone(upstream_closure({"a": {"inputs": {"x": ["b", 0]}}}, ["a"]))
+
+    def test_find_pair_by_hashes_matches_the_text_lookup(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            db = PromptDatabase(os.path.join(tmp, "p.db"))
+            try:
+                pair_id = db.save_prompt_pair("cat", "")
+                self.assertEqual(
+                    find_pair_id_by_hashes(db, generate_prompt_hash("cat"), None),
+                    pair_id,
+                )
+                self.assertIsNone(
+                    find_pair_id_by_hashes(
+                        db, generate_prompt_hash("cat"), generate_prompt_hash("x")
+                    )
+                )
+            finally:
+                db.close_all()
+            assert_closed(self, tmp)
+
+
+class TestRegistration(unittest.TestCase):
+    def setUp(self):
+        self.modules = host_modules()
+        patcher = mock.patch.dict(sys.modules, self.modules)
+        patcher.start()
+        self.addCleanup(patcher.stop)
+        flag = mock.patch.object(module, "_registered", threading.Event())
+        flag.start()
+        self.addCleanup(flag.stop)
+
+    class Queue:
+        def __init__(self):
+            self.done = []
+
+        def get(self, timeout=None):
+            return self.result
+
+        def task_done(self, item_id, *args, **kwargs):
+            self.done.append(item_id)
+
+    def test_registers_once_and_follows_the_job(self):
+        queue = self.Queue()
+        server = types.SimpleNamespace(prompt_queue=queue)
+        runs = mock.Mock()
+        self.assertTrue(register_cached_runs(server, lambda: "db", runs))
+        self.assertFalse(register_cached_runs(server, lambda: "db", runs))
+        queue.result = (("item",), 5)
+        queue.get()
+        runs.begin_attempt.assert_called_once_with((("item",), 5))
+        executor = self.modules["execution"].PromptExecutor()
+        executor.server = server
+        executor.add_message("execution_start", {"prompt_id": "j"}, broadcast=False)
+        executor.add_message(
+            "execution_cached", {"prompt_id": "j", "nodes": ["n"]}, broadcast=False
+        )
+        runs.replay.assert_called_once()
+        self.assertEqual(runs.replay.call_args.args[1:3], ("j", ["n"]))
+        other = self.modules["execution"].PromptExecutor()
+        other.server = types.SimpleNamespace(prompt_queue=object())
+        other.add_message("execution_cached", {"prompt_id": "j", "nodes": []}, False)
+        self.assertEqual(runs.replay.call_count, 1)
+        queue.task_done(5, None, status=None)
+        runs.end_attempt.assert_called_once_with(5)
+
+    def test_hosts_without_the_interfaces_register_nothing(self):
+        class NoTaskDone:
+            def get(self):
+                return None
+
+        self.assertFalse(
+            register_cached_runs(
+                types.SimpleNamespace(prompt_queue=NoTaskDone()), lambda: None
+            )
+        )
+        self.assertFalse(register_cached_runs(types.SimpleNamespace(), lambda: None))
+        del self.modules["execution"].PromptExecutor.add_message
+        self.assertFalse(
+            register_cached_runs(
+                types.SimpleNamespace(prompt_queue=self.Queue()), lambda: None
+            )
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_database_link_matches.py

@@ -0,0 +1,456 @@
+"""The prompt-link read of the workspace Images page (#354).
+
+``PromptDatabase.get_image_link_matches`` returns every row of its filter
+SELECT in one SQLite step (one JSON value) instead of one step per row, so the
+read does not have to win the GIL back once per linked image while ComfyUI
+generates. Its result must equal the streamed read it replaces, which stays as
+the fallback, on every filter and on odd values.
+"""
+
+import itertools
+import os
+import sqlite3
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+from unittest.mock import patch
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+from database import operations  # noqa: E402
+from database.operations import PromptDatabase, link_filter_query  # noqa: E402
+
+try:
+    from tests.open_handles import assert_closed  # noqa: E402
+except ImportError:  # discovered with tests/ as the top-level directory
+    from open_handles import assert_closed  # noqa: E402
+
+LOGGER = "prompt_manager.database"
+MISSING_FUNCTION_SQL = (
+    "SELECT pm_missing_function(json_group_array(json_array("
+    "file_path, rating, matched, positive))) FROM ({select})"
+)
+QUERIES = ("", "lantern", "LANTERN title", "no-such-text")
+CATEGORIES = (None, "cat-a", "cat-b", "cat-none")
+TAG_SETS = ([], ["t1"], ["t1", "t2"], ["t-none"])
+
+PROMPTS = (
+    # id, text, category, rating, tags, library title
+    (1, "red lantern at dusk", "cat-a", 5, ("t1", "t2"), None),
+    (2, "blue harbor", "cat-a", None, ("t1",), None),
+    (3, "green field", "cat-b", 3, (), "Lantern title"),
+    (4, "pair positive", "cat-b", 4, ("t2",), None),
+    (5, "pair negative lantern", "cat-a", 1, ("t1",), None),
+)
+QUOTED = '/out/it\'s "quoted".png'
+BACKSLASHED = "C:\\out\\back\\slash.png"
+UNICODE = "/out/ünïcødé 画像.png"
+NEWLINE = "/out/new\nline.png"
+IMAGES = (
+    # prompt id, file path
+    (1, "/out/a.png"),
+    (2, QUOTED),
+    (2, BACKSLASHED),
+    (3, UNICODE),
+    (1, NEWLINE),
+    (1, "/out/ambiguous.png"),
+    (2, "/out/ambiguous.png"),
+    (5, "/out/pair.png"),  # linked through pair 1: its positive is prompt 4
+    (3, "/out/two-pairs.png"),  # two pairs: no single pair, so prompt 3
+    (1, None),  # no file path: never listed
+)
+
+
+class LinkMatchesTestCase(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory()
+        self.root = Path(os.path.realpath(self.temp.name))
+        self.db = PromptDatabase(str(self.root / "prompts.db"))
+        for name in ("_one_step_unsupported", "_one_step_warned"):
+            patcher = patch.object(operations, name, False)
+            patcher.start()
+            self.addCleanup(patcher.stop)
+        self.statements = []
+        original = self.db.model.get_connection
+
+        def traced_connection():
+            connection = original()
+            connection.set_trace_callback(self.statements.append)
+            return connection
+
+        patcher = patch.object(
+            self.db.model, "get_connection", side_effect=traced_connection
+        )
+        patcher.start()
+        self.addCleanup(patcher.stop)
+
+    def tearDown(self):
+        self.db.close_all()
+        assert_closed(self, self.root)
+        self.temp.cleanup()
+
+    def seed(self):
+        with self.db.model.get_connection() as conn:
+            for prompt_id, text, category, rating, tags, title in PROMPTS:
+                conn.execute(
+                    "INSERT INTO prompts(id,text,category,rating,hash) "
+                    "VALUES(?,?,?,?,?)",
+                    (prompt_id, text, category, rating, f"hash-{prompt_id}"),
+                )
+                for tag in tags:
+                    conn.execute("INSERT OR IGNORE INTO tags(name) VALUES(?)", (tag,))
+                    conn.execute(
+                        "INSERT INTO prompt_tags(prompt_id,tag_id) "
+                        "SELECT ?, id FROM tags WHERE name=?",
+                        (prompt_id, tag),
+                    )
+                if title:
+                    conn.execute(
+                        "INSERT INTO prompt_library_state(prompt_id,title) "
+                        "VALUES(?,?)",
+                        (prompt_id, title),
+                    )
+            ids = {}
+            for prompt_id, path in IMAGES:
+                cursor = conn.execute(
+                    "INSERT INTO generated_images"
+                    "(prompt_id,image_path,filename,file_path) VALUES(?,?,?,?)",
+                    (prompt_id, path or "/elsewhere/x.png", "x.png", path),
+                )
+                ids.setdefault(path, cursor.lastrowid)
+            conn.execute(
+                "INSERT INTO prompt_pairs(id,positive_prompt_id,negative_prompt_id) "
+                "VALUES(1,4,5),(2,3,5),(3,3,NULL)"
+            )
+            conn.executemany(
+                "INSERT INTO image_prompt_pairs(image_id,pair_id,provenance) "
+                "VALUES(?,?,'{}')",
+                [
+                    (ids["/out/pair.png"], 1),
+                    (ids["/out/two-pairs.png"], 2),
+                    (ids["/out/two-pairs.png"], 3),
+                ],
+            )
+
+    def add_image(self, prompt_id, path):
+        with self.db.model.get_connection() as conn:
+            conn.execute(
+                "INSERT INTO generated_images(prompt_id,image_path,filename,file_path)"
+                " VALUES(?,?,?,?)",
+                (prompt_id, "/blob/x.png", "x.png", path),
+            )
+
+    def streamed(self, q, category, tags, every_link=False, wanted=None):
+        """Today's read, called directly (the fallback)."""
+        sql, params = link_filter_query(
+            q, tags, every_link=every_link, category=category
+        )
+        with self.db.model.get_connection() as conn:
+            return operations._streamed_link_matches(
+                conn, sql, params, wanted, category is not None
+            )
+
+    def selects(self):
+        found = [s for s in self.statements if s.lstrip().upper().startswith("SELECT")]
+        self.statements.clear()
+        return found
+
+
+class TestOneStepLinkRead(LinkMatchesTestCase):
+    def test_plain_read_returns_every_unambiguous_link(self):
+        self.seed()
+        matches = self.db.get_image_link_matches("", [], every_link=True)
+        self.assertEqual(
+            matches,
+            {
+                "/out/a.png": (True, 5, 1, None),
+                QUOTED: (True, None, 2, None),
+                BACKSLASHED: (True, None, 2, None),
+                UNICODE: (True, 3, 3, None),
+                NEWLINE: (True, 5, 1, None),
+                "/out/pair.png": (True, 4, 4, None),
+                "/out/two-pairs.png": (True, 3, 3, None),
+            },
+        )
+        self.assertIsNone(matches[QUOTED][1])
+        self.assertIsInstance(matches["/out/a.png"][1], int)
+        self.assertIsInstance(matches["/out/a.png"][2], int)
+
+    def test_search_hits_follow_text_title_and_tags(self):
+        self.seed()
+        self.assertEqual(
+            self.db.get_image_link_matches("lantern", []),
+            {
+                "/out/a.png": (True, 5, 1, None),
+                NEWLINE: (True, 5, 1, None),
+                UNICODE: (True, 3, 3, None),
+                "/out/two-pairs.png": (True, 3, 3, None),
+            },
+        )
+        self.assertEqual(
+            self.db.get_image_link_matches("lantern", [], category="cat-a"),
+            {
+                "/out/a.png": (True, 5, 1, "cat-a"),
+                NEWLINE: (True, 5, 1, "cat-a"),
+                QUOTED: (False, None, 2, "cat-a"),
+                BACKSLASHED: (False, None, 2, "cat-a"),
+            },
+        )
+
+    def test_every_filter_equals_the_streamed_read(self):
+        self.seed()
+        wanted_sets = (None, {"/out/a.png", UNICODE, "/out/pair.png", "/absent.png"})
+        for q, category, tags, every_link, wanted in itertools.product(
+            QUERIES, CATEGORIES, TAG_SETS, (False, True), wanted_sets
+        ):
+            with self.subTest(
+                q=q, category=category, tags=tags, every=every_link, wanted=wanted
+            ):
+                expected = self.streamed(q, category, tags, every_link, wanted)
+                self.statements.clear()
+                actual = self.db.get_image_link_matches(
+                    q,
+                    list(tags),
+                    every_link=every_link,
+                    wanted=wanted,
+                    category=category,
+                )
+                self.assertEqual(actual, expected)
+                self.assertEqual(
+                    {path: tuple(map(type, row)) for path, row in actual.items()},
+                    {path: tuple(map(type, row)) for path, row in expected.items()},
+                )
+                found = self.selects()
+                self.assertEqual(len(found), 1, found)
+                self.assertIn("json_group_array", found[0])
+
+    def test_empty_database_returns_nothing_in_one_statement(self):
+        self.assertEqual(self.db.get_image_link_matches("", [], every_link=True), {})
+        self.assertEqual(self.db.get_image_link_matches("x", ["t"], category="c"), {})
+        found = self.selects()
+        self.assertEqual(len(found), 2, found)
+        self.assertTrue(all("json_group_array" in query for query in found))
+
+    def test_wanted_limits_the_result_to_the_listing(self):
+        self.seed()
+        self.assertEqual(
+            self.db.get_image_link_matches(
+                "", [], every_link=True, wanted={"/out/pair.png", "/x.png"}
+            ),
+            {"/out/pair.png": (True, 4, 4, None)},
+        )
+        self.assertEqual(
+            self.db.get_image_link_matches("", [], every_link=True, wanted=set()),
+            {},
+        )
+
+    def test_category_read_carries_the_inherited_category_in_one_step(self):
+        # A recipe's own category wins over its positive's (#332 MC4); the
+        # read only narrows to links holding the value, the caller compares.
+        self.seed()
+        with self.db.model.get_connection() as conn:
+            conn.execute("UPDATE prompt_pairs SET category='cat-a' WHERE id=1")
+        self.statements.clear()
+        for category, expected in (
+            ("cat-a", {"/out/pair.png": (True, 4, 4, "cat-a")}),
+            ("cat-b", {"/out/pair.png": (True, 4, 4, "cat-a")}),
+        ):
+            with self.subTest(category=category):
+                actual = self.db.get_image_link_matches(
+                    "", [], every_link=True, category=category, wanted={"/out/pair.png"}
+                )
+                self.assertEqual(actual, expected)
+                self.assertEqual(
+                    actual, self.streamed("", category, [], True, {"/out/pair.png"})
+                )
+        found = [query for query in self.selects() if "json_group_array" in query]
+        self.assertEqual(len(found), 2, found)
+        self.assertTrue(all("pair_category" in query for query in found))
+
+    def test_plain_read_leaves_the_categories_out_of_the_json(self):
+        self.seed()
+        self.statements.clear()
+        self.db.get_image_link_matches("", [], every_link=True)
+        (query,) = self.selects()
+        aggregate = query[query.index("json_array(") :].split(")", 1)[0]
+        self.assertEqual(aggregate, "json_array(file_path, rating, matched, positive")
+
+    def test_read_releases_its_snapshot(self):
+        # A statement left open after the read would pin its WAL snapshot, and
+        # a TRUNCATE checkpoint from another connection would report busy.
+        self.seed()
+        self.assertTrue(self.db.get_image_link_matches("", [], every_link=True))
+        other = sqlite3.connect(str(self.root / "prompts.db"))
+        try:
+            other.execute("UPDATE prompts SET rating=2 WHERE id=1")
+            other.commit()
+            busy, _log, _done = other.execute(
+                "PRAGMA wal_checkpoint(TRUNCATE)"
+            ).fetchone()
+        finally:
+            other.close()
+        self.assertEqual(busy, 0)
+        self.assertEqual(os.path.getsize(self.root / "prompts.db-wal"), 0)
+
+    def test_wrapped_query_keeps_the_ambiguity_probe_an_index_search(self):
+        self.seed()
+        sql, params = link_filter_query(
+            "lantern", ["t1"], every_link=True, category="cat-a"
+        )
+        with self.db.model.get_connection() as conn:
+            plan = [
+                row[3]
+                for row in conn.execute(
+                    "EXPLAIN QUERY PLAN "
+                    + operations.link_matches_json_query(sql, categories=True),
+                    params,
+                )
+            ]
+        self.assertIn(
+            "SEARCH other USING COVERING INDEX idx_image_file_path (file_path=?)", plan
+        )
+        self.assertFalse([step for step in plan if step.startswith("SCAN other")])
+
+
+class TestStreamedFallback(LinkMatchesTestCase):
+    def test_missing_json_functions_stream_and_stop_trying(self):
+        self.seed()
+        expected = self.streamed("", None, [], True)
+        self.statements.clear()
+        wrapper = operations.link_matches_json_query
+        with (
+            patch.object(operations, "_LINK_MATCHES_JSON_SQL", MISSING_FUNCTION_SQL),
+            patch.object(
+                operations, "link_matches_json_query", side_effect=wrapper
+            ) as attempts,
+            self.assertLogs(LOGGER, "WARNING") as logged,
+        ):
+            first = self.db.get_image_link_matches("", [], every_link=True)
+            found = self.selects()
+            self.assertEqual(attempts.call_count, 1)
+            second = self.db.get_image_link_matches("", [], every_link=True)
+            again = self.selects()
+        self.assertEqual(first, expected)
+        self.assertEqual(second, expected)
+        self.assertEqual(len(logged.records), 1, logged.output)
+        self.assertIn("no such function: pm_missing_function", logged.output[0])
+        self.assertTrue(operations._one_step_unsupported)
+        # SQLite refuses the wrapped statement before it runs (not traced).
+        self.assertEqual(len(found), 1, found)
+        self.assertNotIn("json_group_array", found[0])
+        # The next read skips the attempt for the rest of the process.
+        self.assertEqual(attempts.call_count, 1)
+        self.assertEqual(len(again), 1, again)
+        self.assertNotIn("json_group_array", again[0])
+
+    def test_blob_path_streams_that_read_and_keeps_trying(self):
+        self.seed()
+        self.add_image(2, b"/out/blob.png")
+        expected = self.streamed("", None, [], True)
+        self.assertEqual(expected[b"/out/blob.png"], (True, None, 2, None))
+        self.statements.clear()
+        with self.assertLogs(LOGGER, "WARNING") as logged:
+            first = self.db.get_image_link_matches("", [], every_link=True)
+            second = self.db.get_image_link_matches("", [], every_link=True)
+        self.assertEqual(first, expected)
+        self.assertEqual(second, expected)
+        self.assertEqual(len(logged.records), 1, logged.output)
+        self.assertFalse(operations._one_step_unsupported)
+        found = self.selects()
+        self.assertEqual(sum("json_group_array" in query for query in found), 2)
+        self.assertEqual(len(found), 4, found)
+
+    def test_blob_that_reads_as_json_still_streams(self):
+        # SQLite 3.45+ reads a BLOB that is valid JSONB as JSON (b"\x00" is
+        # null) instead of refusing it; the streamed read keeps the bytes.
+        self.seed()
+        self.add_image(2, b"\x00")
+        expected = self.streamed("", None, [], True)
+        self.assertIn(b"\x00", expected)
+        with self.assertLogs(LOGGER, "WARNING"):
+            self.assertEqual(
+                self.db.get_image_link_matches("", [], every_link=True), expected
+            )
+        self.assertFalse(operations._one_step_unsupported)
+
+    def test_blob_rating_streams(self):
+        self.seed()
+        with self.db.model.get_connection() as conn:
+            # Only a database written around the CHECK can hold one.
+            conn.execute("PRAGMA ignore_check_constraints=ON")
+            conn.execute("UPDATE prompts SET rating=? WHERE id=3", (b"\x00",))
+            conn.execute("PRAGMA ignore_check_constraints=OFF")
+        expected = self.streamed("", None, [], True)
+        self.assertEqual(expected[UNICODE], (True, b"\x00", 3, None))
+        with self.assertLogs(LOGGER, "WARNING"):
+            self.assertEqual(
+                self.db.get_image_link_matches("", [], every_link=True), expected
+            )
+
+    def test_blob_category_streams_a_category_read(self):
+        self.seed()
+        with self.db.model.get_connection() as conn:
+            # Admitted by its recipe's text category; the positive's is a BLOB.
+            conn.execute("UPDATE prompts SET category=? WHERE id=4", (b"cat-b",))
+            conn.execute("UPDATE prompt_pairs SET category='cat-b' WHERE id=1")
+        expected = self.streamed("", "cat-b", [], True)
+        self.assertEqual(expected["/out/pair.png"], (True, 4, 4, "cat-b"))
+        with self.assertLogs(LOGGER, "WARNING") as logged:
+            actual = self.db.get_image_link_matches(
+                "", [], every_link=True, category="cat-b"
+            )
+        self.assertEqual(actual, expected)
+        self.assertIn("BLOB", logged.output[0])
+        self.assertFalse(operations._one_step_unsupported)
+
+    def test_json_text_over_the_length_limit_streams(self):
+        self.seed()
+        expected = self.streamed("", None, [], True)
+        conn = self.db.model.get_connection()
+        limit = conn.setlimit(sqlite3.SQLITE_LIMIT_LENGTH, 200)
+        try:
+            with self.assertLogs(LOGGER, "WARNING") as logged:
+                actual = self.db.get_image_link_matches("", [], every_link=True)
+        finally:
+            conn.setlimit(sqlite3.SQLITE_LIMIT_LENGTH, limit)
+        self.assertEqual(actual, expected)
+        self.assertIn("too big", logged.output[0])
+        self.assertFalse(operations._one_step_unsupported)
+
+    def test_an_interrupted_read_raises_without_a_fallback(self):
+        # Move library interrupts a retired connection: the read fails as
+        # before, and the one warning is kept for a real fallback.
+        self.seed()
+        conn = self.db.model.get_connection()
+        conn.set_progress_handler(lambda: 1, 1)
+        self.statements.clear()
+        try:
+            with (
+                self.assertNoLogs(LOGGER, "WARNING"),
+                self.assertRaisesRegex(sqlite3.OperationalError, "^interrupted$"),
+            ):
+                self.db.get_image_link_matches("", [], every_link=True)
+        finally:
+            conn.set_progress_handler(None, 1)
+        self.assertFalse(operations._one_step_warned)
+        self.assertFalse(operations._one_step_unsupported)
+        self.assertFalse([s for s in self.statements if "json_group_array" not in s])
+
+    def test_the_maintenance_link_rows_reader_is_not_shadowed(self):
+        from database.maintenance import MaintenanceOperations
+
+        self.assertIs(PromptDatabase._link_rows, MaintenanceOperations._link_rows)
+
+    def test_a_failed_streamed_read_still_raises(self):
+        with (
+            patch.object(operations, "_LINK_MATCHES_JSON_SQL", MISSING_FUNCTION_SQL),
+            patch.object(operations, "_LINK_FILTER_SQL", "SELECT broken FROM nowhere"),
+            self.assertLogs(LOGGER, "WARNING"),
+        ):
+            with self.assertRaises(sqlite3.OperationalError):
+                self.db.get_image_link_matches("", [], every_link=True)
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_duplicate_image_categories.py

@@ -0,0 +1,151 @@
+"""Duplicate cleanup keeps images' own categories (#332 MC11).
+
+The kept copy's own category wins; a kept copy without one receives the
+removed copy's. The removed copy's row is never deleted, so a give-back
+(the kept copy changed) and a failed delete lose nothing.
+"""
+
+import asyncio
+import os
+from unittest.mock import patch
+
+try:
+    from tests.test_api_duplicate_files import WAIT, DuplicateFilesTestCase
+except ImportError:  # discovered with tests/ as the top-level directory
+    from test_api_duplicate_files import WAIT, DuplicateFilesTestCase
+
+from py.api import duplicate_files  # noqa: E402
+from py.api.images import image_category_key  # noqa: E402
+from py.config import GalleryConfig  # noqa: E402
+
+
+class TestDuplicateCleanupKeepsCategories(DuplicateFilesTestCase):
+    def key(self, path):
+        return image_category_key(self.api._get_all_output_dirs(), path)
+
+    def category(self, path):
+        return self.api.db.image_category(*self.key(path))
+
+    def set_category(self, path, value):
+        self.api.db.set_image_categories([self.key(path)], value)
+
+    async def run_cleanup(self, keep="a.png"):
+        job, group = await self.found_group()
+        plan = await self.review(job.id, [self.keep_of(group, keep)])
+        body = await self.apply(plan["token"])
+        cleanup = self.api._jobs.get(body["job"]["id"])
+        await asyncio.wait_for(asyncio.shield(cleanup.task), WAIT)
+        return cleanup
+
+    async def test_kept_copy_without_a_category_receives_the_removed_one(self):
+        self.trio()
+        b = self.output_dir / "b.png"
+        self.set_category(b, "Portraits")
+        cleanup = await self.run_cleanup()
+        self.assertFalse(b.exists())
+        self.assertEqual(self.category(self.output_dir / "a.png"), "Portraits")
+        # The removed copy's row stays (hidden while its file is gone).
+        self.assertEqual(self.category(b), "Portraits")
+        self.assertIn(
+            "Kept 1 image category on the kept copies", "\n".join(cleanup.log)
+        )
+
+    async def test_kept_copy_keeps_its_own_category(self):
+        self.trio()
+        self.set_category(self.output_dir / "a.png", "Landscapes")
+        self.set_category(self.output_dir / "b.png", "Portraits")
+        self.set_category(self.output_dir / "sub" / "c.png", "Scans")
+        cleanup = await self.run_cleanup()
+        self.assertEqual(self.category(self.output_dir / "a.png"), "Landscapes")
+        self.assertNotIn("image categor", "\n".join(cleanup.log))
+
+    async def test_two_removed_copies_give_the_first_category(self):
+        self.trio()
+        self.set_category(self.output_dir / "b.png", "Portraits")
+        self.set_category(self.output_dir / "sub" / "c.png", "Scans")
+        cleanup = await self.run_cleanup()
+        self.assertIn(self.category(self.output_dir / "a.png"), {"Portraits", "Scans"})
+        self.assertIn(
+            "Kept 1 image category on the kept copies", "\n".join(cleanup.log)
+        )
+
+    async def test_give_back_loses_no_category(self):
+        self.trio()
+        self.set_category(self.output_dir / "b.png", "Portraits")
+        with patch.object(duplicate_files, "still_kept", return_value=False):
+            cleanup = await self.run_cleanup()
+        self.assertEqual(cleanup.counters["removed"], 0)
+        rows = {row["path"]: row["detail"] for row in cleanup.outcomes["kept"]}
+        self.assertEqual(
+            rows["b.png"], duplicate_files.ROW_DETAILS[duplicate_files.KEEPER_GONE]
+        )
+        self.assertTrue((self.output_dir / "b.png").is_file())
+        self.assertEqual(self.category(self.output_dir / "b.png"), "Portraits")
+
+    async def test_a_failed_delete_keeps_both_categories(self):
+        self.trio()
+        self.set_category(self.output_dir / "b.png", "Portraits")
+        real = duplicate_files._unlink
+
+        def unlink(path):
+            if os.path.basename(path) == "b.png":
+                raise PermissionError(13, "denied")
+            real(path)
+
+        with patch.object(duplicate_files, "_unlink", side_effect=unlink):
+            await self.run_cleanup()
+        self.assertTrue((self.output_dir / "b.png").is_file())
+        self.assertEqual(self.category(self.output_dir / "b.png"), "Portraits")
+        self.assertEqual(self.category(self.output_dir / "a.png"), "Portraits")
+
+    async def test_nested_sources_use_the_deepest_source_keys(self):
+        self.write("sub/a.png", b"same", mtime=1)
+        self.write("sub/b.png", b"same", mtime=2)
+        # The subfolder is listed first, so the cleanup's listed root is the
+        # file key's source; the outer source still holds the files.
+        GalleryConfig.MONITORING_DIRECTORIES = [
+            self._root(self.output_dir / "sub"),
+            self._root(self.output_dir),
+        ]
+        sub_key = duplicate_files.favorite_root_key(self.output_dir / "sub")
+        self.api.db.set_image_categories([(sub_key, "b.png")], "Portraits")
+        await self.run_cleanup()
+        self.assertFalse((self.output_dir / "sub" / "b.png").exists())
+        self.assertEqual(self.api.db.image_category(sub_key, "a.png"), "Portraits")
+        outer_key = duplicate_files.favorite_root_key(self.output_dir)
+        self.assertIsNone(self.api.db.image_category(outer_key, "sub/a.png"))
+
+    async def test_outer_source_listed_first_still_keys_by_the_deepest(self):
+        self.write("sub/a.png", b"same", mtime=1)
+        self.write("sub/b.png", b"same", mtime=2)
+        GalleryConfig.MONITORING_DIRECTORIES = [
+            self._root(self.output_dir),
+            self._root(self.output_dir / "sub"),
+        ]
+        sub_key = duplicate_files.favorite_root_key(self.output_dir / "sub")
+        self.api.db.set_image_categories([(sub_key, "b.png")], "Portraits")
+        job, group = await self.found_group()
+        [kept] = [f for f in group["files"] if f["path"].endswith("a.png")][:1]
+        plan = await self.review(
+            job.id, [self.keep_of(group, kept["path"], kept["root_index"])]
+        )
+        body = await self.apply(plan["token"])
+        cleanup = self.api._jobs.get(body["job"]["id"])
+        await asyncio.wait_for(asyncio.shield(cleanup.task), WAIT)
+        self.assertFalse((self.output_dir / "sub" / "b.png").exists())
+        self.assertEqual(self.api.db.image_category(sub_key, "a.png"), "Portraits")
+
+    async def test_a_symlinked_output_folder_still_moves_the_category(self):
+        link = self.output_dir.parent / "linked-output"
+        try:
+            os.symlink(self.output_dir, link, target_is_directory=True)
+        except (OSError, NotImplementedError):
+            self.skipTest("symlinks are not available")
+        self.trio()
+        with patch.object(self.api, "_get_all_output_dirs", return_value=[link]):
+            key = image_category_key([link], link / "b.png")
+            self.api.db.set_image_categories([key], "Portraits")
+            await self.run_cleanup()
+            kept = image_category_key([link], link / "a.png")
+        self.assertFalse((self.output_dir / "b.png").exists())
+        self.assertEqual(self.api.db.image_category(*kept), "Portraits")

