Merge remote-tracking branch 'origin/main' into feat/330-s13-pr3

ci: full matrix once per PR in the merge queue; Windows/macOS non-blocking (#420 ) (#421 )
* ci: run the full matrix once per PR, in the merge queue (#420) Pull requests now run a fast subset: Python 3.12 on ubuntu-latest, the coverage gate, black/flake8, frontend modules, bandit and the Chromium/touch frontend coverage shards plus merge. The merge queue, pushes to main and manual runs keep the full matrix: Linux/Windows/macOS x Python 3.12-3.14, real ComfyUI compatibility and the Firefox/WebKit page workflows. A dropped matrix leg never reports a check, so the new required "all tests" gate requires every test.yml job to succeed outside pull requests and real ComfyUI to be skipped only on pull requests; viewerjs does the same for the browser shards. branch-protection.json drops the eight legs a pull request no longer runs and adds "all tests". * docs(ci): ruleset edit keeps every rule and integration id; find merge-queue runs * ci: move Windows and macOS out of the blocking path (#420) The maintainer deferred Windows and macOS to the end of the redesign. The merge queue now runs Linux on Python 3.12-3.14, real ComfyUI, the frontend coverage shards and the Firefox/WebKit page workflows; pull requests keep the Linux 3.12 subset. The six Windows/macOS legs move to the new portability.yml, which runs on push to main, nightly and on demand, keeps the 27-minute limit and is never a required check. Red runs there are fixed at their cause before the cutover (#334). * docs(ci): required checks live in the ruleset and the classic protection (#420)
2026-10-28 06:01:30 -07:00 · 2026-10-28 12:44:06 +00:00 · 2026-10-28 05:05:10 -07:00 · 2026-10-28 11:25:20 +00:00 · 2026-10-28 04:17:38 -07:00 · 2026-10-28 10:15:28 +00:00
29 changed files with 1560 additions and 2625 deletions
@@ -3,17 +3,10 @@
    "strict": false,
    "contexts": [
      "py3.12 on ubuntu-latest",
-      "py3.13 on ubuntu-latest",
-      "py3.14 on ubuntu-latest",
-      "py3.12 on windows-latest",
-      "py3.13 on windows-latest",
-      "py3.14 on windows-latest",
-      "py3.12 on macos-latest",
-      "py3.13 on macos-latest",
-      "py3.14 on macos-latest",
      "coverage gate (85%)",
      "black and flake8",
      "frontend modules",
+      "all tests",
      "viewerjs",
      "real ComfyUI compatibility",
      "bandit (high severity)"
@@ -0,0 +1,55 @@
+name: Windows and macOS
+
+permissions:
+  contents: read
+
+# Non-blocking portability runs (#420): never on pull requests or in the merge queue, and no context
+# here is a required check. A red run is fixed at its cause before the workspace cutover (#334).
+on:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "17 3 * * *"
+  workflow_dispatch:
+
+# Every run gets its own group (run_id), so no main commit's run is ever cancelled or dropped as pending.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.run_id }}
+  cancel-in-progress: false
+
+env:
+  PYTHONFAULTHANDLER: "1"
+
+# Time limit rule as in test.yml: ceil(1.5 x the slowest of three recent green runs on main) + 3
+# minutes, never under 5. Measured 2026-10-26 in test.yml on runs 40257217681 (3be0ada),
+# 40240706568 (fb9134f), 40228167328 (f9835aa), before these legs moved here in #420:
+#   slowest py3.10 on windows-latest: 12m43s / 15m54s / 14m53s -> 27 min
+#     (macos 6m14s-8m30s, windows 11m42s-15m54s)
+jobs:
+  test:
+    name: py${{ matrix.python-version }} on ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 27
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-latest, macos-latest]
+        python-version: ["3.12", "3.13", "3.14"]
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v7
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+          cache-dependency-path: requirements-dev.txt
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements-dev.txt
+
+      - name: Run tests
+        run: python -m tests.run_suite -v
@@ -28,10 +28,18 @@ env:
 #   py matrix, slowest py3.10 on windows-latest: 12m43s / 15m54s / 14m53s -> 27 min
 #     (ubuntu 5m27s-6m27s, macos 6m14s-8m30s, windows 11m42s-15m54s)
 #     3.10 and 3.11 left the matrix and 3.14 joined it in #356; re-measure after three green main runs.
+#     Windows and macOS moved to portability.yml (#420), which keeps this 27-minute limit; this
+#     Linux-only matrix keeps it too until it is re-measured.
 #   real ComfyUI compatibility: 13m32s / 8m55s / 11m46s -> 24 min
 #   coverage gate (85%): 7m26s / 7m22s / 7m54s -> 15 min
 #   perf budget 30s / 29s / 27s, black and flake8 39s / 37s / 39s,
 #   frontend modules 23s / 19s / 29s -> 5 min (the floor)
+#   all tests: a result check without setup, 5 min (the floor)
+#
+# Pull requests run a fast subset (#420): Python 3.12 on ubuntu-latest, coverage, lint and frontend
+# modules. The merge queue (merge_group), pushes to main and manual runs add Python 3.13 and 3.14 on
+# Linux and the real ComfyUI job. "all tests" is the required gate that holds the queue to that set.
+# Windows and macOS run in portability.yml (push to main, nightly, on demand) and never gate a merge.
 jobs:
  test:
    name: py${{ matrix.python-version }} on ${{ matrix.os }}
@@ -40,8 +48,8 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
-        python-version: ["3.12", "3.13", "3.14"]
+        os: [ubuntu-latest]
+        python-version: ${{ github.event_name == 'pull_request' && fromJSON('["3.12"]') || fromJSON('["3.12", "3.13", "3.14"]') }}

    steps:
      - uses: actions/checkout@v7
@@ -63,6 +71,9 @@ jobs:

  comfyui:
    name: real ComfyUI compatibility
+    # Merge queue, main and manual runs only. A job skipped by its condition reports Success, so this
+    # required context never blocks a pull request; "all tests" fails if it is skipped anywhere else.
+    if: github.event_name != 'pull_request'
    runs-on: ubuntu-latest
    # Chromium and its system libraries come from the pinned Playwright image (tag = @playwright/test in
    # tools/vendor/package-lock.json; tests/vendor/browser-image.test.mjs checks it). The runner install
@@ -253,3 +264,32 @@ jobs:

      - name: Run JS tests
        run: node --test tests/js/*.test.js
+
+  # The required context "all tests". A dropped matrix leg never reports a check at all, so the eight
+  # legs that pull requests skip cannot be required by name; this gate requires them instead. Every
+  # job must succeed; real ComfyUI must be skipped on a pull request and succeed on every other event.
+  all-tests:
+    name: all tests
+    needs: [test, comfyui, coverage, lint, js-test]
+    if: always()
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Require every test job for this event
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          TEST_RESULT: ${{ needs.test.result }}
+          COMFYUI_RESULT: ${{ needs.comfyui.result }}
+          COVERAGE_RESULT: ${{ needs.coverage.result }}
+          LINT_RESULT: ${{ needs.lint.result }}
+          JS_RESULT: ${{ needs.js-test.result }}
+        run: |
+          queue_only=success
+          if [ "$EVENT_NAME" = pull_request ]; then queue_only=skipped; fi
+          echo "event: $EVENT_NAME (real ComfyUI must be $queue_only)"
+          echo "test matrix: $TEST_RESULT"
+          echo "comfyui: $COMFYUI_RESULT"
+          echo "coverage: $COVERAGE_RESULT"
+          echo "lint: $LINT_RESULT"
+          echo "js-test: $JS_RESULT"
+          test "$TEST_RESULT" = success && test "$COVERAGE_RESULT" = success && test "$LINT_RESULT" = success && test "$JS_RESULT" = success && test "$COMFYUI_RESULT" = "$queue_only"
@@ -165,6 +165,8 @@ jobs:

  browser-workflows:
    name: page workflows (${{ matrix.browser }}, shard ${{ matrix.shard }}/2)
+    # Merge queue, main and manual runs only (#420); pull requests run the Chromium/touch coverage shards.
+    if: github.event_name != 'pull_request'
    runs-on: ubuntu-latest
    # Layout comparisons depend on the fonts each browser falls back to, so browser jobs run in the
    # same pinned Playwright image as local runs (tag = @playwright/test in tools/vendor/package-lock.json;
@@ -219,8 +221,9 @@ jobs:
          retention-days: 14

  # Branch protection requires the exact context "viewerjs". This job keeps that
-  # name and fails unless every frontend job above succeeded (every shard, the
-  # coverage merge and every browser shard), including when one was cancelled or skipped.
+  # name and fails unless every coverage shard and the coverage merge succeeded and
+  # the browser shards succeeded, or, on a pull request only, were skipped (#420).
+  # Any failure, cancellation or other skip fails it.
  viewerjs:
    needs: [frontend-coverage, frontend-coverage-merge, browser-workflows]
    if: always()
@@ -229,11 +232,15 @@ jobs:
    steps:
      - name: Require every frontend job to succeed
        env:
+          EVENT_NAME: ${{ github.event_name }}
          COVERAGE_RESULT: ${{ needs.frontend-coverage.result }}
          MERGE_RESULT: ${{ needs.frontend-coverage-merge.result }}
          WORKFLOWS_RESULT: ${{ needs.browser-workflows.result }}
        run: |
+          queue_only=success
+          if [ "$EVENT_NAME" = pull_request ]; then queue_only=skipped; fi
+          echo "event: $EVENT_NAME (browser-workflows must be $queue_only)"
          echo "frontend-coverage: $COVERAGE_RESULT"
          echo "frontend-coverage-merge: $MERGE_RESULT"
          echo "browser-workflows: $WORKFLOWS_RESULT"
-          test "$COVERAGE_RESULT" = success && test "$MERGE_RESULT" = success && test "$WORKFLOWS_RESULT" = success
+          test "$COVERAGE_RESULT" = success && test "$MERGE_RESULT" = success && test "$WORKFLOWS_RESULT" = "$queue_only"
@@ -56,7 +56,7 @@ Both nodes include the complete PromptManager feature set:
 - **📊 Analytics**: Track prompt usage patterns and effectiveness over time
 - **🔬 Workflow Analysis**: Extract and analyze ComfyUI workflow data from PNG images
 - **📋 Metadata Viewer**: Standalone tool for analyzing ComfyUI-generated images
- **🛠️ System Management**: Built-in diagnostics, backup/restore, and maintenance tools
+- **🛠️ System Management**: Built-in diagnostics, backup/restore, and maintenance tools in System
 - **🏷️ AI AutoTag**: Automatically tag your image collection using WD14 or JoyCaption vision models
 - **🔗 LoRA Manager Integration**: Import LoRA metadata and preview images from [ComfyUI-Lora-Manager](https://github.com/willmiao/ComfyUI-Lora-Manager)

@@ -206,14 +206,11 @@ match Classic and Focused.
 - **Responsive Design**: Works on desktop, tablet, and mobile devices
 - **Real-time Search**: Instant search results as you type
 - **Bulk Operations**: Edit multiple prompts simultaneously with batch tools
- **Settings Panel**: Configure behavior and display options
- **System Management**: Complete toolset for database operations:
+- **Settings and System tools live in System**: the dashboard's **Settings** opens System › Overview, **Maintenance** opens System › Maintenance, **Backup DB** and **Restore DB** open System › Backup & export, and **Diagnostics** and **View Logs** open System › Diagnostics & logs, each in a new tab. System reviews every destructive operation before it runs it as an Activity job.
+- **Page options**: the list header's **Page options** keeps the prompt list's Infinite Scrolling default
+- **Dashboard tools**:
  - **🔍 Metadata Viewer**: Launch standalone PNG analysis tool
-  - **📸 Scan Images**: Bulk scan output directories for ComfyUI images
-  - **💾 Backup/Restore**: Database backup and recovery operations
-  - **🔧 Maintenance**: Database optimization and cleanup tools including orphaned prompt removal
-  - **📋 Logs**: Comprehensive logging system with download capability
-  - **🔍 Diagnostics**: System health checks and troubleshooting
+  - **📸 Scan Images**: Bulk scan output directories for ComfyUI images (with a quick backup first)
 - **Export Tools**: Download prompts and metadata in various formats
 - **Progress Tracking**: Real-time progress indicators for long operations
 - **Error Handling**: Graceful error display with recovery suggestions
@@ -333,14 +330,11 @@ The comprehensive gallery system provides complete access to all your ComfyUI ou

 #### **⚙️ Gallery Settings**

-Configure your viewing experience in the settings panel:
+The gallery's **Settings** opens System › Appearance in a new tab: image quality, details on cards, collapsed viewer details, video autoplay/mute/loop, metadata loading and file paths are set there and apply to this page too.

- **Display Settings**: Default view, items per page, grid columns, media info, infinite scrolling
- **Performance Settings**: Image quality, lazy loading
- **Video Settings**: Autoplay, mute by default, loop videos
- **Thumbnail Management**: Generate optimized thumbnails for faster loading (runs on the configured worker threads; a run that stops at the per-run cap tells you how many remain)
- **Find Duplicate Images**: Hashes every file on the worker threads with a progress bar; close the window and it keeps running, results wait in a pill
- **Rescan Output Folder**: Drops the server-side listing cache and rewalks the folders
+The gallery's **Page options** keep the page's own settings: the thumbnail check at startup, lazy loading, items per page, grid columns, infinite scrolling, debug mode and API timeout. Reset puts back only these.
+
+Thumbnail generation, the server thumbnail and browser cache clears, refreshing the file listing and finding duplicate images are in System › Sources & scans and System › Maintenance (Page options links both); each runs as an Activity job you can follow after closing the page.

 #### **🖼️ Image Viewing Experience**

@@ -398,7 +392,7 @@ Import existing ComfyUI images into your database:
   - Any errors or issues encountered
 5. **Access imported data** through the normal gallery interface

-The scan reads PNG text chunks and A1111-style parameters, and, when `ffprobe` is installed, the prompt ComfyUI's video savers embed in MP4/MOV/WebM files. Files are read on the number of **worker threads** set in Settings → Performance (default: half your cores), which makes a large library several times faster.
+The scan reads PNG text chunks and A1111-style parameters, and, when `ffprobe` is installed, the prompt ComfyUI's video savers embed in MP4/MOV/WebM files. Files are read on the number of **worker threads** set in System › Sources & scans (default: half your cores), which makes a large library several times faster.

 ### 🏷️ AI AutoTag

@@ -414,7 +408,7 @@ Automatically tag your entire image collection using AI vision models:

 1. **AutoTag (Batch Mode)**: Tag your entire collection automatically
   - Click **"🏷️ AutoTag"** in the admin dashboard
-   - Choose your model type (FP16 or GGUF)
+   - Choose your model type (FP16 or GGUF). A model that is not downloaded yet shows **Manage in System**: download (or unload) it in System › Auto-tagging, then reopen the dialog
   - Select how to handle already-tagged images:
     - **Skip images with existing tags**: Preserve your meticulous manual tagging work
     - **Re-tag all images**: Overwrite existing tags with fresh AI analysis
@@ -445,7 +439,7 @@ Adjust the system prompt to match your tagging style:
 #### **Requirements**

 - Sufficient VRAM for the chosen model (FP16 requires more, GGUF is lighter)
- Models are downloaded automatically on first use
+- Models are downloaded in System › Auto-tagging
 - Feature requests and improvements are welcome!

 ### 📁 Folder Filter
@@ -470,18 +464,18 @@ If you use [ComfyUI-Lora-Manager](https://github.com/willmiao/ComfyUI-Lora-Manag

 #### **Enabling the Integration**

-1. Open the admin dashboard and click **Settings**
-2. Scroll to the **Integrations** section — PromptManager will auto-detect if LoRA Manager is installed
+1. Open System › Integrations (the admin dashboard's **Settings** opens System)
+2. PromptManager auto-detects whether LoRA Manager is installed

 ![LoRA Enabled](images/pm-lora-enabled.png)

 3. Toggle the **LoraManager** switch to enable
 4. Optionally enable **Auto-inject trigger words** to automatically append LoRA trigger words when `<lora:name:weight>` is detected in your prompts
-5. Click **Save Settings** (requires a ComfyUI restart to take effect)
+5. Click **Save preferences** (requires a ComfyUI restart to take effect)

 #### **Importing LoRA Data**

-Click **Import LoRA Data** in the settings panel to start the import. A progress popup shows real-time status as each LoRA is processed:
+Click **Review import** in System › Integrations; Start runs the import as an Activity job:

 - Reads LoRA Manager's own settings the way LoRA Manager does: from the folder in `LORA_MANAGER_SETTINGS_DIR`, from the plugin's `settings.json` in portable mode, or from your user config folder, and only the keys that say where its files are
 - Finds each LoRA's metadata in both storage modes: beside the model (the default) or in the central sidecar folder, and imports only LoRAs whose model file still exists in a LoRA folder (the review says how many metadata files it skipped)
@@ -502,7 +496,7 @@ A CivitAI API key is **required if your library contains NSFW LoRAs** — CivitA

 To add your key:
 1. Get your API key from [civitai.com/user/account](https://civitai.com/user/account)
-2. Paste it into the **CivitAI API Key** field in the Integrations settings
+2. Paste it into the **CivitAI API key** field in System › Integrations
 3. Save and re-import to download any previously skipped images

 The key is sent only over HTTPS to CivitAI's own hosts. CivitAI serves images through a redirect to its storage host; PromptManager follows such a redirect only over HTTPS to a host on CivitAI's own `civitai.com`, `civitai.red` or `civitai.green` domains, at most three hops, and never sends the key with it. When downloads fail, the import's status line says how many; when none could be downloaded, it starts with a warning. The server log has one warning per failed image with the reason (HTTP status, refused redirect, size cap, unreadable image, timeout or network error).
@@ -517,23 +511,20 @@ The comprehensive web interface provides:
 - **Filter Options**: Filter by category, tags, rating, and date
 - **Bulk Operations**: Select multiple prompts for batch editing
 - **Export Tools**: Download your prompt collection
- **Settings Panel**: Configure auto-save and display options
- **Diagnostics**: System health checks and troubleshooting
+- **Settings**: System (new tab) for settings, maintenance, backups and diagnostics; **Page options** for the page's own display settings

 ### 🔧 Database Maintenance

-Keep your database optimized with built-in maintenance tools:
+Keep your database optimized in System › Maintenance (the admin dashboard's **Maintenance** opens it in a new tab):

-1. **Open the admin dashboard** and click **"🔧 Maintenance"**
-2. **Select maintenance operations**:
-   - **Remove Duplicates**: Find and merge duplicate prompts while preserving images
-   - **Vacuum Database**: Optimize database file size and performance
-   - **Clean Orphaned Images**: Remove image records for missing files
-   - **🚮 Prune Orphaned Prompts**: Remove prompts that have no linked images
-   - **Check Consistency**: Verify database integrity and relationships
-   - **Database Statistics**: Generate detailed database reports
-3. **Run selected operations** and monitor progress in real-time
-4. **Review results** showing detailed information about each operation
+- **Duplicate prompt text**: merge duplicate prompts while preserving images
+- **Optimize database**: reclaim unused SQLite space
+- **Missing-file links**: remove image records for missing files
+- **Unused prompt components**: remove prompts nothing uses
+- **Run health checks**: verify database integrity and relationships (the Health report)
+- **Database size and prompt counts**: System › Diagnostics & logs (Database) and the Overview's Statistics
+
+Each operation opens a review that shows what it will change and the safety backup it takes, then runs as an Activity job.

 ### Database Location

@@ -835,8 +826,8 @@ Before upgrading or changing this setting:
 1. Identify the database your current installation actually uses and confirm its
   library contents. Check both the configured path and the prior fallback
   `<extension>/prompts.db`; keep track of which existing file you intend to use.
-2. Preserve a consistent backup of the active database with the dashboard's
-   Backup/Restore backup action or SQLite's online backup API. Do not copy only
+2. Preserve a consistent backup of the active database with
+   System › Backup & export's Back up or SQLite's online backup API. Do not copy only
   the main file of a live SQLite database: committed data may still be in its
   `-wal` file. For a filesystem copy, stop ComfyUI cleanly first and preserve any
   remaining `-wal` file together with the main database.
@@ -181,10 +181,12 @@ check, so run it before pushing a new or deleted frontend file instead of
 waiting for the `frontend coverage` jobs.

