refactor(parse): return a uniform pair from the SameValueZero key

fix(scan): link the traced prompt when the pair resolver cannot decide
The output scan skipped every file the pair resolver called ambiguous or unresolved, so workflows where several samplers share one prompt (a base pass, an upscale pass and a detailer) never reached the Library from a scan. It now links the positive prompt the shared parser traces for those files, the prompt the inspector and the legacy pages show. Files the resolver decides are stored as before, and graphs without a recognized sampler keep the legacy extractor (#252). Read-only scans of a 38,602-file output folder into temporary databases: - links: 1,500 before, 7,954 after; none of the 1,500 dropped or changed; - of the added links that differ from the pre-redesign scan, 1,275 replace a number, a LoRA tag, a fragment or a truncated prompt that scan stored.
2026-10-19 20:42:22 -07:00 · 2026-10-19 20:22:53 -07:00 · 2026-10-19 20:22:53 -07:00
794 changed files with 11656 additions and 236760 deletions
@@ -1,12 +1,22 @@
 {
  "required_status_checks": {
-    "strict": false,
+    "strict": true,
    "contexts": [
+      "py3.10 on ubuntu-latest",
+      "py3.11 on ubuntu-latest",
      "py3.12 on ubuntu-latest",
+      "py3.13 on ubuntu-latest",
+      "py3.10 on windows-latest",
+      "py3.11 on windows-latest",
+      "py3.12 on windows-latest",
+      "py3.13 on windows-latest",
+      "py3.10 on macos-latest",
+      "py3.11 on macos-latest",
+      "py3.12 on macos-latest",
+      "py3.13 on macos-latest",
      "coverage gate (85%)",
      "black and flake8",
      "frontend modules",
-      "all tests",
      "viewerjs",
      "real ComfyUI compatibility",
      "bandit (high severity)"
@@ -4,7 +4,6 @@ permissions:
  contents: read

 on:
-  merge_group:
  push:
    branches: [main]
  pull_request:
@@ -20,17 +19,14 @@ jobs:
  security:
    name: bandit (high severity)
    runs-on: ubuntu-latest
-    # ceil(1.5 x slowest of three green main runs) + 3, never under 5 (test.yml): runs 40257217665,
-    # 40254137380, 40240706583 took 23s / 16s / 23s -> 5 min.
-    timeout-minutes: 5

    steps:
      - uses: actions/checkout@v7

-      - name: Set up Python 3.12
+      - name: Set up Python 3.10
        uses: actions/setup-python@v7
        with:
-          python-version: "3.12"
+          python-version: "3.10"

      - name: Install bandit
        run: pip install bandit[toml]
@@ -1,117 +0,0 @@
-name: Windows
-
-permissions:
-  contents: read
-
-# Non-blocking Windows runs (#420; macOS dropped from CI in #571): never on pull requests or in the merge queue, and no context
-# here is a required check. A red run is fixed at its cause before the workspace cutover (#334).
-on:
-  push:
-    branches: [main]
-  schedule:
-    - cron: "17 3 * * *"
-  workflow_dispatch:
-
-# Every run gets its own group (run_id), so no main commit's run is ever cancelled or dropped as pending.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.run_id }}
-  cancel-in-progress: false
-
-env:
-  PYTHONFAULTHANDLER: "1"
-
-# Time limit rule as in test.yml: ceil(1.5 x the slowest of three recent green runs on main) + 3
-# minutes, never under 5, timed as whole-job wall time. One matrix job, so the slowest leg of each
-# run counts (tests/vendor/ci-workflow.test.mjs recomputes it, #493).
-# Measured 2026-10-29 on main runs 40935337099 (dd247e3), 40938407252 (dd247e3), 40941240624 (dd247e3):
-#   slowest leg: 7m24s (py3.12 windows) / 7m31s (py3.13 windows) / 7m32s (py3.14 windows) -> 15 min
-#     (windows 4m56s-7m32s)
-#   native-trash-linux (#543) has no green main runs yet: it installs the dev requirements and runs
-#     one test module, about 1 minute by the same estimate, so ceil(1.5 x 2) + 3 gives it 6 minutes.
-#     Recalibrate after three green runs.
-jobs:
-  test:
-    name: py${{ matrix.python-version }} on ${{ matrix.os }}
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 15
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [windows-latest]
-        python-version: ["3.12", "3.13", "3.14"]
-
-    steps:
-      - uses: actions/checkout@v7
-
-      - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v7
-        with:
-          python-version: ${{ matrix.python-version }}
-          cache: pip
-          cache-dependency-path: requirements-dev.txt
-
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          pip install -r requirements-dev.txt
-
-      # The runner's TEMP is on C:, the OS disk, where a flush took about 6 ms
-      # and a test database's create-to-delete about 111 ms; on the D: work
-      # disk the same took 0.5 ms and 23 ms. Tests write their
-      # databases under TEMP, so it moves to a folder on D: (measured in #487,
-      # run 40915866444). The runner's TEMP was an 8.3 short name
-      # (C:\Users\RUNNER~1\...), so the new one is spelled by its short name too
-      # and paths still have to be resolved. D: makes no short names by default
-      # (run 40922502209), so they are switched on for it first.
-      - name: Keep test files on the work disk (Windows)
-        if: runner.os == 'Windows'
-        shell: pwsh
-        run: |
-          fsutil 8dot3name set D: 0
-          $folder = New-Item -ItemType Directory -Force -Path (Join-Path $env:RUNNER_TEMP "PromptManagerTests")
-          $short = (New-Object -ComObject Scripting.FileSystemObject).GetFolder($folder.FullName).ShortPath
-          Write-Output "test TEMP: $short (long name $($folder.FullName))"
-          if ($short -eq $folder.FullName) { Write-Output "::warning::D: gave the test TEMP no 8.3 short name" }
-          "TEMP=$short" >> $env:GITHUB_ENV
-          "TMP=$short" >> $env:GITHUB_ENV
-
-      - name: Run tests
-        env:
-          PM_TEST_SLOWEST: "40"
-        run: python -m tests.run_suite -v
-
-  # The same tests as the fake mount table, on a real ext4 mount used as the output root (#543). A
-  # runner can mount with sudo; the tests run as the normal user, so owner and mode checks are real.
-  native-trash-linux:
-    name: native trash on a real mount
-    runs-on: ubuntu-latest
-    timeout-minutes: 6
-
-    steps:
-      - uses: actions/checkout@v7
-
-      - name: Set up Python
-        uses: actions/setup-python@v7
-        with:
-          python-version: "3.12"
-          cache: pip
-          cache-dependency-path: requirements-dev.txt
-
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          pip install -r requirements-dev.txt
-
-      - name: Mount an ext4 image
-        run: |
-          truncate -s 64M "$RUNNER_TEMP/drive.img"
-          mkfs.ext4 -q "$RUNNER_TEMP/drive.img"
-          mkdir "$RUNNER_TEMP/drive"
-          sudo mount -o loop "$RUNNER_TEMP/drive.img" "$RUNNER_TEMP/drive"
-          sudo rmdir "$RUNNER_TEMP/drive/lost+found"
-          sudo chown "$(id -u):$(id -g)" "$RUNNER_TEMP/drive"
-          findmnt "$RUNNER_TEMP/drive"
-
-      - name: Native trash proof
-        timeout-minutes: 4
-        run: PM_TRASH_MOUNT="$RUNNER_TEMP/drive" python -m unittest tests.test_trash_mount_root -v
@@ -4,12 +4,10 @@ permissions:
  contents: read

 on:
-  merge_group:
  pull_request:
    branches: [main]
  push:
    branches: [main]
-  workflow_dispatch:

 # Superseded PR pushes cancel their older run. Every main push gets its own
 # group (run_id), so no main commit's run is ever cancelled or dropped as pending.
@@ -20,36 +18,15 @@ concurrency:
 env:
  PYTHONFAULTHANDLER: "1"

-# Every job has a time limit: ceil(1.5 x the slowest of three recent green runs on main) + 3
-# minutes, never under 5. The 3 minutes leave room for the Python runner's watchdog (120 s, see
-# tests/run_suite.py) to print its stack dump before GitHub cancels the job. A limit changes only
-# with new measurements written here (TESTING.md "Time limits and hangs").
-# Measured 2026-10-26 on runs 40257217681 (3be0ada), 40240706568 (fb9134f), 40228167328 (f9835aa):
-#   py matrix, slowest py3.10 on windows-latest: 12m43s / 15m54s / 14m53s -> 27 min
-#     (ubuntu 5m27s-6m27s, macos 6m14s-8m30s, windows 11m42s-15m54s)
-#     3.10 and 3.11 left the matrix and 3.14 joined it in #356; re-measure after three green main runs.
-#     Windows moved to portability.yml (#420; macOS left CI in #571), which has its own measured limit (#493);
-#     this Linux-only matrix keeps 27 minutes until it is re-measured.
-#   real ComfyUI compatibility: 13m32s / 8m55s / 11m46s -> 24 min
-#   coverage gate (85%): 7m26s / 7m22s / 7m54s -> 15 min
-#   perf budget 30s / 29s / 27s, black and flake8 39s / 37s / 39s,
-#   frontend modules 23s / 19s / 29s -> 5 min (the floor)
-#   all tests: a result check without setup, 5 min (the floor)
-#
-# Pull requests run a fast subset (#420): Python 3.12 on ubuntu-latest, coverage, lint and frontend
-# modules. The merge queue (merge_group), pushes to main and manual runs add Python 3.13 and 3.14 on
-# Linux and the real ComfyUI job. "all tests" is the required gate that holds the queue to that set.
-# Windows runs in portability.yml (push to main, nightly, on demand) and never gate a merge.
 jobs:
  test:
    name: py${{ matrix.python-version }} on ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
-    timeout-minutes: 27
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest]
-        python-version: ${{ github.event_name == 'pull_request' && fromJSON('["3.12"]') || fromJSON('["3.12", "3.13", "3.14"]') }}
+        os: [ubuntu-latest, windows-latest, macos-latest]
+        python-version: ["3.10", "3.11", "3.12", "3.13"]

    steps:
      - uses: actions/checkout@v7
@@ -67,26 +44,21 @@ jobs:
          pip install -r requirements-dev.txt

      - name: Run tests
-        run: python -m tests.run_suite -v
+        run: python -m unittest discover -s tests -v

  comfyui:
    name: real ComfyUI compatibility
-    # Merge queue, main and manual runs only. A job skipped by its condition reports Success, so this
-    # required context never blocks a pull request; "all tests" fails if it is skipped anywhere else.
-    if: github.event_name != 'pull_request'
    runs-on: ubuntu-latest
-    # Chromium and its system libraries come from the pinned Playwright image (tag = @playwright/test in
-    # tools/vendor/package-lock.json; tests/vendor/browser-image.test.mjs checks it). The runner install
-    # pulled them from Ubuntu's apt mirror on every run, and three runs (#349, #378, #382) crawled at
-    # ~26 kB/s for 11-12 minutes until the job hit its limit after every test had passed.
-    container:
-      image: mcr.microsoft.com/playwright:v1.64.1-noble
-      options: --user 1001
-    timeout-minutes: 24
+    timeout-minutes: 25
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
+      - uses: actions/setup-node@v7
+        with:
+          node-version: "24"
+          cache: npm
+          cache-dependency-path: tools/vendor/package-lock.json
      - name: Read the reviewed runtime pins
        id: runtime
        run: |
@@ -111,42 +83,21 @@ jobs:
          ref: ${{ steps.runtime.outputs.kikoRevision }}
          path: .ci-kikotools
          persist-credentials: false
-      # The image's own Python and Node 24: setup-python/setup-node install the runner's toolcache builds,
-      # whose entry points name host paths that do not exist in the container. The image has no ensurepip
-      # and the job has no root, so a checksum-pinned pip wheel bootstraps a user-space venv. The image
-      # Python must be the reviewed host Python, so a pin or image bump that disagrees fails here.
-      - name: Python environment on the reviewed host Python
-        env:
-          PIP_WHEEL: https://files.pythonhosted.org/packages/f3/6e/1736e5b4ae2b778ef2f81c47d797de9f891d4d8acb047a24ca37a60294dd/pip-26.2.1-py3-none-any.whl
-          PIP_SHA256: 71138adf1f4ca900cdb7d289c21b7494329f2332b6d85f0e1c42108c0384ed3e
-          PINNED_PYTHON: ${{ steps.runtime.outputs.pythonVersion }}
-        run: |
-          image="$(python3 -c 'import sys; print("%d.%d" % sys.version_info[:2])')"
-          [ "$image" = "$PINNED_PYTHON" ] || { echo "::error::image Python $image is not the pinned $PINNED_PYTHON"; exit 1; }
-          venv="$RUNNER_TEMP/venv" wheel="$RUNNER_TEMP/pip-26.2.1-py3-none-any.whl"
-          python3 -m venv --without-pip "$venv"
-          curl -fsSL --retry 3 -o "$wheel" "$PIP_WHEEL"
-          echo "$PIP_SHA256  $wheel" | sha256sum -c -
-          "$venv/bin/python" "$wheel/pip" install --no-index --no-cache-dir "$wheel"
-          echo "$venv/bin" >> "$GITHUB_PATH"
-      - run: python --version && node --version && node --version | grep -q '^v24\.'
-      # pip's download cache (torch alone is ~200 MB); inside the container ~ is the job's HOME (/github/home).
-      - name: Cache pip downloads
-        uses: actions/cache@v6
+      - uses: actions/setup-python@v7
        with:
-          path: ~/.cache/pip
-          key: pip-${{ runner.os }}-playwright-v1.64.1-${{ hashFiles('requirements-dev.txt', '.ci-comfyui/requirements.txt', 'tools/vendor/comfyui-runtime.json') }}
+          python-version: ${{ steps.runtime.outputs.pythonVersion }}
+          cache: pip
+          cache-dependency-path: |
+            requirements-dev.txt
+            .ci-comfyui/requirements.txt
+            tools/vendor/comfyui-runtime.json
      - name: Install CPU runtime and test dependencies
        run: |
+          python -m pip install --upgrade pip
          pip install "torch==${{ steps.runtime.outputs.torchVersion }}" "torchvision==${{ steps.runtime.outputs.torchvisionVersion }}" --index-url https://download.pytorch.org/whl/cpu
          pip install -r .ci-comfyui/requirements.txt -r requirements-dev.txt "torch==${{ steps.runtime.outputs.torchVersion }}" "torchvision==${{ steps.runtime.outputs.torchvisionVersion }}"
-      # npm's download cache, keyed on the lockfile. node_modules itself is still built fresh by npm ci.
-      - name: Cache npm downloads
-        uses: actions/cache@v6
-        with:
-          path: ~/.npm
-          key: npm-${{ runner.os }}-playwright-v1.64.1-${{ hashFiles('tools/vendor/package-lock.json') }}
      - run: npm ci --prefix tools/vendor --ignore-scripts
+      - run: npx --prefix tools/vendor playwright install --with-deps chromium
      - name: Classic and Nodes 2.0 startup and compatibility
        env:
          PM_COMFY_ROOT: ${{ github.workspace }}/.ci-comfyui
@@ -175,7 +126,6 @@ jobs:
  coverage:
    name: coverage gate (85%)
    runs-on: ubuntu-latest
-    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7

@@ -192,65 +142,31 @@ jobs:

      - name: Measure coverage
        run: |
-          python -m coverage run -m tests.run_suite
+          python -m coverage run -m unittest discover -s tests
          python -m coverage combine
          python -m coverage report --fail-under=85

-  perf-budget:
-    # The reference wall-clock measurement (TESTING.md "Performance budgets").
-    # Shared-runner timing varies, so it never gates a pull request: it runs on
-    # each push to main and on demand. A red run on main means fix the code.
-    name: perf budget
-    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@v7
-
-      - uses: actions/setup-python@v7
-        with:
-          python-version: "3.13"
-          cache: pip
-          cache-dependency-path: requirements-dev.txt
-
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          pip install -r requirements-dev.txt
-
-      - name: Workspace filter budget
-        env:
-          PROMPTMANAGER_PERF_BUDGET: "1"
-        run: python -m unittest -v tests.test_api_workspace_images.TestWorkspaceImages.test_filter_budget
-
  lint:
    name: black and flake8
    runs-on: ubuntu-latest
-    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v7
        with:
          python-version: "3.12"
-          cache: pip
-          cache-dependency-path: requirements-dev.txt
-      # The exact black and flake8 pins from requirements-dev.txt, so a new release cannot turn CI red.
-      - run: pip install $(grep -E '^(black|flake8)==' requirements-dev.txt)
+      - run: pip install black flake8
      - run: black --check .
      - run: flake8 .

  js-test:
    name: frontend modules
    runs-on: ubuntu-latest
-    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-node@v7
        with:
          node-version: "24"
-          cache: npm
-          cache-dependency-path: tools/vendor/package-lock.json

      - name: Check shipped extension and page modules parse
        run: |
@@ -264,32 +180,3 @@ jobs:

      - name: Run JS tests
        run: node --test tests/js/*.test.js
-
-  # The required context "all tests". A dropped matrix leg never reports a check at all, so the eight
-  # legs that pull requests skip cannot be required by name; this gate requires them instead. Every
-  # job must succeed; real ComfyUI must be skipped on a pull request and succeed on every other event.
-  all-tests:
-    name: all tests
-    needs: [test, comfyui, coverage, lint, js-test]
-    if: always()
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - name: Require every test job for this event
-        env:
-          EVENT_NAME: ${{ github.event_name }}
-          TEST_RESULT: ${{ needs.test.result }}
-          COMFYUI_RESULT: ${{ needs.comfyui.result }}
-          COVERAGE_RESULT: ${{ needs.coverage.result }}
-          LINT_RESULT: ${{ needs.lint.result }}
-          JS_RESULT: ${{ needs.js-test.result }}
-        run: |
-          queue_only=success
-          if [ "$EVENT_NAME" = pull_request ]; then queue_only=skipped; fi
-          echo "event: $EVENT_NAME (real ComfyUI must be $queue_only)"
-          echo "test matrix: $TEST_RESULT"
-          echo "comfyui: $COMFYUI_RESULT"
-          echo "coverage: $COVERAGE_RESULT"
-          echo "lint: $LINT_RESULT"
-          echo "js-test: $JS_RESULT"
-          test "$TEST_RESULT" = success && test "$COVERAGE_RESULT" = success && test "$LINT_RESULT" = success && test "$JS_RESULT" = success && test "$COMFYUI_RESULT" = "$queue_only"
@@ -1,7 +1,6 @@
 name: Viewer.js vendor and compatibility

 on:
-  merge_group:
  pull_request:
    branches: [main]
  push:
@@ -17,37 +16,9 @@ concurrency:
  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

-# Timeouts are the measured job time plus at least 50%, and never under 20 minutes for a browser job,
-# because runner speed varies. Before sharding (main 2cecfcf, one worker): frontend coverage 32m10s,
-# page workflows firefox 18m59s, webkit 19m26s. First sharded run (PR #274 run 39712909047, 3 workers,
-# no npm cache, where npm ci stalled for 5m in six of eight jobs): coverage shards 11m19s/10m47s/10m49s
-# (tests 5m20s/4m42s/4m46s), merge 5m52s (report and check 4s), firefox shards 7m53s/9m27s (tests
-# 4m41s/3m29s), webkit shards 12m25s+ (cancelled at the old 12-minute limit after its 267 tests passed in
-# 6m29s) and 4m53s (tests 3m08s). With the npm cache hit (run 39725176320 at cbc8a61, npm ci 0-2s):
-# coverage shards 7m34s/6m04s/5m22s (tests 6m38s/4m53s/4m04s), merge 54s, firefox 7m57s/5m21s (tests
-# 7m08s/4m34s), webkit 8m16s/5m03s (tests 7m26s/3m58s); a cache miss adds up to 5m to npm ci, which
-# the 20-minute limits absorb.
-# Hangs (#425): a job killed at its limit keeps no log and skips its upload steps, so each browser
-# test step has its own timeout-minutes (18) below the job's 20. At the step limit, SIGTERM makes
-# tools/vendor/running-tests-reporter.mjs print the tests still running and hand over to Playwright's
-# interrupt, which writes the blob report; the always() uploads then run.
-# Measured on main (runs 40725289094, 40719375442, 40700439399): setup before the test step <= 52s,
-# uploads <= 35s; test steps up to 14m42s (webkit shard 1/2) and 13m05s for coverage (shard 1/3:
-# 12m53s, node units and the viewer suite before 11.8m of workflows), so coverage is the tight one
-# in its 18 minutes. This holds only when the npm cache hits: a cold cache adds up to 5m to npm ci,
-# and then the job limit can still end the job before the step limit does.
-# #473: firefox/webkit shard 1/2 reached its 18-minute step limit (queue run 40866252975: webkit 622 tests
-# passed in 17m56s, 48.5 worker-minutes vs 28.0 in shard 2/2; recent shard 1/2 jobs 13.7m-18.9m, shard 2/2
-# 7.3m-12.2m), because --shard splits by test count and the slow concept specs sort into shard 1. The page
-# workflows now run in three shards per browser with the limits unchanged; the per-shard times are
-# re-measured after three green main runs.
-# #563: coverage shards reached their 18-minute step limit three times on 2026-10-31 with no failing
-# test (PR #560 shard 2/3: 814 passed in 17.9m; queue run 41206495451 shard 1/3: 827 passed; PR #564
-# shard 2/3 twice), against recent green shards of 11m-17m. Coverage now runs in four shards with the
-# limits unchanged; the per-shard times are re-measured after three green main runs.
 jobs:
  frontend-coverage:
-    name: frontend coverage (shard ${{ matrix.shard }}/4)
+    name: frontend coverage (chromium and touch)
    runs-on: ubuntu-latest
    # Layout comparisons depend on the fonts each browser falls back to, so browser jobs run in the
    # same pinned Playwright image as local runs (tag = @playwright/test in tools/vendor/package-lock.json;
@@ -55,15 +26,7 @@ jobs:
    container:
      image: mcr.microsoft.com/playwright:v1.64.1-noble
      options: --user 1001
-    timeout-minutes: 20
-    # Public-repo ubuntu-latest runners have 4 vCPUs: three Playwright workers, each with its own test
-    # server, leave one CPU for the servers and the runner.
-    env:
-      PM_TEST_WORKERS: 3
-    strategy:
-      fail-fast: false
-      matrix:
-        shard: [1, 2, 3, 4]
+    timeout-minutes: 25
    steps:
      - uses: actions/checkout@v7
      # The image's own Python 3.12 and Node 24: setup-python/setup-node install the runner's toolcache
@@ -82,111 +45,24 @@ jobs:
          "$venv/bin/python" -m pip install --no-cache-dir -r requirements-dev.txt
          echo "$venv/bin" >> "$GITHUB_PATH"
      - run: python --version && node --version && node --version | grep -q '^v24\.'
-      # npm's download cache, keyed on the lockfile; inside the container ~ is the job's HOME (/github/home),
-      # which npm also uses. node_modules itself is still built fresh by npm ci.
-      - name: Cache npm downloads
-        uses: actions/cache@v6
-        with:
-          path: ~/.npm
-          key: npm-${{ runner.os }}-playwright-v1.64.1-${{ hashFiles('tools/vendor/package-lock.json') }}
      - run: npm ci --prefix tools/vendor --ignore-scripts
-      # Shard 1 also runs the node units and the viewer suite, so the vendor pins and the tooling tests
-      # run on the lightest shard instead.
-      - if: matrix.shard == 4
-        run: npm run --prefix tools/vendor check
-      - if: matrix.shard == 4
-        run: npm run --prefix tools/vendor test
-      - name: Page workflows with coverage, shard ${{ matrix.shard }}/4
-        timeout-minutes: 18
-        run: npm run --prefix tools/vendor test:coverage:shard -- ${{ matrix.shard }}/4
-      - name: Upload raw coverage
-        uses: actions/upload-artifact@v7
-        with:
-          name: coverage-raw-${{ matrix.shard }}
-          path: coverage/js/raw/
-          if-no-files-found: error
-          retention-days: 3
-      # Traces and the blob report (test-results/blob/) of a failed, timed-out or cancelled step.
-      - name: Upload Chromium and touch traces
-        if: always()
-        uses: actions/upload-artifact@v7
-        with:
-          name: frontend-traces-shard-${{ matrix.shard }}
-          path: tools/vendor/test-results/
-          retention-days: 14
-
-  frontend-coverage-merge:
-    name: frontend coverage (merge)
-    needs: frontend-coverage
-    runs-on: ubuntu-latest
-    # Same image as the shards: the raw files name sources by the container's workspace path.
-    container:
-      image: mcr.microsoft.com/playwright:v1.64.1-noble
-      options: --user 1001
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v7
-      - run: node --version && node --version | grep -q '^v24\.'
-      # npm's download cache, keyed on the lockfile; inside the container ~ is the job's HOME (/github/home),
-      # which npm also uses. node_modules itself is still built fresh by npm ci.
-      - name: Cache npm downloads
-        uses: actions/cache@v6
-        with:
-          path: ~/.npm
-          key: npm-${{ runner.os }}-playwright-v1.64.1-${{ hashFiles('tools/vendor/package-lock.json') }}
-      - run: npm ci --prefix tools/vendor --ignore-scripts
-      # Each artifact lands in its own coverage-raw-N directory, so the next step can count them.
-      - uses: actions/download-artifact@v8
-        with:
-          pattern: coverage-raw-*
-          path: ${{ runner.temp }}/coverage-raw
-      # coverage:merge only checks that raw files exist; merging three of four shards would report
-      # partial coverage, so a missing or empty shard artifact fails here.
-      - name: Verify every shard's raw coverage arrived
-        shell: bash
-        env:
-          STAGED_RAW: ${{ runner.temp }}/coverage-raw
-          EXPECTED_SHARDS: 4
-        run: |
-          found=0
-          for shard in $(seq 1 "$EXPECTED_SHARDS"); do
-            directory="$STAGED_RAW/coverage-raw-$shard"
-            count=0
-            if [ -d "$directory" ]; then count=$(find "$directory" -maxdepth 1 -type f -name '*.json' | wc -l); fi
-            echo "coverage-raw-$shard: $count raw files"
-            if [ "$count" -gt 0 ]; then found=$((found + 1)); fi
-          done
-          echo "shard artifacts with raw coverage: $found of $EXPECTED_SHARDS"
-          if [ "$found" -ne "$EXPECTED_SHARDS" ]; then
-            echo "::error::Expected raw coverage from $EXPECTED_SHARDS shards, got $found of $EXPECTED_SHARDS"
-            exit 1
-          fi
-          staged=$(find "$STAGED_RAW" -mindepth 2 -maxdepth 2 -type f -name '*.json' | wc -l)
-          mkdir -p coverage/js/raw
-          # cp -n never overwrites; a clash shows up as fewer merged files than staged ones.
-          find "$STAGED_RAW" -mindepth 2 -maxdepth 2 -type f -name '*.json' -exec cp -n -t coverage/js/raw {} + || true
-          merged=$(find coverage/js/raw -maxdepth 1 -type f -name '*.json' | wc -l)
-          if [ "$merged" -ne "$staged" ]; then
-            echo "::error::Shards wrote clashing raw file names: $staged staged, $merged merged"
-            exit 1
-          fi
-          echo "merged $merged raw files"
-      - name: Frontend coverage report and baseline check
-        run: npm run --prefix tools/vendor coverage:merge
-      - name: Upload frontend coverage report
+      - run: npm run --prefix tools/vendor check
+      - run: npm run --prefix tools/vendor test
+      - name: Frontend unit, viewer, workflow, and coverage checks
+        run: npm run --prefix tools/vendor test:coverage
+      - name: Upload frontend coverage and Chromium traces
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: frontend-test-reports
          path: |
+            tools/vendor/test-results/
            coverage/js/
            !coverage/js/raw/**
          retention-days: 14

  browser-workflows:
-    name: page workflows (${{ matrix.browser }}, shard ${{ matrix.shard }}/3)
-    # Merge queue, main and manual runs only (#420); pull requests run the Chromium/touch coverage shards.
-    if: github.event_name != 'pull_request'
+    name: page workflows (${{ matrix.browser }})
    runs-on: ubuntu-latest
    # Layout comparisons depend on the fonts each browser falls back to, so browser jobs run in the
    # same pinned Playwright image as local runs (tag = @playwright/test in tools/vendor/package-lock.json;
@@ -194,16 +70,11 @@ jobs:
    container:
      image: mcr.microsoft.com/playwright:v1.64.1-noble
      options: --user 1001
-    timeout-minutes: 20
-    # Public-repo ubuntu-latest runners have 4 vCPUs: three Playwright workers, each with its own test
-    # server, leave one CPU for the servers and the runner.
-    env:
-      PM_TEST_WORKERS: 3
+    timeout-minutes: 25
    strategy:
      fail-fast: false
      matrix:
        browser: [firefox, webkit]
-        shard: [1, 2, 3]
    steps:
      - uses: actions/checkout@v7
      # The image's own Python 3.12 and Node 24: setup-python/setup-node install the runner's toolcache
@@ -222,47 +93,31 @@ jobs:
          "$venv/bin/python" -m pip install --no-cache-dir -r requirements-dev.txt
          echo "$venv/bin" >> "$GITHUB_PATH"
      - run: python --version && node --version && node --version | grep -q '^v24\.'
-      # npm's download cache, keyed on the lockfile; inside the container ~ is the job's HOME (/github/home),
-      # which npm also uses. node_modules itself is still built fresh by npm ci.
-      - name: Cache npm downloads
-        uses: actions/cache@v6
-        with:
-          path: ~/.npm
-          key: npm-${{ runner.os }}-playwright-v1.64.1-${{ hashFiles('tools/vendor/package-lock.json') }}
      - run: npm ci --prefix tools/vendor --ignore-scripts
-      - name: Page workflows in ${{ matrix.browser }}, shard ${{ matrix.shard }}/3
-        timeout-minutes: 18
-        run: npm run --prefix tools/vendor test:workflows -- --project ${{ matrix.browser }} --shard ${{ matrix.shard }}/3
-      # Traces and the blob report (test-results/blob/) of a failed, timed-out or cancelled step.
+      - name: Page workflows in ${{ matrix.browser }}
+        run: npm run --prefix tools/vendor test:workflows -- --project ${{ matrix.browser }}
      - name: Upload browser traces
        if: always()
        uses: actions/upload-artifact@v7
        with:
-          name: browser-traces-${{ matrix.browser }}-shard-${{ matrix.shard }}
+          name: browser-traces-${{ matrix.browser }}
          path: tools/vendor/test-results/
          retention-days: 14

  # Branch protection requires the exact context "viewerjs". This job keeps that
-  # name and fails unless every coverage shard and the coverage merge succeeded and
-  # the browser shards succeeded, or, on a pull request only, were skipped (#420).
-  # Any failure, cancellation or other skip fails it.
+  # name and fails unless every frontend job above succeeded, including when one
+  # was cancelled or skipped.
  viewerjs:
-    needs: [frontend-coverage, frontend-coverage-merge, browser-workflows]
+    needs: [frontend-coverage, browser-workflows]
    if: always()
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Require every frontend job to succeed
        env:
-          EVENT_NAME: ${{ github.event_name }}
          COVERAGE_RESULT: ${{ needs.frontend-coverage.result }}
-          MERGE_RESULT: ${{ needs.frontend-coverage-merge.result }}
          WORKFLOWS_RESULT: ${{ needs.browser-workflows.result }}
        run: |
-          queue_only=success
-          if [ "$EVENT_NAME" = pull_request ]; then queue_only=skipped; fi
-          echo "event: $EVENT_NAME (browser-workflows must be $queue_only)"
          echo "frontend-coverage: $COVERAGE_RESULT"
-          echo "frontend-coverage-merge: $MERGE_RESULT"
          echo "browser-workflows: $WORKFLOWS_RESULT"
-          test "$COVERAGE_RESULT" = success && test "$MERGE_RESULT" = success && test "$WORKFLOWS_RESULT" = "$queue_only"
+          test "$COVERAGE_RESULT" = success && test "$WORKFLOWS_RESULT" = success
@@ -211,10 +211,3 @@ coverage/

 # Disposable upstream checkout for real-host CI
 .ci-comfyui/
-
-# Old library files a Move library renamed (never deleted; #249 S6b)
-*.moved-to-*
-
-# Per-install key behind the workspace scopes and cursors (#430)
-workspace-scope.key
-.workspace-scope.key.*.tmp
@@ -13,18 +13,16 @@ repos:
        language: system
        types: [python]

-      # Fails at the severity CI enforces (code-quality.yml: -lll, high only), never stricter.
-      # pre-commit appends the staged files, so no shell wrapper can drop the first one.
      - id: bandit
        name: bandit
-        entry: bandit -lll -q
+        entry: bash -c 'bandit "$@" -ll -q 2>&1; true'
        language: system
        types: [python]
        exclude: ^(tests/|reference/)

      - id: tests
        name: tests
-        entry: python -m tests.run_suite -q
+        entry: python -m unittest discover tests/ -v
        language: system
        pass_filenames: false
        stages: [pre-push]
@@ -22,21 +22,22 @@ Features:
 - Comprehensive logging and diagnostics
 """

-import atexit
-import threading
-import time
+import re
 from pathlib import Path


 def get_version():
-    """Parse version from pyproject.toml (``utils/version.py``)."""
-    from .utils.version import project_version
-
+    """Parse version from pyproject.toml"""
    try:
-        root = Path(__file__).parent
+        pyproject_path = Path(__file__).parent / "pyproject.toml"
+        if pyproject_path.exists():
+            content = pyproject_path.read_text()
+            match = re.search(r'version\s*=\s*["\']([^"\']+)["\']', content)
+            if match:
+                return match.group(1)
    except Exception:
-        return "unknown"
-    return project_version(root)
+        pass
+    return "unknown"


 from .prompt_manager import (  # noqa: E402
@@ -71,12 +72,6 @@ NODE_DISPLAY_NAME_MAPPINGS = {
 # are served by our own routes instead (see py/api).
 WEB_DIRECTORY = "web/comfy"

-# Parts the package teardown stops (``_stop_background_work``). Each stays None
-# when its start-up block below fails, and the teardown skips it.
-api = None
-_global_prompt_tracker = None
-_global_image_monitor = None
-
 # Add API routes (same pattern as ComfyUI_Assets)
 try:
    # Set extension URI
@@ -92,38 +87,9 @@ try:
    routes = config.routes
    api = PromptManagerAPI()
    api.add_routes(routes)
-
-    # The thumbnail location's startup check (#320), then the temp files of
-    # preview writes a crash interrupted (#317), off the import path: the
-    # walk may cover a large thumbnails folder.
-    # #320: the configured thumbnail location is in force before any request
-    # (no I/O); the thread below checks it.
-    api.use_preview_location()
-
-    def _preview_startup():
-        api.start_preview_location()
-        api.recover_thumbnail_move()  # an interrupted move, before the sweep
-        api.sweep_thumbnail_temps()
-
-    threading.Thread(
-        target=_preview_startup,
-        name="PromptManagerPreviewTempSweep",
-        daemon=True,
-    ).start()
    host_app = getattr(config.server_instance, "app", None)
    if host_app is not None and hasattr(host_app, "on_cleanup"):
        host_app.on_cleanup.append(api.cleanup_history_reads)
-        host_app.on_cleanup.append(api.cleanup_annotation_captures)
-        host_app.on_cleanup.append(api.cleanup_gallery_listings)
-    if host_app is not None and hasattr(host_app, "on_startup"):
-        # Build each output root's Images listing once the server's loop runs,
-        # so the first open does not wait for the walk (#348).
-        host_app.on_startup.append(api.warm_gallery_listings)
-        # #320: old thumbnails a move left to remove, once it is checked.
-        host_app.on_startup.append(api.finish_thumbnail_move)
-    if host_app is not None and hasattr(host_app, "on_shutdown"):
-        # Open Needs review change streams end before the server waits on them.
-        host_app.on_shutdown.append(api.close_review_events)

 except Exception as e:
    # Log to internal logging system without console spam
@@ -133,7 +99,6 @@ except Exception as e:
        logger = get_logger("prompt_manager.init")
        logger.error(f"Failed to register API routes: {e}")
    except Exception:
-        # logging failed too; a report must never stop the node loading
        pass

 # Shared database, set up with the monitoring system below. Stays None when that
@@ -156,19 +121,6 @@ try:
    _global_prompt_tracker = get_prompt_tracker(_global_db)
    _global_image_monitor = get_image_monitor(_global_db, _global_prompt_tracker)

-    # The Needs review pass for ambiguous new outputs runs through the API's
-    # capture store (the one the scan and the Tag dialog use): a linked output
-    # is never queued and its pending items leave the queue. The package
-    # teardown detaches it before that store is closed at shutdown.
-    if api is not None:
-        _global_image_monitor.set_review_recorder(api.record_review_file)
-        # Every settled output's preview is queued for the API's background
-        # worker (#249): the workspace never asks to generate thumbnails.
-        _global_image_monitor.set_thumbnail_queue(api.queue_capture_thumbnail)
-        # Every settled output walks its Images listing again (#348): the
-        # API hops from the monitor's thread onto the server's loop.
-        _global_image_monitor.set_output_listener(api.notify_output_settled)
-
    # Start monitoring
    _global_image_monitor.start_monitoring()
    _init_logger.info("Global image monitoring system started successfully")
@@ -209,26 +161,6 @@ except Exception as e:
            f"Failed to register usage hook: {e}"
        )

-# A cached node counts what its last execution of the same text counted (#347).
-try:
-    from .py.config import server_instance
-    from .utils.cached_runs import register_cached_runs
-
-    register_cached_runs(server_instance, _db_factory)
-except Exception as e:
-    try:
-        from .utils.logging_config import get_logger
-
-        get_logger("prompt_manager.init").error(
-            f"Failed to register cached-run counting: {e}"
-        )
-    except Exception:
-        import logging
-
-        logging.getLogger("prompt_manager.init").error(
-            f"Failed to register cached-run counting: {e}"
-        )
-

 def _history_db_factory() -> "PromptDatabase":
    """Initialize history on its worker even if monitoring initialization failed."""
@@ -257,216 +189,14 @@ except Exception:
            "Failed to register execution history"
        )

-
-# ── Package teardown (#301, #302) ────────────────────────────────────────────
-# ComfyUI never runs aiohttp's cleanup hooks (it never calls
-# ``runner.cleanup()``), so ``atexit`` is the live host's path: Ctrl+C, and a
-# normal exit. It is registered after the history hook, so at exit (newest
-# first) it runs before the history dispose. Hosts that do run ``on_cleanup``
-# (our test servers) run it there, and the tests' package unload calls it.
-
-TEARDOWN_SECONDS = 10.0
-_clock = time.monotonic
-_background_work_lock = threading.Lock()
-_background_work_result = None
-
-
-def _teardown_step(name, stop, logger):
-    """Run one teardown step; a failure (even Ctrl+C) is logged and is False."""
-    try:
-        return bool(stop())
-    except (Exception, KeyboardInterrupt):
-        logger.error(f"Background work: stopping {name} failed", exc_info=True)
-        return False
-
-
-def _teardown_logger():
-    """PromptManager's init logger; the standard one if that cannot load."""
-    try:
-        from .utils.logging_config import get_logger
-
-        return get_logger("prompt_manager.init")
-    except Exception:
-        import logging
-
-        return logging.getLogger("prompt_manager.init")
-
-
-def _stop_background_work():
-    """Stop the image monitor, the preview worker, the job worker threads
-    and the prompt cleanup thread against one TEARDOWN_SECONDS deadline, once.
-
-    Returns ``{"monitor", "thumbnails", "workers", "tracker"}`` booleans
-    (True: it stopped), leaving out parts that never started. Later calls return a
-    copy of the first result. A Ctrl+C inside a step is logged and the
-    step is False; one between steps is re-raised after the result (parts
-    not reached are False) is stored and the ``atexit`` entry removed.
-    """
-    global _background_work_result
-    with _background_work_lock:
-        if _background_work_result is not None:
-            return dict(_background_work_result)
-        monitor, thumbnails, tracker = (
-            _global_image_monitor,
-            api,
-            _global_prompt_tracker,
-        )
-        from .utils import parallel
-
-        # A part whose global is set has started; False until its step says
-        # otherwise, so an interrupt between steps leaves an honest result.
-        started = (
-            ("monitor", monitor),
-            ("thumbnails", thumbnails),
-            ("workers", parallel.job_pool_started() or None),
-            ("tracker", tracker),
-        )
-        result = {name: False for name, part in started if part is not None}
-        try:
-            logger = _teardown_logger()
-            began = _clock()
-            deadline = began + TEARDOWN_SECONDS
-
-            def left(own_bound):
-                return max(0.0, min(own_bound, deadline - _clock()))
-
-            if monitor is not None:
-
-                def stop_monitor():
-                    from .utils.image_monitor import OBSERVER_JOIN_SECONDS
-
-                    # Callbacks first: an image in hand queues no preview into a
-                    # closing preview worker. The worker may have read the queue
-                    # callback already, so the API refuses new previews too (at
-                    # exit, Python 3.12+ refuses to start their worker thread).
-                    if thumbnails is not None:
-                        thumbnails.refuse_auto_thumbnails()
-                    monitor.set_review_recorder(None)
-                    monitor.set_thumbnail_queue(None)
-                    monitor.set_output_listener(None)
-                    return monitor.stop_monitoring(left(OBSERVER_JOIN_SECONDS))
-
-                result["monitor"] = _teardown_step(
-                    "the image monitor", stop_monitor, logger
-                )
-            if thumbnails is not None:
-
-                def close_previews():
-                    from .py.api.thumbnail_auto import CLOSE_WAIT_SECONDS
-
-                    return thumbnails.close_auto_thumbnails(
-                        final=True, timeout=left(CLOSE_WAIT_SECONDS)
-                    )
-
-                result["thumbnails"] = _teardown_step(
-                    "the preview worker", close_previews, logger
-                )
-            if "workers" in result:
-
-                def stop_workers():
-                    from .utils.parallel import JOB_POOL_JOIN_SECONDS
-
-                    return parallel.shutdown_job_pool(left(JOB_POOL_JOIN_SECONDS))
-
-                result["workers"] = _teardown_step(
-                    "the job worker threads", stop_workers, logger
-                )
-            if tracker is not None:
-
-                def stop_tracker():
-                    from .utils.prompt_tracker import TRACKER_JOIN_SECONDS
-
-                    return tracker.shutdown(left(TRACKER_JOIN_SECONDS))
-
-                result["tracker"] = _teardown_step(
-                    "the prompt cleanup thread", stop_tracker, logger
-                )
-            elapsed = _clock() - began
-            failed = [name for name, ok in result.items() if not ok]
-            if failed:
-                logger.warning(
-                    f"Background work not stopped in time ({elapsed:.1f} s): "
-                    + ", ".join(failed)
-                )
-            else:
-                parts = " ".join(f"{name}=ok" for name in result)
-                logger.info(f"Background work stopped in {elapsed:.1f} s: {parts}")
-        finally:
-            _background_work_result = result
-            atexit.unregister(_stop_background_work)
-        return dict(result)
-
-
-async def _stop_background_work_on_cleanup(app):
-    """aiohttp ``on_cleanup``: no request is served then, so it runs inline."""
-    _stop_background_work()
-
-
-def _kill_encoders_at_exit():
-    """Run by the exit hook before Python joins the executor threads (#376):
-    a JPEG XL or ffmpeg encoder (no console on Windows, so Ctrl+C never
-    reaches it) is killed instead of being waited for."""
-    from .py.api.thumbnail_encode import shutdown_encoders
-
-    shutdown_encoders()
-
-
-def _abort_downloads_at_exit():
-    """Run by the exit hook (#376): huggingface_hub's Xet transfers ignore
-    the chunk checkpoint, so they are aborted the way hub aborts on Ctrl+C."""
-    import sys
-
-    if "huggingface_hub" not in sys.modules:
-        return  # no download ever ran: import nothing at exit
-    from .py.autotag import abort_hub_downloads
-
-    abort_hub_downloads()
-
-
-try:
-    # Before the executor join: running jobs stop at their next file, item or
-    # chunk (#376). The teardown below still runs from atexit afterwards.
-    from .utils import exit_signal as _exit_signal
-
-    _exit_signal.install(_kill_encoders_at_exit)
-    _exit_signal.install(_abort_downloads_at_exit)
-except Exception as e:
-    try:
-        from .utils.logging_config import get_logger
-
-        get_logger("prompt_manager.init").error(
-            f"Failed to register the exit signal: {e}"
-        )
-    except Exception:
-        # logging failed too; a report must never stop the node loading
-        pass
-
-try:
-    atexit.register(_stop_background_work)
-    from .py.config import server_instance as _teardown_server
-
-    _teardown_host = getattr(_teardown_server, "app", None)
-    if _teardown_host is not None and hasattr(_teardown_host, "on_cleanup"):
-        _teardown_host.on_cleanup.insert(0, _stop_background_work_on_cleanup)
-except Exception as e:
-    try:
-        from .utils.logging_config import get_logger
-
-        get_logger("prompt_manager.init").error(
-            f"Failed to register the background work teardown: {e}"
-        )
-    except Exception:
-        # logging failed too; a report must never stop the node loading
-        pass
-
 __all__ = ["NODE_CLASS_MAPPINGS", "NODE_DISPLAY_NAME_MAPPINGS", "WEB_DIRECTORY"]