tests/test_exit_cancel.py

@@ -0,0 +1,463 @@
+"""Work running at Ctrl+C stops at its next safe point (#376).
+
+ComfyUI catches Ctrl+C in ``main.py`` and returns without closing its event
+loop. Python then joins every executor thread (``concurrent.futures``'s
+``_python_exit``, a ``threading._register_atexit`` callback) before any
+``atexit`` callback runs, so a call still running on the default executor
+used to keep the process alive until it returned. The package registers its
+own ``threading._register_atexit`` hook, which runs before that join: it sets
+the exit signal that ``Job.cancelled`` and ``map_parallel`` read, and kills
+the encoder processes.
+
+The child-process test starts three long calls on the default executor (a
+registry job checking ``job.cancelled`` between files, a ``map_parallel``
+batch and an encoder process that ignores the exit, as ffmpeg does on
+Windows), returns from its main module and must exit far sooner than any of
+them would end.
+"""
+
+import json
+import os
+import subprocess
+import sys
+import tempfile
+import textwrap
+import threading
+import unittest
+from unittest import mock
+
+ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+sys.path.insert(0, ROOT)
+
+try:
+    from utils import exit_signal  # noqa: E402
+except ImportError:  # before #376: only the child-process test can run
+    exit_signal = None
+
+# The parent never waits longer than this for the child (the hang watchdog
+# allows 120 s per test). Each fake job alone would run 300 s or more.
+CHILD_CEILING_SECONDS = 60
+# From the child's return to its last atexit callback: the stopped calls end
+# at their next file, item or chunk (the encoder is killed).
+EXIT_BOUND_SECONDS = 15
+JOB_SECONDS = 600
+# The fake encoder outlives the ceiling, yet a failing run leaks it only
+# briefly (the parent cannot reach the child's own child to kill it).
+ENCODER_SECONDS = 90
+REPORT_PREFIX = "PM_EXIT_REPORT "
+
+CHILD = textwrap.dedent("""
+    import asyncio
+    import atexit
+    import contextlib
+    import importlib
+    import io
+    import json
+    import os
+    import sys
+    import threading
+    import time
+
+    root, tmp = sys.argv[1], sys.argv[2]
+    job_seconds, encoder_seconds = float(sys.argv[3]), int(sys.argv[4])
+    sys.path.insert(0, root)
+    state = {"stopped": {}}
+
+    def report():
+        returned = state.get("returned")
+        print("PM_EXIT_REPORT " + json.dumps({
+            "exit_seconds": None if returned is None else time.monotonic() - returned,
+            "stopped": state["stopped"],
+        }))
+        sys.stdout.flush()
+
+    # Registered first, so it runs after every other atexit callback, and
+    # every atexit callback runs after the executor threads were joined.
+    atexit.register(report)
+
+    from tests.test_init_package import _import_package, fake_server_module
+
+    output = os.path.join(tmp, "output")
+    with contextlib.redirect_stdout(io.StringIO()):
+        package, _ = _import_package(
+            "pm_exit_child",
+            os.path.join(tmp, "prompts.db"),
+            output,
+            fake_server_module(queue_task_done=True),
+        )
+    parallel = importlib.import_module("pm_exit_child.utils.parallel")
+    encode = importlib.import_module("pm_exit_child.py.api.thumbnail_encode")
+    registry = package.api._jobs
+    entered = {name: threading.Event() for name in ("job", "batch", "encoder")}
+
+    def job_work(job):
+        # A job's thread work: one "file" at a time, checking its cancel
+        # between files the way the thumbnail and import jobs do.
+        entered["job"].set()
+        deadline = time.monotonic() + job_seconds
+        while time.monotonic() < deadline:
+            if job.cancelled:
+                state["stopped"]["job"] = True
+                return
+            time.sleep(0.05)
+
+    def batch_item(index):
+        entered["batch"].set()
+        time.sleep(0.5)
+        return index
+
+    def batch_work():
+        try:
+            parallel.map_parallel(batch_item, range(int(job_seconds)), 2)
+        except Exception as error:
+            state["stopped"]["batch"] = type(error).__name__
+
+    def encoder_work():
+        # Stands for ffmpeg on Windows, which runs without a console and
+        # never sees Ctrl+C: only a kill ends it before its timeout.
+        cmd = [sys.executable, "-c", "import time; time.sleep(%d)" % encoder_seconds]
+        try:
+            encode.run_encoder(
+                cmd,
+                timeout=encoder_seconds,
+                track=lambda _process: entered["encoder"].set(),
+            )
+        except Exception as error:
+            state["stopped"]["encoder"] = type(error).__name__
+
+    async def begin():
+        loop = asyncio.get_running_loop()
+
+        async def runner(job):
+            await loop.run_in_executor(None, job_work, job)
+
+        registry.start("exit-test", "Exit test", admission="read", runner=runner)
+        loop.run_in_executor(None, batch_work)
+        loop.run_in_executor(None, encoder_work)
+        for name, event in entered.items():
+            if not await loop.run_in_executor(None, event.wait, 30):
+                sys.exit("not started: " + name)
+
+    loop = asyncio.new_event_loop()
+    asyncio.set_event_loop(loop)
+    loop.run_until_complete(begin())
+    state["returned"] = time.monotonic()
+    # Return with the three calls running and the loop open, as ComfyUI does
+    # after Ctrl+C.
+    """)
+
+
+class TestExitStopsRunningWork(unittest.TestCase):
+    def test_running_executor_work_stops_at_exit(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            os.makedirs(os.path.join(tmp, "output"))
+            script = os.path.join(tmp, "child.py")
+            with open(script, "w", encoding="utf-8") as handle:
+                handle.write(CHILD)
+            env = dict(os.environ)
+            env.pop("PROMPT_MANAGER_CONFIG_PATH", None)
+            env["PROMPT_MANAGER_DATA_DIR"] = tmp
+            env["PYTHONIOENCODING"] = "utf-8"
+            try:
+                completed = subprocess.run(
+                    [
+                        sys.executable,
+                        script,
+                        ROOT,
+                        tmp,
+                        str(JOB_SECONDS),
+                        str(ENCODER_SECONDS),
+                    ],
+                    cwd=ROOT,
+                    env=env,
+                    capture_output=True,
+                    timeout=CHILD_CEILING_SECONDS,
+                    encoding="utf-8",
+                    errors="replace",
+                )
+            except subprocess.TimeoutExpired as hung:
+                self.fail(
+                    f"the child did not exit within {CHILD_CEILING_SECONDS} s\n"
+                    f"stdout:\n{hung.stdout}\nstderr:\n{hung.stderr}"
+                )
+        detail = f"stdout:\n{completed.stdout}\nstderr:\n{completed.stderr}"
+        self.assertEqual(completed.returncode, 0, detail)
+        reports = [
+            line[len(REPORT_PREFIX) :]
+            for line in completed.stdout.splitlines()
+            if line.startswith(REPORT_PREFIX)
+        ]
+        self.assertEqual(len(reports), 1, detail)
+        report = json.loads(reports[0])
+        self.assertLess(report["exit_seconds"], EXIT_BOUND_SECONDS, detail)
+        self.assertEqual(
+            report["stopped"],
+            {"job": True, "batch": "ExitRequested", "encoder": "EncoderClosed"},
+            detail,
+        )
+        for text in ("Traceback", "Background work not stopped in time"):
+            self.assertNotIn(text, completed.stderr, detail)
+
+
+class _Isolated(unittest.TestCase):
+    """Each test starts with the signal clear and no hook installed."""
+
+    def setUp(self):
+        exit_signal.reset()
+        self.addCleanup(exit_signal.reset)
+
+
+class TestInstall(_Isolated):
+    def test_the_hook_is_registered_once_before_the_executor_join(self):
+        calls = []
+        with mock.patch.object(
+            exit_signal.threading,
+            "_register_atexit",
+            side_effect=lambda func: calls.append(func),
+            create=True,
+        ):
+            self.assertTrue(exit_signal.install())
+            self.assertTrue(exit_signal.install())
+        self.assertEqual(len(calls), 1)
+        self.assertFalse(exit_signal.requested())
+        calls[0]()
+        self.assertTrue(exit_signal.requested())
+
+    def test_a_missing_internal_hook_degrades_to_the_old_exit(self):
+        with mock.patch.object(exit_signal, "threading") as fake:
+            del fake._register_atexit
+            self.assertFalse(exit_signal.install())
+        self.assertFalse(exit_signal.requested())
+
+    def test_a_refused_registration_degrades_to_the_old_exit(self):
+        refuse = RuntimeError("can't register atexit after shutdown")
+        with mock.patch.object(
+            exit_signal.threading, "_register_atexit", side_effect=refuse, create=True
+        ):
+            self.assertFalse(exit_signal.install())
+
+    def test_a_failing_exit_action_never_escapes_the_hook(self):
+        # An exception out of a threading atexit callback would abort
+        # threading._shutdown and skip the executor join itself.
+        calls = []
+
+        def boom():
+            raise KeyboardInterrupt  # a second Ctrl+C
+
+        with mock.patch.object(
+            exit_signal.threading,
+            "_register_atexit",
+            side_effect=lambda func: calls.append(func),
+            create=True,
+        ):
+            exit_signal.install(boom)
+        with self.assertLogs(exit_signal.logger, "ERROR"):
+            calls[0]()
+        self.assertTrue(exit_signal.requested())
+
+
+class TestCheckpoints(_Isolated):
+    def test_checked_runs_until_the_signal_then_raises(self):
+        seen = []
+        record = exit_signal.checked(seen.append)
+        record(1)
+        exit_signal.request()
+        with self.assertRaises(exit_signal.ExitRequested):
+            record(2)
+        self.assertEqual(seen, [1])
+
+    def test_map_parallel_starts_no_item_after_the_signal(self):
+        from utils.parallel import map_parallel
+
+        started = []
+        gate = threading.Event()
+
+        def item(index):
+            started.append(index)
+            if index == 0:
+                exit_signal.request()
+                gate.set()
+            return index
+
+        with self.assertRaises(exit_signal.ExitRequested):
+            map_parallel(item, range(50), 1)
+        self.assertTrue(gate.is_set())
+        self.assertEqual(started, [0])
+
+    def test_job_cancelled_follows_the_signal_and_its_own_cancel(self):
+        from py.api.jobs import Job
+
+        job = Job("scan", "Scan", admission="records")
+        self.assertFalse(job.cancelled)
+        job.cancelled = True
+        self.assertTrue(job.cancelled)
+        other = Job("scan", "Scan", admission="records", cancellable=False)
+        exit_signal.request()
+        self.assertTrue(other.cancelled)
+
+    def test_the_scan_walk_stops_between_directories(self):
+        from py.api.admin import _collect_media_files
+
+        with tempfile.TemporaryDirectory() as tmp:
+            for name in ("a", "b"):
+                os.makedirs(os.path.join(tmp, name))
+                with open(os.path.join(tmp, name, "x.png"), "wb") as image:
+                    image.write(b"x")
+            self.assertEqual(len(_collect_media_files([tmp], [".png"])), 2)
+            exit_signal.request()
+            with self.assertRaises(exit_signal.ExitRequested):
+                _collect_media_files([tmp], [".png"])
+
+
+class TestLoraImportStopsAtExit(_Isolated):
+    def test_staging_stops_before_the_next_sidecar_whatever_the_caller_checks(self):
+        import types
+
+        from py import lora_import
+
+        discovery = types.SimpleNamespace(
+            sidecars=[object(), object()], unreadable=[], layout=None
+        )
+        exit_signal.request()
+        with tempfile.TemporaryDirectory() as tmp:
+            with self.assertRaises(lora_import.ImportCancelled):
+                lora_import.stage(
+                    discovery,
+                    tmp,
+                    media_extensions=frozenset(),
+                    cancelled=lambda: False,  # the legacy scan's own check
+                )
+
+
+class _FakeTqdm:
+    """huggingface_hub.utils.tqdm as far as a download uses it."""
+
+    def __init__(self, *args, **kwargs):
+        self.n = 0
+
+    def update(self, n=1):
+        self.n += n
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *exc):
+        return False
+
+
+def _fake_hub(chunks_before_exit):
+    """A ``huggingface_hub`` whose download writes chunks to a temp file and,
+    like huggingface_hub 1.x, removes it on any failure before the rename."""
+    import types
+
+    def hf_hub_download(
+        repo_id, filename, local_dir=None, local_dir_use_symlinks=None, tqdm_class=None
+    ):
+        final = os.path.join(local_dir, filename)
+        partial = final + ".abc.incomplete"
+        bar = (tqdm_class or _FakeTqdm)(total=10)
+        try:
+            with open(partial, "wb") as handle:
+                for index in range(10):
+                    if index == chunks_before_exit:
+                        exit_signal.request()
+                    bar.update(1)
+                    handle.write(b"x")
+            os.replace(partial, final)
+        finally:
+            if os.path.exists(partial):
+                os.unlink(partial)
+        return final
+
+    hub = types.ModuleType("huggingface_hub")
+    hub.hf_hub_download = hf_hub_download
+    hub.snapshot_download = lambda **kwargs: None
+    utils = types.ModuleType("huggingface_hub.utils")
+    utils.tqdm = _FakeTqdm
+    hub.utils = utils
+    return {"huggingface_hub": hub, "huggingface_hub.utils": utils}
+
+
+class TestModelDownloadStopsAtExit(_Isolated):
+    def test_a_download_stops_between_chunks_and_leaves_no_file(self):
+        from py.autotag import AutoTagService
+
+        with tempfile.TemporaryDirectory() as tmp:
+            service = AutoTagService(models_dir=tmp)
+            with mock.patch.dict(sys.modules, _fake_hub(chunks_before_exit=3)):
+                with self.assertLogs(service.logger, "INFO") as logs:
+                    self.assertFalse(service.download_model("wd14-vit"))
+            folder = os.path.join(tmp, "WD14-ViT")
+            self.assertEqual(os.listdir(folder), [])
+        self.assertTrue(any("exiting" in line for line in logs.output), logs.output)
+        self.assertFalse(any("Download failed" in line for line in logs.output))
+
+    def test_a_download_without_the_signal_finishes(self):
+        from py.autotag import AutoTagService
+
+        with tempfile.TemporaryDirectory() as tmp:
+            service = AutoTagService(models_dir=tmp)
+            with mock.patch.dict(sys.modules, _fake_hub(chunks_before_exit=None)):
+                self.assertTrue(service.download_model("wd14-vit"))
+            folder = os.path.join(tmp, "WD14-ViT")
+            self.assertEqual(
+                sorted(os.listdir(folder)), ["model.onnx", "selected_tags.csv"]
+            )
+
+    def test_xet_transfers_are_aborted_the_way_hub_aborts_on_ctrl_c(self):
+        import types
+
+        from py.autotag import abort_hub_downloads
+
+        aborted = []
+        xet = types.ModuleType("huggingface_hub.utils._xet")
+        xet.abort_xet_session = lambda: aborted.append(True)
+        hub = _fake_hub(chunks_before_exit=None)
+        hub["huggingface_hub.utils._xet"] = xet
+        hub["huggingface_hub.utils"]._xet = xet
+        with mock.patch.dict(sys.modules, hub):
+            abort_hub_downloads()
+        self.assertEqual(aborted, [True])
+        with mock.patch.dict(sys.modules):
+            sys.modules.pop("huggingface_hub", None)
+            abort_hub_downloads()  # never imported: nothing to abort
+        self.assertEqual(aborted, [True])
+
+    def test_an_aborted_xet_download_is_logged_as_stopped(self):
+        from py.autotag import AutoTagService
+
+        hub = _fake_hub(chunks_before_exit=None)
+
+        def aborted(*args, **kwargs):
+            exit_signal.request()  # the hook ran, then hub raised
+            raise RuntimeError("xet session aborted")
+
+        hub["huggingface_hub"].hf_hub_download = aborted
+        with tempfile.TemporaryDirectory() as tmp:
+            service = AutoTagService(models_dir=tmp)
+            with mock.patch.dict(sys.modules, hub):
+                with self.assertLogs(service.logger, "INFO") as logs:
+                    self.assertFalse(service.download_model("wd14-vit"))
+        self.assertTrue(any("exiting" in line for line in logs.output), logs.output)
+        self.assertFalse(any("Download failed" in line for line in logs.output))
+
+    def test_an_old_hub_without_tqdm_class_downloads_as_before(self):
+        from py.autotag import AutoTagService
+
+        hub = _fake_hub(chunks_before_exit=None)
+        full = hub["huggingface_hub"].hf_hub_download
+
+        def old_download(
+            repo_id, filename, local_dir=None, local_dir_use_symlinks=None
+        ):
+            return full(repo_id, filename, local_dir, local_dir_use_symlinks)
+
+        hub["huggingface_hub"].hf_hub_download = old_download
+        with tempfile.TemporaryDirectory() as tmp:
+            service = AutoTagService(models_dir=tmp)
+            with mock.patch.dict(sys.modules, hub):
+                self.assertTrue(service.download_model("wd14-vit"))
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_file_prompt.py

@@ -0,0 +1,705 @@
+"""The per-file prompt decision shared by the scan and the monitor (#247).
+
+One test per case, named by the ladder step of the design
+(``docs/egm/247-foreign-workflows``). The ladder does no file or database
+I/O: history comes in through ``lookup``.
+"""
+
+import json
+import unittest
+from unittest import mock
+
+from database.run_attribution import RecordedOutput
+from tests.test_pair_scan import flux_graph, sampled_graph
+from tests.test_prompt_attribution import issue_graph, pair_evidence
+from tests import test_save_to_library as save_tests
+from utils import file_prompt
+from utils.file_prompt import Policy, decide_file_prompt, junk_text
+from utils.prompt_inspector import InspectionResult
+
+try:
+    from tests import inspection_parity as parity
+    from tests import saver_anchor_graphs as shapes
+except ImportError:  # pragma: no cover - discover -s tests puts tests/ first
+    import inspection_parity as parity
+    import saver_anchor_graphs as shapes
+
+SHARED_NAME = "IMG_GEN_00371_.png"
+LORA = "<lora:style:1.00>"
+
+
+def _decide(
+    metadata,
+    *,
+    policy=Policy.SCAN,
+    lookup=None,
+    in_output=True,
+    file_name=SHARED_NAME,
+    file_size=None,
+):
+    return decide_file_prompt(
+        metadata,
+        file_name=file_name,
+        file_size=file_size,
+        in_output=in_output,
+        lookup=lookup,
+        policy=policy,
+    )
+
+
+def _graph(graph):
+    return {"prompt": json.dumps(graph)}
+
+
+class _Lookup:
+    """A history lookup that counts its calls."""
+
+    def __init__(self, saver=None):
+        self.calls = 0
+        self.found = RecordedOutput(saver, {}) if saver is not None else None
+
+    def __call__(self):
+        self.calls += 1
+        return self.found
+
+
+def _inspected(state, malformed=False):
+    resolution = {"state": state, "positive": None, "negative": None}
+    return InspectionResult(resolution, malformed=malformed)
+
+
+def _untraced_by_both():
+    """A sampled graph whose positive no profile traces; the legacy parser does."""
+    return mock.patch.object(
+        file_prompt, "inspection_resolution", return_value=_inspected("unresolved")
+    )
+
+
+def _gated(graph):
+    """``graph`` past the default profile's node gate, so it is unresolved."""
+    graph = dict(graph)
+    for index in range(510):
+        graph[f"pad{index}"] = {"class_type": "Note", "inputs": {}}
+    return graph
+
+
+def _prompt_manager_branches(prepend="PRE", append="APP"):
+    """Two KSampler branches, each fed by a PromptManagerText string."""
+    graph = sampled_graph()
+    del graph["1"]
+    sampler = graph.pop("3")
+    for index, text in enumerate(("a cat", "a dog"), start=1):
+        base = index * 10
+        graph[str(base)] = {
+            "class_type": "PromptManagerText",
+            "inputs": {"text": text, "prepend_text": prepend, "append_text": append},
+        }
+        graph[str(base + 1)] = {
+            "class_type": "CLIPTextEncode",
+            "inputs": {"text": [str(base), 0]},
+        }
+        graph[str(base + 2)] = {
+            **sampler,
+            "inputs": {**sampler["inputs"], "positive": [str(base + 1), 0]},
+        }
+    return graph
+
+
+def _numeric_first_branches():
+    """Three branches; the legacy parser's answer (the first) is a number."""
+    graph = sampled_graph("2048")
+    for index, text in ((5, "a cat"), (6, "a dog")):
+        graph[str(index * 10)] = {
+            "class_type": "CLIPTextEncode",
+            "inputs": {"text": text},
+        }
+        graph[str(index * 10 + 1)] = {
+            **graph["3"],
+            "inputs": {**graph["3"]["inputs"], "positive": [str(index * 10), 0]},
+        }
+    return graph
+
+
+class TestStepsBeforeResolving(unittest.TestCase):
+    def test_step_1_no_metadata_tries_the_recorded_run(self):
+        for metadata in ({}, None):
+            decision = _decide(metadata)
+            self.assertEqual(decision.kind, "never")
+            self.assertTrue(decision.try_recorded_run)
+            self.assertIsNone(decision.unlinked_status)
+            self.assertEqual(decision.canonical, {})
+
+    def test_step_3_neither_prompt_nor_parameters_tries_the_recorded_run(self):
+        decision = _decide({"workflow": json.dumps({"nodes": []})})
+        self.assertEqual(decision.kind, "never")
+        self.assertTrue(decision.try_recorded_run)
+        self.assertIsNone(decision.unlinked_status)
+        self.assertEqual(decision.canonical, {"workflow": {"nodes": []}})
+
+    def test_strings_are_parsed_and_malformed_ones_kept(self):
+        decision = _decide({"prompt": "{not json", "workflow": "{}"})
+        self.assertEqual(decision.canonical["prompt"], "{not json")
+        self.assertEqual(decision.canonical["workflow"], {})
+
+    def test_the_file_size_is_recorded_unless_the_metadata_has_one(self):
+        meta = _graph(sampled_graph())
+        self.assertEqual(
+            _decide(meta, file_size=42).canonical["file_info"], {"size": 42}
+        )
+        meta["file_info"] = {"size": 7, "width": 3}
+        self.assertEqual(
+            _decide(meta, file_size=42).canonical["file_info"], {"size": 7, "width": 3}
+        )
+        self.assertNotIn("file_info", _decide(_graph(sampled_graph())).canonical)
+
+    def test_a_file_size_reader_is_called_only_for_prompt_metadata(self):
+        reads = []
+
+        def size():
+            reads.append(1)
+            return 9
+
+        for metadata in ({}, {"workflow": "{}"}):
+            _decide(metadata, file_size=size)
+        self.assertEqual(reads, [])
+        decision = _decide(_graph(sampled_graph()), file_size=size)
+        self.assertEqual((reads, decision.canonical["file_info"]), ([1], {"size": 9}))
+
+
+def _off_behind(middle, key):
+    """A switched-off PromptManagerText reaching the encoder through
+    ``middle``'s ``key`` input."""
+    graph = save_tests.run_graph()
+    graph["1"] = {
+        "class_type": "PromptManagerText",
+        "inputs": {"text": "SECRET OFF TEXT", "save_to_library": False},
+    }
+    graph["7"] = {"class_type": middle, "inputs": {key: ["1", 0]}}
+    graph["8"] = {
+        "class_type": "CLIPTextEncode",
+        "inputs": {"text": ["7", 0], "clip": ["4", 1]},
+    }
+    graph["3"]["inputs"]["positive"] = ["8", 0]
+    return graph
+
+
+class TestSaveToLibrarySteps(unittest.TestCase):
+    """#90: a PromptManager node with Save to library off stores nothing."""
+
+    def test_step_2_an_opted_out_file_is_not_saved(self):
+        lookup = _Lookup("9")
+        graph = save_tests.run_graph(save=False)
+        graph["5"] = {**graph["3"], "inputs": {**graph["3"]["inputs"]}}
+        graph["5"]["inputs"]["positive"] = ["2", 0]  # ambiguous otherwise
+        for policy in Policy:
+            decision = _decide(_graph(graph), policy=policy, lookup=lookup)
+            self.assertEqual(decision.kind, "not_saved")
+            self.assertFalse(decision.try_recorded_run)
+            self.assertIsNone(decision.review)
+        self.assertEqual(lookup.calls, 0)
+
+    def test_step_2_a_wired_switch_is_not_saved_wired(self):
+        graph = save_tests.run_graph(save=["9", 0])
+        graph["9"] = {"class_type": "SomeCustomSwitch", "inputs": {}}
+        lookup = _Lookup("9")
+        decision = _decide(_graph(graph), lookup=lookup)
+        self.assertEqual(decision.kind, "not_saved_wired")
+        self.assertFalse(decision.try_recorded_run)
+        self.assertIsNone(decision.review)
+        self.assertEqual(lookup.calls, 0)
+
+    def test_step_8_1_an_off_node_behind_a_pass_through_is_not_saved(self):
+        """The #90 graph walk does not follow ``anything`` or ``value``; the
+        inspector does, so its positive is checked against the switch."""
+        for middle, key in (("easy showAnything", "anything"), ("MyNode", "value")):
+            with self.subTest(middle=middle):
+                graph = _off_behind(middle, key)
+                for policy in Policy:
+                    decision = _decide(_graph(graph), policy=policy, lookup=_Lookup())
+                    self.assertEqual(decision.kind, "not_saved")
+                    self.assertIsNone(decision.text)
+
+    def test_step_8_4_a_legacy_answer_from_an_off_node_is_not_saved(self):
+        graph = _off_behind("MyNode", "value")
+        graph["9"] = {"class_type": "CLIPTextEncode", "inputs": {"text": "on text"}}
+        graph["5"] = {**graph["3"], "inputs": {**graph["3"]["inputs"]}}
+        graph["5"]["inputs"]["positive"] = ["9", 0]
+        decision = _decide(_graph(graph), lookup=_Lookup())
+        self.assertEqual(decision.kind, "not_saved")
+        self.assertIsNone(decision.text)
+
+    def test_step_2_an_off_node_on_any_positive_input_is_not_saved(self):
+        """Any input name upstream of a positive, not only prompt-like ones."""
+        guider = _off_behind("MyNode", "value")
+        guider["3"] = {
+            "class_type": "BasicGuider",
+            "inputs": {"model": ["4", 0], "conditioning": ["8", 0]},
+        }
+        prepended = _off_behind("MyNode", "value")
+        prepended["1"]["inputs"]["prepend_text"] = "pre"
+        pair = _off_behind("MyNode", "value")
+        pair["1"] = {
+            "class_type": "PromptManagerPair",
+            "inputs": {"text": "x", "negative_text": "y", "save_to_library": False},
+        }
+        pair["2"]["inputs"]["text"] = ["1", 1]
+        cases = {"sampler-less guider": guider, "prepend": prepended, "pair": pair}
+        for name, graph in cases.items():
+            with self.subTest(name=name):
+                lookup = _Lookup("9")
+                decision = _decide(_graph(graph), lookup=lookup)
+                self.assertEqual(decision.kind, "not_saved")
+                self.assertFalse(decision.try_recorded_run)
+                self.assertEqual(lookup.calls, 0)
+
+    def test_step_2_a_wired_switch_behind_a_pass_through_is_not_saved_wired(self):
+        graph = _off_behind("MyNode", "value")
+        graph["1"]["inputs"]["save_to_library"] = ["20", 0]
+        graph["20"] = {"class_type": "SomeBoolNode", "inputs": {}}
+        self.assertEqual(_decide(_graph(graph)).kind, "not_saved_wired")
+
+    def test_a_switched_on_node_behind_a_pass_through_is_stored(self):
+        """Regression guard: on, or no switch at all (older files)."""
+        for value in (True, None):
+            with self.subTest(value=value):
+                graph = _off_behind("MyNode", "value")
+                if value is None:
+                    del graph["1"]["inputs"]["save_to_library"]
+                else:
+                    graph["1"]["inputs"]["save_to_library"] = value
+                decision = _decide(_graph(graph), lookup=_Lookup())
+                self.assertEqual(decision.kind, "positive")
+                self.assertEqual(decision.text, "SECRET OFF TEXT")
+
+    def test_an_off_node_on_a_negative_input_name_never_blocks(self):
+        """The walk skips negative inputs: #90's own rule (``neg``,
+        ``neg_text``, ``text_neg``) and any name containing "negative"."""
+        for key in (
+            "neg",
+            "neg_text",
+            "text_neg",
+            "negative_text",
+            "negative2",
+            "negativeprompt",
+            "NegativePrompt",
+        ):
+            with self.subTest(key=key):
+                graph = {
+                    "1": {
+                        "class_type": "PromptManagerText",
+                        "inputs": {"text": "bad hands", "save_to_library": False},
+                    },
+                    "9": {
+                        "class_type": "PromptManagerText",
+                        "inputs": {"text": "a cat", "save_to_library": True},
+                    },
+                    "7": {
+                        "class_type": "PipeEncode",
+                        "inputs": {"pos_text": ["9", 0], key: ["1", 0]},
+                    },
+                    "4": {"class_type": "CheckpointLoaderSimple", "inputs": {}},
+                    "3": {
+                        "class_type": "KSampler",
+                        "inputs": {
+                            "model": ["4", 0],
+                            "positive": ["7", 0],
+                            "negative": ["7", 1],
+                        },
+                    },
+                }
+                self.assertIsNone(file_prompt._switched_off_upstream(graph))
+                self.assertNotIn(
+                    _decide(_graph(graph)).kind, ("not_saved", "not_saved_wired")
+                )
+
+    def test_the_guards_accept_malformed_nodes(self):
+        graph = {
+            "1": {"class_type": "PromptManagerText", "inputs": None},
+            "2": {"class_type": "PromptManagerText"},
+        }
+        self.assertIsNone(file_prompt._off_text(graph, "x"))
+        side = {"provenance": ["not", "a", "dict"]}
+        with mock.patch.object(file_prompt, "side_opted_out", return_value=True):
+            self.assertIsNone(file_prompt._side_switch(graph, side))
+
+    def test_the_off_text_guard_reads_a_nodes_resolved_text(self):
+        graph = {
+            "1": {
+                "class_type": "PromptManagerText",
+                "inputs": {"text": ["30", 0], "save_to_library": False},
+            },
+            "30": {
+                "class_type": "PrimitiveStringMultiline",
+                "inputs": {"value": "SECRET OFF TEXT"},
+            },
+            "2": {
+                "class_type": "PromptManagerText",
+                "inputs": {"text": "WIRED", "save_to_library": ["9", 0]},
+            },
+            "9": {"class_type": "SomeBoolNode", "inputs": {}},
+        }
+        self.assertEqual(file_prompt._off_text(graph, " SECRET OFF TEXT"), "not_saved")
+        self.assertEqual(file_prompt._off_text(graph, "WIRED"), "not_saved_wired")
+        self.assertIsNone(file_prompt._off_text(graph, "other"))
+
+    def test_steps_5_and_7_check_the_resolved_positive_too(self):
+        """A resolved positive through an off node the #90 walk missed."""
+        cases = {
+            "pair": save_tests.run_graph(save=False),
+            "negative off": save_tests.run_graph(save=False, negative_save=False),
+        }
+        for name, graph in cases.items():
+            with (
+                self.subTest(name=name),
+                mock.patch.object(
+                    file_prompt, "metadata_opted_out", return_value=False
+                ),
+            ):
+                self.assertEqual(_decide(_graph(graph)).kind, "not_saved")
+
+    def test_step_5_a_junk_positive_is_never_stored(self):
+        """Pinned: the positive alone still passes the junk gate, and a blank
+        positive (never storable) stores nothing either."""
+        graph = save_tests.run_graph(save=True, negative_save=False)
+        graph["1"]["inputs"]["text"] = "2048"
+        decision = _decide(_graph(graph))
+        self.assertEqual((decision.kind, decision.source), ("never", "junk:number"))
+        self.assertEqual(decision.unlinked_status, "found")
+        graph["1"]["inputs"]["text"] = ""
+        decision = _decide(_graph(graph))
+        self.assertEqual((decision.kind, decision.text), ("never", None))
+
+    def test_step_2_a_workflow_only_opt_out_comes_before_step_3(self):
+        workflow = {
+            "nodes": [{"id": 1, "type": "PromptManager", "widgets_values": [False]}]
+        }
+        decision = _decide({"workflow": json.dumps(workflow)})
+        self.assertEqual(decision.kind, "not_saved")
+
+    def test_step_5_an_opted_out_negative_stores_the_positive_alone(self):
+        graph = save_tests.run_graph(save=True, negative_save=False)
+        decision = _decide(_graph(graph))
+        self.assertEqual(decision.kind, "positive")
+        self.assertEqual(decision.source, "opted-out-negative")
+        self.assertEqual(decision.text, save_tests.POSITIVE)
+
+
+class TestResolvedSteps(unittest.TestCase):
+    def test_step_6_a_blank_positive_counts_as_unresolved(self):
+        meta = {
+            "prompt": json.dumps(issue_graph()),
+            "comfyassets_prompt_pairs": json.dumps(pair_evidence()),
+        }
+        decision = _decide(meta, policy=Policy.MONITOR, in_output=False)
+        self.assertEqual(decision.kind, "never")
+        self.assertEqual(decision.resolution["state"], "unresolved")
+
+    def test_step_7_a_resolved_pair(self):
+        lookup = _Lookup("9")
+        decision = _decide(_graph(sampled_graph("cat", "blur")), lookup=lookup)
+        self.assertEqual(decision.kind, "pair")
+        self.assertEqual(decision.source, "resolver")
+        self.assertEqual(decision.text, "cat")
+        self.assertEqual(decision.resolution["negative"]["text"], "blur")
+        self.assertIsNone(decision.review)
+        self.assertEqual(lookup.calls, 0, "decided before step 8: history not asked")
+
+    def test_step_7_a_blank_negative_stays_a_pair(self):
+        decision = _decide(_graph(sampled_graph("cat", "")))
+        self.assertEqual(decision.kind, "pair")
+        self.assertEqual(decision.resolution["negative"]["text"], "")
+
+
+class TestUndecidedGraph(unittest.TestCase):
+    def test_step_8_1_the_inspector_alone_decides(self):
+        decision = _decide({"prompt": parity.build("f03")["prompt"]})
+        self.assertEqual(decision.kind, "positive")
+        self.assertEqual(decision.source, "inspector")
+        self.assertEqual(decision.text, parity.POS)
+        self.assertEqual(decision.resolution["state"], "unresolved")
+
+    def test_step_8_1_the_recorded_saver_names_its_branch(self):
+        lookup = _Lookup("23")
+        decision = _decide(_graph(shapes.shared_prefix()), lookup=lookup)
+        self.assertEqual(decision.kind, "positive")
+        self.assertEqual(decision.source, "recorded-run")
+        self.assertEqual(decision.text, shapes.BRANCH_TEXTS[1])
+        self.assertEqual(decision.review, "ambiguous")
+        self.assertEqual(lookup.calls, 1)
+
+    def test_step_8_1_stores_the_storage_text_without_prepend_or_append(self):
+        graph = shapes.shared_prefix()
+        graph["20"]["inputs"]["text"] = ["25", 1]
+        graph["25"] = {
+            "class_type": "PromptManagerSplit",
+            "inputs": {
+                "text": shapes.BRANCH_TEXTS[1],
+                "prepend_text": "trigger",
+                "append_text": "detail",
+            },
+        }
+        decision = _decide(_graph(graph), lookup=_Lookup("23"))
+        self.assertEqual(decision.source, "recorded-run")
+        self.assertEqual(decision.text, shapes.BRANCH_TEXTS[1])
+
+    def test_step_8_1_a_file_name_naming_another_saver_anchors_nothing(self):
+        graph = shapes.branch_bench()
+        for index in (1, 3, 4):
+            graph[str(index * 10 + 3)]["inputs"]["filename_prefix"] = "bench/shared"
+        decision = _decide(
+            _graph(graph), lookup=_Lookup("43"), file_name="s45_branch_2_00001_.png"
+        )
+        # The name contradicts history's branch 4: no recorded anchor.
+        self.assertEqual(decision.source, "legacy-parser")
+
+    def test_step_8_1_the_file_name_anchor_alone_never_decides(self):
+        """#390: the file-name anchor never decides a link. The scan's legacy
+        floor may still link the file (as before #247), and a file nothing
+        links is queued with the anchor's choice per #390; the monitor
+        stores nothing."""
+        name = "s45_branch_2_00001_.png"
+        scan = _decide(_graph(shapes.branch_bench()), lookup=_Lookup(), file_name=name)
+        self.assertEqual((scan.kind, scan.source), ("positive", "legacy-parser"))
+        self.assertEqual(scan.review, "ambiguous")
+        monitor = _decide(
+            _graph(shapes.branch_bench()),
+            policy=Policy.MONITOR,
+            lookup=_Lookup(),
+            file_name=name,
+        )
+        self.assertEqual(monitor.kind, "never")
+        recorded = _decide(
+            _graph(shapes.branch_bench()), lookup=_Lookup("43"), file_name=name
+        )
+        # The recorded saver still decides: history says branch 4, but the
+        # file name names branch 2, which contradicts it.
+        self.assertNotEqual(recorded.source, "recorded-run")
+        recorded = _decide(_graph(shapes.branch_bench()), lookup=_Lookup("43"))
+        self.assertEqual(recorded.source, "recorded-run")
+        self.assertEqual(recorded.text, shapes.BRANCH_TEXTS[3])
+
+    def test_step_8_2_the_monitor_waits_for_history_inside_the_output_folder(self):
+        decision = _decide(_graph(shapes.shared_prefix()), policy=Policy.MONITOR)
+        self.assertEqual(decision.kind, "history")
+
+    def test_step_8_2_outside_the_output_folder_steps_8_3_and_8_4_apply(self):
+        decision = _decide(
+            _graph(shapes.shared_prefix()), policy=Policy.MONITOR, in_output=False
+        )
+        self.assertEqual(decision.kind, "never")
+        with _untraced_by_both():
+            decision = _decide(
+                _graph(_gated(sampled_graph())), policy=Policy.MONITOR, in_output=False
+            )
+        self.assertEqual(
+            (decision.kind, decision.source), ("positive", "legacy-parser")
+        )
+
+    def test_step_8_3_an_ambiguous_file_is_left_unlinked_by_the_monitor(self):
+        lookup = _Lookup("missing")
+        decision = _decide(
+            _graph(shapes.shared_prefix()), policy=Policy.MONITOR, lookup=lookup
+        )
+        self.assertEqual(decision.kind, "never")
+        self.assertEqual(decision.unlinked_status, "ambiguous")
+        self.assertFalse(decision.try_recorded_run)
+        self.assertEqual(lookup.calls, 1)
+
+    def test_step_8_4_joined_prompt_manager_text_is_never_the_legacy_answer(self):
+        """The legacy parser returns prepend + text + append; the stored text
+        of a PromptManager node cannot be told from it."""
+        decision = _decide(_graph(_prompt_manager_branches()), lookup=_Lookup())
+        self.assertEqual(decision.kind, "never")
+        self.assertEqual(decision.unlinked_status, "ambiguous")
+        self.assertEqual(decision.review, "ambiguous")
+        self.assertTrue(decision.try_recorded_run)
+        # A linked part the parser does not follow: its answer is the node's
+        # own text, which is what the node stores (#170 parity).
+        linked = _prompt_manager_branches(prepend=["99", 0], append="")
+        decision = _decide(_graph(linked), lookup=_Lookup())
+        self.assertEqual((decision.kind, decision.text), ("positive", "a cat"))
+
+    def test_step_8_4_prompt_manager_text_without_parts_keeps_the_floor(self):
+        """Regression guard (passes on the base): no prepend or append."""
+        graph = _prompt_manager_branches(prepend="", append=" ")
+        decision = _decide(_graph(graph), lookup=_Lookup())
+        self.assertEqual((decision.kind, decision.text), ("positive", "a cat"))
+
+    def test_step_8_4_an_ambiguous_file_gets_the_legacy_answer_in_the_scan(self):
+        decision = _decide(_graph(shapes.shared_prefix()), lookup=_Lookup())
+        self.assertEqual(decision.kind, "positive")
+        self.assertEqual(decision.source, "legacy-parser")
+        self.assertEqual(decision.text, shapes.BRANCH_TEXTS[0])
+        self.assertEqual(decision.review, "ambiguous")
+
+    def test_step_8_4_an_untraceable_file_gets_the_legacy_answer_in_both(self):
+        for policy in Policy:
+            for inspected in (_inspected("unresolved"), _inspected("x", True)):
+                with (
+                    self.subTest(policy=policy, malformed=inspected.malformed),
+                    mock.patch.object(
+                        file_prompt, "inspection_resolution", return_value=inspected
+                    ),
+                ):
+                    decision = _decide(
+                        _graph(_gated(sampled_graph("cat"))),
+                        policy=policy,
+                        lookup=_Lookup(),
+                    )
+                    self.assertEqual(decision.kind, "positive")
+                    self.assertEqual(decision.source, "legacy-parser")
+                    self.assertEqual(decision.text, "cat")
+
+    def test_step_8_4_nothing_traced_tries_the_recorded_run(self):
+        graph = sampled_graph()
+        graph["5"] = {**graph["3"]}
+        for sampler in ("3", "5"):
+            graph[sampler]["inputs"]["positive"] = ["9", 0]
+        graph["9"] = {"class_type": "BasicGuider", "inputs": {"width": 2048}}
+        decision = _decide(_graph(graph), lookup=_Lookup())
+        self.assertEqual(decision.kind, "never")
+        self.assertTrue(decision.try_recorded_run)
+        # Ambiguous without a choice is reported unresolved.
+        self.assertEqual(decision.unlinked_status, "unresolved")
+        self.assertEqual(decision.review, "untraced")
+
+
+class TestStepsWithoutAnUndecidedGraph(unittest.TestCase):
+    def test_step_9_ambiguous_parameters_only(self):
+        meta = {
+            "parameters": (
+                "cat\nNegative prompt: blur\nNegative prompt: noise"
+                "\nSteps: 20, Sampler: Euler"
+            )
+        }
+        decision = _decide(meta)
+        self.assertEqual(decision.kind, "never")
+        self.assertFalse(decision.try_recorded_run)
+        self.assertEqual(decision.unlinked_status, "unresolved")
+
+    def test_step_10_unresolved_without_a1111_text(self):
+        decision = _decide({"prompt": {}, "parameters": 5})
+        self.assertEqual(decision.kind, "never")
+        self.assertFalse(decision.try_recorded_run)
+        self.assertEqual(decision.unlinked_status, "unresolved")
+
+    def test_step_11_sampler_less_with_one_text(self):
+        decision = _decide(_graph(flux_graph()))
+        self.assertEqual((decision.kind, decision.source), ("positive", "sampler-less"))
+        self.assertEqual(decision.text, "a red fox")
+
+    def test_step_11_sampler_less_with_several_texts(self):
+        graph = flux_graph()
+        graph["50"] = {
+            "class_type": "Lora Loader (LoraManager)",
+            "inputs": {"model": ["1", 0], "clip": ["2", 0], "text": "a lora note"},
+        }
+        graph["22"]["inputs"]["model"] = ["50", 0]
+        graph["6"]["inputs"]["clip"] = ["50", 1]
+        decision = _decide(_graph(graph))
+        self.assertEqual(decision.kind, "never")
+        self.assertTrue(decision.try_recorded_run)
+        self.assertEqual(decision.unlinked_status, "unresolved")
+        meta = {**_graph(graph), "parameters": "a red fox\nNegative prompt: x"}
+        decision = _decide(meta)
+        self.assertEqual((decision.kind, decision.source), ("positive", "a1111"))
+        self.assertEqual(decision.text, "a red fox")
+
+    def test_step_11_sampler_less_without_a_text(self):
+        graph = {"40": {"class_type": "easy showAnything", "inputs": {"text": "x"}}}
+        decision = _decide(_graph(graph))
+        self.assertEqual(decision.kind, "never")
+        self.assertTrue(decision.try_recorded_run)
+        self.assertEqual(decision.unlinked_status, "found")
+
+    def test_step_12_a1111_only(self):
+        decision = _decide({"parameters": "a cat"})
+        self.assertEqual((decision.kind, decision.source), ("positive", "a1111"))
+        self.assertEqual(decision.text, "a cat")
+        decision = _decide({"parameters": "Negative prompt: blur"})
+        self.assertEqual((decision.kind, decision.unlinked_status), ("never", "found"))
+        self.assertFalse(decision.try_recorded_run)
+
+    def test_step_12_parsed_metadata_never_raises(self):
+        # The monitor hands parsed values: a dict prompt, non-string parameters.
+        decision = _decide({"prompt": {}, "parameters": "a cat"})
+        self.assertEqual(decision.text, "a cat")
+        decision = _decide({"parameters": 5})
+        self.assertEqual((decision.kind, decision.unlinked_status), ("never", "found"))
+
+
+class TestJunkGate(unittest.TestCase):
+    JUNK = {
+        "blank": "  ",
+        "number": "2048",
+        "lora-only": f"{LORA}, <lora:detail:0.5> |",
+        "model-file": "models/checkpoints/Flux-Dev.SafeTensors",
+    }
+
+    def test_each_junk_class_is_named(self):
+        for name, text in self.JUNK.items():
+            with self.subTest(name=name):
+                self.assertEqual(junk_text(text), name)
+        for ending in ("ckpt", "pt", "pth", "bin", "gguf", "sft"):
+            self.assertEqual(junk_text(f"model.{ending}"), "model-file")
+
+    def test_near_misses_are_not_junk(self):
+        for text in (
+            f"a red fox {LORA}",
+            "a.safetensors b.safetensors",
+            "nan",
+            "a portrait saved as final.safetensors",
+            "4k",
+            "C:\\My Models\\x.safetensors",
+        ):
+            with self.subTest(text=text):
+                self.assertIsNone(junk_text(text))
+
+    def test_step_13_junk_from_any_step_is_never_stored(self):
+        cases = {
+            "resolver": _graph(sampled_graph("2048", "blur")),
+            "sampler-less": _graph(flux_graph(text=LORA)),
+            "a1111": {"parameters": "model.safetensors"},
+        }
+        for step, meta in cases.items():
+            with self.subTest(step=step):
+                decision = _decide(meta)
+                self.assertEqual(decision.kind, "never")
+                self.assertTrue(decision.source.startswith("junk:"), decision.source)
+                self.assertTrue(decision.try_recorded_run)
+                self.assertEqual(decision.unlinked_status, "found")
+
+    def test_step_13_a_junk_legacy_answer_is_never_stored(self):
+        with _untraced_by_both():
+            decision = _decide(_graph(_gated(sampled_graph(LORA))), lookup=_Lookup())
+        self.assertEqual(decision.source, "junk:lora-only")
+        self.assertEqual(decision.kind, "never")
+        self.assertEqual(decision.unlinked_status, "unresolved")
+
+    def test_step_13_junk_at_step_8_keeps_that_steps_status_and_review(self):
+        # An ambiguous file whose legacy answer is a number is still a
+        # Needs review case: its status stays "ambiguous".
+        decision = _decide(_graph(_numeric_first_branches()), lookup=_Lookup())
+        self.assertEqual((decision.kind, decision.source), ("never", "junk:number"))
+        self.assertEqual(decision.unlinked_status, "ambiguous")
+        self.assertEqual(decision.review, "ambiguous")
+        self.assertTrue(decision.try_recorded_run)
+
+
+class TestParseComfyuiPrompt(unittest.TestCase):
+    def test_a_parsed_prompt_and_non_string_values_are_kept(self):
+        parsed = file_prompt.parse_comfyui_prompt(
+            {"prompt": {"1": {}}, "workflow": {"nodes": []}, "steps": 20}
+        )
+        self.assertEqual(parsed["prompt"], {"1": {}})
+        self.assertEqual(parsed["workflow"], {"nodes": []})
+        self.assertEqual(parsed["parameters"]["steps"], 20)
+        self.assertIsNone(parsed["positive_prompt"])
+
+    def test_non_string_parameters_are_ignored(self):
+        parsed = file_prompt.parse_comfyui_prompt({"parameters": {"a": 1}})
+        self.assertIsNone(parsed["positive_prompt"])
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_image_categories.py