 The `viewerjs` check runs on every PR, including backend-only changes. It is an
-aggregate job that passes only when every frontend job succeeds: the three
-`frontend coverage (shard N/3)` jobs, `frontend coverage (merge)`, and the four
-`page workflows (firefox|webkit, shard N/2)` jobs. A failed, cancelled or skipped
-job fails it. Every browser job runs with `PM_TEST_WORKERS: 3` (the public
+aggregate job. It requires the three `frontend coverage (shard N/3)` jobs and
+`frontend coverage (merge)` to succeed on every event. The four
+`page workflows (firefox|webkit, shard N/2)` jobs run only in the merge queue,
+on `main` and on `workflow_dispatch` (see "Pull requests and the merge queue").
+`viewerjs` requires them to be skipped on a pull request and to succeed
+everywhere else. Any other failed, cancelled or skipped job fails it. Every browser job runs with `PM_TEST_WORKERS: 3` (the public
 runners have 4 vCPUs). Each coverage shard runs `test:coverage:shard -- N/3`
 (shard 1 also runs the node units and the viewer suite, shard 3 the vendor pins
 and tooling tests) and uploads its raw V8 files as `coverage-raw-N` (kept 3
@@ -271,6 +273,13 @@ gh run view <run id> --json jobs                          # shows a job that alr
 gh run view --job <job id> --log-failed                   # that job's failed log, at once
 ```

+Python 3.13/3.14, real ComfyUI and Firefox/WebKit failures first show up in the
+merge queue, on the merge-group commit rather than the
+pushed one. Find that run with `gh run list --event merge_group --workflow test.yml`
+(or `viewerjs-check.yml`) and match its head branch
+(`gh-readonly-queue/main/pr-<N>-...`). Windows and macOS failures show up only
+after the merge, in `gh run list --workflow portability.yml`.
+
 Start fixing as soon as a failed log shows the cause, but push the fix only after
 the run for that commit has finished: pull-request runs use `cancel-in-progress`,
 so a push cancels the running jobs and can hide a second failure.
@@ -313,6 +322,26 @@ from the tests' package unload (`cleanup_package`), and it removes its own
 ComfyUI-Manager restart through `os.execv`, a closed Windows console, or
 ComfyUI Desktop stopping its server. SQLite's WAL journal covers those.

+Jobs running at exit (#376): before any `atexit` callback, Python joins every
+executor thread (`concurrent.futures` registers that join with
+`threading._register_atexit`). The package registers its own callback there
+(`utils/exit_signal.install`, after `concurrent.futures`, so it runs first):
+it sets the exit signal and kills the running encoder processes
+(`shutdown_encoders`, the ffmpeg that never sees Ctrl+C on Windows). The call in
+flight then stops at its next safe point: `Job.cancelled` is True, so every
+check a job already makes between files stops it, `map_parallel` starts no
+further item (`ExitRequested`), the scan walk stops between folders, LoRA
+import staging stops before its next sidecar (also for the legacy scan) and a
+tagging model download stops before its next chunk where huggingface_hub takes
+`tqdm_class` (1.x removes its temp file; 0.x `hf_hub_download` does not take it
+and finishes the file). Xet transfers ignore that checkpoint, so the hook also
+calls hub's own `abort_xet_session` when huggingface_hub is loaded. The
+trigger-word cache load (small JSON sidecars) has no checkpoint. No check sits
+inside a library write. That hook is
+CPython-internal; without it (or when it is refused) `install` returns False and
+exit waits for the call in flight, as before. `tests/test_exit_cancel.py` runs a
+child process with three such calls running and requires its exit within 15 s.
+
 Stop contract: `PromptTracker.shutdown(timeout)`,
 `ImageGenerationHandler.shutdown(timeout)` (restartable),
 `ImageGenerationHandler.close(timeout)` (final: `schedule()` refuses and a
@@ -519,29 +548,95 @@ Before changing paths, SQLite, streams, restore or cleanup:
  open with `FirstWriterHold`) and give peers that must all succeed the
  ordinary busy timeout; cross-thread handoffs wait on events with generous
  ceilings, never a short wall clock (#242).
- Run native Windows CI early for these changes and include a Windows impact and
-  evidence note in the PR. All twelve OS/Python combinations and every applicable
+- Run native Windows CI early for these changes. Pull requests and the merge
+  queue run only Linux, so start Windows and macOS on the branch with
+  `gh workflow run portability.yml --ref <branch>`.
+  Include a Windows impact and evidence note in the PR. All six Windows/macOS
+  combinations in that run, every Linux leg and every applicable
  exact-head check must pass before merge. Portable `ntpath`/`PureWindowsPath`
  controls do not establish native filesystem, locking or cleanup success.

+## Pull requests and the merge queue
+
+Each PR runs the full matrix once, in the merge queue (#420). The event decides
+what runs:
+
+| Job | `pull_request` | `merge_group`, push to `main`, `workflow_dispatch` |
+| --- | --- | --- |
+| `py3.12 on ubuntu-latest` | runs | runs |
+| `py3.13 on ubuntu-latest`, `py3.14 on ubuntu-latest` | not created | run |
+| `real ComfyUI compatibility` | skipped | runs |
+| `coverage gate (85%)`, `black and flake8`, `frontend modules`, `bandit (high severity)` | run | run |
+| `frontend coverage (shard N/3)`, `frontend coverage (merge)` (vendor pins and tooling tests on shard 3) | run | run |
+| `page workflows (firefox\|webkit, shard N/2)` | skipped | run |
+| `all tests`, `viewerjs` (gates) | run | run |
+| `perf budget` | skipped | push and dispatch only (not in the queue) |
+| `py3.12-3.14 on windows-latest/macos-latest` (`portability.yml`) | not run | push to `main`, nightly, `workflow_dispatch` only; never required |
+
+GitHub has one required set for pull requests and the queue. A job skipped by
+its `if:` reports Success. A dropped matrix leg never reports, so it would stay
+pending. That is why `all tests` (in `test.yml`) and `viewerjs` carry the
+guarantee:
+- On a pull request they require the subset to succeed and the queue-only jobs
+  to be skipped.
+- On every other event they require every job to succeed.
+
+So a merge group cannot turn green unless all three Linux Python legs, real
+ComfyUI and the four browser shards passed.
+
+Windows and macOS (Python 3.12-3.14) are out of the blocking path for now
+(maintainer, 2026-10-28). They run in `portability.yml` on every push to `main`,
+nightly and on demand, and no context there is required. A red portability run
+is still a failure: fix it at its cause, not by rerunning, and have every one
+green before the workspace cutover (#334). `tests/vendor/ci-workflow.test.mjs` pins the
+event split and runs both gate scripts for each event.
+
 ## Required merge checks

-`.github/branch-protection.json` records the required checks: all twelve Python/OS
-combinations, Python coverage, formatting, frontend modules, `viewerjs`, `real ComfyUI compatibility`,
-and `bandit (high severity)`.
-The branch must be current with main, and administrators follow the same checks.
+`.github/branch-protection.json` records the required checks:
+`py3.12 on ubuntu-latest`, `coverage gate (85%)`, `black and flake8`,
+`frontend modules`, `all tests`, `viewerjs`, `real ComfyUI compatibility` and
+`bandit (high severity)`. Each one reports on a pull request.
+The same set lives in two places, and both must change together: the `main`
+ruleset (25960526, which also holds the merge queue) and the classic branch
+protection on `main`, which the manifest mirrors. GitHub requires the union of
+the two, so a context left in either one blocks every PR that does not report it.
 It does not require an additional human approval.

 A repository administrator applies the configuration after the new workflow is
 passing, then verifies it:

+```sh
+gh api repos/ComfyAssets/ComfyUI_PromptManager/rulesets/25960526 \
+  | jq '.rules[] | select(.type == "required_status_checks") | [.parameters.required_status_checks[].context]'
+```
+
+A PUT replaces the whole `rules` array, so edit the current ruleset in place.
+Keep the `deletion`, `non_fast_forward` and `merge_queue` rules, and give every
+context `integration_id` 15368 (GitHub Actions), so no other integration can
+post a required check. Save the current ruleset first; it is the rollback:
+
+```sh
+gh api repos/ComfyAssets/ComfyUI_PromptManager/rulesets/25960526 > ruleset-before.json
+jq '{name, target, enforcement, conditions, bypass_actors, rules: [.rules[]
+     | if .type == "required_status_checks"
+       then .parameters.required_status_checks = [$ARGS.positional[] | {context: ., integration_id: 15368}]
+       else . end]}' ruleset-before.json --args "py3.12 on ubuntu-latest" "..." > ruleset-new.json
+gh api --method PUT repos/ComfyAssets/ComfyUI_PromptManager/rulesets/25960526 --input ruleset-new.json
+```
+
+Afterwards, read it back. Check that the `merge_queue` rule is still there and
+that every context keeps its `integration_id`. Then apply the manifest to the
+classic protection and read both back:
+
 ```sh
 gh api --method PUT repos/ComfyAssets/ComfyUI_PromptManager/branches/main/protection \
  --input .github/branch-protection.json
 gh api repos/ComfyAssets/ComfyUI_PromptManager/branches/main/protection/required_status_checks
+gh api repos/ComfyAssets/ComfyUI_PromptManager/rules/branches/main
 ```
-
-Update the manifest whenever required job names change. Keep the frontend check
+ Update the manifest whenever
+required job names change. Keep the frontend check
 free of path filters so a required check is never silently skipped.

 ## Unified workspace
@@ -2439,6 +2534,14 @@ production hub `#/overview` is unchanged (D28); its System card opens
 the pressed section button and disposes the previous section's scope, so its reads,
 listeners and dialogs never outlive it.

+System is the home for settings and maintenance (#330 System S13). The legacy pages keep
+their prompt list, tags, Scan Images, auto-tag batch and review and gallery browsing; their
+Settings, Diagnostics, View Logs, Maintenance, Backup DB, Restore DB, the gallery's
+thumbnail, cache, rescan and duplicate tools and the auto-tag model downloads open the
+System section that owns them in a new tab (`legacy-system-links.spec.mjs`). Each page
+keeps only its own settings in Page options. What left the legacy pages is listed in
+"Legacy System UI removed by S13".
+
 Drafts (`system-state.mjs`) live for the page session (Q10). Save writes the dirty
 browser fields, then the host fields (`POST /prompt_manager/settings` with
 `expected_revision`, #220), then the runtime fields. A failed domain keeps its drafts and
@@ -4053,6 +4156,9 @@ auto-tag / review", which the Images selection bar owns, not a System section. A
 is not `covered` names none (`—`). Test is the exact title of a test that runs, then its
 file. Anchors are line numbers on `main` at this PR.

+S13 (#330) removed the legacy copy of the `covered` rows the legacy pages linked to System;
+"Legacy System UI removed by S13" below lists every removed element against its row.
+
 `tests/vendor/legacy-coverage.test.mjs` fails on a row with any of these problems:
 - no owner, or a status outside the three;
 - a malformed Native control cell;
@@ -4133,7 +4239,11 @@ opens `workspace#/system/<id>` in a new tab) and removes the legacy copy of a ca
 only when its row above is `covered`. One row per removed capability: Capability is the
 exact Capability cell of its coverage row, Page is `admin` or `gallery`, Removed ids and
 Removed methods list what went (`—` for none), and Native test copies that row's Test
-cell. An id that stays on a System link is not listed, only its handler.
+cell. An id that stays on a System link is not listed, only its handler. The gallery's
+Default View Mode left Page options too: System › Appearance's Default layout is the one
+default-layout control. Nothing writes the legacy `defaultViewMode` any more; a stored
+value still picks the view the legacy gallery opens in (grid otherwise), and Page options
+Save and Reset keep it.

 `tests/vendor/legacy-coverage.test.mjs` fails when a row cites a capability that is not
 `covered` or copies another test, when an id or method is listed twice for one page, or
@@ -4152,6 +4262,31 @@ legacy page workflows), not by this check.
 | Log files list and download | admin | `#downloadLogsBtn`, `#logFilesList` | `loadLogFiles()`, `downloadLogs()`, `downloadLogFile()` | each listed file downloads by its returned name and a link has no Download (workspace-system-diagnostics.spec.mjs) |
 | Clear/truncate logs | admin | `#clearLogsBtn` | `clearLogs()` | Clear all logs states both counts, confirms first and reads everything again (workspace-system-diagnostics.spec.mjs) |
 | Set log level (incl. CRITICAL), console logging | admin | `#updateLogConfigBtn`, `#setLogLevel`, `#consoleLogging` | `loadLogConfig()`, `updateLogConfig()` | runtime level (including CRITICAL) and console logging save and say they apply until the server restarts (workspace-system-diagnostics.spec.mjs) |
+| Image scan directories add/remove | admin | `#scanPathsList`, `#addScanPathBtn` | `renderScanPaths()`, `addScanPath()`, `removeScanPath()`, `_collectScanPaths()` | Add source validates on the server, then marks the host draft dirty; Save persists (workspace-system-sources.spec.mjs) |
+| Currently monitoring list + Refresh | admin | `#refreshMonitoringStatus`, `#monitoringStatus` | `updateMonitoringStatus()` | watching only with a live observer; restart pending otherwise (workspace-system-sources.spec.mjs) |
+| Search results auto-hide `result_timeout` | admin | `#resultTimeout` | — | host fields round-trip through /settings with revision (workspace-system.spec.mjs) |
+| Web UI display mode | admin | `#webuiDisplayMode` | — | host fields round-trip through /settings with revision (workspace-system.spec.mjs) |
+| Worker threads | admin | `#workerThreads`, `#workerThreadsValue` | `renderWorkerThreads()` | worker range max is cpu_count (workspace-system-sources.spec.mjs) |
+| LoraManager badge, enable, path, trigger words, CivitAI key, clear key | admin | `#loraDetectionBadge`, `#loraEnabled`, `#loraSettings`, `#loraManagerPath`, `#loraTriggerWords`, `#civitaiApiKey`, `#clearCivitaiKey` | `detectLoraManager()`, `_bindLoraEvents()`, `saveLoraSettings()` | LoRA rows show detected / enabled / cache-loaded separately (workspace-system-integrations.spec.mjs) |
+| LoRA data import with progress | admin | `#loraImportModal`, `#loraImportBtn`, `#loraImportStatus`, `#loraImportPercent`, `#loraImportBar`, `#loraImportProcessed`, `#loraImportImported` | `runLoraImport()` | Review import shows replacement, blocked items and network effects with the backup box; Start opens the job (D107) (workspace-system-integrations.spec.mjs) |
+| Maintenance cleanup_duplicates, vacuum, cleanup_orphaned_images, prune_orphaned_prompts | admin | `#maintenanceModal`, `#cleanup_duplicates`, `#vacuum`, `#cleanup_orphaned_images`, `#prune_orphaned_prompts`, `#runMaintenanceBtn`, `#maintenanceResults` | `showMaintenanceModal()`, `closeMaintenance()`, `runMaintenance()`, `renderMaintenanceResults()` | Apply reviewed operation closes, toasts, opens the job in Activity (workspace-system-maintenance.spec.mjs) |
+| Maintenance check_hash_duplicates, check_consistency | admin | `#check_hash_duplicates`, `#check_consistency` | — | Run health checks opens Health report and updates metric 4 (workspace-system.spec.mjs) |
+| Maintenance statistics (database info) | admin | `#statistics` | — | meta-grid shows real database and source status, the pinned Viewer.js version and the host renderers (workspace-system-diagnostics.spec.mjs) |
+| Maintenance select all / clear all / run | admin | `#selectAllMaintenanceBtn`, `#clearAllMaintenanceBtn` | `selectAllMaintenance()`, `clearAllMaintenance()` | plan dialog shows the server's scope, protected, backup policy and media lines with the backup box (D100); Cancel writes nothing (workspace-system-maintenance.spec.mjs) |
+| Database backup | admin | — | `backupDatabase()` | Back up downloads through the api client and revokes the object URL (D103) (workspace-system-backups.spec.mjs) |
+| Restore from file | admin | `#restoreModal`, `#restoreFileInput`, `#confirmRestore`, `#cancelRestore` | `showRestoreModal()`, `confirmRestore()` | Review restore stages the chosen file and shows the real summary with the backup box (D105) (workspace-system-backups.spec.mjs) |
+| Gallery thumbnail generation | gallery | `#generateThumbnailsBtn`, `#thumbnailStatus`, `#thumbnailProgress`, `#progressText`, `#progressPercent`, `#cancelThumbnailsBtn`, `#progressBar`, `#progressDetails`, `#progressETA` | `generateThumbnails()`, `generateThumbnailsWithProgress()` | Start closes the dialog, toasts, and opens the job in Activity (workspace-system-sources.spec.mjs) |
+| Default view mode, image quality | gallery | `#defaultViewModeSelect`, `#imageQualitySelect` | — | defaults apply to a new visit but not to the current view or a saved view (workspace-system.spec.mjs) |
+| Image info on cards; sidebar collapsed | gallery | `#showImageInfoToggle`, `#sidebarCollapsedByDefaultToggle` | — | added rows reach their consumers (workspace-system.spec.mjs) |
+| Video autoplay, mute, loop | gallery | `#videoAutoplayToggle`, `#videoMuteToggle`, `#videoLoopToggle` | — | video defaults reach the viewer (workspace-system.spec.mjs) |
+| Auto-load metadata, cache metadata, show file paths | gallery | `#autoLoadMetadataToggle`, `#cacheMetadataToggle`, `#showFilePathsToggle` | — | metadata off shows an explicit load and loads once on request (workspace-system.spec.mjs) |
+| Browser cache clear | gallery | `#clearCacheBtn` | `clearCache()` | Metadata cache reviews and clears only owned browser entries when there are some (D102) (workspace-system-maintenance.spec.mjs) |
+| Clear server thumbnails | gallery | — | — | Thumbnail cache opens the S5 dialog (workspace-system-maintenance.spec.mjs) |
+| Refresh file listing | gallery | `#rescanFolderBtn` | `rescanFolder()` | Refresh files calls /gallery/rescan and toasts its counts (workspace-system-sources.spec.mjs) |
+| Duplicate image scan, review, delete | gallery | `#scanDuplicatesBtn`, `#dupScanPill`, `#dupScanPillText`, `#duplicatesModal`, `#closeDuplicatesBtn`, `#duplicatesScanStatus`, `#dupProgressText`, `#dupProgressBar`, `#duplicatesContent`, `#duplicatesList`, `#duplicatesFooter`, `#duplicatesCount`, `#selectAllBtn`, `#removeDuplicatesBtn` | `scanDuplicates()`, `attachDuplicateStream()`, `resumeDuplicateScan()`, `applyDuplicateEvent()`, `renderDuplicateProgress()`, `setDuplicateButton()`, `showDuplicatePill()`, `hideDuplicatePill()`, `openDuplicatesModal()`, `showDuplicatesModal()`, `hideDuplicatesModal()`, `displayDuplicates()`, `selectAllDuplicates()`, `removeDuplicates()` | Find duplicates starts a job; its view links Review groups; Keep radios build a duplicate_files plan (D101) (workspace-system-maintenance.spec.mjs) |
+| Auto-tag model download | admin | `#autoTagDownloadModal`, `#downloadModelName`, `#downloadStatus`, `#downloadProgressPercent`, `#downloadProgressBar`, `#cancelDownloadBtn` | `downloadModel()`, `cancelDownload()` | Download starts the job and Activity shows it without Cancel (workspace-system-tagging.spec.mjs) |
+| Auto-tag model download | gallery | `#autoTagDownloadModal`, `#downloadModelName`, `#downloadStatus`, `#downloadProgressPercent`, `#downloadProgressBar`, `#cancelDownloadBtn` | `downloadModel()`, `cancelDownload()` | Download starts the job and Activity shows it without Cancel (workspace-system-tagging.spec.mjs) |
+| Unload model | gallery | — | `unloadModel()` | Unload is enabled only while a model is loaded, and a held gate's refusal names the operation (workspace-system-tagging.spec.mjs) |

 ### Browser cache ownership (#222)

@@ -4170,17 +4305,15 @@ page writes a key that is neither a preference nor inventoried, writes one it ca
 CacheStorage or IndexedDB; `the storage scan reports every way of writing browser
 storage` pins those patterns. It skips `web/lib` (third-party builds) and the pinned
 Toolkit build (`web/js/shared/toolkit`, never hand-edited, verified by `npm run check`;
-its storage belongs to the Toolkit repository and a new pin is reviewed on its own). The
-gallery's server thumbnail clear stays its own request and runs first: refused or
-unreachable, it changes nothing and says so (the old code toasted success when the
-request failed); refused browser storage is reported, never hidden
-(`tests/js/legacy-refusals.test.js`; the browser case `the gallery cache clear keeps
-preferences and other tools caches` in `workflows.spec.mjs`).
+its storage belongs to the Toolkit repository and a new pin is reviewed on its own). Since
+System S13 (#330) the legacy gallery no longer offers Clear cache: System › Maintenance's
+Metadata cache and Thumbnail cache reviews own both parts (removal table above), and
+`cache-ownership.js` serves the native review.

-The legacy duplicates dialog's View Full now names its source (`?root=<index>`, with the
-path URL-encoded) when the gallery's output folder is a listed source; before, the serve
-route opened the first source holding a file at that path
-(`test_view_full_names_the_gallery_folder_source`).
+The duplicates dialog's View Full named its source (`?root=<index>`, with the path
+URL-encoded) when the gallery's output folder is a listed source
+(`test_view_full_names_the_gallery_folder_source`); S13 removed the legacy dialog, and the
+route keeps that behaviour for System › Maintenance's duplicate review.

 ### Library location contract (#249 System S6b)

@@ -355,6 +355,44 @@ async def _stop_background_work_on_cleanup(app):
    _stop_background_work()


+def _kill_encoders_at_exit():
+    """Run by the exit hook before Python joins the executor threads (#376):
+    a JPEG XL or ffmpeg encoder (no console on Windows, so Ctrl+C never
+    reaches it) is killed instead of being waited for."""
+    from .py.api.thumbnail_encode import shutdown_encoders
+
+    shutdown_encoders()
+
+
+def _abort_downloads_at_exit():
+    """Run by the exit hook (#376): huggingface_hub's Xet transfers ignore
+    the chunk checkpoint, so they are aborted the way hub aborts on Ctrl+C."""
+    import sys
+
+    if "huggingface_hub" not in sys.modules:
+        return  # no download ever ran: import nothing at exit
+    from .py.autotag import abort_hub_downloads
+
+    abort_hub_downloads()
+
+
+try:
+    # Before the executor join: running jobs stop at their next file, item or
+    # chunk (#376). The teardown below still runs from atexit afterwards.
+    from .utils import exit_signal as _exit_signal
+
+    _exit_signal.install(_kill_encoders_at_exit)
+    _exit_signal.install(_abort_downloads_at_exit)
+except Exception as e:
+    try:
+        from .utils.logging_config import get_logger
+
+        get_logger("prompt_manager.init").error(
+            f"Failed to register the exit signal: {e}"
+        )
+    except Exception:
+        pass
+
 try:
    atexit.register(_stop_background_work)
    from .py.config import server_instance as _teardown_server
@@ -34,6 +34,11 @@ try:
 except ImportError:
    from utils.parallel import map_parallel

+try:
+    from ...utils import exit_signal
+except ImportError:
+    from utils import exit_signal
+
 try:
    from ...database.pair_ingestion import blank_positive, ingest_resolved_pair
    from ...database.run_attribution import (
@@ -118,6 +123,7 @@ def _collect_media_files(output_dirs, extensions):
        if not os.path.isdir(root):
            continue
        for current, dirnames, filenames in os.walk(root, followlinks=False):
+            exit_signal.checkpoint()  # #376: stop between directories at exit
            depth = 0 if current == root else len(Path(current).relative_to(root).parts)
            dirnames[:] = sorted(
                d
@@ -47,6 +47,11 @@ import time
 import uuid
 from pathlib import PurePosixPath, PureWindowsPath

+try:
+    from ...utils import exit_signal
+except ImportError:  # tests import the package top-level
+    from utils import exit_signal
+
 logger = logging.getLogger(__name__)
 # Start and finish order: wall-clock times can tie (coarse Windows clocks).
 _sequence = itertools.count()
@@ -195,11 +200,21 @@ class Job:
        self.counters = dict.fromkeys(groups, 0)
        self.outcomes = {group: [] for group in groups}
        self.log = []
-        self.cancelled = False
+        self._cancel_requested = False
        self.last_event = None
        self.task = None
        self._subscribers = set()

+    @property
+    def cancelled(self):
+        """Cancel was requested, or the interpreter is exiting (#376): every
+        check a job already makes between files also stops it at exit."""
+        return self._cancel_requested or exit_signal.requested()
+
+    @cancelled.setter
+    def cancelled(self, value):
+        self._cancel_requested = bool(value)
+
    @property
    def record_changing(self):
        return self.admission == "records"
@@ -92,6 +92,11 @@ try:
 except ImportError:  # tests import the package top-level
    from utils.parallel import map_parallel, note_refusal, refused_at_shutdown

+try:
+    from ...utils.exit_signal import ExitRequested
+except ImportError:  # tests import the package top-level
+    from utils.exit_signal import ExitRequested
+
 # The placeholder frame a video without a preview is answered with (JPEG
 # bytes, never written to disk); written previews follow the settings.
 PLACEHOLDER_SIZE = (thumbnail_settings.DEFAULT_EDGE, thumbnail_settings.DEFAULT_EDGE)
@@ -460,6 +465,8 @@ class AutoThumbnailer:
    def _run(self):
        try:
            self._drain()
+        except ExitRequested:
+            pass  # #376: the interpreter is exiting; queued files are dropped
        except Exception:
            self._logger.warning("The automatic preview worker stopped", exc_info=True)
        finally:
@@ -7,6 +7,7 @@ Refactored from standalone_tagger.py for integration with PromptManager API.

 import errno
 import gc
+import inspect
 import os
 import sys
 from pathlib import Path
@@ -32,6 +33,54 @@ try:
 except ImportError:
    from py.tagging_defaults import DEFAULT_TAG_TEMPLATE

+try:
+    from ..utils import exit_signal
+except ImportError:
+    from utils import exit_signal
+
+
+def abort_hub_downloads() -> None:
+    """Abort huggingface_hub's Xet transfers (run by the exit hook, #376).
+
+    Xet downloads report progress from native code, which ignores an
+    exception raised in ``tqdm.update``; huggingface_hub aborts them itself
+    on Ctrl+C with ``abort_xet_session``. Nothing happens when
+    huggingface_hub was never imported or has no Xet support.
+    """
+    if "huggingface_hub" not in sys.modules:
+        return
+    try:
+        from huggingface_hub.utils import _xet
+    except ImportError:
+        return
+    abort = getattr(_xet, "abort_xet_session", None)
+    if callable(abort):
+        abort()
+
+
+def _stop_at_exit(download) -> Dict[str, Any]:
+    """Keyword arguments that stop a huggingface_hub download at its next
+    chunk once the interpreter is exiting (#376), or none when this
+    huggingface_hub does not take ``tqdm_class``.
+
+    huggingface_hub 1.x removes its partial temp file on any failure; older
+    versions keep their resumable ``.incomplete`` file. The model's own path
+    is only written by the final rename either way.
+    """
+    try:
+        if "tqdm_class" not in inspect.signature(download).parameters:
+            return {}
+        from huggingface_hub.utils import tqdm as hub_tqdm
+    except (ImportError, TypeError, ValueError):
+        return {}
+
+    class StopAtExit(hub_tqdm):
+        def update(self, n=1):
+            exit_signal.checkpoint()
+            return super().update(n)
+
+    return {"tqdm_class": StopAtExit}
+

 def _autotag_config():
    """The saved defaults; imported late, as config needs ComfyUI's server."""
@@ -397,6 +446,7 @@ class AutoTagService:
                    filename=filename,
                    local_dir=str(model_dir),
                    local_dir_use_symlinks=False,
+                    **_stop_at_exit(hf_hub_download),
                )

        if progress_callback:
@@ -541,6 +591,13 @@ class AutoTagService:
            else:
                return self._download_hf_model(progress_callback)
        except Exception as e:
+            if exit_signal.requested():
+                # ExitRequested between chunks, or the Xet session aborted
+                # by the exit hook (abort_hub_downloads).
+                self.logger.info(
+                    f"Model download stopped: ComfyUI is exiting ({model_type})"
+                )
+                return False
            self.logger.error(f"Download failed: {e}")
            if progress_callback:
                progress_callback(f"Error: {str(e)}", 0)
@@ -570,6 +627,7 @@ class AutoTagService:
                filename=config["filename"],
                local_dir=str(gguf_dir),
                local_dir_use_symlinks=False,
+                **_stop_at_exit(hf_hub_download),
            )
            self.logger.info("GGUF model downloaded")

@@ -587,6 +645,7 @@ class AutoTagService:
                filename=config["mmproj_filename"],
                local_dir=str(gguf_dir),
                local_dir_use_symlinks=False,
+                **_stop_at_exit(hf_hub_download),
            )
            self.logger.info("mmproj downloaded")

@@ -613,6 +672,7 @@ class AutoTagService:
                repo_id=config["repo"],
                local_dir=str(model_dir),
                local_dir_use_symlinks=False,
+                **_stop_at_exit(snapshot_download),
            )
            self.logger.info("HF model downloaded")

@@ -44,8 +44,10 @@ from .lora_manager_layout import (
 )

 try:
+    from ..utils import exit_signal
    from ..utils.hashing import generate_prompt_hash
 except ImportError:  # pragma: no cover - flat test imports
+    from utils import exit_signal
    from utils.hashing import generate_prompt_hash

 LORA_CATEGORY = "lora-manager"
@@ -189,14 +191,15 @@ def stage(
    downloads its CivitAI example images. A sidecar that cannot be read, or
    whose record fails to build, is skipped by its name, as are the
    centralized sidecars discovery could not parse. ``cancelled()`` is asked
-    before each sidecar (raises ImportCancelled); ``on_record(index,
+    before each sidecar, and so is the exit signal (#376: the legacy scan's
+    ``cancelled`` does not read it); either raises ImportCancelled. ``on_record(index,
    record_or_None, staged)`` follows each one.
    """
    sidecars = discovery.sidecars
    staged = StagedImport(total=len(sidecars))
    staged.skipped.extend(discovery.unreadable)
    for index, sidecar in enumerate(sidecars):
-        if cancelled():
+        if cancelled() or exit_signal.requested():
            raise ImportCancelled()
        record = None
        path = sidecar.metadata_path
@@ -1,11 +1,9 @@
-// #328: the legacy admin and gallery auto-tag tools keep working beside System › Auto-tagging. The model download is
-// the `model_download` Activity job; the pages' stream attaches to it. No model is ever downloaded: the fixture's
-// fake download waits until the test releases it (`/__test__/tagging/download`).
+// #328: the legacy admin and gallery auto-tag batch and review keep working beside System › Auto-tagging. Since #330
+// the pages download and unload models only through System (legacy-system-links.spec.mjs); a batch never downloads
+// one. The fixture's fake download (`/__test__/tagging/download`) is held so nothing is ever fetched.
 import { startCoverage, saveCoverage } from '../../tools/vendor/browser-coverage.mjs';
 import { test, expect } from './fixtures.mjs';

-const TITLE = 'Tagging model download · WD14 ViT';
-
 async function post(request, url, data) {
    await expect(await request.post(url, data === undefined ? {} : { data })).toBeOK();
 }
@@ -33,61 +31,6 @@ test.afterEach(async ({ page, request, browserName }) => {
    await post(request, '/__test__/jobs/restart');
 });

-async function startDownload(page, request) {
-    await page.locator('#autoTagBtn').click();
-    const status = page.locator('#wd14VitModelStatus');
-    await status.getByRole('button', { name: 'Download', exact: true }).click();
-    const modal = page.locator('#autoTagDownloadModal');
-    await expect(modal).toBeVisible();
-    await expect(page.locator('#downloadStatus')).toHaveText('Downloading…');
-    await expect(page.locator('#downloadProgressBar')).toHaveClass(/animate-pulse/);
-    await expect(modal).toContainText('The download continues in Activity.');
-    await expect(page.locator('#cancelDownloadBtn')).toHaveText('Close');
-    const running = (await downloads(request)).filter(job => job.state === 'running');
-    expect(running.map(job => [job.title, job.cancellable])).toEqual([[TITLE, false]]);
-    return { modal, status };
-}
-
-test('admin download modal closes on complete and Activity lists the job without Cancel', async ({ page, request }) => {
-    await page.goto('/prompt_manager/admin');
-    const { modal, status } = await startDownload(page, request);