-# One startup line, printed at import on purpose: it is the package's banner on
-# stdout, as ComfyUI's other custom nodes print theirs. Not a log record: the
-# console log handler hides INFO by default, so a logger would drop it. ASCII
-# only: a Windows console using a legacy code page cannot print emoji, and a
-# UnicodeEncodeError here would abort loading the node.
-print(
-    f"\033[94m[ComfyUI-PromptManager] Version:\033[0m {get_version()}"
-    f" - {len(NODE_CLASS_MAPPINGS)} tools loaded"
-)
+# Print startup message with loaded tools
+print()
+print(f"\033[94m[ComfyUI-PromptManager] Version:\033[0m {get_version()}")
+for node_key, display_name in NODE_DISPLAY_NAME_MAPPINGS.items():
+    # ASCII only: a Windows console using a legacy code page cannot print emoji,
+    # and a UnicodeEncodeError here would abort loading the whole node.
+    print(f"  \033[94mLoaded:\033[0m {display_name}")
+print(f"\033[94mTotal: {len(NODE_CLASS_MAPPINGS)} tools loaded\033[0m")
+print()
@@ -1,290 +0,0 @@
-"""Image annotation schema group (#249): file locators, byte records, image tags.
-
-The group installs like ``image_favorites`` and ``saved_views``: optional in old
-backups, required once a database is current. It owns
-
- ``media_annotation_metadata``: one row, the group's schema version and the
-  image index revision;
- ``media_annotation_files``: one private canonical locator per physical file
-  (``normcase(join(realpath(root), relative))``, server-side only);
- ``media_annotation_bytes``: one record per observed whole-file SHA-256 of a
-  file, with the size and ``mtime_ns`` verified when those bytes were last seen
-  and the tag set's revision;
- ``media_image_tags``: the ordered image tag set of one byte record, joined
-  into the global ``tags`` registry so vocabulary maintenance carries image
-  links like prompt and pair links.
-
-Installation never backfills anything from prompt or pair tags and never
-touches the filesystem. Validation reads only: the catalog objects are compared
-after whitespace compaction, columns, foreign keys and indexes through the
-PRAGMAs, and persisted values in single bounded SQL passes.
-"""
-
-import re
-import sqlite3
-from typing import Optional
-
-from .image_favorites import MAX_KEY_LENGTH
-
-SCHEMA_VERSION = 1
-METADATA_TABLE = "media_annotation_metadata"
-FILES_TABLE = "media_annotation_files"
-BYTES_TABLE = "media_annotation_bytes"
-IMAGE_TAGS_TABLE = "media_image_tags"
-TABLES = (METADATA_TABLE, FILES_TABLE, BYTES_TABLE, IMAGE_TAGS_TABLE)
-MAX_LOCATOR_LENGTH = MAX_KEY_LENGTH
-_TIMESTAMP_BYTES = 64
-
-_TABLE_DDL = {
-    METADATA_TABLE: (
-        f"CREATE TABLE {METADATA_TABLE} (singleton_id INTEGER PRIMARY KEY "
-        "CHECK(singleton_id=1), schema_version INTEGER NOT NULL "
-        f"CHECK(schema_version={SCHEMA_VERSION}), "
-        "image_index_revision INTEGER NOT NULL DEFAULT 0 "
-        "CHECK(image_index_revision>=0))"
-    ),
-    FILES_TABLE: (
-        f"CREATE TABLE {FILES_TABLE} (id TEXT PRIMARY KEY CHECK(length(id)=36), "
-        "locator TEXT NOT NULL UNIQUE, created_at TEXT NOT NULL)"
-    ),
-    BYTES_TABLE: (
-        f"CREATE TABLE {BYTES_TABLE} (id TEXT PRIMARY KEY CHECK(length(id)=36), "
-        f"file_id TEXT NOT NULL REFERENCES {FILES_TABLE}(id) ON DELETE CASCADE, "
-        "sha256 TEXT NOT NULL CHECK(length(sha256)=64 AND sha256 NOT GLOB "
-        "'*[^0-9a-f]*'), size INTEGER NOT NULL CHECK(size>=0), "
-        "mtime_ns INTEGER NOT NULL, verified_at TEXT NOT NULL, "
-        "first_seen_at TEXT NOT NULL, tag_revision INTEGER NOT NULL DEFAULT 0 "
-        "CHECK(tag_revision>=0), UNIQUE(file_id, sha256))"
-    ),
-    IMAGE_TAGS_TABLE: (
-        f"CREATE TABLE {IMAGE_TAGS_TABLE} (byte_id TEXT NOT NULL REFERENCES "
-        f"{BYTES_TABLE}(id) ON DELETE CASCADE, tag_id INTEGER NOT NULL "
-        "REFERENCES tags(id) ON DELETE CASCADE, position INTEGER NOT NULL "
-        "CHECK(position>=0), PRIMARY KEY(byte_id, tag_id))"
-    ),
-}
-_INDEX_DDL = {
-    "idx_media_annotation_bytes_fingerprint": (
-        "CREATE INDEX idx_media_annotation_bytes_fingerprint ON "
-        f"{BYTES_TABLE}(file_id, size, mtime_ns)"
-    ),
-    "idx_media_image_tags_tag": (
-        f"CREATE INDEX idx_media_image_tags_tag ON {IMAGE_TAGS_TABLE}(tag_id)"
-    ),
-    "idx_media_image_tags_position": (
-        "CREATE UNIQUE INDEX idx_media_image_tags_position ON "
-        f"{IMAGE_TAGS_TABLE}(byte_id, position)"
-    ),
-}
-# SQLite names the indexes behind TEXT primary keys and UNIQUE constraints
-# ``sqlite_autoindex_<table>_<n>``; their catalog rows carry no SQL.
-_AUTOINDEXES = {FILES_TABLE: 2, BYTES_TABLE: 2, IMAGE_TAGS_TABLE: 1}
-# (name, declared type, not null, default, primary key position)
-_COLUMNS = {
-    METADATA_TABLE: (
-        ("singleton_id", "INTEGER", 0, None, 1),
-        ("schema_version", "INTEGER", 1, None, 0),
-        ("image_index_revision", "INTEGER", 1, "0", 0),
-    ),
-    FILES_TABLE: (
-        ("id", "TEXT", 0, None, 1),
-        ("locator", "TEXT", 1, None, 0),
-        ("created_at", "TEXT", 1, None, 0),
-    ),
-    BYTES_TABLE: (
-        ("id", "TEXT", 0, None, 1),
-        ("file_id", "TEXT", 1, None, 0),
-        ("sha256", "TEXT", 1, None, 0),
-        ("size", "INTEGER", 1, None, 0),
-        ("mtime_ns", "INTEGER", 1, None, 0),
-        ("verified_at", "TEXT", 1, None, 0),
-        ("first_seen_at", "TEXT", 1, None, 0),
-        ("tag_revision", "INTEGER", 1, "0", 0),
-    ),
-    IMAGE_TAGS_TABLE: (
-        ("byte_id", "TEXT", 1, None, 1),
-        ("tag_id", "INTEGER", 1, None, 2),
-        ("position", "INTEGER", 1, None, 0),
-    ),
-}
-# (column, parent table, parent column, on delete)
-_FOREIGN_KEYS = {
-    METADATA_TABLE: set(),
-    FILES_TABLE: set(),
-    BYTES_TABLE: {("file_id", FILES_TABLE, "id", "CASCADE")},
-    IMAGE_TAGS_TABLE: {
-        ("byte_id", BYTES_TABLE, "id", "CASCADE"),
-        ("tag_id", "tags", "id", "CASCADE"),
-    },
-}
-
-
-def _compact(sql: str) -> str:
-    return re.sub(r"\s+", "", sql).lower()
-
-
-def _uuid(column: str) -> str:
-    """SQL: *column* is a lowercase hyphenated 36-character UUID string."""
-    return (
-        f"typeof({column}) = 'text' AND length({column}) = 36 "
-        f"AND substr({column}, 9, 1) = '-' AND substr({column}, 14, 1) = '-' "
-        f"AND substr({column}, 19, 1) = '-' AND substr({column}, 24, 1) = '-' "
-        f"AND length(replace({column}, '-', '')) = 32 "
-        f"AND replace({column}, '-', '') NOT GLOB '*[^0-9a-f]*'"
-    )
-
-
-def _timestamp(column: str) -> str:
-    return (
-        f"typeof({column}) = 'text' "
-        f"AND length(CAST({column} AS BLOB)) <= {_TIMESTAMP_BYTES}"
-    )
-
-
-def _non_negative(column: str) -> str:
-    return f"typeof({column}) = 'integer' AND {column} >= 0"
-
-
-# Every row of a table must satisfy its predicate; one pass each, LIMIT 1.
-_ROW_PREDICATES = {
-    FILES_TABLE: " AND ".join(
-        (
-            _uuid("id"),
-            "typeof(locator) = 'text'",
-            # UTF-8 is at most 4 bytes per character; the decoded length of
-            # the few candidates above the byte bound is checked in Python.
-            f"length(CAST(locator AS BLOB)) <= {MAX_LOCATOR_LENGTH * 4}",
-            _timestamp("created_at"),
-        )
-    ),
-    BYTES_TABLE: " AND ".join(
-        (
-            _uuid("id"),
-            _uuid("file_id"),
-            "typeof(sha256) = 'text' AND length(sha256) = 64 "
-            "AND sha256 NOT GLOB '*[^0-9a-f]*'",
-            _non_negative("size"),
-            "typeof(mtime_ns) = 'integer'",
-            _timestamp("verified_at"),
-            _timestamp("first_seen_at"),
-            _non_negative("tag_revision"),
-        )
-    ),
-    IMAGE_TAGS_TABLE: " AND ".join(
-        (_uuid("byte_id"), "typeof(tag_id) = 'integer'", _non_negative("position"))
-    ),
-}
-
-
-def _expected_catalog() -> set:
-    objects = {("table", name, _compact(sql)) for name, sql in _TABLE_DDL.items()}
-    objects |= {("index", name, _compact(sql)) for name, sql in _INDEX_DDL.items()}
-    objects |= {
-        ("index", f"sqlite_autoindex_{table}_{n}", "")
-        for table, count in _AUTOINDEXES.items()
-        for n in range(1, count + 1)
-    }
-    return objects
-
-
-def _catalog(conn: sqlite3.Connection) -> list:
-    names = TABLES + tuple(_INDEX_DDL)
-    marks = ",".join("?" * len(names))
-    table_marks = ",".join("?" * len(TABLES))
-    return conn.execute(  # only "?" placeholders are interpolated
-        "SELECT type,name,sql FROM sqlite_master "
-        f"WHERE name IN ({marks}) OR tbl_name IN ({table_marks})",  # nosec B608
-        names + TABLES,
-    ).fetchall()
-
-
-def _structure_error(conn: sqlite3.Connection) -> Optional[str]:
-    for table, expected in _COLUMNS.items():
-        columns = tuple(
-            (row[1], row[2].upper(), row[3], row[4], row[5])
-            for row in conn.execute(f"PRAGMA table_info({table})")
-        )
-        if columns != expected:
-            return f"Image annotations table {table} has invalid columns"
-        foreign_keys = {
-            (row[3], row[2], row[4], row[6])
-            for row in conn.execute(f"PRAGMA foreign_key_list({table})")
-        }
-        if foreign_keys != _FOREIGN_KEYS[table]:
-            return f"Image annotations table {table} has invalid foreign keys"
-        if conn.execute(f"PRAGMA foreign_key_check({table})").fetchone():
-            return f"Image annotations table {table} contains foreign key violations"
-    return None
-
-
-def _value_error(conn: sqlite3.Connection) -> Optional[str]:
-    # Only this module's constants are interpolated into the SQL below.
-    rows = conn.execute(
-        "SELECT COUNT(*), MIN(typeof(singleton_id) = 'integer' "  # nosec B608
-        "AND singleton_id = 1 AND typeof(schema_version) = 'integer' "
-        f"AND schema_version = {SCHEMA_VERSION} "
-        f"AND {_non_negative('image_index_revision')}) FROM {METADATA_TABLE}"
-    ).fetchone()
-    if rows[0] != 1 or rows[1] != 1:
-        return "Image annotations metadata is invalid"
-    for table, predicate in _ROW_PREDICATES.items():
-        if conn.execute(
-            f"SELECT 1 FROM {table} WHERE NOT ({predicate}) LIMIT 1"  # nosec B608
-        ).fetchone():
-            return f"Image annotations table {table} contains invalid values"
-    # length() stops at an embedded NUL, so the SQL pass bounds bytes and the
-    # few candidates over the character bound are measured decoded here.
-    for (raw,) in conn.execute(
-        f"SELECT CAST(locator AS BLOB) FROM {FILES_TABLE} "  # nosec B608
-        f"WHERE length(CAST(locator AS BLOB)) > {MAX_LOCATOR_LENGTH}"
-    ):
-        if len(bytes(raw).decode("utf-8", "replace")) > MAX_LOCATOR_LENGTH:
-            return f"Image annotations table {FILES_TABLE} contains invalid values"
-    return None
-
-
-def annotation_schema_error(
-    conn: sqlite3.Connection, *, allow_missing: bool = True
-) -> Optional[str]:
-    """Reject partial or unsupported annotation schemas and invalid rows.
-
-    Reads only: nothing is ever repaired. A database without any of the
-    group's objects is acceptable for backups that predate it unless
-    ``allow_missing`` is false.
-    """
-    objects = _catalog(conn)
-    if not objects:
-        return None if allow_missing else "Missing image annotation schema"
-    present = {name for kind, name, _sql in objects if kind == "table"}
-    if present != set(TABLES):
-        return "Incomplete image annotation schema"
-    actual = {(kind, name, _compact(sql or "")) for kind, name, sql in objects}
-    if actual != _expected_catalog():
-        return "Image annotations has an invalid schema definition"
-    return _structure_error(conn) or _value_error(conn)
-
-
-def migrate_annotation_state(conn: sqlite3.Connection) -> None:
-    """Install the group atomically; validate before and after creating it."""
-    conn.execute("SAVEPOINT media_annotation_schema")
-    try:
-        error = annotation_schema_error(conn)
-        if error:
-            raise sqlite3.DatabaseError(error)
-        for sql in _TABLE_DDL.values():
-            conn.execute(sql.replace("CREATE TABLE", "CREATE TABLE IF NOT EXISTS", 1))
-        for sql in _INDEX_DDL.values():
-            conn.execute(sql.replace("INDEX", "INDEX IF NOT EXISTS", 1))
-        conn.execute(
-            f"INSERT OR IGNORE INTO {METADATA_TABLE} "
-            "(singleton_id, schema_version, image_index_revision) VALUES (1, ?, 0)",
-            (SCHEMA_VERSION,),
-        )
-        error = annotation_schema_error(conn, allow_missing=False)
-        if error:
-            raise sqlite3.DatabaseError(error)
-        conn.execute("RELEASE media_annotation_schema")
-    except BaseException:
-        conn.execute("ROLLBACK TO media_annotation_schema")
-        conn.execute("RELEASE media_annotation_schema")
-        raise
@@ -1,555 +0,0 @@
-"""Per-image tag sets (#249): byte-exact storage in the shared vocabulary.
-
-A tag set belongs to one byte record (``media_annotation_bytes``): the
-whole-file SHA-256 of one physical file, owned by the file's private locator
-(``media_annotation_files``). Callers pass verified facts (digest, size,
-``mtime_ns``); nothing here reads the filesystem or resolves an owner through
-prompt links, so tagging one image never changes another image, a prompt or a
-pair.
-
-Commands run in one ``_pair_transaction`` fenced by the storage epoch, like the
-native Library and vocabulary commands. A save is a full replacement guarded
-by the set's ``tag_revision``; the identical set sent again (a lost-response
-retry, or the current set at its own revision) answers ``replayed: true`` and
-writes nothing. ``add_image_tags`` unions into the existing set, keeping the
-stored spelling. Names enter the global ``tags`` registry exactly as spelled,
-so vocabulary rename, merge and delete carry image links with prompt and pair
-links (``PromptDatabase._move_tag_links``).
-
-Cheap reads (spec amendment S1) treat a byte record as *current* only while
-the file's present ``(size, mtime_ns)`` equals the record's verified
-fingerprint; a file without a current record shows no image tags.
-
-A write made from a tagging model's result passes ``mark_autotagged`` (#379):
-the byte record is then marked auto-tagged (``media_image_autotags``) in the
-same transaction, so a mark never exists without the write it records. Hand
-tags never mark.
-"""
-
-import re
-import sqlite3
-from contextlib import contextmanager
-from typing import Iterator
-from uuid import uuid4
-
-from .annotation_schema import (
-    BYTES_TABLE,
-    FILES_TABLE,
-    IMAGE_TAGS_TABLE,
-    MAX_LOCATOR_LENGTH,
-    METADATA_TABLE,
-)
-from .autotag_schema import AUTOTAG_TABLE
-from .image_removal_schema import clear_marks
-from .library_commands import _UUID, LibraryCommandError, _validate_epoch
-from .models import utc_now_iso
-from .vocabulary import validate_vocabulary_tag_name
-
-MAX_IMAGE_TAGS = 100
-_LOOKUP_CHUNK = 500
-_DIGEST = re.compile(r"[0-9a-f]{64}")
-_MAX_INT = 2**63 - 1
-_MIN_INT = -(2**63)
-# Only this module's table constants are interpolated into the SQL below.
-_OWNER = f"SELECT id FROM {FILES_TABLE} WHERE locator=?"  # nosec B608
-_INSERT_OWNER = (
-    f"INSERT INTO {FILES_TABLE}(id,locator,created_at) VALUES(?,?,?)"  # nosec B608
-)
-_BYTE = (
-    f"SELECT id,tag_revision,size,mtime_ns FROM {BYTES_TABLE} "  # nosec B608
-    "WHERE file_id=? AND sha256=?"
-)
-_INSERT_BYTE = (
-    f"INSERT INTO {BYTES_TABLE}(id,file_id,sha256,size,mtime_ns,"  # nosec B608
-    "verified_at,first_seen_at,tag_revision) VALUES(?,?,?,?,?,?,?,0)"
-)
-_REFRESH_BYTE = (
-    f"UPDATE {BYTES_TABLE} SET size=?,mtime_ns=?,verified_at=? WHERE id=?"  # nosec B608
-)
-_REFRESH_BY_LOCATOR = (
-    f"UPDATE {BYTES_TABLE} SET size=?,mtime_ns=?,verified_at=? "  # nosec B608
-    f"WHERE sha256=? AND file_id=({_OWNER})"
-)
-_BYTE_TAGS = (
-    f"SELECT t.name FROM {IMAGE_TAGS_TABLE} mit "  # nosec B608
-    "JOIN tags t ON t.id=mit.tag_id WHERE mit.byte_id=? ORDER BY mit.position"
-)
-_CLEAR_TAGS = f"DELETE FROM {IMAGE_TAGS_TABLE} WHERE byte_id=?"  # nosec B608
-_INSERT_TAG = (
-    f"INSERT INTO {IMAGE_TAGS_TABLE}(byte_id,tag_id,position) "  # nosec B608
-    "VALUES(?,?,?)"
-)
-_BUMP_REVISION = (
-    f"UPDATE {BYTES_TABLE} SET tag_revision=tag_revision+1 WHERE id=?"  # nosec B608
-)
-_REVISION = f"SELECT tag_revision FROM {BYTES_TABLE} WHERE id=?"  # nosec B608
-_BUMP_INDEX = (
-    f"UPDATE {METADATA_TABLE} SET "  # nosec B608
-    "image_index_revision=image_index_revision+1 WHERE singleton_id=1"
-)
-_READ = (
-    "SELECT b.id,b.tag_revision,"  # nosec B608
-    f"(SELECT COUNT(*) FROM {BYTES_TABLE} o WHERE o.file_id=f.id AND o.sha256!=?) "
-    f"FROM {FILES_TABLE} f LEFT JOIN {BYTES_TABLE} b "
-    "ON b.file_id=f.id AND b.sha256=? WHERE f.locator=?"
-)
-_FINGERPRINTS = (
-    "SELECT f.locator,b.id,b.size,b.mtime_ns,b.verified_at "  # nosec B608
-    f"FROM {FILES_TABLE} f JOIN {BYTES_TABLE} b ON b.file_id=f.id "
-    "WHERE f.locator IN ({marks})"
-)
-_TAGS_OF = (
-    f"SELECT mit.byte_id,t.name FROM {IMAGE_TAGS_TABLE} mit "  # nosec B608
-    "JOIN tags t ON t.id=mit.tag_id WHERE mit.byte_id IN ({marks}) "
-    "ORDER BY mit.byte_id,mit.position"
-)
-_MARK = f"INSERT OR IGNORE INTO {AUTOTAG_TABLE}(byte_id) VALUES(?)"  # nosec B608
-_MARKED_OF = (
-    f"SELECT byte_id FROM {AUTOTAG_TABLE} WHERE byte_id IN ({{marks}})"  # nosec B608
-)
-_MARKED_LOCATORS = (
-    f"SELECT DISTINCT f.locator FROM {AUTOTAG_TABLE} m "  # nosec B608
-    f"JOIN {BYTES_TABLE} b ON b.id=m.byte_id JOIN {FILES_TABLE} f ON f.id=b.file_id"
-)
-# Tag search (#379): the names that tag at least one image (the tag index
-# answers the EXISTS), then the locators carrying chosen names (by tag_id).
-_IMAGE_TAG_NAMES = (
-    "SELECT t.id,t.name FROM tags t WHERE EXISTS "  # nosec B608
-    f"(SELECT 1 FROM {IMAGE_TAGS_TABLE} mit WHERE mit.tag_id=t.id)"
-)
-_TAG_LOCATORS = (
-    f"SELECT DISTINCT f.locator FROM {IMAGE_TAGS_TABLE} mit "  # nosec B608
-    f"JOIN {BYTES_TABLE} b ON b.id=mit.byte_id "
-    f"JOIN {FILES_TABLE} f ON f.id=b.file_id WHERE mit.tag_id IN ({{marks}})"
-)
-
-
-class AnnotationCommandError(LibraryCommandError):
-    """An image tag command lost a race or hit the set's bound.
-
-    ``code`` is ``tag-conflict`` (the set changed since it was read) or
-    ``tag-limit`` (the union would exceed ``MAX_IMAGE_TAGS``); ``current`` is
-    the stored set ``{sha256, tags, tag_revision}`` read inside the
-    transaction, so the caller can show it.
-    """
-
-    def __init__(self, code: str, epoch: str, current: dict | None = None):
-        super().__init__(code, epoch)
-        self.current = current
-
-
-class ImageTagLimitError(ValueError):
-    """More than ``MAX_IMAGE_TAGS`` distinct names in one set."""
-
-
-def normalize_image_tags(names: object) -> list[str]:
-    """Trim and validate each name, fold case-insensitive repeats, cap at 100.
-
-    The first occurrence keeps its spelling and position. Raises ``ValueError``
-    for anything but a list of valid vocabulary names, and its subclass
-    ``ImageTagLimitError`` for more than ``MAX_IMAGE_TAGS`` distinct names.
-    """
-    if not isinstance(names, list):
-        raise ValueError("tags must be a list of strings")
-    result: list[str] = []
-    seen: set[str] = set()
-    for value in names:
-        name = validate_vocabulary_tag_name(value)
-        key = name.casefold()
-        if key in seen:
-            continue
-        seen.add(key)
-        result.append(name)
-    if len(result) > MAX_IMAGE_TAGS:
-        raise ImageTagLimitError(f"An image can carry at most {MAX_IMAGE_TAGS} tags")
-    return result
-
-
-def _validate_locator(locator: object) -> None:
-    if not isinstance(locator, str) or not 0 < len(locator) <= MAX_LOCATOR_LENGTH:
-        raise ValueError(
-            f"locator must be a nonblank path of at most {MAX_LOCATOR_LENGTH} chars"
-        )
-
-
-def _validate_digest(sha256: object) -> None:
-    if not isinstance(sha256, str) or not _DIGEST.fullmatch(sha256):
-        raise ValueError("sha256 must be 64 lowercase hexadecimal characters")
-
-
-def _validate_int(value: object, name: str, minimum: int) -> None:
-    if type(value) is not int or not minimum <= value <= _MAX_INT:
-        raise ValueError(f"{name} must be an integer not below {minimum}")
-
-
-def _validate_target(locator: object, sha256: object, size: object, mtime_ns: object):
-    _validate_locator(locator)
-    _validate_digest(sha256)
-    _validate_int(size, "size", 0)
-    _validate_int(mtime_ns, "mtime_ns", _MIN_INT)
-
-
-def _validate_fingerprint(locator: object, fingerprint: object) -> None:
-    _validate_locator(locator)
-    if (
-        not isinstance(fingerprint, tuple)
-        or len(fingerprint) != 2
-        or any(type(value) is not int for value in fingerprint)
-    ):
-        raise ValueError("stats must map locators to (size, mtime_ns) integer pairs")
-
-
-def _new_id() -> str:
-    """A canonical UUID; the schema's CHECK lets NULL through, this does not."""
-    value = str(uuid4())
-    if not _UUID.fullmatch(value):
-        raise ValueError("Annotation ids must be canonical UUIDs")
-    return value
-
-
-def _receipt(epoch: str, sha256: str, tags: list, revision: int, replayed: bool):
-    return {
-        "library_epoch": epoch,
-        "sha256": sha256,
-        "tags": list(tags),
-        "tag_revision": revision,
-        "replayed": replayed,
-    }
-
-
-class AnnotationOperations:
-    """PromptDatabase mixin: image tag sets, fingerprints and cheap reads.
-
-    ``_`` helpers take the open ``_pair_transaction`` connection.
-    """
-
-    @contextmanager
-    def _annotation_read(self) -> Iterator[sqlite3.Connection]:
-        """One deferred read transaction, so paired SELECTs see one snapshot."""
-        conn = self.model.get_connection()
-        if conn.in_transaction:
-            raise sqlite3.ProgrammingError(
-                "Annotation reads require their own snapshot"
-            )
-        with conn:
-            conn.execute("BEGIN")
-            yield conn
-
-    @staticmethod
-    def _annotation_owner(conn: sqlite3.Connection, locator: str, now: str) -> str:
-        # A file with image tags or Needs review state is in the library: a
-        # removal mark never hides it (#480).
-        clear_marks(conn, [locator])
-        row = conn.execute(_OWNER, (locator,)).fetchone()
-        if row is not None:
-            return row[0]
-        file_id = _new_id()
-        conn.execute(_INSERT_OWNER, (file_id, locator, now))
-        return file_id
-
-    @staticmethod
-    def _annotation_byte(
-        conn: sqlite3.Connection,
-        file_id: str,
-        sha256: str,
-        size: int,
-        mtime_ns: int,
-        now: str,
-    ) -> tuple[str, int, bool, bool]:
-        """The byte record for these bytes, refreshed or created.
-
-        Returns ``(id, tag_revision, created, refingerprinted)``; the last is
-        True when an existing record's verified ``(size, mtime_ns)`` changed,
-        which moves its currency for cheap reads (the caller bumps the index
-        revision when nothing else does).
-        """
-        row = conn.execute(_BYTE, (file_id, sha256)).fetchone()
-        if row is None:
-            byte_id = _new_id()
-            conn.execute(
-                _INSERT_BYTE, (byte_id, file_id, sha256, size, mtime_ns, now, now)
-            )
-            return byte_id, 0, True, False
-        conn.execute(_REFRESH_BYTE, (size, mtime_ns, now, row[0]))
-        return row[0], row[1], False, (row[2], row[3]) != (size, mtime_ns)
-
-    @staticmethod
-    def _byte_tags(conn: sqlite3.Connection, byte_id: str) -> list[str]:
-        return [row[0] for row in conn.execute(_BYTE_TAGS, (byte_id,))]
-
-    def _write_image_tags(
-        self, conn: sqlite3.Connection, byte_id: str, tags: list[str]
-    ) -> int:
-        """Rewrite the junction in order, bump both revisions; return the new one."""
-        tag_ids = self._ensure_tags(conn, tags)
-        conn.execute(_CLEAR_TAGS, (byte_id,))
-        conn.executemany(
-            _INSERT_TAG,
-            [(byte_id, tag_ids[name], position) for position, name in enumerate(tags)],
-        )
-        conn.execute(_BUMP_REVISION, (byte_id,))
-        conn.execute(_BUMP_INDEX)
-        return conn.execute(_REVISION, (byte_id,)).fetchone()[0]
-
-    def _current_set(self, conn, sha256, byte_id, revision) -> dict:
-        return {
-            "sha256": sha256,
-            "tags": self._byte_tags(conn, byte_id),
-            "tag_revision": revision,
-        }
-
-    def read_image_tags(self, locator: str, sha256: str) -> dict:
-        """The stored set of these exact bytes, or an empty set at revision 0.
-
-        ``prior_count`` is the number of other byte records at the locator
-        (earlier or later bytes of the same file).
-        """
-        _validate_locator(locator)
-        _validate_digest(sha256)
-        with self._annotation_read() as conn:
-            row = conn.execute(_READ, (sha256, sha256, locator)).fetchone()
-            if row is None:
-                return {"tags": [], "tag_revision": 0, "prior_count": 0}
-            tags = self._byte_tags(conn, row[0]) if row[0] is not None else []
-            return {"tags": tags, "tag_revision": row[1] or 0, "prior_count": row[2]}
-
-    def replace_image_tags(
-        self,
-        *,
-        locator: str,
-        sha256: str,
-        size: int,
-        mtime_ns: int,
-        expected_epoch: str,
-        expected_tag_revision: int,
-        tags: list,
-        mark_autotagged: bool = False,
-    ) -> dict:
-        """Replace the set of these exact bytes, guarded by epoch and revision.
-
-        Creates the owner and byte record when the bytes are new (an explicit
-        empty set is a real save). The identical set at the current revision,
-        or one behind it (a lost-response retry), is ``replayed`` and writes
-        no tag; any other revision mismatch is ``tag-conflict`` with the
-        current set and no writes. ``mark_autotagged`` marks the bytes
-        auto-tagged on a saved or replayed receipt (the Tag image dialog's
-        save after Generate suggestions).
-        """
-        _validate_target(locator, sha256, size, mtime_ns)
-        _validate_epoch(expected_epoch)
-        _validate_int(expected_tag_revision, "expected_tag_revision", 0)
-        tags = normalize_image_tags(tags)
-        with self._pair_transaction() as conn:
-            epoch = self._library_epoch(conn, expected_epoch)
-            now = utc_now_iso()
-            file_id = self._annotation_owner(conn, locator, now)
-            byte_id, revision, created, refingerprinted = self._annotation_byte(
-                conn, file_id, sha256, size, mtime_ns, now
-            )
-            current = self._byte_tags(conn, byte_id)
-            if (
-                not created
-                and current == tags
-                and expected_tag_revision in (revision, revision - 1)
-            ):
-                if refingerprinted:
-                    conn.execute(_BUMP_INDEX)
-                if mark_autotagged:
-                    conn.execute(_MARK, (byte_id,))
-                return _receipt(epoch, sha256, current, revision, True)
-            if expected_tag_revision != revision:
-                raise AnnotationCommandError(
-                    "tag-conflict",
-                    epoch,
-                    {"sha256": sha256, "tags": current, "tag_revision": revision},
-                )
-            revision = self._write_image_tags(conn, byte_id, tags)
-            if mark_autotagged:
-                conn.execute(_MARK, (byte_id,))
-            return _receipt(epoch, sha256, tags, revision, False)
-
-    def add_image_tags(
-        self,
-        *,
-        locator: str,
-        sha256: str,
-        size: int,
-        mtime_ns: int,
-        expected_epoch: str,
-        tags: list,
-        mark_autotagged: bool = False,
-    ) -> dict:
-        """Union ``tags`` into the set of these exact bytes, keeping stored spelling.
-
-        ``added`` counts the names that were new (case-insensitively). A union
-        over ``MAX_IMAGE_TAGS`` is ``tag-limit`` with the current set and no
-        writes; a union that adds nothing to an existing record is ``replayed``.
-        ``mark_autotagged`` (a tagging model's result) also marks the bytes
-        auto-tagged, replayed or not; only such a call may pass no tags (the
-        model found none: the image is marked and its set is unchanged).
-        """
-        _validate_target(locator, sha256, size, mtime_ns)
-        _validate_epoch(expected_epoch)
-        tags = normalize_image_tags(tags)
-        if not tags and not mark_autotagged:
-            raise ValueError("tags must name at least one tag")
-        with self._pair_transaction() as conn:
-            epoch = self._library_epoch(conn, expected_epoch)
-            now = utc_now_iso()
-            file_id = self._annotation_owner(conn, locator, now)
-            byte_id, revision, created, refingerprinted = self._annotation_byte(
-                conn, file_id, sha256, size, mtime_ns, now
-            )
-            current = self._byte_tags(conn, byte_id)
-            present = {name.casefold() for name in current}
-            added = [name for name in tags if name.casefold() not in present]
-            merged = current + added
-            if len(merged) > MAX_IMAGE_TAGS:
-                raise AnnotationCommandError(
-                    "tag-limit",
-                    epoch,
-                    {"sha256": sha256, "tags": current, "tag_revision": revision},
-                )
-            if mark_autotagged:
-                conn.execute(_MARK, (byte_id,))
-            if not created and not added:
-                if refingerprinted:
-                    conn.execute(_BUMP_INDEX)
-                return {**_receipt(epoch, sha256, current, revision, True), "added": 0}
-            revision = self._write_image_tags(conn, byte_id, merged)
-            return {
-                **_receipt(epoch, sha256, merged, revision, False),
-                "added": len(added),
-            }
-
-    def refresh_image_fingerprint(
-        self, locator: str, sha256: str, size: int, mtime_ns: int
-    ) -> bool:
-        """Record that these exact bytes were just seen with this stat.
-
-        True when a byte record was refreshed; nothing is created and no tag
-        or tag revision changes. The image index revision moves because the
-        record's currency for cheap reads may have changed.
-        """
-        _validate_target(locator, sha256, size, mtime_ns)
-        with self.model.get_connection() as conn:
-            cursor = conn.execute(
-                _REFRESH_BY_LOCATOR, (size, mtime_ns, utc_now_iso(), sha256, locator)
-            )
-            if cursor.rowcount > 0:
-                conn.execute(_BUMP_INDEX)
-            return cursor.rowcount > 0
-
-    @staticmethod
-    def _validated_stats(stats: object) -> dict:
-        if not isinstance(stats, dict):
-            raise ValueError(
-                "stats must map locators to (size, mtime_ns) integer pairs"
-            )
-        for locator, fingerprint in stats.items():
-            _validate_fingerprint(locator, fingerprint)
-        return stats
-
-    @staticmethod
-    def _current_byte_records(conn: sqlite3.Connection, stats: dict) -> dict:
-        """``{locator: byte_id}`` of each locator's current byte record.
-
-        The one rule every cheap read uses: a record is current while its
-        verified ``(size, mtime_ns)`` equals the file's present fingerprint
-        in ``stats``; the most recently verified wins (ties on ``(verified_at,
-        byte_id)``). A locator without a current record is left out. Lookups
-        go in chunks of 500 locators.
-        """
-        locators = list(stats)
-        chosen: dict[str, tuple[tuple[str, str], str]] = {}
-        for start in range(0, len(locators), _LOOKUP_CHUNK):
-            chunk = locators[start : start + _LOOKUP_CHUNK]
-            marks = ",".join("?" * len(chunk))
-            for locator, byte_id, size, mtime_ns, verified_at in conn.execute(
-                _FINGERPRINTS.format(marks=marks), chunk
-            ):
-                if (size, mtime_ns) != stats[locator]:
-                    continue
-                key = (verified_at, byte_id)
-                if locator not in chosen or key > chosen[locator][0]:
-                    chosen[locator] = (key, byte_id)
-        return {locator: byte_id for locator, (_key, byte_id) in chosen.items()}
-
-    def current_image_tags(self, stats: dict) -> dict:
-        """Image tags of the files whose current ``(size, mtime_ns)`` is verified.
-
-        ``stats`` maps locators to their present fingerprint. A locator is
-        answered (possibly with an empty set) only when a byte record carries
-        exactly that verified fingerprint; the most recently verified record
-        wins when several do. Lookups go in chunks of 500 locators.
-        """
-        stats = self._validated_stats(stats)
-        with self._annotation_read() as conn:
-            current = self._current_byte_records(conn, stats)
-            owners = {byte_id: locator for locator, byte_id in current.items()}
-            result: dict[str, list[str]] = {locator: [] for locator in current}
-            byte_ids = list(owners)
-            for start in range(0, len(byte_ids), _LOOKUP_CHUNK):
-                chunk = byte_ids[start : start + _LOOKUP_CHUNK]
-                marks = ",".join("?" * len(chunk))
-                for byte_id, name in conn.execute(_TAGS_OF.format(marks=marks), chunk):
-                    result[owners[byte_id]].append(name)
-        return result
-
-    def autotag_state(self, stats: dict) -> dict:
-        """``{locator: bool}``: is each file's current byte record auto-tagged?
-
-        ``stats`` as for :meth:`current_image_tags`, whose rule picks the
-        current record; a locator without one is False. One read snapshot.
-        """
-        stats = self._validated_stats(stats)
-        with self._annotation_read() as conn:
-            current = self._current_byte_records(conn, stats)
-            byte_ids = list(dict.fromkeys(current.values()))
-            marked: set[str] = set()
-            for start in range(0, len(byte_ids), _LOOKUP_CHUNK):
-                chunk = byte_ids[start : start + _LOOKUP_CHUNK]
-                marks = ",".join("?" * len(chunk))
-                marked.update(
-                    row[0]
-                    for row in conn.execute(_MARKED_OF.format(marks=marks), chunk)
-                )
-        return {locator: current.get(locator) in marked for locator in stats}
-
-    def autotagged_locators(self) -> set:
-        """Locators with at least one auto-tagged byte record, current or not.
-
-        No fingerprint is checked (the Tag output images review's estimate).
-        """
-        with self._annotation_read() as conn:
-            return {row[0] for row in conn.execute(_MARKED_LOCATORS)}
-
-    def image_tag_ids(self, wanted, query: str) -> list[int]:
-        """Ids of the tag names on at least one image that a search wants.
-
-        A name counts when it is in ``wanted`` exactly (the Tags filter) or
-        contains ``query`` case-folded (the text search; ``query`` is
-        already folded). One read of the names that tag an image.
-        """
-        wanted = set(wanted)
-        with self._annotation_read() as conn:
-            return [
-                tag_id
-                for tag_id, name in conn.execute(_IMAGE_TAG_NAMES)
-                if name in wanted or (query and query in name.casefold())
-            ]
-
-    def image_tag_locators(self, tag_ids) -> set[str]:
-        """Locators with any byte record (current or not) carrying one of
-        ``tag_ids``, through the tag index, in chunks of 500 ids."""
-        ids = list(dict.fromkeys(tag_ids))
-        found: set[str] = set()
-        with self._annotation_read() as conn:
-            for start in range(0, len(ids), _LOOKUP_CHUNK):
-                chunk = ids[start : start + _LOOKUP_CHUNK]
-                marks = ",".join("?" * len(chunk))
-                found.update(
-                    row[0]
-                    for row in conn.execute(_TAG_LOCATORS.format(marks=marks), chunk)
-                )
-        return found
@@ -1,140 +0,0 @@
-"""Auto-tagged marks (#379): which image bytes a tagging model has handled.
-
-One table, ``media_image_autotags``: one row per byte record of the image
-annotation group (``media_annotation_bytes``) means "a tagging model looked at
-these exact bytes and its result was stored", or that the bytes were found to
-be untaggable. "Skip already tagged" skips an image whose current byte record
-is marked; hand tags never mark. Rows are written only by the image tag store
-(``database/annotations.py``), in the transaction of the tag write they
-record.
-
-The group installs like ``image_favorites``: optional in old backups,
-required once a database is current, and never backfilled. Like the Needs
-review group it is valid only beside a valid image annotation group, because
-every mark cites one byte record (``ON DELETE CASCADE``). Validation reads
-only: the catalog compared after whitespace compaction, the columns and the
-foreign key through the PRAGMAs, then one bounded value pass and the foreign
-key check.
-"""
-
-import re
-import sqlite3
-from typing import Optional
-
-from .annotation_schema import BYTES_TABLE
-from .annotation_schema import TABLES as ANNOTATION_TABLES
-from .annotation_schema import _catalog as _annotation_catalog
-from .annotation_schema import _uuid, annotation_schema_error
-
-AUTOTAG_TABLE = "media_image_autotags"
-_DDL = (
-    f"CREATE TABLE {AUTOTAG_TABLE} (byte_id TEXT PRIMARY KEY "
-    f"REFERENCES {BYTES_TABLE}(id) ON DELETE CASCADE) WITHOUT ROWID"
-)
-# (cid, name, declared type, not null, default, primary key position): the
-# key of a WITHOUT ROWID table is implicitly NOT NULL.
-_COLUMNS = [(0, "byte_id", "TEXT", 1, None, 1)]
-# (column, parent table, parent column, on delete)
-_FOREIGN_KEYS = {("byte_id", BYTES_TABLE, "id", "CASCADE")}
-
-NEEDS_ANNOTATIONS = "Image auto-tag marks need the image annotation tables"
-INVALID_SCHEMA = "Image auto-tag marks have an invalid schema"
-INVALID_VALUES = "Image auto-tag marks contain invalid values"
-MISSING = "Missing image auto-tag marks schema"
-
-
-def _compact(sql: str) -> str:
-    return re.sub(r"\s+", "", sql).lower()
-
-
-def _catalog(conn: sqlite3.Connection) -> list:
-    return conn.execute(
-        "SELECT type,name,sql FROM sqlite_master WHERE name=? OR tbl_name=?",
-        (AUTOTAG_TABLE, AUTOTAG_TABLE),
-    ).fetchall()
-
-
-def autotag_without_annotations_error(conn: sqlite3.Connection) -> Optional[str]:
-    """Catalog only: the marks table present without its annotation tables.
-
-    Startup asks this before the annotation group installs, which would make
-    a marks table copied without it look valid. It reads no rows.
-    """
-    if not _catalog(conn):
-        return None
-    present = {
-        name for kind, name, _sql in _annotation_catalog(conn) if kind == "table"
-    }
-    if present != set(ANNOTATION_TABLES):
-        return NEEDS_ANNOTATIONS
-    return None
-
-
-def autotag_schema_error(
-    conn: sqlite3.Connection,
-    *,
-    allow_missing: bool = True,
-    annotations_valid: bool = False,
-) -> Optional[str]:
-    """Reject an unsupported marks table or invalid marks; reads only.
-
-    A database without the table is acceptable for backups that predate it
-    unless ``allow_missing`` is false. A present table requires a present,
-    valid image annotation group; ``annotations_valid`` says the caller has
-    just validated it (startup's annotation install), so only its presence is
-    checked again.
-    """
-    objects = _catalog(conn)
-    if not objects:
-        return None if allow_missing else MISSING
-    if annotations_valid:
-        if autotag_without_annotations_error(conn):
-            return NEEDS_ANNOTATIONS
-    elif annotation_schema_error(conn, allow_missing=False):
-        return NEEDS_ANNOTATIONS
-    actual = {(kind, name, _compact(sql or "")) for kind, name, sql in objects}
-    if actual != {("table", AUTOTAG_TABLE, _compact(_DDL))}:
-        return INVALID_SCHEMA
-    columns = [
-        (row[0], row[1], row[2].upper(), row[3], row[4], row[5])
-        for row in conn.execute(f"PRAGMA table_info({AUTOTAG_TABLE})")
-    ]
-    if columns != _COLUMNS:
-        return INVALID_SCHEMA
-    foreign_keys = {
-        (row[3], row[2], row[4], row[6])
-        for row in conn.execute(f"PRAGMA foreign_key_list({AUTOTAG_TABLE})")
-    }
-    if foreign_keys != _FOREIGN_KEYS:
-        return INVALID_SCHEMA
-    # Only this module's constants are interpolated into the SQL below.
-    if conn.execute(
-        f"SELECT 1 FROM {AUTOTAG_TABLE} "  # nosec B608
-        f"WHERE NOT ({_uuid('byte_id')}) LIMIT 1"
-    ).fetchone():
-        return INVALID_VALUES
-    if conn.execute(f"PRAGMA foreign_key_check({AUTOTAG_TABLE})").fetchone():
-        return INVALID_VALUES
-    return None
-
-
-def migrate_autotag_state(conn: sqlite3.Connection) -> None:
-    """Install the table atomically; validate before and after creating it.
-
-    Runs after ``migrate_annotation_state`` (which has just validated the
-    annotation group). Creates one empty table: no row is read or copied.
-    """
-    conn.execute("SAVEPOINT media_autotag_schema")
-    try:
-        error = autotag_schema_error(conn, annotations_valid=True)
-        if error:
-            raise sqlite3.DatabaseError(error)
-        conn.execute(_DDL.replace("CREATE TABLE", "CREATE TABLE IF NOT EXISTS", 1))
-        error = autotag_schema_error(conn, allow_missing=False, annotations_valid=True)
-        if error:
-            raise sqlite3.DatabaseError(error)
-        conn.execute("RELEASE media_autotag_schema")
-    except BaseException:
-        conn.execute("ROLLBACK TO media_autotag_schema")
-        conn.execute("RELEASE media_autotag_schema")
-        raise
@@ -1,201 +0,0 @@
-"""Atomic replacement of one imported category (#221, #249 System S10).
-
-The LoRA reference import used to delete its whole category and then save
-each record in its own transaction, so a failure part way left the previous
-collection deleted and the new one partial. ``replace_category_prompts``
-does both in one ``BEGIN IMMEDIATE`` transaction: the category's current
-prompts (with their tags and image links) are replaced by the staged
-records, or, on any error, nothing changes.
-
-A staged record is ``{text, hash, tags, images}``. A record whose hash a
-prompt outside the category already has links its images to that prompt
-(the legacy import did the same); a second record with the hash of an
-earlier one links its images to that one. Neither is a new prompt.
-"""
-
-from typing import Any, Dict, List, Optional, Sequence
-
-try:
-    from .maintenance import PlanChanged
-    from .pairs import PairDependencyError
-    from .workflow_documents import documents_of_rows, release_documents
-except ImportError:  # pragma: no cover - flat test imports
-    from database.maintenance import PlanChanged
-    from database.pairs import PairDependencyError
-    from database.workflow_documents import documents_of_rows, release_documents
-
-
-class EmptyReplacement(ValueError):
-    """The replacement has no record and would remove every current import."""
-
-
-# The category's prompt ids, as a subquery (one bound parameter).
-_IN_CATEGORY = "SELECT id FROM prompts WHERE category = ?"
-
-# Each record's outcome and the result counter it adds to.
-_COUNTERS = {"imported": "imported", "linked": "linked", "duplicate": "duplicates"}
-
-
-def _placeholders(values: Sequence[Any]) -> str:
-    return ",".join("?" * len(values))
-
-
-class CategoryImportOperations:
-    """Read the state of an imported category and replace it atomically."""
-
-    def category_import_state(self, category: str) -> Dict[str, Any]:
-        """``{ids, paired}``: the category's prompt ids (ascending) and how
-        many of them a saved pair uses (those block a replacement)."""
-        with self.model.get_connection() as conn:
-            ids = [
-                row[0]
-                for row in conn.execute(
-                    "SELECT id FROM prompts WHERE category = ? ORDER BY id",
-                    (category,),
-                ).fetchall()
-            ]
-            paired = conn.execute(
-                "SELECT COUNT(*) FROM prompts WHERE category = ? AND id IN "
-                "(SELECT positive_prompt_id FROM prompt_pairs UNION "
-                "SELECT negative_prompt_id FROM prompt_pairs)",
-                (category,),
-            ).fetchone()[0]
-        return {"ids": ids, "paired": paired}
-
-    def existing_prompt_hashes(
-        self, hashes: Sequence[str], exclude_category: str
-    ) -> set:
-        """The given hashes a prompt outside ``exclude_category`` already has."""
-        found = set()
-        wanted = list(dict.fromkeys(hashes))
-        with self.model.get_connection() as conn:
-            for start in range(0, len(wanted), 500):
-                chunk = wanted[start : start + 500]
-                rows = conn.execute(
-                    f"SELECT hash FROM prompts WHERE hash IN ({_placeholders(chunk)}) "
-                    "AND (category IS NULL OR category != ?)",
-                    [*chunk, exclude_category],
-                ).fetchall()
-                found.update(row[0] for row in rows)
-        return found
-
-    def replace_category_prompts(
-        self,
-        category: str,
-        records: List[Dict[str, Any]],
-        *,
-        expected_ids: Optional[List[int]] = None,
-        allow_empty: bool = False,
-    ) -> Dict[str, Any]:
-        """Replace every prompt of ``category`` with ``records`` in one transaction.
-
-        Raises (and changes nothing): ``PlanChanged`` when ``expected_ids`` is
-        given and the category's prompt ids differ from it;
-        ``PairDependencyError`` when a saved pair uses one of its prompts;
-        ``EmptyReplacement`` when ``records`` is empty while the category has
-        prompts, unless ``allow_empty`` (an empty replacement that was
-        reviewed). Any other error rolls everything back too.
-
-        Returns ``{removed, imported, linked, duplicates, images, rows}``:
-        prompts removed and created, records linked to an existing prompt or
-        to an earlier record with the same text, image links added, and per
-        record ``{name, outcome}`` (``imported``/``linked``/``duplicate``).
-        """
-        with self._pair_transaction() as conn:
-            ids = [
-                row[0]
-                for row in conn.execute(
-                    "SELECT id FROM prompts WHERE category = ? ORDER BY id",
-                    (category,),
-                ).fetchall()
-            ]
-            if expected_ids is not None and ids != list(expected_ids):
-                raise PlanChanged("The imported prompts changed since the review")
-            if not records and ids and not allow_empty:
-                raise EmptyReplacement(
-                    "Nothing to import; the previous imports were kept"
-                )
-            self._ensure_category_unpaired(conn, category)
-            removed = self._delete_category_rows(conn, category, ids)
-            result = {
-                "removed": removed,
-                "imported": 0,
-                "linked": 0,
-                "duplicates": 0,
-                "images": 0,
-                "rows": [],
-            }
-            created = {}
-            for record in records:
-                self._import_record(conn, category, record, created, result)
-            return result
-
-    def _delete_category_rows(self, conn, category: str, ids: List[int]) -> int:
-        """Delete the category's prompts with their image links and tags.
-
-        No commit. The rows are selected by category (just verified against
-        ``ids`` under the write lock), so no statement binds one parameter per
-        prompt and SQLite's variable limit never caps a collection.
-        """
-        if not ids:
-            return 0
-        documents = documents_of_rows(conn, "prompt_id", ids)  # chunked
-        conn.execute(
-            f"DELETE FROM generated_images WHERE prompt_id IN ({_IN_CATEGORY})",
-            (category,),
-        )
-        release_documents(conn, documents)
-        conn.execute(
-            f"DELETE FROM prompt_tags WHERE prompt_id IN ({_IN_CATEGORY})",
-            (category,),
-        )
-        return conn.execute(
-            "DELETE FROM prompts WHERE category = ?", (category,)
-        ).rowcount
-
-    @staticmethod
-    def _ensure_category_unpaired(conn, category: str) -> None:
-        """Raise PairDependencyError when a saved pair uses a category prompt."""
-        row = conn.execute(
-            f"SELECT id FROM prompt_pairs WHERE positive_prompt_id IN ({_IN_CATEGORY}) "
-            f"OR negative_prompt_id IN ({_IN_CATEGORY}) LIMIT 1",
-            (category, category),
-        ).fetchone()
-        if row:
-            raise PairDependencyError(
-                f"Prompt belongs to saved pair {row[0]}; delete the pair first "
-                "or save changed text as a new prompt"
-            )
-
-    def _import_record(self, conn, category, record, created, result) -> None:
-        """Save one staged record on ``conn``, or link it to the prompt it repeats."""
-        prompt_hash = record["hash"]
-        name = record.get("name") or record["text"]
-        if prompt_hash in created:
-            prompt_id, outcome = created[prompt_hash], "duplicate"
-        else:
-            row = conn.execute(
-                "SELECT id FROM prompts WHERE hash = ?", (prompt_hash,)
-            ).fetchone()
-            if row is not None:
-                prompt_id, outcome = row[0], "linked"
-            else:
-                prompt_id = self._insert_prompt(
-                    conn,
-                    record["text"],
-                    category,
-                    list(record.get("tags") or []),
-                    None,
-                    None,
-                    prompt_hash,
-                )
-                outcome = "imported"
-            created[prompt_hash] = prompt_id
-        result[_COUNTERS[outcome]] += 1
-        # Linked last to first: every workspace list shows a prompt's media
-        # newest link first, so the record's first image (the LoRA cover,
-        # #355) is the one a Library card shows.
-        for image in reversed(record.get("images") or []):
-            if self._insert_image_link(conn, prompt_id, image):
-                result["images"] += 1
-        result["rows"].append({"name": name, "outcome": outcome})
@@ -1,252 +0,0 @@
-"""Records of duplicate image files: count them and move them (#249 S6, T17).
-
-A removed copy's records move to its verified kept copy before the copy is
-unlinked (``py/api/duplicate_files.py``), one file per short ``BEGIN
-IMMEDIATE`` transaction, so no row ever names a deleted file:
-
- its image records (``generated_images``), found under every spelling the
-  file is linked by. A record moves to the kept copy, unless its prompt
-  already links the kept copy: then its saved-pair links join that record
-  and it is deleted;
- its favorite;
- its collection memberships (#331), joined onto the kept copy's as their
-  union under the same keys a favorite moves by;
- its image tags (``media_image_tags`` of its byte record), joined onto the
-  kept copy's byte record as their union, in order;
- its own image category (#332), copied to the kept copy when that copy has
-  none; the removed copy's row is kept, so a give-back loses nothing;
- its pending Needs review items, settled: only an item still ``pending`` at
-  revision 0 with no decision row is removed (``review._SETTLE_ITEM``), so a
-  decided item is never touched.
-
-Every statement is an index search (see ``FILE_LINK_SQL``).
-"""
-
-import os
-
-from .annotation_schema import BYTES_TABLE, FILES_TABLE
-from .annotations import _BUMP_INDEX
-from .image_categories import COPY_SQL as COPY_CATEGORY_SQL
-from .image_categories import copy_image_category
-from .models import normalize_image_path, utc_now_iso
-from .review import _BUMP_REVIEW_INDEX, _PENDING_OF_LOCATOR, _SETTLE_ITEM
-from .review_changes import notify_review_change
-from .workflow_documents import documents_of_rows, release_documents
-
-LINKS_BY_FILE_SQL = "SELECT id, prompt_id FROM generated_images WHERE file_path = ?"
-LEGACY_LINKS_SQL = (
-    "SELECT id, prompt_id FROM generated_images "
-    "WHERE image_path = ? AND file_path IS NULL"
-)
-KEEPER_LINK_SQL = (
-    "SELECT id FROM generated_images WHERE prompt_id = ? AND file_path = ?"
-)
-MOVE_PAIR_LINKS_SQL = (
-    "UPDATE OR IGNORE image_prompt_pairs SET image_id = ? WHERE image_id = ?"
-)
-MOVE_LINK_SQL = (
-    "UPDATE generated_images SET image_path = ?, filename = ?, file_path = ? "
-    "WHERE id = ?"
-)
-DELETE_LINK_SQL = "DELETE FROM generated_images WHERE id = ?"
-FAVORITE_SQL = (
-    "SELECT created_at FROM image_favorites WHERE root_key = ? AND relative_path = ?"
-)
-INSERT_FAVORITE_SQL = "INSERT OR IGNORE INTO image_favorites VALUES (?, ?, ?)"
-DELETE_FAVORITE_SQL = (
-    "DELETE FROM image_favorites WHERE root_key = ? AND relative_path = ?"
-)
-COPY_MEMBERSHIPS_SQL = (
-    "INSERT OR IGNORE INTO image_collection_items "
-    "(collection_id, root_key, relative_path, added_at) "
-    "SELECT collection_id, ?, ?, added_at FROM image_collection_items "
-    "WHERE root_key = ? AND relative_path = ?"
-)
-DELETE_MEMBERSHIPS_SQL = (
-    "DELETE FROM image_collection_items WHERE root_key = ? AND relative_path = ?"
-)
-COPY_BYTE_SQL = (
-    f"SELECT b.id FROM {FILES_TABLE} f JOIN {BYTES_TABLE} b "  # nosec B608
-    "ON b.file_id=f.id WHERE f.locator=? AND b.sha256=?"
-)
-COPY_TAG_COUNT_SQL = (
-    "SELECT COUNT(*) FROM media_image_tags WHERE byte_id=?"  # nosec B608
-)
-PENDING_COUNT_SQL = (
-    f"SELECT COUNT(*) FROM {FILES_TABLE} f "  # nosec B608
-    f"JOIN {BYTES_TABLE} b ON b.file_id=f.id "
-    "JOIN media_review_items i ON i.byte_id=b.id "
-    "WHERE f.locator=? AND +i.state='pending' AND i.revision=0 "
-    "AND NOT EXISTS (SELECT 1 FROM media_review_decisions d WHERE d.item_id=i.id)"
-)
-FILE_LINK_SQL = (
-    LINKS_BY_FILE_SQL,
-    LEGACY_LINKS_SQL,
-    KEEPER_LINK_SQL,
-    MOVE_PAIR_LINKS_SQL,
-    MOVE_LINK_SQL,
-    DELETE_LINK_SQL,
-    FAVORITE_SQL,
-    DELETE_FAVORITE_SQL,
-    COPY_MEMBERSHIPS_SQL,
-    DELETE_MEMBERSHIPS_SQL,
-    COPY_BYTE_SQL,
-    COPY_TAG_COUNT_SQL,
-    PENDING_COUNT_SQL,
-    COPY_CATEGORY_SQL,
-)
-
-
-def _file_link_rows(conn, spelled):
-    """``(id, prompt_id)`` of the image records linking one spelling."""
-    rows = list(conn.execute(LINKS_BY_FILE_SQL, (normalize_image_path(spelled),)))
-    rows += list(conn.execute(LEGACY_LINKS_SQL, (spelled,)))
-    return [tuple(row) for row in rows]
-
-
-def _copy_byte(conn, locator, sha256):
-    row = conn.execute(COPY_BYTE_SQL, (locator, sha256)).fetchone()
-    return row[0] if row else None
-
-
-class DuplicateCopyOperations:
-    """PromptDatabase mixin: the records of duplicate copies."""
-
-    def count_copy_records(self, copies) -> dict:
-        """``{path: {links, tags, review}}`` for each copy (one read snapshot).
-
-        ``copies`` maps each path to ``{spellings, locator, sha256}``:
-        ``links`` counts the image records under any spelling, ``tags`` the
-        image tags of its bytes and ``review`` its pending, undecided Needs
-        review items.
-        """
-        from .maintenance import _read_snapshot
-
-        def read(conn):
-            found = {}
-            for path, copy in copies.items():
-                ids = {
-                    row[0]
-                    for spelled in copy["spellings"]
-                    for row in _file_link_rows(conn, spelled)
-                }
-                byte_id = _copy_byte(conn, copy["locator"], copy["sha256"])
-                tags = (
-                    conn.execute(COPY_TAG_COUNT_SQL, (byte_id,)).fetchone()[0]
-                    if byte_id
-                    else 0
-                )
-                review = conn.execute(PENDING_COUNT_SQL, (copy["locator"],))
-                found[path] = {
-                    "links": len(ids),
-                    "tags": tags,
-                    "review": review.fetchone()[0],
-                }
-            return found
-
-        return _read_snapshot(self.model.db_path, read)
-
-    def move_copy_records(self, move) -> dict:
-        """Move one removed copy's records to its kept copy (one transaction).
-
-        ``move``: ``removed`` and ``kept`` (the spellings each file is linked
-        by), ``targets`` (``{removed spelling: kept spelling}``, the spelling
-        a moved record takes; else ``kept_path``), ``favorites`` (``(root key,
-        removed key, kept root key, kept key)`` per listed root holding the
-        file; they move its favorite and its collection memberships),
-        ``removed_locator``, ``kept_locator``, ``sha256`` and the kept copy's
-        ``kept_size`` and ``kept_mtime_ns``; ``categories``: ``(removed file
-        key, kept file key)`` pairs of the image categories (#332). Returns
-        ``{moved, merged, favorites, tags, review, collections, categories}``
-        (``collections``: the memberships inserted on the kept copy;
-        ``categories``: the image categories copied to the kept copy).
-        """
-        counts = dict.fromkeys(
-            ("moved", "merged", "favorites", "tags", "review", "collections"), 0
-        )
-        kept_keys = [normalize_image_path(path) for path in move["kept"]]
-        with self._pair_transaction() as conn:
-            for spelled in dict.fromkeys(move["removed"]):
-                target = move["targets"].get(spelled, move["kept_path"])
-                keys = list(dict.fromkeys(kept_keys + [normalize_image_path(target)]))
-                for image_id, prompt_id in _file_link_rows(conn, spelled):
-                    existing = None
-                    for key in keys:
-                        existing = conn.execute(
-                            KEEPER_LINK_SQL, (prompt_id, key)
-                        ).fetchone()
-                        if existing is not None:
-                            break
-                    if existing is not None:
-                        conn.execute(MOVE_PAIR_LINKS_SQL, (existing[0], image_id))
-                        documents = documents_of_rows(conn, "id", [image_id])
-                        conn.execute(DELETE_LINK_SQL, (image_id,))
-                        release_documents(conn, documents)
-                        counts["merged"] += 1
-                        continue
-                    conn.execute(
-                        MOVE_LINK_SQL,
-                        (
-                            target,
-                            os.path.basename(target),
-                            normalize_image_path(target),
-                            image_id,
-                        ),
-                    )
-                    counts["moved"] += 1
-            for favorite in move.get("favorites", ()):
-                counts["favorites"] += _move_favorite(conn, *favorite)
-                counts["collections"] += _move_memberships(conn, *favorite)
-            counts["tags"] = self._move_copy_tags(conn, move)
-            counts["categories"] = sum(
-                copy_image_category(conn, removed, kept)
-                for removed, kept in move.get("categories", ())
-            )
-            for (item_id,) in conn.execute(
-                _PENDING_OF_LOCATOR, (move["removed_locator"],)
-            ).fetchall():
-                counts["review"] += conn.execute(_SETTLE_ITEM, (item_id,)).rowcount
-            if counts["review"]:
-                conn.execute(_BUMP_REVIEW_INDEX)
-        if counts["review"]:
-            notify_review_change(self.model.db_path)
-        return counts
-
-    def _move_copy_tags(self, conn, move):
-        """Join the removed copy's image tags onto the kept copy's; the count added."""
-        removed = _copy_byte(conn, move["removed_locator"], move["sha256"])
-        if removed is None:
-            return 0
-        tags = self._byte_tags(conn, removed)
-        if not tags:
-            return 0
-        now = utc_now_iso()
-        file_id = self._annotation_owner(conn, move["kept_locator"], now)
-        byte_id, _revision, created, moved = self._annotation_byte(
-            conn, file_id, move["sha256"], move["kept_size"], move["kept_mtime_ns"], now
-        )
-        current = self._byte_tags(conn, byte_id)
-        union = current + [tag for tag in tags if tag not in current]
-        if union != current:
-            self._write_image_tags(conn, byte_id, union)
-        elif created or moved:
-            conn.execute(_BUMP_INDEX)
-        return len(union) - len(current)
-
-
-def _move_favorite(conn, root_key, removed_key, kept_root, kept_key):
-    row = conn.execute(FAVORITE_SQL, (root_key, removed_key)).fetchone()
-    if row is None:
-        return 0
-    conn.execute(INSERT_FAVORITE_SQL, (kept_root, kept_key, row[0]))
-    conn.execute(DELETE_FAVORITE_SQL, (root_key, removed_key))
-    return 1
-
-
-def _move_memberships(conn, root_key, removed_key, kept_root, kept_key):
-    """Copy a removed copy's memberships to the kept copy; the rows inserted."""
-    inserted = conn.execute(
-        COPY_MEMBERSHIPS_SQL, (kept_root, kept_key, root_key, removed_key)
-    ).rowcount
-    conn.execute(DELETE_MEMBERSHIPS_SQL, (root_key, removed_key))
-    return inserted
@@ -7,11 +7,6 @@ from typing import Callable, ContextManager, Iterator