@@ -0,0 +1,523 @@
+"""Image categories (#332): schema, migration, restore check, store and file key."""
+
+import hashlib
+import ntpath
+import os
+import sqlite3
+import tempfile
+import unittest
+from contextlib import closing
+from pathlib import Path
+from unittest.mock import patch
+
+try:
+    from open_handles import assert_closed
+except ImportError:
+    from tests.open_handles import assert_closed
+
+from database.image_categories import (
+    COPY_SQL,
+    INDEX,
+    STATEMENTS,
+    TABLE,
+    copy_image_category,
+    image_categories_schema_error,
+    migrate_image_categories,
+)
+from database.models import PromptModel
+from database.operations import PromptDatabase
+from py.api.images import image_category_key
+
+_DDL = (
+    f"CREATE TABLE {TABLE} (root_key TEXT NOT NULL, relative_path TEXT NOT NULL, "
+    "category TEXT NOT NULL, updated_at TEXT NOT NULL, "
+    "PRIMARY KEY (root_key, relative_path))"
+)
+_INDEX_DDL = f"CREATE INDEX {INDEX} ON {TABLE}(category)"
+
+
+def category_checksum(conn) -> tuple:
+    """sha256 of prompts and prompt_pairs ``(id, category, updated_at)``."""
+    sums = []
+    for table in ("prompts", "prompt_pairs"):
+        digest = hashlib.sha256()
+        for row in conn.execute(  # nosec B608 - fixed table names
+            f"SELECT id, category, updated_at FROM {table} ORDER BY id"
+        ):
+            digest.update(repr(tuple(row)).encode())
+        sums.append(digest.hexdigest())
+    return tuple(sums)
+
+
+def table_checksums(conn) -> dict:
+    """``{name: (schema sql, sha256 of rows)}`` of every table but ours."""
+    found = {}
+    for name, sql in conn.execute(
+        "SELECT name, sql FROM sqlite_master WHERE type='table' AND name != ?",
+        (TABLE,),
+    ).fetchall():
+        digest = hashlib.sha256()
+        rows = conn.execute(f'SELECT * FROM "{name}"')  # nosec B608
+        for text in sorted(repr(tuple(row)) for row in rows):
+            digest.update(text.encode())
+        found[name] = (sql, digest.hexdigest())
+    return found
+
+
+class _TempDir(unittest.TestCase):
+    def setUp(self):
+        self.tmpdir = tempfile.mkdtemp()
+        self.path = os.path.join(self.tmpdir, "categories.db")
+
+    def tearDown(self):
+        PromptModel.close_all_instances()
+        assert_closed(self, self.tmpdir)
+        for name in os.listdir(self.tmpdir):
+            os.unlink(os.path.join(self.tmpdir, name))
+        os.rmdir(self.tmpdir)
+
+
+class TestImageCategoriesSchema(_TempDir):
+    def test_migration_creates_table_and_index(self):
+        db = PromptDatabase(self.path)
+        db.close_all()
+        PromptModel.close_all_instances()
+        with closing(sqlite3.connect(self.path)) as conn:
+            names = {
+                (kind, name)
+                for kind, name in conn.execute(
+                    "SELECT type, name FROM sqlite_master WHERE tbl_name=?", (TABLE,)
+                )
+            }
+            self.assertEqual(
+                names,
+                {
+                    ("table", TABLE),
+                    ("index", INDEX),
+                    ("index", f"sqlite_autoindex_{TABLE}_1"),
+                },
+            )
+            self.assertEqual(
+                conn.execute(f"SELECT COUNT(*) FROM {TABLE}").fetchone()[0], 0
+            )
+            self.assertIsNone(image_categories_schema_error(conn, allow_missing=False))
+
+    def test_migration_leaves_prompt_categories_unchanged(self):
+        """23,000 links; the migration reads and writes only its own objects."""
+        db = PromptDatabase(self.path)
+        db.close_all()
+        PromptModel.close_all_instances()
+        with closing(sqlite3.connect(self.path)) as conn:
+            conn.execute(f"DROP TABLE {TABLE}")  # a library from before #332
+            categories = ["Landscapes", "Portraits", None, "  ", "Scans"]
+            conn.executemany(
+                "INSERT INTO prompts (text, category, hash, updated_at) "
+                "VALUES (?, ?, ?, ?)",
+                [
+                    (f"p{n}", categories[n % 5], f"h{n}", f"2026-01-01 00:00:{n % 60}")
+                    for n in range(200)
+                ],
+            )
+            conn.executemany(
+                "INSERT INTO prompt_pairs (positive_prompt_id, negative_prompt_id, "
+                "category) VALUES (?, ?, ?)",
+                [(n, n + 100, categories[(n + 1) % 5]) for n in range(1, 50)],
+            )
+            conn.executemany(
+                "INSERT INTO generated_images (prompt_id, image_path, filename, "
+                "file_path) VALUES (?, ?, ?, ?)",
+                [
+                    (n % 200 + 1, f"/out/{n}.png", f"{n}.png", f"/out/{n}.png")
+                    for n in range(23000)
+                ],
+            )
+            conn.commit()
+            before = table_checksums(conn)
+            prompts_before = category_checksum(conn)
+            seen = []
+
+            def authorize(action, arg1, arg2, _db, _trigger):
+                seen.append((action, arg1, arg2))
+                return sqlite3.SQLITE_OK
+
+            conn.set_authorizer(authorize)
+            migrate_image_categories(conn)
+            conn.commit()
+            conn.set_authorizer(None)
+            own = {TABLE, "sqlite_master", "sqlite_schema", INDEX}
+            touched = set()
+            for action, arg1, arg2 in seen:
+                if action in (sqlite3.SQLITE_READ, sqlite3.SQLITE_INSERT):
+                    touched.add(arg1)
+                if action == sqlite3.SQLITE_READ:
+                    self.assertIn(arg1, own, (action, arg1, arg2))
+                elif action in (
+                    sqlite3.SQLITE_INSERT,
+                    sqlite3.SQLITE_UPDATE,
+                    sqlite3.SQLITE_DELETE,
+                ):
+                    self.assertIn(arg1, own, (action, arg1, arg2))
+                elif action == sqlite3.SQLITE_CREATE_TABLE:
+                    self.assertEqual(arg1, TABLE)
+                elif action == sqlite3.SQLITE_CREATE_INDEX:
+                    self.assertIn(arg1, (INDEX, f"sqlite_autoindex_{TABLE}_1"))
+                    self.assertEqual(arg2, TABLE)
+                elif action == sqlite3.SQLITE_PRAGMA:
+                    self.assertEqual((arg1, arg2), ("table_info", TABLE))
+            self.assertIn(TABLE, touched)  # the authorizer saw the work
+            self.assertEqual(table_checksums(conn), before)
+            self.assertEqual(category_checksum(conn), prompts_before)
+            schema = conn.execute(
+                "SELECT sql FROM sqlite_master ORDER BY name"
+            ).fetchall()
+            migrate_image_categories(conn)  # a second run changes nothing
+            conn.commit()
+            self.assertEqual(
+                conn.execute("SELECT sql FROM sqlite_master ORDER BY name").fetchall(),
+                schema,
+            )
+        # The whole startup sequence keeps them too.
+        PromptDatabase(self.path).close_all()
+        PromptModel.close_all_instances()
+        with closing(sqlite3.connect(self.path)) as conn:
+            self.assertEqual(category_checksum(conn), prompts_before)
+            self.assertEqual(
+                conn.execute(f"SELECT COUNT(*) FROM {TABLE}").fetchone()[0], 0
+            )
+
+    def test_structure_accepted_and_refused(self):
+        variants = {
+            "missing": None,
+            "extra column": (
+                f"CREATE TABLE {TABLE} (root_key TEXT NOT NULL, relative_path TEXT "
+                "NOT NULL, category TEXT NOT NULL, updated_at TEXT NOT NULL, x TEXT, "
+                "PRIMARY KEY (root_key, relative_path))",
+                _INDEX_DDL,
+            ),
+            "wrong index": (_DDL, f"CREATE INDEX {INDEX} ON {TABLE}(updated_at)"),
+            "extra index": (
+                _DDL,
+                _INDEX_DDL,
+                f"CREATE INDEX extra ON {TABLE}(root_key)",
+            ),
+            "trigger": (
+                _DDL,
+                _INDEX_DDL,
+                f"CREATE TRIGGER t AFTER INSERT ON {TABLE} BEGIN SELECT 1; END",
+            ),
+            "wrong ddl": (
+                f"CREATE TABLE {TABLE} (root_key TEXT, relative_path TEXT, "
+                "category TEXT, updated_at TEXT, "
+                "PRIMARY KEY (root_key, relative_path))",
+                _INDEX_DDL,
+            ),
+            "view": (f"CREATE VIEW {TABLE} AS SELECT 1",),
+        }
+        for label, statements in variants.items():
+            with self.subTest(label), closing(sqlite3.connect(":memory:")) as conn:
+                for sql in statements or ():
+                    conn.execute(sql)
+                error = image_categories_schema_error(conn)
+                if statements is None:
+                    self.assertIsNone(error)
+                    self.assertIsNotNone(
+                        image_categories_schema_error(conn, allow_missing=False)
+                    )
+                    continue
+                self.assertIsNotNone(error)
+                self.assertIsNotNone(
+                    image_categories_schema_error(conn, check_values=False)
+                )
+                with self.assertRaises(sqlite3.DatabaseError):
+                    migrate_image_categories(conn)
+        # A table without its category index (never written by this code) is
+        # refused by the check but repaired by the install.
+        with closing(sqlite3.connect(":memory:")) as conn:
+            conn.execute(_DDL)
+            conn.execute(f"INSERT INTO {TABLE} VALUES ('r', 'a.png', 'Scans', 'now')")
+            self.assertIsNotNone(image_categories_schema_error(conn))
+            migrate_image_categories(conn)
+            self.assertIsNone(image_categories_schema_error(conn, allow_missing=False))
+            self.assertEqual(
+                conn.execute(f"SELECT COUNT(*) FROM {TABLE}").fetchone()[0], 1
+            )
+        with closing(sqlite3.connect(":memory:")) as conn:
+            migrate_image_categories(conn)
+            migrate_image_categories(conn)  # idempotent
+            self.assertIsNone(image_categories_schema_error(conn, allow_missing=False))
+
+    def test_values_refused_but_startup_checks_structure_only(self):
+        bad = {
+            "blank": "",
+            "101 characters": "x" * 101,
+            "control character": "a\tb",
+            "nul": "a\x00b",
+            "leading space": " Landscapes",
+            "trailing space": "Landscapes ",
+        }
+        for label, value in bad.items():
+            with self.subTest(label), closing(sqlite3.connect(":memory:")) as conn:
+                migrate_image_categories(conn)
+                conn.execute(
+                    f"INSERT INTO {TABLE} VALUES ('r', 'a.png', ?, 'now')", (value,)
+                )
+                self.assertIsNotNone(image_categories_schema_error(conn))
+                self.assertIsNone(
+                    image_categories_schema_error(conn, check_values=False)
+                )
+                migrate_image_categories(conn)  # startup still opens it
+        with closing(sqlite3.connect(":memory:")) as conn:
+            migrate_image_categories(conn)
+            conn.execute(
+                f"INSERT INTO {TABLE} VALUES ('r', ?, 'Scans', 'now')", ("x" * 5000,)
+            )
+            self.assertIsNotNone(image_categories_schema_error(conn))
+            conn.execute(f"DELETE FROM {TABLE}")
+            conn.execute(f"INSERT INTO {TABLE} VALUES ('r', x'00ff', 'Scans', 'now')")
+            self.assertIsNotNone(image_categories_schema_error(conn))
+            conn.execute(f"DELETE FROM {TABLE}")
+            for value in ("x" * 100, "Scans", "Café · 風景", "a b"):
+                conn.execute(
+                    f"INSERT OR REPLACE INTO {TABLE} VALUES ('r', 'a.png', ?, 'now')",
+                    (value,),
+                )
+                self.assertIsNone(image_categories_schema_error(conn), value)
+
+    def test_restore_check(self):
+        PromptDatabase(self.path).close_all()
+        PromptModel.close_all_instances()
+        ok, reason = PromptModel.verify_database_file(
+            self.path, require_library_state=True
+        )
+        self.assertTrue(ok, reason)
+        with closing(sqlite3.connect(self.path)) as conn:
+            conn.execute(f"DROP TABLE {TABLE}")
+            conn.commit()
+        # A backup from before #332 is accepted ...
+        ok, reason = PromptModel.verify_database_file(self.path)
+        self.assertTrue(ok, reason)
+        # ... but a current database must have the table.
+        ok, reason = PromptModel.verify_database_file(
+            self.path, require_library_state=True
+        )
+        self.assertFalse(ok)
+        self.assertIn("image categories", reason.lower())
+        with closing(sqlite3.connect(self.path)) as conn:
+            conn.execute(_DDL)
+            conn.execute(_INDEX_DDL)
+            conn.execute(f"INSERT INTO {TABLE} VALUES ('r', 'a.png', ' x', 'now')")
+            conn.commit()
+        ok, reason = PromptModel.verify_database_file(self.path)
+        self.assertFalse(ok)
+        self.assertIn("image categories", reason.lower())
+
+
+class TestImageCategoryStore(_TempDir):
+    def setUp(self):
+        super().setUp()
+        self.db = PromptDatabase(self.path)
+
+    def tearDown(self):
+        self.db.close_all()
+        super().tearDown()
+
+    def rows(self):
+        return (
+            self.db.model.get_connection()
+            .execute(
+                f"SELECT root_key, relative_path, category, updated_at FROM {TABLE} "
+                "ORDER BY root_key, relative_path"
+            )
+            .fetchall()
+        )
+
+    def test_set_counts_updated_and_unchanged(self):
+        keys = [("/out", "a.png"), ("/other", "a.png"), ("/out", "a.png")]
+        self.assertEqual(
+            self.db.set_image_categories(keys, "Portraits"),
+            {"updated": 2, "unchanged": 0},
+        )
+        stamps = {(r[0], r[1]): r[3] for r in self.rows()}
+        self.assertEqual(
+            self.db.set_image_categories(
+                [("/out", "a.png"), ("/out", "b.png")], "Portraits"
+            ),
+            {"updated": 1, "unchanged": 1},
+        )
+        # An unchanged file keeps its updated_at.
+        self.assertEqual(
+            {(r[0], r[1]): r[3] for r in self.rows()}[("/out", "a.png")],
+            stamps[("/out", "a.png")],
+        )
+        self.assertEqual(
+            self.db.set_image_categories([("/out", "a.png")], "Scans"),
+            {"updated": 1, "unchanged": 0},
+        )
+        self.assertEqual(self.db.image_category("/out", "a.png"), "Scans")
+        self.assertEqual(self.db.image_category("/other", "a.png"), "Portraits")
+        self.assertIsNone(self.db.image_category("/out", "missing.png"))
+        self.assertEqual(
+            self.db.own_categories_of(["/out", "/out", "/none"]),
+            {("/out", "a.png"): "Scans", ("/out", "b.png"): "Portraits"},
+        )
+
+    def test_clear_counts_removed_rows(self):
+        self.db.set_image_categories([("/out", "a.png"), ("/b", "c.png")], "Scans")
+        self.assertEqual(
+            self.db.clear_image_categories(
+                [("/out", "a.png"), ("/b", "c.png"), ("/out", "gone.png")]
+            ),
+            2,
+        )
+        self.assertEqual(self.rows(), [])
+        self.assertEqual(self.db.clear_image_categories([("/out", "a.png")]), 0)
+
+    def test_a_failed_write_writes_nothing(self):
+        self.db.set_image_categories([("/out", "a.png")], "Scans")
+        keys = [("/out", "b.png"), ("/out", None)]  # NOT NULL fails the second
+        with self.assertRaises(sqlite3.IntegrityError):
+            self.db.set_image_categories(keys, "Portraits")
+        self.assertEqual([r[:3] for r in self.rows()], [("/out", "a.png", "Scans")])
+
+    def test_store_never_touches_prompt_categories(self):
+        conn = self.db.model.get_connection()
+        with conn:
+            conn.execute(
+                "INSERT INTO prompts (text, category, hash) VALUES ('p', 'L', 'h')"
+            )
+        before = category_checksum(conn)
+        seen = set()
+        conn.set_authorizer(
+            lambda action, arg1, *_: seen.add(arg1) or sqlite3.SQLITE_OK
+        )
+        try:
+            self.db.set_image_categories([("/out", "a.png")], "Scans")
+            self.db.own_categories_of(["/out"])
+            self.db.image_category("/out", "a.png")
+            self.db.clear_image_categories([("/out", "a.png")])
+        finally:
+            conn.set_authorizer(None)
+        self.assertFalse(seen & {"prompts", "prompt_pairs", "generated_images"}, seen)
+        self.assertEqual(category_checksum(conn), before)
+
+    def test_copy_keeps_kept_copy_category(self):
+        self.db.set_image_categories([("/out", "removed.png")], "Scans")
+        self.db.set_image_categories([("/out", "kept.png")], "Portraits")
+        with self.db._pair_transaction() as conn:
+            inserted = copy_image_category(
+                conn, ("/out", "removed.png"), ("/out", "kept.png")
+            )
+        self.assertEqual(inserted, 0)
+        self.assertEqual(self.db.image_category("/out", "kept.png"), "Portraits")
+        with self.db._pair_transaction() as conn:
+            inserted = copy_image_category(
+                conn, ("/out", "removed.png"), ("/out", "new.png")
+            )
+        self.assertEqual(inserted, 1)
+        self.assertEqual(self.db.image_category("/out", "new.png"), "Scans")
+        # The removed copy's row is never deleted.
+        self.assertEqual(self.db.image_category("/out", "removed.png"), "Scans")
+        with self.db._pair_transaction() as conn:
+            self.assertEqual(
+                copy_image_category(conn, ("/out", "none.png"), ("/out", "x.png")), 0
+            )
+            self.assertEqual(
+                copy_image_category(
+                    conn, ("/out", "removed.png"), ("/out", "removed.png")
+                ),
+                0,
+            )
+
+    def test_statements_never_scan_the_table(self):
+        conn = self.db.model.get_connection()
+        for sql in STATEMENTS:
+            with self.subTest(sql):
+                params = (None,) * sql.count("?")
+                plan = " ".join(
+                    row[-1] for row in conn.execute(f"EXPLAIN QUERY PLAN {sql}", params)
+                )
+                self.assertNotRegex(plan, rf"SCAN {TABLE}\b", plan)
+        plan = " ".join(
+            row[-1]
+            for row in conn.execute(
+                f"EXPLAIN QUERY PLAN SELECT rowid FROM {TABLE} WHERE category=? "
+                "ORDER BY rowid",
+                ("x",),
+            )
+        )
+        self.assertIn(INDEX, plan)
+        self.assertIn(COPY_SQL, STATEMENTS)
+
+
+class TestImageCategoryKey(unittest.TestCase):
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory()
+        self.base = Path(os.path.realpath(self._tmp.name))
+        self.outer = self.base / "output"
+        self.inner = self.outer / "nested"
+        (self.inner / "sub").mkdir(parents=True)
+
+    def tearDown(self):
+        self._tmp.cleanup()
+
+    def test_equals_the_favorite_key_without_nesting(self):
+        from py.api.images import _favorite_relative_key, _favorite_root_key
+
+        key = image_category_key([self.outer], self.outer / "sub" / "a.png")
+        self.assertEqual(
+            key, (_favorite_root_key(self.outer), _favorite_relative_key("sub/a.png"))
+        )
+
+    def test_deepest_source_wins_in_any_order(self):
+        from py.api.images import _favorite_root_key
+
+        path = self.inner / "sub" / "a.png"
+        for sources in ([self.outer, self.inner], [self.inner, self.outer]):
+            with self.subTest(sources=sources):
+                self.assertEqual(
+                    image_category_key(sources, path),
+                    (_favorite_root_key(self.inner), "sub/a.png"),
+                )
+        # A file of the outer source only is keyed by it.
+        self.assertEqual(
+            image_category_key([self.outer, self.inner], self.outer / "b.png"),
+            (_favorite_root_key(self.outer), "b.png"),
+        )
+
+    def test_outside_every_source_has_no_key(self):
+        self.assertIsNone(image_category_key([self.inner], self.outer / "a.png"))
+        self.assertIsNone(image_category_key([], self.outer / "a.png"))
+        # A sibling sharing a name prefix is not inside.
+        self.assertIsNone(
+            image_category_key([self.outer], self.base / "output2" / "a.png")
+        )
+        self.assertIsNone(image_category_key([self.outer], self.outer))
+
+    def test_symlinked_subfolder_is_not_resolved(self):
+        target = self.base / "elsewhere"
+        target.mkdir()
+        link = self.outer / "linked"
+        try:
+            os.symlink(target, link, target_is_directory=True)
+        except (OSError, NotImplementedError):
+            self.skipTest("symlinks are not available")
+        key = image_category_key([self.outer], link / "a.png")
+        self.assertEqual(key[1], "linked/a.png")
+
+    def test_windows_folds_case_of_the_relative_key(self):
+        with patch("py.api.images._path_flavor", ntpath):
+            upper = image_category_key([self.outer], self.outer / "Sub" / "A.PNG")
+            lower = image_category_key([self.outer], self.outer / "sub" / "a.png")
+        self.assertEqual(upper[1], "sub/a.png")
+        self.assertEqual(upper, lower)
+
+    def test_posix_keeps_case_distinct(self):
+        if os.path.normcase("A") == "a":
+            self.skipTest("this OS folds case")
+        upper = image_category_key([self.outer], self.outer / "A.png")
+        lower = image_category_key([self.outer], self.outer / "a.png")
+        self.assertNotEqual(upper, lower)
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_ingestion_resolver_profile.py

@@ -1,9 +1,11 @@
-"""Ingestion keeps the default resolver profile; only inspection routes moved (D1).
+"""Ingestion decides with the default resolver profile first (D1, #247 D-Q1).
 
 The live monitor and the admin scan write pairs and links to the user's
-database, so their resolver semantics stay byte-for-byte today's. f03 (506
-executable nodes) separates the profiles: the default profile's 500-node gate
-leaves it unresolved, while the inspection profile resolves it.
+database, so the default profile decides every file it can, byte-for-byte as
+before. f03 (506 executable nodes) separates the profiles: the default
+profile's 500-node gate leaves it unresolved, while the inspection profile
+resolves it. Only such an undecided file reaches the inspector's resolve
+(``inspection_resolution``), and only its positive is stored (#247).
 """
 
 import logging
@@ -68,24 +70,26 @@ class TestIngestionKeepsDefaultProfile(unittest.TestCase):
         spy.assert_default_and_gated(self)
         handler.db_manager.link_image_to_prompt_or_raise.assert_called_once()
 
-    def test_admin_scan_ingestion_uses_the_default_profile(self):
+    def test_admin_scan_ingestion_uses_the_default_profile_first(self):
         from py.api import admin
+        from utils import file_prompt
 
         mixin = admin.AdminRoutesMixin.__new__(admin.AdminRoutesMixin)
         mixin.db = Mock()
-        mixin.db.get_prompt_by_hash.return_value = None
-        mixin.db.save_prompt.return_value = 7
         spy = _Spy()
-        with patch.object(admin, "resolve_prompt_pair", spy):
+        with (
+            patch.object(file_prompt, "resolve_prompt_pair", spy),
+            patch.object(
+                admin, "store_scanned_prompt", return_value=("added", 7)
+            ) as store,
+        ):
             status = mixin._ingest_scanned_file(Path("/out/f03.png"), _f03_metadata())
         spy.assert_default_and_gated(self)
-        # The resolver leaves f03 unresolved; the scan links the prompt the
-        # browser parser traces, as the inspector shows it.
+        # The default profile leaves f03 unresolved; the inspector's resolve
+        # names the prompt the inspector shows, and the scan stores it.
         self.assertEqual(status, "added")
-        self.assertEqual(
-            mixin.db.save_prompt.call_args.args[0], "a red fox in snow, detailed fur"
-        )
-        mixin.db.link_image_to_prompt.assert_called_once()
+        self.assertEqual(store.call_args.args[3], "a red fox in snow, detailed fur")
+        mixin.db.link_image_to_prompt.assert_not_called()
 
 
 if __name__ == "__main__":

tests/test_inspect_image_categories.py

@@ -0,0 +1,277 @@
+"""The inspector and History show an image's own category (#332 §5, DC4, DC5)."""
+
+import os
+import sqlite3
+import unittest
+from unittest.mock import patch
+
+from tests import test_api_history_outputs as history
+from tests.test_api_images import make_png
+from py.api.images import _favorite_root_key, image_category_key
+from utils.inspection_response import (
+    OWN_CATEGORY_UNREAD,
+    _library_projection,
+    apply_own_category,
+)
+
+
+class InspectCase(history.ImageAPITestCase):
+    async def tearDownAsync(self):
+        self.api.db.close_all()
+        await super().tearDownAsync()
+
+    def own(self, path, value, sources=None):
+        sources = sources or self.api._get_all_output_dirs()
+        self.api.db.set_image_categories([image_category_key(sources, path)], value)
+
+    async def library(self, path, root="0"):
+        response = await self.client.get(
+            f"/prompt_manager/images/inspect/{path}", params={"root": root}
+        )
+        body = await response.json()
+        self.assertEqual(response.status, 200, body)
+        return body["library"]
+
+
+class TestInspectorOwnCategory(InspectCase):
+    async def test_inspect_reports_image_scope(self):
+        path = make_png(self.output_dir / "image.png")
+        self.own(path, "Portraits")
+        library = await self.library("image.png")
+        self.assertEqual(library["status"], "none")
+        self.assertEqual(
+            (library["category"], library["category_scope"]), ("Portraits", "image")
+        )
+
+    async def test_own_overrides_linked_recipe_and_ambiguous(self):
+        db = self.api.db
+        linked = make_png(self.output_dir / "linked.png")
+        self._link_image(linked, "castle at dusk")
+        prompt = db.get_prompt_id_for_image(str(linked))
+        with db.model.get_connection() as conn:
+            conn.execute(
+                "UPDATE prompts SET category='Landscapes' WHERE id=?", (prompt,)
+            )
+        library = await self.library("linked.png")
+        self.assertEqual(
+            (library["category"], library["category_scope"]),
+            ("Landscapes", "positive"),
+        )
+        self.own(linked, "Portraits")
+        library = await self.library("linked.png")
+        self.assertEqual(library["status"], "linked")
+        self.assertEqual(
+            (library["category"], library["category_scope"]), ("Portraits", "image")
+        )
+        recipe = make_png(self.output_dir / "recipe.png")
+        self._save_prompt("Pair positive", category="Night")
+        pair = db.save_prompt_pair("Pair positive", "Noise", category="Recipes")
+        positive = db.get_prompt_pair(pair)["positive_prompt_id"]
+        image = db.link_image_to_prompt(positive, str(recipe))
+        db.link_image_to_pair(pair, image, {"source": "fixture"})
+        library = await self.library("recipe.png")
+        self.assertEqual(
+            (library["category"], library["category_scope"]), ("Recipes", "pair")
+        )
+        self.own(recipe, "Mine")
+        library = await self.library("recipe.png")
+        self.assertEqual(
+            (library["category"], library["category_scope"]), ("Mine", "image")
+        )
+        ambiguous = make_png(self.output_dir / "ambiguous.png")
+        self._link_image(ambiguous, "owner one")
+        self._link_image(ambiguous, "owner two")
+        self.own(ambiguous, "Scans")
+        library = await self.library("ambiguous.png")
+        self.assertEqual(library["status"], "ambiguous")
+        self.assertEqual(
+            (library["category"], library["category_scope"]), ("Scans", "image")
+        )
+
+    async def test_a_failed_read_hides_the_category(self):
+        linked = make_png(self.output_dir / "linked.png")
+        self._link_image(linked, "castle at dusk")
+
+        def broken(*_args, **_kwargs):
+            raise sqlite3.OperationalError("secret")
+
+        with patch.object(self.api.db, "image_category", side_effect=broken):
+            with self.assertLogs("prompt_manager", level="WARNING"):
+                library = await self.library("linked.png")
+        self.assertEqual(library["status"], "linked")
+        self.assertIsNone(library["category"])
+        self.assertIsNone(library["category_scope"])
+
+    async def test_a_lora_root_reads_no_own_category(self):
+        lora = self.comfy_dir / "loras"
+        make_png(lora / "preview.png")
+        roots = [self.output_dir, lora]
+        reads = []
+        real = self.api.db.image_category
+
+        def recorded(*args):
+            reads.append(args)
+            return real(*args)
+
+        with (
+            patch.object(self.api, "_media_roots", lambda outputs: roots),
+            patch.object(self.api, "_linked_only_error", self._no_error),
+            patch.object(self.api.db, "image_category", side_effect=recorded),
+        ):
+            response = await self.client.get(
+                "/prompt_manager/images/inspect/preview.png", params={"root": "1"}
+            )
+            body = await response.json()
+        self.assertEqual(response.status, 200, body)
+        self.assertEqual(reads, [])
+        self.assertIsNone(body["library"]["category"])
+
+    @staticmethod
+    async def _no_error(*_args):
+        return None
+
+
+class TestProjection(unittest.TestCase):
+    def test_scope_image_is_kept_for_category_only(self):
+        base = {"status": "none", "scope": "saved-library", "tags": []}
+        projected = _library_projection(
+            {**base, "category": "Scans", "category_scope": "image"}
+        )
+        self.assertEqual(projected["category_scope"], "image")
+        projected = _library_projection({**base, "tags_scope": "image"})
+        self.assertNotIn("tags_scope", projected)
+
+    def test_apply_own_category_three_cases(self):
+        library = {"status": "linked", "category": "L", "category_scope": "positive"}
+        self.assertEqual(
+            apply_own_category(library, "Mine"),
+            {"status": "linked", "category": "Mine", "category_scope": "image"},
+        )
+        self.assertEqual(apply_own_category(library, None), library)
+        self.assertEqual(
+            apply_own_category(library, OWN_CATEGORY_UNREAD),
+            {"status": "linked", "category": None, "category_scope": None},
+        )
+        self.assertEqual(library["category"], "L")  # never mutated
+
+
+class TestHistoryOwnCategory(history.ImageAPITestCase):
+    """Only the inspection request reads the own category, keyed as Images."""
+
+    # The History fixture's helpers, without inheriting its tests.
+    _base = history.HistoryOutputAPITests
+    ref = _base.ref
+    capture = _base.capture
+    outputs = _base.outputs
+    current = _base.current
+    media = _base.media
+
+    async def get_application(self):
+        app = await super().get_application()
+        self.temp_dir = self.comfy_dir / "temp"
+        self.temp_dir.mkdir()
+        self.host_output = str(self.output_dir)
+        self.host_temp = str(self.temp_dir)
+        self.patches = history.ExitStack()
+        self.addCleanup(self.patches.close)
+        for name, value in (
+            ("folder_paths.get_output_directory", lambda: self.host_output),
+            ("folder_paths.get_temp_directory", lambda: self.host_temp),
+        ):
+            self.patches.enter_context(patch(name, value, create=True))
+        self.patches.enter_context(
+            patch.object(
+                history.GalleryConfig,
+                "allowed_gallery_parents",
+                lambda: [str(self.comfy_dir)],
+            )
+        )
+        return app
+
+    async def tearDownAsync(self):
+        self.api.close_history_reads()
+        self.patches.close()
+        await super().tearDownAsync()
+
+    async def inspect(self, start):
+        descriptor = await self.media(start)
+        response = await self.current(descriptor["inspection_url"])
+        body = await response.json()
+        self.assertEqual(response.status, 200, body)
+        return body["library"]
+
+    async def test_history_inspection_shows_own_category(self):
+        path = make_png(self.output_dir / "image.png")
+        self.api.db.set_image_categories(
+            [image_category_key([self.output_dir], path)], "Portraits"
+        )
+        start = self.capture([self.ref()])
+        library = await self.inspect(start)
+        self.assertEqual(
+            (library["category"], library["category_scope"]), ("Portraits", "image")
+        )
+
+    async def test_nested_sources_give_the_images_key(self):
+        inner = self.output_dir / "nested"
+        path = make_png(inner / "image.png")
+        self.api._get_all_output_dirs = lambda: [self.output_dir, inner]
+        self.api.db.set_image_categories(
+            [(_favorite_root_key(inner), "image.png")], "S"
+        )
+        start = self.capture([self.ref(subfolder="nested")])
+        library = await self.inspect(start)
+        self.assertEqual(library["category"], "S")
+        self.assertEqual(
+            image_category_key([self.output_dir, inner], path),
+            (_favorite_root_key(inner), "image.png"),
+        )
+
+    async def test_a_symlinked_output_folder_still_shows_it(self):
+        real = self.comfy_dir / "real-output"
+        real.mkdir()
+        link = self.comfy_dir / "linked-output"
+        self._make_symlink(real, link, target_is_directory=True)
+        make_png(real / "image.png")
+        self.host_output = str(link)
+        self.api._get_all_output_dirs = lambda: [real]
+        self.api.db.set_image_categories([(_favorite_root_key(real), "image.png")], "S")
+        start = self.capture([self.ref()])
+        library = await self.inspect(start)
+        self.assertEqual(library["category"], "S")
+
+    async def test_outputs_and_media_read_no_own_category(self):
+        make_png(self.output_dir / "image.png")
+        start = self.capture([self.ref()])
+        reads = []
+        real = self.api.db.image_category
+
+        def recorded(*args):
+            reads.append(args)
+            return real(*args)
+
+        with patch.object(self.api.db, "image_category", side_effect=recorded):
+            descriptor = await self.media(start)
+            for field in ("url", "thumbnail_url"):
+                response = await self.current(descriptor[field])
+                await response.read()
+                self.assertEqual(response.status, 200)
+            self.assertEqual(reads, [])
+            await self.current(descriptor["inspection_url"])
+            self.assertEqual(len(reads), 1)
+
+    async def test_a_temp_output_has_none(self):
+        reference = {"folder_type": "temp", "subfolder": "", "filename": "a.png"}
+        self.assertIsNone(self.api._history_own_category(reference, None))
+
+    async def test_a_failed_read_hides_it(self):
+        make_png(self.output_dir / "image.png")
+        start = self.capture([self.ref()])
+
+        def broken(*_args):
+            raise sqlite3.OperationalError("secret")
+
+        with patch.object(self.api.db, "image_category", side_effect=broken):
+            with self.assertLogs("prompt_manager", level="WARNING"):
+                library = await self.inspect(start)
+        self.assertIsNone(library["category"])
+        self.assertTrue(os.path.exists(self.output_dir / "image.png"))

tests/test_inspection_response.py

@@ -1426,3 +1426,32 @@ class TestPerRecordBudgets(unittest.TestCase):
         self.assertEqual(metadata["record_formats"], {"workflow": "limited"})
         self.assertEqual(metadata["workflow_graph"]["status"], "limited")
         self.assertEqual(metadata["prompt_graph"]["status"], "absent")
+
+
+class TestInheritedCategory(unittest.TestCase):
+    """#332 MC4: one inherited-category rule for the chip, filter and History."""
+
+    def test_recipe_set_blank_and_absent(self):
+        from utils.inspection_response import inherited_category, library_metadata
+
+        cases = [
+            (("Night", "Recipes", True), ("Recipes", "pair")),
+            (("Night", "   ", True), ("Night", "positive")),
+            (("Night", " \t", True), ("Night", "positive")),
+            (("Night", b" ", True), ("Night", "positive")),
+            (("Night", None, True), ("Night", "positive")),
+            (("Night", "Recipes", False), ("Night", "positive")),
+            (("  ", None, False), ("  ", "positive")),
+            ((None, None, False), (None, "positive")),
+        ]
+        for args, expected in cases:
+            with self.subTest(args=args):
+                self.assertEqual(inherited_category(*args), expected)
+                positive, recipe, has_recipe = args
+                metadata = library_metadata(
+                    positive, ["t"], (recipe, []) if has_recipe else None
+                )
+                self.assertEqual(
+                    (metadata["category"], metadata["category_scope"]), expected
+                )
+                self.assertEqual(metadata["tags_scope"], "positive")

tests/test_pair_scan.py

@@ -1,9 +1,12 @@
 """Metadata scanning enriches known pairs and conservatively leaves conflicts."""
 