-
-    await page.goto('/prompt_manager/workspace#/activity');
-    const item = page.locator('#workspace-main section.surface > .activity-item')
-        .filter({ has: page.getByRole('link', { name: new RegExp(`${TITLE}$`) }) });
-    await expect(item.locator('.chip')).toHaveText('Running');
-    await expect(item.locator('progress')).not.toHaveAttribute('value');
-    await expect(item.getByRole('button', { name: 'Cancel job', exact: true })).toHaveCount(0);
-
-    // Back on the admin page a second download of the same model attaches to the running job.
-    await page.goto('/prompt_manager/admin');
-    await startDownload(page, request);
-    await post(request, '/__test__/tagging/download', { mode: 'succeed' });
-    await expect(modal).toBeHidden();
-    await expect(status).toContainText('Downloaded');
-    expect((await downloads(request)).map(job => [job.title, job.state])).toEqual([[TITLE, 'finished']]);
-});
-
-test('gallery download modal closes on complete', async ({ page, request }) => {
-    await page.goto('/prompt_manager/gallery');
-    const { modal, status } = await startDownload(page, request);
-    await post(request, '/__test__/tagging/download', { mode: 'succeed' });
-    await expect(modal).toBeHidden();
-    await expect(page.locator('#autoTagModal')).toBeVisible();
-    await expect(status).toContainText('Downloaded');
-    expect((await downloads(request)).map(job => job.state)).toEqual(['finished']);
-});
-
-test('a failed download closes the modal and says so', async ({ page, request }) => {
-    await page.goto('/prompt_manager/gallery');
-    const { modal, status } = await startDownload(page, request);
-    await post(request, '/__test__/tagging/download', { mode: 'fail' });
-    await expect(modal).toBeHidden();
-    await expect(page.getByText('Download failed: Download failed')).toBeVisible();
-    await expect(status.getByRole('button', { name: 'Download', exact: true })).toBeVisible();
-    expect((await downloads(request)).map(job => job.state)).toEqual(['failed']);
-});
-
 // (wd14-vit is not downloaded in these tests: beforeEach marks it so the download tests can offer it.)
 // The gallery's batch reader keyed on `data.status` values the server never sends, so its modal never moved or
 // closed (#328 Problem 5). It now reads `type` frames as the admin page does.
@@ -171,25 +114,6 @@ test('admin review opens the first image', async ({ page }) => {
    await expect(page.getByText('Failed to start review mode')).toHaveCount(0);
 });

-test('gallery unload works and is refused while the gate is held', async ({ page, request }) => {
-    await page.goto('/prompt_manager/gallery');
-    await runGalleryBatch(page); // keeps the model in memory
-    await page.locator('#autoTagBtn').click();
-    const unload = page.locator('#unloadModelBtn');
-    await expect(unload).toBeVisible();
-
-    // A held download owns the model gate: Unload is refused with the server's error.
-    const held = await request.post('/prompt_manager/jobs/model-download', { data: { model_type: 'gguf' } });
-    expect(held.status()).toBe(202);
-    await unload.click();
-    await expect(page.getByText(/^Failed to unload model: A tagging model is busy/)).toBeVisible();
-
-    await post(request, '/__test__/tagging/download', { mode: 'succeed' });
-    await expect.poll(async () => (await downloads(request)).map(job => job.state)).toEqual(['finished']);
-    await unload.click();
-    await expect(page.getByText('WD14-SWINV2 model unloaded successfully')).toBeVisible();
-});
-
 /** The admin review lists every row, videos too: Skip any image that is not one until the confirmation shows. */
 async function untilAutoTagged(page, confirm) {
    // Each image's skip check answers before its confirmation or its error shows.
@@ -15,9 +15,40 @@ const LABELS = Object.freeze({
    diagnostics: 'Diagnostics & logs',
 });

+async function openPageOptions(page) {
+    await page.locator('#pageOptionsBtn').click();
+    await expect(page.locator('#settingsModal')).toBeVisible();
+}
+
+/** The auto-tag modal with its model rows read from /autotag/models. */
+async function openAutoTag(page) {
+    const read = page.waitForResponse(item => item.url().endsWith('/prompt_manager/autotag/models'));
+    await page.locator('#autoTagBtn').click();
+    await read;
+    await expect(page.locator('#autoTagModal')).toBeVisible();
+}
+
+const notDownloaded = (page, request) => post(request, '/__test__/tagging/models', { unavailable: ['gguf'] });
+const modelLoaded = (page, request) => post(request, '/__test__/tagging/loaded', { model: 'wd14-vit' });
+
 // One row per System link of the design's §2 map: the page, the control's label, how to find it, the section it opens
 // and what a test must arrange before the control shows.
 const LINKS = Object.freeze([
+    { page: 'admin', label: 'Settings', locate: page => page.locator('#settingsBtn'), section: 'overview' },
+    { page: 'admin', label: 'Maintenance', locate: page => page.locator('#maintenanceBtn'), section: 'maintenance' },
+    { page: 'admin', label: 'Backup DB', locate: page => page.locator('#backupBtn'), section: 'backups' },
+    { page: 'admin', label: 'Restore DB', locate: page => page.locator('#restoreBtn'), section: 'backups' },
+    { page: 'gallery', label: 'Settings', locate: page => page.locator('#settingsBtn'), section: 'appearance' },
+    { page: 'admin', label: 'Manage in System (model row)', arrange: notDownloaded, reveal: openAutoTag,
+        locate: page => page.locator('#ggufModelStatus a'), section: 'tagging' },
+    { page: 'gallery', label: 'Manage in System (model row)', arrange: notDownloaded, reveal: openAutoTag,
+        locate: page => page.locator('#ggufModelStatus a'), section: 'tagging' },
+    { page: 'gallery', label: 'Manage in System (Unload Model)', arrange: modelLoaded, reveal: openAutoTag,
+        locate: page => page.locator('#unloadModelBtn'), section: 'tagging' },
+    { page: 'gallery', label: 'Page options Maintenance', reveal: openPageOptions,
+        locate: page => page.locator('#pageOptionsMaintenanceLink'), section: 'maintenance' },
+    { page: 'gallery', label: 'Page options Sources & scans', reveal: openPageOptions,
+        locate: page => page.locator('#pageOptionsSourcesLink'), section: 'sources' },
    { page: 'admin', label: 'Diagnostics', locate: page => page.locator('#diagnosticsBtn'), section: 'diagnostics' },
    { page: 'admin', label: 'View Logs', locate: page => page.locator('#logsBtn'), section: 'diagnostics' },
 ]);
@@ -54,17 +85,31 @@ async function openLink(page, request, link) {
    return control;
 }

+// Each row opens its section in a new tab and sends no request from the legacy page (the design's `a System link sends
+// no request from the legacy page`, checked per row so one slow page never times out the whole table).
 for (const link of LINKS) {
    test(`legacy ${link.page} ${link.label} opens System ${link.section}`, async ({ page, context, request }) => {
+        // The gallery's thumbnail startup check (K9) reads its status on a timer of its own; it is off here.
+        await page.addInitScript(() => {
+            localStorage.setItem('gallerySettings', JSON.stringify({ checkThumbnailsAtStartup: false }));
+        });
        const control = await openLink(page, request, link);
        const legacyUrl = page.url();
        await expect(control).toHaveAttribute('href', `workspace#/system/${link.section}`);
        await expect(control).toHaveAttribute('target', '_blank');
        await expect(control).toHaveAttribute('rel', 'noopener');
+        // The page's own start-up reads (list, film strips, settings) finish first; then the click must add none.
+        // Lazy thumbnails may still load whenever the layout changes; they are not the click's.
+        await page.waitForLoadState('networkidle');
+        const sent = [];
+        const record = item => { if (item.resourceType() !== 'image') sent.push(`${item.method()} ${item.url()}`); };
+        page.on('request', record);
        const opened = context.waitForEvent('page');
        await control.click();
        const system = await opened;
        await expect(system).toHaveURL(new RegExp(`/prompt_manager/workspace#/system/${link.section}$`));
+        page.off('request', record);
+        expect(sent, 'a System link sends no request from the legacy page').toEqual([]);
        // System's page heading is "System"; the open section is the pressed button of its section switcher.
        const main = system.locator('#workspace-main');
        await expect(main.getByRole('heading', { level: 1, name: 'System', exact: true })).toBeVisible();
@@ -75,24 +120,6 @@ for (const link of LINKS) {
    });
 }

-test('a System link sends no request from the legacy page', async ({ page, context, request }) => {
-    for (const link of LINKS) {
-        const control = await openLink(page, request, link);
-        // The page's own start-up reads (list, film strips, settings) finish first; then the click must add none.
-        await page.waitForLoadState('networkidle');
-        const sent = [];
-        const record = item => sent.push(`${item.method()} ${item.url()}`);
-        page.on('request', record);
-        const opened = context.waitForEvent('page');
-        await control.click();
-        const system = await opened;
-        await system.waitForLoadState('domcontentloaded');
-        page.off('request', record);
-        expect(sent, `${link.page} ${link.label}`).toEqual([]);
-        await system.close();
-    }
-});
-
 test('kept admin flows still work', async ({ page, context }) => {
    await page.goto(PAGES.admin);
    const texts = page.locator('#resultsList .prompt-text');
@@ -161,3 +188,99 @@ test('kept admin flows still work', async ({ page, context }) => {
        await tab.close();
    }
 });
+
+test('Page options keeps the page-only settings admin', async ({ page, request }) => {
+    const before = (await (await request.get('/prompt_manager/settings')).json()).settings;
+    await page.goto(PAGES.admin);
+    await expect(page.locator('#resultsList .prompt-text').first()).toBeVisible();
+    await page.locator('#pageOptionsBtn').click();
+    const dialog = page.locator('#settingsModal');
+    await expect(dialog).toBeVisible();
+    await expect(dialog.locator('h3')).toHaveText('Page options');
+    // Exactly the page-only setting (G5): the list's Infinite Scrolling default.
+    expect(await dialog.locator('input, select, textarea').evaluateAll(fields => fields.map(field => field.id)))
+        .toEqual(['infiniteScrollDefault']);
+    await expect(page.locator('#infiniteScrollDefault')).not.toBeChecked();
+    await page.locator('#infiniteScrollDefault').check();
+    const saved = page.waitForRequest(item => item.method() === 'POST' && item.url().endsWith('/prompt_manager/settings'));
+    await page.locator('#saveSettings').click();
+    expect((await saved).postDataJSON()).toEqual({ infinite_scroll: true });
+    await expect(dialog).toBeHidden();
+    // The list header follows the saved default at once; nothing else changed.
+    await expect(page.locator('#infiniteScrollSession')).toBeChecked();
+    const after = (await (await request.get('/prompt_manager/settings')).json()).settings;
+    expect(after).toEqual({ ...before, infinite_scroll: true });
+    await page.reload();
+    // The dialog shows the saved default once the page has read it (the header follows it first).
+    await expect(page.locator('#infiniteScrollSession')).toBeChecked();
+    await page.locator('#pageOptionsBtn').click();
+    await expect(page.locator('#infiniteScrollDefault')).toBeChecked();
+});
+
+test('Page options keeps the page-only settings gallery', async ({ page }) => {
+    // Native Appearance keys and the startup prompt's own keys are in the shared object before the page opens.
+    const stored = { imageQuality: 'high', showImageInfo: false, videoMute: false,
+        autoLoadMetadata: false, workspaceLayout: 'masonry', thumbnailPromptDismissed: 'sig', thumbnailsGenerated: true,
+        checkThumbnailsAtStartup: false, defaultViewMode: 'list' };
+    await page.addInitScript(value => {
+        if (!sessionStorage.getItem('seeded')) {
+            sessionStorage.setItem('seeded', '1');
+            localStorage.setItem('gallerySettings', value);
+        }
+    }, JSON.stringify(stored));
+    const listed = page.waitForResponse(item => item.url().includes('/prompt_manager/images/output?'));
+    await page.goto(PAGES.gallery);
+    await listed;
+    // With no Page options control, a stored default view still opens the page in it.
+    await expect(page.locator('#listViewBtn')).toHaveClass(/bg-pm-accent/);
+    await openPageOptions(page);
+    const dialog = page.locator('#settingsModal');
+    await expect(dialog.locator('h3')).toHaveText('Page options');
+    // Exactly the page-only settings (G5); the default view is System › Appearance's Default layout.
+    expect(await dialog.locator('input, select, textarea').evaluateAll(fields => fields.map(field => field.id))).toEqual([
+        'checkThumbnailsAtStartup', 'lazyLoadingToggle', 'defaultLimitSelect', 'gridColumnsSelect',
+        'infiniteScrollToggle', 'debugModeToggle', 'apiTimeoutInput']);
+    await expect(dialog.getByText('Default View Mode')).toHaveCount(0);
+    await page.locator('#defaultLimitSelect').selectOption('50');
+    await page.locator('#debugModeToggle').check();
+    await page.locator('#saveSettingsBtn').click();
+    await expect(dialog).toBeHidden();
+    const read = () => page.evaluate(() => JSON.parse(localStorage.getItem('gallerySettings')));
+    let saved = await read();
+    expect(saved).toMatchObject({ ...stored, defaultLimit: 50, debugMode: true });
+
+    // Reset puts back only the page options' defaults; the Appearance, startup-prompt and default-view keys stay.
+    await openPageOptions(page);
+    page.once('dialog', dialog => dialog.accept());
+    await page.locator('#resetSettingsBtn').click();
+    await expect(page.getByText('Page options reset to defaults')).toBeVisible();
+    await expect(page.locator('#defaultLimitSelect')).toHaveValue('100');
+    saved = await read();
+    expect(saved).toMatchObject({ defaultViewMode: 'list', imageQuality: 'high', showImageInfo: false, videoMute: false,
+        autoLoadMetadata: false, workspaceLayout: 'masonry', thumbnailPromptDismissed: 'sig', thumbnailsGenerated: true,
+        defaultLimit: 100, debugMode: false, checkThumbnailsAtStartup: true, lazyLoading: true, gridColumns: 8,
+        infiniteScroll: false, apiTimeout: 30 });
+});
+
+test('the legacy auto-tag modal stays open after Manage in System', async ({ page, context, request }) => {
+    for (const legacy of ['admin', 'gallery']) {
+        await post(request, '/__test__/tagging/models', { unavailable: ['gguf'] });
+        await page.goto(PAGES[legacy]);
+        await openAutoTag(page);
+        const link = page.locator('#ggufModelStatus').getByRole('link', { name: 'Manage in System', exact: true });
+        await expect(link).toHaveAttribute('title', 'Opens System › Auto-tagging in a new tab');
+        // A downloaded model keeps its status text.
+        await expect(page.locator('#wd14VitModelStatus')).toHaveText('\u2713 Downloaded');
+        const opened = context.waitForEvent('page');
+        await link.click();
+        const system = await opened;
+        await expect(system).toHaveURL(/#\/system\/tagging$/);
+        await expect(page.locator('#autoTagModal')).toBeVisible();
+        await system.close();
+        // Downloaded in System meanwhile: reopening the modal reads the models again (CUJ 4).
+        await post(request, '/__test__/tagging/models', { unavailable: [] });
+        await page.goto(PAGES[legacy]);
+        await openAutoTag(page);
+        await expect(page.locator('#ggufModelStatus')).toHaveText('\u2713 Downloaded');
+    }
+});
@@ -104,33 +104,6 @@ for (const leave of ['beforeunload', 'pagehide']) {
    });
 }

-// #222: the gallery's Clear cache clears the server's thumbnails by its own request and keeps this browser's
-// preferences and other tools' storage; nothing of Prompt Manager's is cached in a browser, and the toast says so.
-test('the gallery cache clear keeps preferences and other tools caches', async ({ page }) => {
-    await page.addInitScript(() => {
-        if (sessionStorage.getItem('seeded')) return;
-        sessionStorage.setItem('seeded', '1');
-        localStorage.setItem('pm_workspace_theme', 'light');
-        localStorage.setItem('other-tool-setting', 'keep');
-        localStorage.setItem('pm_other_tool', 'keep');
-    });
-    await page.goto('/prompt_manager/gallery');
-    await expect(page.locator('#galleryGrid .image-item')).toHaveCount(2);
-    await page.evaluate(async () => { await (await caches.open('other-tool-gallery-thumbnails')).put('/x', new Response('x')); });
-    const clears = [];
-    page.on('request', req => { if (req.url().includes('/clear-thumbnails')) clears.push(req.method()); });
-    page.once('dialog', dialog => dialog.accept());
-    await page.locator('#settingsBtn').click();
-    await page.locator('#clearCacheBtn').click();
-    await expect(page.getByText("Thumbnails cleared; original images untouched. Nothing of Prompt Manager's is cached in this browser."))
-        .toBeVisible();
-    expect(clears).toEqual(['POST']);
-    expect(await page.evaluate(async () => ({
-        theme: localStorage.getItem('pm_workspace_theme'), other: localStorage.getItem('other-tool-setting'),
-        prefixed: localStorage.getItem('pm_other_tool'), notice: localStorage.getItem('pm_update_notice_dismissed'),
-        caches: await caches.keys(),
-    }))).toEqual({ theme: 'light', other: 'keep', prefixed: 'keep', notice: '3.2.0', caches: ['other-tool-gallery-thumbnails'] });
-});

 // #379: the reviewed tags are that image's own tags; no prompt changes.
 test('actual gallery review generates and persists tags for the selected root\'s image', async ({ page, request }) => {
@@ -226,7 +199,7 @@ test('gallery infinite scroll appends a real backend page while retaining existi
    await expect(await request.post('/__test__/reset', { data: { extra_images: 108 } })).toBeOK();
    await page.goto('/prompt_manager/gallery');
    await expect(page.locator('#galleryGrid .image-item')).toHaveCount(100);
-    await page.locator('#settingsBtn').click();
+    await page.locator('#pageOptionsBtn').click();
    await page.locator('#infiniteScrollToggle').check();
    await page.locator('#saveSettingsBtn').click();
    await expect(page.locator('#settingsModal')).toBeHidden();
@@ -246,37 +219,6 @@ async function promptSnapshot(request) {
    })).sort((a, b) => a.id - b.id);
 }

-async function downloadBackup(page) {
-    const downloading = page.waitForEvent('download');
-    await page.locator('#backupBtn').click();
-    const download = await downloading;
-    expect(download.suggestedFilename()).toMatch(/^prompts_backup_.*\.db$/);
-    expect(await download.failure()).toBeNull();
-    const chunks = [];
-    for await (const chunk of await download.createReadStream()) chunks.push(chunk);
-    const buffer = Buffer.concat(chunks);
-    expect(buffer.subarray(0, 16).toString()).toBe('SQLite format 3\0');
-    return { name: download.suggestedFilename(), mimeType: 'application/octet-stream', buffer };
-}
-
-async function chooseRestore(page, file) {
-    await page.locator('#restoreBtn').click();
-    await expect(page.locator('#restoreModal')).toBeVisible();
-    await page.locator('#restoreFileInput').setInputFiles(file);
-}
-
-// Confirms the chosen restore and waits for the server's answer, not for a timer: a restore is disk-bound and can take
-// longer than an expect timeout on a slow runner (#359). The modal closes only after that answer.
-async function confirmRestoreAndWait(page) {
-    const restored = page.waitForResponse(response => response.url().endsWith('/prompt_manager/restore'));
-    await page.locator('#confirmRestore').click();
-    const response = await restored;
-    const body = await response.text();
-    expect(response.status(), body).toBe(200);
-    expect(JSON.parse(body)).toMatchObject({ success: true, prompt_count: 2, backup_created: expect.any(String) });
-    await expect(page.locator('#restoreModal')).toBeHidden();
-}
-
 function confirmNextDialog(page, accept, message) {
    page.once('dialog', async dialog => {
        expect(dialog.type()).toBe('confirm');
@@ -292,88 +234,6 @@ async function deletePromptButton(page, text) {
    return page.locator(`[data-action="delete"][data-prompt-id="${id}"]`);
 }

-test('downloaded backup restores deleted prompts, tags, and image links through the actual upload form', async ({ page, request }) => {
-    await page.goto('/prompt_manager/admin');
-    await expect(page.locator('.prompt-text')).toHaveCount(2);
-    const before = await promptSnapshot(request);
-    expect(before.map(prompt => prompt.tags)).toEqual([['cats'], ['dogs']]);
-    expect(before.every(prompt => prompt.images.length === 1)).toBe(true);
-    const backup = await downloadBackup(page);
-    const button = await deletePromptButton(page, 'Cat portrait');
-    confirmNextDialog(page, true, 'delete this prompt');
-    await button.click();
-    await expect(page.locator('.prompt-text')).toHaveCount(1);
-    await expect(await request.post('/prompt_manager/save', { data: { text: 'Added after backup', tags: ['temporary'] } })).toBeOK();
-    expect(await promptSnapshot(request)).not.toEqual(before);
-    await chooseRestore(page, backup);
-    confirmNextDialog(page, true, backup.name);
-    await confirmRestoreAndWait(page);
-    await expect(page.locator('.prompt-text')).toHaveCount(2);
-    await page.reload();
-    await expect(page.locator('.prompt-text').filter({ hasText: 'Cat portrait' })).toBeVisible();
-    await expect(page.locator('.prompt-text').filter({ hasText: 'Added after backup' })).toHaveCount(0);
-    expect(await promptSnapshot(request)).toEqual(before);
-    await page.goto('/prompt_manager/admin#/tags');
-    await page.locator('[data-tag-name="cats"]').click();
-    await expect(page.locator('#tagPromptsGrid')).toContainText('Cat portrait');
-    await page.locator('#tagPromptsGrid img').first().click();
-    await expect(page.locator('.viewer-canvas img')).toBeVisible();
-    await expect.poll(() => page.locator('.viewer-canvas img').evaluate(image => image.complete && image.naturalWidth > 0)).toBe(true);
-});
-
-test('restore validation and cancellation preserve live data and allow a valid retry', async ({ page, request }) => {
-    await page.goto('/prompt_manager/admin');
-    const before = await promptSnapshot(request);
-    const backup = await downloadBackup(page);
-    let uploads = 0;
-    page.on('request', request => { if (request.url().endsWith('/prompt_manager/restore')) uploads++; });
-    await page.locator('#restoreBtn').click();
-    await page.locator('#confirmRestore').click();
-    await expect(page.getByText('Please select a database file to restore', { exact: true })).toBeVisible();
-    await page.locator('#restoreFileInput').setInputFiles({ ...backup, name: 'backup.txt' });
-    await page.locator('#confirmRestore').click();
-    await expect(page.getByText('Please select a valid .db file', { exact: true })).toBeVisible();
-    expect(uploads).toBe(0);
-    await page.locator('#restoreFileInput').setInputFiles(backup);
-    confirmNextDialog(page, false, 'replace your current database');
-    await page.locator('#confirmRestore').click();
-    await expect(page.locator('#restoreModal')).toBeVisible();
-    expect(uploads).toBe(0);
-    await page.locator('#restoreFileInput').setInputFiles({ name: 'corrupt.db', mimeType: 'application/octet-stream', buffer: Buffer.from('not a SQLite database') });
-    confirmNextDialog(page, true, 'corrupt.db');
-    const rejected = page.waitForResponse(response => response.url().endsWith('/prompt_manager/restore'));
-    await page.locator('#confirmRestore').click();
-    expect((await rejected).status()).toBe(400);
-    await expect(page.getByText(/Restore failed:/)).toBeVisible();
-    await expect(page.locator('#restoreModal')).toBeVisible();
-    await expect(page.locator('#confirmRestore')).toBeEnabled();
-    expect(await promptSnapshot(request)).toEqual(before);
-    await page.locator('#restoreFileInput').setInputFiles(backup);
-    confirmNextDialog(page, true, backup.name);
-    await confirmRestoreAndWait(page);
-    expect(await promptSnapshot(request)).toEqual(before);
-});
-
-test('backup and restore recover from interrupted network requests without losing data', async ({ page, request }) => {
-    await page.goto('/prompt_manager/admin');
-    const before = await promptSnapshot(request);
-    await page.route('**/prompt_manager/backup', route => route.abort('failed'), { times: 1 });
-    await page.locator('#backupBtn').click();
-    await expect(page.getByText(/Backup failed:/)).toBeVisible();
-    const backup = await downloadBackup(page);
-    await chooseRestore(page, backup);
-    await page.route('**/prompt_manager/restore', route => route.abort('failed'), { times: 1 });
-    confirmNextDialog(page, true, backup.name);
-    await page.locator('#confirmRestore').click();
-    await expect(page.getByText(/Restore failed:/)).toBeVisible();
-    await expect(page.locator('#confirmRestore')).toBeEnabled();
-    await expect(page.locator('#restoreModal')).toBeVisible();
-    expect(await promptSnapshot(request)).toEqual(before);
-    confirmNextDialog(page, true, backup.name);
-    await confirmRestoreAndWait(page);
-    expect(await promptSnapshot(request)).toEqual(before);
-});
-
 test('prompt deletion requires confirmation and can retry after a network failure', async ({ page, request }) => {
    await page.goto('/prompt_manager/admin');
    const before = await promptSnapshot(request);
@@ -401,98 +261,3 @@ test('prompt deletion requires confirmation and can retry after a network failur
        await expect(await request.get(url)).toBeOK();
    }
 });
-
-// The duplicate scan reads the output root only, but the fixture's input root holds a different
-// shared/same.png. A bare /images/serve/<path> URL tries every gallery root in turn, so once the
-// output copy is deleted it answers 200 with the input copy: check each file in its own root.
-const serveIn = (root, path) => `/prompt_manager/images/serve/${path.split(/[\\/]/).map(encodeURIComponent).join('/')}?root=${root}`;
-const rootOf = url => new URL(url, 'http://gallery.test').searchParams.get('root');
-
-// Which copy the scan keeps depends on file times: the fixture stamps shared/same.png with the
-// wall clock, and the kernel can stamp its bulk copies a fraction of a millisecond earlier.
-// listOrder rewrites the finished scan's groups so a test can pick the order it needs.
-async function openDuplicateScan(page, request, listOrder = null) {
-    await expect(await request.post('/__test__/reset', { data: { extra_images: 2 } })).toBeOK();
-    if (listOrder) {
-        await page.route('**/prompt_manager/scan_duplicates/stream', async route => {
-            const response = await route.fetch();
-            const body = (await response.text()).replace(/^data: (.*)$/gm, (line, json) => {
-                const event = JSON.parse(json);
-                if (event.type !== 'complete') return line;
-                for (const group of event.duplicates) group.images = listOrder(group.images);
-                return `data: ${JSON.stringify(event)}`;
-            });
-            await route.fulfill({ response, body });
-        });
-    }
-    await page.goto('/prompt_manager/gallery');
-    await expect(page.locator('#galleryGrid .image-item')).toHaveCount(4);
-    const originals = await page.locator('#galleryGrid img[data-original]').evaluateAll(images => images.map(image => image.dataset.original));
-    const output = rootOf(originals.find(url => url.includes('/bulk/')));
-    const input = rootOf(originals.find(url => url.includes('/shared/same.png') && rootOf(url) !== output));
-    expect(output).not.toBeNull();
-    expect(input).not.toBeNull();
-    await page.locator('#settingsBtn').click();
-    await page.locator('#scanDuplicatesBtn').click();
-    await expect(page.locator('#duplicatesCount')).toHaveText('1');
-    const candidates = page.locator('.duplicate-checkbox');
-    await expect(candidates).toHaveCount(2);
-    return { originals, output, input, candidates };
-}
-
-async function expectOnlySelectedGone(page, request, { originals, output, input }, selected, retained) {
-    expect((await request.get(serveIn(output, selected))).status()).toBe(404);
-    await expect(await request.get(serveIn(output, retained))).toBeOK();
-    await expect(await request.get(serveIn(input, 'shared/same.png'))).toBeOK();
-    await page.reload();
-    await expect(page.locator('#galleryGrid .image-item')).toHaveCount(3);
-    const remaining = await page.locator('#galleryGrid img[data-original]').evaluateAll(images => images.map(image => image.dataset.original));
-    expect(remaining).toHaveLength(originals.length - 1);
-    for (const url of remaining) {
-        expect(originals).toContain(url);
-        await expect(await request.get(url)).toBeOK();
-    }
-}
-
-test('duplicate cleanup cancels safely and deletes only the selected file after a retry', async ({ page, request }) => {
-    const scan = await openDuplicateScan(page, request);
-    const { output, candidates } = scan;
-    const selected = await candidates.first().getAttribute('data-image-path');
-    const retained = await candidates.last().getAttribute('data-image-path');
-    await candidates.first().check();
-    let deletes = 0;
-    page.on('request', request => { if (request.url().endsWith('/delete_duplicate_images')) deletes++; });
-    confirmNextDialog(page, false, 'permanently delete 1 duplicate image files');
-    await page.locator('#removeDuplicatesBtn').click();
-    expect(deletes).toBe(0);
-    await expect(await request.get(serveIn(output, selected))).toBeOK();
-    await page.route('**/prompt_manager/delete_duplicate_images', route => route.abort('failed'), { times: 1 });
-    confirmNextDialog(page, true, 'permanently delete 1 duplicate image files');
-    await page.locator('#removeDuplicatesBtn').click();
-    await expect(page.getByText('Failed to delete duplicate images', { exact: true })).toBeVisible();
-    await expect(page.locator('#removeDuplicatesBtn')).toBeEnabled();
-    await expect(await request.get(serveIn(output, selected))).toBeOK();
-    confirmNextDialog(page, true, 'permanently delete 1 duplicate image files');
-    const deleted = page.waitForResponse(response => response.url().endsWith('/delete_duplicate_images'));
-    await page.locator('#removeDuplicatesBtn').click();
-    expect((await (await deleted).json())).toMatchObject({ success: true, deleted_count: 1, failed_count: 0 });
-    await expect(page.locator('#duplicatesModal')).toBeHidden();
-    await expectOnlySelectedGone(page, request, scan, selected, retained);
-});
-
-test('deleting a duplicate whose path another gallery root also holds removes only the scanned copy', async ({ page, request }) => {
-    // The order CI saw: a bulk copy stamped first, so shared/same.png is the first Delete candidate.
-    const ciOrder = ['bulk/0000.png', 'shared/same.png', 'bulk/0001.png'];
-    const rank = image => ciOrder.indexOf(image.path.replace(/\\/g, '/'));
-    const scan = await openDuplicateScan(page, request, images => [...images].sort((a, b) => rank(a) - rank(b)));
-    const selected = await scan.candidates.first().getAttribute('data-image-path');
-    const retained = await scan.candidates.last().getAttribute('data-image-path');
-    expect(selected.replace(/\\/g, '/')).toBe('shared/same.png');
-    await scan.candidates.first().check();
-    confirmNextDialog(page, true, 'permanently delete 1 duplicate image files');
-    const deleted = page.waitForResponse(response => response.url().endsWith('/delete_duplicate_images'));
-    await page.locator('#removeDuplicatesBtn').click();
-    expect((await (await deleted).json())).toMatchObject({ success: true, deleted_count: 1, failed_count: 0 });
-    await expect(page.locator('#duplicatesModal')).toBeHidden();
-    await expectOnlySelectedGone(page, request, scan, selected, retained);
-});
@@ -395,14 +395,15 @@ test('a failed settings read leaves the policy disabled with the reason', async
    await expect(row.locator('input')).toBeDisabled();
 });

-test('the legacy admin Backup and Restore keep working', async ({ page, request }) => {
+test('the legacy Backup and Restore routes keep working and the admin page links to System', async ({ page, request }) => {
    const bytes = await backupBytes(request);
    const restored = await request.post('/prompt_manager/restore', { multipart: { database_file: {
        name: 'prompts_backup.db', mimeType: 'application/octet-stream', buffer: bytes } } });
    await expect(restored).toBeOK();
    expect((await restored.json()).success).toBe(true);
+    // #330: the admin page's Backup DB and Restore DB open System › Backup & export.