 try:
    from ..utils.execution_history_events import RunFinish, encode_command
-    from ..utils.hashing import (
-        generate_prompt_hash,
-        stored_prompt_text,
-        stored_prompt_text_sql,
-    )
    from ..utils.execution_contexts import (
        CAPTURE_REASONS,
        ContextBundle,
@@ -20,11 +15,6 @@ try:
    )
 except ImportError:
    from utils.execution_history_events import RunFinish, encode_command
-    from utils.hashing import (
-        generate_prompt_hash,
-        stored_prompt_text,
-        stored_prompt_text_sql,
-    )
    from utils.execution_contexts import (
        CAPTURE_REASONS,
        ContextBundle,
@@ -144,8 +134,7 @@ def _insert_exact(

 def _role_hints(role: str) -> str:
    return (
-        f"SELECT r.{role}_prompt_id, tx.text_value, "
-        f"{stored_prompt_text_sql('tx.text_value')} "
+        f"SELECT r.{role}_prompt_id, tx.text_value "
        "FROM execution_run_contexts r "
        "JOIN execution_contexts c ON c.context_id = r.context_id "
        f"JOIN execution_prompt_snapshots s ON s.snapshot_id = c.{role}_snapshot_id "
@@ -157,78 +146,57 @@ def _role_hints(role: str) -> str:

 # Set form of the read-time prompt-hint rule in get_execution_contexts():
 # a stored role hint is live only in the current storage epoch, and only when
-# the hinted prompt is the one match of _prompt_hint: by text (the raw
-# snapshot text or its stored form, outer whitespace stripped, #438), or, only
-# when no prompt has either text, by dedup hash (case folded too, #460).
-# The hash is a fallback, so a hint #438 kept is never made ambiguous.
-# Needs register_prompt_functions (pm_prompt_hash). The hint rows are the
-# outer loop (CROSS JOIN), so each prompts lookup is by index.
+# its exact raw snapshot text matches exactly one prompt, which is the hinted
+# one (_prompt_hint). Evaluated once per statement, never per prompt row.
 # Defines the CTE ``live_hint_prompts(prompt_id)``; prefix it with WITH.
 LIVE_HINT_CTES = (
-    "stored_hints(prompt_id, raw, stored) AS ("
+    "stored_hints(prompt_id, raw) AS ("
    + _role_hints("positive")
    + " UNION "
    + _role_hints("negative")
-    + "), hint_matches(prompt_id, raw, stored, match_id) AS ("
-    "SELECT h.prompt_id, h.raw, h.stored, p.id FROM stored_hints h "
-    "CROSS JOIN prompts p ON p.text COLLATE BINARY IN (h.raw, h.stored) "
-    "UNION ALL "
-    "SELECT h.prompt_id, h.raw, h.stored, p.id FROM stored_hints h "
-    "CROSS JOIN prompts p ON p.hash = pm_prompt_hash(h.raw) "
-    "WHERE NOT EXISTS (SELECT 1 FROM prompts q "
-    "WHERE q.text COLLATE BINARY IN (h.raw, h.stored))"
+    + "), unique_hint_texts(prompt_id, raw) AS ("
+    "SELECT MIN(id), text COLLATE BINARY FROM prompts "
+    "WHERE text COLLATE BINARY IN (SELECT raw FROM stored_hints) "
+    "GROUP BY text COLLATE BINARY HAVING COUNT(*) = 1"
    "), live_hint_prompts(prompt_id) AS ("
-    "SELECT prompt_id FROM hint_matches GROUP BY prompt_id, raw, stored "
-    "HAVING COUNT(*) = 1 AND MIN(match_id) = prompt_id)"
+    "SELECT h.prompt_id FROM stored_hints h JOIN unique_hint_texts u "
+    "ON u.prompt_id = h.prompt_id AND u.raw = h.raw COLLATE BINARY)"
 )
 LIVE_HINT_PROMPT_IDS_SQL = (
    "WITH " + LIVE_HINT_CTES + " SELECT DISTINCT prompt_id FROM live_hint_prompts"
 )

-_BY_TEXT = "SELECT id FROM prompts WHERE text COLLATE BINARY IN (?,?) LIMIT 2"
-
-
-def _text_matches(conn: sqlite3.Connection, raw: str) -> list:
-    return [row[0] for row in conn.execute(_BY_TEXT, (raw, stored_prompt_text(raw)))]
-

 def _prompt_hint(conn: sqlite3.Connection, raw: str | None) -> int | None:
-    """The one prompt that stores ``raw`` (#438), else the one it counts toward.
-
-    By text first: ``raw`` or ``raw.strip()`` (the exact form keeps hints of
-    older rows that kept outer whitespace). Only when no prompt has either
-    text, by the dedup hash, which also folds case (#460).
-    """
    if raw is None:
        return None
-    matches = _text_matches(conn, raw)
-    if not matches:
-        matches = [
-            row[0]
-            for row in conn.execute(
-                "SELECT id FROM prompts WHERE hash=? LIMIT 2",
-                (generate_prompt_hash(raw),),
-            )
-        ]
-    return matches[0] if len(matches) == 1 else None
+    rows = conn.execute(
+        "SELECT id FROM prompts WHERE text=? COLLATE BINARY LIMIT 2", (raw,)
+    ).fetchall()
+    return rows[0][0] if len(rows) == 1 else None


 def _hints(
    conn: sqlite3.Connection, positive: str | None, negative: str | None
 ) -> tuple:
    pos_id, neg_id = _prompt_hint(conn, positive), _prompt_hint(conn, negative)
-    stored = None if negative is None else stored_prompt_text(negative)
    pair_id = None
-    # A known negative that names no prompt because several share its text
    negative_ambiguous = (
-        stored is not None and neg_id is None and bool(_text_matches(conn, negative))
+        negative is not None
+        and neg_id is None
+        and conn.execute(
+            "SELECT 1 FROM prompts WHERE text=? COLLATE BINARY LIMIT 1", (negative,)
+        ).fetchone()
+        is not None
    )
-    if pos_id is not None and stored is not None and not negative_ambiguous:
+    if pos_id is not None and negative is not None and not negative_ambiguous:
        rows = conn.execute(
-            "SELECT pp.id FROM prompt_pairs pp "
+            "SELECT pp.id FROM prompt_pairs pp LEFT JOIN prompts n ON "
+            "n.id=pp.negative_prompt_id "
            "WHERE pp.positive_prompt_id=? AND ((pp.negative_prompt_id IS NULL AND "
-            "?='') OR pp.negative_prompt_id=?) LIMIT 2",
-            (pos_id, stored, neg_id),
+            "?='') "
+            "OR (pp.negative_prompt_id=? AND n.text=? COLLATE BINARY)) LIMIT 2",
+            (pos_id, negative, neg_id, negative),
        ).fetchall()
        if len(rows) == 1:
            pair_id = rows[0][0]
@@ -196,14 +196,3 @@ class ExecutionHistoryOperations:
            .fetchone()
        )
        return dict(row) if row is not None else None
-
-
-def rekey_history_restore(old_path: str, new_path: str) -> None:
-    """Move the observers of ``old_path`` to ``new_path`` (Move library)."""
-    old, new = _database_identity(old_path), _database_identity(new_path)
-    if old == new:
-        return
-    with _restore_lock:
-        observers = _restore_observers.pop(old, None)
-        if observers:
-            _restore_observers.setdefault(new, {}).update(observers)
@@ -4,8 +4,6 @@ import sqlite3
 from contextlib import ExitStack
 from typing import Callable, ContextManager

-from .run_attribution import notify_outputs_sealed
-
 try:
    from ..utils.execution_history_events import RunFinish, encode_command
    from ..utils.execution_outputs import OutputBundle, validate_output_bundle
@@ -115,10 +113,6 @@ class ExecutionOutputOperations:
                    "VALUES(?,?,?,?,?,?,?,?)",
                    [(run_id, *reference) for reference in prepared],
                )
-        # Committed: images waiting for this run may now be attributed (#342)
-        notify_outputs_sealed(
-            run_id, [dict(zip(_REFERENCE_FIELDS, row)) for row in prepared]
-        )
        return True

    def get_execution_outputs(self, run_id: str) -> dict:
@@ -1,391 +0,0 @@
-"""The read-only health check behind System › Overview and Maintenance.
-
-``run_health_checks`` opens its own ``mode=ro`` connection, reads one
-snapshot and closes the connection in ``finally``; it never writes. Each
-check reports ``passed``, ``issues`` (with an exact ``count``; the
-integrity check stops at ``INTEGRITY_LIMIT`` problems and then says
-``capped``),
-``unavailable`` (it could not be checked here, so ``count`` is None, or
-``missing_files`` checked only some sources and found nothing) or ``failed``
-(it raised; the other checks still run). ``missing_files`` also reports each
-source and whether the check was ``partial``; it reads the image rows inside
-the snapshot and checks their files after the snapshot ended, so a slow source
-never holds the WAL. At most ``MAX_DETAIL`` detail strings are returned per
-check, and none of them carries a server path.
-"""
-
-import datetime
-import logging
-import ntpath
-import os
-import sqlite3
-from pathlib import PurePosixPath, PureWindowsPath
-from urllib.parse import quote
-
-try:
-    from ..utils.hashing import register_prompt_functions
-    from .models import normalize_image_path
-except ImportError:
-    from utils.hashing import register_prompt_functions
-    from database.models import normalize_image_path
-
-logger = logging.getLogger("prompt_manager.database.health")
-
-MAX_DETAIL = 10  # detail strings returned per check
-INTEGRITY_LIMIT = 100  # PRAGMA integrity_check(N): problems SQLite reports
-BATCH_ROWS = 100  # image rows read per fetch
-REVIEW_UNAVAILABLE = "Needs review is not available yet."
-CHECK_FAILED = "The check could not finish."
-# Check ids and the labels of the concept's health report, in its order;
-# pair uniqueness and consistency are the added rows (D63, now D95).
-CHECKS = (
-    ("integrity", "Integrity check"),
-    ("foreign_keys", "Foreign keys & pair references"),
-    ("canonical_hashes", "Canonical hashes"),
-    ("pair_uniqueness", "Pair uniqueness"),
-    ("missing_files", "Missing files"),
-    ("ambiguous_metadata", "Ambiguous metadata"),
-    ("consistency", "Consistency"),
-)
-_DATABASE_CHECKS = (
-    "integrity",
-    "foreign_keys",
-    "canonical_hashes",
-    "pair_uniqueness",
-    "missing_files",
-    "consistency",
-)
-
-
-def iter_consistency_issues(conn):
-    """The legacy consistency issues: tag and image rows of a missing prompt."""
-    for ref in conn.execute(
-        "SELECT pt.prompt_id FROM prompt_tags pt "
-        "LEFT JOIN prompts p ON pt.prompt_id = p.id WHERE p.id IS NULL"
-    ):
-        yield f"prompt_tags entry references non-existent prompt {ref[0]}"
-    for ref in conn.execute(
-        "SELECT gi.id, gi.prompt_id FROM generated_images gi "
-        "LEFT JOIN prompts p ON gi.prompt_id = p.id WHERE p.id IS NULL"
-    ):
-        yield f"Image {ref[0]} references non-existent prompt {ref[1]}"
-
-
-def _result(count, detail, *, status=None):
-    return {
-        "status": status or ("issues" if count else "passed"),
-        "count": count,
-        "detail": detail[:MAX_DETAIL],
-    }
-
-
-def _counted(lines):
-    """(count, first MAX_DETAIL lines) of an iterable, consumed once."""
-    count, detail = 0, []
-    for line in lines:
-        count += 1
-        if len(detail) < MAX_DETAIL:
-            detail.append(line)
-    return _result(count, detail)
-
-
-def readonly_uri(db_path, *, windows=None):
-    """The ``mode=ro`` SQLite URI of *db_path*, on this platform or the given one.
-
-    pathlib spells a UNC path ``\\\\server\\share\\x.db`` as
-    ``file://server/share/x.db``, a remote authority SQLite refuses to open.
-    With an empty authority (``file:////server/share/x.db``) SQLite hands
-    Windows the ``//server/share`` path, which it opens as the UNC path.
-    """
-    if windows is None:
-        windows = os.name == "nt"
-        db_path = os.path.abspath(db_path)
-    if not windows:
-        return PurePosixPath(db_path).as_uri() + "?mode=ro"
-    path = PureWindowsPath(db_path)
-    if ntpath.splitdrive(str(path))[0].startswith("\\\\"):
-        return "file:" + quote("//" + path.as_posix()) + "?mode=ro"
-    return path.as_uri() + "?mode=ro"
-
-
-def _integrity(conn, _roots):
-    rows = [
-        row[0] for row in conn.execute(f"PRAGMA integrity_check({INTEGRITY_LIMIT})")
-    ]
-    if rows == ["ok"]:
-        return {**_result(0, []), "capped": False}
-    # SQLite stops listing at the limit: there may be more problems than that.
-    return {**_result(len(rows), rows), "capped": len(rows) >= INTEGRITY_LIMIT}
-
-
-def _foreign_keys(conn, _roots):
-    return _counted(
-        f"{table} row {rowid} references a missing {parent} row"
-        for table, rowid, parent, _fkid in conn.execute("PRAGMA foreign_key_check")
-    )
-
-
-def _canonical_hashes(conn, _roots):
-    register_prompt_functions(conn)  # pm_prompt_hash, shared with history (#460)
-    return _counted(
-        f"Prompt {row[0]}: the stored hash does not match its text"
-        for row in conn.execute(
-            "SELECT id FROM prompts WHERE hash IS NOT pm_prompt_hash(text) ORDER BY id"
-        )
-    )
-
-
-def _pair_uniqueness(conn, _roots):
-    groups = conn.execute(
-        "SELECT positive_prompt_id,negative_prompt_id,COUNT(*) FROM prompt_pairs "
-        "GROUP BY positive_prompt_id,negative_prompt_id HAVING COUNT(*)>1 "
-        "ORDER BY positive_prompt_id,negative_prompt_id"
-    ).fetchall()
-    detail = [
-        f"Positive prompt {positive} with "
-        + ("no negative" if negative is None else f"negative {negative}")
-        + f": {rows} pair rows"
-        for positive, negative, rows in groups
-    ]
-    # The surplus rows: what keeping one row per pair would leave out.
-    return _result(sum(rows - 1 for _p, _n, rows in groups), detail)
-
-
-def _consistency(conn, _roots):
-    return _counted(iter_consistency_issues(conn))
-
-
-def _readable(root):
-    return os.path.isdir(root) and os.access(root, os.R_OK | os.X_OK)
-
-
-def _root_prefix(root):
-    return normalize_image_path(root).rstrip("\\/") + os.sep
-
-
-def _source_name(root, index):
-    """A source's folder name for the report (never its server path)."""
-    return os.path.basename(str(root).rstrip("\\/")) or f"Source {index + 1}"
-
-
-def _owner(path, prefixes):
-    """Index of the longest source prefix *path* lies under, or None."""
-    owner, longest = None, -1
-    for index, prefix in enumerate(prefixes):
-        if path.startswith(prefix) and len(prefix) > longest:
-            owner, longest = index, len(prefix)
-    return owner
-
-
-def _image_owner(image_path, file_path, prefixes):
-    spelled = file_path or normalize_image_path(image_path)
-    owner = _owner(spelled, prefixes)
-    if owner is None:
-        owner = _owner(normalize_image_path(os.path.realpath(image_path)), prefixes)
-    return owner
-
-
-def readable_roots(roots):
-    """Whether each source can be read now (an unmounted drive cannot)."""
-    return [_readable(root) for root in roots]
-
-
-def link_states(rows, roots, readable):
-    """``(row, owner, state)`` for each image row ``(id, image_path, filename,
-    file_path)``: ``owner`` is the index of the source it lies under (None
-    outside every source) and ``state`` is ``missing``, ``present``,
-    ``unavailable`` (its source cannot be read, so the file is not looked at)
-    or ``outside``. ``readable`` is ``readable_roots(roots)``. The health
-    check's ``missing_files`` and the maintenance missing-link plan both
-    judge links this way, so their counts agree.
-    """
-    for row, owner, state in _placed_links(rows, roots, readable):
-        if state is None:
-            state = "present" if os.path.exists(row[1]) else "missing"
-        yield row, owner, state
-
-
-def held_links(rows, roots, readable):
-    """``(row, owner, state)`` for each link ``link_states`` holds back
-    (``unavailable`` or ``outside``), without looking at any file (#586)."""
-    for row, owner, state in _placed_links(rows, roots, readable):
-        if state is not None:
-            yield row, owner, state
-
-
-def _placed_links(rows, roots, readable):
-    """``link_states`` before any file is looked at: state None means the
-    link lies under a readable source."""
-    prefixes = [_root_prefix(root) for root in roots]
-    for row in rows:
-        owner = _image_owner(row[1], row[3], prefixes)
-        if owner is None:
-            yield row, None, "outside"
-        elif not readable[owner]:
-            yield row, owner, "unavailable"
-        else:
-            yield row, owner, None
-
-
-def _unavailable_line(unavailable, *, partial):
-    noun = "source is" if unavailable == 1 else "sources are"
-    effect = "its files were" if unavailable == 1 else "their files were"
-    if not partial:
-        effect = "missing files were"
-    return f"{unavailable} image {noun} unavailable, so {effect} not counted."
-
-
-def _missing_files(conn, roots):
-    """Links whose file is gone, counted per source (only readable ones).
-
-    Each source reports ``checked`` with its own count, or ``unavailable``
-    (an unmounted drive) with no count: its links are never turned into a
-    count, while the readable sources still are. The check's ``count`` is the
-    readable sources' total (None when none is readable) and ``partial`` says
-    some sources were not checked. Links outside every source are named in the
-    detail, not counted.
-
-    Inside the snapshot this only reads the image rows; it returns the step
-    that checks their files, which runs after the snapshot ended.
-    """
-    if not roots:
-        result = _result(None, ["No image source is available."], status="unavailable")
-        return {**result, "partial": False, "sources": []}
-    rows = []
-    cursor = conn.execute(
-        "SELECT id,image_path,filename,file_path FROM generated_images ORDER BY id"
-    )
-    while batch := cursor.fetchmany(BATCH_ROWS):
-        rows.extend(batch)
-    return lambda: _check_files(rows, roots)
-
-
-def _check_files(rows, roots):
-    """The ``missing_files`` result of the image *rows*, from the file system."""
-    readable = readable_roots(roots)
-    sources = [
-        {
-            "name": _source_name(root, index),
-            "status": "checked" if ok else "unavailable",
-            "count": 0 if ok else None,
-        }
-        for index, (root, ok) in enumerate(zip(roots, readable))
-    ]
-    unavailable = readable.count(False)
-    if not any(readable):
-        result = _result(
-            None, [_unavailable_line(unavailable, partial=False)], status="unavailable"
-        )
-        return {**result, "partial": False, "sources": sources}
-    outside, missing = 0, []
-    for row, owner, state in link_states(rows, roots, readable):
-        if state == "outside":
-            outside += 1
-        elif state == "missing":
-            image_id, image_path, filename, _file_path = row
-            sources[owner]["count"] += 1
-            if len(missing) < MAX_DETAIL:
-                name = filename or os.path.basename(image_path)
-                missing.append(f"Image {image_id}: {name} is missing")
-    count = sum(source["count"] or 0 for source in sources)
-    detail = [_unavailable_line(unavailable, partial=True)] if unavailable else []
-    detail += missing
-    if outside:
-        links = "link" if outside == 1 else "links"
-        verb = "was" if outside == 1 else "were"
-        detail.append(
-            f"{outside} {links} outside the image sources {verb} not checked."
-        )
-    status = None if count or not unavailable else "unavailable"
-    result = _result(count, detail, status=status)
-    return {**result, "partial": bool(unavailable), "sources": sources}
-
-
-def _ambiguous(review_count):
-    if review_count is None:
-        return _result(None, [REVIEW_UNAVAILABLE], status="unavailable")
-    return _result(review_count, [])
-
-
-def overall_status(checks) -> str:
-    """``passed`` only when every check passed; any check not run is incomplete."""
-    statuses = {check["status"] for check in checks}
-    if statuses & {"unavailable", "failed"} or any(
-        check.get("partial") for check in checks
-    ):
-        return "incomplete"
-    return "issues" if "issues" in statuses else "passed"
-
-
-def _failed():
-    return _result(None, [CHECK_FAILED], status="failed")
-
-
-def _run_check(check_id, step, *args):
-    """One check's result, or None (reported as failed) when it raised."""
-    try:
-        return step(*args)
-    except Exception:  # any error fails this check only; the others still run
-        logger.exception(f"Health check {check_id} failed")
-        return None
-
-
-def _run_database_checks(db_path, roots):
-    """Each database check's result (None when it raised), from one snapshot.
-
-    A check may return a step instead of its result: the step runs after the
-    snapshot ended and the connection closed (``missing_files``' file checks).
-    """
-    results = dict.fromkeys(_DATABASE_CHECKS)
-    try:
-        conn = sqlite3.connect(readonly_uri(db_path), uri=True)
-    except sqlite3.Error:
-        logger.exception("Health check could not open the database")
-        return results
-    try:
-        conn.execute("BEGIN")  # one read snapshot for every check
-        for check_id in _DATABASE_CHECKS:
-            runner = globals()["_" + check_id]  # looked up per run (tests patch it)
-            results[check_id] = _run_check(check_id, runner, conn, roots)
-    except sqlite3.Error:
-        logger.exception("Health check could not read the database")
-    finally:
-        conn.close()
-    for check_id, result in results.items():
-        if callable(result):
-            results[check_id] = _run_check(check_id, result)
-    return results
-
-
-class HealthOperations:
-    """Mixin for PromptDatabase: the read-only System health check."""
-
-    def run_health_checks(self, roots, *, review_count=None) -> dict:
-        """Run every check and return a ``HealthReport``.
-
-        Args:
-            roots: The image source directories to judge missing files under:
-                the effective sources plus any configured source that is not
-                available (reported as an unavailable source of ``missing_files``).
-            review_count: The Needs-review pending count, or None while no
-                review queue exists (``ambiguous_metadata`` is then unavailable).
-        """
-        if review_count is not None and (
-            type(review_count) is not int or review_count < 0
-        ):
-            raise ValueError("review_count must be a non-negative integer or None")
-        roots = [str(root) for root in roots]
-        database = _run_database_checks(self.model.db_path, roots)
-        checks = []
-        for check_id, label in CHECKS:
-            if check_id == "ambiguous_metadata":
-                result = _ambiguous(review_count)
-            else:
-                result = database[check_id] or _failed()
-            checks.append({"id": check_id, "label": label, **result})
-        return {
-            "success": True,
-            "checked_at": datetime.datetime.now(datetime.timezone.utc).isoformat(),
-            "status": overall_status(checks),
-            "checks": checks,
-        }
@@ -4,17 +4,9 @@ import os
 import sqlite3

 try:
-    from ..utils.inspection_response import (
-        MAX_LIBRARY_BYTES,
-        _library_projection,
-        library_metadata,
-    )
+    from ..utils.inspection_response import MAX_LIBRARY_BYTES, _library_projection
 except ImportError:
-    from utils.inspection_response import (
-        MAX_LIBRARY_BYTES,
-        _library_projection,
-        library_metadata,
-    )
+    from utils.inspection_response import MAX_LIBRARY_BYTES, _library_projection


 def _display_bytes(value: bytes | None) -> str | None:
@@ -60,21 +52,15 @@ def _saved_projection(conn: sqlite3.Connection, row: sqlite3.Row) -> tuple[dict,
        return saved, _library_projection({"status": "limited"})
    pair = pairs[0] if pairs else None
    title = pair["title"] if pair is not None else None
-    recipe_tags, limited = (
-        _tags(conn, pair["id"], pair=True) if pair is not None else ([], False)
-    )
-    positive_tags = []
-    if not recipe_tags and not limited:
-        # D39: only read the positive's tags when they are what the panel shows.
-        positive_tags, limited = _tags(conn, row["prompt_id"], pair=False)
-    metadata = library_metadata(
-        row["category"],
-        positive_tags,
-        (pair["category"], recipe_tags) if pair is not None else None,
+    category = pair["category"] if pair is not None else row["category"]
+    tags, limited = _tags(
+        conn,
+        pair["id"] if pair is not None else row["prompt_id"],
+        pair=pair is not None,
    )
    limited = limited or any(
        value is not None and len(value) > MAX_LIBRARY_BYTES
-        for value in (title, metadata["category"])
+        for value in (title, category)
    )
    if pair is not None:
        saved["pair"] = {
@@ -87,8 +73,9 @@ def _saved_projection(conn: sqlite3.Connection, row: sqlite3.Row) -> tuple[dict,
            "positive_id": row["prompt_id"],
            "pair_id": pair["id"] if pair is not None else None,
            "title": _display_bytes(title),
-            **metadata,
-            "category": _display_bytes(metadata["category"]),
+            "category": _display_bytes(category),
+            "tags": tags,
+            "metadata_scope": "pair" if pair is not None else "positive",
        }
    )
    if limited:
@@ -10,16 +10,11 @@ import re
 import sqlite3
 from typing import Iterator

-from .execution_contexts import _hints, _values, content_digest
+from .execution_contexts import content_digest
 from .execution_history import HistoryEpochChanged
 from .execution_outputs import _capture, _REFERENCE_COLUMNS
 from .library import _ELIGIBLE

-try:
-    from ..utils.hashing import prompt_key, stored_prompt_text
-except ImportError:
-    from utils.hashing import prompt_key, stored_prompt_text
-
 RunKey = tuple[int, str, int, str]


@@ -103,45 +98,14 @@ _ORDER = (
    "r.observed_dequeue_at DESC,r.session_id COLLATE BINARY DESC,"
    "r.queue_item_id DESC,r.run_id COLLATE BINARY DESC"
 )
-# Stale-hint rows a newest-pair lookup inspects before it reports none.
-_PAIR_RUN_CANDIDATES = 16
-# The recorded texts of one scope, as a JSON array parameter (_scope_text_ids).
-_IN_SCOPE = "IN (SELECT value FROM json_each(?))"
 _MATCHING = (
    "SELECT DISTINCT rc.run_id FROM execution_prompt_snapshots s "
    "JOIN execution_contexts c ON c.positive_snapshot_id=s.snapshot_id "
    "JOIN execution_run_contexts rc ON rc.context_id=c.context_id "
-    f"WHERE s.raw_text_id {_IN_SCOPE}"
+    "WHERE s.raw_text_id=?"
 )