 import json
+import sqlite3
 from pathlib import Path
+from unittest.mock import patch
 
 from tests.test_api_admin import AdminAPITestCase
+from utils.hashing import generate_prompt_hash
 
 
 def graph(positive="cat", negative="blur"):
@@ -449,3 +452,159 @@ class TestSamplerLessScan(AdminAPITestCase):
         path = self.output_dir / "saver.png"
         self.assertEqual(self.api._ingest_scanned_file(path, meta), "added")
         self.assertEqual(self._texts(), ["a red fox"])
+
+
+class TestScanDecision(AdminAPITestCase):
+    """The scan applies the shared per-file decision (#247): one prompt per
+    file, no junk text, marks on every prompt it creates."""
+
+    def _path(self, name):
+        path = self.output_dir / name
+        path.write_bytes(b"png")
+        return path
+
+    def _links(self, path):
+        rows = self.api.db.model.get_connection().execute(
+            "SELECT prompt_id FROM generated_images WHERE image_path=?", (str(path),)
+        )
+        return [row[0] for row in rows]
+
+    def _prompt(self, text):
+        return self.api.db.get_prompt_by_hash(generate_prompt_hash(text))
+
+    def test_a_file_linked_to_another_prompt_is_a_conflict(self):
+        path = self._path("fox.png")
+        other = self.api.db.save_prompt(
+            "a dog", prompt_hash=generate_prompt_hash("a dog")
+        )
+        self.api.db.link_image_to_prompt(other, str(path))
+        meta = {"prompt": json.dumps(flux_graph())}
+        self.assertEqual(self.api._ingest_scanned_file(path, meta), "conflict")
+        self.assertEqual(self._links(path), [other])
+        self.assertIsNone(self._prompt("a red fox"))
+
+    def test_junk_text_is_never_stored(self):
+        cases = {
+            "lora.png": {"prompt": json.dumps(flux_graph(text="<lora:style:1.00>"))},
+            "model.png": {"parameters": "models/flux-dev.safetensors"},
+        }
+        for name, meta in cases.items():
+            with self.subTest(name=name):
+                path = self._path(name)
+                self.assertEqual(self.api._ingest_scanned_file(path, meta), "found")
+                self.assertEqual(self._links(path), [])
+        self.assertEqual(self.api.db.get_recent_prompts()["prompts"], [])
+
+    def test_created_prompts_carry_the_scan_marks(self):
+        path = self._path("pair.png")
+        meta = {"prompt": json.dumps(sampled_graph("cat", "blur"))}
+        self.assertEqual(self.api._ingest_scanned_file(path, meta), "added")
+        for text in ("cat", "blur"):
+            prompt = self._prompt(text)
+            self.assertEqual(prompt["category"], "scanned")
+            self.assertEqual(prompt["tags"], ["auto-scanned"])
+            self.assertEqual(prompt["notes"], "Auto-scanned from pair.png")
+
+    def test_outcome_of_a_positive_reports_its_title(self):
+        """Regression guard (passes on the base): the detailed positive row."""
+        path = self._path("fox.png")
+        meta = {"prompt": json.dumps(flux_graph())}
+        first = self.api._ingest_scanned_file(path, meta, detailed=True)
+        self.assertEqual(first, {"status": "added", "title": "a red fox"})
+        again = self.api._ingest_scanned_file(path, meta, detailed=True)
+        self.assertEqual(again["status"], "unchanged")
+        other = self._path("fox2.png")
+        linked = self.api._ingest_scanned_file(other, meta, detailed=True)
+        self.assertEqual(linked["status"], "linked")
+
+    def test_outcome_of_a_pair_reports_its_counts(self):
+        """Regression guard (passes on the base): the detailed pair row."""
+        path = self._path("pair.png")
+        meta = {"prompt": json.dumps(sampled_graph("cat", "blur"))}
+        result = self.api._ingest_scanned_file(path, meta, detailed=True)
+        self.assertEqual(result["status"], "added")
+        self.assertEqual((result["pairs_added"], result["links_added"]), (1, 1))
+        self.assertEqual(result["title"], "cat")
+
+    def test_outcome_without_a_store_reports_the_unlinked_status(self):
+        """Regression guard (passes on the base): never-stored rows."""
+        path = self._path("notes.png")
+        meta = {"prompt": json.dumps({"40": {"class_type": "Textbox", "inputs": {}}})}
+        self.assertEqual(self.api._ingest_scanned_file(path, meta), "found")
+        self.assertIsNone(self.api._ingest_scanned_file(path, {}))
+
+    def test_review_lists_get_the_default_profiles_ambiguous_files(self):
+        """Regression guard (passes on the base): Needs review inputs."""
+        g = sampled_graph()
+        g["6"] = {"class_type": "CLIPTextEncode", "inputs": {"text": "dog"}}
+        g["12"] = {**g["3"], "inputs": {**g["3"]["inputs"], "positive": ["6", 0]}}
+        ambiguous, untraced, records = [], [], {}
+        path = self._path("two.png")
+        status = self.api._ingest_scanned_file(
+            path,
+            {"prompt": json.dumps(g)},
+            ambiguous=ambiguous,
+            untraced=untraced,
+            records=records,
+        )
+        # Linked by the legacy floor, still listed (queued only if unlinked).
+        self.assertEqual(status, "added")
+        self.assertEqual((ambiguous, untraced), ([path], []))
+        self.assertEqual(records["canonical"]["prompt"], g)
+
+    def test_an_ambiguous_file_with_a_junk_answer_is_still_queued(self):
+        from tests.test_file_prompt import _numeric_first_branches
+
+        path = self._path("numbers.png")
+        meta = {"prompt": json.dumps(_numeric_first_branches())}
+        with patch.object(
+            type(self.api), "_record_scanned_review", autospec=True
+        ) as record:
+            counts = self.api._ingest_scan_batch_sync([(path, meta)])
+        self.assertEqual(counts["ambiguous"], 1, counts)
+        record.assert_called_once()
+        self.assertEqual(self._links(path), [])
+
+    def test_a_conflict_row_says_the_link_was_kept(self):
+        from py.api.admin import _scan_outcome
+
+        _group, row, _line = _scan_outcome(self._path("c.png"), [], "conflict")
+        self.assertEqual(row["detail"], "Kept: already linked to a different prompt")
+
+    def test_a_library_move_reruns_the_scan_writes(self):
+        from py.api import admin
+
+        real = admin.ingest_resolved_pair
+        model = self.api.db.model
+
+        def moved_once(*args, **kwargs):
+            if not calls:
+                calls.append(1)
+                model._generation += 1
+                raise sqlite3.OperationalError("closed")
+            return real(*args, **kwargs)
+
+        calls = []
+        path = self._path("pair.png")
+        with patch.object(admin, "ingest_resolved_pair", side_effect=moved_once):
+            meta = {"prompt": json.dumps(sampled_graph("cat", "blur"))}
+            self.assertEqual(self.api._ingest_scanned_file(path, meta), "added")
+        self.assertEqual(calls, [1])
+
+    def test_an_off_node_behind_a_pass_through_stores_nothing(self):
+        """#90 regression guard for the scan (main stored nothing here)."""
+        from tests.test_save_to_library import run_graph
+
+        g = run_graph(save=False)
+        g["1"]["class_type"] = "PromptManagerText"
+        g["7"] = {"class_type": "easy showAnything", "inputs": {"anything": ["1", 0]}}
+        g["8"] = {
+            "class_type": "CLIPTextEncode",
+            "inputs": {"text": ["7", 0], "clip": ["4", 1]},
+        }
+        g["3"]["inputs"]["positive"] = ["8", 0]
+        path = self._path("off.png")
+        meta = {"prompt": json.dumps(g)}
+        self.assertEqual(self.api._ingest_scanned_file(path, meta), "not_saved")
+        self.assertEqual(self.api.db.get_recent_prompts()["prompts"], [])
+        self.assertEqual(self._links(path), [])

tests/test_pair_usage_tracking.py

@@ -85,6 +85,23 @@ class TestPairUsageTracking(unittest.TestCase):
             self.db.get_prompt_by_id(pair["negative_prompt_id"])["run_count"], 0
         )
 
+    def test_execution_records_a_cached_run_receipt_for_both_editors(self):
+        from utils.cached_runs import Facts
+
+        node = self.node()
+        node.cached_runs = Mock()
+        node.cached_runs.replayed.return_value = False
+        node.encode_prompt(
+            Mock(),
+            "cat",
+            negative_text="",
+            prompt=pair_graph(negative=""),
+            unique_id="1",
+        )
+        node.cached_runs.record_item.assert_called_once_with(
+            "1", ("cat", ""), Facts(usage_tracking.generate_prompt_hash("cat"), None)
+        )
+
     def test_validation_rejection_never_counts_or_saves(self):
         self.submit(pair_graph())
         self.assertEqual(self.db.list_prompt_pairs()["total"], 0)

tests/test_prompt_usage.py

@@ -278,5 +278,49 @@ class TestNodeRecordsUse(UsageTestCase):
         self.assertEqual(self.db.get_prompt_by_id(pid)["run_count"], 2)
 
 
+class TestNodeRecordsCachedRunReceipt(UsageTestCase):
+    """Each execution leaves a receipt for cached jobs (#347)."""
+
+    GRAPH = {
+        "1": {"class_type": "PromptManagerText", "inputs": {"text": "typed text"}},
+    }
+
+    def _node(self):
+        from unittest import mock
+
+        from prompt_manager_text import PromptManagerText
+
+        node = PromptManagerText.__new__(PromptManagerText)
+        node.db = self.db
+        node.logger = __import__("logging").getLogger("test.prompt_usage")
+        node.prompt_tracker = mock.Mock()
+        node.comfyui_integration = mock.Mock()
+        node._inject_lora_trigger_words = lambda text: text
+        node.cached_runs = mock.Mock()
+        node.cached_runs.replayed.return_value = False
+        return node
+
+    def test_receipt_holds_the_returned_text_and_the_stored_hash(self):
+        from utils.cached_runs import Facts
+
+        node = self._node()
+        node.process_text(
+            "typed text", prepend_text="pre", prompt=self.GRAPH, unique_id="1"
+        )
+        node.cached_runs.record_item.assert_called_once_with(
+            "1", ("pre typed text",), Facts(generate_prompt_hash("typed text"))
+        )
+        # Hook-visible text: the node counts nothing itself
+        row = self.db.get_prompt_by_hash(generate_prompt_hash("typed text"))
+        self.assertEqual(row["run_count"], 0)
+
+    def test_empty_editor_records_empty_facts(self):
+        from utils.cached_runs import Facts
+
+        node = self._node()
+        node.process_text("  ", prompt=self.GRAPH, unique_id="1")
+        node.cached_runs.record_item.assert_called_once_with("1", ("  ",), Facts(None))
+
+
 if __name__ == "__main__":
     unittest.main()

tests/test_recorded_saver_anchor.py

@@ -0,0 +1,463 @@
+"""Recorded run history names the saver that wrote a file (#386, #240).
+
+When a file's graph alone cannot name its prompt (sampler branches that differ
+only in their prompt and share one saver prefix), the inspector asks recorded
+history which save node wrote the file and walks from that node, as the #381
+file-name anchor does. A result the file alone resolves is never changed; a
+recorded saver that names nothing certain leaves the file "several possible
+prompts". The resolved sides are labelled as coming from the recorded run.
+"""
+
+import json
+import unittest
+
+from utils import prompt_pair_resolver as resolver
+from utils.prompt_inspector import inspect_prompt_evidence
+
+try:
+    from tests import saver_anchor_graphs as shapes
+except ImportError:  # discovered with ``-s tests``
+    import saver_anchor_graphs as shapes
+
+
+def _resolve(graph, **options):
+    return resolver.resolve_prompt_pair(
+        {"prompt": graph}, profile=resolver.INSPECTION_PROFILE, **options
+    )
+
+
+def _positive(result):
+    side = result["positive"]
+    return side["text"] if isinstance(side, dict) else None
+
+
+def _evidence(graph, **options):
+    return inspect_prompt_evidence({"prompt": json.dumps(graph)}, **options)
+
+
+# ``branch_bench``'s savers are node ``N3`` of branch N (10s based).
+def _saver(index):
+    return str(index * 10 + 3)
+
+
+def guider_dataset():
+    """The dataset run's shape: SamplerCustomAdvanced branches on BasicGuider
+    (no negative), every branch saved with one prefix."""
+    graph = {
+        "1": {"class_type": "CheckpointLoaderSimple", "inputs": {"ckpt_name": "m"}},
+        "2": {"class_type": "EmptyLatentImage", "inputs": {"width": 64}},
+        "4": {"class_type": "RandomNoise", "inputs": {"noise_seed": 1}},
+        "5": {"class_type": "KSamplerSelect", "inputs": {"sampler_name": "euler"}},
+        "6": {
+            "class_type": "BasicScheduler",
+            "inputs": {"model": ["1", 0], "steps": 8, "scheduler": "simple"},
+        },
+    }
+    for index, text in enumerate(shapes.BRANCH_TEXTS, start=1):
+        base = index * 10
+        graph[str(base)] = {
+            "class_type": "CLIPTextEncode",
+            "inputs": {"text": text, "clip": ["1", 1]},
+        }
+        graph[str(base + 4)] = {
+            "class_type": "BasicGuider",
+            "inputs": {"model": ["1", 0], "conditioning": [str(base), 0]},
+        }
+        graph[str(base + 1)] = {
+            "class_type": "SamplerCustomAdvanced",
+            "inputs": {
+                "noise": ["4", 0],
+                "guider": [str(base + 4), 0],
+                "sampler": ["5", 0],
+                "sigmas": ["6", 0],
+                "latent_image": ["2", 0],
+            },
+        }
+        graph[str(base + 2)] = {
+            "class_type": "VAEDecode",
+            "inputs": {"samples": [str(base + 1), 0], "vae": ["1", 2]},
+        }
+        graph[str(base + 3)] = {
+            "class_type": "SaveImage",
+            "inputs": {
+                "filename_prefix": "dataset/IMG_GEN",
+                "images": [str(base + 2), 0],
+            },
+        }
+    return graph
+
+
+class TestRecordedSaverInResolver(unittest.TestCase):
+    def test_the_recorded_saver_picks_its_branch_of_a_shared_prefix(self):
+        for index, text in enumerate(shapes.BRANCH_TEXTS, start=1):
+            with self.subTest(branch=index):
+                result = _resolve(
+                    shapes.shared_prefix(),
+                    file_name="IMG_GEN_00371_.png",
+                    recorded_saver_id=_saver(index),
+                )
+                self.assertEqual(result["state"], "resolved")
+                self.assertEqual(_positive(result), text)
+                self.assertEqual(result["sampler_id"], str(index * 10 + 1))
+
+    def test_without_a_recorded_saver_the_shared_prefix_stays_several(self):
+        result = _resolve(shapes.shared_prefix(), file_name="IMG_GEN_00371_.png")
+        self.assertEqual(result["state"], "ambiguous")
+
+    def test_a_recorded_saver_the_graph_lacks_anchors_nothing(self):
+        for node in ("missing", "3", "2"):
+            with self.subTest(node=node):
+                result = _resolve(shapes.shared_prefix(), recorded_saver_id=node)
+                self.assertEqual(result["state"], "ambiguous")
+
+    def test_a_recorded_saver_of_an_unknown_class_anchors(self):
+        graph = shapes.branch_bench(
+            prefixes=["dataset/IMG_GEN"] * len(shapes.BRANCH_TEXTS),
+            saver="VendorSaveImage",
+        )
+        result = _resolve(graph, recorded_saver_id=_saver(2))
+        self.assertEqual(_positive(result), shapes.BRANCH_TEXTS[1])
+
+    def test_the_default_profile_ignores_a_recorded_saver(self):
+        result = resolver.resolve_prompt_pair(
+            {"prompt": shapes.shared_prefix()}, recorded_saver_id=_saver(1)
+        )
+        self.assertEqual(result["state"], "ambiguous")
+
+
+class TestRecordedSaverInInspector(unittest.TestCase):
+    def test_the_inspector_shows_the_recorded_branch_labelled_as_recorded(self):
+        evidence = _evidence(
+            shapes.shared_prefix(),
+            file_name="IMG_GEN_00371_.png",
+            recorded_saver_id=_saver(3),
+        )
+        self.assertEqual(evidence["resolution"]["state"], "resolved")
+        positive = evidence["prompts"]["positive"]
+        self.assertEqual(positive["text"], shapes.BRANCH_TEXTS[2])
+        self.assertEqual(positive["source"], "recorded-run")
+        self.assertEqual(evidence["prompts"]["negative"]["source"], "recorded-run")
+
+    def test_a_guider_branch_without_a_negative_shows_its_positive(self):
+        self.assertEqual(
+            _evidence(guider_dataset(), file_name="IMG_GEN_00371_.png")["resolution"][
+                "state"
+            ],
+            "ambiguous",
+        )
+        evidence = _evidence(
+            guider_dataset(), file_name="IMG_GEN_00371_.png", recorded_saver_id="23"
+        )
+        self.assertEqual(
+            evidence["prompts"]["positive"],
+            {
+                "status": "resolved",
+                "text": shapes.BRANCH_TEXTS[1],
+                "source": "recorded-run",
+            },
+        )
+        self.assertEqual(evidence["prompts"]["negative"]["status"], "absent")
+
+    def test_a_file_name_naming_another_saver_contradicts_history(self):
+        # The bench file name names branch 2's saver; history says branch 4's.
+        graph = shapes.branch_bench()
+        for index in (1, 3, 4):
+            graph[_saver(index)]["inputs"]["filename_prefix"] = "bench/run/shared"
+        result = _resolve(
+            graph, file_name="s45_branch_2_00001_.png", recorded_saver_id=_saver(4)
+        )
+        self.assertIs(result["recorded_anchor"], False)
+        evidence = _evidence(
+            shapes.shared_prefix(),
+            file_name="IMG_GEN_00001_.png",
+            recorded_saver_id=_saver(4),
+        )
+        self.assertEqual(
+            evidence["prompts"]["positive"]["text"], shapes.BRANCH_TEXTS[3]
+        )
+
+    def test_a_file_that_resolves_alone_keeps_its_own_result(self):
+        # The file name names branch 2; a recorded saver never overrides it.
+        evidence = _evidence(
+            shapes.branch_bench(),
+            file_name="s45_branch_2_00001_.png",
+            recorded_saver_id=_saver(4),
+        )
+        positive = evidence["prompts"]["positive"]
+        self.assertEqual(positive["text"], shapes.BRANCH_TEXTS[1])
+        self.assertEqual(positive["source"], "graph-inferred")
+
+    def test_a_recorded_saver_that_names_nothing_keeps_several_prompts(self):
+        evidence = _evidence(shapes.shared_prefix(), recorded_saver_id="missing")
+        self.assertEqual(evidence["resolution"]["state"], "ambiguous")
+        self.assertEqual(evidence["prompts"]["positive"]["status"], "ambiguous")
+
+    def test_no_recorded_saver_is_unchanged(self):
+        self.assertEqual(
+            _evidence(shapes.shared_prefix(), recorded_saver_id=None),
+            _evidence(shapes.shared_prefix()),
+        )
+
+
+LLM_TEXT = "a red vintage car parked by the sea, golden hour"
+
+
+def text_generate_run():
+    """The maintainer's moss run: a language model writes PromptManager's text."""
+    return {
+        "1": {"class_type": "CheckpointLoaderSimple", "inputs": {"ckpt_name": "m"}},
+        "2": {"class_type": "EmptyLatentImage", "inputs": {"width": 64}},
+        "17": {"class_type": "PrimitiveStringMultiline", "inputs": {"value": "a car"}},
+        "14": {
+            "class_type": "PrimitiveStringMultiline",
+            "inputs": {"value": "You are a prompt engineer."},
+        },
+        "11": {
+            "class_type": "TextGenerate",
+            "inputs": {
+                "prompt": ["17", 0],
+                "system_prompt": ["14", 0],
+                "clip": ["1", 1],
+                "max_length": 4096,
+                "sampling_mode.seed": 0,
+            },
+        },
+        "36": {
+            "class_type": "PromptManagerPair",
+            "inputs": {
+                "text": ["11", 0],
+                "negative_text": "",
+                "prepend_text": "",
+                "append_text": "",
+                "clip": ["1", 1],
+            },
+        },
+        "7": {
+            "class_type": "KSampler",
+            "inputs": {
+                "seed": 1,
+                "steps": 20,
+                "cfg": 1.0,
+                "sampler_name": "euler",
+                "scheduler": "simple",
+                "denoise": 1.0,
+                "model": ["1", 0],
+                "positive": ["36", 0],
+                "negative": ["36", 1],
+                "latent_image": ["2", 0],
+            },
+        },
+        "8": {
+            "class_type": "VAEDecode",
+            "inputs": {"samples": ["7", 0], "vae": ["1", 2]},
+        },
+        "9": {
+            "class_type": "SaveImage",
+            "inputs": {"filename_prefix": "moss", "images": ["8", 0]},
+        },
+    }
+
+
+def two_generated_branches():
+    """``text_generate_run`` plus a second generated branch saved by an unknown
+    saver and also previewed."""
+    graph = text_generate_run()
+    graph["31"] = {**graph["11"], "inputs": {**graph["11"]["inputs"]}}
+    graph["37"] = {
+        "class_type": "PromptManagerPair",
+        "inputs": {**graph["36"]["inputs"], "text": ["31", 0]},
+    }
+    graph["20"] = {
+        "class_type": "KSampler",
+        "inputs": {
+            **graph["7"]["inputs"],
+            "positive": ["37", 0],
+            "negative": ["37", 1],
+        },
+    }
+    graph["21"] = {
+        "class_type": "VAEDecode",
+        "inputs": {"samples": ["20", 0], "vae": ["1", 2]},
+    }
+    graph["22"] = {
+        "class_type": "Image Save",
+        "inputs": {"filename_prefix": "other", "images": ["21", 0]},
+    }
+    graph["23"] = {"class_type": "PreviewImage", "inputs": {"images": ["21", 0]}}
+    return graph
+
+
+class TestRecordedTexts(unittest.TestCase):
+    """The texts PromptManager recorded at execution, per sampler of the run."""
+
+    def test_a_run_time_text_shows_what_the_run_recorded(self):
+        alone = _evidence(text_generate_run(), file_name="moss_00026_.png")
+        self.assertEqual(alone["resolution"]["reason_code"], "runtime-value")
+        evidence = _evidence(
+            text_generate_run(),
+            file_name="moss_00026_.png",
+            recorded_saver_id="9",
+            recorded_texts={"7": {"positive": LLM_TEXT, "negative": ""}},
+        )
+        self.assertEqual(
+            evidence["prompts"],
+            {
+                "positive": {
+                    "status": "resolved",
+                    "text": LLM_TEXT,
+                    "source": "execution",
+                },
+                "negative": {"status": "resolved", "text": "", "source": "execution"},
+            },
+        )
+        self.assertEqual(evidence["resolution"]["state"], "resolved")
+        self.assertEqual(evidence["resolution"]["sampler_id"], "7")
+
+    def test_an_unrecorded_negative_stays_open(self):
+        evidence = _evidence(
+            text_generate_run(),
+            recorded_saver_id="9",
+            recorded_texts={"7": {"positive": LLM_TEXT, "negative": None}},
+        )
+        self.assertEqual(evidence["prompts"]["positive"]["text"], LLM_TEXT)
+        self.assertEqual(evidence["prompts"]["negative"]["status"], "unresolved")
+
+    def test_texts_that_do_not_name_the_open_sampler_change_nothing(self):
+        alone = _evidence(text_generate_run())
+        for texts in (
+            {"8": {"positive": LLM_TEXT, "negative": ""}},
+            {"7": {"positive": None, "negative": ""}},
+            {"7": {"positive": "  ", "negative": ""}},
+            {"7": "not roles"},
+            {},
+        ):
+            with self.subTest(texts=texts):
+                self.assertEqual(
+                    _evidence(
+                        text_generate_run(), recorded_saver_id="9", recorded_texts=texts
+                    ),
+                    alone,
+                )
+
+    def test_texts_need_the_saver_history_recorded_to_lead_to_the_sampler(self):
+        texts = {"7": {"positive": LLM_TEXT, "negative": ""}}
+        alone = _evidence(text_generate_run())
+        for saver in (None, "missing", "2"):
+            with self.subTest(saver=saver):
+                self.assertEqual(
+                    _evidence(
+                        text_generate_run(),
+                        recorded_saver_id=saver,
+                        recorded_texts=texts,
+                    ),
+                    alone,
+                )
+
+    def test_texts_follow_the_recorded_saver_not_another_sampler(self):
+        # Review: the texts are those of the sampler history's saver leads to.
+        graph = two_generated_branches()
+        texts = {
+            "7": {"positive": "STAGE X TEXT", "negative": ""},
+            "20": {"positive": "STAGE Y TEXT", "negative": ""},
+        }
+        for saver, text, sampler in (
+            ("22", "STAGE Y TEXT", "20"),
+            ("9", "STAGE X TEXT", "7"),
+        ):
+            with self.subTest(saver=saver):
+                evidence = _evidence(
+                    graph,
+                    file_name="renamed_00001_.png",
+                    recorded_saver_id=saver,
+                    recorded_texts=texts,
+                )
+                self.assertEqual(evidence["prompts"]["positive"]["text"], text)
+                self.assertEqual(evidence["resolution"]["sampler_id"], sampler)
+
+
+class TestInspectionResolution(unittest.TestCase):
+    """``inspection_resolution``: the inspector's resolve and recorded anchor,
+    shared with ingestion (#247), so the two cannot drift."""
+
+    def _result(self, graph, saver=None, *, as_text=True, name="IMG_GEN_00371_.png"):
+        from utils.prompt_inspector import inspection_resolution
+
+        prompt = json.dumps(graph) if as_text else graph
+        return inspection_resolution({"prompt": prompt}, name, saver)
+
+    def test_the_recorded_saver_names_its_branch_by_record(self):
+        result = self._result(shapes.shared_prefix(), _saver(2))
+        self.assertTrue(result.by_record)
+        self.assertFalse(result.malformed)
+        self.assertEqual(result.resolution["state"], "resolved")
+        self.assertEqual(_positive(result.resolution), shapes.BRANCH_TEXTS[1])
+        self.assertIs(result.anchored, result.resolution)
+
+    def test_without_a_saver_nothing_is_anchored(self):
+        result = self._result(shapes.shared_prefix())
+        self.assertEqual(result.resolution["state"], "ambiguous")
+        self.assertIsNone(result.anchored)
+        self.assertFalse(result.by_record)
+
+    def test_a_saver_that_names_nothing_keeps_the_open_result(self):
+        result = self._result(shapes.shared_prefix(), "missing")
+        self.assertEqual(result.resolution["state"], "ambiguous")
+        self.assertIsNotNone(result.anchored)
+        self.assertFalse(result.by_record)
+
+    def test_a_file_that_resolves_alone_is_never_anchored(self):
+        result = self._result(
+            shapes.branch_bench(), _saver(4), name="s45_branch_2_00001_.png"
+        )
+        self.assertEqual(_positive(result.resolution), shapes.BRANCH_TEXTS[1])
+        self.assertIsNone(result.anchored)
+        self.assertFalse(result.by_record)
+
+    def test_parsed_metadata_resolves_as_the_file_text_does(self):
+        # The monitor hands parsed dicts; the scan hands the file's strings.
+        parsed = self._result(shapes.shared_prefix(), _saver(3), as_text=False)
+        text = self._result(shapes.shared_prefix(), _saver(3))
+        self.assertEqual(parsed.resolution, text.resolution)
+
+    def test_malformed_metadata_is_reported_as_malformed(self):
+        from utils.prompt_inspector import inspection_resolution
+
+        result = inspection_resolution({"prompt": "{not json"}, None, None)
+        self.assertTrue(result.malformed)
+        self.assertEqual(result.resolution["state"], "unresolved")
+        self.assertEqual(result.resolution["reason_code"], "malformed")
+
+    def test_metadata_without_a_role_record_is_absent(self):
+        from utils.prompt_inspector import inspection_resolution
+
+        result = inspection_resolution({"workflow": "{}"}, None, "9")
+        self.assertFalse(result.malformed)
+        self.assertEqual(result.resolution["state"], "absent")
+
+    def test_without_the_name_anchor_a_file_name_names_no_branch(self):
+        from utils.prompt_inspector import inspection_resolution
+
+        graph = {"prompt": json.dumps(shapes.branch_bench())}
+        name = "s45_branch_2_00001_.png"
+        named = inspection_resolution(graph, name, None)
+        self.assertEqual(_positive(named.resolution), shapes.BRANCH_TEXTS[1])
+        blind = inspection_resolution(graph, name, None, name_anchor=False)
+        self.assertEqual(blind.resolution["state"], "ambiguous")
+        # The recorded saver still decides, and the name still contradicts it.
+        recorded = inspection_resolution(graph, name, _saver(2), name_anchor=False)
+        self.assertTrue(recorded.by_record)
+        shared = {"prompt": json.dumps(shapes.shared_prefix())}
+        bench = shapes.branch_bench()
+        for index in (1, 3, 4):
+            bench[_saver(index)]["inputs"]["filename_prefix"] = "bench/shared"
+        contradicted = inspection_resolution(
+            {"prompt": json.dumps(bench)}, name, _saver(4), name_anchor=False
+        )
+        self.assertFalse(contradicted.by_record)
+        self.assertTrue(
+            inspection_resolution(shared, name, _saver(4), name_anchor=False).by_record
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_run_attribution.py

@@ -9,13 +9,24 @@ import unittest
 from pathlib import Path
 from unittest import mock
 
-from database.run_attribution import stored_run_prompt
+from database.run_attribution import (
+    RecordedOutput,
+    recorded_output,
+    stored_run_prompt,
+)
 from tests import test_execution_history_database as history_tests
 from tests.background_stops import close_handler
 from tests.test_api_admin import AdminAPITestCase
-from tests.test_execution_context_database import snapshot
+from tests import saver_anchor_graphs as shapes
+from tests.test_pair_scan import sampled_graph
+from tests.test_execution_context_database import known, snapshot
 from tests.test_prompt_attribution import issue_graph, llm_text_graph, make_tracker
-from utils.execution_contexts import ContextBundle, RecipeContext
+from utils.execution_contexts import (
+    ContextBundle,
+    PromptSnapshot,
+    RecipeContext,
+    TextEvidence,
+)
 from utils.execution_outputs import (
     OutputBundle,
     OutputReference,
@@ -38,28 +49,34 @@ class RecordedRuns:
     start = history_tests.HistoryDatabaseTests.start
     finish = history_tests.HistoryDatabaseTests.finish
 
-    def record_run(self, db, output_root, files, positives, item=0, window=None):
+    def record_run(
+        self, db, output_root, files, positives, item=0, window=None, nodes=None
+    ):
         started, finished = window or (now_ms() - 5000, now_ms() + 5000)
         start = self.start(db, item, started)
         db.write_execution_start(start)
         finish = self.finish(start, time=finished)
         db.write_execution_finish(finish)
-        db.write_execution_contexts(
-            start.run_id,
-            start.storage_epoch,
-            ContextBundle(
-                tuple(
-                    RecipeContext(str(4 + i), snapshot(text), snapshot(""), "inferred")
-                    for i, text in enumerate(positives)
+        if positives:  # a run with no PromptManager node records no contexts
+            db.write_execution_contexts(
+                start.run_id,
+                start.storage_epoch,
+                ContextBundle(
+                    tuple(
+                        RecipeContext(
+                            str(4 + i), snapshot(text), snapshot(""), "inferred"
+                        )
+                        for i, text in enumerate(positives)
+                    ),
+                    "complete",
+                    "captured",
                 ),
-                "complete",
-                "captured",
-            ),
-        )
+            )
         root = snapshot_output_roots(STYLE, output_root, output_root).output_key
+        nodes = nodes or ["9"] * len(files)
         references = tuple(
-            OutputReference("9", i, "output", sub, name, STYLE, root)
-            for i, (sub, name) in enumerate(files)
+            OutputReference(node, i, "output", sub, name, STYLE, root)
+            for i, (node, (sub, name)) in enumerate(zip(nodes, files))
         )
         db.write_execution_outputs_for_finish(
             finish, OutputBundle(references, "complete", "reported")
@@ -171,6 +188,186 @@ class TestStoredRunPrompt(RecordedRuns, unittest.TestCase):
         self.assertEqual(linked, [prompt_id])
 