    await page.goto('/prompt_manager/admin');
-    await expect(page.locator('#restoreFileInput')).toHaveCount(1);
+    for (const id of ['#backupBtn', '#restoreBtn']) await expect(page.locator(id)).toHaveAttribute('href', 'workspace#/system/backups');
 });

 /** Start a fake running job (a metadata scan another tab started), which an exclusive restore must wait for. */
@@ -247,6 +247,22 @@ def register_tagging_commands(
        model.unavailable = set(data["unavailable"])
        return web.json_response({"success": True})

+    @routes.post("/__test__/tagging/loaded")
+    async def loaded(request: web.Request) -> web.Response:
+        """Mark one fake model loaded (``{"model": "<key>"}``), as a batch that
+        kept it in memory leaves it; ``/autotag/models`` then reports
+        ``model_loaded``. Reset unloads it."""
+        data = await request.json() if request.can_read_body else None
+        if (
+            request.query
+            or not isinstance(data, dict)
+            or set(data) != {"model"}
+            or data["model"] not in MODELS
+        ):
+            raise web.HTTPBadRequest()
+        model.loaded = data["model"]
+        return web.json_response({"success": True})
+
    @routes.post("/__test__/tagging/download")
    async def download_mode(request: web.Request) -> web.Response:
        """Switch the model's download to a fake (never a real download).
@@ -76,35 +76,101 @@ test("the workspace keys have their own defaults and validation", () => {
    assert.equal(normalizeGallerySettings({ defaultViewMode: "masonry" }).defaultViewMode, "grid");
 });

-test("a legacy gallery Save keeps the workspace keys and every other stored key", () => {
+// #330 S13: the legacy gallery's Page options edit only the page-only keys (PAGE_OPTION_KEYS); System › Appearance owns the rest, so a Save
+// or a Reset from the legacy page keeps every other stored key.
+function legacyGallery(stored, controls, extra = {}) {
    const fs = require("node:fs");
    const path = require("node:path");
    const vm = require("node:vm");
    const settings = require("../../web/js/gallery-settings.js");
-    const storage = new Map([["gallerySettings", JSON.stringify({ workspaceLayout: "masonry", workspaceDensity: "compact", someOtherTool: 1 })]]);
-    const controls = {
-        lazyLoadingToggle: { checked: true }, imageQualitySelect: { value: "high" }, defaultViewModeSelect: { value: "list" },
-        defaultLimitSelect: { value: "200" }, gridColumnsSelect: { value: "6" }, showImageInfoToggle: { checked: false },
-        autoLoadMetadataToggle: { checked: true }, cacheMetadataToggle: { checked: true }, showFilePathsToggle: { checked: false },
-        sidebarCollapsedByDefaultToggle: { checked: true }, infiniteScrollToggle: { checked: false }, debugModeToggle: { checked: false },
-        apiTimeoutInput: { value: "30" }, checkThumbnailsAtStartup: { checked: true }, videoAutoplayToggle: { checked: true },
-        videoMuteToggle: { checked: false }, videoLoopToggle: { checked: true },
-    };
+    const storage = new Map([["gallerySettings", JSON.stringify(stored)]]);
    const context = vm.createContext({
        document: { addEventListener() {}, getElementById: id => controls[id] },
        window: {}, console: { debug() {}, warn() {}, error() {} }, GallerySettings: settings,
-        localStorage: { getItem: key => storage.get(key) ?? null, setItem: (key, value) => storage.set(key, value) },
+        localStorage: { getItem: key => storage.get(key) ?? null, setItem: (key, value) => storage.set(key, value),
+            removeItem: key => storage.delete(key) },
+        ...extra,
    });
    const file = path.join(__dirname, "../../web/js/gallery.js");
    const Manager = vm.runInContext(`${fs.readFileSync(file, "utf8")}\nGalleryManager;`, context, { filename: file });
    const manager = Object.create(Manager.prototype);
-    Object.assign(manager, { showNotification() {}, hideSettings() {}, applySettings() {} });
+    const calls = [];
+    Object.assign(manager, { showNotification: (message, type) => calls.push([type, message]), hideSettings() {},
+        applySettings: applied => calls.push(["apply", applied.lazyLoading]) });
+    return { manager, storage, calls, saved: () => JSON.parse(storage.get("gallerySettings")) };
+}
+
+const PAGE_OPTION_CONTROLS = () => ({
+    checkThumbnailsAtStartup: { checked: false }, lazyLoadingToggle: { checked: false },
+    defaultLimitSelect: { value: "200" },
+    gridColumnsSelect: { value: "6" }, infiniteScrollToggle: { checked: true }, debugModeToggle: { checked: true },
+    apiTimeoutInput: { value: "45" },
+});
+
+test("a legacy gallery Save keeps the workspace keys and every other stored key", () => {
+    const { manager, saved } = legacyGallery({ workspaceLayout: "masonry", workspaceDensity: "compact", someOtherTool: 1,
+        imageQuality: "high", showImageInfo: false, videoMute: false, thumbnailPromptDismissed: "sig", defaultViewMode: "list" },
+        PAGE_OPTION_CONTROLS());
    manager.saveSettings();
-    const saved = JSON.parse(storage.get("gallerySettings"));
-    assert.equal(saved.workspaceLayout, "masonry");
-    assert.equal(saved.workspaceDensity, "compact");
-    assert.equal(saved.someOtherTool, 1);
-    assert.equal(saved.defaultViewMode, "list");
-    assert.equal(saved.showImageInfo, false);
-    assert.equal(saved.videoMute, false);
+    const result = saved();
+    assert.equal(result.workspaceLayout, "masonry");
+    assert.equal(result.workspaceDensity, "compact");
+    assert.equal(result.someOtherTool, 1);
+    assert.equal(result.imageQuality, "high");
+    assert.equal(result.showImageInfo, false);
+    assert.equal(result.videoMute, false);
+    assert.equal(result.thumbnailPromptDismissed, "sig");
+    // Page options no longer edit the default view (S13 G5), so a stored one stays.
+    assert.equal(result.defaultViewMode, "list");
+    // The page-only keys come from the dialog.
+    assert.equal(result.lazyLoading, false);
+    assert.equal(result.debugMode, true);
+    assert.equal(result.checkThumbnailsAtStartup, false);
+    assert.equal(result.defaultLimit, 200);
+    assert.equal(result.gridColumns, 6);
+    assert.equal(result.infiniteScroll, true);
+    assert.equal(result.apiTimeout, 45);
+});
+
+test("a legacy gallery Reset restores only the page options and keeps every other stored key", () => {
+    const controls = PAGE_OPTION_CONTROLS();
+    const { manager, saved, calls } = legacyGallery({ workspaceLayout: "masonry", imageQuality: "high", videoMute: false,
+        thumbnailPromptDismissed: "sig", thumbnailsGenerated: true, lazyLoading: false, debugMode: true, defaultLimit: 200,
+        gridColumns: 6, infiniteScroll: true, apiTimeout: 45, checkThumbnailsAtStartup: false, defaultViewMode: "list" }, controls,
+    { confirm: message => (calls.push(["confirm", message]), true) });
+    manager.resetSettings();
+    const result = saved();
+    const { DEFAULT_SETTINGS } = require("../../web/js/gallery-settings.js");
+    for (const key of ["checkThumbnailsAtStartup", "lazyLoading", "defaultLimit", "gridColumns",
+        "infiniteScroll", "debugMode", "apiTimeout"]) {
+        assert.equal(result[key], DEFAULT_SETTINGS[key], key);
+    }
+    // The default view is not a page option (S13 G5): Reset keeps a stored one.
+    assert.equal(result.defaultViewMode, "list");
+    assert.equal(result.workspaceLayout, "masonry");
+    assert.equal(result.imageQuality, "high");
+    assert.equal(result.videoMute, false);
+    assert.equal(result.thumbnailPromptDismissed, "sig");
+    assert.equal(result.thumbnailsGenerated, true);
+    // The dialog shows the defaults again and the page applies them.
+    assert.equal(controls.lazyLoadingToggle.checked, DEFAULT_SETTINGS.lazyLoading);
+    assert.equal(controls.apiTimeoutInput.value, DEFAULT_SETTINGS.apiTimeout);
+    assert.deepEqual(calls, [["confirm", "Reset these page options to their defaults?"], ["apply", DEFAULT_SETTINGS.lazyLoading],
+        ["success", "Page options reset to defaults"]]);
+});
+
+test("Page options no longer hold the default view; System › Appearance's Default layout is the one control", () => {
+    const { manager } = legacyGallery({}, {});
+    assert.deepEqual([...manager.constructor.PAGE_OPTION_KEYS], ["checkThumbnailsAtStartup", "lazyLoading", "defaultLimit",
+        "gridColumns", "infiniteScroll", "debugMode", "apiTimeout"]);
+});
+
+test("a viewer mute or loop click remembers only that key and never reads the Page options dialog", () => {
+    const { manager, saved, calls } = legacyGallery({ defaultLimit: 200, lazyLoading: false, videoMute: true }, {});
+    manager.storeSetting("videoMute", false);
+    const result = saved();
+    assert.equal(result.videoMute, false);
+    assert.equal(result.defaultLimit, 200);
+    assert.equal(result.lazyLoading, false);
+    assert.deepEqual(calls, []);
 });
@@ -112,11 +112,12 @@ test('saving gallery settings retains the remembered thumbnail dismissal', () =>
 });

 // #249 System S5: the stream's work is now an Activity job that outlives the page's connection, so the gallery's
-// Cancel asks the server to stop the job. The stream's first frame, `job {id, started}`, names the job; the gallery
+// Cancel asks the server to stop the job. Since #330 the startup dialog is the gallery's only thumbnail stream (System
+// › Sources & scans generates the rest). The stream's first frame, `job {id, started}`, names the job; the gallery
 // cancels by that id, only a job this stream started, and a Cancel before the id waits for it (review I1).
 const JOB = 'b'.repeat(32);

-function streamFixture({ modal = false, postFails = false } = {}) {
+function streamFixture({ postFails = false } = {}) {
    const posts = [];
    const warnings = [];
    const gets = [];
@@ -146,18 +147,20 @@ function streamFixture({ modal = false, postFails = false } = {}) {
                return { success: true };
            } } });
    const emit = (type, data) => (listeners[type] || []).forEach(handler => handler({ data: JSON.stringify(data) }));
+    // The dialog's Cancel runs the handler and from then on reads as cancelled, as the startup dialog does.
+    let cancelled = false;
    const ui = { addStatusMessage() {}, progressText: element(), progressPercent: element(), progressBar: element(),
-        progressDetails: element(), progressETA: element(), isCancelled: () => false,
-        onCancel: handler => { ui.cancel = handler; } };
-    const result = modal ? manager.generateThumbnailsWithProgressInModal(ui)
-        : manager.generateThumbnailsWithProgress({ quality: 'medium' });
+        progressDetails: element(), progressETA: element(), isCancelled: () => cancelled,
+        onCancel: handler => { ui.cancel = () => { cancelled = true; handler(); }; } };
+    const result = manager.generateThumbnailsWithProgressInModal(ui);
    const outcome = result.then(value => ({ value }), error => ({ error: error.message }));
-    const cancel = () => (modal ? ui.cancel() : elements.cancelThumbnailsBtn.click());
+    const cancel = () => ui.cancel();
    const settle = () => new Promise(resolve => setImmediate(resolve));
    return { emit, source, posts, gets, warnings, outcome, cancel, settle };
 }

 const cancelUrl = id => `/prompt_manager/jobs/${id}/cancel`;
+const CANCELLED = 'Thumbnail generation cancelled; previews already written are kept';

 test('Cancel before the job id arrives cancels that job once it does', async () => {
    const f = streamFixture();
@@ -165,8 +168,8 @@ test('Cancel before the job id arrives cancels that job once it does', async ()
    await f.settle();
    assert.deepEqual(f.posts, []);
    assert.equal(f.source.closed, 0); // kept open until the stream names its job
-    assert.deepEqual(await f.outcome, { error: 'Thumbnail generation cancelled by user' });
-    f.emit('status', { phase: 'scanning', message: 'Scanning…' });
+    assert.deepEqual(await f.outcome, { error: CANCELLED });
+    // The job frame is the stream's first (the dialog closes the stream on any later frame once cancelled).
    f.emit('job', { id: JOB, started: true });
    await f.settle();
    assert.equal(JSON.stringify(f.posts), JSON.stringify([[cancelUrl(JOB), {}]]));
@@ -185,7 +188,7 @@ test('Cancel after the id cancels it at once, and a double Cancel posts once', a
    await f.settle();
    assert.equal(JSON.stringify(f.posts), JSON.stringify([[cancelUrl(JOB), {}]]));
    assert.equal(f.source.closed, 1);
-    assert.deepEqual(await f.outcome, { error: 'Thumbnail generation cancelled by user' });
+    assert.deepEqual(await f.outcome, { error: CANCELLED });
    assert.deepEqual(f.gets, []);
 });

@@ -216,11 +219,11 @@ test('a cancel post that fails is reported, not thrown', async () => {
    await f.settle();
    assert.equal(f.posts.length, 1);
    assert.equal(f.warnings.length, 1);
-    assert.deepEqual(await f.outcome, { error: 'Thumbnail generation cancelled by user' });
+    assert.deepEqual(await f.outcome, { error: CANCELLED });
 });

 test('the startup dialog cancels its own job by id too', async () => {
-    const f = streamFixture({ modal: true });
+    const f = streamFixture();
    f.cancel();
    await f.settle();
    assert.deepEqual(f.posts, []);
@@ -65,109 +65,12 @@ function load(file, className, fetchUrl, extra = {}, dom = elements()) {

 const BUSY = 'Scan for metadata already running';

-test('gallery cache clear reports a refused server clear and never claims success', async () => {
-    const calls = [];
-    const { page, dom, notifications, storage } = load('gallery.js', 'GalleryManager', async url => {
-        calls.push(url);
-        return jsonResponse(409, { success: false, error: BUSY });
-    });
-    page.getSettings = () => ({ thumbnailsGenerated: true });
-    dom.getElementById('thumbnailStatus').textContent = 'Generated';
-
-    await page.clearCache();
-
-    assert.deepEqual(calls, ['/prompt_manager/images/clear-thumbnails']);
-    assert.deepEqual(notifications, [['error', `Thumbnails were not cleared: ${BUSY}`]]);
-    assert.equal(dom.nodes.thumbnailStatus.textContent, 'Generated');
-    assert.equal(storage.get('gallerySettings'), undefined); // thumbnailsGenerated is not reset
-});
-
-test('gallery cache clear says what it cleared and keeps preferences and other data (#222)', async () => {
-    const calls = [];
-    const { page, dom, notifications, storage } = load('gallery.js', 'GalleryManager', async url => {
-        calls.push(url);
-        return jsonResponse(200, { success: true, cleared_count: 3 });
-    });
-    page.getSettings = () => ({ thumbnailsGenerated: true });
-
-    await page.clearCache();
-
-    // The server's thumbnails are cleared by their own explicit call; nothing Prompt Manager owns is cached in this
-    // browser, so no browser entry is removed and the toast says exactly that.
-    assert.deepEqual(calls, ['/prompt_manager/images/clear-thumbnails']);
-    assert.deepEqual(notifications, [['success',
-        "Thumbnails cleared; original images untouched. Nothing of Prompt Manager's is cached in this browser."]]);
-    assert.equal(dom.nodes.thumbnailStatus.textContent, 'Not generated');
-    assert.equal(JSON.parse(storage.get('gallerySettings')).thumbnailsGenerated, false);
-    assert.equal(storage.get('userData'), 'keep');
-    assert.equal(storage.get('pm_cached'), '1');
-    assert.equal(storage.get('pm_workspace_theme'), 'light');
-    assert.equal(storage.get('pm_update_notice_dismissed'), '3.3.0');
-});
-
-test("gallery cache clear never deletes another tool's gallery or thumbnail caches (#222)", async () => {
-    const names = new Set(['comfy-gallery', 'thumbnail-cache']);
-    const caches = { keys: async () => [...names], delete: async name => names.delete(name) };
-    const { page, notifications } = load('gallery.js', 'GalleryManager',
-        async () => jsonResponse(200, { success: true }), { caches, window: { caches } });
-    page.getSettings = () => ({});
-
-    await page.clearCache();
-
-    assert.deepEqual([...names], ['comfy-gallery', 'thumbnail-cache']);
-    assert.equal(notifications.at(-1)[0], 'success');
-});
-
-test('gallery cache clear reports a lost server clear instead of success', async () => {
-    const { page, dom, notifications, storage } = load('gallery.js', 'GalleryManager', async () => {
-        throw new TypeError('Failed to fetch');
-    });
-    page.getSettings = () => ({ thumbnailsGenerated: true });
-    dom.getElementById('thumbnailStatus').textContent = 'Generated';
-
-    await page.clearCache();
-
-    assert.deepEqual(notifications, [['error', 'Thumbnails were not cleared: the server could not be reached.']]);
-    assert.equal(dom.nodes.thumbnailStatus.textContent, 'Generated');
-    assert.equal(storage.get('gallerySettings'), undefined);
-});
-
-test('gallery cache clear says so when browser storage is denied', async () => {
-    const denied = { get length() { throw new Error('SecurityError'); }, key() { throw new Error('SecurityError'); },
-        getItem() { throw new Error('SecurityError'); }, setItem() { throw new Error('SecurityError'); },
-        removeItem() { throw new Error('SecurityError'); } };
-    const { page, notifications } = load('gallery.js', 'GalleryManager',
-        async () => jsonResponse(200, { success: true }), { localStorage: denied });
-    page.getSettings = () => ({});
-
-    await page.clearCache();
-
-    assert.deepEqual(notifications, [['warning',
-        'Thumbnails cleared; original images untouched. This browser refused access to its storage, so nothing there was cleared.']]);
-});
-
-test('admin LoRA import shows a refusal frame and closes its modal', async () => {
-    const { page, dom, timers, notifications } = load('admin.js', 'PromptAdmin',
-        async () => sseResponse([{ type: 'error', status: BUSY, progress: 0, message: BUSY }]));
-    page.saveLoraSettings = async () => true;
-    page.loadStatistics = () => assert.fail('a refused import must not reload statistics');
-
-    await page.runLoraImport();
-
-    assert.equal(dom.nodes.loraImportStatus.textContent, `Error: ${BUSY}`);
-    assert.deepEqual(notifications.filter(([type]) => type === 'error'), [['error', `LoRA import failed: ${BUSY}`]]);
-    assert.equal(timers.length, 1);
-    timers[0]();
-    assert.deepEqual(notifications.at(-1), ['hide', 'loraImportModal']);
-});
-
 test('admin settings save shows why config.json refused it', async () => {
    const message = 'config.json cannot be read, so nothing was saved. Fix or remove the file, then save again.';
    const { page, notifications } = load('admin.js', 'PromptAdmin',
        async () => jsonResponse(409, { success: false, persisted: false, code: 'config-unreadable', error: message }));
    page.settings = {};
-    page._collectScanPaths = () => [];
-    page.saveLoraSettings = async () => assert.fail('nothing else is saved after a refusal');
+    page.setInfiniteScroll = () => assert.fail('nothing changes after a refusal');

    await page.saveSettings();

@@ -178,27 +81,30 @@ test('admin settings save keeps its plain message when the reply has no reason',
    const { page, notifications } = load('admin.js', 'PromptAdmin', async () => ({ ok: false, status: 500,
        json: async () => { throw new SyntaxError('not json'); } }));
    page.settings = {};
-    page._collectScanPaths = () => [];

    await page.saveSettings();

    assert.deepEqual(notifications, [['error', 'Failed to save settings']]);
 });

-test('admin maintenance names the job that refused it', async () => {
-    const { page, dom, notifications } = load('admin.js', 'PromptAdmin',
-        async () => jsonResponse(409, { success: false, error: BUSY }), {
-            escapeHtml: text => String(text),
-            document: { readyState: 'loading', addEventListener() {}, getElementById: id => dom.getElementById(id),
-                querySelectorAll: selector => (selector === '.maintenance-option:checked' ? [{ id: 'vacuum' }] : []) },
-        });
+// #330 S13-9: the admin page's reduced Page options save sends only the list's scroll default, so a stale legacy form
+// can no longer overwrite scan folders or other settings edited in System.
+test('admin Page options save posts only infinite_scroll', async () => {
+    const sent = [];
+    const { page, dom, notifications } = load('admin.js', 'PromptAdmin', async (url, init) => {
+        sent.push([url, init.method, JSON.parse(init.body)]);
+        return jsonResponse(200, { success: true, restart_required: true });
+    });
+    page.settings = { infiniteScroll: false };
+    const scrolled = [];
+    page.setInfiniteScroll = (on, options) => scrolled.push([on, { ...options }]);
+    dom.getElementById('infiniteScrollDefault').checked = true;

-    await page.runMaintenance();
+    await page.saveSettings();

-    const results = dom.nodes.maintenanceResults.innerHTML;
-    assert.match(results, /Maintenance Failed/);
-    assert.match(results, new RegExp(BUSY));
-    assert.doesNotMatch(results, /HTTP 409/);
-    assert.deepEqual(notifications, [['error', '❌ Maintenance failed']]);
-    assert.equal(dom.nodes.runMaintenanceBtn.disabled, false);
+    assert.deepEqual(sent, [['/prompt_manager/settings', 'POST', { infinite_scroll: true }]]);
+    assert.deepEqual(scrolled, [[true, { session: false }]]);
+    assert.equal(page.settings.infiniteScroll, true);
+    assert.deepEqual(notifications, [['success', 'Page options saved'], ['hide', 'settingsModal']]);
 });
+
@@ -264,6 +264,41 @@ class TestRestoreRoute(BackupRestoreTestCase):
        texts = sorted(p["text"] for p in self.api.db.search_prompts())
        self.assertEqual(texts, ["restored a", "restored b"])

+    async def test_restore_round_trip_keeps_tags_and_image_links(self):
+        """A downloaded backup brings back every prompt with its tags and images.
+
+        The legacy admin page's Restore form left for System (#330); this keeps
+        its browser test's data check at the route.
+        """
+        db = self.api.db
+        originals = {}
+        for text, tags, image in (
+            ("round trip cat", ["cats", "pets"], "cat.png"),
+            ("round trip dog", ["dogs"], "dog.png"),
+        ):
+            prompt_id = db.save_prompt(
+                text=text, tags=tags, prompt_hash=generate_prompt_hash(text)
+            )
+            path = self._write(image, b"\x89PNG\r\n\x1a\n")
+            self.assertTrue(db.link_image_to_prompt(str(prompt_id), path))
+            originals[text] = (prompt_id, sorted(tags), [path])
+
+        resp = await self.client.get("/prompt_manager/backup")
+        self.assertEqual(resp.status, 200)
+        backup = self._write("downloaded.db", await resp.read())
+        self.assertTrue(db.delete_prompt(originals["round trip dog"][0]))
+
+        resp = await self._restore(backup)
+        self.assertEqual(resp.status, 200, await resp.text())
+
+        restored = {p["text"]: p for p in self.api.db.search_prompts()}
+        self.assertEqual(sorted(restored), sorted(originals))
+        for text, (prompt_id, tags, paths) in originals.items():
+            self.assertEqual(restored[text]["id"], prompt_id)
+            self.assertEqual(sorted(restored[text]["tags"]), tags)
+            images = self.api.db.get_prompt_images(str(prompt_id))
+            self.assertEqual([image["image_path"] for image in images], paths)
+
    async def test_restore_leaves_no_temp_files_behind(self):
        upload = self._make_db_file(["restored"])
        created = []
@@ -0,0 +1,463 @@
+"""Work running at Ctrl+C stops at its next safe point (#376).
+
+ComfyUI catches Ctrl+C in ``main.py`` and returns without closing its event
+loop. Python then joins every executor thread (``concurrent.futures``'s
+``_python_exit``, a ``threading._register_atexit`` callback) before any
+``atexit`` callback runs, so a call still running on the default executor
+used to keep the process alive until it returned. The package registers its
+own ``threading._register_atexit`` hook, which runs before that join: it sets
+the exit signal that ``Job.cancelled`` and ``map_parallel`` read, and kills
+the encoder processes.
+
+The child-process test starts three long calls on the default executor (a
+registry job checking ``job.cancelled`` between files, a ``map_parallel``
+batch and an encoder process that ignores the exit, as ffmpeg does on
+Windows), returns from its main module and must exit far sooner than any of
+them would end.
+"""
+
+import json
+import os
+import subprocess
+import sys
+import tempfile
+import textwrap
+import threading
+import unittest
+from unittest import mock
+
+ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+sys.path.insert(0, ROOT)
+
+try:
+    from utils import exit_signal  # noqa: E402
+except ImportError:  # before #376: only the child-process test can run
+    exit_signal = None
+
+# The parent never waits longer than this for the child (the hang watchdog
+# allows 120 s per test). Each fake job alone would run 300 s or more.
+CHILD_CEILING_SECONDS = 60
+# From the child's return to its last atexit callback: the stopped calls end
+# at their next file, item or chunk (the encoder is killed).
+EXIT_BOUND_SECONDS = 15
+JOB_SECONDS = 600
+# The fake encoder outlives the ceiling, yet a failing run leaks it only
+# briefly (the parent cannot reach the child's own child to kill it).
+ENCODER_SECONDS = 90
+REPORT_PREFIX = "PM_EXIT_REPORT "
+
+CHILD = textwrap.dedent("""
+    import asyncio
+    import atexit
+    import contextlib
+    import importlib
+    import io
+    import json
+    import os
+    import sys
+    import threading
+    import time
+
+    root, tmp = sys.argv[1], sys.argv[2]
+    job_seconds, encoder_seconds = float(sys.argv[3]), int(sys.argv[4])
+    sys.path.insert(0, root)
+    state = {"stopped": {}}
+
+    def report():
+        returned = state.get("returned")
+        print("PM_EXIT_REPORT " + json.dumps({
+            "exit_seconds": None if returned is None else time.monotonic() - returned,
+            "stopped": state["stopped"],
+        }))
+        sys.stdout.flush()
+
+    # Registered first, so it runs after every other atexit callback, and
+    # every atexit callback runs after the executor threads were joined.
+    atexit.register(report)
+
+    from tests.test_init_package import _import_package, fake_server_module
+
+    output = os.path.join(tmp, "output")
+    with contextlib.redirect_stdout(io.StringIO()):
+        package, _ = _import_package(
+            "pm_exit_child",
+            os.path.join(tmp, "prompts.db"),
+            output,
+            fake_server_module(queue_task_done=True),
+        )
+    parallel = importlib.import_module("pm_exit_child.utils.parallel")
+    encode = importlib.import_module("pm_exit_child.py.api.thumbnail_encode")
+    registry = package.api._jobs
+    entered = {name: threading.Event() for name in ("job", "batch", "encoder")}
+
+    def job_work(job):
+        # A job's thread work: one "file" at a time, checking its cancel
+        # between files the way the thumbnail and import jobs do.
+        entered["job"].set()
+        deadline = time.monotonic() + job_seconds
+        while time.monotonic() < deadline:
+            if job.cancelled:
+                state["stopped"]["job"] = True
+                return
+            time.sleep(0.05)
+
+    def batch_item(index):
+        entered["batch"].set()
+        time.sleep(0.5)
+        return index
+
+    def batch_work():
+        try:
+            parallel.map_parallel(batch_item, range(int(job_seconds)), 2)
+        except Exception as error:
+            state["stopped"]["batch"] = type(error).__name__
+
+    def encoder_work():
+        # Stands for ffmpeg on Windows, which runs without a console and
+        # never sees Ctrl+C: only a kill ends it before its timeout.
+        cmd = [sys.executable, "-c", "import time; time.sleep(%d)" % encoder_seconds]
+        try:
+            encode.run_encoder(
+                cmd,
+                timeout=encoder_seconds,
+                track=lambda _process: entered["encoder"].set(),
+            )
+        except Exception as error:
+            state["stopped"]["encoder"] = type(error).__name__
+
+    async def begin():
+        loop = asyncio.get_running_loop()
+
+        async def runner(job):
+            await loop.run_in_executor(None, job_work, job)
+
+        registry.start("exit-test", "Exit test", admission="read", runner=runner)
+        loop.run_in_executor(None, batch_work)
+        loop.run_in_executor(None, encoder_work)
+        for name, event in entered.items():
+            if not await loop.run_in_executor(None, event.wait, 30):
+                sys.exit("not started: " + name)
+
+    loop = asyncio.new_event_loop()
+    asyncio.set_event_loop(loop)
+    loop.run_until_complete(begin())
+    state["returned"] = time.monotonic()
+    # Return with the three calls running and the loop open, as ComfyUI does
+    # after Ctrl+C.
+    """)
+
+
+class TestExitStopsRunningWork(unittest.TestCase):
+    def test_running_executor_work_stops_at_exit(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            os.makedirs(os.path.join(tmp, "output"))
+            script = os.path.join(tmp, "child.py")
+            with open(script, "w", encoding="utf-8") as handle:
+                handle.write(CHILD)
+            env = dict(os.environ)
+            env.pop("PROMPT_MANAGER_CONFIG_PATH", None)
+            env["PROMPT_MANAGER_DATA_DIR"] = tmp
+            env["PYTHONIOENCODING"] = "utf-8"
+            try:
+                completed = subprocess.run(
+                    [
+                        sys.executable,
+                        script,
+                        ROOT,
+                        tmp,
+                        str(JOB_SECONDS),
+                        str(ENCODER_SECONDS),
+                    ],
+                    cwd=ROOT,
+                    env=env,
+                    capture_output=True,
+                    timeout=CHILD_CEILING_SECONDS,
+                    encoding="utf-8",
+                    errors="replace",
+                )
+            except subprocess.TimeoutExpired as hung:
+                self.fail(
+                    f"the child did not exit within {CHILD_CEILING_SECONDS} s\n"
+                    f"stdout:\n{hung.stdout}\nstderr:\n{hung.stderr}"
+                )
+        detail = f"stdout:\n{completed.stdout}\nstderr:\n{completed.stderr}"
+        self.assertEqual(completed.returncode, 0, detail)
+        reports = [
+            line[len(REPORT_PREFIX) :]
+            for line in completed.stdout.splitlines()
+            if line.startswith(REPORT_PREFIX)
+        ]
+        self.assertEqual(len(reports), 1, detail)
+        report = json.loads(reports[0])
+        self.assertLess(report["exit_seconds"], EXIT_BOUND_SECONDS, detail)
+        self.assertEqual(
+            report["stopped"],
+            {"job": True, "batch": "ExitRequested", "encoder": "EncoderClosed"},
+            detail,
+        )
+        for text in ("Traceback", "Background work not stopped in time"):
+            self.assertNotIn(text, completed.stderr, detail)
+
+
+class _Isolated(unittest.TestCase):
+    """Each test starts with the signal clear and no hook installed."""
+
+    def setUp(self):
+        exit_signal.reset()
+        self.addCleanup(exit_signal.reset)
+
+
+class TestInstall(_Isolated):
+    def test_the_hook_is_registered_once_before_the_executor_join(self):
+        calls = []
+        with mock.patch.object(
+            exit_signal.threading,
+            "_register_atexit",
+            side_effect=lambda func: calls.append(func),
+            create=True,
+        ):
+            self.assertTrue(exit_signal.install())
+            self.assertTrue(exit_signal.install())
+        self.assertEqual(len(calls), 1)
+        self.assertFalse(exit_signal.requested())
+        calls[0]()
+        self.assertTrue(exit_signal.requested())
+
+    def test_a_missing_internal_hook_degrades_to_the_old_exit(self):
+        with mock.patch.object(exit_signal, "threading") as fake:
+            del fake._register_atexit
+            self.assertFalse(exit_signal.install())
+        self.assertFalse(exit_signal.requested())
+
+    def test_a_refused_registration_degrades_to_the_old_exit(self):
+        refuse = RuntimeError("can't register atexit after shutdown")
+        with mock.patch.object(
+            exit_signal.threading, "_register_atexit", side_effect=refuse, create=True
+        ):
+            self.assertFalse(exit_signal.install())
+
+    def test_a_failing_exit_action_never_escapes_the_hook(self):
+        # An exception out of a threading atexit callback would abort
+        # threading._shutdown and skip the executor join itself.
+        calls = []
+
+        def boom():
+            raise KeyboardInterrupt  # a second Ctrl+C
+
+        with mock.patch.object(
+            exit_signal.threading,
+            "_register_atexit",
+            side_effect=lambda func: calls.append(func),
+            create=True,
+        ):
+            exit_signal.install(boom)
+        with self.assertLogs(exit_signal.logger, "ERROR"):
+            calls[0]()