-def _scope_text_ids(conn: sqlite3.Connection, key: str) -> str:
-    """Every recorded raw text whose prompt key is ``key``, as a JSON array.
-
-    A run keeps its exact raw text, while the Library saves and counts it as
-    the prompt with its key (outer whitespace #438, case #460). The values are
-    compared, never only their digests; ``pm_prompt_key`` is Python's key.
-    """
-    return json.dumps(
-        [
-            row[0]
-            for row in conn.execute(
-                # Only snapshot raw texts: effective and affix texts are skipped
-                "SELECT t.text_id FROM (SELECT DISTINCT raw_text_id AS text_id "
-                "FROM execution_prompt_snapshots) s CROSS JOIN "
-                "execution_context_texts t WHERE t.text_id=s.text_id AND "
-                "pm_prompt_key(t.text_value)=? COLLATE BINARY",
-                (key,),
-            )
-        ]
-    )
-
-
-def _scope_text_id(raw: str | None) -> str | None:
-    """The scope digest of a raw text: that of its prompt key."""
-    return None if raw is None else content_digest("text", (prompt_key(raw),))
-
-
 def _limit(limit: int) -> None:
    if type(limit) is not int or not 1 <= limit <= 100:
        raise ValueError("History limit must be an integer from 1 to 100")
@@ -289,15 +253,8 @@ class HistoryReadOperations:
        if saved is None:
            return None
        text = saved["text"]
-        raw_id = _scope_text_id(text)
-        # A position from before #460 names the scope by the stripped text
-        # alone; it is the same scope, so a page open across the upgrade resumes.
-        legacy_id = (
-            None
-            if text is None
-            else content_digest("text", (stored_prompt_text(text),))
-        )
-        if after is not None and after.raw_text_id not in (raw_id, legacy_id):
+        raw_id = None if text is None else content_digest("text", (text,))
+        if after is not None and after.raw_text_id != raw_id:
            raise ValueError("History position text scope changed")
        group = {
            "positive_id": positive_id,
@@ -314,11 +271,18 @@ class HistoryReadOperations:
            next_position=None,
            resume_position=None,
        )
-        if raw_id is None:
+        if (
+            raw_id is None
+            or conn.execute(
+                "SELECT 1 FROM execution_context_texts WHERE text_id=? "
+                "AND text_value=? COLLATE BINARY",
+                (raw_id, text),
+            ).fetchone()
+            is None
+        ):
            return result
-        scope = _scope_text_ids(conn, prompt_key(text))
        where = f"r.run_id IN ({_MATCHING})"
-        params = [scope]
+        params = [raw_id]
        if after is not None:
            where += f" AND {_KEY}<=(?,?,?,?)"
            params.extend(after.upper)
@@ -372,9 +336,9 @@ class HistoryReadOperations:
            "LEFT JOIN execution_prompt_snapshots n "
            "ON n.snapshot_id=c.negative_snapshot_id "
            "LEFT JOIN execution_context_texts t ON t.text_id=n.raw_text_id "
-            f"WHERE rc.run_id IN ({placeholders}) AND p.raw_text_id {_IN_SCOPE} "
+            f"WHERE rc.run_id IN ({placeholders}) AND p.raw_text_id=? "
            "ORDER BY rc.anchor_id COLLATE BINARY,rc.run_id COLLATE BINARY",
-            (*by_run, scope),
+            (*by_run, raw_id),
        )
        summaries = {}
        evidence_by_context = {}
@@ -446,68 +410,6 @@ class HistoryReadOperations:
        result["context_summaries"] = list(ordered.values())
        return result

-    def get_newest_pair_run(self, positive_id: int, pair_id: int) -> dict | None:
-        """The newest matching run whose current saved-pair hint names `pair_id`.
-
-        None when the positive is not an eligible saved prompt or the pair is
-        not one of its pairs; ``{"run": None}`` when no recorded run names it.
-        Only a hint captured in this epoch and still resolving to the same pair
-        counts, as in ``get_history_run``.
-        """
-        conn = self._history_connection()
-        saved = conn.execute(
-            "SELECT CASE WHEN typeof(p.text)='text' AND "
-            "length(CAST(p.text AS BLOB))<=65536 THEN p.text ELSE NULL END AS text "
-            f"FROM prompts p WHERE p.id=? AND ({_ELIGIBLE})",
-            (positive_id,),
-        ).fetchone()
-        if saved is None or (
-            conn.execute(
-                "SELECT 1 FROM prompt_pairs WHERE id=? AND positive_prompt_id=?",
-                (pair_id, positive_id),
-            ).fetchone()
-            is None
-        ):
-            return None
-        if saved["text"] is None:
-            return {"run": None}
-        epoch = self.get_execution_epoch()
-        key = prompt_key(saved["text"])
-        candidates = conn.execute(
-            "SELECT r.run_id,rc.anchor_id,rc.context_id,"
-            "c.positive_snapshot_id,c.negative_snapshot_id "
-            "FROM execution_runs r JOIN execution_run_contexts rc "
-            "ON rc.run_id=r.run_id JOIN execution_contexts c "
-            "ON c.context_id=rc.context_id JOIN execution_prompt_snapshots s "
-            "ON s.snapshot_id=c.positive_snapshot_id "
-            f"WHERE s.raw_text_id {_IN_SCOPE} AND rc.pair_id=? "
-            "AND rc.reference_epoch=? "
-            f"ORDER BY {_ORDER},rc.anchor_id COLLATE BINARY LIMIT ?",
-            (
-                _scope_text_ids(conn, key),
-                pair_id,
-                epoch,
-                _PAIR_RUN_CANDIDATES,
-            ),
-        ).fetchall()
-        for row in candidates:
-            positive = _values(conn, row["positive_snapshot_id"])
-            negative = _values(conn, row["negative_snapshot_id"])
-            if (
-                positive is None
-                or positive["raw"] is None
-                or prompt_key(positive["raw"]) != key
-            ):
-                continue
-            hints = _hints(conn, positive["raw"], negative["raw"] if negative else None)
-            if hints[2] == pair_id:
-                return {
-                    "run": {
-                        key: row[key] for key in ("run_id", "anchor_id", "context_id")
-                    }
-                }
-        return {"run": None}
-
    def get_history_run(self, run_id: str) -> dict | None:
        conn = self._history_connection()
        run = self.get_execution_run(run_id)
@@ -517,9 +419,11 @@ class HistoryReadOperations:
        snapshots = {
            row["anchor_id"]: row
            for row in conn.execute(
-                "SELECT rc.anchor_id,c.positive_snapshot_id,c.negative_snapshot_id "
+                "SELECT rc.anchor_id,c.positive_snapshot_id,c.negative_snapshot_id,"
+                "p.raw_text_id AS positive_raw_text_id "
                "FROM execution_run_contexts rc JOIN execution_contexts c "
-                "ON c.context_id=rc.context_id WHERE rc.run_id=?",
+                "ON c.context_id=rc.context_id LEFT JOIN execution_prompt_snapshots p "
+                "ON p.snapshot_id=c.positive_snapshot_id WHERE rc.run_id=?",
                (run_id,),
            )
        }
@@ -529,12 +433,12 @@ class HistoryReadOperations:
            context.update(
                {
                    key: row[key]
-                    for key in ("positive_snapshot_id", "negative_snapshot_id")
-                },
-                # The history scope this context belongs to (#438)
-                positive_raw_text_id=_scope_text_id(
-                    (context["positive"] or {}).get("raw")
-                ),
+                    for key in (
+                        "positive_snapshot_id",
+                        "negative_snapshot_id",
+                        "positive_raw_text_id",
+                    )
+                }
            )
            pair = context["pair_id"]
            context["navigation"] = {
@@ -1,251 +0,0 @@
-"""Image categories (#332): an image file's own category.
-
-An image shows its own category when it has one, otherwise the category its
-link supplies (its recipe's, else its positive prompt's); this table holds
-only the own values. A row is keyed by the file key: the deepest configured
-output source that contains the file (its real, case-normalized path) and the
-path below it, case-folded where the OS folds case
-(``py/api/images.py`` ``image_category_key``). Without nested sources the key
-equals a favorite's key. Nothing follows a moved file: its row stays and is
-hidden until a file appears at the same path again.
-
-Writes validate strictly (the route strips the value and applies
-``validate_category``). Startup checks the structure only, so a value saved
-under older rules never stops the library opening; restore also checks the
-values. Optional in old backups, required once a database is current.
-"""
-
-import re
-import sqlite3
-from typing import Iterable
-
-TABLE = "image_categories"
-INDEX = "idx_image_categories_category"
-MAX_KEY_LENGTH = 4096
-MAX_CATEGORY_LENGTH = 100
-_DDL = (
-    f"CREATE TABLE {TABLE} (root_key TEXT NOT NULL, relative_path TEXT NOT NULL, "
-    "category TEXT NOT NULL, updated_at TEXT NOT NULL, "
-    "PRIMARY KEY (root_key, relative_path))"
-)
-_INDEX_DDL = f"CREATE INDEX {INDEX} ON {TABLE}(category)"
-_AUTOINDEX = f"sqlite_autoindex_{TABLE}_1"
-_COLUMNS = (
-    ("root_key", "TEXT", 1, 1),
-    ("relative_path", "TEXT", 1, 2),
-    ("category", "TEXT", 1, 0),
-    ("updated_at", "TEXT", 1, 0),
-)
-# A category may not hold a character below U+0020 (validate_category).
-_CONTROL_GLOB = "*[" + "".join(chr(code) for code in range(1, 32)) + "]*"
-
-CATEGORY_OF_SQL = (
-    f"SELECT category FROM {TABLE} WHERE root_key = ? AND relative_path = ?"
-)
-CATEGORIES_OF_ROOT_SQL = (
-    f"SELECT relative_path, category FROM {TABLE} WHERE root_key = ?"
-)
-UPSERT_SQL = (
-    f"INSERT INTO {TABLE} (root_key, relative_path, category, updated_at) "
-    "VALUES (?, ?, ?, ?) ON CONFLICT(root_key, relative_path) "
-    "DO UPDATE SET category = excluded.category, updated_at = excluded.updated_at"
-)
-DELETE_SQL = f"DELETE FROM {TABLE} WHERE root_key = ? AND relative_path = ?"
-# The duplicate cleanup's copy (#332 MC11): the removed copy's row is copied
-# to the kept copy only when the kept copy has none; it is never deleted.
-COPY_SQL = (
-    f"INSERT OR IGNORE INTO {TABLE} (root_key, relative_path, category, updated_at) "
-    f"SELECT ?, ?, category, updated_at FROM {TABLE} "
-    "WHERE root_key = ? AND relative_path = ?"
-)
-STATEMENTS = (CATEGORY_OF_SQL, CATEGORIES_OF_ROOT_SQL, UPSERT_SQL, DELETE_SQL, COPY_SQL)
-
-
-def _compact(sql: str) -> str:
-    return re.sub(r"\s+", "", sql or "").lower()
-
-
-def _structure_error(
-    conn: sqlite3.Connection, allow_missing: bool, allow_missing_index: bool = False
-) -> str | None:
-    objects = conn.execute(
-        "SELECT type,name,sql FROM sqlite_master WHERE name=? "
-        "OR (type IN ('index','trigger') AND tbl_name=?)",
-        (TABLE, TABLE),
-    ).fetchall()
-    if not objects:
-        return None if allow_missing else "Missing image categories schema"
-    tables = [sql for kind, _name, sql in objects if kind == "table"]
-    others = {(kind, name) for kind, name, _sql in objects if kind != "table"}
-    expected = {("index", _AUTOINDEX), ("index", INDEX)}
-    # Before its install, a table without the category index is repaired by
-    # CREATE INDEX IF NOT EXISTS rather than refused.
-    if allow_missing_index and others == {("index", _AUTOINDEX)}:
-        expected = others
-    if len(tables) != 1 or others != expected:
-        return "Image categories name is reserved by an unsupported schema object"
-    if _compact(tables[0]) != _compact(_DDL):
-        return "Image categories has an invalid table definition"
-    index_sql = next((sql for kind, name, sql in objects if name == INDEX), None)
-    if ("index", INDEX) in expected and _compact(index_sql) != _compact(_INDEX_DDL):
-        return "Image categories has an invalid index"
-    autoindex_sql = next(sql for kind, name, sql in objects if name == _AUTOINDEX)
-    if autoindex_sql is not None:
-        return "Image categories has an invalid index"
-    columns = tuple(
-        (row[1], row[2].upper(), row[3], row[5])
-        for row in conn.execute(f"PRAGMA table_info({TABLE})")
-    )
-    if columns != _COLUMNS:
-        return "Image categories has invalid columns"
-    return None
-
-
-def _values_error(conn: sqlite3.Connection) -> str | None:
-    # Bytes bound characters from above (UTF-8 is at most 4 bytes each).
-    limit = MAX_KEY_LENGTH * 4
-    if conn.execute(
-        f"SELECT 1 FROM {TABLE} WHERE typeof(root_key) != 'text' "  # nosec B608
-        "OR typeof(relative_path) != 'text' OR typeof(category) != 'text' "
-        "OR typeof(updated_at) != 'text' "
-        f"OR length(CAST(root_key AS BLOB)) > {limit} "
-        f"OR length(CAST(relative_path AS BLOB)) > {limit} "
-        "OR length(CAST(updated_at AS BLOB)) > 64 "
-        "OR instr(CAST(category AS BLOB), x'00') > 0 "
-        f"OR length(category) < 1 OR length(category) > {MAX_CATEGORY_LENGTH} "
-        "OR category != TRIM(category) OR category GLOB ? LIMIT 1",
-        (_CONTROL_GLOB,),
-    ).fetchone():
-        return "Image categories contains invalid values"
-    for root, path in conn.execute(
-        f"SELECT CAST(root_key AS BLOB), CAST(relative_path AS BLOB) "  # nosec B608
-        f"FROM {TABLE} WHERE length(CAST(root_key AS BLOB)) > {MAX_KEY_LENGTH} "
-        f"OR length(CAST(relative_path AS BLOB)) > {MAX_KEY_LENGTH}"
-    ):
-        for raw in (root, path):
-            if len(bytes(raw).decode("utf-8", "replace")) > MAX_KEY_LENGTH:
-                return "Image categories contains invalid values"
-    return None
-
-
-def image_categories_schema_error(
-    conn: sqlite3.Connection,
-    *,
-    allow_missing: bool = True,
-    check_values: bool = True,
-) -> str | None:
-    """Reject an unsupported image categories schema (and, optionally, values).
-
-    Reads only. A missing table is acceptable for backups that predate it
-    unless ``allow_missing`` is false. ``check_values`` also refuses a stored
-    value the write path could never have written.
-    """
-    error = _structure_error(conn, allow_missing)
-    if error is not None or not check_values:
-        return error
-    exists = conn.execute(
-        "SELECT 1 FROM sqlite_master WHERE type='table' AND name=?", (TABLE,)
-    ).fetchone()
-    return _values_error(conn) if exists else None
-
-
-def migrate_image_categories(conn: sqlite3.Connection) -> None:
-    """Install the table and its index atomically; structure is checked
-    before and after. Reads only ``sqlite_master`` and this table's PRAGMAs
-    and writes only its own two objects (no backfill)."""
-    conn.execute("SAVEPOINT image_categories_schema")
-    try:
-        error = _structure_error(conn, True, allow_missing_index=True)
-        if error:
-            raise sqlite3.DatabaseError(error)
-        conn.execute(_DDL.replace("CREATE TABLE", "CREATE TABLE IF NOT EXISTS", 1))
-        conn.execute(
-            _INDEX_DDL.replace("CREATE INDEX", "CREATE INDEX IF NOT EXISTS", 1)
-        )
-        error = image_categories_schema_error(
-            conn, allow_missing=False, check_values=False
-        )
-        if error:
-            raise sqlite3.DatabaseError(error)
-        conn.execute("RELEASE image_categories_schema")
-    except BaseException:
-        conn.execute("ROLLBACK TO image_categories_schema")
-        conn.execute("RELEASE image_categories_schema")
-        raise
-
-
-def copy_image_category(conn: sqlite3.Connection, removed_key, kept_key) -> int:
-    """Give the kept copy the removed copy's category when it has none.
-
-    Runs inside the caller's transaction; never deletes the removed copy's
-    row, so a give-back or a failed delete loses nothing. Returns 1 when a
-    row was inserted, else 0.
-    """
-    if tuple(removed_key) == tuple(kept_key):
-        return 0
-    return max(conn.execute(COPY_SQL, (*kept_key, *removed_key)).rowcount, 0)
-
-
-class ImageCategoryOperations:
-    """PromptDatabase mixin: set, clear and read images' own categories.
-
-    Never reads or writes ``prompts``, ``prompt_pairs`` or
-    ``generated_images``.
-    """
-
-    def image_category(self, root_key: str, relative_key: str) -> str | None:
-        """One file's own category, or None."""
-        row = (
-            self.model.get_connection()
-            .execute(CATEGORY_OF_SQL, (root_key, relative_key))
-            .fetchone()
-        )
-        return row[0] if row else None
-
-    def own_categories_of(self, root_keys: Iterable[str]) -> dict:
-        """``{(root key, relative key): category}`` under the given sources.
-
-        One primary-key range read per source.
-        """
-        found = {}
-        conn = self.model.get_connection()
-        for root_key in dict.fromkeys(root_keys):
-            for relative, category in conn.execute(CATEGORIES_OF_ROOT_SQL, (root_key,)):
-                found[(root_key, relative)] = category
-        return found
-
-    def set_image_categories(self, file_keys, category: str) -> dict:
-        """Set *category* on every file key, in one transaction.
-
-        ``file_keys``: ``(root key, relative key)`` pairs from any number of
-        sources. Returns ``{updated, unchanged}``; a file that already had
-        exactly this value is ``unchanged`` and keeps its ``updated_at``.
-        """
-        from .image_removal_schema import clear_marks_of_keys
-        from .models import utc_now_iso  # models imports this module's schema
-
-        keys = list(dict.fromkeys(tuple(key) for key in file_keys))
-        counts = {"updated": 0, "unchanged": 0}
-        now = utc_now_iso()
-        with self._pair_transaction() as conn:
-            for key in keys:
-                row = conn.execute(CATEGORY_OF_SQL, key).fetchone()
-                if row is not None and row[0] == category:
-                    counts["unchanged"] += 1
-                    continue
-                conn.execute(UPSERT_SQL, (*key, category, now))
-                counts["updated"] += 1
-            clear_marks_of_keys(conn, keys)  # #480: a categorized file is listed
-        return counts
-
-    def clear_image_categories(self, file_keys) -> int:
-        """Remove the own category of every file key (one transaction).
-
-        Returns the number of rows removed.
-        """
-        keys = list(dict.fromkeys(tuple(key) for key in file_keys))
-        removed = 0
-        with self._pair_transaction() as conn:
-            for key in keys:
-                removed += conn.execute(DELETE_SQL, key).rowcount
-        return removed
@@ -1,492 +0,0 @@
-"""Collections (#331): named, hand-picked groups of image files.
-
-A member names its file exactly as a favorite does (``image_favorites.py``):
-the source folder's real, case-normalized path (``root_key``) and the path
-below it (``relative_path``), both server-side only. A member whose file is
-moved, renamed or deleted outside PromptManager is kept and simply not listed;
-nothing follows a file to a new place.
-
-Names are trimmed with each run of whitespace collapsed to one space, 1 to 100
-characters without control characters; ``name_key`` (NFC of the case-folded
-NFC name) is UNIQUE, so names are unique ignoring case and Unicode form.
-
-The two tables install like ``image_favorites`` and ``saved_views``: optional
-in old backups, required once a database is current, created empty with no
-backfill. Startup checks only the structure, so a value saved under older
-rules never stops the library from opening; restore checks the values too,
-but never recomputes ``name_key`` (case tables differ between Python
-versions).
-"""
-
-import re
-import sqlite3
-import unicodedata
-from typing import Optional
-
-from .image_favorites import MAX_KEY_LENGTH
-
-COLLECTIONS_TABLE = "image_collections"
-ITEMS_TABLE = "image_collection_items"
-FILE_INDEX = "idx_image_collection_items_file"
-TABLES = (COLLECTIONS_TABLE, ITEMS_TABLE)
-MAX_NAME_LENGTH = 100
-_TIMESTAMP_BYTES = 64
-# A name key's byte bound: case folding expands a character to at most
-# three, each at most 4 UTF-8 bytes.
-_MAX_KEY_BYTES = MAX_NAME_LENGTH * 3 * 4
-_WHITESPACE = re.compile(r"\s+")
-
-_TABLE_DDL = {
-    COLLECTIONS_TABLE: (
-        f"CREATE TABLE {COLLECTIONS_TABLE} (id INTEGER PRIMARY KEY AUTOINCREMENT, "
-        "name TEXT NOT NULL, name_key TEXT NOT NULL UNIQUE, "
-        "created_at TEXT NOT NULL)"
-    ),
-    ITEMS_TABLE: (
-        f"CREATE TABLE {ITEMS_TABLE} (collection_id INTEGER NOT NULL REFERENCES "
-        f"{COLLECTIONS_TABLE}(id) ON DELETE CASCADE, root_key TEXT NOT NULL, "
-        "relative_path TEXT NOT NULL, added_at TEXT NOT NULL, "
-        "PRIMARY KEY (collection_id, root_key, relative_path))"
-    ),
-}
-_INDEX_DDL = f"CREATE INDEX {FILE_INDEX} ON {ITEMS_TABLE}(root_key, relative_path)"
-# (name, declared type, not null, default, primary key position)
-_COLUMNS = {
-    COLLECTIONS_TABLE: (
-        ("id", "INTEGER", 0, None, 1),
-        ("name", "TEXT", 1, None, 0),
-        ("name_key", "TEXT", 1, None, 0),
-        ("created_at", "TEXT", 1, None, 0),
-    ),
-    ITEMS_TABLE: (
-        ("collection_id", "INTEGER", 1, None, 1),
-        ("root_key", "TEXT", 1, None, 2),
-        ("relative_path", "TEXT", 1, None, 3),
-        ("added_at", "TEXT", 1, None, 0),
-    ),
-}
-# (column, parent table, parent column, on delete)
-_FOREIGN_KEYS = {
-    COLLECTIONS_TABLE: set(),
-    ITEMS_TABLE: {("collection_id", COLLECTIONS_TABLE, "id", "CASCADE")},
-}
-
-
-class CollectionInvalid(ValueError):
-    """A name, id or target breaks the write rules (a 400)."""
-
-
-def _has_control(text: str) -> bool:
-    """Any Unicode control character (category Cc: C0, DEL and C1)."""
-    return any(unicodedata.category(char) == "Cc" for char in text)
-
-
-def normalize_collection_name(name: object) -> str:
-    """The stored spelling of *name*: trimmed, whitespace collapsed, checked.
-
-    Raises ``CollectionInvalid`` unless the result is 1 to 100 characters
-    without control characters.
-    """
-    if not isinstance(name, str):
-        raise CollectionInvalid("Name must be a string")
-    collapsed = _WHITESPACE.sub(" ", name).strip()
-    if not 1 <= len(collapsed) <= MAX_NAME_LENGTH:
-        raise CollectionInvalid(f"Name must be 1 to {MAX_NAME_LENGTH} characters")
-    if _has_control(collapsed):
-        raise CollectionInvalid("Name contains control characters")
-    return collapsed
-
-
-def collection_name_key(name: str) -> str:
-    """The uniqueness key of a name: NFC of the case-folded NFC spelling."""
-    return unicodedata.normalize("NFC", unicodedata.normalize("NFC", name).casefold())
-
-
-def _compact(sql: str) -> str:
-    return re.sub(r"\s+", "", sql).lower()
-
-
-def _expected_catalog() -> set:
-    objects = {("table", name, _compact(sql)) for name, sql in _TABLE_DDL.items()}
-    objects.add(("index", FILE_INDEX, _compact(_INDEX_DDL)))
-    objects |= {("index", f"sqlite_autoindex_{table}_1", "") for table in TABLES}
-    return objects
-
-
-def _catalog(conn: sqlite3.Connection) -> list:
-    # sqlite_sequence (AUTOINCREMENT) is shared with other tables and ignored.
-    return conn.execute(
-        "SELECT type,name,sql FROM sqlite_master "
-        "WHERE name IN (?,?,?) OR tbl_name IN (?,?)",
-        (*TABLES, FILE_INDEX, *TABLES),
-    ).fetchall()
-
-
-def _structure_error(conn: sqlite3.Connection) -> Optional[str]:
-    for table, expected in _COLUMNS.items():
-        columns = tuple(
-            (row[1], row[2].upper(), row[3], row[4], row[5])
-            for row in conn.execute(f"PRAGMA table_info({table})")
-        )
-        if columns != expected:
-            return f"Image collections table {table} has invalid columns"
-        foreign_keys = {
-            (row[3], row[2], row[4], row[6])
-            for row in conn.execute(f"PRAGMA foreign_key_list({table})")
-        }
-        if foreign_keys != _FOREIGN_KEYS[table]:
-            return f"Image collections table {table} has invalid foreign keys"
-    return None
-
-
-def _decoded_too_long(conn, sql: str, limit: int) -> bool:
-    """Whether a byte-bounded candidate row decodes to over *limit* characters."""
-    for row in conn.execute(sql):
-        for raw in row:
-            if len(bytes(raw).decode("utf-8", "replace")) > limit:
-                return True
-    return False
-
-
-def _value_error(conn: sqlite3.Connection) -> Optional[str]:
-    # Only this module's constants are interpolated into the SQL below. Bytes
-    # bound characters from above (UTF-8 is at most 4 bytes each); the few
-    # candidates over the character bound are measured decoded in Python.
-    if conn.execute(
-        f"SELECT 1 FROM {COLLECTIONS_TABLE} WHERE "  # nosec B608
-        "typeof(id) != 'integer' OR typeof(name) != 'text' "
-        "OR typeof(name_key) != 'text' OR typeof(created_at) != 'text' "
-        f"OR length(CAST(name AS BLOB)) > {MAX_NAME_LENGTH * 4} "
-        "OR length(CAST(name_key AS BLOB)) = 0 "
-        f"OR length(CAST(name_key AS BLOB)) > {_MAX_KEY_BYTES} "
-        f"OR length(CAST(created_at AS BLOB)) > {_TIMESTAMP_BYTES} LIMIT 1"
-    ).fetchone():
-        return "Image collections contains invalid values"
-    # The key is not recomputed: Unicode case tables differ between Python
-    # versions, and a key written by another version must stay restorable.
-    # Its UNIQUE constraint keeps names distinct; writes compute it.
-    for (name,) in conn.execute(f"SELECT name FROM {COLLECTIONS_TABLE}"):  # nosec B608
-        if (
-            not 1 <= len(name) <= MAX_NAME_LENGTH
-            or _has_control(name)
-            or name != name.strip()
-        ):
-            return "Image collections contains invalid names"
-    limit = MAX_KEY_LENGTH * 4
-    if conn.execute(
-        f"SELECT 1 FROM {ITEMS_TABLE} WHERE "  # nosec B608
-        "typeof(collection_id) != 'integer' OR typeof(root_key) != 'text' "
-        "OR typeof(relative_path) != 'text' OR typeof(added_at) != 'text' "
-        f"OR length(CAST(root_key AS BLOB)) > {limit} "
-        f"OR length(CAST(relative_path AS BLOB)) > {limit} "
-        f"OR length(CAST(added_at AS BLOB)) > {_TIMESTAMP_BYTES} LIMIT 1"
-    ).fetchone() or _decoded_too_long(
-        conn,
-        f"SELECT CAST(root_key AS BLOB), CAST(relative_path AS BLOB) "  # nosec B608
-        f"FROM {ITEMS_TABLE} WHERE length(CAST(root_key AS BLOB)) > {MAX_KEY_LENGTH} "
-        f"OR length(CAST(relative_path AS BLOB)) > {MAX_KEY_LENGTH}",
-        MAX_KEY_LENGTH,
-    ):
-        return "Image collections contains invalid members"
-    if conn.execute(f"PRAGMA foreign_key_check({ITEMS_TABLE})").fetchone():
-        return "Image collections contains members of a missing collection"
-    return None
-
-
-def image_collections_schema_error(
-    conn: sqlite3.Connection,
-    *,
-    allow_missing: bool = True,
-    check_values: bool = True,
-) -> Optional[str]:
-    """Reject partial or unsupported collections schemas and invalid rows.
-
-    Reads only: nothing is ever repaired. A database without either table is
-    acceptable for backups that predate them unless ``allow_missing`` is
-    false. ``check_values=False`` (live startup) checks the structure only.
-    """
-    objects = _catalog(conn)
-    if not objects:
-        return None if allow_missing else "Missing image collections schema"
-    present = {name for kind, name, _sql in objects if kind == "table"}
-    if present != set(TABLES):
-        return "Incomplete image collections schema"
-    actual = {(kind, name, _compact(sql or "")) for kind, name, sql in objects}
-    if actual != _expected_catalog():
-        return "Image collections has an invalid schema definition"
-    error = _structure_error(conn)
-    if error or not check_values:
-        return error
-    return _value_error(conn)
-
-
-def migrate_image_collections(conn: sqlite3.Connection) -> None:
-    """Install both tables atomically; validate before and after creating them."""
-    conn.execute("SAVEPOINT image_collections_schema")
-    try:
-        error = image_collections_schema_error(conn, check_values=False)
-        if error:
-            raise sqlite3.DatabaseError(error)
-        for sql in _TABLE_DDL.values():
-            conn.execute(sql.replace("CREATE TABLE", "CREATE TABLE IF NOT EXISTS", 1))
-        conn.execute(_INDEX_DDL.replace("INDEX", "INDEX IF NOT EXISTS", 1))
-        error = image_collections_schema_error(
-            conn, allow_missing=False, check_values=False
-        )
-        if error:
-            raise sqlite3.DatabaseError(error)
-        conn.execute("RELEASE image_collections_schema")
-    except BaseException:
-        conn.execute("ROLLBACK TO image_collections_schema")
-        conn.execute("RELEASE image_collections_schema")
-        raise
-
-
-class CollectionMissing(LookupError):
-    """No collection has the id (a 404 ``collection-not-found``)."""
-
-
-class CollectionNameTaken(ValueError):
-    """Another collection already has the name's key (a 409 ``name-taken``)."""
-
-    def __init__(self, collection_id: int):
-        super().__init__("Another collection has this name")
-        self.collection_id = collection_id
-
-
-class CollectionFilesMissing(LookupError):
-    """A new name with nothing to insert (a 404 ``files-not-found``)."""
-
-
-LIST_SQL = f"SELECT id, name FROM {COLLECTIONS_TABLE} ORDER BY name_key, id"
-GET_SQL = f"SELECT id, name FROM {COLLECTIONS_TABLE} WHERE id = ?"
-BY_KEY_SQL = f"SELECT id, name FROM {COLLECTIONS_TABLE} WHERE name_key = ?"
-MEMBERS_SQL = (
-    f"SELECT relative_path FROM {ITEMS_TABLE} "
-    "WHERE collection_id = ? AND root_key = ?"
-)
-ROOT_MEMBERS_SQL = (
-    f"SELECT collection_id, relative_path FROM {ITEMS_TABLE} WHERE root_key = ?"
-)
-COUNTS_SQL = (
-    f"SELECT c.id, (SELECT COUNT(*) FROM {ITEMS_TABLE} i "
-    f"WHERE i.collection_id = c.id) FROM {COLLECTIONS_TABLE} c"
-)
-FILE_SQL = (
-    f"SELECT collection_id FROM {ITEMS_TABLE} "
-    "WHERE root_key = ? AND relative_path = ? ORDER BY collection_id"
-)
-# Every read, for the EXPLAIN QUERY PLAN check: none scans the items table and
-# only the two whole-list reads (LIST_SQL, COUNTS_SQL) scan the collections.
-READ_SQL = (
-    LIST_SQL,
-    GET_SQL,
-    BY_KEY_SQL,
-    MEMBERS_SQL,
-    ROOT_MEMBERS_SQL,
-    COUNTS_SQL,
-    FILE_SQL,
-)
-_INSERT_ITEM_SQL = f"INSERT OR IGNORE INTO {ITEMS_TABLE} VALUES (?, ?, ?, ?)"
-_DELETE_ITEM_SQL = (
-    f"DELETE FROM {ITEMS_TABLE} "
-    "WHERE collection_id = ? AND root_key = ? AND relative_path = ?"
-)
-
-
-def _collection_id(value: object) -> int:
-    if type(value) is not int or not 1 <= value <= 999_999_999:
-        raise CollectionInvalid("Collection id must be a positive integer")
-    return value
-
-
-def _items(items: object) -> list:
-    """Distinct ``(root key, relative key)`` pairs, in order."""
-    if not isinstance(items, (list, tuple)):
-        raise CollectionInvalid("Items must be a list")
-    found = []
-    for item in items:
-        if (
-            not isinstance(item, (list, tuple))
-            or len(item) != 2
-            or not all(
-                isinstance(part, str) and 1 <= len(part) <= MAX_KEY_LENGTH
-                for part in item
-            )
-        ):
-            raise CollectionInvalid("Each item is a root key and a relative key")
-        found.append((item[0], item[1]))
-    return list(dict.fromkeys(found))
-
-
-def _row(row) -> dict:
-    return {"id": row[0], "name": row[1]}
-
-
-class ImageCollectionOperations:
-    """PromptDatabase mixin: collections and their members.
-
-    Each write runs in its own ``BEGIN IMMEDIATE`` transaction
-    (``_pair_transaction``), so two tabs creating one name are serialized.
-    """
-
-    def list_collections(self) -> list[dict]:
-        """Every collection ``{id, name}`` in name-key order, then id."""
-        rows = self.model.get_connection().execute(LIST_SQL)
-        return [_row(row) for row in rows]
-
-    def get_collection(self, collection_id: int) -> Optional[dict]:
-        """``{id, name}`` of one collection, or None."""
-        row = (
-            self.model.get_connection()
-            .execute(GET_SQL, (_collection_id(collection_id),))
-            .fetchone()
-        )
-        return _row(row) if row else None
-
-    def collection_exists(self, collection_id: int) -> bool:
-        return self.get_collection(collection_id) is not None
-
-    def collection_members(self, collection_id: int, root_key: str) -> set[str]:
-        """The relative keys stored for one collection under one source."""
-        rows = self.model.get_connection().execute(
-            MEMBERS_SQL, (_collection_id(collection_id), root_key)
-        )
-        return {path for (path,) in rows}
-
-    def root_collection_members(self, root_key: str) -> dict[int, set[str]]:
-        """``{collection id: relative keys}`` stored under one source."""
-        found: dict[int, set[str]] = {}
-        for collection_id, path in self.model.get_connection().execute(
-            ROOT_MEMBERS_SQL, (root_key,)
-        ):
-            found.setdefault(collection_id, set()).add(path)
-        return found
-
-    def collection_count_snapshot(self, root_keys: list) -> tuple[dict, dict]:
-        """``({root key: {id: relative keys}}, {id: stored rows})`` read in
-        one read transaction, so a write between the reads cannot skew them.
-        """
-        conn = self.model.get_connection()
-        if conn.in_transaction:
-            raise RuntimeError("Collection counts require their own transaction")
-        conn.execute("BEGIN")
-        try:
-            members = {}
-            for root_key in dict.fromkeys(root_keys):
-                found: dict[int, set[str]] = {}
-                for collection_id, path in conn.execute(ROOT_MEMBERS_SQL, (root_key,)):
-                    found.setdefault(collection_id, set()).add(path)
-                members[root_key] = found
-            stored = {cid: count for cid, count in conn.execute(COUNTS_SQL)}
-        finally:
-            conn.rollback()  # it only read
-        return members, stored
-
-    def collection_counts(self) -> dict[int, int]:
-        """``{collection id: stored rows}`` for every collection."""
-        rows = self.model.get_connection().execute(COUNTS_SQL)
-        return {collection_id: count for collection_id, count in rows}
-
-    def file_collections(self, root_key: str, relative_path: str) -> list[int]:
-        """Ids of the collections holding one file."""
-        rows = self.model.get_connection().execute(FILE_SQL, (root_key, relative_path))
-        return [collection_id for (collection_id,) in rows]
-
-    def add_to_collection(
-        self, *, items: object, collection_id: object = None, name: object = None
-    ) -> dict:
-        """Add files to an existing id or a name; create the name when needed.
-
-        A name whose key exists uses that collection; otherwise a collection
-        is created only when at least one item is inserted. Returns
-        ``{collection, created, added, already}``.
-        """
-        from .image_removal_schema import clear_marks_of_keys
-        from .models import utc_now_iso  # models imports this module's schema
-
-        if (collection_id is None) == (name is None):
-            raise CollectionInvalid("Give either a collection id or a name")
-        pairs = _items(items)
-        if name is not None:
-            spelled = normalize_collection_name(name)
-        else:
-            collection_id = _collection_id(collection_id)
-        now = utc_now_iso()
-        with self._pair_transaction() as conn:
-            created = False
-            if name is not None:
-                row = conn.execute(
-                    BY_KEY_SQL, (collection_name_key(spelled),)
-                ).fetchone()
-                if row is None:
-                    if not pairs:
-                        raise CollectionFilesMissing("Nothing to add")
-                    cursor = conn.execute(
-                        f"INSERT INTO {COLLECTIONS_TABLE} "  # nosec B608
-                        "(name, name_key, created_at) VALUES (?, ?, ?)",
-                        (spelled, collection_name_key(spelled), now),
-                    )
-                    row, created = (cursor.lastrowid, spelled), True
-            else:
-                row = conn.execute(GET_SQL, (collection_id,)).fetchone()
-                if row is None:
-                    raise CollectionMissing("No such collection")
-            collection = _row(row)
-            added = sum(
-                conn.execute(
-                    _INSERT_ITEM_SQL, (collection["id"], root, path, now)
-                ).rowcount
-                for root, path in pairs
-            )
-            clear_marks_of_keys(conn, pairs)  # #480: a collected file is listed
-        return {
-            "collection": collection,
-            "created": created,
-            "added": added,
-            "already": len(pairs) - added,
-        }
-
-    def remove_from_collection(self, collection_id: object, items: object) -> dict:
-        """Remove files from one collection; ``{collection, removed}``."""
-        collection_id = _collection_id(collection_id)
-        pairs = _items(items)
-        with self._pair_transaction() as conn:
-            row = conn.execute(GET_SQL, (collection_id,)).fetchone()
-            if row is None:
-                raise CollectionMissing("No such collection")
-            removed = sum(
-                conn.execute(_DELETE_ITEM_SQL, (collection_id, root, path)).rowcount
-                for root, path in pairs
-            )
-        return {"collection": _row(row), "removed": removed}
-
-    def rename_collection(self, collection_id: object, name: object) -> dict:
-        """The renamed ``{id, name}``; a case variant of its own name is fine."""
-        collection_id = _collection_id(collection_id)
-        spelled = normalize_collection_name(name)
-        key = collection_name_key(spelled)
-        with self._pair_transaction() as conn:
-            if conn.execute(GET_SQL, (collection_id,)).fetchone() is None:
-                raise CollectionMissing("No such collection")
-            taken = conn.execute(BY_KEY_SQL, (key,)).fetchone()
-            if taken is not None and taken[0] != collection_id:
-                raise CollectionNameTaken(taken[0])
-            conn.execute(
-                f"UPDATE {COLLECTIONS_TABLE} SET name = ?, name_key = ? "  # nosec B608
-                "WHERE id = ?",
-                (spelled, key, collection_id),
-            )
-        return {"id": collection_id, "name": spelled}
-
-    def delete_collection(self, collection_id: object) -> bool:
-        """Delete one collection and its members (never a file). True."""
-        collection_id = _collection_id(collection_id)
-        with self._pair_transaction() as conn:
-            cursor = conn.execute(
-                f"DELETE FROM {COLLECTIONS_TABLE} WHERE id = ?",  # nosec B608
-                (collection_id,),
-            )
-            if cursor.rowcount == 0:
-                raise CollectionMissing("No such collection")
-        return True
@@ -1,155 +0,0 @@
-"""Persisted image favorites, keyed by gallery root + relative path.
-
-The root key is the root's real, case-normalized path and the relative key is
-case-normalized the same way (see ``py/api/images.py``); both stay
-server-side. Folder names alone are not unique across roots, so a favorite
-follows the directory itself when the configured roots are reordered.
-Optional in old backups, required once a database is current (see
-``library_schema.py``).
-"""
-
-import re
-import sqlite3
-from typing import Iterable
-
-TABLE = "image_favorites"
-MAX_KEY_LENGTH = 4096
-_LOOKUP_CHUNK = 500
-_DDL = (
-    f"CREATE TABLE {TABLE} (root_key TEXT NOT NULL, relative_path TEXT NOT NULL, "
-    "created_at TEXT NOT NULL, PRIMARY KEY(root_key, relative_path))"
-)
-_AUTOINDEX = f"sqlite_autoindex_{TABLE}_1"
-_COLUMNS = (
-    ("root_key", "TEXT", 1, 1),
-    ("relative_path", "TEXT", 1, 2),
-    ("created_at", "TEXT", 1, 0),
-)
-
-
-def _compact(sql: str) -> str:
-    return re.sub(r"\s+", "", sql).lower()
-
-
-def image_favorites_schema_error(
-    conn: sqlite3.Connection, *, allow_missing: bool = True
-) -> str | None:
-    """Reject unsupported favorites schemas and invalid persisted values.
-
-    Reads only. A missing table is acceptable for backups that predate it
-    unless ``allow_missing`` is false.
-    """
-    objects = conn.execute(
-        "SELECT type,name,sql FROM sqlite_master WHERE name=? "
-        "OR (type IN ('index','trigger') AND tbl_name=?)",
-        (TABLE, TABLE),
-    ).fetchall()
-    if not objects:
-        return None if allow_missing else "Missing image favorites schema"
-    tables = [sql for kind, _name, sql in objects if kind == "table"]
-    others = {(kind, name, sql) for kind, name, sql in objects if kind != "table"}
-    if len(tables) != 1 or others != {("index", _AUTOINDEX, None)}:
-        return "Image favorites name is reserved by an unsupported schema object"
-    if _compact(tables[0] or "") != _compact(_DDL):
-        return "Image favorites has an invalid table definition"
-    columns = tuple(
-        (row[1], row[2].upper(), row[3], row[5])
-        for row in conn.execute(f"PRAGMA table_info({TABLE})")
-    )
-    if columns != _COLUMNS:
-        return "Image favorites has invalid columns"
-    # Bytes bound characters from above (UTF-8 is at most 4 bytes each).
-    limit = MAX_KEY_LENGTH * 4
-    if conn.execute(
-        f"SELECT 1 FROM {TABLE} WHERE typeof(root_key) != 'text' "
-        "OR typeof(relative_path) != 'text' OR typeof(created_at) != 'text' "
-        f"OR length(CAST(root_key AS BLOB)) > {limit} "
-        f"OR length(CAST(relative_path AS BLOB)) > {limit} "
-        "OR length(CAST(created_at AS BLOB)) > 64 LIMIT 1"
-    ).fetchone():
-        return "Image favorites contains invalid values"
-    for root, path in conn.execute(
-        f"SELECT CAST(root_key AS BLOB), CAST(relative_path AS BLOB) FROM {TABLE} "
-        f"WHERE length(CAST(root_key AS BLOB)) > {MAX_KEY_LENGTH} "
-        f"OR length(CAST(relative_path AS BLOB)) > {MAX_KEY_LENGTH}"
-    ):
-        for raw in (root, path):
-            if len(bytes(raw).decode("utf-8", "replace")) > MAX_KEY_LENGTH:
-                return "Image favorites contains invalid values"
-    return None
-
-
-def migrate_image_favorites(conn: sqlite3.Connection) -> None:
-    """Install the table atomically; validate before and after creating it."""
-    conn.execute("SAVEPOINT image_favorites_schema")
-    try:
-        error = image_favorites_schema_error(conn)
-        if error:
-            raise sqlite3.DatabaseError(error)
-        conn.execute(_DDL.replace("CREATE TABLE", "CREATE TABLE IF NOT EXISTS", 1))
-        error = image_favorites_schema_error(conn, allow_missing=False)
-        if error:
-            raise sqlite3.DatabaseError(error)
-        conn.execute("RELEASE image_favorites_schema")
-    except BaseException:
-        conn.execute("ROLLBACK TO image_favorites_schema")
-        conn.execute("RELEASE image_favorites_schema")
-        raise
-
-
-class ImageFavoriteOperations:
-    """PromptDatabase mixin: set, clear and look up image favorites."""
-
-    def set_image_favorite(self, root_key: str, relative_path: str) -> bool:
-        """Mark one file as a favorite; repeating it is a no-op. Returns True."""
-        from .models import utc_now_iso  # models imports this module's schema
-
-        from .image_removal_schema import clear_marks_of_keys
-
-        with self.model.get_connection() as conn:
-            conn.execute(
-                "INSERT OR IGNORE INTO image_favorites VALUES (?, ?, ?)",
-                (root_key, relative_path, utc_now_iso()),
-            )
-            clear_marks_of_keys(conn, [(root_key, relative_path)])  # #480
-        return True
-
-    def clear_image_favorite(self, root_key: str, relative_path: str) -> bool:
-        """Remove one favorite; True when a row was removed."""
-        with self.model.get_connection() as conn:
-            cursor = conn.execute(
-                "DELETE FROM image_favorites WHERE root_key=? AND relative_path=?",
-                (root_key, relative_path),
-            )
-        return cursor.rowcount > 0
-
-    def get_image_favorites(
-        self, root_key: str, relative_paths: Iterable[str]
-    ) -> set[str]:
-        """The subset of *relative_paths* favorited under *root_key*."""
-        wanted = list(dict.fromkeys(relative_paths))
-        found: set[str] = set()
-        conn = self.model.get_connection()
-        for start in range(0, len(wanted), _LOOKUP_CHUNK):
-            chunk = wanted[start : start + _LOOKUP_CHUNK]
-            marks = ",".join("?" * len(chunk))
-            rows = conn.execute(  # only "?" placeholders are interpolated
-                "SELECT relative_path FROM image_favorites WHERE root_key=? "
-                f"AND relative_path IN ({marks})",  # nosec B608
-                (root_key, *chunk),
-            )
-            found.update(path for (path,) in rows)
-        return found
-
-    def get_root_favorites(self, root_key: str) -> set[str]:
-        """Every relative key favorited under *root_key* (a primary-key range).
-
-        The Favorites listing (``favorites=1``) intersects these with the
-        root's scan, so its size follows the root's favorites, not its files.
-        """
-        conn = self.model.get_connection()
-        rows = conn.execute(
-            "SELECT relative_path FROM image_favorites WHERE root_key=?",
-            (root_key,),
-        )
-        return {path for (path,) in rows}
@@ -1,348 +0,0 @@
-"""Remove a file's records from the library, and its removal mark (#480).
-
-A *removal* describes one physical file the way the API resolved it from the
-walked listing (``py/api/image_delete.py``):
-
- ``spellings``: every path string records may name it by
-  (``duplicate_spellings.Spellings.of``);
- ``locator``: its private canonical locator;
- ``favorites``: ``(root key, relative key)`` under every listed root holding
-  it, the keys of its favorite and its collection memberships;
- ``category``: its own category's file key, or None.
-
-``remove_image_records`` deletes, in one ``BEGIN IMMEDIATE`` transaction:
-
- its image records (``generated_images``) under every spelling, plus legacy
-  rows matched by ``image_path``; their saved-pair links go by cascade and the
-  workflow documents they held are released;
- the image tags and auto-tag marks of its byte records. The annotation file
-  and byte rows go too, unless a Needs review item still cites them
-  (``media_review_items.byte_id`` is ``ON DELETE RESTRICT``): a decided or
-  revised item keeps its decision;
- its pending, undecided Needs review items (settled as duplicate removal
-  settles them);
- its own category, favorite and collection memberships.
-
-With ``mark`` it also writes the file's removal mark (library-only removal):
-the file stays on disk, hidden until its bytes change. Prompts, recorded runs
-and the media file itself are never touched here.
-"""
-
-import os
-
-from .annotation_schema import BYTES_TABLE, FILES_TABLE
-from .annotations import _BUMP_INDEX
-from .autotag_schema import AUTOTAG_TABLE
-from .duplicate_copies import (
-    DELETE_FAVORITE_SQL,
-    DELETE_LINK_SQL,
-    DELETE_MEMBERSHIPS_SQL,
-    _file_link_rows,
-)
-from .image_categories import DELETE_SQL as DELETE_CATEGORY_SQL
-from .image_removal_schema import (
-    META_TABLE,
-    TABLE,
-    bump_generation,
-    clear_marks,
-    has_marks_table,
-    mark_of,
-    write_mark as _write_mark,
-)
-from .library import display_title
-from .models import utc_now_iso
-from .review import _BUMP_REVIEW_INDEX, _PENDING_OF_LOCATOR, _SETTLE_ITEM
-from .review_changes import notify_review_change
-from .workflow_documents import documents_of_rows, release_documents
-
-BYTES_OF_LOCATOR_SQL = (
-    f"SELECT b.id FROM {FILES_TABLE} f JOIN {BYTES_TABLE} b "  # nosec B608
-    "ON b.file_id=f.id WHERE f.locator=?"
-)
-TAG_COUNT_SQL = "SELECT COUNT(*) FROM media_image_tags WHERE byte_id=?"
-AUTOTAG_COUNT_SQL = (
-    f"SELECT COUNT(*) FROM {AUTOTAG_TABLE} WHERE byte_id=?"  # nosec B608
-)
-CLEAR_TAGS_SQL = "DELETE FROM media_image_tags WHERE byte_id=?"
-CLEAR_AUTOTAG_SQL = f"DELETE FROM {AUTOTAG_TABLE} WHERE byte_id=?"  # nosec B608
-BUMP_TAG_REVISION_SQL = (
-    f"UPDATE {BYTES_TABLE} SET tag_revision=tag_revision+1 WHERE id=?"  # nosec B608
-)
-REVIEW_REFS_SQL = (
-    f"SELECT COUNT(*) FROM {FILES_TABLE} f "  # nosec B608
-    f"JOIN {BYTES_TABLE} b ON b.file_id=f.id "
-    "JOIN media_review_items i ON i.byte_id=b.id WHERE f.locator=?"
-)
-DELETE_FILE_SQL = f"DELETE FROM {FILES_TABLE} WHERE locator=?"  # nosec B608
-FILE_EXISTS_SQL = f"SELECT 1 FROM {FILES_TABLE} WHERE locator=?"  # nosec B608
-FAVORITE_EXISTS_SQL = (
-    "SELECT COUNT(*) FROM image_favorites WHERE root_key=? AND relative_path=?"
-)
-MEMBERSHIP_COUNT_SQL = (
-    "SELECT COUNT(*) FROM image_collection_items WHERE root_key=? AND relative_path=?"
-)
-CATEGORY_EXISTS_SQL = (
-    "SELECT COUNT(*) FROM image_categories WHERE root_key=? AND relative_path=?"
-)
-PAIR_LINK_COUNT_SQL = "SELECT COUNT(*) FROM image_prompt_pairs WHERE image_id=?"
-PROMPT_LINKS_SQL = "SELECT id FROM generated_images WHERE prompt_id=?"
-PROMPT_TITLE_SQL = (
-    "SELECT p.text, s.title FROM prompts p "
-    "LEFT JOIN prompt_library_state s ON s.prompt_id=p.id WHERE p.id=?"
-)
-MARKS_SQL = f"SELECT locator, size, mtime_ns FROM {TABLE}"  # nosec B608
-REVISION_SQL = f"SELECT revision FROM {META_TABLE} WHERE singleton_id=1"  # nosec B608
-MAX_ORPHAN_TITLES = 3
-RECORD_KINDS = (
-    "prompt_links",
-    "pair_links",
-    "image_tags",
-    "auto_tagged",
-    "categories",
-    "collections",
-    "favorites",
-    "review_items",
-)
-
-
-def _link_ids(conn, removal):
-    """``{image id: prompt id}`` of the records naming the file, any spelling."""
-    found = {}
-    for spelled in dict.fromkeys(removal["spellings"]):
-        for image_id, prompt_id in _file_link_rows(conn, spelled):
-            found[image_id] = prompt_id
-    return found
-
-
-def _byte_ids(conn, locator):
-    return [row[0] for row in conn.execute(BYTES_OF_LOCATOR_SQL, (locator,))]
-
-
-def file_locator(path) -> str:
-    """The locator of an absolute path (``normcase(realpath)``)."""
-    return os.path.normcase(os.path.realpath(str(path)))
-
-
-def removed_from_library(conn, path) -> bool:
-    """Whether *path* is hidden by a removal mark whose bytes still match.
-
-    A mark whose file changed (other size or ``mtime_ns``) or is gone is
-    stale: it is deleted on *conn* (the caller's write transaction), and the
-    file is not hidden.
-    """
-    locator = file_locator(path)
-    mark = mark_of(conn, locator)
-    if mark is None:
-        return False
-    try:
-        info = os.lstat(path)
-    except OSError:
-        clear_marks(conn, [locator])
-        return False
-    if (info.st_size, info.st_mtime_ns) == tuple(mark):
-        return True
-    clear_marks(conn, [locator])
-    return False
-
-
-def mark_hides(marks: dict, locator: str, path) -> bool:
-    """Whether a removal mark in *marks* hides the file at *path* (blocking).
-
-    *marks* is ``{locator: (size, mtime_ns)}``. The mark of *locator* hides
-    the file while ``os.lstat(path)`` still has the size and ``mtime_ns`` it
-    was removed with; a file that cannot be looked at is not hidden.
-    """
-    mark = marks.get(locator)
-    if mark is None:
-        return False
-    try:
-        info = os.lstat(path)
-    except OSError:
-        return False
-    return (info.st_size, info.st_mtime_ns) == tuple(mark)
-
-
-def write_mark(conn, locator, size, mtime_ns):
-    _write_mark(conn, locator, size, mtime_ns, utc_now_iso())
-
-
-class ImageRemovalOperations:
-    """PromptDatabase mixin: remove a file's records; removal marks."""
-
-    def count_removal_records(self, removals) -> dict:
-        """Counts of what removing *removals* deletes, in one read snapshot.
-
-        ``{records: {kind: n}, orphaned_prompts: {count, titles}}``: prompts
-        whose every image record is among these files lose their last image
-        (they stay in the Library).
-        """
-        from .maintenance import _read_snapshot
-
-        def read(conn):
-            totals = dict.fromkeys(RECORD_KINDS, 0)
-            links = {}
-            for removal in removals:
-                found = _link_ids(conn, removal)
-                links.update(found)
-                for image_id in found:
-                    totals["pair_links"] += conn.execute(
-                        PAIR_LINK_COUNT_SQL, (image_id,)
-                    ).fetchone()[0]
-                tagged = autotagged = False
-                for byte_id in _byte_ids(conn, removal["locator"]):
-                    tagged |= bool(
-                        conn.execute(TAG_COUNT_SQL, (byte_id,)).fetchone()[0]
-                    )
-                    autotagged |= bool(
-                        conn.execute(AUTOTAG_COUNT_SQL, (byte_id,)).fetchone()[0]
-                    )
-                totals["image_tags"] += int(tagged)
-                totals["auto_tagged"] += int(autotagged)
-                totals["review_items"] += len(
-                    conn.execute(_PENDING_OF_LOCATOR, (removal["locator"],)).fetchall()
-                )
-                totals["favorites"] += int(
-                    any(
-                        conn.execute(FAVORITE_EXISTS_SQL, key).fetchone()[0]
-                        for key in removal["favorites"]
-                    )
-                )
-                totals["collections"] += sum(
-                    conn.execute(MEMBERSHIP_COUNT_SQL, key).fetchone()[0]
-                    for key in removal["favorites"]
-                )
-                if removal.get("category"):
-                    totals["categories"] += conn.execute(
-                        CATEGORY_EXISTS_SQL, removal["category"]
-                    ).fetchone()[0]
-            totals["prompt_links"] = len(links)
-            return {
-                "records": totals,
-                "orphaned_prompts": self._orphaned_prompts(conn, links),
-            }
-
-        return _read_snapshot(self.model.db_path, read)
-
-    @staticmethod
-    def _orphaned_prompts(conn, links):
-        removed = set(links)
-        orphans = []
-        for prompt_id in dict.fromkeys(links.values()):
-            remaining = [
-                row[0]
-                for row in conn.execute(PROMPT_LINKS_SQL, (prompt_id,))
-                if row[0] not in removed
-            ]
-            if not remaining:
-                orphans.append(prompt_id)
-        titles = []
-        for prompt_id in orphans[:MAX_ORPHAN_TITLES]:
-            row = conn.execute(PROMPT_TITLE_SQL, (prompt_id,)).fetchone()
-            if row is not None:
-                titles.append(display_title((row[1],), row[0]) or "")
-        return {"count": len(orphans), "titles": titles}
-
-    def remove_image_records(self, removal, *, mark=None) -> dict:
-        """Delete every record of one file (one transaction); see the module.
-
-        ``mark``: ``(size, mtime_ns)`` to write the file's removal mark, or
-        None (the file was moved to the trash). Returns the counts deleted.
-        """
-        counts = dict.fromkeys(RECORD_KINDS, 0)
-        locator = removal["locator"]
-        with self._pair_transaction() as conn:
-            links = _link_ids(conn, removal)
-            if links:
-                documents = documents_of_rows(conn, "id", list(links))
-                for image_id in links:
-                    counts["pair_links"] += conn.execute(
-                        PAIR_LINK_COUNT_SQL, (image_id,)
-                    ).fetchone()[0]
-                    conn.execute(DELETE_LINK_SQL, (image_id,))
-                release_documents(conn, documents)
-            counts["prompt_links"] = len(links)
-            counts.update(self._remove_annotations(conn, locator))
-            for key in removal["favorites"]:
-                counts["favorites"] += conn.execute(DELETE_FAVORITE_SQL, key).rowcount
-                counts["collections"] += conn.execute(
-                    DELETE_MEMBERSHIPS_SQL, key
-                ).rowcount
-            if removal.get("category"):
-                counts["categories"] += conn.execute(
-                    DELETE_CATEGORY_SQL, tuple(removal["category"])
-                ).rowcount
-            if mark is not None:
-                write_mark(conn, locator, *mark)
-        if counts["review_items"]:
-            notify_review_change(self.model.db_path)
-        return counts
-
-    def _remove_annotations(self, conn, locator) -> dict:
-        """Tags, auto-tag marks, pending review items and, when free, the rows."""
-        counts = {"image_tags": 0, "auto_tagged": 0, "review_items": 0}
-        bytes_ = _byte_ids(conn, locator)
-        for byte_id in bytes_:
-            tags = conn.execute(CLEAR_TAGS_SQL, (byte_id,)).rowcount
-            autotags = conn.execute(CLEAR_AUTOTAG_SQL, (byte_id,)).rowcount
-            if tags:
-                conn.execute(BUMP_TAG_REVISION_SQL, (byte_id,))
-            counts["image_tags"] |= bool(tags)
-            counts["auto_tagged"] |= bool(autotags)
-        for (item_id,) in conn.execute(_PENDING_OF_LOCATOR, (locator,)).fetchall():
-            counts["review_items"] += conn.execute(_SETTLE_ITEM, (item_id,)).rowcount
-        if counts["review_items"]:
-            conn.execute(_BUMP_REVIEW_INDEX)
-        if conn.execute(FILE_EXISTS_SQL, (locator,)).fetchone():
-            if not conn.execute(REVIEW_REFS_SQL, (locator,)).fetchone()[0]:
-                conn.execute(DELETE_FILE_SQL, (locator,))
-            conn.execute(_BUMP_INDEX)
-        counts["image_tags"] = int(counts["image_tags"])
-        counts["auto_tagged"] = int(counts["auto_tagged"])
-        return counts
-
-    def removal_marks(self) -> dict:
-        """``{locator: (size, mtime_ns)}`` of every removal mark (one read)."""
-        conn = self.model.get_connection()
-        if not has_marks_table(conn):
-            return {}
-        return {row[0]: (row[1], row[2]) for row in conn.execute(MARKS_SQL)}
-
-    def removal_revision(self) -> int:
-        conn = self.model.get_connection()
-        if not has_marks_table(conn):
-            return 0
-        row = conn.execute(REVISION_SQL).fetchone()
-        return row[0] if row else 0
-
-    def clear_removal_marks(self, locators) -> int:
-        """Show these files again (their marks go); the count removed."""
-        locators = list(locators)
-        if not locators:
-            return 0
-        with self._pair_transaction() as conn:
-            removed = clear_marks(conn, locators)
-        # #498: again after the commit, so a reader that cached the marks
-        # between the in-transaction bump and the commit reloads them.
-        bump_generation()
-        return removed
-
-    def clear_hiding_marks(self, files) -> set:
-        """Delete the marks that still hide their file (#498, Return to library).
-
-        *files* are ``(locator, path)`` pairs. In one ``BEGIN IMMEDIATE``
-        transaction each mark is read again and deleted only while the file at
-        *path* still has its size and ``mtime_ns``. Returns the locators whose
-        marks went.
-        """
-        cleared = set()
-        files = list(files)
-        if not files:
-            return cleared
-        with self._pair_transaction() as conn:
-            for locator, path in files:
-                mark = mark_of(conn, locator)
-                if mark is not None and mark_hides({locator: mark}, locator, path):
-                    cleared.add(locator)
-            clear_marks(conn, sorted(cleared))
-        bump_generation()
-        return cleared
@@ -1,213 +0,0 @@
-"""Removal marks (#480): files removed from the library that stay on disk.
-
-``image_removals`` holds one row per hidden file: its private canonical
-locator (the ``media_annotation_files.locator`` form) and the ``size`` and
-``mtime_ns`` it had when it was removed. A file at that locator with other
-bytes is a new file and shows again. ``image_removals_meta`` is one row, the
-marks revision, bumped in the same transaction as every mark change so the
-workspace listing caches can tell marks changed.
-
-The group installs like ``image_favorites``: optional in old backups,
-required once a database is current. Older builds ignore it.
-"""
-
-import os
-import re
-import sqlite3
-
-from .annotation_schema import MAX_LOCATOR_LENGTH
-
-TABLE = "image_removals"
-META_TABLE = "image_removals_meta"
-TABLES = (TABLE, META_TABLE)
-_TABLE_DDL = {
-    TABLE: (
-        f"CREATE TABLE {TABLE} (locator TEXT PRIMARY KEY, "
-        "size INTEGER NOT NULL CHECK(size>=0), mtime_ns INTEGER NOT NULL, "
-        "removed_at TEXT NOT NULL) WITHOUT ROWID"
-    ),
-    META_TABLE: (
-        f"CREATE TABLE {META_TABLE} (singleton_id INTEGER PRIMARY KEY "
-        "CHECK(singleton_id=1), revision INTEGER NOT NULL DEFAULT 0 "
-        "CHECK(revision>=0))"
-    ),
-}
-_SEED_META = (
-    f"INSERT OR IGNORE INTO {META_TABLE} (singleton_id, revision) VALUES (1, 0)"
-)
-_COLUMNS = {
-    TABLE: (
-        ("locator", "TEXT", 1, 1),
-        ("size", "INTEGER", 1, 0),
-        ("mtime_ns", "INTEGER", 1, 0),
-        ("removed_at", "TEXT", 1, 0),
-    ),
-    META_TABLE: (
-        ("singleton_id", "INTEGER", 0, 1),
-        ("revision", "INTEGER", 1, 0),
-    ),
-}
-_AUTOINDEX = f"sqlite_autoindex_{TABLE}_1"
-
-
-def _compact(sql: str) -> str:
-    return re.sub(r"\s+", "", sql or "").lower()
-
-
-def _structure_error(conn: sqlite3.Connection, allow_missing: bool) -> str | None:
-    rows = conn.execute(
-        "SELECT type,name,tbl_name,sql FROM sqlite_master WHERE name IN (?,?) "
-        "OR tbl_name IN (?,?)",
-        TABLES + TABLES,
-    ).fetchall()
-    if not rows:
-        return None if allow_missing else "Missing image removal marks schema"
-    tables = {name: sql for kind, name, _tbl, sql in rows if kind == "table"}
-    others = {(kind, name) for kind, name, _tbl, _sql in rows if kind != "table"}
-    if set(tables) != set(TABLES) or others - {("index", _AUTOINDEX)}:
-        return "Image removal marks name is reserved by an unsupported schema object"
-    for table in TABLES:
-        if _compact(tables[table]) != _compact(_TABLE_DDL[table]):
-            return "Image removal marks have an invalid table definition"
-        columns = tuple(
-            (row[1], row[2].upper(), row[3], row[5])
-            for row in conn.execute(f"PRAGMA table_info({table})")
-        )
-        if columns != _COLUMNS[table]:
-            return "Image removal marks have invalid columns"
-    return None
-
-
-def _values_error(conn: sqlite3.Connection) -> str | None:
-    limit = MAX_LOCATOR_LENGTH * 4
-    if conn.execute(
-        f"SELECT 1 FROM {TABLE} WHERE typeof(locator) != 'text' "  # nosec B608
-        f"OR length(CAST(locator AS BLOB)) > {limit} OR locator = '' "
-        "OR typeof(size) != 'integer' OR typeof(mtime_ns) != 'integer' "
-        "OR typeof(removed_at) != 'text' OR length(CAST(removed_at AS BLOB)) > 64 "
-        "LIMIT 1"
-    ).fetchone():
-        return "Image removal marks contain invalid values"
-    meta = conn.execute(
-        f"SELECT singleton_id, typeof(revision) FROM {META_TABLE}"  # nosec B608
-    ).fetchall()
-    if meta != [(1, "integer")]:
-        return "Image removal marks have an invalid revision"
-    return None
-
-
-def image_removals_schema_error(
-    conn: sqlite3.Connection, *, allow_missing: bool = True
-) -> str | None:
-    """Reject unsupported schemas and invalid persisted values (reads only)."""
-    error = _structure_error(conn, allow_missing)
-    if error:
-        return error
-    exists = conn.execute(
-        "SELECT 1 FROM sqlite_master WHERE type='table' AND name=?", (TABLE,)
-    ).fetchone()
-    return _values_error(conn) if exists else None
-
-
-def migrate_image_removals(conn: sqlite3.Connection) -> None:
-    """Install both tables atomically; validate before and after."""
-    conn.execute("SAVEPOINT image_removals_schema")
-    try:
-        error = image_removals_schema_error(conn)
-        if error:
-            raise sqlite3.DatabaseError(error)
-        for sql in _TABLE_DDL.values():
-            conn.execute(sql.replace("CREATE TABLE", "CREATE TABLE IF NOT EXISTS", 1))
-        conn.execute(_SEED_META)
-        error = image_removals_schema_error(conn, allow_missing=False)
-        if error:
-            raise sqlite3.DatabaseError(error)
-        conn.execute("RELEASE image_removals_schema")
-    except BaseException:
-        conn.execute("ROLLBACK TO image_removals_schema")
-        conn.execute("RELEASE image_removals_schema")
-        raise
-
-
-_UNMARK_SQL = f"DELETE FROM {TABLE} WHERE locator=?"  # nosec B608
-_MARK_SQL = (
-    f"INSERT OR REPLACE INTO {TABLE} "  # nosec B608
-    "(locator, size, mtime_ns, removed_at) VALUES (?, ?, ?, ?)"
-)
-_MARK_OF_SQL = f"SELECT size, mtime_ns FROM {TABLE} WHERE locator=?"  # nosec B608
-BUMP_MARKS_SQL = (
-    f"UPDATE {META_TABLE} SET revision=revision+1 WHERE singleton_id=1"  # nosec B608
-)
-
-
-# Bumped whenever this process writes or clears a mark (even in a transaction
-# that later rolls back): readers that cache the marks reload when it moves.
-_generation = 0
-
-
-def generation() -> int:
-    """The marks generation of this process (see ``_generation``)."""
-    return _generation
-
-
-def _bump() -> None:
-    global _generation
-    _generation += 1
-
-
-def bump_generation() -> None:
-    """Move the generation after a commit (a cached read made before it reloads)."""
-    _bump()
-
-
-def has_marks_table(conn: sqlite3.Connection) -> bool:
-    return (
-        conn.execute(
-            "SELECT 1 FROM sqlite_master WHERE type='table' AND name=?", (TABLE,)
-        ).fetchone()
-        is not None
-    )
-
-
-def locator_of_key(root_key: str, relative_key: str) -> str:
-    """The locator of a favorite-style file key (root key + relative key)."""
-    return os.path.normcase(os.path.join(root_key, *relative_key.split("/")))
-
-
-def mark_of(conn: sqlite3.Connection, locator: str):
-    """``(size, mtime_ns)`` of the file's removal mark, or None."""
-    if not has_marks_table(conn):
-        return None
-    row = conn.execute(_MARK_OF_SQL, (locator,)).fetchone()
-    return (row[0], row[1]) if row else None
-
-
-def write_mark(
-    conn: sqlite3.Connection, locator: str, size: int, mtime_ns: int, now: str
-):
-    conn.execute(_MARK_SQL, (locator, int(size), int(mtime_ns), now))
-    conn.execute(BUMP_MARKS_SQL)
-    _bump()
-
-
-def clear_marks(conn: sqlite3.Connection, locators) -> int:
-    """Delete the marks of *locators* on *conn* (no commit); the count removed.
-
-    Every record write for a file calls this (#480): a file with records is
-    in the library, so it is never hidden.
-    """
-    locators = list(dict.fromkeys(locators))
-    if not locators or not has_marks_table(conn):
-        return 0
-    removed = 0
-    for locator in locators:
-        removed += conn.execute(_UNMARK_SQL, (locator,)).rowcount
-    if removed:
-        conn.execute(BUMP_MARKS_SQL)
-        _bump()
-    return removed
-
-
-def clear_marks_of_keys(conn: sqlite3.Connection, file_keys) -> int:
-    """``clear_marks`` for favorite-style ``(root key, relative key)`` pairs."""
-    return clear_marks(conn, [locator_of_key(*key) for key in file_keys])
@@ -1,13 +1,10 @@
 """Read-only positive-parent views over existing prompt and pair tables."""