 
+class TestRecordedOutputNode(RecordedRuns, unittest.TestCase):
+    """#386: the save node history says wrote a file, under the same rules."""
+
+    close_databases = history_tests.HistoryDatabaseTests.close_databases
+    database = history_tests.HistoryDatabaseTests.database
+    setUp = TestStoredRunPrompt.setUp
+
+    def node(self, path=None):
+        found = recorded_output(self.db, path or self.image, self.output)
+        return found.saver_id if found is not None else None
+
+    def test_one_run_one_saver_names_the_saver(self):
+        other = os.path.join(self.output, "sub", "img_00002_.png")
+        Path(other).write_bytes(b"png")
+        self.record_run(
+            self.db,
+            self.output,
+            [("sub", "img_00001_.png"), ("sub", "img_00002_.png")],
+            [],
+            nodes=["13", "23"],
+        )
+        self.assertEqual(self.node(), "13")
+        self.assertEqual(self.node(other), "23")
+
+    def test_a_run_without_prompt_manager_contexts_still_names_the_saver(self):
+        self.record_run(self.db, self.output, [("sub", "img_00001_.png")], [])
+        self.assertEqual(self.node(), "9")
+
+    def test_two_runs_reporting_the_file_name_nothing(self):
+        self.record_run(
+            self.db, self.output, [("sub", "img_00001_.png")], [], nodes=["13"]
+        )
+        self.record_run(
+            self.db, self.output, [("sub", "img_00001_.png")], [], item=1, nodes=["23"]
+        )
+        self.assertIsNone(self.node())
+
+    def test_one_run_reporting_the_file_from_two_savers_names_nothing(self):
+        self.record_run(
+            self.db,
+            self.output,
+            [("sub", "img_00001_.png"), ("sub", "img_00001_.png")],
+            [],
+            nodes=["13", "23"],
+        )
+        self.assertIsNone(self.node())
+
+    def test_a_file_written_outside_the_run_names_nothing(self):
+        self.record_run(
+            self.db,
+            self.output,
+            [("sub", "img_00001_.png")],
+            [],
+            window=(1_000_000, 2_000_000),
+        )
+        self.assertIsNone(self.node())
+
+    def test_unrecorded_outside_or_unknown_roots_name_nothing(self):
+        self.record_run(self.db, self.output, [("sub", "img_00001_.png")], [])
+        other = os.path.join(self.output, "sub", "other.png")
+        Path(other).write_bytes(b"png")
+        self.assertIsNone(self.node(other))
+        self.assertIsNone(recorded_output(self.db, self.image, None))
+        self.assertIsNone(recorded_output(self.db, "", self.output))
+
+    def test_the_run_texts_recorded_at_execution_come_with_the_saver(self):
+        self.record_run(
+            self.db, self.output, [("sub", "img_00001_.png")], ["an llm prompt"]
+        )
+        self.assertEqual(
+            recorded_output(self.db, self.image, self.output),
+            RecordedOutput("9", {"4": {"positive": "an llm prompt", "negative": ""}}),
+        )
+
+    def test_texts_only_inferred_from_the_graph_are_not_recorded(self):
+        start = self.start(self.db, 0, now_ms() - 5000)
+        self.db.write_execution_start(start)
+        finish = self.finish(start, time=now_ms() + 5000)
+        self.db.write_execution_finish(finish)
+        inferred = TextEvidence("graph text", "inferred", "graph_literal", None)
+        self.db.write_execution_contexts(
+            start.run_id,
+            start.storage_epoch,
+            ContextBundle(
+                (
+                    RecipeContext(
+                        "7",
+                        PromptSnapshot(inferred, inferred, known(""), known("")),
+                        snapshot("kept"),
+                        "inferred",
+                    ),
+                ),
+                "complete",
+                "captured",
+            ),
+        )
+        root = snapshot_output_roots(STYLE, self.output, self.output).output_key
+        self.db.write_execution_outputs_for_finish(
+            finish,
+            OutputBundle(
+                (
+                    OutputReference(
+                        "9", 0, "output", "sub", "img_00001_.png", STYLE, root
+                    ),
+                ),
+                "complete",
+                "reported",
+            ),
+        )
+        self.assertEqual(
+            recorded_output(self.db, self.image, self.output).texts,
+            {"7": {"positive": None, "negative": "kept"}},
+        )
+
+    def test_several_savers_name_no_saver_but_keep_the_texts(self):
+        self.record_run(
+            self.db,
+            self.output,
+            [("sub", "img_00001_.png"), ("sub", "img_00001_.png")],
+            ["text"],
+            nodes=["13", "23"],
+        )
+        found = recorded_output(self.db, self.image, self.output)
+        self.assertIsNone(found.saver_id)
+        self.assertEqual(found.texts, {"4": {"positive": "text", "negative": ""}})
+
+    def test_the_route_lookup_logs_a_failure_and_names_nothing(self):
+        from database.run_attribution import recorded_output_lookup
+
+        broken = mock.Mock()
+        broken.model.get_connection.return_value.execute.side_effect = (
+            sqlite3.OperationalError("locked")
+        )
+        broken.get_execution_contexts.side_effect = sqlite3.OperationalError("x")
+        with mock.patch(
+            "database.run_attribution.host_output_directory", return_value=self.output
+        ):
+            self.assertIsNone(recorded_output_lookup(broken)(self.image))
+            with (
+                mock.patch(
+                    "database.run_attribution.recorded_runs",
+                    side_effect=sqlite3.OperationalError("locked"),
+                ),
+                self.assertLogs("prompt_manager.run_attribution", "WARNING"),
+            ):
+                self.assertIsNone(
+                    recorded_output_lookup(broken, close=True)(self.image)
+                )
+        broken.model.close.assert_called_once_with()
+
+    def test_a_history_reference_spells_the_file_as_history_recorded_it(self):
+        # On Windows the history route's target is normcased (lower case);
+        # history matches names exactly, so the route passes its reference.
+        from database.run_attribution import recorded_output_lookup
+
+        upper = os.path.join(self.output, "sub", "IMG_00001_.png")
+        Path(upper).write_bytes(b"png")
+        self.record_run(self.db, self.output, [("sub", "IMG_00001_.png")], [])
+        target = os.path.join(self.output, "sub", "img_00001_.png")
+        reference = {
+            "folder_type": "output",
+            "subfolder": "sub",
+            "filename": "IMG_00001_.png",
+        }
+        with mock.patch(
+            "database.run_attribution.host_output_directory", return_value=self.output
+        ):
+            found = recorded_output_lookup(self.db, reference=reference)(target)
+            self.assertEqual(found.saver_id, "9")
+            temp = {**reference, "folder_type": "temp"}
+            self.assertIsNone(recorded_output_lookup(self.db, reference=temp)(target))
+
+    def test_a_library_without_history_tables_names_nothing(self):
+        broken = mock.Mock()
+        broken.model.get_connection.return_value.execute.side_effect = (
+            sqlite3.OperationalError("no such table")
+        )
+        self.assertIsNone(recorded_output(broken, self.image, self.output))
+
+
 class TestScanUsesHistory(RecordedRuns, AdminAPITestCase):
     """The output scan applies the same rules as the monitor."""
 
@@ -256,6 +453,86 @@ class TestScanUsesHistory(RecordedRuns, AdminAPITestCase):
         self.assertIsNone(self.linked_prompt(path))
         self.assertEqual(db.list_prompt_pairs()["pairs"], [])
 
+    def scan_dataset(self, names, nodes):
+        """Two branches of the shared-prefix dataset graph, one run, then a scan."""
+        paths = [self.write(name) for name in names]
+        self.record_run(
+            self.api.db,
+            str(self.output_dir),
+            [("", path.name) for path in paths],
+            [],
+            nodes=nodes,
+        )
+        meta = {"prompt": json.dumps(shapes.shared_prefix())}
+        return paths, self.api._ingest_scan_batch_sync([(p, meta) for p in paths])
+
+    def test_the_recorded_saver_links_each_dataset_file_to_its_branch(self):
+        """#247: before, the legacy parser gave every branch the first prompt."""
+        paths, counts = self.scan_dataset(
+            ["IMG_GEN_00001_.png", "IMG_GEN_00002_.png"], ["13", "23"]
+        )
+        self.assertEqual(counts["added"], 2, counts)
+        for path, text in zip(paths, shapes.BRANCH_TEXTS):
+            prompt = self.api.db.get_prompt_by_hash(generate_prompt_hash(text))
+            self.assertEqual(self.linked_prompt(path), prompt["id"])
+            self.assertEqual(prompt["category"], "scanned")
+
+    def test_a_file_the_legacy_answer_linked_is_left_as_it_is(self):
+        """#247 Q5: a rescan never adds a second link to the branch prompt."""
+        db = self.api.db
+        legacy = shapes.BRANCH_TEXTS[0]
+        legacy_id = db.save_prompt(legacy, prompt_hash=generate_prompt_hash(legacy))
+        path = self.write("IMG_GEN_00002_.png")
+        db.link_image_to_prompt(legacy_id, str(path))
+        self.record_run(db, str(self.output_dir), [("", path.name)], [], nodes=["23"])
+        meta = {"prompt": json.dumps(shapes.shared_prefix())}
+        self.assertEqual(self.api._ingest_scanned_file(path, meta), "conflict")
+        self.assertEqual(self.linked_prompt(path), legacy_id)
+        self.assertIsNone(
+            db.get_prompt_by_hash(generate_prompt_hash(shapes.BRANCH_TEXTS[1]))
+        )
+
+    def test_a_recorded_run_never_adds_a_second_link(self):
+        db = self.api.db
+        db.save_prompt(text=LLM_TEXT, prompt_hash=generate_prompt_hash(LLM_TEXT))
+        other = db.save_prompt(text="a dog", prompt_hash=generate_prompt_hash("a dog"))
+        path = self.write("bare_00003_.png")
+        db.link_image_to_prompt(other, str(path))
+        self.record_run(db, str(self.output_dir), [("", path.name)], [LLM_TEXT])
+        self.assertEqual(self.api._ingest_scanned_file(path, {}), "conflict")
+        rows = db.model.get_connection().execute(
+            "SELECT prompt_id FROM generated_images WHERE image_path=?", (str(path),)
+        )
+        self.assertEqual([row[0] for row in rows], [other])
+
+    def test_a_single_file_asks_history_once(self):
+        db = self.api.db
+        db.save_prompt(text=LLM_TEXT, prompt_hash=generate_prompt_hash(LLM_TEXT))
+        path = self.write("llm_00002_.png")
+        self.record_run(db, str(self.output_dir), [("", path.name)], [LLM_TEXT])
+        meta = {"prompt": json.dumps(llm_text_graph())}
+        statements = []
+        conn = db.model.get_connection()
+        conn.set_trace_callback(statements.append)
+        try:
+            self.assertEqual(self.api._ingest_scanned_file(path, meta), "linked")
+        finally:
+            conn.set_trace_callback(None)
+        lookups = [s for s in statements if "FROM execution_run_outputs" in s]
+        self.assertEqual(len(lookups), 1)
+
+    def test_a_file_the_recorded_saver_links_is_not_queued(self):
+        """A default-ambiguous file linked at the inspector's step is no
+        Needs review case."""
+        with mock.patch.object(
+            type(self.api), "_record_scanned_review", autospec=True
+        ) as record:
+            _paths, counts = self.scan_dataset(
+                ["IMG_GEN_00003_.png", "IMG_GEN_00004_.png"], ["13", "23"]
+            )
+        self.assertEqual(counts["added"], 2, counts)
+        record.assert_not_called()
+
 
 class TestHostHelpers(unittest.TestCase):
     """The host lookups degrade to "no proof", never to an error."""
@@ -557,13 +834,17 @@ class TestScanBatchLookup(RecordedRuns, AdminAPITestCase):
     """M5: a scan batch asks history once per chunk of names, not per file."""
 
     def test_a_batch_its_metadata_links_never_asks_history(self):
-        """R3: the batch lookup is made only when a file needs it."""
+        """R3: the batch lookup is made only when a file needs it.
+
+        Since #247 every file the default profile leaves undecided asks (the
+        recorded saver may name its branch), so these files resolve as pairs.
+        """
         files = []
         for n in range(3):
             path = self.output_dir / f"typed_{n:05}_.png"
             path.write_bytes(b"png")
             files.append(path)
-        meta = {"prompt": json.dumps(issue_graph(text="typed mountains"))}
+        meta = {"prompt": json.dumps(sampled_graph("typed mountains"))}
         statements = []
         conn = self.api.db.model.get_connection()
         conn.set_trace_callback(statements.append)
@@ -607,6 +888,72 @@ class TestScanBatchLookup(RecordedRuns, AdminAPITestCase):
         }
         self.assertEqual(linked, {f.name for f in files[:4]})
 
+    def test_the_batch_saver_equals_the_files_recorded_output(self):
+        from py.api.admin import _BatchHistory
+
+        db = self.api.db
+        names = ["one_node.png", "two_nodes.png", "two_runs.png", "unrecorded.png"]
+        files = []
+        for name in names:
+            path = self.output_dir / name
+            path.write_bytes(b"png")
+            files.append(path)
+        root = str(self.output_dir)
+        self.record_run(db, root, [("", "one_node.png")], [], nodes=["13"])
+        self.record_run(
+            db, root, [("", "two_nodes.png")] * 2, [], item=1, nodes=["13", "23"]
+        )
+        self.record_run(db, root, [("", "two_runs.png")], [], item=2)
+        self.record_run(db, root, [("", "two_runs.png")], [], item=3)
+        history = _BatchHistory(self.api, files)
+        with mock.patch(
+            "database.run_attribution.host_output_directory", return_value=root
+        ):
+            for path in files:
+                with self.subTest(path=path.name):
+                    expected = recorded_output(db, str(path), root)
+                    found = history.recorded(str(path))
+                    if expected is None:
+                        self.assertIsNone(found)
+                    else:
+                        self.assertEqual(found.saver_id, expected.saver_id)
+        self.assertEqual(history.recorded(str(files[0])).saver_id, "13")
+        self.assertIsNone(history.recorded(str(files[1])).saver_id)
+
+    def test_a_failed_batch_lookup_is_logged_and_names_nothing(self):
+        from py.api.admin import _BatchHistory
+
+        path = self.output_dir / "x.png"
+        history = _BatchHistory(self.api, [path])
+        with (
+            mock.patch(
+                "py.api.admin.recorded_runs", side_effect=sqlite3.OperationalError("x")
+            ),
+            self.assertLogs("prompt_manager", "WARNING"),
+        ):
+            self.assertIsNone(history.recorded(str(path)))
+        self.assertIsNone(history.get(str(path)))
+
+    def test_a_failed_prompt_lookup_is_logged_and_names_nothing(self):
+        from py.api.admin import _BatchHistory
+
+        path = self.output_dir / "one.png"
+        path.write_bytes(b"png")
+        root = str(self.output_dir)
+        self.record_run(self.api.db, root, [("", path.name)], [LLM_TEXT])
+        history = _BatchHistory(self.api, [path])
+        with (
+            mock.patch(
+                "database.run_attribution.host_output_directory", return_value=root
+            ),
+            mock.patch(
+                "py.api.admin.named_prompt", side_effect=sqlite3.OperationalError("x")
+            ),
+            self.assertLogs("prompt_manager", "WARNING"),
+        ):
+            self.assertIsNone(history.get(str(path)))
+            self.assertEqual(history.recorded(str(path)).saver_id, "9")
+
 
 class TestLinkedOutputRoot(RecordedRuns, unittest.TestCase):
     """R2: ComfyUI's output folder reached through a symlink or junction."""

tests/test_save_to_library.py

@@ -0,0 +1,508 @@
+"""#90 item 3: a node's ``save_to_library`` switch.
+
+Off: PromptManager ignores the run completely (no prompt saved, no run count,
+no image link), while the node still returns its normal outputs. On (the
+default, and every workflow or image made before the switch existed): as before.
+"""
+
+import logging
+import os
+import sys
+import unittest
+from pathlib import Path
+from unittest import mock
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+try:
+    from tests.test_prompt_attribution import MonitorCase, NodeCase
+    from tests.test_execution_contexts import load_module
+except ImportError:  # discovered with tests/ as the top-level directory
+    from test_prompt_attribution import MonitorCase, NodeCase
+    from test_execution_contexts import load_module
+
+from prompt_manager import PromptManager, PromptManagerFocused, PromptManagerSplit
+from prompt_manager_pair import PromptManagerPair
+from prompt_manager_text import PromptManagerText
+from prompt_search_list import PromptSearchList
+from utils.hashing import generate_prompt_hash
+from utils.prompt_graph import (
+    intrinsic_pair_nodes,
+    positive_opt_outs,
+    run_prompt_components,
+    run_prompt_nodes,
+    save_setting,
+)
+from utils.run_keys import prompt_node_key
+from utils.usage_tracking import (
+    PendingFirstUse,
+    QueuedRuns,
+    handle_queued_prompt,
+    on_dequeue,
+    queued_pair_runs,
+    queued_prompt_runs,
+)
+
+POSITIVE = "a lighthouse at dusk"
+NEGATIVE = "blurry"
+NODE_CLASSES = (
+    PromptManager,
+    PromptManagerText,
+    PromptManagerFocused,
+    PromptManagerSplit,
+    PromptManagerPair,
+)
+
+
+def run_graph(save=None, kind="PromptManager", negative_save=None):
+    """A PromptManager positive feeding a KSampler; ``save`` None leaves it out."""
+    inputs = {"text": POSITIVE, "clip": ["4", 1]}
+    if save is not None:
+        inputs["save_to_library"] = save
+    negative_inputs = {"text": NEGATIVE, "clip": ["4", 1]}
+    if negative_save is not None:
+        negative_inputs["save_to_library"] = negative_save
+    return {
+        "1": {"class_type": kind, "inputs": inputs},
+        "2": {"class_type": "PromptManager", "inputs": negative_inputs},
+        "4": {"class_type": "CheckpointLoaderSimple", "inputs": {"ckpt_name": "m"}},
+        "3": {
+            "class_type": "KSampler",
+            "inputs": {
+                "model": ["4", 0],
+                "positive": ["1", 0],
+                "negative": ["2", 0],
+                "latent_image": ["6", 0],
+            },
+        },
+        "6": {"class_type": "EmptyLatentImage", "inputs": {"batch_size": 1}},
+    }
+
+
+def pair_graph(save=None):
+    inputs = {"text": POSITIVE, "negative_text": NEGATIVE, "clip": ["4", 1]}
+    if save is not None:
+        inputs["save_to_library"] = save
+    return {
+        "1": {"class_type": "PromptManagerPair", "inputs": inputs},
+        "4": {"class_type": "CheckpointLoaderSimple", "inputs": {"ckpt_name": "m"}},
+        "3": {
+            "class_type": "KSampler",
+            "inputs": {
+                "model": ["4", 0],
+                "positive": ["1", 0],
+                "negative": ["1", 1],
+                "latent_image": ["6", 0],
+            },
+        },
+        "6": {"class_type": "EmptyLatentImage", "inputs": {"batch_size": 1}},
+    }
+
+
+class TestInputDeclaration(unittest.TestCase):
+    def test_every_prompt_manager_node_declares_a_boolean_defaulting_on(self):
+        for cls in NODE_CLASSES:
+            optional = cls.INPUT_TYPES()["optional"]
+            kind, options = optional["save_to_library"]
+            self.assertEqual(kind, "BOOLEAN", cls.__name__)
+            self.assertIs(options["default"], True, cls.__name__)
+            # Declared last: no saved widget value of an older workflow shifts
+            self.assertEqual(list(optional)[-1], "save_to_library", cls.__name__)
+
+    def test_search_list_has_no_switch(self):
+        inputs = PromptSearchList.INPUT_TYPES()
+        self.assertNotIn("save_to_library", inputs.get("optional", {}))
+        self.assertNotIn("save_to_library", inputs.get("required", {}))
+
+
+class TestSaveSetting(unittest.TestCase):
+    def test_missing_input_is_on(self):
+        self.assertIs(save_setting(run_graph(), "1"), True)
+
+    def test_literals_follow_comfyui_boolean_coercion(self):
+        for value, expected in (
+            (True, True),
+            (False, False),
+            ("", False),
+            (0, False),
+            ({"__value__": False}, False),
+            ({"__value__": True}, True),
+        ):
+            with self.subTest(value=value):
+                self.assertIs(save_setting(run_graph(save=value), "1"), expected)
+
+    def test_link_to_primitive_boolean_is_read(self):
+        for value in (True, False):
+            graph = run_graph(save=["9", 0])
+            graph["9"] = {"class_type": "PrimitiveBoolean", "inputs": {"value": value}}
+            self.assertIs(save_setting(graph, "1"), value)
+
+    def test_link_to_an_unknown_node_is_not_knowable(self):
+        graph = run_graph(save=["9", 0])
+        graph["9"] = {"class_type": "SomeCustomSwitch", "inputs": {}}
+        self.assertIsNone(save_setting(graph, "1"))
+        self.assertIsNone(save_setting(run_graph(save=["missing", 0]), "1"))
+
+
+class TestGraphRoles(unittest.TestCase):
+    def test_opted_out_positive_is_not_a_run_prompt(self):
+        graph = run_graph(save=False)
+        self.assertEqual(run_prompt_nodes(graph), [])
+        self.assertEqual(run_prompt_components(graph), [])
+        self.assertEqual(positive_opt_outs(graph), ["1"])
+
+    def test_enabled_positive_is_unchanged(self):
+        for save in (None, True):
+            graph = run_graph(save=save)
+            self.assertEqual(run_prompt_nodes(graph), ["1"])
+            self.assertEqual(positive_opt_outs(graph), [])
+
+    def test_opted_out_negative_is_no_positive_opt_out(self):
+        graph = run_graph(negative_save=False)
+        self.assertEqual(run_prompt_nodes(graph), ["1"])
+        self.assertEqual(positive_opt_outs(graph), [])
+
+    def test_walk_stops_at_an_opted_out_node(self):
+        graph = run_graph(save=False)
+        graph["1"]["inputs"]["text"] = ["7", 0]
+        graph["7"] = {"class_type": "PromptManagerText", "inputs": {"text": "x"}}
+        self.assertEqual(run_prompt_nodes(graph), [])
+
+    def test_sampler_less_fallback_skips_opted_out_nodes(self):
+        graph = {
+            "1": {
+                "class_type": "PromptManagerText",
+                "inputs": {"text": "a", "save_to_library": False},
+            },
+            "2": {"class_type": "PromptManagerText", "inputs": {"text": "b"}},
+        }
+        self.assertEqual(run_prompt_nodes(graph), ["2"])
+        self.assertEqual(run_prompt_components(graph), [("2", "text")])
+        self.assertEqual(positive_opt_outs(graph), ["1"])
+
+    def test_opted_out_pair_is_not_an_intrinsic_pair(self):
+        self.assertEqual(intrinsic_pair_nodes(pair_graph()), ["1"])
+        self.assertEqual(intrinsic_pair_nodes(pair_graph(save=False)), [])
+
+
+class TestQueueHook(unittest.TestCase):
+    def test_opted_out_node_is_never_stashed(self):
+        self.assertEqual(queued_prompt_runs(run_graph(save=False)), [])
+        self.assertEqual(queued_pair_runs(pair_graph(save=False)), [])
+
+    def test_unknown_setting_is_left_to_the_node(self):
+        graph = run_graph(save=["9", 0])
+        graph["9"] = {"class_type": "SomeCustomSwitch", "inputs": {}}
+        self.assertEqual(queued_prompt_runs(graph), [])
+        pair = pair_graph(save=["9", 0])
+        pair["9"] = {"class_type": "SomeCustomSwitch", "inputs": {}}
+        self.assertEqual(queued_pair_runs(pair), [])
+
+    def test_primitive_boolean_on_still_counts(self):
+        graph = run_graph(save=["9", 0])
+        graph["9"] = {"class_type": "PrimitiveBoolean", "inputs": {"value": True}}
+        self.assertEqual(
+            queued_prompt_runs(graph), [(generate_prompt_hash(POSITIVE), POSITIVE)]
+        )
+
+    def test_dequeue_counts_nothing_for_a_cached_opted_out_node(self):
+        """A cached node never executes: only the queued graph can say it is off."""
+        db = mock.Mock()
+        db.get_prompt_by_hash.return_value = {"id": 5}
+        queued, pending = QueuedRuns(), PendingFirstUse()
+        request = {"prompt": run_graph(save=False), "prompt_id": "job-1"}
+        handle_queued_prompt(request, queued, pair_queued=QueuedRuns())
+        on_dequeue("job-1", queued, lambda: db, pending, pair_queued=QueuedRuns())
+        db.record_prompt_use.assert_not_called()
+        self.assertEqual(pending.consume(generate_prompt_hash(POSITIVE)), 0)
+
+
+class TestNodesSaveNothing(NodeCase):
+    def run_node(self, cls, graph, save):
+        node = self.node(cls)
+        node.record_pair = mock.Mock()
+        kwargs = {"prompt": graph, "unique_id": "1", "save_to_library": save}
+        if cls is PromptManagerText:
+            return node, node.process_text(POSITIVE, **kwargs)
+        if cls is PromptManagerPair:
+            return node, node.encode_prompt(
+                self.clip(), POSITIVE, negative_text=NEGATIVE, **kwargs
+            )
+        return node, node.encode_prompt(self.clip(), POSITIVE, **kwargs)
+
+    def test_off_saves_counts_and_tracks_nothing_but_returns_outputs(self):
+        for cls in NODE_CLASSES:
+            with self.subTest(node=cls.__name__):
+                graph = (
+                    pair_graph(save=False)
+                    if cls is PromptManagerPair
+                    else run_graph(save=False, kind=cls.__name__)
+                )
+                node, result = self.run_node(cls, graph, False)
+                self.assertEqual(self.count_rows("prompts"), 0)
+                self.assertEqual(self.count_rows("prompt_pairs"), 0)
+                self.assertEqual(self.tracker.keyed_snapshot(), {})
+                self.assertEqual(self.tracker._prompt_queue, [])
+                node.comfyui_integration.register_prompt.assert_not_called()
+                if cls is PromptManagerText:
+                    self.assertEqual(result, (POSITIVE,))
+                elif cls is PromptManagerPair:
+                    self.assertEqual(result[0], ("cond", POSITIVE))
+                    self.assertEqual(result[1], ("cond", NEGATIVE))
+                    self.assertEqual(result[2:], (POSITIVE, NEGATIVE))
+                else:
+                    self.assertEqual(result, (("cond", POSITIVE), POSITIVE))
+
+    def test_off_without_graph_context_still_saves_nothing(self):
+        node = self.node(PromptManager)
+        node.encode_prompt(self.clip(), POSITIVE, save_to_library=False)
+        self.assertEqual(self.count_rows("prompts"), 0)
+        self.assertEqual(self.tracker._prompt_queue, [])
+
+    def test_off_leaves_an_existing_prompt_uncounted(self):
+        prompt_id = self.save(POSITIVE)
+        self.run_node(PromptManager, run_graph(save=False), False)
+        row = self.db.get_prompt_by_id(prompt_id)
+        self.assertFalse(row.get("run_count") or 0)
+
+    def test_on_is_unchanged(self):
+        self.run_node(PromptManager, run_graph(save=True), True)
+        self.assertIsNotNone(self.db.get_prompt_by_hash(generate_prompt_hash(POSITIVE)))
+        self.assertIn(
+            prompt_node_key(run_graph(save=True), "1"), self.tracker.keyed_snapshot()
+        )
+
+    def test_unknown_setting_on_at_run_time_counts_at_execution(self):
+        """The hook could not read a wired switch, so the node counts its run."""
+        graph = run_graph(save=["9", 0])
+        graph["9"] = {"class_type": "SomeCustomSwitch", "inputs": {}}
+        prompt_id = self.save(POSITIVE)
+        self.run_node(PromptManager, graph, True)
+        self.assertEqual(self.db.get_prompt_by_id(prompt_id)["run_count"], 1)
+
+
+class TestWiredSwitchOffMarksItsRun(NodeCase):
+    """Review finding: a wired switch off at run time keeps the node a run prompt."""
+
+    def wired_graph(self):
+        graph = run_graph(save=["9", 0])
+        graph["9"] = {"class_type": "SomeCustomSwitch", "inputs": {}}
+        return graph
+
+    def test_an_earlier_entry_of_the_key_never_stands_in(self):
+        graph = self.wired_graph()
+        key = prompt_node_key(graph, "1")
+        node = self.node(PromptManager)
+        node.encode_prompt(
+            self.clip(), POSITIVE, prompt=graph, unique_id="1", save_to_library=True
+        )
+        node.encode_prompt(
+            self.clip(), POSITIVE, prompt=graph, unique_id="1", save_to_library=False
+        )
+        latest, _run, _count = self.tracker.keyed_snapshot()[key]
+        self.assertTrue(latest.get("placeholder"))
+
+    def test_literal_off_marks_nothing(self):
+        node = self.node(PromptManager)
+        node.encode_prompt(
+            self.clip(),
+            POSITIVE,
+            prompt=run_graph(save=False),
+            unique_id="1",
+            save_to_library=False,
+        )
+        self.assertEqual(self.tracker.keyed_snapshot(), {})
+
+
+class TestMonitorLeavesOptedOutFilesUnlinked(MonitorCase):
+    def test_existing_prompt_is_not_linked_from_metadata(self):
+        self.save(POSITIVE)
+        self.assertIsNone(self.process({"prompt": run_graph(save=False)}))
+
+    def test_find_prompt_reports_opted_out(self):
+        self.save(POSITIVE)
+        state, prompt = self.handler._find_prompt_from_metadata(
+            {"prompt": run_graph(save=False)}
+        )
+        self.assertEqual((state, prompt), ("opted_out", None))
+
+    def test_mixed_positive_settings_leave_the_file_unlinked(self):
+        self.save(POSITIVE)
+        graph = run_graph(save=True)
+        graph["8"] = {
+            "class_type": "PromptManager",
+            "inputs": {"text": "other", "save_to_library": False},
+        }
+        graph["5"] = {
+            "class_type": "KSampler",
+            "inputs": {
+                "model": ["4", 0],
+                "positive": ["8", 0],
+                "negative": ["2", 0],
+                "latent_image": ["6", 0],
+            },
+        }
+        self.assertIsNone(self.process({"prompt": graph}))
+
+    def test_workflow_only_metadata_with_switch_off_is_opted_out(self):
+        self.save(POSITIVE)
+        metadata = {
+            "text_encoder_nodes": [
+                {
+                    "type": "PromptManager",
+                    "inputs": [],
+                    "widgets_values": [POSITIVE, "", "", "", "", "", False],
+                }
+            ]
+        }
+        state, _prompt = self.handler._find_prompt_from_metadata(metadata)
+        self.assertEqual(state, "opted_out")
+
+    def test_workflow_only_ignores_muted_nodes_and_reads_subgraphs(self):
+        from utils.prompt_graph import metadata_opted_out
+
+        node = {
+            "type": "PromptManager",
+            "widgets_values": [POSITIVE, "", "", "", "", "", False],
+        }
+        self.assertFalse(
+            metadata_opted_out({"workflow": {"nodes": [{**node, "mode": 4}]}})
+        )
+        self.assertTrue(
+            metadata_opted_out(
+                {
+                    "workflow": {
+                        "nodes": [],
+                        "definitions": {"subgraphs": [{"nodes": [node]}]},
+                    }
+                }
+            )
+        )
+
+    def test_unknown_setting_is_left_to_the_run(self):
+        self.save(POSITIVE)
+        graph = run_graph(save=["9", 0])
+        graph["9"] = {"class_type": "SomeCustomSwitch", "inputs": {}}
+        state, _prompt = self.handler._find_prompt_from_metadata({"prompt": graph})
+        self.assertEqual(state, "unknown")
+
+    def test_enabled_positive_still_links(self):
+        prompt_id = self.save(POSITIVE)
+        self.assertEqual(self.process({"prompt": run_graph(save=True)}), prompt_id)
+
+
+class TestLinkKeepsOptedOutNegativeOut(MonitorCase):
+    def setUp(self):
+        super().setUp()
+        # The real link, not the recording stub of MonitorCase
+        del self.handler.link_image_to_prompt
+
+    def test_opted_out_negative_is_never_stored_as_a_pair(self):
+        prompt_id = self.save(POSITIVE)
+        metadata = {"prompt": run_graph(save=True, negative_save=False)}
+        self.handler.link_image_to_prompt(self.image, {"id": prompt_id}, metadata)
+        self.assertIsNone(self.db.get_prompt_by_hash(generate_prompt_hash(NEGATIVE)))
+        self.assertEqual(self.count_pairs(), 0)
+        linked = (
+            self.db.model.get_connection()
+            .execute("SELECT prompt_id FROM generated_images")
+            .fetchall()
+        )
+        self.assertEqual([row[0] for row in linked], [prompt_id])
+
+    def test_opted_out_positive_links_nothing(self):
+        prompt_id = self.save(POSITIVE)
+        metadata = {"prompt": run_graph(save=False)}
+        self.handler.link_image_to_prompt(self.image, {"id": prompt_id}, metadata)
+        count = (
+            self.db.model.get_connection()
+            .execute("SELECT COUNT(*) FROM generated_images")
+            .fetchone()[0]
+        )
+        self.assertEqual(count, 0)
+
+    def count_pairs(self):
+        conn = self.db.model.get_connection()
+        return conn.execute("SELECT COUNT(*) FROM prompt_pairs").fetchone()[0]
+
+
+class TestScanSkipsOptedOutFiles(NodeCase):
+    def setUp(self):
+        super().setUp()
+        from py.api import admin
+
+        self.mixin = admin.AdminRoutesMixin.__new__(admin.AdminRoutesMixin)
+        self.mixin.db = self.db
+        self.mixin.logger = logging.getLogger("test.save_to_library.scan")
+        self.file = Path(self.tmp.name) / "out.png"
+
+    def test_opted_out_file_stores_nothing(self):
+        status = self.mixin._ingest_scanned_file(
+            self.file, {"prompt": run_graph(save=False)}
+        )
+        self.assertEqual(status, "not_saved")
+        self.assertEqual(self.count_rows("prompts"), 0)
+        self.assertEqual(self.count_rows("generated_images"), 0)
+
+    def test_opted_out_file_is_never_queued_for_review(self):
+        ambiguous = []
+        graph = run_graph(save=False)
+        graph["5"] = dict(graph["3"])  # a second sampler: ambiguous otherwise
+        graph["5"]["inputs"] = {**graph["3"]["inputs"], "positive": ["2", 0]}
+        status = self.mixin._ingest_scanned_file(
+            self.file, {"prompt": graph}, ambiguous=ambiguous
+        )
+        self.assertEqual(status, "not_saved")
+        self.assertEqual(ambiguous, [])
+
+    def test_opted_out_negative_stores_the_positive_only(self):
+        status = self.mixin._ingest_scanned_file(
+            self.file, {"prompt": run_graph(save=True, negative_save=False)}
+        )
+        self.assertEqual(status, "added")
+        self.assertIsNotNone(self.db.get_prompt_by_hash(generate_prompt_hash(POSITIVE)))
+        self.assertIsNone(self.db.get_prompt_by_hash(generate_prompt_hash(NEGATIVE)))
+        self.assertEqual(self.count_rows("prompt_pairs"), 0)
+
+    def test_wired_switch_is_left_to_the_live_run(self):
+        graph = run_graph(save=["9", 0])
+        graph["9"] = {"class_type": "SomeCustomSwitch", "inputs": {}}
+        status = self.mixin._ingest_scanned_file(self.file, {"prompt": graph})
+        self.assertEqual(status, "not_saved_wired")
+        self.assertEqual(self.count_rows("prompts"), 0)
+
+    def test_status_has_a_scan_detail(self):
+        from py.api import admin
+
+        group, row, _line = admin._scan_outcome(self.file, [], "not_saved")
+        self.assertEqual(group, "no_metadata")
+        self.assertIn("does not save", row["detail"])
+
+
+class TestHistoryRecordsNoText(unittest.TestCase):
+    def setUp(self):
+        self.m = load_module("execution_context_graph")
+
+    def test_opted_out_role_has_no_sources_and_no_text(self):
+        recipe = self.m.project_contexts(run_graph(save=False), None).recipes[0]
+        self.assertEqual(recipe.positive.sources, ())
+        self.assertIsNone(recipe.positive.inferred)
+        self.assertEqual(recipe.positive.reason, "not_saved")
+        # The enabled negative is recorded as before
+        self.assertEqual(recipe.negative.inferred.raw.value, NEGATIVE)
+
+    def test_unknown_setting_records_no_text_either(self):
+        graph = run_graph(save=["9", 0])
+        graph["9"] = {"class_type": "SomeCustomSwitch", "inputs": {}}
+        recipe = self.m.project_contexts(graph, None).recipes[0]
+        self.assertIsNone(recipe.positive.inferred)
+        self.assertEqual(recipe.positive.reason, "not_saved")
+
+    def test_enabled_role_is_unchanged(self):
+        recipe = self.m.project_contexts(run_graph(save=True), None).recipes[0]
+        self.assertEqual(recipe.positive.inferred.raw.value, POSITIVE)
+        self.assertEqual(len(recipe.positive.sources), 1)
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_scanned_prompts.py