+        self.assertTrue(exit_signal.requested())
+
+
+class TestCheckpoints(_Isolated):
+    def test_checked_runs_until_the_signal_then_raises(self):
+        seen = []
+        record = exit_signal.checked(seen.append)
+        record(1)
+        exit_signal.request()
+        with self.assertRaises(exit_signal.ExitRequested):
+            record(2)
+        self.assertEqual(seen, [1])
+
+    def test_map_parallel_starts_no_item_after_the_signal(self):
+        from utils.parallel import map_parallel
+
+        started = []
+        gate = threading.Event()
+
+        def item(index):
+            started.append(index)
+            if index == 0:
+                exit_signal.request()
+                gate.set()
+            return index
+
+        with self.assertRaises(exit_signal.ExitRequested):
+            map_parallel(item, range(50), 1)
+        self.assertTrue(gate.is_set())
+        self.assertEqual(started, [0])
+
+    def test_job_cancelled_follows_the_signal_and_its_own_cancel(self):
+        from py.api.jobs import Job
+
+        job = Job("scan", "Scan", admission="records")
+        self.assertFalse(job.cancelled)
+        job.cancelled = True
+        self.assertTrue(job.cancelled)
+        other = Job("scan", "Scan", admission="records", cancellable=False)
+        exit_signal.request()
+        self.assertTrue(other.cancelled)
+
+    def test_the_scan_walk_stops_between_directories(self):
+        from py.api.admin import _collect_media_files
+
+        with tempfile.TemporaryDirectory() as tmp:
+            for name in ("a", "b"):
+                os.makedirs(os.path.join(tmp, name))
+                with open(os.path.join(tmp, name, "x.png"), "wb") as image:
+                    image.write(b"x")
+            self.assertEqual(len(_collect_media_files([tmp], [".png"])), 2)
+            exit_signal.request()
+            with self.assertRaises(exit_signal.ExitRequested):
+                _collect_media_files([tmp], [".png"])
+
+
+class TestLoraImportStopsAtExit(_Isolated):
+    def test_staging_stops_before_the_next_sidecar_whatever_the_caller_checks(self):
+        import types
+
+        from py import lora_import
+
+        discovery = types.SimpleNamespace(
+            sidecars=[object(), object()], unreadable=[], layout=None
+        )
+        exit_signal.request()
+        with tempfile.TemporaryDirectory() as tmp:
+            with self.assertRaises(lora_import.ImportCancelled):
+                lora_import.stage(
+                    discovery,
+                    tmp,
+                    media_extensions=frozenset(),
+                    cancelled=lambda: False,  # the legacy scan's own check
+                )
+
+
+class _FakeTqdm:
+    """huggingface_hub.utils.tqdm as far as a download uses it."""
+
+    def __init__(self, *args, **kwargs):
+        self.n = 0
+
+    def update(self, n=1):
+        self.n += n
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *exc):
+        return False
+
+
+def _fake_hub(chunks_before_exit):
+    """A ``huggingface_hub`` whose download writes chunks to a temp file and,
+    like huggingface_hub 1.x, removes it on any failure before the rename."""
+    import types
+
+    def hf_hub_download(
+        repo_id, filename, local_dir=None, local_dir_use_symlinks=None, tqdm_class=None
+    ):
+        final = os.path.join(local_dir, filename)
+        partial = final + ".abc.incomplete"
+        bar = (tqdm_class or _FakeTqdm)(total=10)
+        try:
+            with open(partial, "wb") as handle:
+                for index in range(10):
+                    if index == chunks_before_exit:
+                        exit_signal.request()
+                    bar.update(1)
+                    handle.write(b"x")
+            os.replace(partial, final)
+        finally:
+            if os.path.exists(partial):
+                os.unlink(partial)
+        return final
+
+    hub = types.ModuleType("huggingface_hub")
+    hub.hf_hub_download = hf_hub_download
+    hub.snapshot_download = lambda **kwargs: None
+    utils = types.ModuleType("huggingface_hub.utils")
+    utils.tqdm = _FakeTqdm
+    hub.utils = utils
+    return {"huggingface_hub": hub, "huggingface_hub.utils": utils}
+
+
+class TestModelDownloadStopsAtExit(_Isolated):
+    def test_a_download_stops_between_chunks_and_leaves_no_file(self):
+        from py.autotag import AutoTagService
+
+        with tempfile.TemporaryDirectory() as tmp:
+            service = AutoTagService(models_dir=tmp)
+            with mock.patch.dict(sys.modules, _fake_hub(chunks_before_exit=3)):
+                with self.assertLogs(service.logger, "INFO") as logs:
+                    self.assertFalse(service.download_model("wd14-vit"))
+            folder = os.path.join(tmp, "WD14-ViT")
+            self.assertEqual(os.listdir(folder), [])
+        self.assertTrue(any("exiting" in line for line in logs.output), logs.output)
+        self.assertFalse(any("Download failed" in line for line in logs.output))
+
+    def test_a_download_without_the_signal_finishes(self):
+        from py.autotag import AutoTagService
+
+        with tempfile.TemporaryDirectory() as tmp:
+            service = AutoTagService(models_dir=tmp)
+            with mock.patch.dict(sys.modules, _fake_hub(chunks_before_exit=None)):
+                self.assertTrue(service.download_model("wd14-vit"))
+            folder = os.path.join(tmp, "WD14-ViT")
+            self.assertEqual(
+                sorted(os.listdir(folder)), ["model.onnx", "selected_tags.csv"]
+            )
+
+    def test_xet_transfers_are_aborted_the_way_hub_aborts_on_ctrl_c(self):
+        import types
+
+        from py.autotag import abort_hub_downloads
+
+        aborted = []
+        xet = types.ModuleType("huggingface_hub.utils._xet")
+        xet.abort_xet_session = lambda: aborted.append(True)
+        hub = _fake_hub(chunks_before_exit=None)
+        hub["huggingface_hub.utils._xet"] = xet
+        hub["huggingface_hub.utils"]._xet = xet
+        with mock.patch.dict(sys.modules, hub):
+            abort_hub_downloads()
+        self.assertEqual(aborted, [True])
+        with mock.patch.dict(sys.modules):
+            sys.modules.pop("huggingface_hub", None)
+            abort_hub_downloads()  # never imported: nothing to abort
+        self.assertEqual(aborted, [True])
+
+    def test_an_aborted_xet_download_is_logged_as_stopped(self):
+        from py.autotag import AutoTagService
+
+        hub = _fake_hub(chunks_before_exit=None)
+
+        def aborted(*args, **kwargs):
+            exit_signal.request()  # the hook ran, then hub raised
+            raise RuntimeError("xet session aborted")
+
+        hub["huggingface_hub"].hf_hub_download = aborted
+        with tempfile.TemporaryDirectory() as tmp:
+            service = AutoTagService(models_dir=tmp)
+            with mock.patch.dict(sys.modules, hub):
+                with self.assertLogs(service.logger, "INFO") as logs:
+                    self.assertFalse(service.download_model("wd14-vit"))
+        self.assertTrue(any("exiting" in line for line in logs.output), logs.output)
+        self.assertFalse(any("Download failed" in line for line in logs.output))
+
+    def test_an_old_hub_without_tqdm_class_downloads_as_before(self):
+        from py.autotag import AutoTagService
+
+        hub = _fake_hub(chunks_before_exit=None)
+        full = hub["huggingface_hub"].hf_hub_download
+
+        def old_download(
+            repo_id, filename, local_dir=None, local_dir_use_symlinks=None
+        ):
+            return full(repo_id, filename, local_dir, local_dir_use_symlinks)
+
+        hub["huggingface_hub"].hf_hub_download = old_download
+        with tempfile.TemporaryDirectory() as tmp:
+            service = AutoTagService(models_dir=tmp)
+            with mock.patch.dict(sys.modules, hub):
+                self.assertTrue(service.download_model("wd14-vit"))
+
+
+if __name__ == "__main__":
+    unittest.main()
@@ -67,6 +67,45 @@ const browserJobIds = [...allJobs].filter(([, body]) => /npm run --prefix tools\
 const mergeJob = () => allJobs.get('frontend-coverage-merge');
 const verifyStep = () => steps(mergeJob()).find(step => /name: Verify every shard's raw coverage arrived/.test(step));

+// Jobs that run only in the merge queue, on main and on demand (#420): skipped on pull_request.
+const QUEUE_ONLY_IF = /^ {4}if: github\.event_name != 'pull_request'$/m;
+const EVENTS = ['pull_request', 'merge_group', 'push', 'workflow_dispatch'];
+
+function gateVariables(jobText) {
+    return new Map([...jobText.matchAll(/^ {10}([A-Z_]+): \$\{\{ needs\.([\w-]+)\.result \}\}$/gm)]
+        .map(match => [match[2], match[1]]));
+}
+
+function runGate(jobText, env) {
+    const script = runScript(steps(jobText).find(step => /run: \|/.test(step)));
+    try {
+        execFileSync('bash', ['--noprofile', '--norc', '-eo', 'pipefail', '-c', script], { env: { PATH: process.env.PATH, ...env }, stdio: 'pipe' });
+        return true;
+    } catch {
+        return false;
+    }
+}
+
+// A gate passes only when every always-on job succeeded and every queue-only job is skipped on a
+// pull request and succeeded on every other event. Anything else fails it.
+function assertGateBehaviour(jobText, queueOnly) {
+    assert.match(jobText, /^ {10}EVENT_NAME: \$\{\{ github\.event_name \}\}$/m, 'the gate knows the event');
+    const variables = gateVariables(jobText);
+    for (const id of queueOnly) assert.ok(variables.has(id), `${id} reaches the gate`);
+    for (const event of EVENTS) {
+        const expected = id => (queueOnly.includes(id) && event === 'pull_request' ? 'skipped' : 'success');
+        const green = Object.fromEntries([...variables].map(([id, name]) => [name, expected(id)]));
+        assert.equal(runGate(jobText, { ...green, EVENT_NAME: event }), true, `${event}: the expected results pass`);
+        for (const [id, name] of variables) {
+            for (const result of ['success', 'failure', 'cancelled', 'skipped']) {
+                if (result === expected(id)) continue;
+                assert.equal(runGate(jobText, { ...green, EVENT_NAME: event, [name]: result }), false,
+                    `${event}: ${id}=${result} must fail the gate`);
+            }
+        }
+    }
+}
+
 test('viewerjs keeps its name and needs every frontend job', () => {
    const viewerjs = allJobs.get('viewerjs');
    assert.ok(viewerjs, 'the required context is the job id viewerjs');
@@ -76,32 +115,17 @@ test('viewerjs keeps its name and needs every frontend job', () => {
    assert.deepEqual([...needs].sort(), [...others].sort(), 'viewerjs needs every other job in the workflow');
    assert.deepEqual([...needs].sort(), ['browser-workflows', 'frontend-coverage', 'frontend-coverage-merge']);
    assert.match(viewerjs, /^ {4}if: always\(\)$/m, 'viewerjs runs (and fails) when a needed job failed or was skipped');
-    const script = runScript(steps(viewerjs).find(step => /run: \|/.test(step)));
-    for (const id of needs) {
-        const variable = new RegExp(`^ {10}([A-Z_]+): \\$\\{\\{ needs\\.${id}\\.result \\}\\}$`, 'm').exec(viewerjs);
-        assert.ok(variable, `${id}'s result reaches the check`);
-        assert.match(script, new RegExp(`test "\\$${variable[1]}" = success`), `${id} must be exactly success`);
-    }
+    assert.deepEqual([...gateVariables(viewerjs).keys()].sort(), [...needs].sort(), 'every needed result reaches the check');
 });

-test('viewerjs fails unless every needed job succeeded', () => {
-    const viewerjs = allJobs.get('viewerjs');
-    const script = runScript(steps(viewerjs).find(step => /run: \|/.test(step)));
-    const variables = [...viewerjs.matchAll(/^ {10}([A-Z_]+): \$\{\{ needs\.[\w-]+\.result \}\}$/gm)].map(match => match[1]);
-    const run = env => {
-        try {
-            execFileSync('bash', ['--noprofile', '--norc', '-eo', 'pipefail', '-c', script], { env: { PATH: process.env.PATH, ...env }, stdio: 'pipe' });
-            return true;
-        } catch {
-            return false;
-        }
-    };
-    const allSuccess = Object.fromEntries(variables.map(name => [name, 'success']));
-    assert.equal(run(allSuccess), true);
-    for (const name of variables) {
-        for (const result of ['failure', 'cancelled', 'skipped']) {
-            assert.equal(run({ ...allSuccess, [name]: result }), false, `${name}=${result} must fail viewerjs`);
-        }
+test('viewerjs requires the browser shards everywhere but on a pull request', () => {
+    assertGateBehaviour(allJobs.get('viewerjs'), ['browser-workflows']);
+});
+
+test('Firefox/WebKit page workflows run only outside pull requests; coverage runs on every event', () => {
+    assert.match(allJobs.get('browser-workflows'), QUEUE_ONLY_IF);
+    for (const id of ['frontend-coverage', 'frontend-coverage-merge']) {
+        assert.doesNotMatch(allJobs.get(id), /^ {4}if:/m, `${id} runs on every event`);
    }
 });

@@ -224,7 +248,8 @@ test('browser job timeouts keep a real margin over measured runs', () => {
 });

 // Every job is bounded (#350): a hang ends at a measured limit instead of GitHub's 6-hour default.
-const BOUNDED_WORKFLOWS = ['test.yml', 'code-quality.yml', 'viewerjs-check.yml'];
+const GATING_WORKFLOWS = ['test.yml', 'code-quality.yml', 'viewerjs-check.yml'];
+const BOUNDED_WORKFLOWS = [...GATING_WORKFLOWS, 'portability.yml'];
 const readWorkflow = name => readFileSync(new URL(`../../.github/workflows/${name}`, import.meta.url), 'utf8');

 test('every job in the CI workflows has a numeric timeout-minutes', () => {
@@ -276,3 +301,73 @@ test('the bandit pre-commit hook fails at the severity CI enforces and passes ev
    assert.doesNotMatch(hook, /true|exit-zero|bash -c/, 'nothing masks the exit code or drops a file');
    assert.doesNotMatch(hook, /pass_filenames: false/, 'the hook scans the staged files');
 });
+
+// Event split (#420): pull requests run a fast subset, the merge queue and main run everything.
+const testJobs = () => jobs(readWorkflow('test.yml'));
+
+test('the Python matrix is Linux 3.12 on a pull request and Linux 3.12-3.14 on every other event', () => {
+    const body = testJobs().get('test');
+    assert.deepEqual(matrixList(body, 'os'), ['ubuntu-latest'], 'Windows and macOS never gate a merge');
+    const match = /^ {8}python-version: \$\{\{ github\.event_name == 'pull_request' && fromJSON\('(\[[^\]]*\])'\) \|\| fromJSON\('(\[[^\]]*\])'\) \}\}$/m.exec(body);
+    assert.ok(match, 'python-version is chosen by event');
+    assert.deepEqual({ pr: JSON.parse(match[1]), other: JSON.parse(match[2]) }, { pr: ['3.12'], other: ['3.12', '3.13', '3.14'] });
+    assert.match(body, /^ {6}fail-fast: false$/m);
+    assert.match(body, /^ {4}name: py\$\{\{ matrix\.python-version \}\} on \$\{\{ matrix\.os \}\}$/m);
+});
+
+test('Windows and macOS run 3.12-3.14 on main, nightly and on demand, never on a PR or in the queue', () => {
+    const text = readWorkflow('portability.yml');
+    const triggers = text.slice(text.indexOf('\non:'), text.indexOf('\nconcurrency:'));
+    for (const event of ['push', 'schedule', 'workflow_dispatch']) assert.match(triggers, new RegExp(`^ {2}${event}:`, 'm'));
+    for (const event of ['pull_request', 'merge_group']) assert.doesNotMatch(triggers, new RegExp(`^ {2}${event}`, 'm'));
+    assert.match(triggers, /^ {4}branches: \[main\]$/m, 'push runs only for main');
+    const body = jobs(text).get('test');
+    assert.deepEqual(matrixList(body, 'os'), ['windows-latest', 'macos-latest']);
+    assert.deepEqual(matrixList(body, 'python-version'), ['"3.12"', '"3.13"', '"3.14"']);
+    assert.match(body, /^ {6}fail-fast: false$/m);
+    assert.match(body, /^ {8}run: python -m tests\.run_suite -v$/m);
+    assert.doesNotMatch(text, /cancel-in-progress: true|cancel-in-progress: \$/, 'no portability run is cancelled');
+});
+
+test('real ComfyUI runs only outside pull requests; the other test.yml checks run on every event', () => {
+    const found = testJobs();
+    assert.match(found.get('comfyui'), QUEUE_ONLY_IF);
+    for (const id of ['test', 'coverage', 'lint', 'js-test']) {
+        assert.doesNotMatch(found.get(id), /^ {4}if:/m, `${id} runs on every event`);
+    }
+});
+
+test('all tests needs every gating test.yml job and requires the full set outside pull requests', () => {
+    const found = testJobs();
+    const gate = found.get('all-tests');
+    assert.ok(gate, 'the aggregate gate exists');
+    assert.match(gate, /^ {4}name: all tests$/m, 'the required context is "all tests"');
+    assert.match(gate, /^ {4}if: always\(\)$/m);
+    const gating = [...found.keys()].filter(id => !['all-tests', 'perf-budget'].includes(id));
+    assert.deepEqual([...needsOf(gate)].sort(), gating.sort(), 'the gate needs every job but the non-gating perf budget');
+    assert.deepEqual([...gateVariables(gate).keys()].sort(), gating.sort(), 'every needed result reaches the gate');
+    assertGateBehaviour(gate, ['comfyui']);
+});
+
+test('the CI workflows run on pull_request, merge_group and push without path filters', () => {
+    for (const name of GATING_WORKFLOWS) {
+        const text = readWorkflow(name);
+        const triggers = text.slice(text.indexOf('\non:'), text.indexOf('\n', text.indexOf('\non:') + 1) + 400);
+        for (const event of ['merge_group', 'pull_request', 'push']) {
+            assert.match(triggers, new RegExp(`^ {2}${event}:`, 'm'), `${name} runs on ${event}`);
+        }
+        assert.doesNotMatch(text, /^ {4}paths(-ignore)?:/m, `${name} has no path filter that would leave a required check pending`);
+    }
+    assert.doesNotMatch(jobs(readWorkflow('code-quality.yml')).get('security'), /^ {4}if:/m, 'bandit runs on every event');
+});
+
+test('every required check reports on a pull request and the gates carry the full matrix', () => {
+    const contexts = JSON.parse(readRepoFile('.github/branch-protection.json')).required_status_checks.contexts;
+    assert.deepEqual([...contexts].sort(), [
+        'all tests', 'bandit (high severity)', 'black and flake8', 'coverage gate (85%)', 'frontend modules',
+        'py3.12 on ubuntu-latest', 'real ComfyUI compatibility', 'viewerjs',
+    ].sort());
+    assert.equal(contexts.filter(context => /^py/.test(context)).length, 1,
+        'a dropped matrix leg never reports on a pull request, so it cannot be required');
+    assert.ok(!contexts.some(context => /windows|macos/.test(context)), 'Windows and macOS never gate a merge');
+});
@@ -0,0 +1,110 @@
+"""The process exit signal: running work stops at its next safe point (#376).
+
+ComfyUI catches Ctrl+C in ``main.py`` and returns without closing its event
+loop. The interpreter then runs ``threading._shutdown``, which first calls the
+``threading._register_atexit`` callbacks, newest first. One of them,
+``concurrent.futures``'s ``_python_exit``, joins every executor thread, and
+only after that do the ``atexit`` callbacks run (the package teardown). A call
+still running on the default executor (a scan batch, a model download, a
+thumbnail batch) used to keep the process alive until it returned.
+
+``install()`` registers a callback in that same list after ``concurrent.futures``
+did, so it runs before the join. It sets the signal that ``requested()`` reads
+(``Job.cancelled`` and ``map_parallel`` read it) and runs ``on_exit``.
+
+``threading._register_atexit`` is CPython-internal. It has the same contract
+on 3.12, 3.13 and 3.14. Without it, or when it refuses the registration, exit
+behaves as before: the call in flight runs to its end.
+"""
+
+import logging
+import threading
+
+logger = logging.getLogger("prompt_manager.exit")
+
+_requested = threading.Event()
+_install_lock = threading.Lock()
+_installed = False
+_on_exit = []
+
+
+class ExitRequested(Exception):
+    """The interpreter is exiting: work not yet started is not started."""
+
+
+def requested():
+    """True once the interpreter has started exiting."""
+    return _requested.is_set()
+
+
+def request():
+    """Set the signal (the exit hook; tests)."""
+    _requested.set()
+
+
+def checkpoint():
+    """Raise ExitRequested once the interpreter is exiting."""
+    if _requested.is_set():
+        raise ExitRequested("ComfyUI is exiting")
+
+
+def checked(func):
+    """``func`` behind a checkpoint: a call that starts after the signal
+    raises ExitRequested instead of running."""
+
+    def run(*args, **kwargs):
+        checkpoint()
+        return func(*args, **kwargs)
+
+    return run
+
+
+def _hook():
+    """The threading atexit callback. It never raises: an exception here
+    would end ``threading._shutdown`` before it shuts the executors."""
+    _requested.set()
+    for action in tuple(_on_exit):
+        try:
+            action()
+        except (Exception, KeyboardInterrupt):
+            logger.error("Stopping work at exit failed", exc_info=True)
+
+
+def install(on_exit=None):
+    """Register the exit hook once per process; True when it is registered.
+
+    ``on_exit`` (optional) runs inside the hook, after the signal is set.
+    False (logged at DEBUG) when this Python has no ``_register_atexit`` or
+    refuses it; exit then waits for running work as before.
+    """
+    global _installed
+    with _install_lock:
+        if on_exit is not None and on_exit not in _on_exit:
+            _on_exit.append(on_exit)
+        if _installed:
+            return True
+        # Imported first so its pool join is registered before our hook:
+        # the callbacks run newest first, so ours runs before that join.
+        import concurrent.futures.thread  # noqa: F401
+
+        register = getattr(threading, "_register_atexit", None)
+        if not callable(register):
+            logger.debug("threading._register_atexit is missing; exit waits for jobs")
+            return False
+        try:
+            register(_hook)
+        except RuntimeError as error:  # already shutting down
+            logger.debug(f"Exit hook not registered: {error}")
+            return False
+        _installed = True
+        return True
+
+
+def reset():
+    """Clear the signal and forget the registration (tests only; a hook
+    already registered stays in ``threading`` and sets the signal at exit)."""
+    global _installed
+    with _install_lock:
+        _requested.clear()
+        _installed = False
+        _on_exit.clear()
@@ -21,6 +21,8 @@ import logging
 import threading
 from concurrent.futures import ThreadPoolExecutor

+from .exit_signal import checked
+
 SHUTDOWN_REFUSAL = "interpreter shutdown"
 _logger = logging.getLogger("prompt_manager.parallel")
 _noted = set()
@@ -49,8 +51,11 @@ def map_parallel(func, items, workers):
    ``workers`` of 1 (or fewer) runs on the calling thread with no pool. An
    exception in ``func`` propagates to the caller, so callers that must
    survive bad input wrap ``func`` themselves. A pool refused at interpreter
-    exit runs the items it did not start on the calling thread (#375).
+    exit runs the items it did not start on the calling thread (#375). An item
+    that has not started when the interpreter starts exiting raises
+    ExitRequested instead (#376).
    """
+    func = checked(func)
    items = list(items)
    workers = max(1, int(workers or 1))
    if workers == 1 or len(items) <= 1:
@@ -164,27 +164,31 @@
                                class="px-2.5 py-1 bg-pm-surface border border-pm hover:bg-pm-hover text-pm text-xs font-medium rounded-pm-sm transition-colors">
                            Export
                        </button>
-                        <button id="settingsBtn"
-                                class="px-2.5 py-1 bg-pm-surface border border-pm hover:bg-pm-hover text-pm text-xs font-medium rounded-pm-sm transition-colors">
+                        <a id="settingsBtn" href="workspace#/system/overview" target="_blank" rel="noopener"
+                           title="Opens System › Overview in a new tab"
+                           class="px-2.5 py-1 bg-pm-surface border border-pm hover:bg-pm-hover text-pm text-xs font-medium rounded-pm-sm transition-colors">
                            Settings
-                        </button>
+                        </a>
                        <a id="diagnosticsBtn" href="workspace#/system/diagnostics" target="_blank" rel="noopener"
                           title="Opens System › Diagnostics &amp; logs in a new tab"
                           class="px-2.5 py-1 bg-pm-surface border border-pm hover:bg-pm-hover text-pm text-xs font-medium rounded-pm-sm transition-colors">
                            Diagnostics
                        </a>
-                        <button id="maintenanceBtn"
-                                class="px-2.5 py-1 bg-pm-surface border border-pm hover:bg-pm-hover text-pm text-xs font-medium rounded-pm-sm transition-colors">
+                        <a id="maintenanceBtn" href="workspace#/system/maintenance" target="_blank" rel="noopener"
+                           title="Opens System › Maintenance in a new tab"
+                           class="px-2.5 py-1 bg-pm-surface border border-pm hover:bg-pm-hover text-pm text-xs font-medium rounded-pm-sm transition-colors">
                            Maintenance
-                        </button>
-                        <button id="backupBtn"
-                                class="px-2.5 py-1 bg-pm-surface border border-pm hover:bg-pm-hover text-pm text-xs font-medium rounded-pm-sm transition-colors">
+                        </a>
+                        <a id="backupBtn" href="workspace#/system/backups" target="_blank" rel="noopener"
+                           title="Opens System › Backup &amp; export in a new tab"
+                           class="px-2.5 py-1 bg-pm-surface border border-pm hover:bg-pm-hover text-pm text-xs font-medium rounded-pm-sm transition-colors">
                            Backup DB
-                        </button>
-                        <button id="restoreBtn"
-                                class="px-2.5 py-1 bg-pm-surface border border-pm hover:bg-pm-hover text-pm text-xs font-medium rounded-pm-sm transition-colors">
+                        </a>
+                        <a id="restoreBtn" href="workspace#/system/backups" target="_blank" rel="noopener"
+                           title="Opens System › Backup &amp; export in a new tab"
+                           class="px-2.5 py-1 bg-pm-surface border border-pm hover:bg-pm-hover text-pm text-xs font-medium rounded-pm-sm transition-colors">
                            Restore DB
-                        </button>
+                        </a>
                        <button id="scanBtn"
                                class="px-2.5 py-1 bg-pm-surface border border-pm hover:bg-pm-hover text-pm text-xs font-medium rounded-pm-sm transition-colors">
                            Scan Images
@@ -231,11 +235,12 @@
                                </select>
                                <span class="text-xs text-pm-secondary">per page</span>
                            </div>
-                            <!-- Session-only toggle; the saved default lives in Settings -->
+                            <!-- Session-only toggle; the saved default lives in Page options -->
                            <label class="flex items-center gap-1.5 text-xs text-pm-secondary cursor-pointer" title="Load the next page as you scroll (this session)">
                                <input type="checkbox" id="infiniteScrollSession" class="w-3.5 h-3.5 rounded border-pm bg-pm-input text-pm-accent focus:ring-pm-accent">
                                Infinite scroll
                            </label>
+                            <button id="pageOptionsBtn" type="button" class="text-xs text-pm-secondary hover:text-pm-accent underline">Page options</button>
                        </div>
                        <span class="text-xs font-medium text-pm-secondary bg-pm-input px-2 py-0.5 rounded-full" id="resultsCount">Loading...</span>
                    </div>
@@ -369,61 +374,13 @@
    <!-- Settings Modal -->
    <div id="settingsModal" class="fixed inset-0 bg-black/60 backdrop-blur-[2px] hidden items-center justify-center z-50">
        <div class="bg-pm-surface rounded-pm-lg p-4 max-w-lg w-full mx-4 border border-pm max-h-[90vh] overflow-y-auto shadow-pm">
-            <h3 class="text-sm font-semibold text-pm mb-4">Settings</h3>
+            <h3 class="text-sm font-semibold text-pm mb-4">Page options</h3>

            <div class="space-y-4">
-                <!-- Gallery Settings Section -->
                <div class="border-b border-pm pb-3">
-                    <h4 class="text-xs font-semibold text-pm-secondary mb-3 uppercase tracking-wide">Gallery Settings</h4>
+                    <h4 class="text-xs font-semibold text-pm-secondary mb-3 uppercase tracking-wide">Prompt list</h4>

-                    <div class="mb-3">
-                        <label class="block text-xs font-medium text-pm-secondary mb-1">Image Scan Directories</label>
-                        <div id="scanPathsList" class="space-y-2">
-                            <!-- Populated dynamically by JS -->
-                        </div>
-                        <button id="addScanPathBtn" type="button"
-                                class="mt-2 flex items-center gap-1 text-xs text-pm-accent hover:text-pm-accent-hover">
-                            <svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
-                                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 4v16m8-8H4"/>
-                            </svg>
-                            Add Directory
-                        </button>
-                        <p class="text-xs text-pm-muted mt-1">Directories to scan for images. Leave empty to use ComfyUI default output directory.</p>
-                    </div>
-
-                    <div class="mb-3">
-                        <div class="flex items-center justify-between">
-                            <label class="block text-xs font-medium text-pm-secondary">Currently Monitoring</label>
-                            <button id="refreshMonitoringStatus" class="text-xs text-pm-accent hover:text-pm-accent-hover">Refresh</button>
-                        </div>
-                        <div id="monitoringStatus" class="mt-1.5 px-2.5 py-1.5 bg-pm-input rounded-pm-sm text-xs text-pm-secondary font-mono">
-                            Loading...
-                        </div>
-                    </div>
-                </div>
-
-                <!-- UI Settings Section -->
-                <div class="border-b border-pm pb-3">
-                    <h4 class="text-xs font-semibold text-pm-secondary mb-3 uppercase tracking-wide">UI Settings</h4>
-
-                    <div class="mb-3">
-                        <label class="block text-xs font-medium text-pm-secondary mb-1">Search Results Auto-Hide (seconds)</label>
-                        <input type="number" id="resultTimeout" min="0" max="300" value="30"
-                               class="w-full px-2.5 py-1.5 bg-pm-input border border-pm rounded-pm-sm text-pm text-[13px] focus:outline-none">
-                        <p class="text-xs text-pm-muted mt-1">Set to 0 to disable auto-hide.</p>
-                    </div>
-
-                    <div>
-                        <label class="block text-xs font-medium text-pm-secondary mb-1">Web UI Display Mode</label>
-                        <select id="webuiDisplayMode"
-                                class="w-full px-2.5 py-1.5 bg-pm-input border border-pm rounded-pm-sm text-pm text-[13px] focus:outline-none">
-                            <option value="popup">Popup Window (Current)</option>
-                            <option value="newtab">New Tab</option>
-                        </select>
-                        <p class="text-xs text-pm-muted mt-1">Choose how the Web UI opens from ComfyUI nodes.</p>
-                    </div>
-
-                    <div class="mt-3 flex items-center justify-between">
+                    <div class="flex items-center justify-between">
                        <div>
                            <label for="infiniteScrollDefault" class="block text-xs font-medium text-pm-secondary">Infinite Scrolling</label>
                            <p class="text-xs text-pm-muted">Load the next page of prompts as you scroll. The checkbox in the list header overrides this for the current session.</p>
@@ -431,76 +388,6 @@
                        <input type="checkbox" id="infiniteScrollDefault" class="w-4 h-4 rounded border-pm bg-pm-input text-pm-accent focus:ring-pm-accent ml-3">
                    </div>
                </div>
-
-                <!-- Performance Section -->
-                <div class="border-b border-pm pb-3">
-                    <h4 class="text-xs font-semibold text-pm-secondary mb-3 uppercase tracking-wide">Performance</h4>
-
-                    <div>
-                        <div class="flex items-center justify-between mb-1.5">
-                            <label for="workerThreads" class="text-xs font-medium text-pm-secondary">Worker threads</label>
-                            <span id="workerThreadsValue" class="text-pm-accent text-xs font-mono">1 / 1 cores</span>