-import datetime
 import sqlite3
 from collections.abc import Iterator
 from contextlib import contextmanager

-from .library_folders import folder_condition, list_library_folders
 from .library_tokens import library_edit_token
-from .prompt_archive import ARCHIVED, SHELVED

 _ELIGIBLE = """(EXISTS(SELECT 1 FROM prompt_pairs ep WHERE ep.positive_prompt_id=p.id)
 OR EXISTS(SELECT 1 FROM generated_images eg WHERE eg.prompt_id=p.id)
@@ -16,79 +13,10 @@ _ELIGIBLE = """(EXISTS(SELECT 1 FROM prompt_pairs ep WHERE ep.positive_prompt_id
 _FROM = "prompts p LEFT JOIN prompt_library_state ls ON ls.prompt_id=p.id"
 # The characters JavaScript's String.prototype.trim() removes, so a title the
 # display treats as blank also falls back to the prompt text for name sorting.
-_TRIM_CODES = (9, 10, 11, 12, 13, 32, 160, 5760, *range(8192, 8203))
-_TRIM_CODES += (8232, 8233, 8239, 8287, 12288, 65279)
-_BLANK = f"char({','.join(map(str, _TRIM_CODES))})"
-_JS_TRIM = "".join(map(chr, _TRIM_CODES))
-# The Library's display title: a stored title, else the prompt's first line.
-DISPLAY_TITLE_LIMIT = 80
-
-
-def _utf16_units(text: str) -> int:
-    """JavaScript ``length``: characters beyond the BMP count as two units."""
-    return len(text) + sum(1 for ch in text if ord(ch) > 0xFFFF)
-
-
-def _utf16_prefix(text: str, units: int) -> str:
-    """The longest prefix within ``units`` UTF-16 units, never splitting a pair."""
-    used = 0
-    for index, ch in enumerate(text):
-        used += 2 if ord(ch) > 0xFFFF else 1
-        if used > units:
-            return text[:index]
-    return text
-
-
-def titled(stored_titles: tuple, text: object) -> tuple[str | None, str | None]:
-    """Return ``(title, source)``: a stored title, else the text's first line.
-
-    ``source`` is ``"stored"`` for the first non-blank stored title (blank as
-    in JavaScript's trim, like the Library view), ``"text"`` for the first line,
-    and None when both are empty. The first line is trimmed and, past
-    DISPLAY_TITLE_LIMIT UTF-16 units, cut with an ellipsis like the Library's
-    ``libraryTitle()`` (never inside a surrogate pair).
-    """
-    for title in stored_titles:
-        if isinstance(title, str) and title.strip(_JS_TRIM):
-            return title, "stored"
-    if not isinstance(text, str):
-        return None, None
-    first = text.split("\n")[0].strip(_JS_TRIM)
-    if _utf16_units(first) > DISPLAY_TITLE_LIMIT:
-        first = _utf16_prefix(first, DISPLAY_TITLE_LIMIT) + "\u2026"
-    return (first, "text") if first else (None, None)
-
-
-def display_title(stored_titles: tuple, text: object) -> str | None:
-    """The Library display title of ``titled``, without its source."""
-    return titled(stored_titles, text)[0]
-
-
-def utc_iso(value: object) -> str | None:
-    """A stored timestamp as UTC ISO text, or None when absent or unreadable.
-
-    Usage writes are already UTC ISO; a naive value (SQLite's CURRENT_TIMESTAMP
-    form) is read as UTC, and an offset is converted to UTC. One bad row must
-    not fail a whole Library read, so a value past the datetime range after
-    conversion (OverflowError) is unreadable too. Python 3.11+ fromisoformat
-    accepts more ISO forms than 3.10 (e.g. a 2-digit fraction); every form the
-    app writes (utc_now_iso, the 3.2.4 backfill, CURRENT_TIMESTAMP, Z) parses
-    the same on both, so only hand-edited values can differ by version.
-    """
-    if not isinstance(value, str):
-        return None
-    text = value.strip()
-    if text.endswith(("Z", "z")):
-        text = text[:-1] + "+00:00"
-    try:
-        stamp = datetime.datetime.fromisoformat(text)
-        if stamp.tzinfo is None:
-            stamp = stamp.replace(tzinfo=datetime.timezone.utc)
-        return stamp.astimezone(datetime.timezone.utc).isoformat()
-    except (ValueError, OverflowError):
-        return None
-
-
+_BLANK = (
+    "char(9,10,11,12,13,32,160,5760,8192,8193,8194,8195,8196,8197,8198,8199,"
+    "8200,8201,8202,8232,8233,8239,8287,12288,65279)"
+)
 _NAME = (
    f"LOWER(CASE WHEN TRIM(COALESCE(ls.title,''),{_BLANK})!='' "
    "THEN ls.title ELSE p.text END)"
@@ -107,12 +35,6 @@ ARCHIVE_SCOPES = {
 }


-# Shelves (#443): the parents on the shelf, or the archived ones.
-PARENT_SCOPES = {"active": SHELVED, "archived": ARCHIVED}
-# A positive pair owner that is on the shelf, as a condition on alias pp.
-SHELVED_PAIR = SHELVED.replace("p.id", "pp.positive_prompt_id")
-
-
 def _escape(value: str) -> str:
    return value.replace("\\", "\\\\").replace("%", "\\%").replace("_", "\\_")

@@ -129,54 +51,7 @@ def _archive(value: str) -> str:
    return ARCHIVE_SCOPES[value]


-# How the Tags filter matches (#444): every tag (AND), any of them (OR), or
-# parents without any tag.
-TAG_MODES = ("all", "any", "untagged")
-# A parent that no tag's Browse returns (#444 "Untagged prompts"): no tag of its
-# own and no active pair carrying one. The vocabulary's untagged count uses it too.
-UNTAGGED = (
-    "NOT EXISTS(SELECT 1 FROM prompt_tags ut WHERE ut.prompt_id=p.id) "
-    "AND NOT EXISTS(SELECT 1 FROM prompt_pairs up JOIN prompt_pair_tags upt "
-    "ON upt.pair_id=up.id WHERE up.positive_prompt_id=p.id AND up.archived=0)"
-)
-
-
-def _tag_mode(tag_mode: object, tags: list[str]) -> str:
-    if not isinstance(tag_mode, str) or tag_mode not in TAG_MODES:
-        raise ValueError("tag_mode must be one of " + ", ".join(TAG_MODES))
-    if tag_mode == "untagged" and tags:
-        raise ValueError("Untagged prompts cannot also filter by tags")
-    return tag_mode
-
-
-def _tag_conditions(tags: list[str], any_tag: bool) -> tuple[list, list, list]:
-    """Parent-arm and pair-arm tag conditions and the tags' parameters."""
-    parent_exists = (
-        "EXISTS(SELECT 1 FROM prompt_tags pt JOIN tags t ON t.id=pt.tag_id "
-        "WHERE pt.prompt_id=p.id AND t.name{test})"
-    )
-    pair_exists = (
-        "EXISTS(SELECT 1 FROM prompt_pair_tags pt JOIN tags t ON t.id=pt.tag_id "
-        "WHERE pt.pair_id=pp.id AND t.name{test})"
-    )
-    if any_tag and tags:
-        # One condition per arm: the card, or one active pair, carries any tag.
-        test = " IN (" + ",".join("?" for _ in tags) + ")"
-        return [parent_exists.format(test=test)], [pair_exists.format(test=test)], tags
-    return (
-        [parent_exists.format(test="=?") for _ in tags],
-        [pair_exists.format(test="=?") for _ in tags],
-        tags,
-    )
-
-
-def _filter(
-    text: str,
-    category: str | None,
-    tags: list[str],
-    tag_mode: str = "all",
-    folder_prefixes: list[str] | None = None,
-) -> tuple[str, list]:
+def _filter(text: str, category: str | None, tags: list[str]) -> tuple[str, list]:
    if not isinstance(text, str) or len(text) > 500:
        raise ValueError("Search text must be a string of at most 500 characters")
    if category is not None and (not isinstance(category, str) or len(category) > 200):
@@ -187,8 +62,6 @@ def _filter(
        or any(not isinstance(tag, str) or not tag or len(tag) > 200 for tag in tags)
    ):
        raise ValueError("Invalid library tags")
-    mode = _tag_mode(tag_mode, tags)
-    untagged = mode == "untagged"
    parent, pair, parent_params, pair_params = [], ["pp.archived=0"], [], []
    if text:
        parent.append("(p.text LIKE ? ESCAPE '\\' OR ls.title LIKE ? ESCAPE '\\')")
@@ -203,11 +76,17 @@ def _filter(
        pair.append("pp.category=?")
        parent_params.append(category)
        pair_params.append(category)
-    parent_tags, pair_tags, tag_params = _tag_conditions(tags, mode == "any")
-    parent.extend(parent_tags)
-    pair.extend(pair_tags)
-    parent_params.extend(tag_params)
-    pair_params.extend(tag_params)
+    for tag in tags:
+        parent.append(
+            "EXISTS(SELECT 1 FROM prompt_tags pt JOIN tags t ON t.id=pt.tag_id "
+            "WHERE pt.prompt_id=p.id AND t.name=?)"
+        )
+        pair.append(
+            "EXISTS(SELECT 1 FROM prompt_pair_tags pt JOIN tags t ON t.id=pt.tag_id "
+            "WHERE pt.pair_id=pp.id AND t.name=?)"
+        )
+        parent_params.append(tag)
+        pair_params.append(tag)
    condition = (
        "("
        + (" AND ".join(parent) or "1=1")
@@ -219,17 +98,7 @@ def _filter(
        + " AND ".join(pair)
        + ")"
    )
-    if untagged:
-        # A whole-card condition: inside the parent-or-pair OR an untagged pair
-        # would let a tagged parent through.
-        condition = f"({condition}) AND {UNTAGGED}"
-    params = [*parent_params, *pair_params]
-    if folder_prefixes:
-        # A whole-card condition around both arms: images link to the parent.
-        folder, folder_params = folder_condition(folder_prefixes)
-        condition = f"({condition}) AND {folder}"
-        params.extend(folder_params)
-    return f"({_ELIGIBLE}) AND ({condition})", params
+    return f"({_ELIGIBLE}) AND ({condition})", [*parent_params, *pair_params]


 class LibraryOperations:
@@ -276,9 +145,6 @@ class LibraryOperations:
    ) -> list[dict]:
        rows = conn.execute(
            "SELECT p.id,p.text,ls.title,p.category,p.rating,p.notes,p.created_at,"
-            "p.run_count,p.last_used_at,"
-            + ARCHIVED
-            + " AS archived,"
            + (f"{sort_expression} AS _sort," if sort_expression else "")
            + "(SELECT COUNT(*) FROM prompt_pairs v WHERE v.positive_prompt_id=p.id "
            "AND v.archived=0) AS variant_count,"
@@ -299,10 +165,6 @@ class LibraryOperations:
            ):
                by_id[row["prompt_id"]]["tags"].append(row["name"])
        for row in result:
-            # Usage is shown, never compared: the token hashes owner fields only.
-            row["run_count"] = row["run_count"] if type(row["run_count"]) is int else 0
-            row["last_used_at"] = utc_iso(row["last_used_at"])
-            row["archived"] = bool(row["archived"])
            row["edit_token"] = library_edit_token(epoch, row)
        return result

@@ -315,21 +177,14 @@ class LibraryOperations:
        text: str = "",
        category: str | None = None,
        tags: list[str] | None = None,
-        tag_mode: str = "all",
-        folder_prefixes: list[str] | None = None,
        sort: str = "newest",
        limit: int = 40,
        after: dict | None = None,
-        shelf: str = "active",
    ) -> dict:
        _limit(limit)
        if sort not in _ORDERS:
            raise ValueError("Unknown library sort order")
-        if not isinstance(shelf, str) or shelf not in PARENT_SCOPES:
-            raise ValueError("shelf must be active or archived")
-        where, params = _filter(
-            text, category, [] if tags is None else tags, tag_mode, folder_prefixes
-        )
+        where, params = _filter(text, category, [] if tags is None else tags)
        if after is not None:
            if (
                not isinstance(after, dict)
@@ -341,18 +196,9 @@ class LibraryOperations:
            ceiling = after["ceiling"]
        where += " AND p.id<=?"
        params.append(ceiling)
-        # One SELECT counts the filtered parents of this scope, their active
-        # variants, and the filtered archived parents (Show archived, #443).
-        scope = PARENT_SCOPES[shelf]
-        total, variant_total, archived_total = conn.execute(
-            f"SELECT COALESCE(SUM({scope}),0),"
-            f"COALESCE(SUM(CASE WHEN {scope} THEN (SELECT COUNT(*) "
-            "FROM prompt_pairs v WHERE v.positive_prompt_id=p.id "
-            "AND v.archived=0) ELSE 0 END),0),"
-            f"COALESCE(SUM({ARCHIVED}),0) FROM " + _FROM + " WHERE " + where,
-            params,
-        ).fetchone()
-        where += f" AND {scope}"
+        total = conn.execute(
+            "SELECT COUNT(*) FROM " + _FROM + " WHERE " + where, params
+        ).fetchone()[0]
        expression, direction = _ORDERS[sort]
        if after is not None:
            operator = ">" if direction == "ASC" else "<"
@@ -384,10 +230,6 @@ class LibraryOperations:
            "library_epoch": epoch,
            "items": rows,
            "total": total,
-            "variant_total": variant_total,
-            "archived_total": archived_total,
-            # Echoed so a client can tell this read applied its tag match.
-            "tag_mode": tag_mode,
            "has_more": has_more,
            "next_key": next_key,
        }
@@ -398,12 +240,9 @@ class LibraryOperations:
        text: str = "",
        category: str | None = None,
        tags: list[str] | None = None,
-        tag_mode: str = "all",
-        folder_prefixes: list[str] | None = None,
        sort: str = "newest",
        limit: int = 40,
        after: dict | None = None,
-        shelf: str = "active",
    ) -> dict:
        with self.library_snapshot(include_ceiling=True) as (conn, epoch, ceiling):
            return self._list_library(
@@ -413,12 +252,9 @@ class LibraryOperations:
                text=text,
                category=category,
                tags=tags,
-                tag_mode=tag_mode,
-                folder_prefixes=folder_prefixes,
                sort=sort,
                limit=limit,
                after=after,
-                shelf=shelf,
            )

    def _is_library_positive(self, conn: sqlite3.Connection, positive_id: int) -> bool:
@@ -471,7 +307,7 @@ class LibraryOperations:
            for row in conn.execute(
                "SELECT pp.id,COALESCE(n.text,'') AS negative_text,"
                "pp.category,pp.title,pp.archived,"
-                "pp.negative_prompt_id IS NULL AS explicit_empty,pp.run_count,"
+                "pp.negative_prompt_id IS NULL AS explicit_empty,"
                "(SELECT COUNT(DISTINCT image_id) FROM image_prompt_pairs ip "
                "WHERE ip.pair_id=pp.id) AS image_count "
                "FROM prompt_pairs pp "
@@ -487,8 +323,6 @@ class LibraryOperations:
            row["tags"] = []
            row["archived"] = bool(row["archived"])
            row["explicit_empty"] = bool(row["explicit_empty"])
-            # The history lane's "N runs" (#249): queue-hook pair uses, 0 when unset.
-            row["run_count"] = row["run_count"] if type(row["run_count"]) is int else 0
        if by_id:
            marks = ",".join("?" for _ in by_id)
            for row in conn.execute(
@@ -546,13 +380,9 @@ class LibraryOperations:
            "categories": [row["category"] for row in rows],
        }