@@ -0,0 +1,274 @@
+"""Storing a file's prompt from its text: one transaction, one prompt each (#247)."""
+
+import os
+import sqlite3
+import tempfile
+import threading
+import unittest
+from concurrent.futures import ThreadPoolExecutor
+from pathlib import Path
+from unittest import mock
+
+try:
+    from tests.open_handles import assert_closed
+    from tests import test_execution_history_database as history_tests
+except ImportError:  # discovered with tests/ as the top-level directory
+    from open_handles import assert_closed
+    import test_execution_history_database as history_tests
+
+from database.operations import PromptDatabase
+from database.pair_ingestion import (
+    RUN_MARKS,
+    SCAN_MARKS,
+    Marks,
+    ingest_resolved_pair,
+)
+from database.scanned_prompts import store_scanned_prompt, store_scanned_prompt_or_raise
+from utils.hashing import generate_prompt_hash
+
+META = {"prompt": {"1": {"class_type": "CLIPTextEncode", "inputs": {"text": "x"}}}}
+
+
+def resolved(positive="cat", negative="blur"):
+    return {
+        "state": "resolved",
+        "positive": {"text": positive, "provenance": {"source": "api"}},
+        "negative": {"text": negative, "provenance": {"source": "api"}},
+    }
+
+
+class StoreCase(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory()
+        self.db = PromptDatabase(str(Path(self.temp.name) / "test.db"))
+        self.path = str(Path(self.temp.name) / "gen.png")
+
+    def tearDown(self):
+        self.db.close_all()
+        assert_closed(self, self.temp.name)
+        self.temp.cleanup()
+
+    def prompts(self):
+        rows = self.db.model.get_connection().execute(
+            "SELECT id, text FROM prompts ORDER BY id"
+        )
+        return [tuple(row) for row in rows]
+
+    def links(self):
+        rows = self.db.model.get_connection().execute(
+            "SELECT prompt_id, image_path FROM generated_images ORDER BY id"
+        )
+        return [tuple(row) for row in rows]
+
+    def save(self, text, **fields):
+        return self.db.save_prompt(
+            text, prompt_hash=generate_prompt_hash(text), **fields
+        )
+
+
+class TestStoreScannedPrompt(StoreCase):
+    def test_a_new_text_is_created_with_the_scan_marks_and_linked(self):
+        status, prompt_id = store_scanned_prompt_or_raise(
+            self.db, self.path, META, " a cat ", SCAN_MARKS
+        )
+        self.assertEqual(status, "added")
+        prompt = self.db.get_prompt_by_id(prompt_id)
+        self.assertEqual(prompt["text"], "a cat")
+        self.assertEqual(prompt["category"], "scanned")
+        self.assertEqual(prompt["tags"], ["auto-scanned"])
+        self.assertEqual(prompt["notes"], "Auto-scanned from gen.png")
+        self.assertEqual(prompt["run_count"], 0)
+        self.assertEqual(self.links(), [(prompt_id, self.path)])
+
+    def test_a_run_created_prompt_names_the_workflow_run(self):
+        _status, prompt_id = store_scanned_prompt_or_raise(
+            self.db, self.path, META, "a cat", RUN_MARKS
+        )
+        prompt = self.db.get_prompt_by_id(prompt_id)
+        self.assertEqual(prompt["notes"], "Saved from a workflow run: gen.png")
+        self.assertEqual(prompt["tags"], ["auto-scanned"])
+
+    def test_a_stored_text_is_reused_by_hash_and_keeps_its_fields(self):
+        existing = self.save("A Cat", category="mine", notes="kept")
+        status, prompt_id = store_scanned_prompt_or_raise(
+            self.db, self.path, META, "a cat ", SCAN_MARKS
+        )
+        self.assertEqual((status, prompt_id), ("linked", existing))
+        prompt = self.db.get_prompt_by_id(existing)
+        self.assertEqual((prompt["category"], prompt["notes"]), ("mine", "kept"))
+        self.assertEqual(prompt["tags"], [])
+        self.assertEqual(len(self.prompts()), 1)
+
+    def test_a_repeat_is_unchanged(self):
+        first = store_scanned_prompt_or_raise(
+            self.db, self.path, META, "a cat", SCAN_MARKS
+        )
+        again = store_scanned_prompt_or_raise(
+            self.db, self.path, META, "a cat", SCAN_MARKS
+        )
+        self.assertEqual(again, ("unchanged", first[1]))
+        self.assertEqual(len(self.links()), 1)
+
+    def test_a_file_linked_to_another_prompt_is_a_conflict(self):
+        other = self.save("a dog")
+        # Linked under another spelling of the same file.
+        spelled = os.path.join(self.temp.name, ".", "gen.png")
+        self.db.link_image_to_prompt(other, spelled)
+        result = store_scanned_prompt_or_raise(
+            self.db, self.path, META, "a cat", SCAN_MARKS
+        )
+        self.assertEqual(result, ("conflict", None))
+        self.assertEqual(self.prompts(), [(other, "a dog")])
+        self.assertEqual(self.links(), [(other, spelled)])
+
+    def test_a_failed_link_raises_and_leaves_no_prompt_behind(self):
+        with mock.patch.object(
+            self.db, "_insert_image_link", side_effect=sqlite3.OperationalError("x")
+        ):
+            with self.assertRaises(sqlite3.OperationalError):
+                store_scanned_prompt_or_raise(
+                    self.db, self.path, META, "a cat", SCAN_MARKS
+                )
+            with self.assertLogs("prompt_manager", "ERROR"):
+                result = store_scanned_prompt(
+                    self.db, self.path, META, "a cat", SCAN_MARKS
+                )
+        self.assertEqual(result, ("found", None))
+        self.assertEqual(self.prompts(), [])
+        self.assertEqual(self.links(), [])
+
+    def test_two_concurrent_writers_store_one_prompt_and_one_link(self):
+        hold = history_tests.FirstWriterHold()
+        outcome = self.db._pair_component_outcome
+        started = threading.Barrier(2)
+
+        def held_open(*args, **kwargs):
+            hold()
+            return outcome(*args, **kwargs)
+
+        def write(_index):
+            started.wait(timeout=30)
+            try:
+                return store_scanned_prompt_or_raise(
+                    self.db, self.path, META, "a cat", SCAN_MARKS
+                )[0]
+            finally:
+                self.db.model.close()
+
+        with (
+            mock.patch.object(
+                self.db, "_pair_component_outcome", side_effect=held_open
+            ),
+            ThreadPoolExecutor(max_workers=2) as pool,
+        ):
+            statuses = sorted(pool.map(write, range(2)))
+        self.assertEqual(statuses, ["added", "unchanged"])
+        self.assertEqual(len(self.prompts()), 1)
+        self.assertEqual(len(self.links()), 1)
+
+    def test_a_library_move_reruns_the_store(self):
+        from database import scanned_prompts
+
+        real = scanned_prompts.store_scanned_prompt_or_raise
+        calls = []
+
+        def moved_once(*args, **kwargs):
+            if not calls:
+                calls.append(1)
+                self.db.model._generation += 1
+                raise sqlite3.OperationalError("closed")
+            return real(*args, **kwargs)
+
+        with mock.patch.object(
+            scanned_prompts, "store_scanned_prompt_or_raise", side_effect=moved_once
+        ):
+            status, _id = store_scanned_prompt(
+                self.db, self.path, META, "a cat", SCAN_MARKS
+            )
+        self.assertEqual((status, calls), ("added", [1]))
+
+    def _linked_folder(self):
+        """``(out_real, out_link)``: a symlink to the same output folder."""
+        from tests.test_api_duplicate_files import TestReview
+
+        if not TestReview._can_symlink(self.temp.name):  # pragma: no cover
+            self.skipTest("symlinks are not available")
+        real = Path(self.temp.name) / "out_real"
+        real.mkdir()
+        link = Path(self.temp.name) / "out_link"
+        os.symlink(str(real), str(link))
+        (real / "a.png").write_bytes(b"png")
+        return os.path.realpath(str(real)), str(link)
+
+    def test_a_file_linked_through_its_real_folder_is_found_through_a_link(self):
+        """The scan stores realpath spellings, the monitor the watcher's."""
+        real, link = self._linked_folder()
+        other = self.save("a dog")
+        self.db.link_image_to_prompt(other, os.path.join(real, "a.png"))
+        through_link = os.path.join(link, "a.png")
+        self.assertEqual(
+            store_scanned_prompt_or_raise(
+                self.db, through_link, META, "a cat", SCAN_MARKS
+            ),
+            ("conflict", None),
+        )
+        self.assertEqual(
+            store_scanned_prompt_or_raise(
+                self.db, through_link, META, "a dog", SCAN_MARKS
+            ),
+            ("unchanged", other),
+        )
+        pair = ingest_resolved_pair(self.db, through_link, META, resolved())
+        self.assertEqual(pair["status"], "conflict")
+        self.assertEqual(len(self.links()), 1)
+
+
+class TestPairMarks(StoreCase):
+    def test_marks_reach_only_created_components(self):
+        kept = self.save("cat", category="mine")
+        result = ingest_resolved_pair(
+            self.db, self.path, META, resolved(), marks=RUN_MARKS
+        )
+        self.assertEqual(result["status"], "added")
+        positive = self.db.get_prompt_by_id(kept)
+        self.assertEqual((positive["category"], positive["tags"]), ("mine", []))
+        negative_id = next(pid for pid, text in self.prompts() if text == "blur")
+        negative = self.db.get_prompt_by_id(negative_id)
+        self.assertEqual(negative["category"], "scanned")
+        self.assertEqual(negative["tags"], ["auto-scanned"])
+        self.assertEqual(negative["notes"], "Saved from a workflow run: gen.png")
+
+    def test_without_marks_created_components_stay_bare(self):
+        """Regression guard (passes on the base): the node path is unchanged."""
+        ingest_resolved_pair(self.db, self.path, META, resolved())
+        for prompt_id, _text in self.prompts():
+            prompt = self.db.get_prompt_by_id(prompt_id)
+            self.assertIsNone(prompt["category"])
+            self.assertEqual(prompt["tags"], [])
+
+    def test_a_blank_negative_creates_only_the_positive(self):
+        result = ingest_resolved_pair(
+            self.db, self.path, META, resolved(negative=""), marks=SCAN_MARKS
+        )
+        self.assertEqual(result["status"], "added")
+        self.assertEqual([text for _id, text in self.prompts()], ["cat"])
+
+    def test_marks_are_a_frozen_value(self):
+        self.assertEqual(
+            SCAN_MARKS, Marks("scanned", ("auto-scanned",), SCAN_MARKS.note)
+        )
+        with self.assertRaises(AttributeError):
+            SCAN_MARKS.category = "x"
+
+
+class TestPublicRunAttribution(unittest.TestCase):
+    def test_recorded_runs_and_named_prompt_are_public(self):
+        from database import run_attribution
+
+        self.assertTrue(callable(run_attribution.recorded_runs))
+        self.assertTrue(callable(run_attribution.named_prompt))
+        self.assertFalse(hasattr(run_attribution, "_recorded_runs"))
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_vocabulary.py

@@ -13,6 +13,11 @@ from database.library_commands import LibraryCommandError
 from database.operations import PromptDatabase
 from utils.hashing import generate_prompt_hash
 
+try:
+    from test_image_categories import category_checksum
+except ImportError:
+    from tests.test_image_categories import category_checksum
+
 
 class TestVocabularyReads(unittest.TestCase):
     def setUp(self):
@@ -168,7 +173,8 @@ class TestVocabularyReads(unittest.TestCase):
         self.assertEqual(page["total"], 4)
         self.assertFalse(page["has_more"])
         for row in page["categories"]:
-            self.assertEqual(set(row), {"value", "prompt_count"})
+            self.assertEqual(set(row), {"value", "prompt_count", "image_count"})
+            self.assertEqual(row["image_count"], 0)
             self.assertEqual(
                 row["prompt_count"],
                 self.db.list_library(category=row["value"])["total"],
@@ -238,6 +244,111 @@ class TestVocabularyReads(unittest.TestCase):
             with self.assertRaises(ValueError):
                 self.read("list_vocabulary_tags", **options)
 
+    def own(self, value, *paths, root="root"):
+        """Give each relative path under ``root`` the own category ``value``."""
+        self.db.set_image_categories([(root, path) for path in paths], value)
+
+    def all_categories(self, limit=200):
+        rows, pages, after = [], [], None
+        while True:
+            page = self.read("list_vocabulary_categories", limit=limit, after=after)
+            pages.append(page)
+            rows.extend(page["categories"])
+            if not page["has_more"]:
+                return rows, pages
+            after = page["next_key"]
+
+    def test_category_list_includes_image_only_values_last(self):
+        self.save("Oldest", category="Zeta")
+        self.save("Newer", category="Alpha")
+        self.own("Zeta", "a.png", "b.png")
+        self.own("Only images B", "c.png")
+        self.own("Only images A", "d.png", "e.png", "gone.png")
+        rows, _pages = self.all_categories()
+        self.assertEqual(
+            rows,
+            [
+                {"value": "Zeta", "prompt_count": 1, "image_count": 2},
+                {"value": "Alpha", "prompt_count": 1, "image_count": 0},
+                {"value": "Only images A", "prompt_count": 0, "image_count": 3},
+                {"value": "Only images B", "prompt_count": 0, "image_count": 1},
+            ],
+        )
+        page = self.read("list_vocabulary_categories")
+        self.assertEqual(page["total"], 4)
+
+    def test_category_cursor_crosses_into_image_only_values(self):
+        for index in range(3):
+            self.save(f"Owner {index}", category=f"P{index}")
+        self.own("P1", "shared.png")
+        self.own("I-b", "x.png")
+        self.own("I-a", "y.png")
+        self.own("I-c", "z.png", root="other")
+        for limit in (1, 2, 3, 4):
+            with self.subTest(limit=limit):
+                rows, pages = self.all_categories(limit=limit)
+                self.assertEqual(
+                    [row["value"] for row in rows],
+                    ["P0", "P1", "P2", "I-a", "I-b", "I-c"],
+                )
+                self.assertEqual({page["total"] for page in pages}, {6})
+                self.assertEqual(
+                    [row["image_count"] for row in rows], [0, 1, 0, 1, 1, 1]
+                )
+        first = self.read("list_vocabulary_categories", limit=3)
+        self.assertEqual(first["next_key"], [3, "P2"])
+        second = self.read("list_vocabulary_categories", limit=1, after=[3, "P2"])
+        self.assertEqual(second["next_key"], [2**63 - 1, "I-a"])
+
+    def test_image_rows_on_a_prompt_value_count_once(self):
+        self.save("Owner", category="Shared")
+        self.db.save_prompt_pair("Owner", "Noise", category="Shared")
+        self.own("Shared", *[f"{n}.png" for n in range(5)])
+        self.own("Shared", "elsewhere.png", root="second")
+        rows, _pages = self.all_categories()
+        self.assertEqual(
+            rows, [{"value": "Shared", "prompt_count": 1, "image_count": 6}]
+        )
+
+    def test_library_options_ignore_image_categories(self):
+        self.save("Owner", category="Prompt value")
+        before = self.db.get_library_options()
+        self.own("Image value", "a.png")
+        self.own("Prompt value", "b.png")
+        self.assertEqual(self.db.get_library_options(), before)
+        self.assertEqual(before["categories"], ["Prompt value"])
+
+    def test_category_reads_use_the_image_category_index(self):
+        from database import vocabulary
+
+        self.own("Value", "a.png")
+        statements = [
+            vocabulary._CATEGORY_ROWS + "SELECT COUNT(*) FROM counted",
+            vocabulary._CATEGORY_ROWS
+            + "SELECT value,first_pid,prompt_count,image_count FROM counted "
+            "WHERE first_pid>? OR (first_pid=? AND value>?) "
+            "ORDER BY first_pid,value LIMIT ?",
+        ]
+        plans = []
+        with self.db.model.get_connection() as conn:
+            for sql in statements:
+                params = [1] * sql.count("?")
+                plans.extend(
+                    row[-1] for row in conn.execute("EXPLAIN QUERY PLAN " + sql, params)
+                )
+            for sql in (
+                vocabulary._IMAGE_CATEGORY_ROWIDS,
+                *vocabulary._CATEGORY_UPDATES,
+            ):
+                params = [1] * sql.count("?")
+                plans.extend(
+                    row[-1] for row in conn.execute("EXPLAIN QUERY PLAN " + sql, params)
+                )
+        image_steps = [step for step in plans if "image_categories" in step]
+        self.assertTrue(image_steps)
+        for step in image_steps:
+            self.assertIn("idx_image_categories_category", step, step)
+
     def test_reads_share_one_snapshot_and_report_epoch(self):
         self.save("Cat", category="Animal", tags=["cat"])
         epoch = self.db.get_execution_epoch()
@@ -741,6 +852,7 @@ class TestVocabularyCategoryCommands(unittest.TestCase):
                 "other_prompts": 1,
                 "negative_variants": 2,
                 "archived_negative_variants": 1,
+                "images": 0,
             },
         )
         self.assertFalse(result["target_exists"])
@@ -810,6 +922,7 @@ class TestVocabularyCategoryCommands(unittest.TestCase):
                 "other_prompts": 0,
                 "negative_variants": 0,
                 "archived_negative_variants": 0,
+                "images": 0,
             },
         )
         self.assertEqual(self.rows("prompts")[variant]["category"], "Other")
@@ -902,6 +1015,171 @@ class TestVocabularyCategoryCommands(unittest.TestCase):
                 self.apply(bad)
         self.assertEqual(self.snapshot(), before)
 
+    def own(self, value, *paths, root="root"):
+        self.db.set_image_categories([(root, path) for path in paths], value)
+
+    def image_rows(self):
+        with self.db.model.get_connection() as conn:
+            return {
+                (row[0], row[1]): (row[2], row[3], row[4])
+                for row in conn.execute(
+                    "SELECT root_key,relative_path,category,updated_at,rowid "
+                    "FROM image_categories ORDER BY rowid"
+                )
+            }
+
+    def checksum(self):
+        with self.db.model.get_connection() as conn:
+            return category_checksum(conn)
+
+    def test_preview_counts_image_rows(self):
+        self.owners()
+        self.own("Scenery", "a.png", "b.png", "missing.png")
+        self.own("Scenery", "c.png", root="second")
+        self.own("Other", "d.png")
+        before = self.image_rows()
+        result = self.preview()
+        self.assertEqual(result["impact"]["images"], 4)
+        self.assertEqual(self.image_rows(), before)
+        self.assertTrue(self.preview(target="Other")["target_exists"])
+
+    def test_apply_renames_image_categories(self):
+        self.owners()
+        bystander = self.save("Bystander", category="Other")
+        self.own("Scenery", "a.png", "b.png")
+        self.own("Scenery", "c.png", root="second")
+        self.own(" Scenery ", "padded.png")
+        self.own("Other", "d.png")
+        self.age_rows()
+        with self.db.model.get_connection() as conn:
+            conn.execute("UPDATE image_categories SET updated_at=?", (_OLD_STAMP,))
+        images_before = self.image_rows()
+        prompts_before, pairs_before = self.snapshot()
+        preview = self.preview()
+        receipt = self.apply(preview["impact_token"])
+        self.assertEqual(receipt["impact"]["images"], 3)
+        images_after = self.image_rows()
+        self.assertEqual(set(images_after), set(images_before))
+        renamed = {("root", "a.png"), ("root", "b.png"), ("second", "c.png")}
+        for key, (value, stamp, rowid) in images_after.items():
+            old_value, old_stamp, old_rowid = images_before[key]
+            self.assertEqual(rowid, old_rowid, key)
+            if key in renamed:
+                self.assertEqual(value, "Landscape")
+                self.assertNotEqual(stamp, _OLD_STAMP)
+            else:
+                self.assertEqual((value, stamp), (old_value, old_stamp))
+        prompts_after, pairs_after = self.snapshot()
+        self.assertEqual(prompts_after[bystander], prompts_before[bystander])
+        for before, after in (
+            (prompts_before, prompts_after),
+            (pairs_before, pairs_after),
+        ):
+            for row_id, row in after.items():
+                if before[row_id]["category"] != "Scenery":
+                    self.assertEqual(row, before[row_id])
+        # Merging into a value images already hold keeps every file key.
+        merge = self.preview(source="Landscape", target="Other")
+        self.assertTrue(merge["target_exists"])
+        self.assertEqual(merge["impact"]["images"], 3)
+        receipt = self.apply(merge["impact_token"], source="Landscape", target="Other")
+        self.assertTrue(receipt["consolidated"])
+        merged = self.image_rows()
+        self.assertEqual(set(merged), set(images_before))
+        self.assertEqual(
+            sorted(key for key, row in merged.items() if row[0] == "Other"),
+            sorted([*renamed, ("root", "d.png")]),
+        )
+
+    def test_image_only_value_can_be_renamed(self):
+        self.save("Bystander", category="Kept")
+        self.db.save_prompt_pair("Pair", "Noise", category="Kept")
+        self.own("Image only", "a.png", "b.png")
+        self.age_rows()
+        before = self.checksum()
+        preview = self.preview(source="Image only", target="Renamed")
+        self.assertEqual(
+            preview["impact"],
+            {
+                "positive_prompts": 0,
+                "other_prompts": 0,
+                "negative_variants": 0,
+                "archived_negative_variants": 0,
+                "images": 2,
+            },
+        )
+        self.assertFalse(preview["target_exists"])
+        receipt = self.apply(
+            preview["impact_token"], source="Image only", target="Renamed"
+        )
+        self.assertFalse(receipt["consolidated"])
+        self.assertEqual({row[0] for row in self.image_rows().values()}, {"Renamed"})
+        self.assertEqual(self.checksum(), before)
+        # An image-only target counts as existing.
+        self.own("Image target", "c.png")
+        self.assertTrue(
+            self.preview(source="Renamed", target="Image target")["target_exists"]
+        )
+        # Nothing holds the value any more: refused.
+        with self.assertRaises(LibraryCommandError) as caught:
+            self.preview(source="Image only", target="Again")
+        self.assertEqual(caught.exception.code, "vocabulary-conflict")
+
+    def test_token_refused_after_an_image_row_gains_or_loses_the_value(self):
+        self.owners()
+        self.own("Scenery", "a.png", "b.png")
+
+        def gain():
+            self.own("Scenery", "late.png")
+
+        def lose():
+            self.db.clear_image_categories([("root", "a.png")])
+
+        def move_away():
+            self.own("Elsewhere", "b.png")
+
+        def target_on_image():
+            self.own("Landscape", "target.png")
+
+        for mutate in (gain, lose, move_away, target_on_image):
+            with self.subTest(mutate.__name__):
+                token = self.preview()["impact_token"]
+                mutate()
+                before = self.snapshot(), self.image_rows()
+                with self.assertRaises(LibraryCommandError) as caught:
+                    self.apply(token)
+                self.assertEqual(caught.exception.code, "vocabulary-conflict")
+                self.assertEqual((self.snapshot(), self.image_rows()), before)
+
+    def test_image_category_failure_rolls_back_prompts(self):
+        self.owners()
+        self.own("Scenery", "a.png")
+        token = self.preview()["impact_token"]
+        with self.db.model.get_connection() as conn:
+            conn.execute(
+                "CREATE TRIGGER abort_images BEFORE UPDATE ON image_categories "
+                "BEGIN SELECT RAISE(ABORT, 'boom'); END"
+            )
+        before = self.snapshot(), self.image_rows()
+        with self.assertRaises(sqlite3.Error):
+            self.apply(token)
+        self.assertEqual((self.snapshot(), self.image_rows()), before)
+
+    def test_category_exists_reads_the_image_index(self):
+        from database import vocabulary
+
+        with self.db.model.get_connection() as conn:
+            plan = [
+                row[-1]
+                for row in conn.execute(
+                    "EXPLAIN QUERY PLAN " + vocabulary._CATEGORY_EXISTS, {"v": "x"}
+                )
+            ]
+        steps = [step for step in plan if "image_categories" in step]
+        self.assertTrue(steps, plan)
+        for step in steps:
+            self.assertIn("idx_image_categories_category", step)
+
     def test_category_apply_failure_rolls_back(self):
         self.owners()
         token = self.preview()["impact_token"]
@@ -942,6 +1220,18 @@ class TestSharedTokenHashing(unittest.TestCase):
             ),
             "cefe7f6a5544b7f6a203f5527810899c6af568aa7abc1b75adffbfb5ae6251ae",
         )
+        with_images = category_impact_token(
+            "e", "S", "T", True, [(1, True)], [], images=[9, 4]
+        )
+        self.assertRegex(with_images, r"\A[0-9a-f]{64}\Z")
+        self.assertEqual(
+            with_images,
+            category_impact_token("e", "S", "T", True, [(1, True)], [], images=[4, 9]),
+        )
+        self.assertNotEqual(
+            with_images,
+            category_impact_token("e", "S", "T", True, [(1, True)], [], images=[4]),
+        )
 
 
 if __name__ == "__main__":

tests/vendor/browser-server-fixture.test.mjs

@@ -2,12 +2,14 @@ import test from 'node:test';
 import assert from 'node:assert/strict';
 import { createServer } from 'node:net';
 import { spawn } from 'node:child_process';
-import { once } from 'node:events';
+import { EventEmitter, once } from 'node:events';
 import { readFileSync } from 'node:fs';
+import { isAbsolute } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { setTimeout as delay } from 'node:timers/promises';
 import { startBrowserServer, createServerSupervisor, attachServerStderr, forwardPrefixedLines, SLOW_RESET_PREFIX } from '../../tools/vendor/start-browser-server.mjs';
-import { workflowWorkers } from '../../tools/vendor/test-workers.mjs';
+import { reporters, workflowWorkers } from '../../tools/vendor/test-workers.mjs';
+import RunningTestsReporter from '../../tools/vendor/running-tests-reporter.mjs';
 
 const fakeServer = fileURLToPath(new URL('./fake-browser-server.mjs', import.meta.url));
 const fake = (...extra) => ({ command: process.execPath, args: port => [fakeServer, '--port', String(port), ...extra] });
@@ -255,3 +257,57 @@ test('worker count follows PM_TEST_WORKERS, then one in CI, then a quarter of th
     assert.throws(() => workflowWorkers({ env: { PM_TEST_WORKERS: 'many' }, cpus: 8 }), /PM_TEST_WORKERS must be a positive integer/);
     assert.throws(() => workflowWorkers({ env: { PM_TEST_WORKERS: '0' }, cpus: 8 }), /PM_TEST_WORKERS must be a positive integer/);
 });
+
+test('CI adds the running-tests reporter and a blob report under test-results/blob/, which the trace upload covers; local runs keep list', () => {
+    assert.equal(reporters({ env: {}, name: 'workflows' }), 'list');
+    const [list, running, blob] = reporters({ env: { CI: '1' }, name: 'workflows' });
+    assert.deepEqual(list, ['list']);
+    // Absolute: a config imported from another directory (workflow-artifacts.test.mjs) still finds it.
+    assert.ok(isAbsolute(running[0]) && running[0].endsWith('running-tests-reporter.mjs'), running[0]);
+    assert.deepEqual(blob, ['blob', { outputDir: './test-results/blob/workflows' }]);
+});
+
+function fakeHost() {
+    const host = new EventEmitter();
+    Object.assign(host, { pid: 4242, signals: [], cwd: () => '/repo/tools/vendor' });
+    host.kill = (pid, signal) => host.signals.push([pid, signal]);
+    return host;
+}
+
+const spec = (id, title, line) => ({ id, title, location: { file: '/repo/tests/browser/a.spec.mjs', line },
+    parent: { project: () => ({ name: 'firefox' }) } });
+
+test('the running-tests reporter names only the tests that never ended, relative to rootDir', () => {
+    let clock = 1_000;
+    const output = [];
+    const host = fakeHost();
+    const reporter = new RunningTestsReporter({ now: () => clock, write: text => output.push(text), host });
+    reporter.onBegin({ rootDir: '/repo/tests/browser' });
+    const done = spec('1', 'finishes', 10);
+    const stuck = spec('2', 'hangs on a fetch', 20);
+    reporter.onTestBegin(done, { retry: 0 });
+    reporter.onTestBegin(stuck, { retry: 0 });
+    clock += 500;
+    reporter.onTestEnd(done, { retry: 0 });
+    clock += 41_500;
+    reporter.onEnd({ status: 'interrupted' });
+    assert.equal(output.join(''), '\nStill running when the run ended (interrupted): 1\n'
+        + '  [firefox] › a.spec.mjs:20 › hangs on a fetch (running 42.0s)\n');
+    assert.equal(host.listenerCount('SIGTERM'), 0, 'the run is over: SIGTERM gets its default again');
+    output.length = 0;
+    reporter.onTestEnd(stuck, { retry: 0 });
+    reporter.onEnd({ status: 'passed' });
+    assert.deepEqual(output, [], 'a run where every test ended prints nothing');
+});
+
+test('on the first SIGTERM the reporter prints the running tests and hands over to Playwright\'s SIGINT', () => {
+    const output = [];
+    const host = fakeHost();
+    const reporter = new RunningTestsReporter({ now: () => 0, write: text => output.push(text), host });
+    reporter.onBegin({ rootDir: '/repo/tests/browser' });
+    reporter.onTestBegin(spec('2', 'hangs on a fetch', 20), { retry: 0 });
+    host.emit('SIGTERM');
+    assert.match(output.join(''), /Still running when the run ended \(SIGTERM\): 1\n {2}\[firefox\] › a\.spec\.mjs:20 › hangs on a fetch/);
+    assert.deepEqual(host.signals, [[4242, 'SIGINT']], 'Playwright\'s own interrupt ends the run and writes the blob');
+    assert.equal(host.listenerCount('SIGTERM'), 0, 'a second SIGTERM kills the process as usual');
+});

tests/vendor/ci-workflow.test.mjs

@@ -67,6 +67,45 @@ const browserJobIds = [...allJobs].filter(([, body]) => /npm run --prefix tools\
 const mergeJob = () => allJobs.get('frontend-coverage-merge');
 const verifyStep = () => steps(mergeJob()).find(step => /name: Verify every shard's raw coverage arrived/.test(step));
 
+// Jobs that run only in the merge queue, on main and on demand (#420): skipped on pull_request.
+const QUEUE_ONLY_IF = /^ {4}if: github\.event_name != 'pull_request'$/m;
+const EVENTS = ['pull_request', 'merge_group', 'push', 'workflow_dispatch'];
+
+function gateVariables(jobText) {
+    return new Map([...jobText.matchAll(/^ {10}([A-Z_]+): \$\{\{ needs\.([\w-]+)\.result \}\}$/gm)]
+        .map(match => [match[2], match[1]]));
+}
+
+function runGate(jobText, env) {
+    const script = runScript(steps(jobText).find(step => /run: \|/.test(step)));
+    try {
+        execFileSync('bash', ['--noprofile', '--norc', '-eo', 'pipefail', '-c', script], { env: { PATH: process.env.PATH, ...env }, stdio: 'pipe' });
+        return true;
+    } catch {
+        return false;
+    }
+}
+
+// A gate passes only when every always-on job succeeded and every queue-only job is skipped on a
+// pull request and succeeded on every other event. Anything else fails it.
+function assertGateBehaviour(jobText, queueOnly) {
+    assert.match(jobText, /^ {10}EVENT_NAME: \$\{\{ github\.event_name \}\}$/m, 'the gate knows the event');
+    const variables = gateVariables(jobText);
+    for (const id of queueOnly) assert.ok(variables.has(id), `${id} reaches the gate`);
+    for (const event of EVENTS) {
+        const expected = id => (queueOnly.includes(id) && event === 'pull_request' ? 'skipped' : 'success');
+        const green = Object.fromEntries([...variables].map(([id, name]) => [name, expected(id)]));
+        assert.equal(runGate(jobText, { ...green, EVENT_NAME: event }), true, `${event}: the expected results pass`);
+        for (const [id, name] of variables) {
+            for (const result of ['success', 'failure', 'cancelled', 'skipped']) {
+                if (result === expected(id)) continue;
+                assert.equal(runGate(jobText, { ...green, EVENT_NAME: event, [name]: result }), false,
+                    `${event}: ${id}=${result} must fail the gate`);
+            }
+        }
+    }
+}
+
 test('viewerjs keeps its name and needs every frontend job', () => {
     const viewerjs = allJobs.get('viewerjs');
     assert.ok(viewerjs, 'the required context is the job id viewerjs');
@@ -76,32 +115,17 @@ test('viewerjs keeps its name and needs every frontend job', () => {
     assert.deepEqual([...needs].sort(), [...others].sort(), 'viewerjs needs every other job in the workflow');
     assert.deepEqual([...needs].sort(), ['browser-workflows', 'frontend-coverage', 'frontend-coverage-merge']);
     assert.match(viewerjs, /^ {4}if: always\(\)$/m, 'viewerjs runs (and fails) when a needed job failed or was skipped');
-    const script = runScript(steps(viewerjs).find(step => /run: \|/.test(step)));
-    for (const id of needs) {
-        const variable = new RegExp(`^ {10}([A-Z_]+): \\$\\{\\{ needs\\.${id}\\.result \\}\\}$`, 'm').exec(viewerjs);
-        assert.ok(variable, `${id}'s result reaches the check`);
-        assert.match(script, new RegExp(`test "\\$${variable[1]}" = success`), `${id} must be exactly success`);
-    }
+    assert.deepEqual([...gateVariables(viewerjs).keys()].sort(), [...needs].sort(), 'every needed result reaches the check');
 });
 
-test('viewerjs fails unless every needed job succeeded', () => {
-    const viewerjs = allJobs.get('viewerjs');
-    const script = runScript(steps(viewerjs).find(step => /run: \|/.test(step)));
-    const variables = [...viewerjs.matchAll(/^ {10}([A-Z_]+): \$\{\{ needs\.[\w-]+\.result \}\}$/gm)].map(match => match[1]);
-    const run = env => {
-        try {
-            execFileSync('bash', ['--noprofile', '--norc', '-eo', 'pipefail', '-c', script], { env: { PATH: process.env.PATH, ...env }, stdio: 'pipe' });
-            return true;
-        } catch {
-            return false;
-        }
-    };
-    const allSuccess = Object.fromEntries(variables.map(name => [name, 'success']));
-    assert.equal(run(allSuccess), true);
-    for (const name of variables) {
-        for (const result of ['failure', 'cancelled', 'skipped']) {
-            assert.equal(run({ ...allSuccess, [name]: result }), false, `${name}=${result} must fail viewerjs`);
-        }
+test('viewerjs requires the browser shards everywhere but on a pull request', () => {
+    assertGateBehaviour(allJobs.get('viewerjs'), ['browser-workflows']);
+});
+
+test('Firefox/WebKit page workflows run only outside pull requests; coverage runs on every event', () => {
+    assert.match(allJobs.get('browser-workflows'), QUEUE_ONLY_IF);
+    for (const id of ['frontend-coverage', 'frontend-coverage-merge']) {
+        assert.doesNotMatch(allJobs.get(id), /^ {4}if:/m, `${id} runs on every event`);
     }
 });
 