-                        </div>
-                        <input type="range" id="workerThreads" min="1" max="1" step="1" value="1"
-                            class="w-full h-1.5 bg-pm-primary rounded-lg appearance-none cursor-pointer accent-[var(--pm-accent)]">
-                        <p class="text-xs text-pm-muted mt-1">Threads used by the image rescan and thumbnail generation. More threads finish sooner; fewer leave CPU for ComfyUI while it generates.</p>
-                    </div>
-                </div>
-
-                <!-- Integrations Section -->
-                <div class="border-b border-pm pb-3">
-                    <h4 class="text-xs font-semibold text-pm-secondary mb-3 uppercase tracking-wide">Integrations</h4>
-
-                    <div class="mb-3">
-                        <div class="flex items-center justify-between mb-2">
-                            <div class="flex items-center gap-2">
-                                <label class="block text-xs font-medium text-pm-secondary">LoraManager</label>
-                                <span id="loraDetectionBadge" class="text-[10px] px-1.5 py-0.5 rounded-full bg-pm-input text-pm-muted">checking...</span>
-                            </div>
-                            <label class="relative inline-flex items-center cursor-pointer">
-                                <input type="checkbox" id="loraEnabled" class="sr-only peer" disabled>
-                                <div class="w-8 h-4 bg-pm-input rounded-full peer peer-checked:bg-pm-accent transition-colors pointer-events-none after:content-[''] after:absolute after:top-0.5 after:left-0.5 after:bg-white after:rounded-full after:h-3 after:w-3 after:transition-all peer-checked:after:translate-x-4"></div>
-                            </label>
-                        </div>
-
-                        <div id="loraSettings" class="hidden space-y-2 mt-2 pl-2 border-l-2 border-pm">
-                            <div>
-                                <label class="block text-xs font-medium text-pm-secondary mb-1">Path</label>
-                                <input type="text" id="loraManagerPath" readonly
-                                       class="w-full px-2.5 py-1.5 bg-pm-input border border-pm rounded-pm-sm text-pm text-[13px] text-pm-muted">
-                            </div>
-
-                            <div class="flex items-center justify-between">
-                                <label class="block text-xs font-medium text-pm-secondary">Auto-inject trigger words</label>
-                                <label class="relative inline-flex items-center cursor-pointer">
-                                    <input type="checkbox" id="loraTriggerWords" class="sr-only peer">
-                                    <div class="w-8 h-4 bg-pm-input rounded-full peer peer-checked:bg-pm-accent transition-colors pointer-events-none after:content-[''] after:absolute after:top-0.5 after:left-0.5 after:bg-white after:rounded-full after:h-3 after:w-3 after:transition-all peer-checked:after:translate-x-4"></div>
-                                </label>
-                            </div>
-                            <p class="text-xs text-pm-muted">Automatically append trigger words when <code class="text-pm-accent">&lt;lora:name:weight&gt;</code> is detected in prompts.</p>
-
-                            <div class="mt-2">
-                                <label class="block text-xs font-medium text-pm-secondary mb-1">CivitAI API Key</label>
-                                <input type="password" id="civitaiApiKey" placeholder="Optional — required for NSFW example images"
-                                       class="w-full px-2.5 py-1.5 bg-pm-input border border-pm rounded-pm-sm text-pm text-[13px] placeholder:text-pm-muted focus:outline-none">
-                                <p class="text-xs text-pm-muted mt-1">Get your key from <a href="https://civitai.com/user/account" target="_blank" class="text-pm-accent hover:underline">civitai.com/user/account</a></p>
-                            </div>
-
-                            <label class="mt-1 flex items-center gap-1.5 text-xs text-pm-secondary cursor-pointer">
-                                <input type="checkbox" id="clearCivitaiKey" class="w-3.5 h-3.5 text-pm-accent bg-pm-input border-pm rounded focus:ring-pm-accent">
-                                <span>Clear the stored key on save</span>
-                            </label>
-
-                            <button id="loraImportBtn" type="button"
-                                    class="mt-1 flex items-center gap-1 text-xs text-pm-accent hover:text-pm-accent-hover">
-                                <svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
-                                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 16v1a3 3 0 003 3h10a3 3 0 003-3v-1m-4-8l-4-4m0 0L8 8m4-4v12"/>
-                                </svg>
-                                Import LoRA Data
-                            </button>
-                        </div>
-                    </div>
-                </div>
            </div>

            <div class="flex justify-end gap-2 mt-4">
@@ -516,32 +403,6 @@
        </div>
    </div>

-    <!-- LoRA Import Progress Modal -->
-    <div id="loraImportModal" class="fixed inset-0 bg-black/60 backdrop-blur-[2px] hidden items-center justify-center z-50">
-        <div class="bg-pm-surface rounded-pm-lg p-4 max-w-md w-full mx-4 border border-pm shadow-pm">
-            <h3 class="text-sm font-semibold text-pm mb-4">Importing LoRA Data</h3>
-
-            <div class="mb-3">
-                <p class="text-pm-secondary text-xs">Status:</p>
-                <p id="loraImportStatus" class="text-pm text-xs font-medium truncate">Initializing...</p>
-            </div>
-
-            <div class="mb-3">
-                <div class="flex justify-between text-xs text-pm-secondary mb-1">
-                    <span>Progress</span>
-                    <span id="loraImportPercent">0%</span>
-                </div>
-                <div class="w-full bg-pm-input rounded-full h-1.5">
-                    <div id="loraImportBar" class="bg-pm-accent h-1.5 rounded-full transition-all duration-300" style="width: 0%"></div>
-                </div>
-                <div class="flex justify-between text-[11px] text-pm-muted mt-1">
-                    <span id="loraImportProcessed">0 processed</span>
-                    <span id="loraImportImported">0 imported</span>
-                </div>
-            </div>
-        </div>
-    </div>
-
    <!-- Bulk Tag Modal -->
    <div id="bulkTagModal" class="fixed inset-0 bg-black/60 backdrop-blur-[2px] hidden items-center justify-center z-50">
        <div class="bg-pm-surface rounded-pm-lg p-4 max-w-md w-full mx-4 border border-pm shadow-pm">
@@ -614,136 +475,6 @@
        </div>
    </div>

-    <!-- Database Restore Modal -->
-    <div id="restoreModal" class="fixed inset-0 bg-black/60 backdrop-blur-[2px] hidden items-center justify-center z-50">
-        <div class="bg-pm-surface rounded-pm-lg p-4 max-w-md w-full mx-4 border border-pm shadow-pm">
-            <h3 class="text-sm font-semibold text-pm mb-4">Restore Database</h3>
-
-            <div class="mb-3">
-                <div class="bg-pm-warning-tint border border-pm-warning/40 rounded-pm-md p-3 mb-3">
-                    <h4 class="text-pm-warning font-medium text-xs">Warning</h4>
-                    <p class="text-pm text-xs mt-1">This will replace your current database. A backup will be created automatically.</p>
-                </div>
-
-                <label class="block text-xs font-medium text-pm-secondary mb-1">Select Database File (.db)</label>
-                <input type="file" id="restoreFileInput" accept=".db"
-                       class="w-full px-2.5 py-1.5 bg-pm-input border border-pm rounded-pm-sm text-pm text-[13px] file:mr-3 file:py-1 file:px-3 file:rounded-pm-sm file:border-0 file:text-xs file:font-medium file:bg-pm-accent file:text-pm-accent-fg">
-            </div>
-
-            <div class="flex justify-end gap-2 mt-4">
-                <button id="cancelRestore"
-                        class="px-3 py-1.5 bg-pm-surface border border-pm hover:bg-pm-hover text-pm text-xs font-medium rounded-pm-sm transition-colors">
-                    Cancel
-                </button>
-                <button id="confirmRestore"
-                        class="px-3 py-1.5 bg-pm-warning hover:opacity-80 text-black text-xs font-medium rounded-pm-sm transition-colors">
-                    Restore Database
-                </button>
-            </div>
-        </div>
-    </div>
-
-    <!-- Maintenance Modal -->
-    <div id="maintenanceModal" class="fixed inset-0 bg-black/60 backdrop-blur-[2px] hidden items-center justify-center z-50">
-        <div class="bg-pm-surface rounded-pm-lg max-w-4xl w-full max-h-[90vh] overflow-hidden mx-4 border border-pm shadow-pm">
-            <div class="p-4 border-b border-pm">
-                <div class="flex items-center justify-between">
-                    <h3 class="text-sm font-semibold text-pm">Database Maintenance</h3>
-                    <button onclick="window.admin.closeMaintenance()" class="p-1 rounded-pm-sm hover:bg-pm-hover transition-colors">
-                        <svg class="w-4 h-4 text-pm-secondary" fill="none" stroke="currentColor" viewBox="0 0 24 24">
-                            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6 6l12 12"></path>
-                        </svg>
-                    </button>
-                </div>
-            </div>
-            <div class="p-4 overflow-y-auto max-h-[calc(90vh-120px)]">
-                <!-- Maintenance Options -->
-                <div class="space-y-3 mb-4">
-                    <h4 class="text-xs font-semibold text-pm-secondary uppercase tracking-wide mb-3">Select Maintenance Operations:</h4>
-                    <div class="grid grid-cols-1 md:grid-cols-2 gap-3">
-                        <label class="flex items-center gap-2.5 p-3 bg-pm-input rounded-pm-md hover:bg-pm-hover cursor-pointer">
-                            <input type="checkbox" id="cleanup_duplicates" class="maintenance-option w-3.5 h-3.5 accent-[var(--pm-accent)]" checked>
-                            <div class="flex-1">
-                                <div class="text-pm text-xs font-medium">Remove Duplicates</div>
-                                <div class="text-[11px] text-pm-secondary">Find and remove duplicate prompts based on text content</div>
-                            </div>
-                        </label>
-
-                        <label class="flex items-center gap-2.5 p-3 bg-pm-input rounded-pm-md hover:bg-pm-hover cursor-pointer">
-                            <input type="checkbox" id="vacuum" class="maintenance-option w-3.5 h-3.5 accent-[var(--pm-accent)]" checked>
-                            <div class="flex-1">
-                                <div class="text-pm text-xs font-medium">Vacuum Database</div>
-                                <div class="text-[11px] text-pm-secondary">Optimize database file size and performance</div>
-                            </div>
-                        </label>
-
-                        <label class="flex items-center gap-2.5 p-3 bg-pm-input rounded-pm-md hover:bg-pm-hover cursor-pointer">
-                            <input type="checkbox" id="cleanup_orphaned_images" class="maintenance-option w-3.5 h-3.5 accent-[var(--pm-accent)]" checked>
-                            <div class="flex-1">
-                                <div class="text-pm text-xs font-medium">Clean Orphaned Images</div>
-                                <div class="text-[11px] text-pm-secondary">Remove image records for files that no longer exist</div>
-                            </div>
-                        </label>
-
-                        <label class="flex items-center gap-2.5 p-3 bg-pm-input rounded-pm-md hover:bg-pm-hover cursor-pointer">
-                            <input type="checkbox" id="check_hash_duplicates" class="maintenance-option w-3.5 h-3.5 accent-[var(--pm-accent)]">
-                            <div class="flex-1">
-                                <div class="text-pm text-xs font-medium">Check Hash Duplicates</div>
-                                <div class="text-[11px] text-pm-secondary">Identify prompts with duplicate hash values</div>
-                            </div>
-                        </label>
-
-                        <label class="flex items-center gap-2.5 p-3 bg-pm-input rounded-pm-md hover:bg-pm-hover cursor-pointer">
-                            <input type="checkbox" id="check_consistency" class="maintenance-option w-3.5 h-3.5 accent-[var(--pm-accent)]">
-                            <div class="flex-1">
-                                <div class="text-pm text-xs font-medium">Consistency Check</div>
-                                <div class="text-[11px] text-pm-secondary">Verify database integrity and data consistency</div>
-                            </div>
-                        </label>
-
-                        <label class="flex items-center gap-2.5 p-3 bg-pm-input rounded-pm-md hover:bg-pm-hover cursor-pointer">
-                            <input type="checkbox" id="statistics" class="maintenance-option w-3.5 h-3.5 accent-[var(--pm-accent)]">
-                            <div class="flex-1">
-                                <div class="text-pm text-xs font-medium">Database Statistics</div>
-                                <div class="text-[11px] text-pm-secondary">Generate detailed database statistics report</div>
-                            </div>
-                        </label>
-
-                        <label class="flex items-center gap-2.5 p-3 bg-pm-input rounded-pm-md hover:bg-pm-hover cursor-pointer">
-                            <input type="checkbox" id="prune_orphaned_prompts" class="maintenance-option w-3.5 h-3.5 accent-[var(--pm-accent)]">
-                            <div class="flex-1">
-                                <div class="text-pm text-xs font-medium">Prune Orphaned Prompts</div>
-                                <div class="text-[11px] text-pm-secondary">Remove prompts that have no linked images</div>
-                            </div>
-                        </label>
-                    </div>
-                </div>
-
-                <!-- Action Buttons -->
-                <div class="flex items-center justify-between mb-4">
-                    <div class="flex gap-2">
-                        <button id="runMaintenanceBtn" class="px-3 py-1.5 bg-pm-accent hover:bg-pm-accent-hover text-pm-accent-fg text-xs font-medium rounded-pm-sm transition-colors">
-                            Run Maintenance
-                        </button>
-                        <button id="selectAllMaintenanceBtn" class="px-2.5 py-1.5 bg-pm-surface border border-pm hover:bg-pm-hover text-pm text-xs font-medium rounded-pm-sm transition-colors">
-                            Select All
-                        </button>
-                        <button id="clearAllMaintenanceBtn" class="px-2.5 py-1.5 bg-pm-surface border border-pm hover:bg-pm-hover text-pm text-xs font-medium rounded-pm-sm transition-colors">
-                            Clear All
-                        </button>
-                    </div>
-                </div>
-
-                <!-- Results -->
-                <div id="maintenanceResults" class="space-y-3">
-                    <div class="text-center py-6 text-pm-secondary text-xs">
-                        Click "Run Maintenance" to perform selected operations
-                    </div>
-                </div>
-            </div>
-        </div>
-    </div>
-
    <!-- Gallery Modal -->
    <div id="galleryModal" class="fixed inset-0 bg-black/75 backdrop-blur-[2px] hidden items-center justify-center z-50">
        <div class="bg-pm-surface rounded-pm-lg max-w-6xl w-full max-h-[90vh] overflow-hidden mx-4 border border-pm shadow-pm">
@@ -1257,36 +988,6 @@ No sentences, no commentary, no captions. Only tags. Keep length short but descr
        </div>
    </div>

-    <!-- Auto Tag Download Modal -->
-    <div id="autoTagDownloadModal" class="fixed inset-0 bg-black/60 backdrop-blur-[2px] hidden items-center justify-center z-50">
-        <div class="bg-pm-surface rounded-pm-lg p-4 max-w-md w-full mx-4 border border-pm shadow-pm">
-            <h3 class="text-sm font-semibold text-pm mb-4">Downloading Model</h3>
-
-            <div class="mb-3">
-                <p class="text-pm-secondary text-xs">Downloading:</p>
-                <p id="downloadModelName" class="text-pm text-xs font-medium">GGUF Model</p>
-            </div>
-
-            <div class="mb-4">
-                <div class="flex justify-between text-xs text-pm-secondary mb-1">
-                    <span id="downloadStatus">Preparing...</span>
-                    <span id="downloadProgressPercent">0%</span>
-                </div>
-                <div class="w-full bg-pm-input rounded-full h-1.5">
-                    <div id="downloadProgressBar" class="bg-pm-accent h-1.5 rounded-full transition-all duration-300" style="width: 0%"></div>
-                </div>
-                <p class="text-pm-secondary text-xs mt-2">The download continues in Activity.</p>
-            </div>
-
-            <div class="flex justify-center">
-                <button id="cancelDownloadBtn"
-                        class="px-3 py-1.5 text-pm-error bg-transparent hover:bg-pm-error-tint border border-pm text-xs font-medium rounded-pm-sm transition-colors">
-                    Close
-                </button>
-            </div>
-        </div>
-    </div>
-
    <script src="js/comfy-metadata.js"></script>
    <script src="js/prompt-list-sort.js"></script>
    <script src="js/view-router.js"></script>
@@ -8,8 +8,6 @@
    <script src="js/html-escape.js"></script>
    <script src="js/image-helpers.js"></script>
    <script src="js/gallery-settings.js"></script>
-    <script src="js/cache-ownership.js"></script>
-    <script src="js/scan-progress.js"></script>
    <script src="js/api-client.js"></script>
    <script src="js/png-metadata.js"></script>
    <script src="js/list-state.js"></script>
@@ -63,7 +61,7 @@
                        <button id="thumbMdBtn" class="px-2 py-1 bg-pm-accent text-pm-accent-fg text-xs rounded-pm-sm transition-colors" title="Medium thumbnails">M</button>
                        <button id="thumbLgBtn" class="px-2 py-1 bg-pm-input hover:bg-pm-hover text-pm text-xs rounded-pm-sm transition-colors" title="Large thumbnails">L</button>
                    </div>
-                    <div class="flex items-center gap-2">
+                    <div class="flex flex-wrap items-center gap-2">
                        <button id="refreshBtn"
                                class="px-3 py-1 bg-pm-accent hover:bg-pm-accent-hover text-pm-accent-fg text-xs font-medium rounded-pm-sm transition-colors">
                            Refresh
@@ -76,9 +74,14 @@
                                class="px-3 py-1 bg-pm-input hover:bg-pm-hover text-pm text-xs font-medium rounded-pm-sm transition-colors">
                            List View
                        </button>
-                        <button id="settingsBtn"
-                                class="px-3 py-1 bg-pm-input hover:bg-pm-hover text-pm text-xs font-medium rounded-pm-sm transition-colors">
+                        <a id="settingsBtn" href="workspace#/system/appearance" target="_blank" rel="noopener"
+                           title="Opens System › Appearance in a new tab"
+                           class="px-3 py-1 bg-pm-input hover:bg-pm-hover text-pm text-xs font-medium rounded-pm-sm transition-colors">
                            Settings
+                        </a>
+                        <button id="pageOptionsBtn" type="button"
+                                class="px-3 py-1 bg-pm-input hover:bg-pm-hover text-pm text-xs font-medium rounded-pm-sm transition-colors">
+                            Page options
                        </button>
                        <button id="autoTagBtn"
                                class="px-3 py-1 bg-pm-accent hover:bg-pm-accent-hover text-pm-accent-fg text-xs font-medium rounded-pm-sm transition-colors">
@@ -176,7 +179,7 @@
        <div class="bg-pm-surface rounded-pm-md max-w-2xl w-full max-h-[90vh] overflow-hidden mx-4 border border-pm">
            <div class="p-3 border-b border-pm">
                <div class="flex items-center justify-between">
-                    <h3 class="text-sm font-semibold text-pm">Gallery Settings</h3>
+                    <h3 class="text-sm font-semibold text-pm">Page options</h3>
                    <button id="closeSettingsBtn" class="p-2 rounded-pm-sm hover:bg-pm-hover transition-colors">
                        <svg class="w-4 h-4 text-pm-secondary" fill="none" stroke="currentColor" viewBox="0 0 24 24">
                            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6 6l12 12"></path>
@@ -190,25 +193,9 @@
                <div class="space-y-3">
                    <h4 class="text-sm font-semibold text-pm">Performance Settings</h4>

-                    <!-- Thumbnail Generation -->
-                    <div class="bg-pm-input rounded-pm-sm p-3">
-                        <div class="flex items-center justify-between mb-2">
-                            <div>
-                                <h5 class="text-pm text-xs font-medium">Generate Thumbnails</h5>
-                                <p class="text-xs text-pm-secondary">Create optimized thumbnails for faster loading</p>
-                            </div>
-                            <button id="generateThumbnailsBtn" class="px-3 py-1 bg-pm-accent hover:bg-pm-accent-hover text-pm-accent-fg text-xs rounded-pm-sm transition-colors">
-                                Generate
-                            </button>
-                        </div>
-                        <div class="text-xs text-pm-muted mb-2">
-                            Status: <span id="thumbnailStatus">Not generated</span>
-                            <div class="text-xs text-pm-muted mt-1">
-                                Thumbnails speed up gallery loading. Original images always used for viewing and metadata.
-                            </div>
-                        </div>
+                    <div class="bg-pm-input rounded-pm-sm p-3 space-y-2">
                        <!-- Check thumbnails at startup -->
-                        <div class="flex items-center justify-between py-2 border-t border-pm">
+                        <div class="flex items-center justify-between">
                            <div>
                                <label class="text-xs text-pm-secondary">Check thumbnails at startup</label>
                                <p class="text-xs text-pm-muted">Prompt to generate thumbnails if missing when opening gallery</p>
@@ -218,43 +205,9 @@
                                <div class="w-11 h-6 bg-pm-input peer-focus:outline-none peer-focus:ring-4 peer-focus:ring-pm-accent rounded-full peer peer-checked:after:translate-x-full peer-checked:after:border-white after:content-[''] after:absolute after:top-[2px] after:left-[2px] after:bg-white after:border-pm after:border after:rounded-full after:h-5 after:w-5 after:transition-all peer-checked:bg-pm-accent"></div>
                            </label>
                        </div>
-                        <!-- Progress bar (hidden by default) -->
-                        <div id="thumbnailProgress" class="hidden">
-                            <div class="flex items-center justify-between text-xs text-pm-secondary mb-1">
-                                <span id="progressText">Processing...</span>
-                                <div class="flex items-center gap-2">
-                                    <span id="progressPercent">0%</span>
-                                    <button id="cancelThumbnailsBtn" class="text-pm-error hover:text-pm-error text-xs px-2 py-1 bg-pm-error-tint rounded-pm-sm hidden">
-                                        Cancel
-                                    </button>
-                                </div>
-                            </div>
-                            <div class="w-full bg-pm-input rounded-full h-2">
-                                <div id="progressBar" class="bg-pm-accent h-2 rounded-full transition-all duration-300" style="width: 0%"></div>
-                            </div>
-                            <div class="flex items-center justify-between text-xs text-pm-muted mt-1">
-                                <span id="progressDetails">Scanning images...</span>
-                                <span id="progressETA" class="text-pm-muted"></span>
-                            </div>
-                        </div>
-                    </div>
-
-                    <!-- Image Loading -->
-                    <div class="bg-pm-input rounded-pm-sm p-3">
-                        <h5 class="text-pm text-xs font-medium mb-2">Image Loading</h5>
-                        <div class="space-y-2">
-                            <div class="flex items-center justify-between">
-                                <label class="text-xs text-pm-secondary">Lazy Loading</label>
-                                <input type="checkbox" id="lazyLoadingToggle" checked class="w-4 h-4 text-pm-accent bg-pm-input border-pm rounded focus:ring-pm-accent">
-                            </div>
-                            <div class="flex items-center justify-between">
-                                <label class="text-xs text-pm-secondary">Image Quality</label>
-                                <select id="imageQualitySelect" class="px-2 py-1 bg-pm-input border border-pm rounded-pm-sm text-pm text-xs">
-                                    <option value="high">High (Original)</option>
-                                    <option value="medium" selected>Medium (Optimized)</option>
-                                    <option value="low">Low (Fast)</option>
-                                </select>
-                            </div>
+                        <div class="flex items-center justify-between">
+                            <label class="text-xs text-pm-secondary">Lazy Loading</label>
+                            <input type="checkbox" id="lazyLoadingToggle" checked class="w-4 h-4 text-pm-accent bg-pm-input border-pm rounded focus:ring-pm-accent">
                        </div>
                    </div>
                </div>
@@ -264,13 +217,6 @@
                    <h4 class="text-sm font-semibold text-pm">Display Settings</h4>

                    <div class="bg-pm-input rounded-pm-sm p-3 space-y-2">
-                        <div class="flex items-center justify-between">
-                            <label class="text-xs text-pm-secondary">Default View Mode</label>
-                            <select id="defaultViewModeSelect" class="px-2 py-1 bg-pm-input border border-pm rounded-pm-sm text-pm text-xs">
-                                <option value="grid" selected>Grid View</option>
-                                <option value="list">List View</option>
-                            </select>
-                        </div>
                        <div class="flex items-center justify-between">
                            <label class="text-xs text-pm-secondary">Items per Page</label>
                            <select id="defaultLimitSelect" class="px-2 py-1 bg-pm-input border border-pm rounded-pm-sm text-pm text-xs">
@@ -289,14 +235,6 @@
                                <option value="10">10 Columns</option>
                            </select>
                        </div>
-                        <div class="flex items-center justify-between">
-                            <label class="text-xs text-pm-secondary">Show Media Info</label>
-                            <input type="checkbox" id="showImageInfoToggle" checked class="w-4 h-4 text-pm-accent bg-pm-input border-pm rounded focus:ring-pm-accent">
-                        </div>
-                        <div class="flex items-center justify-between">
-                            <label class="text-xs text-pm-secondary">Collapse Sidebar by Default</label>
-                            <input type="checkbox" id="sidebarCollapsedByDefaultToggle" class="w-4 h-4 text-pm-accent bg-pm-input border-pm rounded focus:ring-pm-accent">
-                        </div>
                        <div class="flex items-center justify-between">
                            <div>
                                <label class="text-xs text-pm-secondary">Infinite Scrolling</label>
@@ -305,78 +243,6 @@
                            <input type="checkbox" id="infiniteScrollToggle" class="w-4 h-4 text-pm-accent bg-pm-input border-pm rounded focus:ring-pm-accent">
                        </div>
                    </div>
-
-                    <!-- Video Settings -->
-                    <div class="bg-pm-input rounded-pm-sm p-3 space-y-2">
-                        <h5 class="text-pm text-xs font-medium mb-2">Video Settings</h5>
-                        <div class="flex items-center justify-between">
-                            <label class="text-xs text-pm-secondary">Autoplay Videos</label>
-                            <input type="checkbox" id="videoAutoplayToggle" class="w-4 h-4 text-pm-accent bg-pm-input border-pm rounded focus:ring-pm-accent">
-                        </div>
-                        <div class="flex items-center justify-between">
-                            <label class="text-xs text-pm-secondary">Mute Videos by Default</label>
-                            <input type="checkbox" id="videoMuteToggle" checked class="w-4 h-4 text-pm-accent bg-pm-input border-pm rounded focus:ring-pm-accent">
-                        </div>
-                        <div class="flex items-center justify-between">
-                            <label class="text-xs text-pm-secondary">Loop Videos</label>
-                            <input type="checkbox" id="videoLoopToggle" checked class="w-4 h-4 text-pm-accent bg-pm-input border-pm rounded focus:ring-pm-accent">
-                        </div>
-                    </div>
-                </div>
-
-                <!-- Metadata Settings -->
-                <div class="space-y-3">
-                    <h4 class="text-sm font-semibold text-pm">Metadata Settings</h4>
-
-                    <div class="bg-pm-input rounded-pm-sm p-3 space-y-2">
-                        <div class="flex items-center justify-between">
-                            <label class="text-xs text-pm-secondary">Auto-load Metadata</label>
-                            <input type="checkbox" id="autoLoadMetadataToggle" checked class="w-4 h-4 text-pm-accent bg-pm-input border-pm rounded focus:ring-pm-accent">
-                        </div>
-                        <div class="flex items-center justify-between">
-                            <label class="text-xs text-pm-secondary">Cache Metadata</label>
-                            <input type="checkbox" id="cacheMetadataToggle" checked class="w-4 h-4 text-pm-accent bg-pm-input border-pm rounded focus:ring-pm-accent">
-                        </div>
-                        <div class="flex items-center justify-between">
-                            <label class="text-xs text-pm-secondary">Show File Paths</label>
-                            <input type="checkbox" id="showFilePathsToggle" checked class="w-4 h-4 text-pm-accent bg-pm-input border-pm rounded focus:ring-pm-accent">
-                        </div>
-                    </div>
-                </div>
-
-                <!-- Maintenance -->
-                <div class="space-y-3">
-                    <h4 class="text-sm font-semibold text-pm">Maintenance</h4>
-
-                    <div class="bg-pm-input rounded-pm-sm p-3 space-y-2">
-                        <div class="flex items-center justify-between">
-                            <div>
-                                <h5 class="text-pm text-xs font-medium">Clear Cache</h5>
-                                <p class="text-xs text-pm-secondary">Clear cached metadata and thumbnails</p>
-                            </div>
-                            <button id="clearCacheBtn" class="px-3 py-1 bg-pm-error hover:bg-pm-error text-pm text-xs rounded-pm-sm transition-colors">
-                                Clear
-                            </button>
-                        </div>
-                        <div class="flex items-center justify-between">
-                            <div>
-                                <h5 class="text-pm text-xs font-medium">Rescan Output Folder</h5>
-                                <p class="text-xs text-pm-secondary">Refresh the image list from disk</p>
-                            </div>
-                            <button id="rescanFolderBtn" class="px-3 py-1 bg-pm-accent hover:bg-pm-accent-hover text-pm-accent-fg text-xs rounded-pm-sm transition-colors">
-                                Rescan
-                            </button>