-    def get_library_options(self, folder_roots=None) -> dict:
-        """Categories; with *folder_roots* (root spellings) also ``folders``."""
+    def get_library_options(self) -> dict:
        with self.library_snapshot() as (conn, epoch, _ceiling):
-            result = self._get_library_options(conn, epoch)
-            if folder_roots is not None:
-                result["folders"] = list_library_folders(conn, folder_roots, _ELIGIBLE)
-            return result
+            return self._get_library_options(conn, epoch)

    def get_library_previews(self, positive_ids: list[int]) -> dict[int, list[dict]]:
        """Read at most two links per parent in one bounded page query."""
@@ -663,9 +493,7 @@ class LibraryOperations:
            owners = {}
            order = []
            for row in conn.execute(
-                "SELECT p.id,p.text,ls.title,p.category,p.rating,p.notes,"
-                + ARCHIVED
-                + " AS archived FROM "
+                "SELECT p.id,p.text,ls.title,p.category,p.rating,p.notes FROM "
                + _FROM
                + " WHERE "
                + _ELIGIBLE
@@ -678,7 +506,6 @@ class LibraryOperations:
                    "tags": [],
                    "rating": row["rating"],
                    "notes": row["notes"],
-                    "archived": bool(row["archived"]),
                    "variants": [],
                }
                order.append(row["id"])
@@ -718,64 +545,3 @@ class LibraryOperations:
                "kind": "prompt-manager-library",
                "positives": [owners[key] for key in order],
            }
-
-    def library_counts(self) -> dict:
-        """System › Overview counts from one snapshot, writing nothing.
-
-        ``positive_prompts`` and ``negative_variants`` are the unfiltered
-        Library's ``total`` and ``variant_total``: eligible parents on the
-        shelf (not archived, #443) and their active pairs (every pair's
-        positive is eligible). ``images`` counts indexed
-        ``generated_images`` rows, not files on disk. An image has no rating
-        of its own (it shows its linked prompt's), so ``rated_images`` counts
-        the indexed images whose linked prompt is rated. ``review_pending`` is
-        the Needs review queue's pending total.
-        """
-        with self.library_snapshot() as (conn, _epoch, _ceiling):
-            row = conn.execute(
-                "SELECT (SELECT COUNT(*) FROM prompts p WHERE "
-                + _ELIGIBLE
-                + " AND "
-                + SHELVED
-                + "),"
-                "(SELECT COUNT(*) FROM prompt_pairs pp WHERE pp.archived=0 AND "
-                + SHELVED_PAIR
-                + "),"
-                "(SELECT COUNT(*) FROM generated_images),"
-                "(SELECT COUNT(*) FROM generated_images gi JOIN prompts r "
-                "ON r.id=gi.prompt_id WHERE r.rating IS NOT NULL),"
-                "(SELECT COUNT(*) FROM media_review_items WHERE state='pending')"
-            ).fetchone()
-        return {
-            "positive_prompts": row[0],
-            "negative_variants": row[1],
-            "images": row[2],
-            "rated_images": row[3],
-            "review_pending": row[4],
-        }
-
-    def usage_by_category(self) -> list[dict]:
-        """Runs and average rating of the Library's parents, per category.
-
-        Only eligible parents count, so a negative-only prompt's runs (which
-        repeat its pairs' runs) are never added twice. A blank category groups
-        with no category as ``None``. Unrated parents are left out of the
-        average, which is ``None`` when no parent is rated. Most runs first.
-        """
-        with self.library_snapshot() as (conn, _epoch, _ceiling):
-            rows = conn.execute(
-                "SELECT * FROM (SELECT NULLIF(TRIM(p.category),'') AS category,"
-                "COALESCE(SUM(p.run_count),0) AS runs,AVG(p.rating) AS rating "
-                "FROM prompts p WHERE " + _ELIGIBLE + " GROUP BY 1) "
-                "ORDER BY runs DESC,category IS NULL,category"
-            ).fetchall()
-        return [
-            {
-                "category": row["category"],
-                "runs": row["runs"],
-                "average_rating": (
-                    None if row["rating"] is None else round(row["rating"], 2)
-                ),
-            }
-            for row in rows
-        ]
@@ -1,473 +0,0 @@
-"""Delete selected Library prompts; archive the paired ones (#443, D152).
-
-A selected Library parent is classified, in this order, as ``not_found``
-(missing, or not a Library parent), ``protected`` (tagged ``__protected__``;
-never changed), ``already_archived``, ``archive`` (the positive or negative of
-any saved pair, archived pair or not: archiving hides it from the shelf and
-removes nothing) or ``delete`` (in no pair: deleted exactly as the legacy
-delete does, through ``delete_prompt_rows``). Every command checks the
-storage epoch first and runs in one ``BEGIN IMMEDIATE`` transaction.
-
-The write executes what the user reviewed: it is given the reviewed archive
-and delete lists, and deletes only reviewed deletes the route backed up
-(``candidates``) whose fingerprint is unchanged since that backup.
-"""
-
-import hashlib
-import json
-import re
-import sqlite3
-from typing import Iterable
-
-from .library import _ELIGIBLE
-from .library_commands import _validate_bulk_ids, _validate_epoch
-from .models import utc_now_iso
-from .prompt_archive import ARCHIVED as _ARCHIVED
-from .prompt_archive import TABLE as ARCHIVE
-from .workflow_documents import documents_of_rows, release_documents
-
-try:
-    from ..utils.hashing import generate_prompt_hash
-except ImportError:
-    from utils.hashing import generate_prompt_hash
-
-# Ids bound per statement: the pair check binds each id twice, which stays
-# under SQLite's historical 999-variable limit (maintenance.py ID_BATCH).
-ID_BATCH = 400
-_PROTECTED = (
-    "EXISTS(SELECT 1 FROM prompt_tags pt JOIN tags t ON t.id=pt.tag_id "
-    "WHERE pt.prompt_id=p.id AND t.name='__protected__')"
-)
-_PAIRED = (
-    "EXISTS(SELECT 1 FROM prompt_pairs pp "
-    "WHERE pp.positive_prompt_id=p.id OR pp.negative_prompt_id=p.id)"
-)
-# #482: used as the negative of another positive's pair (archived or not):
-# never deleted, so that positive's variant stays (archive only).
-_NEGATIVE_OF_OTHER = (
-    "EXISTS(SELECT 1 FROM prompt_pairs op "
-    "WHERE op.negative_prompt_id=p.id AND op.positive_prompt_id!=p.id)"
-)
-# Classes in the order a prompt is tested; the first that holds wins.
-CLASSES = (
-    "not_found",
-    "protected",
-    "already_archived",
-    "not_archived",
-    "archive",
-    "delete",
-)
-# #492: the shelf a Delete… runs on. On the archived shelf an archived prompt is
-# classified by its pairs, and one restored since is ``not_archived``.
-SHELVES = ("active", "archived")
-
-
-def _check_shelf(shelf: str) -> bool:
-    """Whether ``shelf`` is the archived shelf (ValueError when unknown)."""
-    if shelf not in SHELVES:
-        raise ValueError("shelf must be active or archived")
-    return shelf == "archived"
-
-
-_DIGEST = re.compile(r"^[0-9a-f]{64}$")
-
-
-def _batches(ids: list) -> Iterable[list]:
-    for start in range(0, len(ids), ID_BATCH):
-        yield ids[start : start + ID_BATCH]
-
-
-def delete_prompt_rows(conn: sqlite3.Connection, prompt_ids: list[int]) -> int:
-    """Delete prompts and their image link rows; return the prompts deleted.
-
-    The legacy delete's statements (``delete_prompt``, ``bulk_delete_prompts``)
-    in the caller's transaction: image link rows first (``image_prompt_pairs``
-    cascades, review decisions keep a NULL image), then the prompts (tags and
-    Library state cascade), then the workflow documents no row references.
-    Image files are never touched. The caller checks pairs first.
-    """
-    documents = documents_of_rows(conn, "prompt_id", prompt_ids)
-    deleted = 0
-    for chunk in _batches(list(prompt_ids)):
-        marks = ",".join("?" for _ in chunk)
-        conn.execute(
-            f"DELETE FROM generated_images WHERE prompt_id IN ({marks})",  # nosec
-            chunk,
-        )
-        deleted += conn.execute(
-            f"DELETE FROM prompts WHERE id IN ({marks})", chunk  # nosec B608
-        ).rowcount
-    release_documents(conn, documents)
-    return deleted
-
-
-class LibraryArchiveOperations:
-    """PromptDatabase mixin: classify, archive or delete, and restore parents."""
-
-    def _classify_library_delete(
-        self, conn: sqlite3.Connection, prompt_ids: list[int], shelf: str = "active"
-    ) -> dict:
-        on_archived_shelf = _check_shelf(shelf)
-        found, deletable = {}, set()
-        for chunk in _batches(prompt_ids):
-            marks = ",".join("?" for _ in chunk)
-            for row in conn.execute(
-                f"SELECT p.id,{_PROTECTED},{_ARCHIVED},{_PAIRED},"  # nosec B608
-                f"{_NEGATIVE_OF_OTHER} "
-                f"FROM prompts p WHERE p.id IN ({marks}) AND {_ELIGIBLE}",
-                chunk,
-            ):
-                protected, archived, paired, negative_of_other = row[1:5]
-                if protected:
-                    found[row[0]] = "protected"
-                elif on_archived_shelf and not archived:
-                    found[row[0]] = "not_archived"
-                elif archived and not on_archived_shelf:
-                    found[row[0]] = "already_archived"
-                elif paired:
-                    found[row[0]] = "archive"
-                    if not negative_of_other:
-                        deletable.add(row[0])
-                else:
-                    found[row[0]] = "delete"
-        classes = {name: [] for name in CLASSES}
-        for pid in prompt_ids:
-            classes[found.get(pid, "not_found")].append(pid)
-        # #482: the archive ids Delete permanently may delete with their pairs.
-        classes["deletable"] = [pid for pid in classes["archive"] if pid in deletable]
-        return classes
-
-    @staticmethod
-    def _image_links(conn: sqlite3.Connection, prompt_ids: list[int]) -> int:
-        total = 0
-        for chunk in _batches(prompt_ids):
-            marks = ",".join("?" for _ in chunk)
-            total += conn.execute(
-                "SELECT COUNT(*) FROM generated_images "  # nosec B608
-                f"WHERE prompt_id IN ({marks})",
-                chunk,
-            ).fetchone()[0]
-        return total
-
-    @staticmethod
-    def _fingerprints(conn: sqlite3.Connection, prompt_ids: list[int]) -> dict:
-        """What a safety backup holds of each prompt a delete would remove.
-
-        The prompt row (usage included), its tag ids, its Library title and
-        its image link rows (count and newest id), as a JSON-safe list.
-        """
-        prints = {}
-        for chunk in _batches(prompt_ids):
-            marks = ",".join("?" for _ in chunk)
-            for row in conn.execute(
-                "SELECT p.id,p.text,p.hash,p.category,p.rating,p.notes,"  # nosec
-                "p.updated_at,p.run_count,p.last_used_at,"
-                "(SELECT group_concat(tag_id) FROM (SELECT tag_id FROM prompt_tags "
-                "WHERE prompt_id=p.id ORDER BY tag_id)),"
-                "(SELECT title FROM prompt_library_state WHERE prompt_id=p.id),"
-                "(SELECT COUNT(*) FROM generated_images WHERE prompt_id=p.id),"
-                "(SELECT MAX(id) FROM generated_images WHERE prompt_id=p.id) "
-                f"FROM prompts p WHERE p.id IN ({marks})",
-                chunk,
-            ):
-                prints[row[0]] = [
-                    value if isinstance(value, (int, str, type(None))) else repr(value)
-                    for value in tuple(row)[1:]
-                ]
-        return prints
-
-    @staticmethod
-    def _distinct_images(conn: sqlite3.Connection, prompt_ids: list[int]) -> int:
-        """Image rows of ``prompt_ids`` (each image once; #482 deletes them)."""
-        return LibraryArchiveOperations._image_links(conn, prompt_ids)
-
-    @staticmethod
-    def _pair_prints(conn: sqlite3.Connection, prompt_ids: list[int]) -> dict:
-        """#482: each prompt's own saved pairs, as the review saw them.
-
-        Per pair (by id): its negative, archived flag, metadata, usage, ordered
-        tag ids and its image-pair links (count and newest id).
-        """
-        prints = {pid: [] for pid in prompt_ids}
-        for chunk in _batches(prompt_ids):
-            marks = ",".join("?" for _ in chunk)
-            for row in conn.execute(
-                "SELECT pp.positive_prompt_id,pp.id,pp.negative_prompt_id,"  # nosec
-                "pp.archived,pp.title,pp.category,pp.rating,pp.notes,pp.run_count,"
-                "pp.last_used_at,pp.updated_at,"
-                "(SELECT group_concat(tag_id) FROM (SELECT tag_id FROM "
-                "prompt_pair_tags WHERE pair_id=pp.id ORDER BY tag_id)),"
-                "(SELECT COUNT(*) FROM image_prompt_pairs WHERE pair_id=pp.id),"
-                "(SELECT MAX(id) FROM image_prompt_pairs WHERE pair_id=pp.id) "
-                f"FROM prompt_pairs pp WHERE pp.positive_prompt_id IN ({marks}) "
-                "ORDER BY pp.id",
-                chunk,
-            ):
-                prints[row[0]].append(
-                    [
-                        v if isinstance(v, (int, str, type(None))) else repr(v)
-                        for v in tuple(row)[1:]
-                    ]
-                )
-        return prints
-
-    @classmethod
-    def _review_digests(cls, conn: sqlite3.Connection, prompt_ids: list[int]) -> dict:
-        """#482: one digest per deletable prompt of its row and its pairs."""
-        prompts = cls._fingerprints(conn, prompt_ids)
-        pairs = cls._pair_prints(conn, prompt_ids)
-        return {
-            pid: hashlib.sha256(
-                json.dumps(
-                    [prompts.get(pid), pairs[pid]], separators=(",", ":")
-                ).encode("utf-8")
-            ).hexdigest()
-            for pid in prompt_ids
-        }
-
-    @staticmethod
-    def _paired_counts(
-        conn: sqlite3.Connection, prompt_ids: list[int], selected: list[int]
-    ) -> dict:
-        """#482: what Delete permanently would remove with ``prompt_ids``."""
-        pairs = archived = variants = 0
-        negatives = set()
-        for chunk in _batches(prompt_ids):
-            marks = ",".join("?" for _ in chunk)
-            for archived_flag, negative, positive in conn.execute(
-                "SELECT archived,negative_prompt_id,positive_prompt_id "  # nosec
-                f"FROM prompt_pairs WHERE positive_prompt_id IN ({marks})",
-                chunk,
-            ):
-                pairs += 1
-                archived += 1 if archived_flag else 0
-                if negative is not None:
-                    variants += 1
-                    if negative != positive:
-                        negatives.add(negative)
-        return {
-            "pairs": pairs,
-            "archived_pairs": archived,
-            "variants": variants,
-            "kept_negatives": len(negatives - set(selected)),
-        }
-
-    @staticmethod
-    def _checked_ids(prompt_ids: list[int], expected_epoch: str) -> list[int]:
-        _validate_epoch(expected_epoch)
-        _validate_bulk_ids(prompt_ids)
-        return list(dict.fromkeys(prompt_ids))
-
-    def classify_library_delete(
-        self, prompt_ids: list[int], *, expected_epoch: str, shelf: str = "active"
-    ) -> dict:
-        """What a delete of ``prompt_ids`` would do now (reads only).
-
-        Returns the id lists per class, in request order, ``image_links``
-        (the image link rows the ``delete`` class would remove) and
-        ``fingerprints`` of the ``delete`` class (``_fingerprints``). On the
-        archived ``shelf`` (#492) archived prompts are classified by their pairs.
-        """
-        _check_shelf(shelf)
-        prompt_ids = self._checked_ids(prompt_ids, expected_epoch)
-        with self.library_snapshot() as (conn, _epoch, _ceiling):
-            epoch = self._library_epoch(conn, expected_epoch)
-            classes = self._classify_library_delete(conn, prompt_ids, shelf)
-            deletable = classes["deletable"]
-            return {
-                "library_epoch": epoch,
-                **classes,
-                "image_links": self._image_links(conn, classes["delete"]),
-                "fingerprints": self._fingerprints(conn, classes["delete"]),
-                # #482: Delete permanently, with the deletable prompts' pairs.
-                "review_digests": self._review_digests(conn, deletable),
-                "paired_counts": self._paired_counts(conn, deletable, prompt_ids),
-                "paired_image_links": self._distinct_images(conn, deletable),
-            }
-
-    @staticmethod
-    def _repair_hash(conn: sqlite3.Connection, prompt_id: int) -> None:
-        """Give an archived prompt its canonical hash, so ingestion finds it.
-
-        Scans, the monitor and node saves resolve prompts by hash; a stale or
-        missing one would make them insert a visible copy (Q3). When another
-        row already holds the canonical hash, lookups find that row and no new
-        copy is made, so nothing is written.
-        """
-        text, stored = conn.execute(
-            "SELECT text,hash FROM prompts WHERE id=?", (prompt_id,)
-        ).fetchone()
-        canonical = generate_prompt_hash(text) if isinstance(text, str) else None
-        if canonical is None or stored == canonical:
-            return
-        if conn.execute(
-            "SELECT 1 FROM prompts WHERE hash=? AND id!=?", (canonical, prompt_id)
-        ).fetchone():
-            return
-        conn.execute("UPDATE prompts SET hash=? WHERE id=?", (canonical, prompt_id))
-
-    def archive_or_delete_library_prompts(
-        self,
-        archive_ids: list[int],
-        delete_ids: list[int],
-        *,
-        expected_epoch: str,
-        candidates: dict | None,
-        delete_paired: dict | None = None,
-        shelf: str = "active",
-    ) -> dict:
-        """Archive and delete what the user reviewed, all or nothing.
-
-        ``archive_ids`` and ``delete_ids`` are the reviewed classes.
-        ``candidates`` maps each reviewed delete the route backed up to its
-        fingerprint then (None: every reviewed delete, unchecked; tests and
-        callers without a backup). A reviewed delete is deleted only when it
-        still classifies ``delete`` and its fingerprint is unchanged; one that
-        is now paired, and a reviewed archive now unpaired, are archived (the
-        restorable direction); anything else is kept and counted.
-
-        ``delete_paired`` (#482) maps reviewed archive ids the user chose to
-        Delete permanently to their review digest. Each is deleted with its
-        own saved pairs only while it is still deletable and its digest is
-        unchanged; otherwise it is archived and counted ``changed``.
-
-        On the archived ``shelf`` (#492) the ids are archived already: nothing
-        is archived or rewritten, every reviewed id not deleted (protected or
-        changed) counts ``changed``, and one restored since ``not_archived``.
-        """
-        on_archived_shelf = _check_shelf(shelf)
-        _validate_epoch(expected_epoch)
-        for ids in (archive_ids, delete_ids):
-            if not isinstance(ids, list) or any(
-                type(pid) is not int or not 1 <= pid <= 2**63 - 1 for pid in ids
-            ):
-                raise ValueError("prompt ids must be lists of positive integers")
-        reviewed_delete = set(delete_ids)
-        delete_paired = {} if delete_paired is None else delete_paired
-        if not isinstance(delete_paired, dict) or any(
-            type(pid) is not int
-            or not isinstance(digest, str)
-            or not _DIGEST.match(digest)
-            for pid, digest in delete_paired.items()
-        ):
-            raise ValueError("delete_paired must map prompt ids to review digests")
-        if not set(delete_paired) <= set(archive_ids):
-            raise ValueError("A permanent delete must be a reviewed archive id")
-        if not archive_ids and not delete_ids:
-            raise ValueError("Nothing to delete or archive")
-        if reviewed_delete & set(archive_ids):
-            raise ValueError("A prompt cannot be both archived and deleted")
-        prompt_ids = list(dict.fromkeys([*archive_ids, *delete_ids]))
-        with self._pair_transaction() as conn:
-            epoch = self._library_epoch(conn, expected_epoch)
-            classes = self._classify_library_delete(conn, prompt_ids, shelf)
-            now_prints = self._fingerprints(conn, classes["delete"])
-            deletes, archives, changed = [], [], 0
-            paired_now = set(classes["deletable"])
-            chosen = [pid for pid in classes["archive"] if pid in delete_paired]
-            digests = self._review_digests(
-                conn, [pid for pid in chosen if pid in paired_now]
-            )
-            paired_deletes = []
-            for pid in classes["archive"]:
-                if pid not in delete_paired:
-                    archives.append(pid)
-                elif digests.get(pid) == delete_paired[pid]:
-                    paired_deletes.append(pid)
-                else:
-                    archives.append(pid)  # changed since the review: restorable
-                    changed += 1
-            for pid in classes["delete"]:
-                if pid not in reviewed_delete:
-                    archives.append(pid)  # reviewed as archive, now unpaired
-                    changed += 1 if pid in delete_paired else 0
-                elif candidates is None or candidates.get(pid) == now_prints[pid]:
-                    deletes.append(pid)
-                else:
-                    changed += 1
-            changed += len(classes["protected"])
-            if on_archived_shelf:
-                # Already archived: the rest stay as they are, each one counted.
-                archives = []
-                changed = len(prompt_ids) - len(deletes) - len(paired_deletes)
-                changed -= len(classes["not_found"]) + len(classes["not_archived"])
-            image_links = self._image_links(conn, [*deletes, *paired_deletes])
-            now = utc_now_iso()
-            for pid in archives:
-                self._repair_hash(conn, pid)
-            conn.executemany(
-                f"INSERT INTO {ARCHIVE}(prompt_id, archived_at) VALUES (?, ?)",
-                [(pid, now) for pid in archives],
-            )
-            # A changed row is the newest edit the restore fingerprint reads.
-            conn.executemany(
-                "UPDATE prompts SET updated_at=? WHERE id=?",
-                [(now, pid) for pid in archives],
-            )
-            # #482: the image-pair links (RESTRICT) go first, then the pairs
-            # (pair tags CASCADE, review decisions SET NULL), then the prompts.
-            pairs_removed = 0
-            for chunk in _batches(paired_deletes):
-                marks = ",".join("?" for _ in chunk)
-                pairs_of = (
-                    "SELECT id FROM prompt_pairs "  # nosec B608
-                    f"WHERE positive_prompt_id IN ({marks})"
-                )
-                conn.execute(
-                    f"DELETE FROM image_prompt_pairs WHERE pair_id IN ({pairs_of})",
-                    chunk,
-                )
-                pairs_removed += conn.execute(
-                    "DELETE FROM prompt_pairs "  # nosec B608
-                    f"WHERE positive_prompt_id IN ({marks})",
-                    chunk,
-                ).rowcount
-            deleted = delete_prompt_rows(conn, [*deletes, *paired_deletes])
-            return {
-                "library_epoch": epoch,
-                "deleted": deleted,
-                "archived": len(archives),
-                "already_archived": len(classes["already_archived"]),
-                "not_archived": len(classes["not_archived"]),
-                "not_found": len(classes["not_found"]),
-                "changed": changed,
-                "image_links": image_links,
-                "pairs_removed": pairs_removed,
-            }
-
-    def restore_library_prompts(
-        self, prompt_ids: list[int], *, expected_epoch: str
-    ) -> dict:
-        """Put archived prompts back on the shelf, all or nothing.
-
-        Every requested id with an archive row is restored, whatever its
-        protection or Library parent state: restoring only un-hides it.
-        """
-        prompt_ids = self._checked_ids(prompt_ids, expected_epoch)
-        with self._pair_transaction() as conn:
-            epoch = self._library_epoch(conn, expected_epoch)
-            restored, existing = [], set()
-            for chunk in _batches(prompt_ids):
-                marks = ",".join("?" for _ in chunk)
-                for pid, archived in conn.execute(
-                    f"SELECT p.id,{_ARCHIVED} FROM prompts p "  # nosec B608
-                    f"WHERE p.id IN ({marks})",
-                    chunk,
-                ):
-                    existing.add(pid)
-                    if archived:
-                        restored.append(pid)
-            now = utc_now_iso()
-            conn.executemany(
-                f"DELETE FROM {ARCHIVE} WHERE prompt_id=?", [(pid,) for pid in restored]
-            )
-            conn.executemany(
-                "UPDATE prompts SET updated_at=? WHERE id=?",
-                [(now, pid) for pid in restored],
-            )
-            return {
-                "library_epoch": epoch,
-                "restored": len(restored),
-                "unchanged": len(existing) - len(restored),
-                "not_found": len(prompt_ids) - len(existing),
-            }
@@ -21,10 +21,6 @@ _UUID = re.compile(r"[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}")
 _TOKEN = re.compile(r"[0-9a-f]{64}")
 # Parent metadata stored on the prompt row; title lives in prompt_library_state.
 _PROMPT_COLUMNS = ("category", "rating", "notes")
-# Ids per IN (...) read: well under SQLite's oldest bound-parameter limit (999).
-_BULK_CHUNK = 500
-# The tags one prompt may carry: what the editor's save accepts (``validate_tags``).
-MAX_LIBRARY_TAGS = 20


 class LibraryCommandError(Exception):
@@ -89,13 +85,6 @@ def _validate_epoch(expected_epoch: str) -> None:
        raise ValueError("expected_epoch must be a canonical UUID")