@@ -223,8 +247,29 @@ test('browser job timeouts keep a real margin over measured runs', () => {
     }
 });
 
+// A hang (#425) must end inside the test step, before the job limit, so the log and the always()
+// uploads survive: the step's timeout-minutes < the job's.
+const BROWSER_TEST_STEP = /npm run --prefix tools\/vendor test:(workflows|coverage)/;
+
+test('each browser test step stops itself before its job limit and its traces upload anyway', () => {
+    for (const id of browserJobIds) {
+        const body = allJobs.get(id);
+        const jobMinutes = Number(/^ {4}timeout-minutes: (\d+)$/m.exec(body)[1]);
+        const jobSteps = steps(body);
+        const testAt = jobSteps.findIndex(step => BROWSER_TEST_STEP.test(step));
+        const testStep = jobSteps[testAt];
+        const stepMinutes = Number(/^ {8}timeout-minutes: (\d+)$/m.exec(testStep)?.[1]);
+        assert.ok(stepMinutes > 0, `${id}: the test step sets its own timeout-minutes`);
+        assert.ok(jobMinutes - stepMinutes >= 2, `${id}: the step limit leaves time for setup and the uploads`);
+        const upload = jobSteps.slice(testAt + 1).find(step => /^ {10}path: tools\/vendor\/test-results\/$/m.test(step));
+        assert.ok(upload, `${id} uploads tools/vendor/test-results/ (traces and blob report) after the tests`);
+        assert.match(upload, /^ {8}if: always\(\)$/m, `${id} uploads them when the step failed or timed out`);
+    }
+});
+
 // Every job is bounded (#350): a hang ends at a measured limit instead of GitHub's 6-hour default.
-const BOUNDED_WORKFLOWS = ['test.yml', 'code-quality.yml', 'viewerjs-check.yml'];
+const GATING_WORKFLOWS = ['test.yml', 'code-quality.yml', 'viewerjs-check.yml'];
+const BOUNDED_WORKFLOWS = [...GATING_WORKFLOWS, 'portability.yml'];
 const readWorkflow = name => readFileSync(new URL(`../../.github/workflows/${name}`, import.meta.url), 'utf8');
 
 test('every job in the CI workflows has a numeric timeout-minutes', () => {
@@ -276,3 +321,73 @@ test('the bandit pre-commit hook fails at the severity CI enforces and passes ev
     assert.doesNotMatch(hook, /true|exit-zero|bash -c/, 'nothing masks the exit code or drops a file');
     assert.doesNotMatch(hook, /pass_filenames: false/, 'the hook scans the staged files');
 });
+
+// Event split (#420): pull requests run a fast subset, the merge queue and main run everything.
+const testJobs = () => jobs(readWorkflow('test.yml'));
+
+test('the Python matrix is Linux 3.12 on a pull request and Linux 3.12-3.14 on every other event', () => {
+    const body = testJobs().get('test');
+    assert.deepEqual(matrixList(body, 'os'), ['ubuntu-latest'], 'Windows and macOS never gate a merge');
+    const match = /^ {8}python-version: \$\{\{ github\.event_name == 'pull_request' && fromJSON\('(\[[^\]]*\])'\) \|\| fromJSON\('(\[[^\]]*\])'\) \}\}$/m.exec(body);
+    assert.ok(match, 'python-version is chosen by event');
+    assert.deepEqual({ pr: JSON.parse(match[1]), other: JSON.parse(match[2]) }, { pr: ['3.12'], other: ['3.12', '3.13', '3.14'] });
+    assert.match(body, /^ {6}fail-fast: false$/m);
+    assert.match(body, /^ {4}name: py\$\{\{ matrix\.python-version \}\} on \$\{\{ matrix\.os \}\}$/m);
+});
+
+test('Windows and macOS run 3.12-3.14 on main, nightly and on demand, never on a PR or in the queue', () => {
+    const text = readWorkflow('portability.yml');
+    const triggers = text.slice(text.indexOf('\non:'), text.indexOf('\nconcurrency:'));
+    for (const event of ['push', 'schedule', 'workflow_dispatch']) assert.match(triggers, new RegExp(`^ {2}${event}:`, 'm'));
+    for (const event of ['pull_request', 'merge_group']) assert.doesNotMatch(triggers, new RegExp(`^ {2}${event}`, 'm'));
+    assert.match(triggers, /^ {4}branches: \[main\]$/m, 'push runs only for main');
+    const body = jobs(text).get('test');
+    assert.deepEqual(matrixList(body, 'os'), ['windows-latest', 'macos-latest']);
+    assert.deepEqual(matrixList(body, 'python-version'), ['"3.12"', '"3.13"', '"3.14"']);
+    assert.match(body, /^ {6}fail-fast: false$/m);
+    assert.match(body, /^ {8}run: python -m tests\.run_suite -v$/m);
+    assert.doesNotMatch(text, /cancel-in-progress: true|cancel-in-progress: \$/, 'no portability run is cancelled');
+});
+
+test('real ComfyUI runs only outside pull requests; the other test.yml checks run on every event', () => {
+    const found = testJobs();
+    assert.match(found.get('comfyui'), QUEUE_ONLY_IF);
+    for (const id of ['test', 'coverage', 'lint', 'js-test']) {
+        assert.doesNotMatch(found.get(id), /^ {4}if:/m, `${id} runs on every event`);
+    }
+});
+
+test('all tests needs every gating test.yml job and requires the full set outside pull requests', () => {
+    const found = testJobs();
+    const gate = found.get('all-tests');
+    assert.ok(gate, 'the aggregate gate exists');
+    assert.match(gate, /^ {4}name: all tests$/m, 'the required context is "all tests"');
+    assert.match(gate, /^ {4}if: always\(\)$/m);
+    const gating = [...found.keys()].filter(id => !['all-tests', 'perf-budget'].includes(id));
+    assert.deepEqual([...needsOf(gate)].sort(), gating.sort(), 'the gate needs every job but the non-gating perf budget');
+    assert.deepEqual([...gateVariables(gate).keys()].sort(), gating.sort(), 'every needed result reaches the gate');
+    assertGateBehaviour(gate, ['comfyui']);
+});
+
+test('the CI workflows run on pull_request, merge_group and push without path filters', () => {
+    for (const name of GATING_WORKFLOWS) {
+        const text = readWorkflow(name);
+        const triggers = text.slice(text.indexOf('\non:'), text.indexOf('\n', text.indexOf('\non:') + 1) + 400);
+        for (const event of ['merge_group', 'pull_request', 'push']) {
+            assert.match(triggers, new RegExp(`^ {2}${event}:`, 'm'), `${name} runs on ${event}`);
+        }
+        assert.doesNotMatch(text, /^ {4}paths(-ignore)?:/m, `${name} has no path filter that would leave a required check pending`);
+    }
+    assert.doesNotMatch(jobs(readWorkflow('code-quality.yml')).get('security'), /^ {4}if:/m, 'bandit runs on every event');
+});
+
+test('every required check reports on a pull request and the gates carry the full matrix', () => {
+    const contexts = JSON.parse(readRepoFile('.github/branch-protection.json')).required_status_checks.contexts;
+    assert.deepEqual([...contexts].sort(), [
+        'all tests', 'bandit (high severity)', 'black and flake8', 'coverage gate (85%)', 'frontend modules',
+        'py3.12 on ubuntu-latest', 'real ComfyUI compatibility', 'viewerjs',
+    ].sort());
+    assert.equal(contexts.filter(context => /^py/.test(context)).length, 1,
+        'a dropped matrix leg never reports on a pull request, so it cannot be required');
+    assert.ok(!contexts.some(context => /windows|macos/.test(context)), 'Windows and macOS never gate a merge');
+});

tests/vendor/comfyui-config.test.mjs

@@ -33,15 +33,18 @@ test('execution script discovers only the new matrix and preserves all 78 origin
     const executions = list('tools/vendor/playwright.execution.config.mjs');
     assert.match(executions, /\[classic-start\]/);
     assert.match(executions, /\[nodes2-start\]/);
-    // + the fresh-host library location case, + #342 image attribution, + #343 linked text
-    assert.match(executions, /Total: 90 tests in 5 files/);
+    // + the fresh-host library location case, + #342 image attribution, + #343 linked text,
+    // + #332 image category routes on a generated output (image-attribution.spec.mjs, 2 projects),
+    // + #347 cached runtime-linked runs: five node kinds and eight one-renderer cases (execution-text-link.spec.mjs, 2 projects),
+    // + #90 Save to library off (five node types)
+    assert.match(executions, /Total: 128 tests in 5 files/);
     for (const project of ['classic-start', 'nodes2-start']) {
         const cases = executions.split('\n').filter(line => line.includes(`[${project}]`));
         assert.equal(cases.filter(line => line.includes('execution-history.spec.mjs')).length, 15);
         assert.equal(cases.filter(line => line.includes('execution-outputs.spec.mjs')).length, 8);
         assert.equal(cases.filter(line => line.includes('library-location.spec.mjs')).length, 1);
-        assert.equal(cases.filter(line => line.includes('image-attribution.spec.mjs')).length, 2);
-        assert.equal(cases.filter(line => line.includes('execution-text-link.spec.mjs')).length, 19);
+        assert.equal(cases.filter(line => line.includes('image-attribution.spec.mjs')).length, 3);
+        assert.equal(cases.filter(line => line.includes('execution-text-link.spec.mjs')).length, 37);
     }
     assert.doesNotMatch(executions, /prompt-manager.spec/);
 });

tests/vendor/frontend-coverage-cli.test.mjs

@@ -1,9 +1,11 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
-import { existsSync, mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { EventEmitter } from 'node:events';
+import { setTimeout as delay } from 'node:timers/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { plan, runCoverage } from '../../tools/vendor/frontend-coverage.mjs';
+import { plan, runCoverage, runNode } from '../../tools/vendor/frontend-coverage.mjs';
 
 const steps = argv => plan(argv).map(({ step, ...options }) => (Object.keys(options).length ? { step, ...options } : step));
 
@@ -91,3 +93,46 @@ test('shard 1 runs the node units into the shared raw dir, then the viewer suite
     assert.ok(calls[1].args.includes(join(paths.tools, 'playwright.config.mjs')));
     assert.deepEqual(calls[2].args.slice(-2), ['--shard', '1/3']);
 });
+
+// #425: npm and a CI step timeout signal only frontend-coverage.mjs; its running child must get it.
+function hostWithSignals() {
+    return new EventEmitter();
+}
+
+test('runNode resolves on exit 0, rejects with the exit code otherwise and leaves no signal listener', async () => {
+    const host = hostWithSignals();
+    await runNode(['-e', 'process.exit(0)'], {}, { host });
+    await assert.rejects(runNode(['-e', 'process.exit(3)'], {}, { host }), /Command failed \(3\): -e process\.exit\(3\)/);
+    assert.equal(host.listenerCount('SIGTERM') + host.listenerCount('SIGINT'), 0);
+});
+
+test('runNode forwards SIGTERM to the running child, which can report before it exits', async t => {
+    const root = mkdtempSync(join(tmpdir(), 'pm-coverage-signal-'));
+    t.after(() => rmSync(root, { recursive: true, force: true }));
+    const ready = join(root, 'ready');
+    const seen = join(root, 'seen');
+    const child = `const fs = require('node:fs');
+process.on('SIGTERM', () => { fs.writeFileSync(${JSON.stringify(seen)}, 'SIGTERM'); process.exit(7); });
+fs.writeFileSync(${JSON.stringify(ready)}, ''); setInterval(() => {}, 1000);`;
+    const host = hostWithSignals();
+    const running = runNode(['-e', child], {}, { host });
+    while (!existsSync(ready)) await delay(20);
+    host.emit('SIGTERM');
+    await assert.rejects(running, /Command failed \(7\)/);
+    assert.equal(readFileSync(seen, 'utf8'), 'SIGTERM', 'the child handled the forwarded signal');
+    assert.equal(host.listenerCount('SIGTERM'), 0);
+});
+
+test('runNode forwards SIGINT and starts the child in its own process group', async () => {
+    const host = hostWithSignals();
+    const kills = [];
+    let options;
+    const fake = new EventEmitter();
+    fake.kill = signal => { kills.push(signal); queueMicrotask(() => fake.emit('exit', null, signal)); };
+    const running = runNode(['x.mjs'], {}, { host, spawnChild: (command, args, spawnOptions) => { options = spawnOptions; return fake; } });
+    assert.equal(options.detached, true, 'a group-wide signal reaches the child only through forwarding, once');
+    host.emit('SIGINT');
+    await assert.rejects(running, /Command failed \(null\): x\.mjs/);
+    assert.deepEqual(kills, ['SIGINT']);
+    assert.equal(host.listenerCount('SIGINT'), 0);
+});

tools/vendor/frontend-coverage-baseline.json

@@ -107,6 +107,12 @@
     "functions": 98,
     "statements": 98
   },
+  "save-to-library.js": {
+    "lines": 98,
+    "branches": 98,
+    "functions": 98,
+    "statements": 98
+  },
   "scan-progress.js": {
     "lines": 98,
     "branches": 98,

tools/vendor/frontend-coverage.mjs

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync, readdirSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join, relative } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
-import { spawnSync } from 'node:child_process';
+import { spawn } from 'node:child_process';
 import { repositoryRoot } from './vendor-viewerjs.mjs';
 
 import { discoverSources, checkCoverage } from '@comfyassets/toolkit/testing/coverage';
@@ -10,10 +10,27 @@ const metrics = ['lines', 'branches', 'functions', 'statements'];
 const SHARD = /^([1-9]\d*)\/([1-9]\d*)$/;
 const USAGE = 'usage: frontend-coverage.mjs [--update-baseline] | --shard I/N | --merge-only [--update-baseline]';
 
-function runNode(args, env = {}) {
-    const result = spawnSync(process.execPath, args, { cwd: repositoryRoot, stdio: 'inherit',
-        env: { ...process.env, ...env } });
-    if (result.status !== 0) throw new Error(`Command failed (${result.status}): ${args.join(' ')}`);
+const FORWARDED_SIGNALS = ['SIGTERM', 'SIGINT'];
+
+// Runs one step's node child and waits for it. npm and a CI step timeout signal only this process,
+// so SIGTERM and SIGINT are forwarded to the running child (#425): Playwright then reports the tests
+// still running and writes its blob. The child gets its own process group, so a signal sent to the
+// whole group (Ctrl-C, `timeout`) still reaches it exactly once, through this forwarding.
+export function runNode(args, env = {}, { spawnChild = spawn, host = process } = {}) {
+    return new Promise((resolve, reject) => {
+        const child = spawnChild(process.execPath, args, { cwd: repositoryRoot, stdio: 'inherit',
+            env: { ...process.env, ...env }, detached: true });
+        const forward = signal => () => child.kill(signal);
+        const handlers = FORWARDED_SIGNALS.map(signal => [signal, forward(signal)]);
+        for (const [signal, handler] of handlers) host.on(signal, handler);
+        const done = () => { for (const [signal, handler] of handlers) host.removeListener(signal, handler); };
+        child.once('error', error => { done(); reject(error); });
+        child.once('exit', code => {
+            done();
+            if (code === 0) resolve();
+            else reject(new Error(`Command failed (${code}): ${args.join(' ')}`));
+        });
+    });
 }
 
 function defaultPaths() {
@@ -112,17 +129,17 @@ export async function runCoverage({ argv = process.argv.slice(2), run = runNode,
         'node-units'() {
             const tests = readdirSync(join(root, 'tests/js')).filter(file => file.endsWith('.test.js'))
                 .map(file => `tests/js/${file}`);
-            run(['--test', ...tests], { NODE_V8_COVERAGE: raw });
+            return run(['--test', ...tests], { NODE_V8_COVERAGE: raw });
         },
         viewer() {
-            run([playwright, 'test', '--config', join(tools, 'playwright.config.mjs')]);
+            return run([playwright, 'test', '--config', join(tools, 'playwright.config.mjs')]);
         },
         workflows({ shard }) {
-            run([playwright, 'test', '--config', join(tools, 'playwright.workflows.config.mjs'),
+            return run([playwright, 'test', '--config', join(tools, 'playwright.workflows.config.mjs'),
                 '--project', 'chromium', '--project', 'touch', ...(shard ? ['--shard', shard] : [])], { PM_JS_COVERAGE: raw });
         },
         report() {
-            run([join(tools, 'node_modules/c8/bin/c8.js'), 'report', '--all', '--src', sourceRoot,
+            return run([join(tools, 'node_modules/c8/bin/c8.js'), 'report', '--all', '--src', sourceRoot,
                 '--include', 'web/js/**/*.js', '--include', 'web/js/**/*.mjs', '--temp-directory', raw, '--reports-dir', reportRoot,
                 '--reporter', 'text', '--reporter', 'json-summary', '--reporter', 'html']);
         },

tools/vendor/playwright.config.mjs

@@ -1,4 +1,5 @@
 import { defineConfig } from '@playwright/test';
+import { reporters } from './test-workers.mjs';
 
 export default defineConfig({
     testDir: './tests',
@@ -8,7 +9,7 @@ export default defineConfig({
     workers: 2,
     forbidOnly: Boolean(process.env.CI),
     retries: process.env.CI ? 1 : 0,
-    reporter: 'list',
+    reporter: reporters({ name: 'viewer' }),
     use: { browserName: 'chromium', headless: true, trace: 'retain-on-failure' },
     projects: [
         { name: 'desktop', use: { viewport: { width: 1280, height: 800 } } },

tools/vendor/playwright.workflows.config.mjs

@@ -1,5 +1,5 @@
 import { defineConfig, devices } from '@playwright/test';
-import { workflowWorkers } from './test-workers.mjs';
+import { reporters, workflowWorkers } from './test-workers.mjs';
 
 // No global webServer: tests/browser/fixtures.mjs starts one server per worker
 // on an OS-chosen port. Files run in parallel; tests inside a file keep their order.
@@ -11,7 +11,7 @@ export default defineConfig({
     fullyParallel: false,
     forbidOnly: Boolean(process.env.CI),
     retries: 0,
-    reporter: 'list',
+    reporter: reporters({ name: 'workflows' }),
     use: { trace: 'retain-on-failure', screenshot: 'only-on-failure' },
     projects: [
         { name: 'chromium', outputDir: './test-results/workflows/chromium', use: { browserName: 'chromium' } },

tools/vendor/running-tests-reporter.mjs

@@ -0,0 +1,58 @@
+import { writeSync } from 'node:fs';
+import { relative } from 'node:path';
+
+// Names the tests still running when a run is cut off (#425). A browser test step that reaches its
+// timeout-minutes gets SIGTERM, which ends Playwright at once: no reporter's onEnd runs, so neither
+// `list` nor the blob report says what was running. On the first SIGTERM this reporter prints every
+// started test that has not ended, then turns the signal into SIGINT, Playwright's own interrupt,
+// which stops the workers, ends the run as interrupted (non-zero exit) and writes the blob report.
+// A second SIGTERM gets the default behaviour: the process dies.
+export default class RunningTestsReporter {
+    constructor({ now = () => Date.now(), write = text => writeSync(1, text), host = process } = {}) {
+        this.now = now;
+        this.write = write;
+        this.host = host;
+        this.rootDir = host.cwd();
+        this.running = new Map();
+        this.onSigterm = () => {
+            this.host.removeListener('SIGTERM', this.onSigterm);
+            this.report('SIGTERM');
+            this.host.kill(this.host.pid, 'SIGINT');
+        };
+    }
+
+    printsToStdio() {
+        return false;
+    }
+
+    onBegin(config) {
+        this.rootDir = config.rootDir;
+        this.host.on('SIGTERM', this.onSigterm);
+    }
+
+    onTestBegin(test, result) {
+        this.running.set(`${test.id}#${result.retry}`, { test, startedAt: this.now() });
+    }
+
+    onTestEnd(test, result) {
+        this.running.delete(`${test.id}#${result.retry}`);
+    }
+
+    describe({ test, startedAt }) {
+        const project = test.parent?.project()?.name;
+        const where = `${relative(this.rootDir, test.location.file)}:${test.location.line}`;
+        const seconds = ((this.now() - startedAt) / 1000).toFixed(1);
+        return `${project ? `[${project}] › ` : ''}${where} › ${test.title} (running ${seconds}s)`;
+    }
+
+    report(reason) {
+        if (!this.running.size) return;
+        const lines = [...this.running.values()].map(entry => `  ${this.describe(entry)}`);
+        this.write(`\nStill running when the run ended (${reason}): ${this.running.size}\n${lines.join('\n')}\n`);
+    }
+
+    onEnd(result) {
+        this.host.removeListener('SIGTERM', this.onSigterm);
+        this.report(result.status);
+    }
+}

tools/vendor/test-workers.mjs

@@ -1,4 +1,8 @@
 import { availableParallelism } from 'node:os';
+import { fileURLToPath } from 'node:url';
+
+// Absolute, so a config that imports this one from another directory still finds it.
+const RUNNING_TESTS_REPORTER = fileURLToPath(new URL('./running-tests-reporter.mjs', import.meta.url));
 
 const MAX_LOCAL_WORKERS = 8;
 const CPUS_PER_WORKER = 4;
@@ -16,3 +20,10 @@ export function workflowWorkers({ env = process.env, cpus = availableParallelism
     if (env.CI) return 1;
     return Math.max(1, Math.min(MAX_LOCAL_WORKERS, Math.floor(cpus / CPUS_PER_WORKER)));
 }
+
+// Under CI, running-tests-reporter.mjs names the tests a step timeout's signal cut off (`list`
+// cannot: they never end), and a blob report beside the traces is uploaded with them.
+export function reporters({ env = process.env, name } = {}) {
+    if (!env.CI) return 'list';
+    return [['list'], [RUNNING_TESTS_REPORTER], ['blob', { outputDir: `./test-results/blob/${name}` }]];
+}

utils/cached_runs.py

@@ -0,0 +1,532 @@
+"""Count a cached PromptManager node like the execution it reuses (#347).
+
+The queue hook (``usage_tracking``) counts text it can read from the queued
+graph. Text only known at run time (a PreviewAny or LLM link, a list node) is
+counted by the node itself when it executes. When ComfyUI later serves the node
+from its output cache the node does not execute, so without this module that
+job is not counted.
+
+When a PromptManager-family node executes it records a *receipt item*: the
+role-independent facts its own count is made from (the stored text hashes)
+and digests of the STRING outputs it returned. When ComfyUI reports the node
+as cached for a later job (``execution_cached``), the receipt whose digests
+equal the text in the cache entry is replayed once for that job. The node's
+role (positive, negative, which Pair outputs are used) and what the hook
+already saw are recomputed from that job's own graph, and both paths count
+through the same ``own_counts`` so they cannot drift.
+
+Fail closed: when the cached text cannot be matched to a receipt recorded in
+this process, nothing is counted (the behavior before #347). In memory only and
+bounded; starts no threads.
+"""
+
+import hashlib
+import threading
+from collections import OrderedDict
+from typing import Any, Callable, Dict, FrozenSet, List, NamedTuple, Optional, Tuple
+
+try:
+    from .hashing import generate_prompt_hash
+    from .logging_config import get_logger
+    from .prompt_graph import (
+        PROMPT_MANAGER_TYPES,
+        intrinsic_pair_nodes,
+        resolve_text,
+        run_prompt_components,
+        run_prompt_nodes,
+    )
+    from .prompt_pair_resolver import resolve_text_input
+    from .queue_observers import subscribe_dequeue, subscribe_task_done
+    from .run_keys import prompt_node_key, upstream_nodes
+    from .usage_tracking import find_pair_id_by_hashes, survive_switch
+except ImportError:
+    from utils.hashing import generate_prompt_hash
+    from utils.logging_config import get_logger
+    from utils.prompt_graph import (
+        PROMPT_MANAGER_TYPES,
+        intrinsic_pair_nodes,
+        resolve_text,
+        run_prompt_components,
+        run_prompt_nodes,
+    )
+    from utils.prompt_pair_resolver import resolve_text_input
+    from utils.queue_observers import subscribe_dequeue, subscribe_task_done
+    from utils.run_keys import prompt_node_key, upstream_nodes
+    from utils.usage_tracking import find_pair_id_by_hashes, survive_switch
+
+logger = get_logger("prompt_manager.cached_runs")
+
+PAIR = "PromptManagerPair"
+MAX_KEYS = 256  # run keys remembered (the same bound as MAX_KEYED_RUNS)
+MAX_RECEIPTS = 4  # receipts per run key: a recurring upstream value (A, B, A)
+MAX_ITEMS = 64  # list items per receipt (the cache reader's bound)
+MAX_CACHED_NODES = 500  # the execution_cached guard the history capture uses
+_EMPTY_HASH = generate_prompt_hash("")
+
+Count = Tuple[Any, ...]  # ("prompt", hash) or ("pair", positive, negative or None)
+
+
+class Facts(NamedTuple):
+    """What one execution stored: hashes of the stored text, None when nothing.
+
+    ``positive_hash`` is None for an empty editor (or saving disabled);
+    ``negative_hash`` (Pair only) is None for an empty negative, which the pair
+    stores as ``negative_prompt_id IS NULL``.
+    """
+
+    positive_hash: Optional[str]
+    negative_hash: Optional[str] = None
+
+
+class Role(NamedTuple):
+    """How a job's graph uses the node: which editors reach a sampler's positive."""
+
+    used_fields: FrozenSet[str]
+    pair_used: bool = False
+
+
+class Seen(NamedTuple):
+    """Which of the node's texts the queue hook resolved, and so already counted."""
+
+    text: bool = False
+    negative_text: bool = False
+    pair: bool = False
+
+
+class _Item(NamedTuple):
+    outputs: Tuple[str, ...]
+    facts: Facts
+
+
+class _Receipt:
+    __slots__ = ("item_id", "items")
+
+    def __init__(self, item_id: int) -> None:
+        self.item_id = item_id
+        self.items: Dict[int, _Item] = {}
+
+    def outputs(self) -> Dict[int, Tuple[str, ...]]:
+        return {index: item.outputs for index, item in self.items.items()}
+
+
+class _Attempt(NamedTuple):
+    item_id: int
+    prompt_id: str
+    graph: Dict[str, Any]
+    nodes: Dict[str, Tuple[str, str]]  # node id -> (class, run key)
+    replayed: set
+
+
+def text_digest(value: str) -> str:
+    """Digest of one returned STRING value, exactly as returned."""
+    return hashlib.sha256(value.encode("utf-8", "surrogatepass")).hexdigest()
+
+
+def stored_facts(text: Any, negative_text: Any = None) -> Facts:
+    """The facts of an execution that stores ``text`` (and a Pair's negative)."""
+    positive = text if isinstance(text, str) and text.strip() else None
+    negative = (
+        negative_text
+        if isinstance(negative_text, str) and negative_text.strip()
+        else None
+    )
+    return Facts(
+        generate_prompt_hash(positive) if positive is not None else None,
+        generate_prompt_hash(negative) if negative is not None else None,
+    )
+
+
+def pair_components(facts: Facts, role: Role) -> List[Tuple[str, str]]:
+    """``(field, hash)`` of each used, stored Pair component; each hash once."""
+    found, counted = [], set()
+    for field, prompt_hash in (
+        ("text", facts.positive_hash),
+        ("negative_text", facts.negative_hash),
+    ):
+        if field not in role.used_fields or prompt_hash is None:
+            continue
+        if prompt_hash in counted:
+            continue
+        counted.add(prompt_hash)
+        found.append((field, prompt_hash))
+    return found
+
+
+def own_counts(node_type: str, facts: Facts, role: Role, seen: Seen) -> List[Count]:
+    """What one execution of a node counts itself: text the hook could not see.
+
+    Shared by the executing node and by replay. Excludes the pending first-use
+    catch-up, which only an execution that saves the prompt can consume.
+    """
+    if facts.positive_hash is None:
+        return []
+    if node_type != PAIR:
+        if "text" in role.used_fields and not seen.text:
+            return [("prompt", facts.positive_hash)]
+        return []
+    counts: List[Count] = [
+        ("prompt", prompt_hash)
+        for field, prompt_hash in pair_components(facts, role)
+        if not getattr(seen, field)
+    ]
+    if role.pair_used and not seen.pair:
+        counts.append(("pair", facts.positive_hash, facts.negative_hash))
+    return counts
+
+
+def graph_role(graph: Any, node_id: str, node_type: str) -> Role:
+    """The node's role in a queued graph, by the functions the nodes use."""
+    if node_type != PAIR:
+        used = {"text"} if node_id in run_prompt_nodes(graph) else set()
+        return Role(frozenset(used))
+    used = {
+        field for source, field in run_prompt_components(graph) if source == node_id
+    }
+    return Role(frozenset(used), node_id in intrinsic_pair_nodes(graph))
+
+
+def _same(resolved: Optional[str], prompt_hash: Optional[str]) -> bool:
+    return resolved is not None and generate_prompt_hash(resolved) == prompt_hash
+
+
+def graph_seen(graph: Any, node_id: str, node_type: str, facts: Facts) -> Seen:
+    """Which texts the queue hook resolved from ``graph`` (as the node decides)."""
+    if node_type != PAIR:
+        return Seen(text=_same(resolve_text(graph, node_id), facts.positive_hash))
+    positive = _same(resolve_text_input(graph, node_id, "text"), facts.positive_hash)
+    negative = _same(
+        resolve_text_input(graph, node_id, "negative_text"),
+        facts.negative_hash or _EMPTY_HASH,
+    )
+    return Seen(positive, negative, positive and negative)
+
+
+def _host_context() -> Tuple[Optional[str], Optional[int]]:
+    """(prompt id, list index) of the node executing on this thread, if known."""
+    try:
+        from comfy_execution.utils import get_executing_context
+    except Exception:
+        return None, None
+    try:
+        context = get_executing_context()
+    except Exception:
+        return None, None
+    prompt_id = getattr(context, "prompt_id", None)
+    index = getattr(context, "list_index", None)
+    return (
+        prompt_id if isinstance(prompt_id, str) and prompt_id else None,
+        index if type(index) is int else None,
+    )
+
+
+def write_count(db: Any, count: Count) -> bool:
+    """Record one counted run; False when the prompt or pair no longer exists."""
+
+    def write() -> bool:
+        if count[0] == "prompt":
+            row = db.get_prompt_by_hash(count[1])
+            if row:
+                db.record_prompt_use(row["id"])
+            return bool(row)
+        pair_id = find_pair_id_by_hashes(db, count[1], count[2])
+        if pair_id:
+            db.record_prompt_pair_use(pair_id)
+        return bool(pair_id)
+
+    return bool(survive_switch(db, write))
+
+
+class CachedRuns:
+    """Receipts of executed nodes and the one job currently executing."""
+
+    def __init__(
+        self,
+        *,
+        max_keys: int = MAX_KEYS,
+        max_receipts: int = MAX_RECEIPTS,
+        max_items: int = MAX_ITEMS,
+        context: Callable[[], Tuple[Optional[str], Optional[int]]] = _host_context,
+    ) -> None:
+        self._max_keys = max_keys
+        self._max_receipts = max_receipts
+        self._max_items = max_items
+        self._context = context
+        self._receipts: "OrderedDict[str, List[_Receipt]]" = OrderedDict()
+        self._attempt: Optional[_Attempt] = None
+        self._lock = threading.Lock()
+
+    # -- the job ------------------------------------------------------------
+
+    def begin_attempt(self, result: Any) -> None:
+        """A job was dequeued: ``result`` is ``PromptQueue.get``'s return value."""
+        attempt = None
+        try:
+            item, item_id = result[0], result[1]
+            prompt_id, graph, outputs = item[1], item[2], item[4]
+            if type(item_id) is int and isinstance(prompt_id, str):
+                if isinstance(graph, dict):
+                    attempt = _Attempt(
+                        item_id, prompt_id, graph, _job_nodes(graph, outputs), set()
+                    )
+        except Exception as error:
+            logger.debug(f"Dequeued job not tracked for cached runs: {error}")
+        with self._lock:
+            self._attempt = attempt
+
+    def end_attempt(self, item_id: Any) -> None:
+        """The job finished: its receipts are complete and replace equal older ones.
+
+        Deduplicating only complete receipts keeps a list execution that is
+        still recording ([A] so far of [A, B]) from dropping an older [A].
+        """
+        with self._lock:
+            if self._attempt is not None and self._attempt.item_id == item_id:
+                self._attempt = None
+            for run_key, receipts in self._receipts.items():
+                if receipts and receipts[0].item_id == item_id:
+                    self._receipts[run_key] = _deduplicated(receipts)
+
+    def _current(self) -> Tuple[Optional[_Attempt], Optional[int]]:
+        """The attempt the executing node belongs to, and its list index."""
+        prompt_id, index = self._context()
+        with self._lock:
+            attempt = self._attempt
+        if attempt is None or prompt_id is None or prompt_id != attempt.prompt_id:
+            return None, None
+        return attempt, index
+
+    # -- node execution -----------------------------------------------------
+
+    def replayed(self, node_id: Any) -> bool:
+        """Whether this job already counted the executing node by replay."""
+        attempt, _ = self._current()
+        if attempt is None:
+            return False
+        with self._lock:
+            return str(node_id) in attempt.replayed
+
+    def record_item(self, node_id: Any, outputs: Tuple[Any, ...], facts: Facts) -> None:
+        """Remember what this execution returned and was entitled to count."""
+        try:
+            attempt, index = self._current()
+            node = attempt.nodes.get(str(node_id)) if attempt else None
+            if node is None:
+                return
+            index = 0 if index is None else index
+            if not 0 <= index < self._max_items:
+                return
+            if any(not isinstance(value, str) for value in outputs):
+                return
+            item = _Item(tuple(text_digest(value) for value in outputs), facts)
+            self._store(node[1], attempt.item_id, index, item)
+        except Exception as error:
+            logger.debug(f"Could not record a cached-run receipt: {error}")
+
+    def _store(self, run_key: str, item_id: int, index: int, item: _Item) -> None:
+        with self._lock:
+            receipts = self._receipts.pop(run_key, [])
+            if receipts and receipts[0].item_id == item_id:
+                receipt = receipts[0]
+            else:
+                # The previous job's receipt is complete (its task_done may
+                # never have fired): it replaces older receipts it equals.
+                receipts = _deduplicated(receipts)
+                receipt = _Receipt(item_id)
+                receipts.insert(0, receipt)
+            receipt.items[index] = item
+            self._receipts[run_key] = receipts[: self._max_receipts]
+            while len(self._receipts) > self._max_keys:
+                self._receipts.popitem(last=False)
+
+    # -- cached nodes -------------------------------------------------------
+
+    def replay(
+        self,
+        executor: Any,
+        prompt_id: Any,
+        nodes: Any,
+        db_factory: Callable[[], Any],
+        reader: Optional[Callable[[Any, str, str], Any]] = None,
+    ) -> None:
+        """Count the job's cached nodes whose cached text a receipt proves."""
+        if reader is None:
+            reader = _host().cached_string_outputs
+        with self._lock:
+            attempt = self._attempt
+        if attempt is None or prompt_id != attempt.prompt_id:
+            return
+        if type(nodes) not in (list, tuple) or len(nodes) > MAX_CACHED_NODES:
+            return
+        db = None
+        for node_id in nodes:
+            node = attempt.nodes.get(node_id) if type(node_id) is str else None
+            if node is None:
+                continue
+            node_type, run_key = node
+            items = self._match(run_key, reader(executor, node_id, node_type))
+            if items is None:
+                logger.debug(
+                    f"Cached node {node_id} not counted: no matching execution"
+                )
+                continue
+            with self._lock:
+                if node_id in attempt.replayed:
+                    continue  # a repeated message or id never counts twice
+                attempt.replayed.add(node_id)
+            counts: List[Count] = []
+            role = graph_role(attempt.graph, node_id, node_type)
+            for item in items:
+                seen = graph_seen(attempt.graph, node_id, node_type, item.facts)
+                counts.extend(own_counts(node_type, item.facts, role, seen))
+            if not counts:
+                continue
+            try:
+                db = db if db is not None else db_factory()
+                for count in counts:
+                    if not write_count(db, count):
+                        logger.info(
+                            f"Cached node {node_id}: its {count[0]} no longer exists, "
+                            "not counted"
+                        )
+            except Exception as error:
+                logger.warning(f"Could not count cached node {node_id}: {error}")
+
+    def _match(self, run_key: str, values: Any) -> Optional[List[_Item]]:
+        """The items of the one receipt whose outputs equal ``values``, in order."""
+        if not values:
+            return None
+        length = len(values[0])
+        if length == 0 or length > self._max_items:
+            return None
+        if any(len(slot) != length for slot in values):
+            return None
+        wanted = {
+            index: tuple(text_digest(slot[index]) for slot in values)
+            for index in range(length)
+        }
+        with self._lock:
+            receipts = self._receipts.get(run_key)
+            if not receipts:
+                return None
+            matches = [receipt for receipt in receipts if receipt.outputs() == wanted]
+            if not matches:
+                return None
+            self._receipts.move_to_end(run_key)
+            facts = {
+                tuple(receipt.items[index].facts for index in range(length))
+                for receipt in matches
+            }
+            if len(facts) != 1:
+                return None
+            return [matches[0].items[index] for index in range(length)]
+
+
+def _deduplicated(receipts: List[_Receipt]) -> List[_Receipt]:
+    """The newest receipt replaces older ones with the same outputs."""
+    if not receipts:
+        return receipts
+    outputs = receipts[0].outputs()
+    return [receipts[0]] + [r for r in receipts[1:] if r.outputs() != outputs]
+
+
+def _job_nodes(graph: Dict[str, Any], outputs: Any) -> Dict[str, Tuple[str, str]]:
+    """PromptManager-family nodes the job's outputs need, with their run keys."""
+    starts = (
+        [str(node) for node in outputs] if isinstance(outputs, (list, tuple)) else []
+    )
+    needed = upstream_nodes(graph, starts)
+    nodes = {}
+    for node_id in needed:
+        node = graph.get(node_id)
+        node_type = node.get("class_type") if isinstance(node, dict) else None
+        if node_type not in PROMPT_MANAGER_TYPES:
+            continue
+        run_key = prompt_node_key(graph, node_id)
+        if run_key is not None:
+            nodes[node_id] = (node_type, run_key)
+    return nodes
+
+
+def _host() -> Any:
+    """The host adapter module (imported late: it needs ComfyUI's modules)."""
+    try:
+        from . import execution_context_host
+    except ImportError:
+        from utils import execution_context_host
+    return execution_context_host
+
+
+# Shared between the nodes and the host observers
+CACHED_RUNS = CachedRuns()
+
+_registered = threading.Event()
+_register_lock = threading.Lock()
+
+
+def register_cached_runs(
+    server: Any, db_factory: Callable[[], Any], runs: Optional[CachedRuns] = None
+) -> bool:
+    """Observe dequeue, ``execution_cached`` and ``task_done``; once per process.
+
+    Registers nothing when the host lacks any of them: counting is then as
+    before #347.
+    """
+    runs = CACHED_RUNS if runs is None else runs
+    with _register_lock:
+        if _registered.is_set():
+            return False
+        queue = getattr(server, "prompt_queue", None)
+        if not callable(getattr(queue, "get", None)) or not callable(
+            getattr(queue, "task_done", None)
+        ):
+            logger.info("Cached runs not counted: the prompt queue is not observable")
+            return False
+        try:
+            from execution import PromptExecutor
+        except Exception:
+            logger.info("Cached runs not counted: no ComfyUI executor")
+            return False
+        if not callable(getattr(PromptExecutor, "add_message", None)):
+            logger.info("Cached runs not counted: executor messages unavailable")
+            return False
+        subscribe_executor_messages = _host().subscribe_executor_messages
+
+        def on_message(executor: Any, args: tuple, kwargs: dict) -> None:
+            try:
+                event = args[0] if args else kwargs.get("event")
+                if event != "execution_cached":
+                    return
+                server_of = getattr(executor, "server", None)
+                if getattr(server_of, "prompt_queue", None) is not queue:
+                    return
+                data = args[1] if len(args) > 1 else kwargs.get("data")
+                if type(data) is not dict:
+                    return
+                runs.replay(
+                    executor, data.get("prompt_id"), data.get("nodes"), db_factory
+                )
+            except Exception as error:
+                logger.warning(f"Could not count cached nodes: {error}")
+
+        unsubscribers = []
+        try:
+            unsubscribers.append(
+                subscribe_dequeue(queue, "cached_runs", runs.begin_attempt)
+            )
+            unsubscribers.append(
+                subscribe_task_done(
+                    queue,
+                    "cached_runs",
+                    lambda args, kwargs: runs.end_attempt(
+                        args[0] if args else kwargs.get("item_id")
+                    ),
+                )
+            )
+            unsubscribers.append(subscribe_executor_messages("cached_runs", on_message))
+        except Exception:
+            for unsubscribe in unsubscribers:
+                unsubscribe()
+            raise
+        _registered.set()
+        logger.info("Counting cached runs of runtime-linked prompt text")
+        return True