-                        </div>
-                        <div class="flex items-center justify-between">
-                            <div>
-                                <h5 class="text-pm text-xs font-medium">Find Duplicate Images</h5>
-                                <p class="text-xs text-pm-secondary">Scan for duplicate images based on file content</p>
-                            </div>
-                            <button id="scanDuplicatesBtn" class="px-3 py-1 bg-pm-warning hover:bg-pm-warning text-pm text-xs rounded-pm-sm transition-colors">
-                                Scan
-                            </button>
-                        </div>
-                    </div>
                </div>

                <!-- Advanced Settings -->
@@ -395,6 +261,14 @@
                    </div>
                </div>

+                <p class="text-xs text-pm-secondary">Thumbnails, cache, file listing and duplicates are in System.
+                    <a id="pageOptionsMaintenanceLink" href="workspace#/system/maintenance" target="_blank" rel="noopener"
+                       title="Opens System › Maintenance in a new tab" class="text-pm-accent hover:underline">Maintenance</a>
+                    ·
+                    <a id="pageOptionsSourcesLink" href="workspace#/system/sources" target="_blank" rel="noopener"
+                       title="Opens System › Sources &amp; scans in a new tab" class="text-pm-accent hover:underline">Sources &amp; scans</a>
+                </p>
+
            </div>
            <div class="p-3 border-t border-pm flex justify-end gap-2">
                <button id="resetSettingsBtn" class="px-3 py-1 bg-pm-input hover:bg-pm-hover text-pm text-xs font-medium rounded-pm-sm transition-colors">
@@ -407,71 +281,6 @@
        </div>
    </div>

-    <!-- Minimized duplicate scan: shown while it runs with its modal hidden, or when results are waiting -->
-    <button id="dupScanPill" type="button" title="Show duplicate scan"
-            class="hidden fixed bottom-4 right-4 z-40 px-3 py-1.5 bg-pm-surface border border-pm shadow-pm rounded-pm-md text-xs text-pm hover:bg-pm-hover transition-colors">
-        <span class="inline-block w-1.5 h-1.5 rounded-full bg-pm-accent mr-1.5 align-middle animate-pulse"></span><span id="dupScanPillText" class="align-middle">Scanning...</span>
-    </button>
-
-    <!-- Duplicates Modal -->
-    <div id="duplicatesModal" class="fixed inset-0 bg-black/50 hidden items-center justify-center z-50">
-        <div class="bg-pm-surface rounded-pm-md max-w-4xl w-full max-h-[90vh] overflow-hidden mx-4 border border-pm">
-            <div class="p-3 border-b border-pm">
-                <div class="flex items-center justify-between">
-                    <h3 class="text-sm font-semibold text-pm">Duplicate Images Found</h3>
-                    <button id="closeDuplicatesBtn" class="p-2 rounded-pm-sm hover:bg-pm-hover transition-colors">
-                        <svg class="w-4 h-4 text-pm-secondary" fill="none" stroke="currentColor" viewBox="0 0 24 24">
-                            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6 6l12 12"></path>
-                        </svg>
-                    </button>
-                </div>
-            </div>
-            <div class="p-3 overflow-y-auto max-h-[calc(90vh-200px)]">
-                <div id="duplicatesScanStatus" class="py-6">
-                    <div class="max-w-md mx-auto bg-pm-input rounded-pm-md p-3">
-                        <div class="flex items-center justify-between mb-1.5">
-                            <span class="text-pm text-xs font-medium">Scanning for duplicate images</span>
-                            <span id="dupProgressText" class="text-pm-secondary text-xs">Starting...</span>
-                        </div>
-                        <div class="w-full bg-pm-primary rounded-full h-1.5">
-                            <div id="dupProgressBar" class="bg-pm-accent h-1.5 rounded-full transition-all duration-300" style="width: 0%"></div>
-                        </div>
-                        <p class="text-[11px] text-pm-muted mt-2">Every file is hashed, so this takes a while on a large library. You can close this window; the scan keeps running and the results will be waiting.</p>
-                    </div>
-                </div>
-                <div id="duplicatesContent" class="hidden">
-                    <div class="mb-3 p-3 bg-pm-error-tint border border-pm-accent rounded-pm-sm">
-                        <div class="flex items-start">
-                            <svg class="w-4 h-4 text-pm-error mt-0.5 mr-2 flex-shrink-0" fill="currentColor" viewBox="0 0 20 20">
-                                <path fill-rule="evenodd" d="M8.257 3.099c.765-1.36 2.722-1.36 3.486 0l5.58 9.92c.75 1.334-.213 2.98-1.742 2.98H4.42c-1.53 0-2.493-1.646-1.743-2.98l5.58-9.92zM11 13a1 1 0 11-2 0 1 1 0 012 0zm-1-8a1 1 0 00-1 1v3a1 1 0 002 0V6a1 1 0 00-1-1z" clip-rule="evenodd"></path>
-                            </svg>
-                            <div>
-                                <h4 class="text-pm-error text-xs font-medium">Warning: Removing duplicate images cannot be undone!</h4>
-                                <p class="text-pm-secondary text-xs mt-1">When you remove a duplicate image, the selected file will be permanently deleted from disk. Choose carefully which images to keep.</p>
-                            </div>
-                        </div>
-                    </div>
-                    <div id="duplicatesList" class="space-y-3">
-                        <!-- Duplicates will be populated here -->
-                    </div>
-                </div>
-            </div>
-            <div id="duplicatesFooter" class="hidden p-3 border-t border-pm flex justify-between items-center">
-                <div class="text-xs text-pm-secondary">
-                    <span id="duplicatesCount">0</span> duplicate image groups found
-                </div>
-                <div class="flex gap-2">
-                    <button id="selectAllBtn" class="px-3 py-1 bg-pm-input hover:bg-pm-hover text-pm text-xs font-medium rounded-pm-sm transition-colors">
-                        Select All to Delete
-                    </button>
-                    <button id="removeDuplicatesBtn" class="px-3 py-1 bg-pm-error hover:bg-pm-error text-pm text-xs font-medium rounded-pm-sm transition-colors">
-                        Delete Selected
-                    </button>
-                </div>
-            </div>
-        </div>
-    </div>
-
    <!-- Auto Tag Modal -->
    <div id="autoTagModal" class="fixed inset-0 bg-black/50 hidden items-center justify-center z-50">
        <div class="bg-pm-surface rounded-pm-md p-3 max-w-lg w-full mx-4 border border-pm">
@@ -549,9 +358,11 @@
                            <span class="text-pm-secondary text-xs ml-2">(Faster processing, uses ~4-16GB VRAM)</span>
                        </div>
                    </div>
-                    <button id="unloadModelBtn" class="px-3 py-1 bg-pm-error hover:bg-pm-error text-pm text-xs rounded-pm-sm transition-colors hidden">
-                        Unload Model
-                    </button>
+                    <a id="unloadModelBtn" href="workspace#/system/tagging" target="_blank" rel="noopener"
+                       title="Unload the model in System › Auto-tagging (opens a new tab)"
+                       class="px-3 py-1 bg-pm-error hover:bg-pm-error text-pm text-xs rounded-pm-sm transition-colors hidden">
+                        Manage in System
+                    </a>
                </label>
                <p id="modelLoadedStatus" class="text-pm-muted text-xs mt-1 hidden">
                    <span class="text-pm-success">●</span> Model currently loaded: <span id="loadedModelType">none</span>
@@ -711,39 +522,6 @@ No sentences, no commentary, no captions. Only tags. Keep length short but descr
        </div>
    </div>

-    <!-- Auto Tag Download Modal -->
-    <div id="autoTagDownloadModal" class="fixed inset-0 bg-black/50 hidden items-center justify-center z-50">
-        <div class="bg-pm-surface rounded-pm-md p-3 max-w-md w-full mx-4 border border-pm">
-            <h3 class="text-sm font-semibold text-pm mb-3">Downloading Model</h3>
-
-            <!-- Model Name -->
-            <div class="mb-3">
-                <p class="text-pm-secondary text-xs">Downloading:</p>
-                <p id="downloadModelName" class="text-pm text-xs font-medium">GGUF Model</p>
-            </div>
-
-            <!-- Progress Bar -->
-            <div class="mb-3">
-                <div class="flex justify-between text-xs text-pm-secondary mb-1">
-                    <span id="downloadStatus">Preparing...</span>
-                    <span id="downloadProgressPercent">0%</span>
-                </div>
-                <div class="w-full bg-pm-input rounded-full h-2">
-                    <div id="downloadProgressBar" class="bg-pm-accent h-2 rounded-full transition-all duration-300" style="width: 0%"></div>
-                </div>
-                <p class="text-pm-secondary text-xs mt-2">The download continues in Activity.</p>
-            </div>
-
-            <!-- Cancel Button -->
-            <div class="flex justify-center">
-                <button id="cancelDownloadBtn"
-                        class="px-3 py-1 bg-pm-error hover:bg-pm-error text-pm text-xs font-medium rounded-pm-sm transition-colors">
-                    Close
-                </button>
-            </div>
-        </div>
-    </div>
-
    <!-- Add Prompt Modal -->
    <div id="addPromptModal" class="fixed inset-0 bg-black/50 hidden items-center justify-center z-50">
        <div class="bg-pm-surface rounded-pm-md p-3 max-w-2xl w-full mx-4 border border-pm max-h-[90vh] overflow-y-auto">
@@ -3,11 +3,8 @@
                this.prompts = [];
                this.listMode = "recent"; // "recent" or "search"; a sort change reloads it
                this.selectedPrompts = new Set();
+                // The page's own options (Page options); every other setting lives in System.
                this.settings = {
-                    resultTimeout: 5,
-                    webuiDisplayMode: 'popup',
-                    workerThreads: 1,
-                    cpuCount: 1,
                    infiniteScroll: false,
                };
                this.categories = [];
@@ -125,11 +122,8 @@
                document.getElementById("bulkTagBtn").addEventListener("click", () => this.showBulkTagModal());
                document.getElementById("bulkCategoryBtn").addEventListener("click", () => this.showBulkCategoryModal());
                document.getElementById("exportBtn").addEventListener("click", () => this.exportPrompts());
-                document.getElementById("settingsBtn").addEventListener("click", () => this.showSettingsModal());
+                document.getElementById("pageOptionsBtn").addEventListener("click", () => this.showSettingsModal());
                document.getElementById("statsBtn").addEventListener("click", () => this.showStats());
-                document.getElementById("maintenanceBtn").addEventListener("click", () => this.showMaintenanceModal());
-                document.getElementById("backupBtn").addEventListener("click", () => this.backupDatabase());
-                document.getElementById("restoreBtn").addEventListener("click", () => this.showRestoreModal());
                document.getElementById("scanBtn").addEventListener("click", () => this.showScanModal());
                document.getElementById("autoTagBtn").addEventListener("click", () => this.showAutoTagModal());
                document.getElementById("addPromptBtn").addEventListener("click", () => this.showAddPromptModal());
@@ -193,8 +187,6 @@
                // Settings modal
                document.getElementById("saveSettings").addEventListener("click", () => this.saveSettings());
                document.getElementById("cancelSettings").addEventListener("click", () => this.hideModal("settingsModal"));
-                document.getElementById("refreshMonitoringStatus").addEventListener("click", () => this.updateMonitoringStatus());
-                document.getElementById("addScanPathBtn").addEventListener("click", () => this.addScanPath());

                // Bulk tag modal
                document.getElementById("confirmBulkTag").addEventListener("click", () => this.confirmBulkTag());
@@ -208,14 +200,6 @@
                document.getElementById("confirmBulkCategory").addEventListener("click", () => this.confirmBulkCategory());
                document.getElementById("cancelBulkCategory").addEventListener("click", () => this.hideModal("bulkCategoryModal"));

-                // Restore modal
-                document.getElementById("confirmRestore").addEventListener("click", () => this.confirmRestore());
-                document.getElementById("cancelRestore").addEventListener("click", () => this.hideModal("restoreModal"));
-
-                // Maintenance modal
-                document.getElementById("runMaintenanceBtn").addEventListener("click", () => this.runMaintenance());
-                document.getElementById("selectAllMaintenanceBtn").addEventListener("click", () => this.selectAllMaintenance());
-                document.getElementById("clearAllMaintenanceBtn").addEventListener("click", () => this.clearAllMaintenance());

                // Scan modal
                document.getElementById("startScan").addEventListener("click", () => this.startScan());
@@ -229,7 +213,6 @@
                document.getElementById("skipReviewBtn").addEventListener("click", () => this.skipReviewImage());
                document.getElementById("applyReviewBtn").addEventListener("click", () => this.applyReviewTags());
                document.getElementById("cancelAutoTagBtn").addEventListener("click", () => this.cancelAutoTag());
-                document.getElementById("cancelDownloadBtn").addEventListener("click", () => this.cancelDownload());

                // Re-tag confirmation modal buttons
                document.getElementById("retagSkipBtn").addEventListener("click", () => this.handleRetagChoice('skip'));
@@ -249,7 +232,6 @@
                document.getElementById('wd14GeneralThreshold').addEventListener('input', (e) => {
                    document.getElementById('wd14GeneralThresholdValue').textContent = parseFloat(e.target.value).toFixed(2);
                });
-                document.getElementById("workerThreads").addEventListener("input", () => this.renderWorkerThreads());
                document.getElementById('wd14CharacterThreshold').addEventListener('input', (e) => {
                    document.getElementById('wd14CharacterThresholdValue').textContent = parseFloat(e.target.value).toFixed(2);
                });
@@ -298,21 +280,9 @@
                    if (response.ok) {
                        const data = await response.json();
                        if (data.success && data.settings) {
-                            this.settings.resultTimeout = data.settings.result_timeout ?? 5;
-                            this.settings.webuiDisplayMode = data.settings.webui_display_mode || 'popup';
                            this.settings.infiniteScroll = data.settings.infinite_scroll === true;
                            // The saved default seeds the session until the header checkbox is used
                            if (!this.infiniteScrollChosen) this.setInfiniteScroll(this.settings.infiniteScroll, { session: false });
-                            this.settings.cpuCount = Math.max(1, parseInt(data.settings.cpu_count, 10) || 1);
-                            this.settings.workerThreads = Math.min(
-                                this.settings.cpuCount, Math.max(1, parseInt(data.settings.worker_threads, 10) || 1)
-                            );
-                            this.settings.monitoredDirectories = data.settings.monitored_directories || [];
-                            this.settings.galleryRootPaths = data.settings.gallery_root_paths || [];
-                            // Backward compat: if server only returned old field
-                            if (!this.settings.galleryRootPaths.length && data.settings.gallery_root_path) {
-                                this.settings.galleryRootPaths = [data.settings.gallery_root_path];
-                            }
                        }
                    }
                } catch (error) {
@@ -996,255 +966,27 @@
                });
            }

-            renderWorkerThreads() {
-                const threads = document.getElementById("workerThreads");
-                document.getElementById("workerThreadsValue").textContent =
-                    `${threads.value} / ${this.settings.cpuCount} cores`;
-            }
-
+            /** Page options: the prompt list's saved Infinite Scrolling default (scan folders and the rest are in System). */
            showSettingsModal() {
-                document.getElementById("resultTimeout").value = this.settings.resultTimeout;
-                document.getElementById("webuiDisplayMode").value = this.settings.webuiDisplayMode;
                document.getElementById("infiniteScrollDefault").checked = this.settings.infiniteScroll;
-                const threads = document.getElementById("workerThreads");
-                threads.max = this.settings.cpuCount;
-                threads.value = this.settings.workerThreads;
-                this.renderWorkerThreads();
-                this.renderScanPaths();
-                this.updateMonitoringStatus();
-                this.detectLoraManager();
                this.showModal("settingsModal");
            }

-            async updateMonitoringStatus() {
-                const statusEl = document.getElementById("monitoringStatus");
-                try {
-                    const response = await ApiClient.fetchUrl("/prompt_manager/settings");
-                    if (response.ok) {
-                        const data = await response.json();
-                        const dirs = data.settings?.monitored_directories || [];
-                        if (dirs.length > 0) {
-                            statusEl.innerHTML = dirs.map(d => `<div class="truncate" title="${escapeHtml(d)}">✓ ${escapeHtml(d)}</div>`).join('');
-                        } else {
-                            statusEl.textContent = 'No directories being monitored (auto-detect on restart)';
-                        }
-                    }
-                } catch (error) {
-                    statusEl.textContent = 'Unable to fetch status';
-                }
-            }
-
-            // ── LoraManager integration ──────────────────────────────
-
-            async detectLoraManager() {
-                const badge = document.getElementById("loraDetectionBadge");
-                const toggle = document.getElementById("loraEnabled");
-                const settings = document.getElementById("loraSettings");
-
-                try {
-                    // First check current status
-                    const statusRes = await ApiClient.fetchUrl("/prompt_manager/lora/status");
-                    if (statusRes.ok) {
-                        const status = await statusRes.json();
-                        if (status.success && status.enabled) {
-                            badge.textContent = "enabled";
-                            badge.className = "text-[10px] px-1.5 py-0.5 rounded-full bg-green-500/20 text-green-400";
-                            toggle.checked = true;
-                            toggle.disabled = false;
-                            document.getElementById("loraManagerPath").value = status.path;
-                            document.getElementById("loraTriggerWords").checked = status.trigger_words_enabled;
-                            const keyInput = document.getElementById("civitaiApiKey");
-                            keyInput.value = "";
-                            keyInput.placeholder = status.has_civitai_api_key
-                                ? "A key is stored — leave empty to keep it"
-                                : "Optional — required for NSFW example images";
-                            document.getElementById("clearCivitaiKey").checked = false;
-                            settings.classList.remove("hidden");
-                            this._loraPath = status.path;
-                            this._bindLoraEvents();
-                            return;
-                        }
-                    }
-
-                    // Try auto-detection
-                    const detectRes = await ApiClient.fetchUrl("/prompt_manager/lora/detect");
-                    if (!detectRes.ok) return;
-                    const data = await detectRes.json();
-
-                    if (data.detected) {
-                        badge.textContent = "detected";
-                        badge.className = "text-[10px] px-1.5 py-0.5 rounded-full bg-blue-500/20 text-blue-400";
-                        toggle.disabled = false;
-                        document.getElementById("loraManagerPath").value = data.path;
-                        this._loraPath = data.path;
-                    } else {
-                        badge.textContent = "not installed";
-                        badge.className = "text-[10px] px-1.5 py-0.5 rounded-full bg-pm-input text-pm-muted";
-                        toggle.disabled = true;
-                    }
-
-                    this._bindLoraEvents();
-                } catch (e) {
-                    badge.textContent = "error";
-                    badge.className = "text-[10px] px-1.5 py-0.5 rounded-full bg-red-500/20 text-red-400";
-                }
-            }
-
-            _bindLoraEvents() {
-                if (this._loraBound) return;
-                this._loraBound = true;
-
-                const toggle = document.getElementById("loraEnabled");
-                const settings = document.getElementById("loraSettings");
-
-                toggle.addEventListener("change", () => {
-                    if (toggle.checked) {
-                        settings.classList.remove("hidden");
-                    } else {
-                        settings.classList.add("hidden");
-                    }
-                });
-
-                document.getElementById("loraImportBtn").addEventListener("click", () => {
-                    this.runLoraImport();
-                });
-            }
-
-            async saveLoraSettings() {
-                const enabled = document.getElementById("loraEnabled").checked;
-                const triggerWords = document.getElementById("loraTriggerWords").checked;
-                const civitaiKey = document.getElementById("civitaiApiKey").value.trim();
-                const clearKey = document.getElementById("clearCivitaiKey").checked;
-                const path = this._loraPath || "";
-
-                // The server never returns the stored key: an empty field keeps it, the
-                // checkbox removes it, and a non-empty field replaces it
-                const payload = { enabled, path, trigger_words_enabled: triggerWords };
-                if (clearKey) payload.clear_civitai_api_key = true;
-                else if (civitaiKey) payload.civitai_api_key = civitaiKey;
-
-                try {
-                    const res = await ApiClient.fetchUrl("/prompt_manager/lora/enable", {
-                        method: "POST",
-                        headers: { "Content-Type": "application/json" },
-                        body: JSON.stringify(payload),
-                    });
-                    const data = await res.json();
-                    if (!data.success) {
-                        this.showNotification(data.error || "Failed to save LoRA settings", "error");
-                        return false;
-                    }
-                    return true;
-                } catch (e) {
-                    this.showNotification("Failed to save LoRA settings", "error");
-                    return false;
-                }
-            }
-
-            async runLoraImport() {
-                const saved = await this.saveLoraSettings();
-                if (!saved) return;
-
-                // Close settings and show progress modal
-                this.hideModal("settingsModal");
-                document.getElementById("loraImportStatus").textContent = "Initializing...";
-                document.getElementById("loraImportBar").style.width = "0%";
-                document.getElementById("loraImportPercent").textContent = "0%";
-                document.getElementById("loraImportProcessed").textContent = "0 processed";
-                document.getElementById("loraImportImported").textContent = "0 imported";
-                this.showModal("loraImportModal");
-
-                try {
-                    const res = await ApiClient.fetchUrl("/prompt_manager/lora/scan", { method: "POST" });
-                    const reader = res.body.getReader();
-                    const decoder = new TextDecoder();
-                    let buffer = "";
-
-                    while (true) {
-                        const { done, value } = await reader.read();
-                        if (done) break;
-
-                        buffer += decoder.decode(value, { stream: true });
-                        const lines = buffer.split("\n\n");
-                        buffer = lines.pop();
-
-                        for (const line of lines) {
-                            if (!line.startsWith("data: ")) continue;
-                            try {
-                                const data = JSON.parse(line.slice(6));
-                                const pct = data.progress || 0;
-                                document.getElementById("loraImportBar").style.width = `${pct}%`;
-                                document.getElementById("loraImportPercent").textContent = `${pct}%`;
-
-                                if (data.status) {
-                                    document.getElementById("loraImportStatus").textContent = data.status;
-                                }
-                                if (data.processed !== undefined) {
-                                    document.getElementById("loraImportProcessed").textContent = `${data.processed} processed`;
-                                }
-                                if (data.imported !== undefined) {
-                                    document.getElementById("loraImportImported").textContent = `${data.imported} imported`;
-                                }
-
-                                if (data.type === "complete") {
-                                    document.getElementById("loraImportStatus").textContent =
-                                        `Done — ${data.imported} imported, ${data.skipped} skipped`;
-                                    this.loadStatistics();
-                                    setTimeout(() => this.hideModal("loraImportModal"), 2000);
-                                } else if (data.type === "error") {
-                                    // A refusal (another job runs) or a failed import: name it and close the modal.
-                                    document.getElementById("loraImportStatus").textContent = `Error: ${data.message}`;
-                                    this.showNotification(`LoRA import failed: ${data.message}`, "error");
-                                    setTimeout(() => this.hideModal("loraImportModal"), 3000);
-                                }
-                            } catch (e) { /* skip malformed SSE */ }
-                        }
-                    }
-                } catch (e) {
-                    document.getElementById("loraImportStatus").textContent = `Error: ${e.message}`;
-                    setTimeout(() => this.hideModal("loraImportModal"), 3000);
-                }
-            }
-
+            /** Saves Page options: only `infinite_scroll`, so a stale page never overwrites what System saved (#330 S13-9). */
            async saveSettings() {
-                const timeout = parseInt(document.getElementById("resultTimeout").value);
-                const displayMode = document.getElementById("webuiDisplayMode").value;
-                const workerThreads = parseInt(document.getElementById("workerThreads").value, 10) || 1;
                const infiniteScroll = document.getElementById("infiniteScrollDefault").checked;
-                const galleryPaths = this._collectScanPaths().filter(p => p !== '');
-
-                this.settings.resultTimeout = timeout;
-                this.settings.webuiDisplayMode = displayMode;
-                this.settings.workerThreads = workerThreads;
-                this.settings.infiniteScroll = infiniteScroll;
-                this.settings.galleryRootPaths = galleryPaths;

                try {
                    const response = await ApiClient.fetchUrl("/prompt_manager/settings", {
                        method: "POST",
                        headers: { "Content-Type": "application/json" },
-                        body: JSON.stringify({
-                            result_timeout: timeout,
-                            webui_display_mode: displayMode,
-                            worker_threads: workerThreads,
-                            infinite_scroll: infiniteScroll,
-                            gallery_root_paths: galleryPaths
-                        }),
+                        body: JSON.stringify({ infinite_scroll: infiniteScroll }),
                    });

                    if (response.ok) {
-                        const data = await response.json();
-
-                        // Save LoRA integration settings (fire-and-forget)
-                        await this.saveLoraSettings();
-
+                        this.settings.infiniteScroll = infiniteScroll;
                        this.setInfiniteScroll(infiniteScroll, { session: false });
-
-                        if (data.restart_required) {
-                            this.showNotification("Settings saved. Restart ComfyUI for gallery path changes to take effect.", "warning");
-                        } else {
-                            this.showNotification("Settings saved successfully", "success");
-                        }
+                        this.showNotification("Page options saved", "success");
                        this.hideModal("settingsModal");
                    } else {
                        // A refusal names its reason (a corrupt config.json, a changed file): show it.
@@ -1257,57 +999,6 @@
                }
            }

-            renderScanPaths() {
-                const container = document.getElementById("scanPathsList");
-                const paths = this.settings.galleryRootPaths || [];
-                container.textContent = '';  // Clear safely
-
-                const toRender = paths.length > 0 ? paths : [''];
-                toRender.forEach((p, i) => {
-                    const row = document.createElement('div');
-                    row.className = 'flex gap-2 items-center';
-                    row.dataset.pathIndex = i;
-
-                    const input = document.createElement('input');
-                    input.type = 'text';
-                    input.value = p;
-                    input.placeholder = 'Leave empty for auto-detect';
-                    input.className = 'flex-1 px-2.5 py-1.5 bg-pm-input border border-pm rounded-pm-sm text-pm text-[13px] focus:outline-none scan-path-input';
-
-                    const removeBtn = document.createElement('button');
-                    removeBtn.type = 'button';
-                    removeBtn.className = 'text-pm-muted hover:text-red-400 p-1 text-lg leading-none';
-                    removeBtn.title = 'Remove';
-                    removeBtn.textContent = '\u00d7';  // multiplication sign as X
-                    removeBtn.addEventListener('click', () => this.removeScanPath(i));
-
-                    row.appendChild(input);
-                    row.appendChild(removeBtn);
-                    container.appendChild(row);
-                });
-            }
-
-            addScanPath() {
-                const paths = this._collectScanPaths();
-                paths.push('');
-                this.settings.galleryRootPaths = paths;
-                this.renderScanPaths();
-                const inputs = document.querySelectorAll('.scan-path-input');
-                if (inputs.length) inputs[inputs.length - 1].focus();
-            }
-
-            removeScanPath(index) {
-                const paths = this._collectScanPaths();
-                paths.splice(index, 1);
-                this.settings.galleryRootPaths = paths;
-                this.renderScanPaths();
-            }
-
-            _collectScanPaths() {
-                return Array.from(document.querySelectorAll('.scan-path-input'))
-                    .map(input => input.value.trim());
-            }
-
            toggleSelectAll(checked) {
                document.querySelectorAll(".prompt-checkbox").forEach((checkbox) => {
                    checkbox.checked = checked;