-def _validate_bulk_ids(prompt_ids: list[int]) -> None:
-    if not isinstance(prompt_ids, list) or not prompt_ids:
-        raise ValueError("prompt_ids must be a non-empty list")
-    if any(type(pid) is not int or not 1 <= pid <= 2**63 - 1 for pid in prompt_ids):
-        raise ValueError("prompt_ids must be positive integers")
-
-
 def _validate_guards(positive_id: int, expected_epoch: str, if_match: str) -> None:
    if type(positive_id) is not int or not 1 <= positive_id <= 2**63 - 1:
        raise ValueError("Invalid positive prompt ID")
@@ -319,134 +308,3 @@ class LibraryCommandOperations:
                positive_created=False,
                pair_created=pair_created,
            )
-
-    def bulk_set_library_category(
-        self, prompt_ids: list[int], category: str, *, expected_epoch: str
-    ) -> dict:
-        """Set one category on many Library parents, all or nothing (#437).
-
-        Guarded by the storage epoch the page read. Only rows whose category
-        differs are written (their ``updated_at`` and edit token change) and
-        registered as Library parents, as the editor's PATCH does; ids
-        that are missing or are not Library parents count as not found.
-        """
-        _validate_epoch(expected_epoch)
-        _validate_bulk_ids(prompt_ids)
-        prompt_ids = list(dict.fromkeys(prompt_ids))
-        if not isinstance(category, str) or not category.strip():
-            raise ValueError("Category is required")
-        validate_category(category)
-        category = category.strip()
-        with self._pair_transaction() as conn:
-            epoch = self._library_epoch(conn, expected_epoch)
-            current = {}
-            for start in range(0, len(prompt_ids), _BULK_CHUNK):
-                chunk = prompt_ids[start : start + _BULK_CHUNK]
-                marks = ",".join("?" for _ in chunk)
-                current.update(
-                    conn.execute(
-                        f"SELECT p.id,p.category FROM prompts p "  # nosec B608
-                        f"WHERE p.id IN ({marks}) AND {_ELIGIBLE}",
-                        chunk,
-                    ).fetchall()
-                )
-            changed = [pid for pid, value in current.items() if value != category]
-            for pid in changed:
-                self._ensure_library_parent(conn, pid)
-            now = utc_now_iso()
-            conn.executemany(
-                "UPDATE prompts SET category=?,updated_at=? WHERE id=?",
-                [(category, now, pid) for pid in changed],
-            )
-            return {
-                "library_epoch": epoch,
-                "category": category,
-                "updated": len(changed),
-                "unchanged": len(current) - len(changed),
-                "not_found": len(prompt_ids) - len(current),
-            }
-
-    def bulk_add_library_tags(
-        self, prompt_ids: list[int], tags: list[str], *, expected_epoch: str
-    ) -> dict:
-        """Add tags to many Library parents, all or nothing (#442).
-
-        Names are normalized once (trim, the vocabulary name rules, casefold
-        repeats folded, at most 20). A parent is given only the names it lacks,
-        compared with ``casefold`` against its own tags; registry rows are
-        found and inserted by their exact name, and only for names some parent
-        gets. A parent whose tags would pass 20 is skipped (``over_limit``) so
-        the editor can still save it. Pair and image tags are not touched.
-        """
-        from .annotations import ImageTagLimitError, normalize_image_tags
-
-        _validate_epoch(expected_epoch)
-        _validate_bulk_ids(prompt_ids)
-        prompt_ids = list(dict.fromkeys(prompt_ids))
-        too_many = f"At most {MAX_LIBRARY_TAGS} tags can be added at once"
-        try:
-            tags = normalize_image_tags(tags)
-        except ImageTagLimitError:
-            # Its message names images; this is a prompt route.
-            raise ValueError(too_many) from None
-        if not tags:
-            raise ValueError("tags must name at least one tag")
-        if len(tags) > MAX_LIBRARY_TAGS:
-            raise ValueError(too_many)
-        with self._pair_transaction() as conn:
-            epoch = self._library_epoch(conn, expected_epoch)
-            held = self._library_parent_tags(conn, prompt_ids)
-            additions, over_limit = {}, 0
-            for pid, names in held.items():
-                present = {name.casefold() for name in names}
-                missing = [name for name in tags if name.casefold() not in present]
-                if not missing:
-                    continue
-                if len(names) + len(missing) > MAX_LIBRARY_TAGS:
-                    over_limit += 1
-                    continue
-                additions[pid] = missing
-            wanted = list(
-                dict.fromkeys(n for names in additions.values() for n in names)
-            )
-            tag_ids = self._ensure_tags(conn, wanted)
-            now = utc_now_iso()
-            for pid, names in additions.items():
-                conn.executemany(
-                    "INSERT OR IGNORE INTO prompt_tags (prompt_id, tag_id) "
-                    "VALUES (?, ?)",
-                    [(pid, tag_ids[name]) for name in names],
-                )
-                self._ensure_library_parent(conn, pid)
-                conn.execute("UPDATE prompts SET updated_at=? WHERE id=?", (now, pid))
-            return {
-                "library_epoch": epoch,
-                "tags": tags,
-                "updated": len(additions),
-                "unchanged": len(held) - len(additions) - over_limit,
-                "not_found": len(prompt_ids) - len(held),
-                "over_limit": over_limit,
-            }
-
-    def _library_parent_tags(
-        self, conn: sqlite3.Connection, prompt_ids: list[int]
-    ) -> dict[int, list[str]]:
-        """The Library parents among ``prompt_ids`` and their own tag names."""
-        held: dict[int, list[str]] = {}
-        for start in range(0, len(prompt_ids), _BULK_CHUNK):
-            chunk = prompt_ids[start : start + _BULK_CHUNK]
-            marks = ",".join("?" for _ in chunk)
-            for (pid,) in conn.execute(
-                f"SELECT p.id FROM prompts p WHERE p.id IN ({marks}) "  # nosec B608
-                f"AND {_ELIGIBLE}",
-                chunk,
-            ):
-                held[pid] = []
-            for pid, name in conn.execute(
-                "SELECT pt.prompt_id,t.name FROM prompt_tags pt "  # nosec B608
-                f"JOIN tags t ON t.id=pt.tag_id WHERE pt.prompt_id IN ({marks})",
-                chunk,
-            ):
-                if pid in held:
-                    held[pid].append(name)
-        return held
@@ -1,114 +0,0 @@
-"""Library output-folder filter (#444): folder names, root prefixes and listing.
-
-A folder is a ``/``-joined path relative to an output root, as Images' folder
-filter and the legacy ``/prompt_manager/subfolders`` name them. A parent
-matches a folder when one of its linked images (``generated_images.prompt_id``,
-the link its previews and image count read) lies in that folder or below it,
-under any spelling of any output root.
-
-Matching compares ``generated_images.file_path``, which is always
-``normcase(normpath(abspath(path)))`` (``models.normalize_image_path``), with
-prefixes built by the same normalization here, so case folding is the
-platform's own on both sides (Windows folds non-ASCII too, unlike SQLite's
-``lower()``) and the comparison is an exact ``substr`` with no wildcards.
-"""
-
-import os
-import sqlite3
-
-_MAX_FOLDER = 1024
-_MAX_PREFIXES = 64
-
-
-def normalize_folder(value: object, pathmod=os.path) -> str:
-    """The folder as ``a/b``, outer slashes dropped; empty means no filter.
-
-    ``/`` always separates. ``\\`` separates only on Windows (``ntpath``): on
-    POSIX it is an ordinary character of a folder's name, and the listing
-    (``relative_folder``) names such a folder with it, so both agree.
-    ``.``/``..``/empty segments, control characters and (on Windows) a drive
-    are refused: the value only ever names a folder below a root.
-    """
-    if not isinstance(value, str) or len(value) > _MAX_FOLDER:
-        raise ValueError(f"folder must be text of at most {_MAX_FOLDER} characters")
-    windows = pathmod.sep == "\\"
-    folder = (value.replace("\\", "/") if windows else value).strip("/")
-    if not folder:
-        return ""
-    parts = folder.split("/")
-    if (
-        any(part in ("", ".", "..") for part in parts)
-        or (windows and ":" in parts[0])
-        or any(ord(char) < 32 or ord(char) == 127 for char in folder)
-    ):
-        raise ValueError("folder must be a folder below an output root")
-    return folder
-
-
-def _base(root: object, pathmod) -> str:
-    return pathmod.normcase(pathmod.normpath(str(root)))
-
-
-def folder_prefixes(roots, folder: str, pathmod=os.path) -> list[str]:
-    """One ``file_path`` prefix per root spelling for a normalized folder."""
-    prefixes = []
-    for root in roots:
-        joined = pathmod.join(_base(root, pathmod), *folder.split("/"))
-        prefix = pathmod.normcase(pathmod.normpath(joined)) + pathmod.sep
-        if prefix not in prefixes:
-            prefixes.append(prefix)
-    if not prefixes or len(prefixes) > _MAX_PREFIXES:
-        raise ValueError("No output folder to filter by")
-    return prefixes
-
-
-def folder_condition(prefixes: list[str]) -> tuple[str, list]:
-    """A condition on alias ``p``: one linked image under any prefix."""
-    tests = " OR ".join("substr(fg.file_path,1,?)=?" for _ in prefixes)
-    params = [value for prefix in prefixes for value in (len(prefix), prefix)]
-    return (
-        "EXISTS(SELECT 1 FROM generated_images fg WHERE fg.prompt_id=p.id "
-        f"AND ({tests}))",
-        params,
-    )
-
-
-def relative_folder(image_path: str, roots, pathmod=os.path) -> str | None:
-    """The folder of *image_path* below the first root spelling holding it.
-
-    The spelling of the stored path is kept (its case on Windows); ``None``
-    for an image directly in a root or outside every root.
-    """
-    directory = pathmod.normpath(pathmod.dirname(image_path))
-    folded = pathmod.normcase(directory)
-    for root in roots:
-        base = _base(root, pathmod)
-        start = base if base.endswith(pathmod.sep) else base + pathmod.sep
-        if not folded.startswith(start):
-            continue
-        # normcase keeps the length for ordinary names; else show the folded form.
-        rest = (directory if len(directory) == len(folded) else folded)[len(start) :]
-        parts = rest.split(pathmod.sep)
-        if any(part in ("", ".", "..") for part in parts):
-            return None
-        return "/".join(parts)
-    return None
-
-
-def list_library_folders(
-    conn: sqlite3.Connection, roots, eligible: str, pathmod=os.path
-) -> list[str]:
-    """Every folder (and ancestor) holding an image of an eligible parent."""
-    folders = set()
-    for (image_path,) in conn.execute(
-        "SELECT DISTINCT g.image_path FROM generated_images g "
-        "JOIN prompts p ON p.id=g.prompt_id WHERE " + eligible
-    ):
-        if not isinstance(image_path, str) or not image_path:
-            continue
-        folder = relative_folder(image_path, roots, pathmod)
-        if folder is None:
-            continue
-        parts = folder.split("/")
-        folders.update("/".join(parts[:index]) for index in range(1, len(parts) + 1))
-    return sorted(folders, key=lambda value: (value.casefold(), value))
@@ -1,836 +0,0 @@
-"""Move library (#249 S6b): copy the node-folder library, verify it, switch.
-
-``plan_move`` checks a ``utils.library_location`` location can move and
-sizes the copy; ``move_library`` does it, in this order:
-
-1. **Disk check** on the target's volume (the copy, the backups and
-   config.json, plus a margin). The source is never renamed across folders,
-   so another drive is simply a copy.
-2. **Copy** with SQLite's backup API from a private connection holding one
-   read transaction: the per-table counts, the workflow documents' digest
-   and ``PRAGMA data_version`` describe exactly the copied snapshot. The copy
-   is a temp file in the target folder, made self-contained
-   (``journal_mode=DELETE``), fsynced and owner-only.
-3. **Verify**: ``verify_database_file`` (integrity check, schema, every
-   workflow document decompressed against its hash, #315), the same row
-   count in every table and the same documents.
-4. **Copy files**: every pooled safety backup and pre-migration backup,
-   checked by size and SHA-256 after the copy (their times are kept, so the
-   pool prunes in the same order).
-5. **Publish** under the old database's write lock (``BEGIN IMMEDIATE``) and
-   the config.json lock: if any other connection wrote since the snapshot
-   (``data_version``), steps 2–4 run again (``attempts``, then
-   ``library-busy``). Else config.json is copied (owner-only, checked), a
-   ``pending`` marker is written, the temp files take their final names
-   (``os.replace`` inside the target folder), the marker turns ``moved``
-   and ``switch`` points the process at the new library while the old file
-   is still locked, so no write can land in it.
-6. **Retire**: the old file's WAL is checkpointed and the old ``prompts.db``
-   and ``config.json`` are renamed ``*.moved-to-<folder>`` (never deleted;
-   the old backups stay where they are). A file still open elsewhere is left
-   in place and reported (``old-in-use``): the marker already makes a restart
-   use the new library.
-
-Any failure before the marker says ``moved`` removes everything the move
-wrote in the target folder and leaves the old library in use, untouched.
-A crash at any point leaves either the old library in use (the marker is
-absent or ``pending``; the next move replaces its own leftovers) or the new
-one (``moved``). ``MoveFailed`` carries a code and a message without paths.
-"""
-
-import contextlib
-import hashlib
-import json
-import os
-import shutil
-import sqlite3
-import time
-import types
-import uuid
-from pathlib import Path
-from dataclasses import dataclass, field
-from typing import Callable, Dict, List, Optional, Tuple
-
-from .models import BUSY_TIMEOUT_SECONDS, PromptModel
-
-try:
-    from ..utils import library_location as ll
-    from ..utils.logging_config import get_logger
-    from ..utils.workspace_keys import KEY_FILE_NAME
-except ImportError:
-    from utils import library_location as ll
-    from utils.logging_config import get_logger
-    from utils.workspace_keys import KEY_FILE_NAME
-
-logger = get_logger("prompt_manager.database.library_move")
-
-TEMP_PREFIX = ".pm-move-"
-MOVED_INFIX = ".moved-to-"
-DISK_MARGIN_BYTES = 16 * 2**20
-DEFAULT_ATTEMPTS = 3
-_COPY_CHUNK = 4 * 2**20
-# Backups that live beside the database and move with it.
-BACKUP_INFIXES = (".backup_", ".pre-workflow-storage_")
-
-MESSAGES = {
-    "not-movable": (
-        "This library is not in the node folder, so there is nothing to move."
-    ),
-    "same-folder": "The new folder is the node folder itself.",
-    "target-invalid": "The new folder cannot hold the library.",
-    "data-dir-served": (
-        "The new folder is inside Prompt Manager's thumbnail folder. Nothing was "
-        "moved."
-    ),
-    "target-has-library": (
-        "The new folder already holds a Prompt Manager library. Nothing was moved."
-    ),
-    "target-conflict": (
-        "The new folder already holds files with the same names. Nothing was moved."
-    ),
-    "insufficient-space": (
-        "There is not enough free space for the copy. Nothing was moved."
-    ),
-    "copy-failed": "The copy could not be written or did not match. Nothing was moved.",
-    "verify-failed": "The copy did not pass verification. Nothing was moved.",
-    "library-busy": (
-        "Prompt Manager kept writing to the library while it was copied. "
-        "Nothing was moved; try again when no workflow is running."
-    ),
-    "switch-failed": (
-        "Prompt Manager could not switch to the verified copy, so the copy was "
-        "removed. Nothing was moved."
-    ),
-}
-
-
-class MoveFailed(Exception):
-    """A move that did not happen (or did not finish), with a coded reason."""
-
-    def __init__(self, code: str, message: Optional[str] = None):
-        self.code = code
-        self.message = message or MESSAGES.get(code, "The library was not moved.")
-        super().__init__(self.message)
-
-
-@dataclass(frozen=True)
-class MovePlan:
-    location: "ll.LibraryLocation"
-    db_path: str
-    source_dir: str
-    target_dir: str
-    config_path: Optional[str]
-    backups: Tuple[str, ...]
-    db_bytes: int
-    files_bytes: int
-
-    @property
-    def required_bytes(self) -> int:
-        return self.db_bytes + self.files_bytes + DISK_MARGIN_BYTES
-
-    @property
-    def target_location(self) -> "ll.LibraryLocation":
-        """Where the library is once moved (an explicit config.json stays)."""
-        source = self.location.target_source or ll.SOURCE_DEFAULT
-        config = (
-            self.location.config_path
-            if self.location.config_explicit
-            else os.path.join(self.target_dir, ll.CONFIG_NAME)
-        )
-        return ll.LibraryLocation(
-            source,
-            os.path.join(self.target_dir, ll.DATABASE_NAME),
-            config,
-            self.target_dir,
-            self.target_dir,
-            None,
-            source,
-            self.location.config_explicit,
-        )
-
-
-@dataclass
-class MoveResult:
-    location: "ll.LibraryLocation"
-    counts: Dict[str, int]
-    files: List[str]
-    renamed: List[str] = field(default_factory=list)
-    retire_problem: Optional[str] = None
-
-
-def _size(path: str) -> int:
-    try:
-        return os.path.getsize(path)
-    except OSError:
-        return 0
-
-
-def _free_bytes(path: str) -> int:
-    return shutil.disk_usage(path).free
-
-
-def _existing_ancestor(path: str) -> str:
-    current = os.path.abspath(path)
-    while not os.path.isdir(current):
-        parent = os.path.dirname(current)
-        if parent == current:
-            break
-        current = parent
-    return current
-
-
-def backup_names(db_path: str) -> Tuple[str, ...]:
-    """The pooled and pre-migration backups beside ``db_path`` (names)."""
-    folder = os.path.dirname(os.path.abspath(db_path))
-    base = os.path.basename(db_path)
-    prefixes = tuple(base + infix for infix in BACKUP_INFIXES)
-    try:
-        names = os.listdir(folder)
-    except OSError:
-        return ()
-    return tuple(
-        sorted(
-            name
-            for name in names
-            if name.startswith(prefixes) and os.path.isfile(os.path.join(folder, name))
-        )
-    )
-
-
-def plan_move(location) -> MovePlan:
-    """Check ``location`` can move to its target; raises MoveFailed."""
-    if not location.movable:
-        raise MoveFailed("not-movable")
-    target = os.path.abspath(location.target_dir)
-    source_dir = os.path.dirname(os.path.abspath(location.db_path))
-    if ll.same_folder(target, source_dir) or os.path.normcase(
-        os.path.realpath(target)
-    ) == os.path.normcase(os.path.realpath(source_dir)):
-        raise MoveFailed("same-folder")
-    if os.path.exists(target) and not os.path.isdir(target):
-        raise MoveFailed("target-invalid")
-    backups = backup_names(location.db_path)
-    # config.json moves with a node-folder library; one named by
-    # PROMPT_MANAGER_CONFIG_PATH is the user's and stays where it is.
-    config = None if location.config_explicit else location.config_path
-    config = config if config and os.path.isfile(config) else None
-    if ll.read_marker(target).get("state") != ll.MARKER_PENDING:
-        if os.path.exists(os.path.join(target, ll.DATABASE_NAME)):
-            raise MoveFailed("target-has-library")
-        names = [ll.CONFIG_NAME] if config else []
-        if any(os.path.exists(os.path.join(target, n)) for n in names + list(backups)):
-            raise MoveFailed("target-conflict")
-    db_bytes = _size(location.db_path) + _size(location.db_path + "-wal")
-    files_bytes = sum(_size(os.path.join(source_dir, n)) for n in backups)
-    files_bytes += _size(config) if config else 0
-    return MovePlan(
-        location,
-        os.path.abspath(location.db_path),
-        source_dir,
-        target,
-        config,
-        backups,
-        db_bytes,
-        files_bytes,
-    )
-
-
-def space_problem(plan: MovePlan) -> Optional[Tuple[int, int]]:
-    """``(required, free)`` when the target's volume is short, else None."""
-    free = _free_bytes(_existing_ancestor(plan.target_dir))
-    if free < plan.required_bytes:
-        return plan.required_bytes, free
-    return None
-
-
-# ── copy and verify ───────────────────────────────────────────────────
-
-
-def _tables(conn) -> List[str]:
-    return [
-        row[0]
-        for row in conn.execute(
-            "SELECT name FROM sqlite_master WHERE type='table' "
-            "AND name NOT LIKE 'sqlite_%' ORDER BY name"
-        )
-    ]
-
-
-def _describe(conn) -> Tuple[Dict[str, int], str]:
-    """Row counts per table and a digest of the workflow documents."""
-    counts = {}
-    for table in _tables(conn):
-        # A name read from sqlite_master, quoted as an identifier.
-        quoted = '"' + table.replace('"', '""') + '"'
-        sql = f"SELECT COUNT(*) FROM {quoted}"  # nosec B608
-        counts[table] = conn.execute(sql).fetchone()[0]
-    digest = hashlib.sha256()
-    if "workflow_documents" in counts:
-        for row in conn.execute(
-            "SELECT id, sha256, byte_length FROM workflow_documents ORDER BY id"
-        ):
-            digest.update(repr((row[0], bytes(row[1]), row[2])).encode())
-    return counts, digest.hexdigest()
-
-
-def _fsync_file(path: str) -> None:
-    with open(path, "rb+") as handle:
-        os.fsync(handle.fileno())
-
-
-def _fsync_dir(path: str) -> None:
-    if os.name != "posix":
-        return
-    fd = os.open(path, os.O_RDONLY)
-    try:
-        os.fsync(fd)
-    finally:
-        os.close(fd)
-
-
-def _private(path: str) -> None:
-    if os.name == "posix":
-        os.chmod(path, 0o600)
-
-
-def _copy_snapshot(source: sqlite3.Connection, temp: str):
-    """Back up ``source``'s current snapshot to ``temp``; return what it holds."""
-    source.execute("BEGIN")
-    try:
-        version = source.execute("PRAGMA data_version").fetchone()[0]
-        counts, documents = _describe(source)
-        destination = sqlite3.connect(temp)
-        try:
-            source.backup(destination)
-        finally:
-            destination.close()
-    finally:
-        source.execute("COMMIT")
-    with contextlib.closing(sqlite3.connect(temp)) as conn:
-        conn.execute("PRAGMA journal_mode=DELETE").fetchone()
-    _fsync_file(temp)
-    _private(temp)
-    return version, counts, documents
-
-
-def _verify_copy(temp: str, counts, documents) -> None:
-    ok, reason = PromptModel.verify_database_file(temp)
-    if not ok:
-        logger.error(f"Library move: the copy did not verify: {reason}")
-        detail = reason if reason.startswith("Workflow document") else None
-        raise MoveFailed(
-            "verify-failed",
-            f"{MESSAGES['verify-failed']} {detail}" if detail else None,
-        )
-    uri = Path(os.path.abspath(temp)).as_uri() + "?mode=ro"
-    try:
-        with contextlib.closing(sqlite3.connect(uri, uri=True)) as conn:
-            copied = _describe(conn)
-    except sqlite3.Error as error:
-        logger.error(f"Library move: the copy could not be read: {error}")
-        raise MoveFailed("verify-failed") from error
-    if copied != (counts, documents):
-        logger.error("Library move: the copy's rows or documents differ")
-        raise MoveFailed("verify-failed")
-
-
-def _hash_copy(source: str, destination: str) -> Tuple[int, str]:
-    """Copy ``source`` to ``destination`` (fsynced, owner-only, times kept)."""
-    digest = hashlib.sha256()
-    size = 0
-    with open(source, "rb") as reader, open(destination, "wb") as writer:
-        while True:
-            chunk = reader.read(_COPY_CHUNK)
-            if not chunk:
-                break
-            digest.update(chunk)
-            size += len(chunk)
-            writer.write(chunk)
-        writer.flush()
-        os.fsync(writer.fileno())
-    stat = os.stat(source)
-    os.utime(destination, ns=(stat.st_atime_ns, stat.st_mtime_ns))
-    _private(destination)
-    return size, digest.hexdigest()
-
-
-def _file_digest(path: str) -> Tuple[int, str]:
-    digest = hashlib.sha256()
-    size = 0
-    with open(path, "rb") as reader:
-        while True:
-            chunk = reader.read(_COPY_CHUNK)
-            if not chunk:
-                return size, digest.hexdigest()
-            digest.update(chunk)
-            size += len(chunk)
-
-
-def _check_copies(copies) -> None:
-    for source, temp, expected in copies:
-        if _file_digest(temp) != expected or _file_digest(source) != expected:
-            logger.error(
-                f"Library move: {os.path.basename(source)} did not copy unchanged"
-            )
-            raise MoveFailed("copy-failed")
-
-
-def write_marker(
-    directory: str, state: str, source_db: str, source_config: Optional[str] = None
-) -> str:
-    """Atomically write the move marker; return its path.
-
-    ``from`` and ``config_from`` name the old files, so a restart after a
-    crash between the switch and the rename can finish the rename.
-    """
-    path = os.path.join(directory, ll.MARKER_NAME)
-    temp = os.path.join(directory, f"{TEMP_PREFIX}{uuid.uuid4().hex}.marker")
-    payload = json.dumps(
-        {
-            "version": 1,
-            "state": state,
-            "from": source_db,
-            "config_from": source_config,
-            "updated_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
-        },
-        indent=2,
-    ).encode("utf-8")
-    fd = os.open(temp, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
-    try:
-        with os.fdopen(fd, "wb") as handle:
-            handle.write(payload)
-            handle.flush()
-            os.fsync(handle.fileno())
-        _private(temp)
-        os.replace(temp, path)
-    except BaseException:
-        _remove(temp)
-        raise
-    _fsync_dir(directory)
-    return path
-
-
-def _remove(*paths) -> None:
-    for path in paths:
-        try:
-            if path and os.path.lexists(path):
-                os.remove(path)
-        except OSError:
-            logger.warning(f"Library move: could not remove {os.path.basename(path)}")
-
-
-def sweep_move_temps(directory: str) -> List[str]:
-    """Remove the temp files an interrupted move left in ``directory``."""
-    removed = []
-    try:
-        names = os.listdir(directory)
-    except OSError:
-        return removed
-    for name in names:
-        if name.startswith(TEMP_PREFIX):
-            _remove(os.path.join(directory, name))
-            removed.append(name)
-    return removed
-
-
-# ── the move ─────────────────────────────────────────────────────────
-
-
-def _noop(*_args, **_kwargs):
-    return None
-
-
-def switch_process(old_db: str, location, detached: list) -> None:
-    """Point this process at ``location``: resolver, every model, observers.
-
-    Adds the old file's connections, detached and still open, to
-    ``detached`` as soon as they are detached, so the mover retires them
-    (``PromptModel.retire_detached``) whether or not the rest succeeds.
-    """
-    from .execution_history import rekey_history_restore
-    from .review_changes import rekey_review_changes
-
-    ll.switch_to(location)
-    detached.extend(PromptModel.repoint_instances(old_db, location.db_path))
-    rekey_review_changes(old_db, location.db_path)
-    rekey_history_restore(old_db, location.db_path)
-
-
-def unswitch_process(old_db: str, new_db: str) -> list:
-    """Undo ``switch_process`` (any part of it); returns detached connections."""
-    from .execution_history import rekey_history_restore
-    from .review_changes import rekey_review_changes
-
-    ll.clear_override()
-    detached = PromptModel.repoint_instances(new_db, old_db)
-    rekey_review_changes(new_db, old_db)
-    rekey_history_restore(new_db, old_db)
-    return detached
-
-
-class _Move:
-    def __init__(self, plan, *, switch, config_lock, progress, checkpoint):
-        self.plan = plan
-        self.switch = switch
-        self.config_lock = config_lock
-        self.progress = progress
-        self.checkpoint = checkpoint
-        self.created_dir = False
-        self.temps: List[str] = []
-        self.published: List[str] = []
-        self.marker: Optional[str] = None
-        self.moved = False
-        # Retired connections still in use; awaited once the locks are free.
-        self.retiring: list = []
-
-    def temp(self, suffix: str) -> str:
-        path = os.path.join(
-            self.plan.target_dir, f"{TEMP_PREFIX}{uuid.uuid4().hex}{suffix}"
-        )
-        self.temps.append(path)
-        return path
-
-    def prepare_target(self) -> None:
-        target = self.plan.target_dir
-        self.created_dir = not os.path.isdir(target)
-        ll.ensure_private_dir(target)
-        sweep_move_temps(target)
-        if ll.read_marker(target).get("state") == ll.MARKER_PENDING:
-            # An earlier move stopped before it switched: its files are ours.
-            names = (ll.DATABASE_NAME, ll.CONFIG_NAME, KEY_FILE_NAME)
-            for name in names + self.plan.backups:
-                _remove(os.path.join(target, name))
-            for suffix in ("-wal", "-shm", "-journal"):
-                _remove(os.path.join(target, ll.DATABASE_NAME + suffix))
-
-    def copy_round(self, source):
-        """Steps 2–4 once: the verified temp copies and the snapshot version."""
-        self.progress("Copying the database")
-        temp_db = self.temp(".db")
-        version, counts, documents = _copy_snapshot(source, temp_db)
-        self.checkpoint("copied")
-        self.progress("Verifying the copy")
-        _verify_copy(temp_db, counts, documents)
-        self.checkpoint("verified")
-        copies = []
-        for name in self.plan.backups:
-            src = os.path.join(self.plan.source_dir, name)
-            temp = self.temp(".bak")
-            try:
-                expected = _hash_copy(src, temp)
-            except OSError as error:
-                logger.error(f"Library move: copying {name} failed: {error}")
-                raise MoveFailed("copy-failed") from error
-            copies.append((src, temp, expected, name))
-        if copies:
-            self.progress(f"Copied {len(copies)} backup file(s)")
-        self.checkpoint("files")
-        _check_copies([(s, t, e) for s, t, e, _ in copies])
-        return version, counts, temp_db, copies
-
-    def discard_round(self, temp_db, copies) -> None:
-        _remove(temp_db, *[temp for _s, temp, _e, _n in copies])
-
-    def publish(self, temp_db, copies) -> List[str]:
-        """Under the locks: config.json, marker, final names, marker moved."""
-        target = self.plan.target_dir
-        files = []
-        if self.plan.config_path:
-            temp = self.temp(".config")
-            try:
-                expected = _hash_copy(self.plan.config_path, temp)
-            except OSError as error:
-                raise MoveFailed("copy-failed") from error
-            _check_copies([(self.plan.config_path, temp, expected)])
-            copies = copies + [(self.plan.config_path, temp, expected, ll.CONFIG_NAME)]
-        copies = copies + self._key_copy()
-        self.marker = write_marker(
-            target, ll.MARKER_PENDING, self.plan.db_path, self.plan.config_path
-        )
-        self.checkpoint("pending")
-        for _src, temp, _expected, name in copies:
-            final = os.path.join(target, name)
-            os.replace(temp, final)
-            self.published.append(final)
-            files.append(name)
-        final_db = os.path.join(target, ll.DATABASE_NAME)
-        os.replace(temp_db, final_db)
-        self.published.append(final_db)
-        files.append(ll.DATABASE_NAME)
-        _fsync_dir(target)
-        self.checkpoint("published")
-        write_marker(target, ll.MARKER_MOVED, self.plan.db_path, self.plan.config_path)
-        self.moved = True
-        self.checkpoint("marked")
-        return files
-
-    def _key_copy(self) -> list:
-        """The workspace key's verified copy (#430), or none: it is re-creatable.
-
-        Without it the moved library starts with a new key, so pages left open
-        across the restart refresh once; that never fails the move.
-        """
-        source = os.path.join(self.plan.source_dir, KEY_FILE_NAME)
-        if not os.path.isfile(source):
-            return []
-        temp = self.temp(".key")
-        try:
-            expected = _hash_copy(source, temp)
-            _check_copies([(source, temp, expected)])
-        except (OSError, MoveFailed) as error:
-            _remove(temp)
-            logger.warning(
-                f"Library move: the workspace key was not copied ({error}); "
-                "open workspace pages refresh once after the restart"
-            )
-            return []
-        return [(source, temp, expected, KEY_FILE_NAME)]
-
-    def cleanup(self) -> None:
-        if self.moved:
-            return
-        _remove(*self.temps, *self.published, self.marker)
-        if self.created_dir:
-            try:
-                os.rmdir(self.plan.target_dir)
-            except OSError:
-                # not empty or already gone: the undo leaves it alone
-                pass
-
-
-def _unique(path: str) -> str:
-    candidate, number = path, 1
-    while os.path.lexists(candidate):
-        candidate = f"{path}_{number}"
-        number += 1
-    return candidate
-
-
-def retire_old_files(plan: MovePlan) -> Tuple[List[str], Optional[str]]:
-    """Rename the old database and config.json; ``(renamed, problem code)``.
-
-    Every connection to the old file must be closed. The WAL is checkpointed
-    first; when it cannot be emptied (another process still has the file
-    open) nothing is renamed (``old-in-use``).
-    """
-    old = plan.db_path
-    folder = os.path.basename(os.path.normpath(plan.target_dir))
-    try:
-        with contextlib.closing(sqlite3.connect(old, timeout=1)) as conn:
-            busy = conn.execute("PRAGMA wal_checkpoint(TRUNCATE)").fetchone()[0]
-    except sqlite3.Error as error:
-        logger.warning(
-            f"Library move: the old database could not be checkpointed: {error}"
-        )
-        return [], "old-in-use"
-    if busy or _size(old + "-wal") > 0:
-        return [], "old-in-use"
-    renamed = []
-    try:
-        for path in (old, plan.config_path):
-            if not path or not os.path.isfile(path):
-                continue
-            new_name = _unique(path + MOVED_INFIX + folder)
-            os.rename(path, new_name)
-            renamed.append(os.path.basename(new_name))
-        for suffix in ("-wal", "-shm"):
-            if os.path.isfile(old + suffix) and _size(old + suffix) == 0:
-                os.remove(old + suffix)
-    except OSError as error:
-        logger.warning(f"Library move: the old files could not be renamed: {error}")
-        return renamed, "old-locked"
-    return renamed, None
-
-
-def finish_interrupted_move(location) -> List[str]:
-    """Rename old files a crash left between the switch and the rename.
-
-    The marker of the folder in use says ``moved`` and names the old files;
-    an old ``prompts.db`` (and config.json) still there under its own name is
-    renamed ``*.moved-to-<folder>`` now, never deleted. Returns the new
-    names (nothing when there is nothing to finish or the file is in use).
-    """
-    if location.source not in (ll.SOURCE_DEFAULT, ll.SOURCE_ENVIRONMENT):
-        return []
-    marker = ll.read_marker(location.data_dir)
-    old = marker.get("from")
-    if marker.get("state") != ll.MARKER_MOVED or not isinstance(old, str):
-        return []
-    if not os.path.isfile(old) or os.path.basename(old) != ll.DATABASE_NAME:
-        return []
-    if ll.same_folder(os.path.dirname(old), location.data_dir):
-        return []
-    config = marker.get("config_from")
-    if not (
-        isinstance(config, str)
-        and os.path.basename(config) == ll.CONFIG_NAME
-        and os.path.isfile(config)
-        and os.path.normcase(os.path.abspath(config))
-        != os.path.normcase(os.path.abspath(location.config_path))
-    ):
-        config = None
-    pending = types.SimpleNamespace(
-        db_path=old, config_path=config, target_dir=location.data_dir
-    )
-    renamed, problem = retire_old_files(pending)
-    if problem:
-        logger.warning(f"Library move: the old files are still in use ({problem})")
-    elif renamed:
-        logger.info(f"Library move finished: renamed {', '.join(renamed)}")
-    return renamed
-
-
-def move_library(
-    plan: MovePlan,
-    *,
-    switch: Callable = switch_process,
-    unswitch: Callable = unswitch_process,
-    after_switch: Callable = _noop,
-    config_lock=None,
-    progress: Callable[[str], None] = _noop,
-    checkpoint: Callable[[str], None] = _noop,
-    attempts: int = DEFAULT_ATTEMPTS,
-) -> MoveResult:
-    """Move the library as planned (blocking; see the module docstring).
-
-    ``switch(old_db, location, detached)`` points the process at the copy
-    and adds the old connections it detached to ``detached``; if it raises,
-    ``unswitch(old_db, new_db)`` undoes it while both files are still
-    locked, every detached connection is closed, the copy is removed and
-    the move fails (``switch-failed``). ``after_switch()`` runs
-    once the switch is final; it is best effort (logged, never fails the move).
-    """
-    short = space_problem(plan)
-    if short is not None:
-        raise MoveFailed("insufficient-space")
-    lock = config_lock if config_lock is not None else contextlib.nullcontext()
-    move = _Move(
-        plan,
-        switch=switch,
-        config_lock=lock,
-        progress=progress,
-        checkpoint=checkpoint,
-    )
-    move.unswitch = unswitch
-    location = plan.target_location
-    try:
-        move.prepare_target()
-        files, counts = _copy_and_switch(move, location, attempts)
-    except Exception:
-        move.cleanup()
-        raise
-    try:
-        after_switch()
-    except Exception:
-        logger.exception("Library move: a follow-up after the switch failed")
-    from .execution_history import notify_history_restore
-
-    notify_history_restore(location.db_path)
-    progress("Renaming the old files")
-    renamed, problem = retire_old_files(plan)
-    checkpoint("retired")
-    return MoveResult(location, counts, files, renamed, problem)
-
-
-def _switch_guarded(move: _Move, location) -> list:
-    """Switch while the copy is locked too; undo it all if any part fails.
-
-    The copy's write lock keeps every repointed thread from writing to it
-    until the switch is whole, so undoing a partial switch loses nothing.
-    Returns the old file's detached connections (still open). On failure
-    every detached connection is retired; those still in use are added to
-    ``move.retiring`` for the caller to await once the locks are released.
-    """
-    plan = move.plan
-    guard = sqlite3.connect(
-        location.db_path, timeout=BUSY_TIMEOUT_SECONDS, isolation_level=None
-    )
-    try:
-        guard.execute("BEGIN IMMEDIATE")
-        detached: list = []
-        try:
-            move.switch(plan.db_path, location, detached)
-        except Exception as error:
-            logger.exception("Library move: switching failed; undoing it")
-            move.moved = False  # the copy and its marker are removed
-            # Retire, never wait, here: a connection still in use may be
-            # waiting on the very locks this thread holds.
-            try:
-                undone = move.unswitch(plan.db_path, location.db_path)
-            except Exception:
-                logger.exception("Library move: undoing the switch failed")
-            else:
-                _retire(move, undone)
-            # The old file's connections a partial switch detached: the
-            # models reopen it on next use, so close them now, not at GC.
-            _retire(move, detached)
-            raise MoveFailed("switch-failed") from error
-        move.checkpoint("switched")
-        return detached
-    finally:
-        if guard.in_transaction:
-            guard.execute("ROLLBACK")
-        guard.close()
-
-
-def _copy_and_switch(move: _Move, location, attempts: int):
-    """Copy, then switch under both locks; retired connections are awaited.
-
-    A connection that was inside a statement when it was retired is closed
-    by its own thread once the statement ends, which may need the locks
-    released first; the old files are renamed (and a failed copy removed)
-    only after that, since Windows refuses to rename or delete an open file.
-    """
-    try:
-        return _copy_and_switch_locked(move, location, attempts)
-    finally:
-        try:
-            PromptModel.await_detached(move.retiring, logger)
-        except Exception:
-            logger.exception("Library move: waiting for old connections failed")
-
-
-def _retire(move: _Move, connections: list) -> None:
-    """Retire ``connections``, adding those still in use to ``move.retiring``.
-
-    Never raises: a switch that completed must not be reported as failed
-    because one of the old connections could not be retired (logged; the
-    rename then reports the old files as still in use).
-    """
-    try:
-        move.retiring.extend(PromptModel.retire_detached(connections, logger))
-    except Exception:
-        logger.exception("Library move: retiring the old connections failed")
-
-
-def _copy_and_switch_locked(move: _Move, location, attempts: int):
-    plan = move.plan
-    for attempt in range(1, attempts + 1):
-        source = sqlite3.connect(
-            plan.db_path, timeout=BUSY_TIMEOUT_SECONDS, isolation_level=None
-        )
-        try:
-            source.execute(f"PRAGMA busy_timeout = {BUSY_TIMEOUT_SECONDS * 1000}")
-            version, counts, temp_db, copies = move.copy_round(source)
-            source.execute("BEGIN IMMEDIATE")
-            try:
-                if source.execute("PRAGMA data_version").fetchone()[0] != version:
-                    move.progress("The library changed during the copy; copying again")
-                    move.discard_round(temp_db, copies)
-                    continue
-                move.checkpoint("locked")
-                with move.config_lock:
-                    files = move.publish(temp_db, copies)
-                    detached = _switch_guarded(move, location)
-                # Still holding the old file's lock: a write that was waiting
-                # on it is interrupted and cannot commit, so it fails (and
-                # runs again on the new library) instead of landing in the
-                # old file. Its own thread closes the connection.
-                _retire(move, detached)
-            finally:
-                if source.in_transaction:
-                    source.execute("ROLLBACK")
-            return files, counts
-        finally:
-            source.close()
-    raise MoveFailed("library-busy")
@@ -1,948 +0,0 @@
-"""Reviewed maintenance plans: read-only previews and their exact apply (#249 S6).
-
-Four operations, each the native owner of a legacy ``/maintenance`` one and
-built on the same queries, so a preview counts what the legacy cleanup would
-change (``workflow_storage`` and #550's ``pair_metadata``, which fills old
-Pair prompts' empty category and tags, live in their own modules):
-
- ``duplicate_prompts``: prompts whose text is equal ignoring case and outer
-  spaces (``DUPLICATE_PROMPTS_SQL``, legacy ``cleanup_duplicates``); each
-  group keeps its oldest prompt, which takes over the others' images and
-  metadata. A group with a member in a saved pair is kept whole.
- ``optimize``: VACUUM (legacy ``vacuum``).
- ``unused_components``: prompts nothing references (``ORPHANED_PROMPTS_SQL``,
-  legacy ``prune_orphaned_prompts``, with the #239 protections).
- ``missing_links``: image rows whose file is gone (legacy
-  ``cleanup_orphaned_images``), counted only under a source that can be read
-  now, as the health check's ``missing_files`` judges them
-  (``health.link_states``). It deletes database rows only, never a file.
-  It also forgets the removal marks (#480) that hide nothing any more: the
-  file is gone or changed, under a readable source (#501, ``_stale_marks``).
-
-``preview_maintenance`` reads one snapshot on its own ``mode=ro`` connection
-(``health.readonly_uri``) and closes it in ``finally``; files are looked at
-after the snapshot ended. It returns a ``MaintenanceDraft``: the public plan
-fields, the targets an apply needs and the fingerprint of exactly what was
-reviewed (ids, text hashes, metadata, tags, Library state and pair refs of
-every prompt involved, or each link's row and source). The fingerprint never
-leaves the server.
-
-``apply_maintenance`` recomputes that fingerprint on the write connection
-inside ``BEGIN IMMEDIATE`` and raises ``PlanChanged`` before writing anything
-when it differs; otherwise it applies the reviewed targets in batches of
-``ID_BATCH`` in that one transaction. VACUUM cannot run in a transaction, so
-``optimize`` binds to its database only (the caller checks that).
-"""
-
-import hashlib
-import json
-import os
-import shutil
-import sqlite3
-from dataclasses import dataclass, field
-from pathlib import Path
-
-from .execution_contexts import LIVE_HINT_CTES
-from .health import BATCH_ROWS, held_links, link_states, readable_roots, readonly_uri
-from .image_removal_schema import TABLE as MARKS_TABLE
-from .image_removal_schema import clear_marks, has_marks_table
-from .pairs import PairDependencyError
-from .workflow_documents import documents_of_rows, release_documents
-
-try:
-    from ..utils.hashing import register_prompt_functions
-except ImportError:
-    from utils.hashing import register_prompt_functions
-
-MAINTENANCE_OPERATIONS = (
-    "duplicate_prompts",
-    "optimize",
-    "unused_components",
-    "missing_links",
-    # Applied as its own batched job (database/workflow_storage.py).
-    "workflow_storage",
-    # #550: fill old Pair prompts' empty category and tags
-    # (database/pair_metadata_repair.py).
-    "pair_metadata",
-)
-MAX_DETAILS = 50  # detail rows a plan lists
-MAX_RESULT_ROWS = 200  # changed records an apply describes (the job lists 200)
-EXCERPT_CHARS = 80
-# Ids bound per statement: the pair-reference read binds each id twice, which
-# stays under SQLite's historical 999-variable limit.
-ID_BATCH = 400
-
-# Why a prompt no image links to is kept (#239): predicates on ``p``, in the
-# order the plan names them. ORPHANED_PROMPTS_SQL is built from them, so the
-# reasons a plan lists are exactly the rules the prune applies.
-PROTECTIONS = (
-    (
-        "EXISTS (SELECT 1 FROM prompt_pairs pp "
-        "WHERE pp.positive_prompt_id = p.id OR pp.negative_prompt_id = p.id)",
-        "in saved pairs",
-        "in a saved pair",
-    ),
-    (
-        "EXISTS (SELECT 1 FROM prompt_tags pt JOIN tags t ON pt.tag_id = t.id "
-        "WHERE pt.prompt_id = p.id AND t.name = '__protected__')",
-        "tagged __protected__",
-        "tagged __protected__",
-    ),
-    (
-        "EXISTS (SELECT 1 FROM prompt_library_state ls WHERE ls.prompt_id = p.id)",
-        "with Library state (a title or an explicit parent)",
-        "with Library state (a title or an explicit parent)",
-    ),
-    (
-        # #443: an archived prompt is restorable, never pruned.
-        "EXISTS (SELECT 1 FROM prompt_archive pa WHERE pa.prompt_id = p.id)",
-        "archived in the Library",
-        "archived in the Library",
-    ),
-    (
-        "p.id IN (SELECT prompt_id FROM live_hint_prompts)",
-        "used by recorded runs",
-        "used by a recorded run",
-    ),
-)
-
-# Exempt references: images, pairs, the __protected__ tag, Library parent
-# state, the Library archive, and live recorded-run hints (computed once,
-# see LIVE_HINT_CTES).
-ORPHANED_PROMPTS_SQL = (
-    "WITH "
-    + LIVE_HINT_CTES
-    + " SELECT p.id FROM prompts p"
-    + " LEFT JOIN generated_images gi ON p.id = gi.prompt_id"
-    + " WHERE gi.prompt_id IS NULL"
-    + "".join(f" AND NOT ({predicate})" for predicate, _many, _one in PROTECTIONS)
-)
-# The prompts no image links to, with which protections keep each one.
-_UNLINKED_PROTECTIONS_SQL = (
-    "WITH "
-    + LIVE_HINT_CTES
-    + " SELECT "
-    + ", ".join(
-        f"COALESCE(SUM({predicate}), 0)" for predicate, _many, _one in PROTECTIONS
-    )
-    + ", COALESCE(SUM("
-    + " OR ".join(f"({predicate})" for predicate, _many, _one in PROTECTIONS)
-    + "), 0) FROM prompts p WHERE NOT EXISTS "
-    "(SELECT 1 FROM generated_images gi WHERE gi.prompt_id = p.id)"
-)
-# Each prompt no image links to, with which protections keep it (#586); the
-# ones with none are filtered out in Python, so each predicate runs once.
-_UNLINKED_KEPT_SQL = (
-    "WITH "
-    + LIVE_HINT_CTES
-    + " SELECT p.id, "
-    + ", ".join(f"({predicate})" for predicate, _many, _one in PROTECTIONS)
-    + " FROM prompts p WHERE NOT EXISTS "
-    "(SELECT 1 FROM generated_images gi WHERE gi.prompt_id = p.id) ORDER BY p.id"
-)
-
-# Duplicate prompt groups, as the legacy cleanup finds them (case-insensitive
-# text; GROUP_CONCAT order is sorted by created_at afterwards).
-DUPLICATE_PROMPTS_SQL = """
-    SELECT LOWER(TRIM(text)) as normalized_text, COUNT(*) as count,
-           GROUP_CONCAT(id) as ids,
-           GROUP_CONCAT(created_at) as created_dates
-    FROM prompts
-    GROUP BY LOWER(TRIM(text))
-    HAVING COUNT(*) > 1
-"""
-
-_LINK_ROWS_SQL = (
-    "SELECT id, image_path, filename, file_path FROM generated_images ORDER BY id"
-)
-
-# What a prompt's fingerprint covers, per batch of ids.
-_PROMPT_STATE_SQL = (
-    "SELECT id, hash, text, category, rating, notes, created_at, updated_at "
-    "FROM prompts WHERE id IN ({marks}) ORDER BY id",
-    "SELECT prompt_id, tag_id FROM prompt_tags WHERE prompt_id IN ({marks}) "
-    "ORDER BY prompt_id, tag_id",
-    "SELECT * FROM prompt_library_state WHERE prompt_id IN ({marks}) "
-    "ORDER BY prompt_id",
-    "SELECT id, positive_prompt_id, negative_prompt_id FROM prompt_pairs "
-    "WHERE positive_prompt_id IN ({marks}) OR negative_prompt_id IN ({marks}) "
-    "ORDER BY id",
-)
-
-# Why the missing-link cleanup holds a link back: (one, many) (#586).
-HELD_LINK_REASONS = {
-    "unavailable": (
-        "link under an unavailable source",
-        "links under unavailable sources",
-    ),
-    "outside": ("link outside the image sources", "links outside the image sources"),
-}
-NO_FILES_DELETED = "No image file is deleted."
-LINKS_ONLY = "Database links only; no image file is deleted."
-UNUSED_DETAIL = "No image, saved pair, Library state or recorded run uses it"
-
-
-# Why a duplicate group is kept whole (``_duplicate_conflict``).
-CONFLICT_REASONS = {
-    "collision": ("group links one image twice", "groups link one image twice"),
-    "title": (
-        "group has its own Library title",
-        "groups have their own Library titles",
-    ),
-}
-PAIRED_DETAIL = "Kept: belongs to a saved pair"
-CONFLICT_DETAILS = {
-    "collision": "Kept: two copies link the same image",
-    "title": "Kept: a copy has its own Library title",
-}
-OPTIMIZE_LOCK_NOTE = (
-    "Runs alone: the database is locked while it runs, and on a large library "
-    "this takes a while. Prompt runs counted and images captured meanwhile "
-    "wait up to 30 seconds each; anything that waits longer is not recorded."
-)
-
-
-class PlanChanged(Exception):
-    """What a plan was reviewed on changed before it was applied."""
-
-
-class MergeConflict(Exception):
-    """A strict duplicate merge would drop an image link or a Library title."""
-
-
-@dataclass
-class MaintenanceDraft:
-    """A preview: the public plan fields plus what only the server keeps."""
-
-    operation: str
-    fingerprint: str
-    targets: list
-    scope: dict
-    protected: dict
-    media: dict
-    details: list = field(default_factory=list)
-    # missing_links only: locators of removal marks whose file is gone (#501).
-    marks: list = field(default_factory=list)
-
-    def public(self):
-        """The plan fields a response may carry (no fingerprint, no targets)."""
-        return {
-            "operation": self.operation,
-            "scope": dict(self.scope),
-            "protected": {
-                "count": self.protected["count"],
-                "reasons": list(self.protected["reasons"]),
-            },
-            "media": dict(self.media),
-            "details": [dict(row) for row in self.details],
-        }
-
-
-def _plural(count, one, many=None):
-    return f"{count:,} {one if count == 1 else (many or one + 's')}"
-
-
-def _excerpt(text):
-    text = " ".join(str(text or "").split())
-    if len(text) <= EXCERPT_CHARS:
-        return text
-    return text[: EXCERPT_CHARS - 1].rstrip() + "…"
-
-
-def _megabytes(size):
-    return f"{size / 2**20:,.1f} MB"
-
-
-class _Fingerprint:
-    """A streaming sha256 over JSON-encoded parts."""
-
-    def __init__(self, operation):
-        self._hash = hashlib.sha256()
-        self.add(operation)
-
-    def add(self, part):
-        encoded = json.dumps(part, separators=(",", ":"), default=str)
-        self._hash.update(encoded.encode("utf-8") + b"\n")
-
-    def hexdigest(self):
-        return "sha256:" + self._hash.hexdigest()
-
-
-def _batches(ids):
-    ids = list(ids)
-    for start in range(0, len(ids), ID_BATCH):
-        yield ids[start : start + ID_BATCH]
-
-
-def _marks(batch):
-    return ",".join("?" for _ in batch)
-
-
-def _add_prompt_state(fingerprint, conn, ids):
-    """Fold every reviewed fact about the prompts ``ids`` into ``fingerprint``."""
-    for batch in _batches(sorted(ids)):
-        marks = _marks(batch)
-        for sql in _PROMPT_STATE_SQL:
-            params = batch * sql.count("{marks}")
-            for row in conn.execute(sql.format(marks=marks), params):
-                fingerprint.add(list(row))
-
-
-def _texts(conn, ids, limit=MAX_DETAILS):
-    """``{id: text}`` of the first ``limit`` prompts, for detail rows."""
-    ids = list(ids)[:limit]
-    if not ids:
-        return {}
-    rows = conn.execute(
-        f"SELECT id, text FROM prompts WHERE id IN ({_marks(ids)})", ids
-    )
-    return {row[0]: row[1] for row in rows}
-
-
-def _orphaned_ids(conn):
-    return sorted(row[0] for row in conn.execute(ORPHANED_PROMPTS_SQL))
-
-
-def _delete_ids(conn, table, ids):
-    """Delete ``table`` rows by id in batches; returns the rows removed.
-
-    The workflow documents only those rows referenced go with them (a
-    prompt's images go by cascade), in the same transaction.
-    """
-    if table not in ("prompts", "generated_images"):
-        raise ValueError(f"Unsupported table {table!r}")
-    removed = 0
-    for batch in _batches(ids):
-        documents = documents_of_rows(
-            conn, "id" if table == "generated_images" else "prompt_id", batch
-        )
-        cursor = conn.execute(
-            f"DELETE FROM {table} WHERE id IN ({_marks(batch)})",  # nosec B608
-            batch,
-        )
-        removed += cursor.rowcount
-        release_documents(conn, documents)
-    return removed
-
-
-def _mark_rows(conn, only=None):
-    """``[(locator, size, mtime_ns)]`` of the removal marks (all, or those
-    among *only*), sorted by locator."""
-    if not has_marks_table(conn):
-        return []
-    sql = f"SELECT locator, size, mtime_ns FROM {MARKS_TABLE}"  # nosec B608
-    if only is None:
-        return sorted(tuple(row) for row in conn.execute(sql))
-    found = []
-    for batch in _batches(sorted(only)):
-        found.extend(
-            tuple(row)
-            for row in conn.execute(
-                f"{sql} WHERE locator IN ({_marks(batch)})", batch  # nosec B608
-            )
-        )
-    return sorted(found)
-
-
-def _lists_something(folder):
-    """Whether *folder* holds at least one entry (an unplugged drive's mount
-    point, or an unbound volume, is an empty folder that reads fine)."""
-    try:
-        with os.scandir(folder) as entries:
-            return next(entries, None) is not None
-    except OSError:
-        return False
-
-
-def _name_listed(path):
-    """Whether *path*'s folder lists its name, compared under ``normcase``.
-
-    A locator is ``normcase``d; on a case-sensitive NTFS folder ``lstat`` of
-    the lower-cased spelling fails for a file that is there.
-    """
-    folder, name = os.path.split(path)
-    wanted = os.path.normcase(name)
-    try:
-        with os.scandir(folder) as entries:
-            return any(os.path.normcase(entry.name) == wanted for entry in entries)
-    except OSError:
-        return True  # cannot tell: keep the mark
-
-
-def _stale_mark(locator, size, mtime_ns):
-    """Whether the file of a mark is gone or has other bytes (blocking)."""
-    try:
-        info = os.lstat(locator)
-    except (FileNotFoundError, NotADirectoryError):
-        return os.path.isdir(os.path.dirname(locator)) and not _name_listed(locator)
-    except OSError:
-        return False
-    return (info.st_size, info.st_mtime_ns) != (size, mtime_ns)
-
-
-def _stale_marks(marks, roots):
-    """``[(locator, owner)]`` of the marks that hide nothing any more (#501).
-
-    *marks* are ``(locator, size, mtime_ns)`` rows. A mark is stale when its
-    file was changed, or is gone from a folder that still exists. Only marks
-    under a source that can be read now and lists something are judged (an
-    unplugged drive's marks, or its empty mount point's, stay); any doubt
-    keeps the mark. *owner* is the index of the longest source holding it.
-    Locators are ``normcase(realpath)`` paths, so the sources are too.
-    """
-    readable = readable_roots(roots)
-    prefixes = [
-        os.path.normcase(os.path.realpath(root)).rstrip("\\/") + os.sep
-        for root in roots
-    ]
-    judged = {}
-    stale = []
-    for locator, size, mtime_ns in marks:
-        owners = [i for i, prefix in enumerate(prefixes) if locator.startswith(prefix)]
-        if not owners:
-            continue  # under no source now (a source removed from the settings)
-        owner = max(owners, key=lambda i: len(prefixes[i]))
-        if owner not in judged:
-            judged[owner] = readable[owner] and _lists_something(roots[owner])
-        if judged[owner] and _stale_mark(locator, size, mtime_ns):
-            stale.append((locator, owner))
-    return stale
-
-
-def _read_snapshot(db_path, read):
-    """``read(conn)`` on one ``mode=ro`` snapshot; the connection always closes."""
-    conn = sqlite3.connect(readonly_uri(db_path), uri=True)
-    try:
-        conn.row_factory = sqlite3.Row
-        register_prompt_functions(conn)  # LIVE_HINT_CTES calls them (#460)
-        conn.execute("BEGIN")  # one read snapshot for the whole plan
-        return read(conn)
-    finally:
-        conn.close()
-
-
-def _relative(image_path, root):
-    try:
-        return Path(os.path.relpath(image_path, root)).as_posix()
-    except ValueError:  # another drive (Windows)
-        return os.path.basename(image_path)
-
-
-def _source_name(root, index):
-    return os.path.basename(str(root).rstrip("\\/")) or f"Source {index + 1}"
-
-
-def _kept_duplicates(paired, conflicted):
-    """``{prompt_id, reasons}`` for each prompt of a group kept whole (#586).
-
-    The reasons are the review's details without "Kept: ".
-    """
-    held = [(ids, PAIRED_DETAIL) for ids in paired] + [
-        (ids, CONFLICT_DETAILS[reason]) for ids, reason in conflicted
-    ]
-    return [
-        {"prompt_id": prompt_id, "reasons": [detail.removeprefix("Kept: ")]}
-        for ids, detail in held
-        for prompt_id in ids
-    ]
-
-
-def _kept_unused(conn):
-    """``{prompt_id, reasons}`` for each prompt the unused prune keeps (#586).
-
-    The reasons are the review's, one per protection that applies, in the
-    order the plan names them.
-    """
-    kept = []
-    for row in conn.execute(_UNLINKED_KEPT_SQL):
-        reasons = [one for flag, (_p, _m, one) in zip(row[1:], PROTECTIONS) if flag]
-        if reasons:
-            kept.append({"prompt_id": row[0], "reasons": reasons})
-    return kept
-
-
-class MaintenanceOperations:
-    """Mixin for PromptDatabase: maintenance previews and their apply."""
-
-    # ── shared with the legacy cleanup ───────────────────────────────
-
-    def _duplicate_groups(self, conn):
-        """``(groups, paired)``: duplicate id groups, oldest first.
-
-        ``paired`` are the groups with a member in a saved pair, which the
-        cleanup keeps whole.
-        """
-        groups, paired = [], []
-        for duplicate in conn.execute(DUPLICATE_PROMPTS_SQL).fetchall():
-            ids = duplicate["ids"].split(",")
-            created_dates = duplicate["created_dates"].split(",")
-            # Sort IDs by created_at date to keep the oldest
-            id_date_pairs = list(zip(ids, created_dates))
-            id_date_pairs.sort(key=lambda x: x[1])
-            sorted_ids = [int(pair[0]) for pair in id_date_pairs]
-            try:
-                self._ensure_prompts_unpaired(conn, sorted_ids)
-            except PairDependencyError:
-                paired.append(sorted_ids)
-                continue
-            groups.append(sorted_ids)
-        return groups, paired
-
-    @staticmethod
-    def _duplicate_conflict(conn, sorted_ids):
-        """Why merging the group would lose something, or None.
-
-        ``collision``: two members link the same file, so moving the images
-        to the oldest prompt would hit ``UNIQUE(prompt_id, file_path)``.
-        ``title``: a member that would be deleted has its own Library title.
-        """
-        marks = _marks(sorted_ids)
-        collision = conn.execute(
-            "SELECT 1 FROM generated_images WHERE prompt_id IN "  # nosec B608
-            f"({marks}) AND file_path IS NOT NULL GROUP BY file_path "
-            "HAVING COUNT(DISTINCT prompt_id) > 1 LIMIT 1",
-            sorted_ids,
-        ).fetchone()
-        if collision:
-            return "collision"
-        duplicates = sorted_ids[1:]
-        titled = conn.execute(
-            "SELECT 1 FROM prompt_library_state WHERE prompt_id IN "  # nosec B608
-            f"({_marks(duplicates)}) AND trim(coalesce(title, '')) != '' LIMIT 1",
-            duplicates,
-        ).fetchone()
-        return "title" if titled else None
-
-    def _merge_duplicate_group(self, conn, sorted_ids, strict=False):
-        """Keep the oldest prompt of a group; returns (removed, images moved).
-
-        ``strict`` (the reviewed apply): a merge that would drop an image
-        link or a Library title raises MergeConflict, and every helper error
-        propagates, so the transaction rolls back. The legacy cleanup keeps
-        its old, lenient behaviour.
-        """
-        primary_id, duplicate_ids = sorted_ids[0], sorted_ids[1:]
-        if strict:
-            conflict = self._duplicate_conflict(conn, sorted_ids)
-            if conflict:
-                raise MergeConflict(conflict)
-        self.logger.debug(
-            f"Merging duplicates: keeping {primary_id}, removing {duplicate_ids}"
-        )
-        primary = conn.execute(
-            "SELECT * FROM prompts WHERE id = ?", (primary_id,)
-        ).fetchone()
-        if not primary:
-            return 0, 0
-        merged_metadata = self._merge_duplicate_metadata(
-            conn, primary_id, duplicate_ids, strict=strict
-        )
-        moved = self._transfer_images_to_primary(
-            conn, primary_id, duplicate_ids, strict=strict
-        )
-        if merged_metadata:
-            self._update_primary_with_merged_metadata(
-                conn, primary_id, merged_metadata, strict=strict
-            )
-        removed = 0
-        # Images the lenient merge could not move go with their prompt.
-        documents = documents_of_rows(conn, "prompt_id", duplicate_ids)
-        for duplicate_id in duplicate_ids:
-            conn.execute("DELETE FROM prompts WHERE id = ?", (duplicate_id,))
-            removed += 1
-            self.logger.debug(f"Removed duplicate prompt {duplicate_id}")
-        release_documents(conn, documents)
-        return removed, moved
-
-    @staticmethod
-    def _missing_link_ids(rows, roots):
-        """Ids of the ``rows`` whose file is gone under a readable source."""
-        readable = readable_roots(roots)
-        return [
-            row[0]
-            for row, _owner, state in link_states(rows, roots, readable)
-            if state == "missing"
-        ]
-
-    # ── previews ──────────────────────────────────────────────────────
-
-    def preview_maintenance(self, operation, roots=()) -> MaintenanceDraft:
-        """The reviewed plan of ``operation``; writes nothing (blocking).
-
-        ``roots`` are the sources missing links are judged under (the health
-        check's: the effective sources plus configured ones that are gone).
-        """
-        if operation not in MAINTENANCE_OPERATIONS:
-            raise ValueError(f"Unknown maintenance operation {operation!r}")
-        roots = [str(root) for root in roots]
-        if operation == "optimize":
-            return self._plan_optimize()
-        if operation == "workflow_storage":
-            return self._plan_workflow_storage()
-        if operation == "missing_links":
-            rows, marks = _read_snapshot(
-                self.model.db_path,
-                lambda conn: (self._link_rows(conn), _mark_rows(conn)),
-            )
-            return self._plan_missing_links(rows, roots, _stale_marks(marks, roots))
-        if operation == "pair_metadata":
-            from .pair_metadata_repair import plan_pair_metadata
-
-            return _read_snapshot(self.model.db_path, plan_pair_metadata)
-        reader = (
-            self._plan_duplicate_prompts
-            if operation == "duplicate_prompts"
-            else self._plan_unused_components
-        )
-        return _read_snapshot(self.model.db_path, reader)
-
-    @staticmethod
-    def _link_rows(conn):
-        rows = []
-        cursor = conn.execute(_LINK_ROWS_SQL)
-        while batch := cursor.fetchmany(BATCH_ROWS):
-            rows.extend(tuple(row) for row in batch)
-        return rows
-
-    def _duplicates_fingerprint(self, conn):
-        """``(groups, paired, conflicted, fingerprint)`` of the duplicate merge.
-
-        ``conflicted`` holds ``(ids, reason)`` of the groups a merge would
-        lose an image link or a Library title in (``_duplicate_conflict``);
-        the plan protects them.
-        """
-        candidates, paired = self._duplicate_groups(conn)
-        groups, conflicted = [], []
-        for ids in candidates:
-            reason = self._duplicate_conflict(conn, ids)
-            if reason:
-                conflicted.append((ids, reason))
-            else:
-                groups.append(ids)
-        fingerprint = _Fingerprint("duplicate_prompts")
-        fingerprint.add({"groups": groups, "paired": paired, "conflicted": conflicted})
-        _add_prompt_state(fingerprint, conn, [i for group in groups for i in group])
-        return groups, paired, conflicted, fingerprint.hexdigest()
-
-    def _plan_duplicate_prompts(self, conn):
-        groups, paired, conflicted, fingerprint = self._duplicates_fingerprint(conn)
-        removed = sum(len(group) - 1 for group in groups)
-        held = [ids for ids, _reason in conflicted]
-        texts = _texts(conn, [group[0] for group in (groups + paired + held)])
-        details = (
-            [
-                {
-                    "label": _excerpt(texts.get(group[0])),
-                    "detail": f"Keeps the oldest of {len(group)} copies",
-                }
-                for group in groups
-            ]
-            + [
-                {
-                    "label": _excerpt(texts.get(group[0])),
-                    "detail": PAIRED_DETAIL,
-                }
-                for group in paired
-            ]
-            + [
-                {
-                    "label": _excerpt(texts.get(ids[0])),
-                    "detail": CONFLICT_DETAILS[reason],
-                }
-                for ids, reason in conflicted
-            ]
-        )
-        if groups:
-            label = (
-                f"{_plural(removed, 'duplicate prompt')} in "
-                f"{_plural(len(groups), 'group')}"
-            )
-        else:
-            label = "No duplicate prompt text"
-        reasons = []
-        if len(paired) == 1:
-            reasons.append("1 group belongs to a saved pair")
-        elif paired:
-            reasons.append(f"{len(paired):,} groups belong to saved pairs")
-        for reason, (one, many) in CONFLICT_REASONS.items():
-            count = sum(1 for _ids, why in conflicted if why == reason)
-            if count:
-                reasons.append(f"{count:,} {one if count == 1 else many}")
-        return MaintenanceDraft(
-            operation="duplicate_prompts",
-            fingerprint=fingerprint,
-            targets=groups,
-            scope={"count": removed, "label": label},
-            protected={
-                "count": sum(len(group) for group in paired + held),
-                "reasons": reasons,
-            },
-            media={"deletes_files": False, "label": NO_FILES_DELETED},
-            details=details[:MAX_DETAILS],
-        )
-
-    def _unused_fingerprint(self, conn):
-        ids = _orphaned_ids(conn)
-        fingerprint = _Fingerprint("unused_components")
-        fingerprint.add(ids)
-        _add_prompt_state(fingerprint, conn, ids)
-        return ids, fingerprint.hexdigest()
-
-    def _plan_unused_components(self, conn):
-        ids, fingerprint = self._unused_fingerprint(conn)
-        *by_reason, kept = conn.execute(_UNLINKED_PROTECTIONS_SQL).fetchone()
-        reasons = [
-            f"{count:,} {many if count != 1 else one}"
-            for count, (_predicate, many, one) in zip(by_reason, PROTECTIONS)
-            if count
-        ]
-        texts = _texts(conn, ids)
-        count = len(ids)
-        return MaintenanceDraft(
-            operation="unused_components",
-            fingerprint=fingerprint,
-            targets=ids,
-            scope={
-                "count": count,
-                "label": (
-                    _plural(count, "unused prompt component")
-                    if count
-                    else "No unused prompt components"
-                ),
-            },
-            protected={"count": kept, "reasons": reasons},
-            media={"deletes_files": False, "label": NO_FILES_DELETED},
-            details=[
-                {"label": _excerpt(texts.get(prompt_id)), "detail": UNUSED_DETAIL}
-                for prompt_id in ids[:MAX_DETAILS]
-            ],
-        )
-
-    def kept_links(self, roots):
-        """``{image_path, owner, reason}`` for each link the missing-link
-        cleanup holds back under ``roots`` (blocking, reads only, no file
-        opened); ``owner`` indexes ``roots`` (None outside every source).
-
-        ``reason`` is the review's (``HELD_LINK_REASONS``), one link each.
-        """
-        roots = [str(root) for root in roots]
-        rows = _read_snapshot(self.model.db_path, self._link_rows)
-        return [
-            {
-                "image_path": row[1],
-                "owner": owner,
-                "reason": HELD_LINK_REASONS[state][0],
-            }
-            for row, owner, state in held_links(rows, roots, readable_roots(roots))
-        ]
-
-    @staticmethod
-    def _links_fingerprint(candidates, stale=()):
-        fingerprint = _Fingerprint("missing_links")
-        for row, owner in candidates:
-            fingerprint.add([row[0], row[1], row[3], owner])
-        for locator, owner in stale:
-            fingerprint.add(["mark", locator, owner])
-        return fingerprint.hexdigest()
-
-    def _plan_missing_links(self, rows, roots, stale=()):
-        readable = readable_roots(roots)
-        candidates, unavailable, outside = [], 0, 0
-        for row, owner, state in link_states(rows, roots, readable):
-            if state == "missing":
-                candidates.append((row, owner))
-            elif state == "unavailable":
-                unavailable += 1
-            elif state == "outside":
-                outside += 1
-        reasons = [
-            _plural(count, *HELD_LINK_REASONS[state])
-            for state, count in (("unavailable", unavailable), ("outside", outside))
-            if count
-        ]
-        count = len(candidates)
-        parts = []
-        if count:
-            parts.append(
-                _plural(count, "link to a missing file", "links to missing files")
-            )
-        if stale:
-            parts.append(
-                _plural(
-                    len(stale),
-                    "removed image whose file is gone or changed",
-                    "removed images whose files are gone or changed",
-                )
-            )
-        details = [
-            {
-                "label": _relative(row[1], roots[owner]),
-                "detail": f"{_source_name(roots[owner], owner)} · the file is missing",
-            }
-            for row, owner in candidates
-        ] + [
-            {
-                "label": _relative(locator, os.path.realpath(roots[owner])),
-                "detail": (
-                    f"{_source_name(roots[owner], owner)} · removed image, "
-                    "the file is gone or changed"
-                ),
-            }
-            for locator, owner in stale
-        ]
-        return MaintenanceDraft(
-            operation="missing_links",
-            fingerprint=self._links_fingerprint(candidates, stale),
-            targets=[row[0] for row, _owner in candidates],
-            scope={
-                "count": count + len(stale),
-                "label": "; ".join(parts) or "No links to missing files",
-            },
-            protected={"count": unavailable + outside, "reasons": reasons},
-            media={"deletes_files": False, "label": LINKS_ONLY},
-            details=details[:MAX_DETAILS],
-            marks=[locator for locator, _owner in stale],
-        )
-
-    def _plan_optimize(self):
-        def read(conn):
-            return [
-                conn.execute(f"PRAGMA {name}").fetchone()[0]
-                for name in ("page_size", "page_count", "freelist_count")
-            ]
-
-        page_size, page_count, free_pages = _read_snapshot(self.model.db_path, read)
-        db_path = self.model.db_path
-        wal = db_path + "-wal"
-        size = page_size * page_count
-        wal_size = os.path.getsize(wal) if os.path.exists(wal) else 0
-        free = shutil.disk_usage(os.path.dirname(os.path.abspath(db_path))).free
-        # VACUUM writes the rebuilt database through the WAL beside it.
-        return MaintenanceDraft(
-            operation="optimize",
-            fingerprint=_Fingerprint("optimize").hexdigest(),
-            targets=[],
-            scope={"count": 1, "label": "The whole database"},
-            protected={"count": 0, "reasons": []},
-            media={"deletes_files": False, "label": NO_FILES_DELETED},
-            details=[
-                {
-                    "label": "Database file",
-                    "detail": f"{_megabytes(size)}, plus {_megabytes(wal_size)} "
-                    "not yet checkpointed",
-                },
-                {
-                    "label": "Free pages",
-                    "detail": f"About {_megabytes(free_pages * page_size)} "
-                    "can be reclaimed",
-                },
-                {
-                    "label": "Lock",
-                    "detail": OPTIMIZE_LOCK_NOTE,
-                },
-                {
-                    "label": "Free space needed",
-                    "detail": f"About {_megabytes(size)} beside the database and "
-                    f"{_megabytes(size)} in SQLite's temporary folder; "
-                    f"{_megabytes(free)} available beside the database",
-                },
-            ],
-        )
-
-    # ── apply ─────────────────────────────────────────────────────────
-
-    def apply_maintenance(
-        self, operation, fingerprint, targets, roots=(), marks=()
-    ) -> dict:
-        """Apply a reviewed plan exactly, or raise PlanChanged (blocking).
-
-        Inside ``BEGIN IMMEDIATE`` the fingerprint is computed again on the
-        write connection; when it differs nothing is written. ``targets`` and
-        ``roots`` are the plan's. Returns ``{changed, rows}``: how many
-        records changed and up to ``MAX_RESULT_ROWS`` descriptions of them
-        (``{prompt_id[, kept_id]}`` or ``{image_path}``). ``marks`` are a
-        missing-links plan's stale removal marks; that apply also returns
-        ``marks``, how many it forgot. ``pair_metadata`` returns every filled
-        prompt, uncapped (its job keeps the complete record, #550). The
-        prompt operations also return ``kept``: every prompt the plan keeps,
-        ``{prompt_id, reasons}`` in the review's wording (#550, #586); the
-        links a missing-links plan keeps are read by ``kept_links``.
-        """
-        if operation not in MAINTENANCE_OPERATIONS or operation == "workflow_storage":
-            raise ValueError(f"Unknown maintenance operation {operation!r}")
-        if operation == "optimize":
-            # VACUUM cannot run in a transaction; the plan binds the database.
-            if fingerprint != _Fingerprint("optimize").hexdigest():
-                raise PlanChanged("optimize")
-            self.model.vacuum_database()
-            return {"changed": 1, "rows": []}
-        appliers = {
-            "duplicate_prompts": self._apply_duplicate_prompts,
-            "unused_components": self._apply_unused_components,
-        }
-        with self._pair_transaction() as conn:
-            if operation == "pair_metadata":
-                from .pair_metadata_repair import apply_pair_metadata
-
-                return apply_pair_metadata(conn, fingerprint, targets)
-            if operation == "missing_links":
-                return self._apply_missing_links(
-                    conn, fingerprint, targets, roots, list(marks)
-                )
-            return appliers[operation](conn, fingerprint, targets, roots)
-
-    def _apply_duplicate_prompts(self, conn, fingerprint, targets, _roots):
-        groups, paired, conflicted, current = self._duplicates_fingerprint(conn)
-        if current != fingerprint or groups != targets:
-            raise PlanChanged("duplicate_prompts")
-        changed, rows = 0, []
-        kept = _kept_duplicates(paired, conflicted)
-        for sorted_ids in groups:
-            removed, _moved = self._merge_duplicate_group(conn, sorted_ids, strict=True)
-            changed += removed
-            rows.extend(
-                {"prompt_id": duplicate_id, "kept_id": sorted_ids[0]}
-                for duplicate_id in sorted_ids[1:]
-            )
-        return {"changed": changed, "rows": rows[:MAX_RESULT_ROWS], "kept": kept}
-
-    def _apply_unused_components(self, conn, fingerprint, targets, _roots):
-        ids, current = self._unused_fingerprint(conn)
-        if current != fingerprint or ids != targets:
-            raise PlanChanged("unused_components")
-        texts = _texts(conn, ids, limit=MAX_RESULT_ROWS)
-        changed = _delete_ids(conn, "prompts", ids)
-        rows = [
-            {"prompt_id": prompt_id, "text": _excerpt(texts.get(prompt_id))}
-            for prompt_id in ids[:MAX_RESULT_ROWS]
-        ]
-        return {"changed": changed, "rows": rows, "kept": _kept_unused(conn)}
-
-    def _apply_missing_links(self, conn, fingerprint, targets, roots, marks):
-        rows = []
-        for batch in _batches(sorted(targets)):
-            rows.extend(
-                tuple(row)
-                for row in conn.execute(
-                    "SELECT id, image_path, filename, file_path FROM generated_images "
-                    f"WHERE id IN ({_marks(batch)}) ORDER BY id",  # nosec B608
-                    batch,
-                )
-            )
-        readable = readable_roots(roots)
-        candidates = []
-        for row, owner, state in link_states(rows, roots, readable):
-            if state != "missing":  # back, or its source went away
-                raise PlanChanged("missing_links")
-            candidates.append((row, owner))
-        stale = _stale_marks(_mark_rows(conn, marks) if marks else [], roots)
-        if [locator for locator, _owner in stale] != marks:  # a mark went or is valid
-            raise PlanChanged("missing_links")
-        if self._links_fingerprint(candidates, stale) != fingerprint:
-            raise PlanChanged("missing_links")
-        changed = _delete_ids(conn, "generated_images", [row[0] for row in rows])
-        return {
-            "changed": changed,
-            "marks": clear_marks(conn, marks),
-            "rows": [{"image_path": row[1]} for row in rows[:MAX_RESULT_ROWS]],
-        }
@@ -1,393 +0,0 @@
-"""A SQLite connection that is never closed under the thread using it.
-
-``PromptModel`` gives each thread its own connection, but Move library and
-``close_all`` must retire every thread's connection from one thread. Closing
-a ``sqlite3.Connection`` while its owner is inside a statement (Python runs
-``sqlite3_step`` without the GIL) frees memory the owner then reads: on
-Windows the process dies with "access violation", elsewhere the owner sees
-garbage such as a ``MemoryError``.
-
-``ManagedConnection`` counts the calls its owner is inside. ``retire()`` is
-safe from any thread and never raises: an idle connection is closed at once;
-one in use is closed by its owner as the call ends. A retired connection
-refuses new work (cursors, statements, commits) with the error a closed
-connection raises.
-
-What retiring a connection in use does and does not do:
-
- It calls ``sqlite3_interrupt`` (thread-safe). That ends a running
-  statement at its next step, but it does not wake a statement that is
-  waiting for another connection's lock: that one waits until the lock is
-  released (or the busy timeout ends it), and only then is it interrupted.
-  An interrupt that arrives between two statements, for example between the
-  implicit ``BEGIN`` and the DML or between ``executemany`` rows, is lost.
- Writes are kept out of a file the process has switched away from because
-  a retired connection never commits: legacy-mode DML runs inside a
-  transaction that only ``commit()`` (refused) or ``close()`` (rolls back)
-  ends. A statement that commits by itself is not covered: DDL or a PRAGMA
-  write outside a transaction, or an explicit ``COMMIT`` passed to
-  ``execute``/``executescript`` (``executescript`` also commits first, in C,
-  on Python before 3.12). Managed connections must never be used that way
-  for library writes.
-"""
-
-from __future__ import annotations
-
-import contextlib
-import logging
-import operator
-import sys
-import threading
-import time
-import weakref
-from collections import deque
-from typing import Any, Callable, Iterable, Iterator, List, Optional
-
-import sqlite3
-
-CLOSED_MESSAGE = "Cannot operate on a closed database."
-# Rows fetched per step when a cursor is iterated: the connection is marked
-# in use once per chunk instead of once per row (iteration costs about what
-# a plain cursor costs). Prefetched rows belong to the cursor so iteration
-# and explicit fetches always advance the same position.
-ITER_CHUNK = 128
-
-
-class ManagedCursor(sqlite3.Cursor):
-    """A cursor whose calls into SQLite count as its connection being in use."""
-
-    def __init__(self, *args: Any, **kwargs: Any) -> None:
-        super().__init__(*args, **kwargs)
-        self._pending = deque()
-        self._closed = False
-
-    def execute(self, sql, parameters=(), /):
-        return self._run_statement(super().execute, sql, parameters)
-
-    def executemany(self, sql, seq_of_parameters, /):
-        return self._run_statement(super().executemany, sql, seq_of_parameters)
-
-    def _run_statement(self, operation: Callable, *args: Any) -> ManagedCursor:
-        conn = self.connection
-        conn._enter()
-        description = self.description
-        completed = False
-        try:
-            result = operation(*args)
-            completed = True
-            return result
-        finally:
-            # Argument parsing can fail before SQLite replaces the old statement.
-            if completed or self.description is not description:
-                self._pending.clear()
-            conn._leave()
-
-    def executescript(self, sql_script, /):
-        conn = self.connection
-        conn._enter()
-        try:
-            return super().executescript(sql_script)
-        finally:
-            conn._leave()
-
-    def fetchone(self):
-        conn = self.connection
-        conn._enter()
-        try:
-            if self._pending and not self._closed:
-                return self._pending.popleft()
-            return super().fetchone()
-        finally:
-            conn._leave()
-
-    def fetchmany(self, *args, **kwargs):
-        conn = self.connection
-        conn._enter()
-        try:
-            # Let SQLite validate the original arguments, including version-specific
-            # handling of zero/negative sizes, before touching prefetched rows.
-            rows = super().fetchmany(*args, **kwargs)
-            if not self._pending:
-                return rows
-            size = operator.index(
-                kwargs.get("size", args[0] if args else self.arraysize)
-            )
-            # Python 3.12 reads all rows for size=0; 3.13+ reads none.
-            if size == 0 and sys.version_info >= (3, 13):
-                return rows
-            self._pending.extend(rows)
-            count = len(self._pending) if size <= 0 else min(size, len(self._pending))
-            return [self._pending.popleft() for _ in range(count)]
-        finally:
-            conn._leave()
-
-    def fetchall(self):
-        conn = self.connection
-        conn._enter()
-        try:
-            rows = super().fetchall()
-            pending = list(self._pending)
-            self._pending.clear()
-            return pending + rows
-        finally:
-            conn._leave()
-
-    def __iter__(self) -> Iterator:
-        return self
-
-    def __next__(self):
-        conn = self.connection
-        pending = self._pending
-        # Buffered Python rows need no SQLite lock, but retirement and cursor
-        # close must still stop an iterator obtained before either operation.
-        if conn._retired or self._closed:
-            raise sqlite3.ProgrammingError(CLOSED_MESSAGE)
-        if pending:
-            return pending.popleft()
-        conn._enter()
-        try:
-            pending.extend(super().fetchmany(ITER_CHUNK))
-            if not pending:
-                raise StopIteration
-            return pending.popleft()
-        finally:
-            conn._leave()
-
-    def close(self):
-        conn = self.connection
-        try:
-            conn._enter()
-        except sqlite3.ProgrammingError:
-            return super().close()  # the connection is closed or closing
-        try:
-            result = super().close()
-            self._pending = deque()
-            self._closed = True
-            return result
-        finally:
-            conn._leave()
-
-
-class ManagedConnection(sqlite3.Connection):
-    """A connection only its owner closes while a call into it is running."""
-
-    def __init__(self, *args, **kwargs):
-        super().__init__(*args, **kwargs)
-        # Guards _depth, _retired, _closing and _cursors. Re-entrant so that
-        # code running in the closing thread while it holds the lock (a
-        # cursor() during the cursor-set copy) is refused instead of hanging.
-        self._use_lock = threading.RLock()
-        self._depth = 0
-        self._retired = False
-        self._closing = False
-        self._released = threading.Event()
-        # Python before 3.12 keeps the file open after close() while a cursor
-        # still holds a statement; these are closed first (see _close_now).
-        self._cursors: "weakref.WeakSet[sqlite3.Cursor]" = weakref.WeakSet()
-        self.close_logger: Optional[logging.Logger] = None
-
-    # ── in use ───────────────────────────────────────────────────────
-
-    def _enter(self) -> None:
-        with self._use_lock:
-            if self._retired:
-                raise sqlite3.ProgrammingError(CLOSED_MESSAGE)
-            self._depth += 1
-
-    def _leave(self) -> None:
-        with self._use_lock:
-            self._depth -= 1
-            close_now = self._retired and self._depth == 0
-        if close_now:
-            self._close_now()
-
-    @contextlib.contextmanager
-    def using(self):
-        """Mark the connection in use for a call this class cannot wrap.
-
-        For example as the *target* of another connection's ``backup()``.
-        """
-        self._enter()
-        try:
-            yield self
-        finally:
-            self._leave()
-
-    def cursor(self, factory=None):
-        with self._use_lock:
-            if self._retired:
-                raise sqlite3.ProgrammingError(CLOSED_MESSAGE)
-            cursor = super().cursor(factory or ManagedCursor)
-            self._cursors.add(cursor)
-        return cursor
-
-    def execute(self, sql, parameters=(), /):
-        return self.cursor().execute(sql, parameters)
-
-    def executemany(self, sql, seq_of_parameters, /):
-        return self.cursor().executemany(sql, seq_of_parameters)
-
-    def executescript(self, sql_script, /):
-        return self.cursor().executescript(sql_script)
-
-    def commit(self):
-        self._enter()
-        try:
-            return super().commit()
-        finally:
-            self._leave()
-
-    def rollback(self):
-        self._enter()  # a closed connection raises, as sqlite3's does
-        try:
-            return super().rollback()
-        finally:
-            self._leave()
-
-    def backup(self, target, **kwargs):
-        self._enter()
-        try:
-            return super().backup(target, **kwargs)
-        finally:
-            self._leave()
-
-    def create_function(self, *args, **kwargs):
-        self._enter()
-        try:
-            return super().create_function(*args, **kwargs)
-        finally:
-            self._leave()
-
-    @property
-    def in_transaction(self) -> bool:
-        self._enter()
-        try:
-            return super().in_transaction
-        finally:
-            self._leave()
-
-    def __exit__(self, exc_type, exc_value, traceback):
-        # The C implementation calls its own commit/rollback, not these.
-        if exc_type is None:
-            try:
-                self.commit()
-            except BaseException:
-                with contextlib.suppress(sqlite3.Error):
-                    self.rollback()
-                raise
-        else:
-            self.rollback()
-        return False
-
-    # ── closing ──────────────────────────────────────────────────────
-
-    def close(self) -> None:
-        """Close now if idle, else as soon as the running call ends.
-
-        Unlike ``sqlite3.Connection.close``, a call from another thread while
-        the owner is inside a call returns before the file is closed. A caller
-        that must know the file is closed (before renaming or deleting it)
-        waits for ``wait_closed`` (``PromptModel.close_detached`` does).
-        """
-        self.retire()
-
-    def retire(self) -> bool:
-        """Refuse new work and close; True when the connection is closed already.
-
-        Safe from any thread, and never raises: failures are logged.
-        """
-        try:
-            with self._use_lock:
-                if not self._retired:
-                    self._retired = True
-                    if self._depth:
-                        # Ends the running statement (see the module docstring
-                        # for what it does not end). The owner cannot start
-                        # closing the connection while this lock is held.
-                        self.interrupt()
-                        return False
-                elif self._depth:
-                    return False
-                else:
-                    return self._released.wait(0)
-        except Exception:
-            self._log_exception("Error retiring database connection")
-            return self._released.wait(0)
-        self._close_now()
-        return True
-
-    def wait_closed(self, timeout: float) -> bool:
-        return self._released.wait(timeout)
-
-    def _close_now(self) -> None:
-        # Only ever called with no call into the connection running, and a
-        # retired connection refuses new calls and cursors: its cursors are
-        # idle, and the set is copied under the lock that guards it.
-        with self._use_lock:
-            if self._closing:
-                return  # another thread closes it and sets _released
-            self._closing = True
-            cursors = list(self._cursors)
-        try:
-            for cursor in cursors:
-                if isinstance(cursor, ManagedCursor):
-                    cursor._pending = deque()
-                    cursor._closed = True
-                with contextlib.suppress(sqlite3.Error):
-                    sqlite3.Cursor.close(cursor)
-            super().close()
-        except Exception:
-            self._log_exception("Error closing database connection")
-        finally:
-            self._released.set()
-
-    def _log_exception(self, message: str) -> None:
-        if self.close_logger is not None:
-            self.close_logger.exception(message)
-
-
-def retire_connections(
-    connections: Iterable[sqlite3.Connection], logger=None
-) -> List[ManagedConnection]:
-    """Retire every connection; return those whose owner has yet to close them.
-
-    Safe while holding a lock the owners wait on: nothing here waits for them.
-    One connection failing to retire is logged and never skips the rest.
-    """
-    pending = []
-    for conn in connections:
-        try:
-            if isinstance(conn, ManagedConnection):
-                if logger is not None:
-                    conn.close_logger = logger
-                if not conn.retire():
-                    pending.append(conn)
-            else:
-                conn.close()
-        except Exception:
-            if logger is not None:
-                logger.exception("Error closing database connection")
-    return pending
-
-
-def await_closed(
-    connections: Iterable[ManagedConnection], timeout: float, logger=None
-) -> bool:
-    """Wait until the owners closed ``connections`` (retired); False on timeout.
-
-    A connection still open after ``timeout`` (its owner is blocked, for
-    example on another process's lock after a lost interrupt) is logged and
-    left to close when its call ends; a Move library then reports the old
-    files as still in use instead of renaming them.
-    """
-    deadline = time.monotonic() + timeout
-    still_open = 0
-    for conn in connections:
-        if not conn.wait_closed(max(0.0, deadline - time.monotonic())):
-            still_open += 1
-    if still_open and logger is not None:
-        logger.warning(
-            f"{still_open} database connection(s) still in use after "
-            f"{timeout:g}s; they close when their statement ends"
-        )
-    return not still_open
@@ -9,53 +9,17 @@ import math
 import sqlite3
 import os
 import threading
+import tempfile
 import weakref
 from contextlib import closing
 from pathlib import Path
 from typing import Optional, Set, Tuple