utils/execution_context_capture.py

@@ -11,6 +11,7 @@ import weakref
 
 from .execution_context_budget import ContextBudget, PayloadLease, SealedContext
 from .execution_context_graph import (
+    NOT_SAVED,
     GraphProjection,
     GraphRole,
     SourceRef,
@@ -325,6 +326,8 @@ class ContextCapture:
                     nonlocal ambiguous
                     if role.reason == "source-transformed":
                         return _unknown("unsupported")
+                    if role.reason == NOT_SAVED:
+                        return _unknown("unavailable")
                     if not role.sources:
                         return role.inferred or _unknown("unsupported")
                     values = [

utils/execution_context_graph.py

@@ -3,8 +3,13 @@
 import re
 from dataclasses import dataclass
 from .execution_contexts import PromptSnapshot, TextEvidence, text_size
+from .prompt_graph import save_setting
 from .prompt_pair_resolver import _DEFAULT_ADAPTERS
 
+# A role whose PromptManager source has save_to_library off, or wired from a
+# node the graph cannot read: no text is recorded for it (#90)
+NOT_SAVED = "not_saved"
+
 
 @dataclass(frozen=True)
 class SourceRef:
@@ -332,6 +337,11 @@ class _Projector:
             self.transformed = False
             # Only the capture-source-to-consumer path determines transforms.
             sources = self.discover_sources(value, "conditioning")
+            if any(
+                save_setting(self.graph, source.node_id) is not True
+                for source in sources
+            ):
+                return GraphRole((), None, NOT_SAVED)
             snapshot, _ = self.text(value, "conditioning")
             return GraphRole(
                 sources, snapshot, "source-transformed" if self.transformed else ""

utils/execution_context_host.py

@@ -75,6 +75,82 @@ def subscribe_executor_messages(key: str, callback: Callable) -> Callable[[], No
         return state.subscribe(key, callback)
 
 
+# STRING output slots of each PromptManager-family node, in output order
+STRING_SLOTS = {
+    "PromptManager": (1,),
+    "PromptManagerFocused": (1,),
+    "PromptManagerSplit": (1,),
+    "PromptManagerText": (0,),
+    "PromptManagerPair": (2, 3),
+}
+MAX_CACHED_VALUES = 64
+
+
+def _local_cache_reader(executor: object) -> Callable | None:
+    """``node_id -> outputs`` of the executor's local output cache, or None.
+
+    Only the supported cache classes, only ``get_local`` (never a provider or
+    an async lookup), only a real ``CacheEntry`` with at most four outputs.
+    """
+    from comfy_execution import caching
+    from execution import CacheEntry
+
+    cache = executor.caches.outputs
+    supported = tuple(
+        cls
+        for name in ("HierarchicalCache", "LRUCache", "RAMPressureCache")
+        if isinstance(cls := getattr(caching, name, None), type)
+    )
+    if type(cache) not in supported:
+        return None
+    local = getattr(cache, "get_local", None)
+    if not callable(local):
+        return None
+
+    def read(node_id: str) -> list | tuple | None:
+        entry = local(node_id)
+        if type(entry) is not CacheEntry:
+            return None
+        outputs = entry.outputs
+        if type(outputs) not in (list, tuple) or not 0 < len(outputs) <= 4:
+            return None
+        return outputs
+
+    return read
+
+
+def cached_string_outputs(
+    executor: object, node_id: str, node_type: str
+) -> tuple[tuple[str, ...], ...] | None:
+    """One tuple per STRING slot of a cached node's local entry, or None (#347).
+
+    None when the cache or entry is not supported, a slot is missing or holds
+    more than 64 values, any value is not a ``str``, or the slots differ in
+    length. Never runs a provider or an async lookup.
+    """
+    try:
+        slots = STRING_SLOTS.get(node_type)
+        if slots is None or type(node_id) is not str:
+            return None
+        local = _local_cache_reader(executor)
+        outputs = local(node_id) if local is not None else None
+        if outputs is None or not max(slots) < len(outputs):
+            return None
+        found = []
+        for slot in slots:
+            values = outputs[slot]
+            if type(values) not in (list, tuple) or len(values) > MAX_CACHED_VALUES:
+                return None
+            if any(type(value) is not str for value in values):
+                return None
+            found.append(tuple(values))
+        if len({len(values) for values in found}) != 1:
+            return None
+        return tuple(found)
+    except Exception:
+        return None
+
+
 def observe_cached_context(
     executor: object, message_type: object, message_data: object
 ) -> None:
@@ -101,19 +177,8 @@ def observe_cached_context(
         nodes = message_data.get("nodes")
         if type(nodes) not in (list, tuple) or len(nodes) > 500:
             return
-        from comfy_execution import caching
-        from execution import CacheEntry
-
-        cache = executor.caches.outputs
-        supported = tuple(
-            cls
-            for name in ("HierarchicalCache", "LRUCache", "RAMPressureCache")
-            if isinstance(cls := getattr(caching, name, None), type)
-        )
-        if type(cache) not in supported:
-            return
-        local = getattr(cache, "get_local", None)
-        if not callable(local):
+        local = _local_cache_reader(executor)
+        if local is None:
             return
         # Only source IDs retained by the bounded submitted graph are queried.
         for source in cap.sources:
@@ -124,11 +189,8 @@ def observe_cached_context(
                 if source.node_type == "PromptManagerPair"
                 else 0 if source.node_type == "PromptManagerText" else 1
             )
-            entry = local(source.node_id)
-            if type(entry) is not CacheEntry:
-                continue
-            outputs = entry.outputs
-            if type(outputs) not in (list, tuple) or not slot < len(outputs) <= 4:
+            outputs = local(source.node_id)
+            if outputs is None or not slot < len(outputs):
                 continue
             values = outputs[slot]
             if type(values) not in (list, tuple) or len(values) > 64:

utils/exit_signal.py

@@ -0,0 +1,110 @@
+"""The process exit signal: running work stops at its next safe point (#376).
+
+ComfyUI catches Ctrl+C in ``main.py`` and returns without closing its event
+loop. The interpreter then runs ``threading._shutdown``, which first calls the
+``threading._register_atexit`` callbacks, newest first. One of them,
+``concurrent.futures``'s ``_python_exit``, joins every executor thread, and
+only after that do the ``atexit`` callbacks run (the package teardown). A call
+still running on the default executor (a scan batch, a model download, a
+thumbnail batch) used to keep the process alive until it returned.
+
+``install()`` registers a callback in that same list after ``concurrent.futures``
+did, so it runs before the join. It sets the signal that ``requested()`` reads
+(``Job.cancelled`` and ``map_parallel`` read it) and runs ``on_exit``.
+
+``threading._register_atexit`` is CPython-internal. It has the same contract
+on 3.12, 3.13 and 3.14. Without it, or when it refuses the registration, exit
+behaves as before: the call in flight runs to its end.
+"""
+
+import logging
+import threading
+
+logger = logging.getLogger("prompt_manager.exit")
+
+_requested = threading.Event()
+_install_lock = threading.Lock()
+_installed = False
+_on_exit = []
+
+
+class ExitRequested(Exception):
+    """The interpreter is exiting: work not yet started is not started."""
+
+
+def requested():
+    """True once the interpreter has started exiting."""
+    return _requested.is_set()
+
+
+def request():
+    """Set the signal (the exit hook; tests)."""
+    _requested.set()
+
+
+def checkpoint():
+    """Raise ExitRequested once the interpreter is exiting."""
+    if _requested.is_set():
+        raise ExitRequested("ComfyUI is exiting")
+
+
+def checked(func):
+    """``func`` behind a checkpoint: a call that starts after the signal
+    raises ExitRequested instead of running."""
+
+    def run(*args, **kwargs):
+        checkpoint()
+        return func(*args, **kwargs)
+
+    return run
+
+
+def _hook():
+    """The threading atexit callback. It never raises: an exception here
+    would end ``threading._shutdown`` before it shuts the executors."""
+    _requested.set()
+    for action in tuple(_on_exit):
+        try:
+            action()
+        except (Exception, KeyboardInterrupt):
+            logger.error("Stopping work at exit failed", exc_info=True)
+
+
+def install(on_exit=None):
+    """Register the exit hook once per process; True when it is registered.
+
+    ``on_exit`` (optional) runs inside the hook, after the signal is set.
+    False (logged at DEBUG) when this Python has no ``_register_atexit`` or
+    refuses it; exit then waits for running work as before.
+    """
+    global _installed
+    with _install_lock:
+        if on_exit is not None and on_exit not in _on_exit:
+            _on_exit.append(on_exit)
+        if _installed:
+            return True
+        # Imported first so its pool join is registered before our hook:
+        # the callbacks run newest first, so ours runs before that join.
+        import concurrent.futures.thread  # noqa: F401
+
+        register = getattr(threading, "_register_atexit", None)
+        if not callable(register):
+            logger.debug("threading._register_atexit is missing; exit waits for jobs")
+            return False
+        try:
+            register(_hook)
+        except RuntimeError as error:  # already shutting down
+            logger.debug(f"Exit hook not registered: {error}")
+            return False
+        _installed = True
+        return True
+
+
+def reset():
+    """Clear the signal and forget the registration (tests only; a hook
+    already registered stays in ``threading`` and sets the signal at exit)."""
+    global _installed
+    with _install_lock:
+        _requested.clear()
+        _installed = False
+        _on_exit.clear()

utils/file_prompt.py

@@ -0,0 +1,634 @@
+"""The per-file prompt decision shared by the output scan and the monitor (#247).
+
+``decide_file_prompt`` is the ladder: which prompt one output file names,
+from its metadata alone plus, when the graph cannot decide, the save node
+recorded history says wrote it. It does no file or database I/O; the caller
+reads the metadata, the file size and history (through ``lookup``) and
+stores the ``Decision``.
+
+The default resolver profile decides first, as ingestion always has. Only
+for a file it leaves ambiguous or unresolved does the ladder ask the
+inspector's resolve (``inspection_resolution``: the inspection profile, then
+the recorded saver anchor; never the file-name saver anchor, whose files go
+to Needs review by the #390 ruling), then the #170 browser parser (the legacy floor).
+The policies differ in one place: for a file the inspector calls ambiguous,
+the scan keeps the legacy floor and the monitor stores nothing. Junk text
+(``junk_text``) is never stored, whichever step found it.
+"""
+
+import json
+import re
+from dataclasses import dataclass, field
+from enum import Enum
+from typing import Any, Callable, Mapping, Optional, Union
+
+from .generation_params import (
+    PLACEHOLDERS,
+    GenerationParamsError,
+    extract_generation_params,
+    parse_page_json,
+)
+from .prompt_graph import (
+    PROMPT_MANAGER_TYPES,
+    _positive_roots,
+    is_negative_input,
+    metadata_opted_out,
+    resolve_text,
+    save_setting,
+    side_opted_out,
+)
+from .prompt_inspector import inspection_resolution
+from .prompt_pair_resolver import _numeric, resolve_prompt_pair, sampler_less_prompt
+from .review_capture import reviewable
+
+try:
+    from ..database.pair_ingestion import blank_positive
+except ImportError:
+    from database.pair_ingestion import blank_positive
+
+
+class Policy(Enum):
+    SCAN = "scan"
+    MONITOR = "monitor"
+
+
+PAIR = "pair"
+POSITIVE = "positive"
+HISTORY = "history"
+NOT_SAVED = "not_saved"
+NOT_SAVED_WIRED = "not_saved_wired"
+NEVER = "never"
+KINDS = (PAIR, POSITIVE, HISTORY, NOT_SAVED, NOT_SAVED_WIRED, NEVER)
+
+_UNDECIDED = ("ambiguous", "unresolved")
+
+
+@dataclass(frozen=True)
+class Decision:
+    """What to store for one file (see the design's "The ladder").
+
+    ``kind``: one of ``KINDS``. ``text``: the storage text of the positive.
+    ``canonical``: the parsed metadata stored with the link. ``resolution``:
+    the resolution that decided a ``pair``, else the default profile's
+    result. ``source``: which step named the text (log lines and the scan's
+    outcome detail). ``review``: ``ambiguous`` or ``untraced`` when the
+    default profile was ambiguous (the scan's Needs review lists).
+    ``try_recorded_run``: the scan tries the recorded run's stored prompt
+    when nothing else links. ``unlinked_status``: the scan status when
+    nothing links (None: no prompt metadata).
+    """
+
+    kind: str
+    text: Optional[str] = None
+    canonical: dict = field(default_factory=dict)
+    resolution: Optional[dict] = None
+    source: str = "none"
+    review: Optional[str] = None
+    try_recorded_run: bool = False
+    unlinked_status: Optional[str] = None
+
+
+@dataclass(frozen=True)
+class _File:
+    """The ladder's inputs beside the metadata."""
+
+    metadata: Mapping
+    canonical: dict
+    resolution: dict
+    review: Optional[str]
+    file_name: Optional[str]
+    in_output: bool
+    lookup: Optional[Callable[[], Any]]
+    policy: Policy
+
+
+def decide_file_prompt(
+    metadata: Any,
+    *,
+    file_name: Optional[str],
+    file_size: Union[None, int, Callable[[], Optional[int]]],
+    in_output: bool,
+    lookup: Optional[Callable[[], Any]],
+    policy: Policy,
+) -> Decision:
+    """The ladder for one file's raw ``metadata``.
+
+    ``prompt``/``workflow`` may be JSON strings (the scan) or parsed values
+    (the monitor). ``lookup`` returns the file's ``RecordedOutput`` or None;
+    it is None when history must not be asked yet. It is called at most
+    once, and only for a graph the default profile leaves undecided.
+    ``file_size`` may be a callable: it is read only for a file with prompt
+    metadata whose ``file_info`` has no size.
+    """
+    if not metadata:
+        return Decision(NEVER, try_recorded_run=True)
+    canonical = _parsed(metadata)
+    if metadata_opted_out(canonical):
+        # Save to library was off for the run's prompt: nothing is stored,
+        # no recorded-run fallback, no Needs review item (#90)
+        return Decision(NOT_SAVED, canonical=canonical)
+    if metadata_opted_out(canonical, unreadable=True):
+        # The switch is wired from a node the file cannot show: only the
+        # live run (the node saw the value) can link it
+        return Decision(NOT_SAVED_WIRED, canonical=canonical)
+    switched = _switched_off_upstream(canonical.get("prompt"))
+    if switched is not None:
+        # The #90 walk follows only prompt-like inputs; any input name
+        # upstream of a positive can carry a switched-off node's text
+        return Decision(switched, canonical=canonical)
+    if not canonical.get("prompt") and not canonical.get("parameters"):
+        return Decision(NEVER, canonical=canonical, try_recorded_run=True)
+    _with_size(canonical, file_size)
+    resolution = resolve_prompt_pair(canonical)
+    switched = (
+        _side_switch(canonical.get("prompt"), resolution["positive"])
+        if resolution["state"] == "resolved"
+        else None
+    )
+    if switched is not None:
+        # The positive passes a node that is off, though the #90 graph walk
+        # did not reach it (steps 5 and 7)
+        return Decision(switched, canonical=canonical)
+    if resolution["state"] == "resolved" and side_opted_out(
+        canonical.get("prompt"), resolution["negative"]
+    ):
+        # Only the negative's node is off: the positive alone, never a pair
+        positive = resolution["positive"]
+        text = positive.get("storage_text", positive["text"]).strip()
+        return _gated(
+            Decision(
+                POSITIVE,
+                text=text,
+                canonical=canonical,
+                resolution=resolution,
+                source="opted-out-negative",
+            ),
+            None,
+        )
+    if blank_positive(resolution):
+        # Only prepend/append text: no stored prompt can own it (#342)
+        resolution = {**resolution, "state": "unresolved"}
+    found = _File(
+        metadata,
+        canonical,
+        resolution,
+        _review(resolution),
+        file_name,
+        in_output,
+        lookup,
+        policy,
+    )
+    return _gated(_decide(found), found)
+
+
+def _decide(found: _File) -> Decision:
+    state = found.resolution["state"]
+    graph = found.canonical.get("prompt")
+    if state == "resolved":
+        positive = found.resolution["positive"]
+        text = positive.get("storage_text", positive["text"])
+        return _decision(found, PAIR, text, "resolver")
+    if graph and state in _UNDECIDED:
+        return _undecided_graph(found)
+    if state == "ambiguous":
+        return _never(found, _unlinked(found))
+    if state == "unresolved" and not isinstance(found.canonical.get("parameters"), str):
+        return _never(found, "unresolved")
+    if graph:
+        return _sampler_less(found, graph)
+    text = _a1111_positive(found.metadata)
+    if text is None:
+        return _never(found, "found")
+    return _decision(found, POSITIVE, text, "a1111")
+
+
+def _undecided_graph(found: _File) -> Decision:
+    recorded = found.lookup() if found.lookup is not None else None
+    saver = recorded.saver_id if recorded is not None else None
+    inspected = inspection_resolution(
+        found.metadata, found.file_name, saver, name_anchor=False
+    )
+    text = _inspected_text(inspected.resolution)
+    switched = (
+        _side_switch(found.canonical["prompt"], inspected.resolution["positive"])
+        if text is not None
+        else None
+    )
+    if switched is not None:
+        # The inspector follows pass-throughs the #90 graph walk does not
+        return Decision(switched, canonical=found.canonical)
+    if text is not None:
+        source = "recorded-run" if inspected.by_record else "inspector"
+        return _decision(found, POSITIVE, text, source)
+    if found.policy is Policy.MONITOR:
+        if found.lookup is None and found.in_output:
+            return _decision(found, HISTORY, None, "none")
+        if not inspected.malformed and inspected.resolution["state"] == "ambiguous":
+            return _never(found, _unlinked(found))
+    text = graph_prompt_text(found.metadata)
+    switched = _off_text(found.canonical["prompt"], text) if text else None
+    if switched is not None:
+        # The legacy answer is a switched-off node's own text (#90)
+        return Decision(switched, canonical=found.canonical)
+    if text is not None and _joined_text(found.canonical["prompt"], text):
+        # The legacy parser joins prepend + text + append: the text a
+        # PromptManager node stores cannot be told from it (#343).
+        return _never(found, _unlinked(found), try_recorded_run=True)
+    if text is not None:
+        return _decision(found, POSITIVE, text, "legacy-parser")
+    return _never(found, _unlinked(found), try_recorded_run=True)
+
+
+def _sampler_less(found: _File, graph: Any) -> Decision:
+    # No node takes a positive or negative input (a guider or wrapper graph):
+    # the one wired text, never a guess (#252).
+    wired = sampler_less_prompt(graph)
+    if wired["text"] is not None:
+        return _decision(found, POSITIVE, wired["text"], "sampler-less")
+    if isinstance(found.canonical.get("parameters"), str):
+        # A metadata saver also wrote A1111 text: its positive prompt.
+        text = _a1111_positive(found.metadata)
+        if text is not None:
+            return _decision(found, POSITIVE, text, "a1111")
+    status = "unresolved" if wired["state"] == "ambiguous" else "found"
+    return _never(found, status, try_recorded_run=True)
+
+
+_UNDECIDED_SOURCES = ("inspector", "recorded-run", "legacy-parser")
+
+
+def _switch_kind(settings: Any) -> Optional[str]:
+    """``not_saved`` when a setting is off, ``not_saved_wired`` when one is
+    unknowable (wired from a node the graph cannot read), else None."""
+    settings = list(settings)
+    if False in settings:
+        return NOT_SAVED
+    if None in settings:
+        return NOT_SAVED_WIRED
+    return None
+
+
+def _prompt_manager_ids(graph: Any) -> list:
+    if not isinstance(graph, dict):
+        return []
+    return [
+        str(node_id)
+        for node_id, node in graph.items()
+        if isinstance(node, dict) and node.get("class_type") in PROMPT_MANAGER_TYPES
+    ]
+
+
+def _side_switch(graph: Any, side: Any) -> Optional[str]:
+    """The switch outcome of the PromptManager nodes on a side's path."""
+    if not isinstance(graph, dict) or not side_opted_out(graph, side):
+        return None
+    provenance = side.get("provenance")
+    path = provenance.get("path") if isinstance(provenance, dict) else None
+    path = path if isinstance(path, list) else []
+    nodes = {str(step.get("node_id")) for step in path if isinstance(step, dict)} & set(
+        _prompt_manager_ids(graph)
+    )
+    return _switch_kind(save_setting(graph, node_id) for node_id in nodes)
+
+
+# Inputs that never carry prompt text or positive conditioning.
+_NOT_TEXT_INPUTS = frozenset(
+    {
+        "model",
+        "clip",
+        "vae",
+        "latent_image",
+        "samples",
+        "pixels",
+        "image",
+        "images",
+        "mask",
+        "noise",
+        "sigmas",
+        "sampler",
+        "control_net",
+        "upscale_model",
+    }
+)
+_MAX_SWITCH_VISITS = 5000
+
+
+def _negative_name(key: Any) -> bool:
+    """#90's negative rule, plus any name containing "negative"
+    (``negative2``, ``NegativePrompt``)."""
+    return is_negative_input(key) or "negative" in str(key).lower()
+
+
+def _switched_off_upstream(graph: Any) -> Optional[str]:
+    """The switch outcome of every PromptManager node upstream of a positive.
+
+    Follows every input except negative and non-text ones (#90's walk follows
+    only prompt-like names). A graph without a recognisable sampler checks
+    every PromptManager node, as #90 does.
+    """
+    if not isinstance(graph, dict):
+        return None
+    roots = _positive_roots(graph)
+    if not roots:
+        ids = _prompt_manager_ids(graph)
+        return _switch_kind(save_setting(graph, node_id) for node_id in ids)
+    seen, found = set(), set()
+    stack = [str(link[0]) for link in roots]
+    while stack and len(seen) < _MAX_SWITCH_VISITS:
+        node_id = stack.pop()
+        if node_id in seen:
+            continue
+        seen.add(node_id)
+        node = graph.get(node_id)
+        if not isinstance(node, dict):
+            continue
+        if node.get("class_type") in PROMPT_MANAGER_TYPES:
+            found.add(node_id)
+        inputs = node.get("inputs")
+        for key, value in (inputs.items() if isinstance(inputs, dict) else ()):
+            if key in _NOT_TEXT_INPUTS or _negative_name(key):
+                continue
+            if isinstance(value, (list, tuple)) and len(value) == 2:
+                if isinstance(value[0], (str, int)) and isinstance(value[1], int):
+                    stack.append(str(value[0]))
+    return _switch_kind(save_setting(graph, node_id) for node_id in found)
+
+
+def _off_text(graph: Any, text: str) -> Optional[str]:
+    """The switch outcome when ``text`` is the text (resolved, else literal)
+    of a PromptManager-family node whose Save to library is not on."""
+    wanted = text.strip()
+    matched = []
+    for node_id in _prompt_manager_ids(graph):
+        node_text = resolve_text(graph, node_id)
+        if node_text is None:
+            inputs = graph[node_id].get("inputs")
+            literal = inputs.get("text") if isinstance(inputs, dict) else None
+            node_text = literal if isinstance(literal, str) else None
+        if node_text is not None and node_text.strip() == wanted:
+            matched.append(save_setting(graph, node_id))
+    return _switch_kind(matched)
+
+
+def _joined_text(graph: Any, text: str) -> bool:
+    """Whether ``text`` may hold a PromptManager node's prepend or append.
+
+    True when a PromptManager-family node has a prepend or append part and
+    ``text`` is not the literal ``text`` of one such node (the legacy
+    parser's answer when it does not follow a linked part).
+    """
+    own = _prompt_manager_parts(graph)
+    return own is not None and text.strip() not in own
+
+
+def _prompt_manager_parts(graph: Any) -> Optional[set]:
+    """The literal texts of PromptManager-family nodes with a prepend or
+    append part, or None when no such node exists."""
+    if not isinstance(graph, dict):
+        return None
+    found = None
+    for node in graph.values():
+        if not isinstance(node, dict):
+            continue
+        name, inputs = node.get("class_type"), node.get("inputs")
+        if not isinstance(name, str) or "promptmanager" not in name.lower():
+            continue
+        if not isinstance(inputs, dict) or not _has_part(inputs):
+            continue
+        found = found if found is not None else set()
+        if isinstance(inputs.get("text"), str):
+            found.add(inputs["text"].strip())
+    return found
+
+
+def _has_part(inputs: dict) -> bool:
+    for key in ("prepend_text", "append_text"):
+        part = inputs.get(key)
+        if part is not None and not (isinstance(part, str) and not part.strip()):
+            return True
+    return False
+
+
+def _gated(decision: Decision, found: Optional[_File]) -> Decision:
+    """Junk text is never stored (step 13).
+
+    A junk answer of the undecided-graph step keeps that step's unlinked
+    status, so an ambiguous file is still a Needs review case; any other
+    step reports ``found``.
+    """
+    if decision.kind not in (PAIR, POSITIVE):
+        return decision
+    junk = junk_text(decision.text)
+    if junk is None:
+        return decision
+    return Decision(
+        NEVER,
+        canonical=decision.canonical,
+        resolution=decision.resolution,
+        source=f"junk:{junk}",
+        review=decision.review,
+        try_recorded_run=True,
+        unlinked_status=(
+            _unlinked(found)
+            if found is not None and decision.source in _UNDECIDED_SOURCES
+            else "found"
+        ),
+    )
+
+
+def _decision(found: _File, kind: str, text: Optional[str], source: str) -> Decision:
+    return Decision(
+        kind,
+        text=text,
+        canonical=found.canonical,
+        resolution=found.resolution,
+        source=source,
+        review=found.review,
+    )
+
+
+def _never(found: _File, status: str, *, try_recorded_run: bool = False) -> Decision:
+    return Decision(
+        NEVER,
+        canonical=found.canonical,
+        resolution=found.resolution,
+        review=found.review,
+        try_recorded_run=try_recorded_run,
+        unlinked_status=status,
+    )
+
+
+def _review(resolution: dict) -> Optional[str]:
+    if resolution["state"] != "ambiguous":
+        return None
+    return "ambiguous" if reviewable(resolution) else "untraced"
+
+
+def _unlinked(found: _File) -> str:
+    """Ambiguous without a choice is reported unresolved."""
+    if found.review == "untraced":
+        return "unresolved"
+    return found.resolution["state"]
+
+
+def _inspected_text(resolution: dict) -> Optional[str]:
+    """The storage text of a positive the inspector shows, else None."""
+    if resolution.get("state") in _UNDECIDED:
+        return None
+    positive = resolution.get("positive")
+    if not isinstance(positive, dict):
+        return None
+    text = positive.get("storage_text", positive.get("text"))
+    return text if isinstance(text, str) and text.strip() else None
+
+
+def _parsed(metadata: Mapping) -> dict:
+    canonical = dict(metadata)
+    for key in ("prompt", "workflow"):
+        if isinstance(canonical.get(key), str):
+            try:
+                canonical[key] = json.loads(canonical[key])
+            except (ValueError, TypeError):
+                # Preserve malformed metadata for conservative resolver rejection.
+                pass
+    return canonical
+
+
+def _with_size(canonical: dict, file_size: Any) -> None:
+    """Record the file's size in ``file_info`` unless the metadata carries one.
+
+    Stored as ``generated_images.file_size``; the "new" scan scope skips a
+    known file only while its size is unchanged.
+    """
+    info = canonical.get("file_info")
+    info = dict(info) if isinstance(info, dict) else {}
+    if info.get("size") is None:
+        size = file_size() if callable(file_size) else file_size
+        if size is not None:
+            info["size"] = size
+    if info:
+        canonical["file_info"] = info
+
+
+def _a1111_positive(metadata: Mapping) -> Optional[str]:
+    text = parse_comfyui_prompt(metadata)["positive_prompt"]
+    return text.strip() if text and text.strip() else None
+
+
+_LORA_TAG = re.compile(r"<lora:[^>]*>")
+_LORA_SEPARATORS = " \t\r\n\f\v,;|"
+_MODEL_FILE = re.compile(r"\S*\.(?:safetensors|ckpt|pt|pth|bin|gguf|sft)", re.I)
+
+
+def junk_text(text: Any) -> Optional[str]:
+    """The #252 junk class of ``text``, or None when it may be a prompt."""
+    stripped = text.strip() if isinstance(text, str) else ""
+    if not stripped:
+        return "blank"
+    if _numeric(stripped):
+        return "number"
+    if not _LORA_TAG.sub("", stripped).strip(_LORA_SEPARATORS):
+        return "lora-only"
+    if _MODEL_FILE.fullmatch(stripped):
+        return "model-file"
+    return None
+
+
+def graph_prompt_text(metadata: Mapping) -> Optional[str]:
+    """The positive prompt the browser parser traces from the graphs, or None.
+
+    Records parse as the legacy pages parsed them (NaN reads as null).
+    """
+    records = {}
+    for key in ("prompt", "workflow"):
+        value = metadata.get(key)
+        records[key] = parse_page_json(value) if isinstance(value, str) else value
+    try:
+        positive = extract_generation_params(records)["positivePrompt"]
+    except GenerationParamsError:
+        return None
+    if not isinstance(positive, str) or positive == PLACEHOLDERS["positivePrompt"]:
+        return None
+    return positive.strip() or None
+
+
+_COMMON_FIELDS = (
+    "positive",
+    "negative",
+    "steps",
+    "cfg",
+    "sampler",
+    "scheduler",
+    "seed",
+)
+
+
+def _json_or_raw(value: Any) -> Any:
+    if not isinstance(value, str):
+        return value
+    try:
+        return json.loads(value)
+    except json.JSONDecodeError:
+        return value
+
+
+def parse_comfyui_prompt(metadata: Mapping) -> dict:
+    """Parse ComfyUI and A1111 prompt data from metadata.
+
+    Accepts the file's strings or parsed values: a parsed ``prompt`` or
+    ``workflow`` is kept as it is and a non-string ``parameters`` is ignored.
+    """
+    result = {
+        "prompt": None,
+        "workflow": None,
+        "parameters": {},
+        "positive_prompt": None,
+        "negative_prompt": None,
+    }
+    params = metadata.get("parameters")
+    if isinstance(params, str):
+        _parse_a1111(params, result)
+    if result["positive_prompt"] is None:
+        for key in ("prompt", "workflow"):
+            if key in metadata:
+                result[key] = _json_or_raw(metadata[key])
+        for name in _COMMON_FIELDS:
+            if name in metadata:
+                result["parameters"][name] = _json_or_raw(metadata[name])
+    return result
+
+
+_SETTINGS_FIELDS = ("Steps", "Sampler", "Schedule type", "CFG scale", "Seed")
+
+
+def _parse_a1111(params: str, result: dict) -> None:
+    """A1111/Forge ``parameters``: a possibly multi-line positive, then a
+    "Negative prompt:" section, then a trailing "Steps: ..." settings line.
+    Taking the first line as the positive would truncate a multi-line prompt,
+    so the text is split on the settings line instead.
+    """
+    body = params
+    settings = ""
+    found = re.search(r"\nSteps:\s", body)
+    if found:
+        settings = body[found.start() + 1 :].strip()
+        body = body[: found.start()]
+    negative = None
+    found = re.search(r"(?im)^\s*negative prompt:\s*", body)
+    if found:
+        negative = body[found.end() :].strip()
+        body = body[: found.start()]
+    elif body.lower().lstrip().startswith("negative prompt:"):
+        negative = body.lower().lstrip()[len("negative prompt:") :].strip()
+        body = ""
+    result["positive_prompt"] = body.strip() or None
+    if negative:
+        result["negative_prompt"] = negative
+    result["parameters"]["parameters"] = params
+    for name in _SETTINGS_FIELDS if settings else ():
+        found = re.search(
+            r"(?i)(?:^|,\s*)" + re.escape(name) + r":\s*([^,]+)", settings
+        )
+        if found:
+            key = name.lower().replace(" ", "_")
+            result["parameters"][key] = found.group(1).strip()