@@ -1788,287 +1479,6 @@
                return `${size.toFixed(1)} ${units[unitIndex]}`;
            }

-            // Maintenance functionality
-            showMaintenanceModal() {
-                this.showModal("maintenanceModal");
-            }
-
-            closeMaintenance() {
-                this.hideModal("maintenanceModal");
-            }
-
-            selectAllMaintenance() {
-                document.querySelectorAll('.maintenance-option').forEach(checkbox => {
-                    checkbox.checked = true;
-                });
-            }
-
-            clearAllMaintenance() {
-                document.querySelectorAll('.maintenance-option').forEach(checkbox => {
-                    checkbox.checked = false;
-                });
-            }
-
-            async runMaintenance() {
-                const resultsContainer = document.getElementById("maintenanceResults");
-                const runButton = document.getElementById("runMaintenanceBtn");
-                
-                // Get selected operations
-                const selectedOps = Array.from(document.querySelectorAll('.maintenance-option:checked'))
-                    .map(checkbox => checkbox.id);
-                
-                if (selectedOps.length === 0) {
-                    this.showNotification('Please select at least one maintenance operation', 'warning');
-                    return;
-                }
-                
-                // Show loading state
-                runButton.disabled = true;
-                runButton.innerHTML = '🔄 Running...';
-                resultsContainer.innerHTML = `
-                    <div class="text-center py-4">
-                        <div class="w-12 h-12 border-4 border-teal-500/30 border-t-teal-500 rounded-full animate-spin mx-auto mb-4"></div>
-                        <p class="text-pm-secondary">Running maintenance operations...</p>
-                        <p class="text-sm text-pm-muted mt-2">Operations: ${selectedOps.map(op => op.replace(/_/g, ' ')).join(', ')}</p>
-                    </div>
-                `;
-                
-                try {
-                    const response = await ApiClient.fetchUrl('/prompt_manager/maintenance', {
-                        method: 'POST',
-                        headers: { 'Content-Type': 'application/json' },
-                        body: JSON.stringify({ operations: selectedOps })
-                    });
-                    
-                    if (response.ok) {
-                        const data = await response.json();
-                        if (data.success) {
-                            this.renderMaintenanceResults(data);
-                            
-                            // Show overall success notification
-                            if (data.all_successful) {
-                                this.showNotification('✅ All maintenance operations completed successfully!', 'success');
-                            } else {
-                                this.showNotification('⚠️ Some maintenance operations had issues', 'warning');
-                            }
-                            
-                            // Refresh stats after maintenance
-                            setTimeout(() => this.loadStatistics(), 1000);
-                        } else {
-                            throw new Error(data.error || 'Maintenance failed');
-                        }
-                    } else {
-                        // A refusal names the job that runs ("Scan for metadata already running").
-                        const data = await response.json().catch(() => ({}));
-                        throw new Error(data.error || `HTTP ${response.status}: ${response.statusText}`);
-                    }
-                } catch (error) {
-                    console.error('Maintenance error:', error);
-                    resultsContainer.innerHTML = `
-                        <div class="bg-pm-error-tint border border-pm-error rounded-pm-sm p-4">
-                            <h4 class="text-pm-error font-medium mb-2">❌ Maintenance Failed</h4>
-                            <p class="text-pm-secondary">${escapeHtml(error.message)}</p>
-                        </div>
-                    `;
-                    this.showNotification('❌ Maintenance failed', 'error');
-                } finally {
-                    runButton.disabled = false;
-                    runButton.innerHTML = '🔧 Run Maintenance';
-                }
-            }
-
-            renderMaintenanceResults(data) {
-                const resultsContainer = document.getElementById("maintenanceResults");
-                
-                let html = '<div class="space-y-4">';
-                
-                // Summary
-                html += '<div class="bg-pm-surface rounded-pm-sm p-4">';
-                html += '<h4 class="text-pm font-medium mb-3">📋 Maintenance Summary</h4>';
-                html += '<div class="grid grid-cols-1 md:grid-cols-2 gap-3">';
-                html += `
-                    <div class="flex justify-between items-center p-2 bg-pm-input rounded">
-                        <span class="text-pm-secondary">Operations Completed</span>
-                        <span class="text-pm-success font-mono text-sm">${escapeHtml(data.operations_completed)}</span>
-                    </div>
-                `;
-                html += `
-                    <div class="flex justify-between items-center p-2 bg-pm-input rounded">
-                        <span class="text-pm-secondary">Overall Success</span>
-                        <span class="${data.all_successful ? 'text-pm-success' : 'text-pm-warning'} font-mono text-sm">
-                            ${data.all_successful ? '✅ ALL PASSED' : '⚠️ SOME ISSUES'}
-                        </span>
-                    </div>
-                `;
-                html += '</div></div>';
-                
-                // Detailed results
-                for (const [operation, result] of Object.entries(data.results)) {
-                    const bgColor = result.success ? 'bg-pm-success-tint border-pm-success' : 'bg-pm-error-tint border-pm-error';
-                    const statusIcon = result.success ? '✅' : '❌';
-                    const statusText = result.success ? 'SUCCESS' : 'FAILED';
-                    
-                    html += `<div class="${bgColor} border rounded-pm-sm p-4">`;
-                    html += `<h4 class="text-pm font-medium mb-2 flex items-center space-x-2">`;
-                    html += `<span>${statusIcon}</span>`;
-                    html += `<span class="capitalize">${escapeHtml(operation.replace(/_/g, ' '))}</span>`;
-                    html += `<span class="text-sm font-mono ${result.success ? 'text-pm-success' : 'text-pm-error'}">${statusText}</span>`;
-                    html += `</h4>`;
-
-                    if (result.message) {
-                        html += `<p class="text-pm-secondary mb-2">${escapeHtml(result.message)}</p>`;
-                    }
-
-                    // Show specific details
-                    if (result.removed_count !== undefined) {
-                        html += `<div class="text-sm text-pm-secondary">Items removed: ${escapeHtml(result.removed_count)}</div>`;
-                    }
-
-                    if (result.duplicate_hashes !== undefined) {
-                        html += `<div class="text-sm text-pm-secondary">Duplicate hash groups found: ${escapeHtml(result.duplicate_hashes)}</div>`;
-                    }
-
-                    if (result.issues_found !== undefined) {
-                        html += `<div class="text-sm text-pm-secondary">Issues found: ${escapeHtml(result.issues_found)}</div>`;
-                        if (result.issues && result.issues.length > 0) {
-                            html += `<ul class="ml-4 list-disc text-xs text-pm-muted mt-1">`;
-                            result.issues.forEach(issue => {
-                                html += `<li>${escapeHtml(issue)}</li>`;
-                            });
-                            html += `</ul>`;
-                        }
-                    }
-
-                    if (result.info) {
-                        html += `<div class="text-sm text-pm-secondary mt-2">`;
-                        html += `<p>Total prompts: ${escapeHtml(result.info.total_prompts || 'N/A')}</p>`;
-                        html += `<p>Database size: ${escapeHtml(result.info.database_size_bytes ? this.formatFileSize(result.info.database_size_bytes) : 'N/A')}</p>`;
-                        html += `</div>`;
-                    }
-
-                    if (result.error) {
-                        html += `<div class="text-sm text-pm-error mt-2 font-mono bg-pm-error-tint p-2 rounded">`;
-                        html += `Error: ${escapeHtml(result.error)}`;
-                        html += `</div>`;
-                    }
-                    
-                    html += '</div>';
-                }
-                
-                html += '</div>';
-                resultsContainer.innerHTML = html;
-            }
-
-            // Database backup and restore functionality
-            async backupDatabase() {
-                try {
-                    const response = await ApiClient.fetchUrl('/prompt_manager/backup');
-                    
-                    if (response.ok) {
-                        // Get the filename from the Content-Disposition header
-                        const contentDisposition = response.headers.get('Content-Disposition');
-                        let filename = 'prompts_backup.db';
-                        
-                        if (contentDisposition) {
-                            const filenameMatch = contentDisposition.match(/filename="(.+)"/);
-                            if (filenameMatch) {
-                                filename = filenameMatch[1];
-                            }
-                        }
-                        
-                        // Create blob and download
-                        const blob = await response.blob();
-                        const url = window.URL.createObjectURL(blob);
-                        const a = document.createElement('a');
-                        a.href = url;
-                        a.download = filename;
-                        document.body.appendChild(a);
-                        a.click();
-                        window.URL.revokeObjectURL(url);
-                        document.body.removeChild(a);
-                        
-                        this.showNotification('💾 Database backup downloaded successfully!', 'success');
-                    } else {
-                        const errorData = await response.json();
-                        throw new Error(errorData.error || 'Backup failed');
-                    }
-                } catch (error) {
-                    console.error('Backup error:', error);
-                    this.showNotification(`❌ Backup failed: ${error.message}`, 'error');
-                }
-            }
-
-            showRestoreModal() {
-                // Clear previous file selection
-                document.getElementById('restoreFileInput').value = '';
-                this.showModal('restoreModal');
-            }
-
-            async confirmRestore() {
-                const fileInput = document.getElementById('restoreFileInput');
-                const file = fileInput.files[0];
-                
-                if (!file) {
-                    this.showNotification('Please select a database file to restore', 'warning');
-                    return;
-                }
-                
-                if (!file.name.endsWith('.db')) {
-                    this.showNotification('Please select a valid .db file', 'warning');
-                    return;
-                }
-                
-                // Show confirmation
-                const confirmed = confirm(
-                    `Are you sure you want to restore from "${file.name}"?\n\n` +
-                    'This will replace your current database. A backup will be created automatically.\n\n' +
-                    'This action cannot be undone.'
-                );
-                
-                if (!confirmed) {
-                    return;
-                }
-                
-                try {
-                    // Disable the restore button and show loading
-                    const confirmBtn = document.getElementById('confirmRestore');
-                    confirmBtn.disabled = true;
-                    confirmBtn.innerHTML = '🔄 Restoring...';
-                    
-                    // Create FormData for file upload
-                    const formData = new FormData();
-                    formData.append('database_file', file);
-                    
-                    const response = await ApiClient.fetchUrl('/prompt_manager/restore', {
-                        method: 'POST',
-                        body: formData
-                    });
-                    
-                    const data = await response.json();
-                    
-                    if (response.ok && data.success) {
-                        this.showNotification(
-                            `✅ Database restored successfully! Found ${data.prompt_count} prompts.`, 
-                            'success'
-                        );
-                        this.hideModal('restoreModal');
-                        
-                        // Refresh the interface to show the restored data
-                        await this.loadInitialData();
-                    } else {
-                        throw new Error(data.error || 'Restore failed');
-                    }
-                } catch (error) {
-                    console.error('Restore error:', error);
-                    this.showNotification(`❌ Restore failed: ${error.message}`, 'error');
-                } finally {
-                    // Re-enable the restore button
-                    const confirmBtn = document.getElementById('confirmRestore');
-                    confirmBtn.disabled = false;
-                    confirmBtn.innerHTML = 'Restore Database';
-                }
-            }
-
            // Copy prompt to clipboard functionality
            async copyPromptToClipboard(promptId) {
                // Find the prompt text from the prompts array
@@ -2773,7 +2183,6 @@ Seed: ${this.currentMetadata.seed || 'Unknown'}`;
            // State for AutoTag feature
            autoTagState = {
                eventSource: null,
-                downloadEventSource: null,
                reviewImages: [],
                reviewIndex: 0,
                currentTags: [],
@@ -3187,11 +2596,15 @@ Seed: ${this.currentMetadata.seed || 'Unknown'}`;
                    span.textContent = '\u2713 Downloaded';
                    el.appendChild(span);
                } else {
-                    const btn = document.createElement('button');
-                    btn.className = 'px-3 py-1 bg-pm-accent hover:bg-pm-accent-hover text-pm text-xs rounded transition-colors';
-                    btn.textContent = 'Download';
-                    btn.addEventListener('click', () => window.admin.downloadModel(modelKey));
-                    el.appendChild(btn);
+                    // Download lives in System › Auto-tagging (#330); the batch refuses a model that is not downloaded.
+                    const link = document.createElement('a');
+                    link.href = 'workspace#/system/tagging';
+                    link.target = '_blank';
+                    link.rel = 'noopener';
+                    link.title = 'Opens System › Auto-tagging in a new tab';
+                    link.className = 'px-3 py-1 bg-pm-accent hover:bg-pm-accent-hover text-pm text-xs rounded transition-colors';
+                    link.textContent = 'Manage in System';
+                    el.appendChild(link);
                }
            }

@@ -3234,74 +2647,6 @@ Seed: ${this.currentMetadata.seed || 'Unknown'}`;
                }
            }

-            async downloadModel(modelType) {
-                const modelNames = {
-                    'gguf': 'GGUF Model',
-                    'hf': 'HuggingFace Model',
-                    'wd14-swinv2': 'WD14 SwinV2',
-                    'wd14-vit': 'WD14 ViT'
-                };
-                const modelName = modelNames[modelType] || modelType;
-                document.getElementById('downloadModelName').textContent = modelName;
-                document.getElementById('downloadStatus').textContent = 'Preparing...';
-                document.getElementById('downloadProgressPercent').textContent = '0%';
-                document.getElementById('downloadProgressBar').style.width = '0%';
-                document.getElementById('downloadProgressBar').classList.remove('animate-pulse');
-
-                this.hideModal("autoTagModal");
-                this.showModal("autoTagDownloadModal");
-
-                try {
-                    this.autoTagState.downloadEventSource = SseStream.connect(`/prompt_manager/autotag/download/${modelType}`, { method: 'POST' });
-
-                    this.autoTagState.downloadEventSource.onmessage = (event) => {
-                        const data = JSON.parse(event.data);
-
-                        // The server sends `type` (progress / complete / error); the download is an
-                        // Activity job with no byte progress, so the bar is indeterminate (#328).
-                        if (data.type === 'progress') {
-                            document.getElementById('downloadStatus').textContent = 'Downloading\u2026';
-                            document.getElementById('downloadProgressPercent').textContent = '';
-                            const bar = document.getElementById('downloadProgressBar');
-                            bar.style.width = '100%';
-                            bar.classList.add('animate-pulse');
-                        } else if (data.type === 'complete') {
-                            this.autoTagState.downloadEventSource.close();
-                            this.hideModal("autoTagDownloadModal");
-                            this.showModal("autoTagModal");
-                            this.checkAutoTagModels();
-                            this.showNotification('Model downloaded successfully!', 'success');
-                        } else if (data.type === 'error') {
-                            this.autoTagState.downloadEventSource.close();
-                            this.hideModal("autoTagDownloadModal");
-                            this.showModal("autoTagModal");
-                            this.showNotification(`Download failed: ${data.message}`, 'error');
-                        }
-                    };
-
-                    this.autoTagState.downloadEventSource.onerror = () => {
-                        this.autoTagState.downloadEventSource.close();
-                        this.hideModal("autoTagDownloadModal");
-                        this.showModal("autoTagModal");
-                        this.showNotification('Download connection lost', 'error');
-                    };
-                } catch (error) {
-                    console.error('Download error:', error);
-                    this.hideModal("autoTagDownloadModal");
-                    this.showModal("autoTagModal");
-                    this.showNotification('Failed to start download', 'error');
-                }
-            }
-
-            cancelDownload() {
-                if (this.autoTagState.downloadEventSource) {
-                    this.autoTagState.downloadEventSource.close();
-                    this.autoTagState.downloadEventSource = null;
-                }
-                this.hideModal("autoTagDownloadModal");
-                this.showModal("autoTagModal");
-            }
-
            async startAutoTag() {
                const modelType = document.querySelector('input[name="autoTagModel"]:checked').value;
                const prompt = document.getElementById('autoTagPrompt').value;
Author	SHA1	Message	Date
Vito Sansevero	3c4d3b733b	Merge remote-tracking branch 'origin/main' into feat/330-s13-pr3	2026-10-28 06:01:30 -07:00
Vito	3f085d0724	ci: full matrix once per PR in the merge queue; Windows/macOS non-blocking (#420 ) (#421 ) * ci: run the full matrix once per PR, in the merge queue (#420) Pull requests now run a fast subset: Python 3.12 on ubuntu-latest, the coverage gate, black/flake8, frontend modules, bandit and the Chromium/touch frontend coverage shards plus merge. The merge queue, pushes to main and manual runs keep the full matrix: Linux/Windows/macOS x Python 3.12-3.14, real ComfyUI compatibility and the Firefox/WebKit page workflows. A dropped matrix leg never reports a check, so the new required "all tests" gate requires every test.yml job to succeed outside pull requests and real ComfyUI to be skipped only on pull requests; viewerjs does the same for the browser shards. branch-protection.json drops the eight legs a pull request no longer runs and adds "all tests". * docs(ci): ruleset edit keeps every rule and integration id; find merge-queue runs * ci: move Windows and macOS out of the blocking path (#420) The maintainer deferred Windows and macOS to the end of the redesign. The merge queue now runs Linux on Python 3.12-3.14, real ComfyUI, the frontend coverage shards and the Firefox/WebKit page workflows; pull requests keep the Linux 3.12 subset. The six Windows/macOS legs move to the new portability.yml, which runs on push to main, nightly and on demand, keeps the 27-minute limit and is never a required check. Red runs there are fixed at their cause before the cutover (#334). * docs(ci): required checks live in the ruleset and the classic protection (#420)	2026-10-28 12:44:06 +00:00
Vito Sansevero	7f6bac5392	Merge remote-tracking branch 'origin/main' into feat/330-s13-pr3	2026-10-28 05:05:10 -07:00
Vito	e769845417	refactor(admin): open System for settings, maintenance, backup and restore (#330 , PR 2) (#407 ) * test(legacy): snapshot the routes and the settings response Pins every registered route and the key paths of GET /prompt_manager/settings while System S13 (#330) moves the legacy pages' tools to native System. Recorded on the unchanged main; cutover (#334) removes it. * test(legacy): prove each removed legacy control has native coverage TESTING.md gains the "Legacy System UI removed by S13" table (no rows yet). legacy-coverage.test.mjs fails when a removal cites a capability that is not covered, copies another native test, lists an id or method twice, or leaves the id or method on its page. legacy-system-links.spec.mjs holds the System link table and guards the kept admin flows. * refactor(admin): open System for Diagnostics and logs The admin page's Diagnostics and View Logs buttons become links that open System › Diagnostics & logs in a new tab. The legacy Diagnostics and System Logs dialogs and their methods go; TESTING.md lists them against their covered capabilities (rows B1–B7). * refactor(admin): open System for settings and keep page options Settings opens System › Overview in a new tab. The settings dialog becomes Page options (opened from the list header) with only the Infinite Scrolling default, and its Save posts {"infinite_scroll": …} alone, so a stale legacy form can no longer overwrite scan folders or other values edited in System (#330 S13-9). Scan folders, monitoring status, auto-hide, display mode, worker threads, LoraManager and the LoRA import leave the page (rows B8–B14). * refactor(admin): open System for maintenance Maintenance opens System › Maintenance in a new tab, where each operation runs as a reviewed Activity job. The one-click legacy Database Maintenance dialog and its methods go (rows B15–B18); formatFileSize stays for the image modal. * refactor(admin): open System for backup and restore Backup DB and Restore DB open System › Backup & export in a new tab, where a restore is staged, reviewed and run as an Activity job. The one-click Restore dialog and its methods go (rows B19–B20); the scan dialog's quick backup stays. The removed browser tests' data checks live on at the route: a new round trip test restores every prompt with its tags and image links. * test(legacy): find a removed modal id passed to showModal and settle the links spec The removal check also finds an id passed as a string to a ...Modal() call and no longer reads data-id= as id=. The no-request test waits for the page's own start-up reads to finish, the sort check compares as the server sorts, and the kept-flow test checks the added prompt shows in the list. * test(admin): open Page options after the saved default is read Drops the leftover LoraManager section comment above the Page options save. * test(legacy): a lazy thumbnail load is not a System link's request	2026-10-28 11:25:20 +00:00
Vito Sansevero	eb6b4284f0	feat(gallery): remove Default View Mode from Page options (#330 ) System > Appearance's Default layout is the one default-layout control, as the S13 design's G5 says. The legacy gallery's Page options no longer show or save a default view and Reset no longer resets it. A stored legacy defaultViewMode still picks the view the gallery opens in (grid otherwise), and Save and Reset keep that key for the workspace-preferences migration.	2026-10-28 04:17:38 -07:00
Vito	9a90c7677f	fix(exit): stop running jobs, downloads and encoders at Ctrl+C instead of waiting for them (#376 ) (#417 ) * fix(exit): stop running jobs before Python joins the executor threads (#376) ComfyUI returns from main.py after Ctrl+C without closing its event loop, and Python joins every executor thread before any atexit callback runs, so a scan batch, thumbnail batch or model download in flight kept ComfyUI alive until it ended (on Windows each ffmpeg up to its 30 s timeout). The package now registers a threading._register_atexit hook (after concurrent.futures', so it runs before that join) that sets an exit signal and kills the running encoder processes. Job.cancelled follows the signal, so every check a job already makes between files stops it at exit; map_parallel starts no further item, the scan walk stops between folders and a tagging model download stops before its next chunk. Without the internal hook exit behaves as before. * fix(exit): abort Xet downloads and stop LoRA staging at exit (#376) Review follow-ups: Xet transfers report progress from native code and ignore the chunk checkpoint, so the exit hook calls huggingface_hub's own abort_xet_session when it is loaded; an aborted download logs as stopped. LoRA import staging reads the exit signal itself, so the legacy LoRA scan stops too. The test's fake encoder outlives the ceiling by less, and TESTING.md states the download limits of older huggingface_hub.	2026-10-28 10:15:28 +00:00
Vito Sansevero	9e3c7bedd9	Merge branch 'feat/330-s13-pr2' into feat/330-s13-pr3 # Conflicts: # tests/browser/legacy-system-links.spec.mjs	2026-10-27 21:58:05 -07:00
Vito Sansevero	0e5fa52e76	Merge remote-tracking branch 'origin/main' into feat/330-s13-pr2 # Conflicts: # TESTING.md # tests/browser/legacy-system-links.spec.mjs # web/admin.html # web/js/admin.js	2026-10-27 21:49:00 -07:00
Vito Sansevero	d2da8fc7f5	fix(gallery): let the header buttons wrap on a narrow screen With Page options beside Settings the header no longer fits a phone's width; it wrapped off the page and covered the Page options dialog in the touch runs.	2026-10-27 20:57:43 -07:00
Vito Sansevero	f78716fc5d	test(legacy): a lazy thumbnail load is not a System link's request	2026-10-27 19:58:41 -07:00
Vito Sansevero	dfa4b3355f	test(legacy): check each System link sends no request in its own test The no-request check runs inside each link's test, so a slow page no longer times out the whole table, and it ignores lazy thumbnail loads the layout starts on its own.	2026-10-27 19:58:41 -07:00
Vito Sansevero	727a8dfd3a	fix(gallery): keep the default view in Page options and save viewer choices alone System › Appearance's Default layout is the workspace's own key, so the legacy gallery's Default View Mode stays a page option instead of losing its only control. The viewer's mute and loop buttons remember just that choice instead of saving the Page options dialog's unfilled inputs over the stored page options. The pending-thumbnails toast names System › Sources & scans.	2026-10-27 19:51:29 -07:00
Vito Sansevero	bd5682e908	docs(system): name System as the home for settings and maintenance README and TESTING.md send settings, maintenance, backups, diagnostics, the gallery's tools and auto-tag model downloads to their System section and name each legacy page's Page options.	2026-10-27 19:34:31 -07:00
Vito Sansevero	e2d7cb1719	refactor(autotag): manage tagging models in System In both auto-tag dialogs a model that is not downloaded shows a Manage in System link to System › Auto-tagging (a new tab) instead of a Download button, and the gallery's Unload Model becomes the same link. The legacy download dialog and the download, cancel and unload methods go (rows B29–B31); the batch and review stay. A test hook marks a fake model loaded.	2026-10-27 19:33:21 -07:00
Vito Sansevero	6527b6fe1d	refactor(gallery): open System for settings and maintenance The gallery's Settings opens System › Appearance in a new tab. Its settings dialog becomes Page options (a new header button) with only the page's own settings: thumbnail startup check, lazy loading, items per page, grid columns, infinite scrolling, debug mode and API timeout. Save and Reset keep every other stored key, so the Appearance values System saves survive (S13-13). Generate Thumbnails, Clear cache, Rescan and Find duplicates leave the page; Page options links System › Maintenance and Sources & scans (rows B21–B28).	2026-10-27 19:28:49 -07:00
Vito Sansevero	97e8b9b680	test(admin): open Page options after the saved default is read Drops the leftover LoraManager section comment above the Page options save.	2026-10-27 19:09:21 -07:00
Vito Sansevero	9909bc5faa	Merge branch 'feat/330-s13-pr1' into feat/330-s13-pr2	2026-10-27 19:08:01 -07:00
Vito Sansevero	8800defb98	test(legacy): find a removed modal id passed to showModal and settle the links spec The removal check also finds an id passed as a string to a ...Modal() call and no longer reads data-id= as id=. The no-request test waits for the page's own start-up reads to finish, the sort check compares as the server sorts, and the kept-flow test checks the added prompt shows in the list.	2026-10-27 19:07:44 -07:00
Vito Sansevero	341b813fd7	refactor(admin): open System for backup and restore Backup DB and Restore DB open System › Backup & export in a new tab, where a restore is staged, reviewed and run as an Activity job. The one-click Restore dialog and its methods go (rows B19–B20); the scan dialog's quick backup stays. The removed browser tests' data checks live on at the route: a new round trip test restores every prompt with its tags and image links.	2026-10-27 18:49:59 -07:00
Vito Sansevero	dae6b3f784	refactor(admin): open System for maintenance Maintenance opens System › Maintenance in a new tab, where each operation runs as a reviewed Activity job. The one-click legacy Database Maintenance dialog and its methods go (rows B15–B18); formatFileSize stays for the image modal.	2026-10-27 18:45:10 -07:00
Vito Sansevero	ba2803dbbf	refactor(admin): open System for settings and keep page options Settings opens System › Overview in a new tab. The settings dialog becomes Page options (opened from the list header) with only the Infinite Scrolling default, and its Save posts {"infinite_scroll": …} alone, so a stale legacy form can no longer overwrite scan folders or other values edited in System (#330 S13-9). Scan folders, monitoring status, auto-hide, display mode, worker threads, LoraManager and the LoRA import leave the page (rows B8–B14).	2026-10-27 18:44:30 -07:00
Vito Sansevero	0abdcbc814	refactor(admin): open System for Diagnostics and logs The admin page's Diagnostics and View Logs buttons become links that open System › Diagnostics & logs in a new tab. The legacy Diagnostics and System Logs dialogs and their methods go; TESTING.md lists them against their covered capabilities (rows B1–B7).	2026-10-27 18:41:38 -07:00
Vito Sansevero	c0d27772b4	test(legacy): prove each removed legacy control has native coverage TESTING.md gains the "Legacy System UI removed by S13" table (no rows yet). legacy-coverage.test.mjs fails when a removal cites a capability that is not covered, copies another native test, lists an id or method twice, or leaves the id or method on its page. legacy-system-links.spec.mjs holds the System link table and guards the kept admin flows.	2026-10-27 18:18:18 -07:00
Vito Sansevero	b26ae112e6	test(legacy): snapshot the routes and the settings response Pins every registered route and the key paths of GET /prompt_manager/settings while System S13 (#330) moves the legacy pages' tools to native System. Recorded on the unchanged main; cutover (#334) removes it.	2026-10-27 18:13:52 -07:00