-from .managed_connection import (
-    ManagedConnection,
-    await_closed,
-    retire_connections,
-)
-from . import restore_stage
 from .library_schema import library_schema_error, migrate_library_state
-from .image_favorites import image_favorites_schema_error, migrate_image_favorites
-from .image_collections import (
-    image_collections_schema_error,
-    migrate_image_collections,
-)
-from .annotation_schema import annotation_schema_error, migrate_annotation_state
-from .autotag_schema import (
-    autotag_schema_error,
-    autotag_without_annotations_error,
-    migrate_autotag_state,
-)
-from .review_schema import (
-    migrate_review_state,
-    review_schema_error,
-    review_without_annotations_error,
-)
-from .saved_views import migrate_saved_views, saved_views_schema_error
-
-try:
-    from ..utils.hashing import register_prompt_functions
-except ImportError:
-    from utils.hashing import register_prompt_functions
-from .image_categories import image_categories_schema_error, migrate_image_categories
-from .image_removal_schema import image_removals_schema_error, migrate_image_removals
-from .prompt_archive import migrate_prompt_archive, prompt_archive_schema_error
-from .workflow_documents import (
-    DOCUMENT_ID_COLUMNS,
-    migrate_workflow_documents,
-    workflow_documents_schema_error,
-)
-
-
 from .execution_history_schema import (
    history_schema_error,
    migrate_execution_history,
+    rotate_history_epoch,
 )

 # Import logging system
@@ -78,19 +42,6 @@ MAX_PAIR_PROVENANCE_LENGTH = 4_000_000
 MAX_PAIR_PROVENANCE_DEPTH = 64


-def _refuse_rebuild_with_documents(columns) -> None:
-    """The legacy generated_images rebuilds copy a fixed column list.
-
-    A file that needs one (``prompt_id`` TEXT, no ``file_path``) but already
-    has the workflow document ids would lose them, so it is refused.
-    """
-    if any(column in columns for column in DOCUMENT_ID_COLUMNS):
-        raise sqlite3.DatabaseError(
-            "This database needs an old image table rebuild but already has "
-            "workflow document references; the rebuild would drop them"
-        )
-
-
 def pair_provenance_error(encoded: object) -> Optional[str]:
    """Validate the same bounded JSON object for live writes and restores."""
    if not isinstance(encoded, str):
@@ -160,15 +111,12 @@ def configure_connection(conn: sqlite3.Connection) -> None:
    (common on Windows) let other writers' polling busy handlers starve past
    BUSY_TIMEOUT_SECONDS and fail with "database is locked" (#242). Without
    WAL (for example an in-memory database) SQLite's FULL default is kept.
-    It also registers the prompt-key SQL functions (register_prompt_functions).
    """
    journal_mode = conn.execute("PRAGMA journal_mode = WAL").fetchone()[0]
    conn.execute("PRAGMA foreign_keys = ON")
    conn.execute(f"PRAGMA busy_timeout = {BUSY_TIMEOUT_SECONDS * 1000}")
    if str(journal_mode).lower() == "wal":
        conn.execute("PRAGMA synchronous = NORMAL")
-    # History reads and the live-hint rule call Python's prompt key (#460)
-    register_prompt_functions(conn)


 class PromptModel:
@@ -350,30 +298,6 @@ class PromptModel:
        self._migrate_prompt_pairs(conn)
        migrate_execution_history(conn)
        migrate_library_state(conn)
-        migrate_image_favorites(conn)
-        migrate_saved_views(conn)
-        migrate_image_collections(conn)
-        # A review group without its annotation group is refused before the
-        # annotation install could make it look valid (catalog only; the rows
-        # are validated once, in migrate_review_state).
-        review_error = review_without_annotations_error(conn)
-        if review_error:
-            raise sqlite3.DatabaseError(review_error)
-        # The auto-tag marks cite annotation bytes the same way (#379).
-        autotag_error = autotag_without_annotations_error(conn)
-        if autotag_error:
-            raise sqlite3.DatabaseError(autotag_error)
-        migrate_annotation_state(conn)
-        migrate_review_state(conn)
-        migrate_autotag_state(conn)
-        # Image categories (#332): independent of every table above.
-        migrate_image_categories(conn)
-        # The Library parent archive (#443): independent of every table above.
-        migrate_prompt_archive(conn)
-        # Removal marks (#480): independent of every table above.
-        migrate_image_removals(conn)
-        # Last: the older generated_images rebuilds run only before file_path.
-        migrate_workflow_documents(conn)

    def _migrate_prompt_pairs(self, conn: sqlite3.Connection) -> None:
        conn.execute("SAVEPOINT prompt_pair_schema")
@@ -586,10 +510,7 @@ class PromptModel:
            "WHERE pp.positive_prompt_id IS NOT gi.prompt_id LIMIT 1"
        ).fetchone():
            return "Image pair association has a different positive prompt owner"
-        # fetchone, not iteration: a managed connection's cursor prefetches
-        # ITER_CHUNK rows when iterated, and each provenance may be ~4 MB.
-        cursor = conn.execute("SELECT provenance FROM image_prompt_pairs")
-        while (row := cursor.fetchone()) is not None:
+        for row in conn.execute("SELECT provenance FROM image_prompt_pairs"):
            error = pair_provenance_error(row[0])
            if error:
                return error
@@ -648,42 +569,19 @@ class PromptModel:
        if conn is not None and self._local.generation == self._generation:
            return conn

-        while True:
-            # The path and generation are read together, and the new
-            # connection is kept only if no Move library repointed the model
-            # meanwhile: otherwise it would write to the old file.
-            with self._conn_lock:
-                path, generation = self.db_path, self._generation
-            # check_same_thread=False only so close_all and Move library can
-            # retire other threads' connections; each connection is still
-            # used by one thread, and ManagedConnection never closes it under
-            # a running statement (see managed_connection).
-            conn = sqlite3.connect(
-                path,
-                check_same_thread=False,
-                timeout=BUSY_TIMEOUT_SECONDS,
-                factory=ManagedConnection,
-            )
-            try:
-                conn.row_factory = sqlite3.Row
-                configure_connection(conn)
-            except BaseException:
-                conn.close()
-                raise
-            with self._conn_lock:
-                if generation == self._generation:
-                    self._connections.add(conn)
-                    break
-            conn.close()
+        # check_same_thread=False only so close_all can clean up other
+        # threads' connections; each connection is still used by one thread.
+        conn = sqlite3.connect(
+            self.db_path, check_same_thread=False, timeout=BUSY_TIMEOUT_SECONDS
+        )
+        conn.row_factory = sqlite3.Row
+        configure_connection(conn)
        self._local.conn = conn
-        self._local.generation = generation
+        self._local.generation = self._generation
+        with self._conn_lock:
+            self._connections.add(conn)
        return conn

-    @property
-    def generation(self) -> int:
-        """Bumped whenever every connection is closed or the model repointed."""
-        return self._generation
-
    @classmethod
    def close_all_instances(cls) -> None:
        """Close every connection of every live model in this process."""
@@ -692,76 +590,22 @@ class PromptModel:
        for model in models:
            model.close_all()

-    @classmethod
-    def repoint_instances(cls, old_path: str, new_path: str) -> list:
-        """Point every model of ``old_path`` at ``new_path`` (Move library).
-
-        Every thread opens the new file on its next ``get_connection``. The
-        old connections are detached, not closed, and returned: the caller
-        retires them (``retire_detached``) while it still holds the old
-        file's write lock. A write waiting on that lock is then interrupted
-        and can never commit, so it fails (and, through
-        ``PromptDatabase.survive_library_switch``, runs again on the new file).
-        """
-        old_key = os.path.normcase(os.path.realpath(old_path))
-        with cls._instances_lock:
-            models = list(cls._instances)
-        with cls._init_lock:
-            cls._initialized_paths.add(os.path.normcase(os.path.realpath(new_path)))
-        detached = []
-        for model in models:
-            if model._schema_key() == old_key:
-                detached.extend(model._detach_connections(new_path))
-        return detached
-
-    @staticmethod
-    def retire_detached(connections, logger=None) -> list:
-        """Retire detached connections without waiting for their owners.
-
-        Idle ones close now. One whose owner thread is inside a statement is
-        never closed from here (that frees memory the owner is using: an
-        access violation on Windows); it is interrupted, refuses to commit and
-        is closed by its owner as the statement ends. Returns those still
-        open, for ``await_detached`` once no lock the owners wait on is held.
-        """
-        return retire_connections(connections, logger)
-
-    @staticmethod
-    def await_detached(connections, logger=None) -> bool:
-        """Wait until retired connections are closed; False if some are not."""
-        return await_closed(connections, BUSY_TIMEOUT_SECONDS, logger)
-
-    @staticmethod
-    def close_detached(connections, logger=None) -> bool:
-        """Retire connections ``repoint_instances`` detached and await them.
-
-        Do not call it while holding a lock their owners may wait on; retire
-        them there (``retire_detached``) and await them after releasing it.
-        """
-        pending = retire_connections(connections, logger)
-        return await_closed(pending, BUSY_TIMEOUT_SECONDS, logger)
-
    def close_all(self) -> None:
        """Close every thread's connection; they reopen lazily on next use.

        Needed before deleting the database file (Windows keeps open files
        locked) and by tests that ran queries through executor threads.
        """
-        self.close_detached(self._detach_connections(), self.logger)
-
-    def _detach_connections(self, new_path: Optional[str] = None) -> list:
-        """Forget every connection (optionally pointing the model elsewhere).
-
-        Returns them for the caller to close; threads reopen on next use.
-        """
        with self._conn_lock:
-            if new_path is not None:
-                self.db_path = new_path
            connections = list(self._connections)
            self._connections.clear()
            self._generation += 1
        self._local.conn = None
-        return connections
+        for conn in connections:
+            try:
+                conn.close()
+            except sqlite3.Error as e:
+                self.logger.warning(f"Error closing database connection: {e}")

    def close(self) -> None:
        """Close the calling thread's connection, if it has one.
@@ -775,7 +619,10 @@ class PromptModel:
        self._local.conn = None
        with self._conn_lock:
            self._connections.discard(conn)
-        self.close_detached([conn], self.logger)
+        try:
+            conn.close()
+        except sqlite3.Error as e:
+            self.logger.warning(f"Error closing database connection: {e}")

    def _migrate_workflow_name_removal(self, conn: sqlite3.Connection) -> None:
        """
@@ -846,7 +693,6 @@ class PromptModel:
            columns = {column[1]: column[2] for column in cursor.fetchall()}
            if columns.get("prompt_id") != "TEXT":
                return
-            _refuse_rebuild_with_documents(columns)

            self.logger.info("Migrating foreign key types: prompt_id TEXT -> INTEGER")
            with self._table_rebuild(conn):
@@ -1012,7 +858,6 @@ class PromptModel:
            }
            if "file_path" in columns:
                return
-            _refuse_rebuild_with_documents(columns)

            self.logger.info("Migrating database: image uniqueness by full path")
            with self._table_rebuild(conn):
@@ -1078,10 +923,6 @@ class PromptModel:

        Reclaims unused space and defragments the database file,
        improving query performance and reducing file size.
-
-        Raises:
-            Exception: whatever stopped VACUUM (logged first); the database is
-            then unchanged.
        """
        try:
            with closing(sqlite3.connect(self.db_path)) as conn:
@@ -1089,7 +930,6 @@ class PromptModel:
                conn.commit()
        except Exception as e:
            self.logger.error(f"Error vacuuming database: {e}")
-            raise

    def get_database_info(self) -> dict:
        """
@@ -1166,7 +1006,7 @@ class PromptModel:

    @staticmethod
    def verify_database_file(
-        path: str, *, require_library_state: bool = False, documents: bool = True
+        path: str, *, require_library_state: bool = False
    ) -> Tuple[bool, str]:
        """
        Check that a file is a healthy prompts database before restoring it.
@@ -1176,14 +1016,6 @@ class PromptModel:

        Args:
            path: File to inspect
-            require_library_state: Also require the tables every current
-                database has (Library state, image favorites, image
-                categories, saved views, collections, image annotations and
-                the review queue), as a migrated
-                restore stage must; old backups may lack them.
-            documents: Read every workflow document and refuse a damaged
-                one. A restore checks its upload without it and repairs
-                damaged documents on the stage (``database/restore_stage.py``).

        Returns:
            (ok, reason): reason is "ok" when the file is acceptable, otherwise
@@ -1238,56 +1070,6 @@ class PromptModel:
            )
            if library_error:
                return False, library_error
-            favorites_error = image_favorites_schema_error(
-                conn, allow_missing=not require_library_state
-            )
-            if favorites_error:
-                return False, favorites_error
-            categories_error = image_categories_schema_error(
-                conn, allow_missing=not require_library_state
-            )
-            if categories_error:
-                return False, categories_error
-            archive_error = prompt_archive_schema_error(
-                conn, allow_missing=not require_library_state
-            )
-            if archive_error:
-                return False, archive_error
-            removals_error = image_removals_schema_error(
-                conn, allow_missing=not require_library_state
-            )
-            if removals_error:
-                return False, removals_error
-            views_error = saved_views_schema_error(
-                conn, allow_missing=not require_library_state
-            )
-            if views_error:
-                return False, views_error
-            collections_error = image_collections_schema_error(
-                conn, allow_missing=not require_library_state
-            )
-            if collections_error:
-                return False, collections_error
-            annotation_error = annotation_schema_error(
-                conn, allow_missing=not require_library_state
-            )
-            if annotation_error:
-                return False, annotation_error
-            review_error = review_schema_error(
-                conn, allow_missing=not require_library_state
-            )
-            if review_error:
-                return False, review_error
-            autotag_error = autotag_schema_error(
-                conn, allow_missing=not require_library_state
-            )
-            if autotag_error:
-                return False, autotag_error
-            documents_error = workflow_documents_schema_error(
-                conn, allow_missing=not require_library_state, documents=documents
-            )
-            if documents_error:
-                return False, documents_error
            return True, "ok"
        except sqlite3.Error as e:
            return False, f"Invalid SQLite database: {e}"
@@ -1310,51 +1092,21 @@ class PromptModel:
            Path(src_path).resolve().as_uri() + "?mode=ro", uri=True
        )
        try:
-            target = self.get_connection()
-            # The target is written under backup's step too: mark it in use
-            # so a concurrent close_all retires it instead of closing it.
-            with target.using():
-                source.backup(target)
+            source.backup(self.get_connection())
        finally:
            source.close()

-    def stage_restore(self, src_path: str):
-        """Stage ``src_path`` beside this database for a restore (blocking).
-
-        Returns a ``StagedRestore`` (``database/restore_stage.py``): a
-        migrated, repaired and verified copy in the library's folder, its
-        digest and what it holds. Neither the live database nor the source
-        is touched. Raises ValueError when either does not verify.
-        """
-        return restore_stage.stage_restore(PromptModel, self.db_path, src_path)
-
-    def publish_staged(self, staged) -> str:
-        """Replace the live database with ``staged``; return the safety backup.
-
-        See ``restore_stage.publish_staged``: the staged bytes are rechecked,
-        the current database is kept as ``<db_path>.backup_<stamp>`` and the
-        WAL is truncated afterwards.
-        """
-        backup_path = restore_stage.publish_staged(self, staged)
-        self.logger.info("Database restored from a staged copy")
-        from .execution_history import notify_history_restore
-
-        notify_history_restore(self.db_path)
-        return backup_path
-
    def restore_from_file(self, src_path: str) -> str:
        """
        Replace the live database with the file at src_path.

-        ``stage_restore`` then ``publish_staged``: a disposable copy of the
-        source is migrated, repaired and verified in the library's folder
-        first. Only then is the current database backed up next to itself as
-        ``<db_path>.backup_<YYYYmmdd_HHMMSS_ffffff>`` (WAL content included),
-        and the staged pages replace the live pages through SQLite's backup
-        API. Staging failures never replace live content or modify the
-        source. An online replacement failure leaves the live database intact
-        and propagates; the completed safety backup remains available. The
-        stage is removed either way.
+        A disposable SQLite backup of the source is migrated and verified first.
+        Only then is the current database backed up next to itself as
+        ``<db_path>.backup_<YYYYmmdd_HHMMSS>`` (WAL content included), and the
+        staged pages replace the live pages through SQLite's backup API.
+        Migration failures never replace live content or modify the source.
+        An online replacement failure leaves the live database intact and
+        propagates; the completed safety backup remains available.

        Args:
            src_path: SQLite file to restore
@@ -1364,14 +1116,55 @@ class PromptModel:
            there was no database to back up.

        Raises:
-            ValueError: If the source or its migrated copy does not verify
-            SafetyBackupFailed: If the previous database could not be backed up
+            RuntimeError: If the previous database could not be backed up
            sqlite3.OperationalError: If SQLite refuses online replacement
        """
-        staged = self.stage_restore(src_path)
-        try:
-            backup_path = self.publish_staged(staged)
-        finally:
-            staged.discard()
-        self.logger.info(f"Database restored from {src_path}")
-        return backup_path
+        ok, reason = self.verify_database_file(src_path)
+        if not ok:
+            raise ValueError(reason)
+        with tempfile.TemporaryDirectory(prefix="prompt-manager-restore-") as directory:
+            staged_path = str(Path(directory) / "staged.db")
+            source = sqlite3.connect(
+                Path(src_path).resolve().as_uri() + "?mode=ro", uri=True
+            )
+            try:
+                with closing(sqlite3.connect(staged_path)) as destination:
+                    source.backup(destination)
+            finally:
+                source.close()
+            staged = None
+            try:
+                staged = PromptModel(staged_path)
+                rotate_history_epoch(staged.get_connection())
+                ok, reason = self.verify_database_file(
+                    staged_path, require_library_state=True
+                )
+                if not ok:
+                    raise ValueError(reason)
+                staged.close_all()
+                backup_path = ""
+                if os.path.exists(self.db_path):
+                    timestamp = datetime.datetime.now().strftime("%Y%m%d_%H%M%S")
+                    backup_path = f"{self.db_path}.backup_{timestamp}"
+                    if not self.backup_database(backup_path):
+                        raise RuntimeError("Could not back up the current database")
+                    self.logger.info(f"Current database backed up to: {backup_path}")
+                try:
+                    self._replace_contents_from(staged_path)
+                except sqlite3.OperationalError as exc:
+                    exc._prompt_manager_restore_backup_created = bool(backup_path)
+                    raise
+                with PromptModel._init_lock:
+                    PromptModel._initialized_paths.add(self._schema_key())
+                self.logger.info(f"Database restored from {src_path}")
+                from .execution_history import notify_history_restore
+
+                notify_history_restore(self.db_path)
+                return backup_path
+            finally:
+                if staged is not None:
+                    staged.close_all()
+                with PromptModel._init_lock:
+                    PromptModel._initialized_paths.discard(
+                        os.path.normcase(os.path.realpath(staged_path))
+                    )
@@ -1,308 +1,136 @@
-"""Atomic metadata enrichment for a single known generation context.
-
-Also the helpers both ingestion store paths share (#247): the file's link
-rows and the one-prompt-per-file rule (``file_link_rows``,
-``link_conflict``) and the marks a prompt created by ingestion carries
-(``Marks``, ``mark_created``).
-"""
+"""Atomic metadata enrichment for a single known generation context."""

+import json
 import os
-from dataclasses import dataclass
-from typing import Any, Dict, List, Optional, Tuple
+from typing import Any, Dict

 from .models import normalize_image_path
 from .operations import _coerce_file_info
-from .workflow_documents import (
-    TEXT_COLUMNS,
-    DocumentReader,
-    release_documents,
-    resolve_image_row,
-    stored_values,
-)

 try:
    from ..utils.hashing import generate_prompt_hash
-    from ..utils.json_strict import dumps_strict
-    from ..utils.prompt_pair_resolver import RESOLVER_VERSION
 except ImportError:
    from utils.hashing import generate_prompt_hash
-    from utils.json_strict import dumps_strict
-    from utils.prompt_pair_resolver import RESOLVER_VERSION
-
-
-def blank_positive(resolution: Dict[str, Any]) -> bool:
-    """A resolved pair whose stored positive text is empty (#342).
-
-    A PromptManager node whose editor is empty encodes only its prepend and
-    append text, which is never stored as a prompt: such a result names no
-    prompt to link.
-    """
-    if resolution.get("state") != "resolved":
-        return False
-    positive = resolution.get("positive") or {}
-    text = positive.get("storage_text", positive.get("text"))
-    return not (isinstance(text, str) and text.strip())
-
-
-@dataclass(frozen=True)
-class Marks:
-    """What a prompt ingestion creates carries, so it can be found and removed.
-
-    ``note`` is formatted with ``name``, the file's name.
-    """
-
-    category: str
-    tags: Tuple[str, ...]
-    note: str
-
-
-SCAN_MARKS = Marks("scanned", ("auto-scanned",), "Auto-scanned from {name}")
-RUN_MARKS = Marks("scanned", ("auto-scanned",), "Saved from a workflow run: {name}")
-
-
-def mark_created(conn: Any, db: Any, prompt_id: int, marks: Marks, name: str) -> None:
-    """Apply ``marks`` to a prompt row the caller just created on ``conn``."""
-    conn.execute(
-        "UPDATE prompts SET category = ?, notes = ? WHERE id = ?",
-        (marks.category, marks.note.format(name=name), prompt_id),
-    )
-    db._sync_prompt_tags(conn, prompt_id, list(marks.tags))
-
-
-def file_link_rows(conn: Any, image_path: str) -> List[Any]:
-    """The file's link rows, each with its prompt's hash.
-
-    Matched under the path and its resolved spelling (an output folder
-    reached through a symlink or junction), each normalized and raw;
-    deduplicated by row id.
-    """
-    rows: Dict[Any, Any] = {}
-    for spelling in dict.fromkeys((image_path, _resolved(image_path))):
-        for row in conn.execute(
-            "SELECT gi.*,p.hash AS positive_hash FROM generated_images gi "
-            "JOIN prompts p ON p.id=gi.prompt_id "
-            "WHERE gi.file_path=? OR gi.image_path=?",
-            (normalize_image_path(spelling), spelling),
-        ).fetchall():
-            rows.setdefault(row["id"], row)
-    return list(rows.values())
-
-
-def _resolved(path: str) -> str:
-    try:
-        return os.path.realpath(path)
-    except (OSError, ValueError):
-        return path
-
-
-def link_conflict(rows: List[Any], prompt_hash: str) -> bool:
-    """One prompt per file: more than one row, or a row of another prompt."""
-    return len(rows) > 1 or bool(rows and rows[0]["positive_hash"] != prompt_hash)


 def ingest_resolved_pair(
-    db: Any,
-    image_path: str,
-    metadata: Dict[str, Any],
-    resolution: Dict[str, Any],
-    *,
-    marks: Optional[Marks] = None,
+    db: Any, image_path: str, metadata: Dict[str, Any], resolution: Dict[str, Any]
 ) -> Dict[str, Any]:
-    """Store a resolved pair and link the file to it in one transaction.
-
-    With ``marks`` (ingestion from files), each pair component this call
-    creates carries them; without (the PromptManager node path) components
-    are created bare, as always.
-    """
    state = resolution.get("state", "unresolved")
-    if state == "resolved" and blank_positive(resolution):
-        state = "unresolved"
    if state != "resolved":
        return {"status": state, "pairs_added": 0, "links_added": 0}
-    with db._pair_transaction() as conn:
-        return _ingest_resolved_pair_in(
-            conn, db, image_path, metadata, resolution, marks=marks
-        )
-
-
-def _conflict() -> Dict[str, Any]:
-    return {"status": "conflict", "pairs_added": 0, "links_added": 0}
-
-
-def _ingest_resolved_pair_in(
-    conn: Any,
-    db: Any,
-    image_path: str,
-    metadata: Dict[str, Any],
-    resolution: Dict[str, Any],
-    *,
-    provenance: Dict[str, Any] | None = None,
-    marks: Optional[Marks] = None,
-) -> Dict[str, Any]:
-    """``ingest_resolved_pair`` inside the caller's open ``_pair_transaction``.
-
-    The compatible-only rules are the public ingester's: an image with more
-    than one exact row, another positive, or a prior pair with another
-    negative is a ``conflict`` and nothing is written. The caller owns the
-    transaction, so its own later failure rolls the link back too.
-    ``provenance`` replaces the link's default resolver provenance (Needs
-    review records the user's selection there). ``marks`` as in
-    ``ingest_resolved_pair``.
-    """
    positive, negative = resolution["positive"], resolution["negative"]
    positive_text = positive.get("storage_text", positive["text"])
    negative_text = negative.get("storage_text", negative["text"])
    normalized = normalize_image_path(image_path)
-    if provenance is None:
-        provenance = {
-            "resolver_version": RESOLVER_VERSION,
-            "positive": positive,
-            "negative": negative,
-        }
-    encoded = dumps_strict(provenance, sort_keys=True, separators=(",", ":"))
-    images = file_link_rows(conn, image_path)
-    if link_conflict(images, generate_prompt_hash(positive_text)):
-        return _conflict()
-    existing = images[0] if images else None
-    if existing:
-        prior = conn.execute(
-            "SELECT n.hash AS negative_hash FROM image_prompt_pairs ip "
-            "JOIN prompt_pairs pp ON pp.id=ip.pair_id "
-            "LEFT JOIN prompts n ON n.id=pp.negative_prompt_id WHERE ip.image_id=?",
-            (existing["id"],),
-        ).fetchall()
-        expected = (
-            generate_prompt_hash(negative_text) if negative_text.strip() else None
-        )
-        if any(row["negative_hash"] != expected for row in prior):
-            return _conflict()
-    prior_pair = conn.execute(
-        "SELECT pp.id FROM prompt_pairs pp "
-        "JOIN prompts p ON p.id=pp.positive_prompt_id "
-        "LEFT JOIN prompts n ON n.id=pp.negative_prompt_id "
-        "WHERE p.hash=? AND n.hash IS ?",
-        (
-            generate_prompt_hash(positive_text),
-            generate_prompt_hash(negative_text) if negative_text.strip() else None,
-        ),
-    ).fetchone()
-    if marks is None:
-        pair_id = db._save_pair(conn, positive_text, negative_text)
-    else:
-        pair_id = _save_marked_pair(
-            conn, db, positive_text, negative_text, marks, os.path.basename(image_path)
-        )
-    pair = conn.execute("SELECT * FROM prompt_pairs WHERE id=?", (pair_id,)).fetchone()
-    pairs_added = int(prior_pair is None)
-    file_size, width, height, image_format = _coerce_file_info(metadata)
-    # ComfyUI's NaN/Infinity are stored as null: the snapshot is strict JSON.
-    snapshots = {
-        column: dumps_strict(metadata[key], sort_keys=True)
-        for column, key in (
-            ("workflow_data", "workflow"),
-            ("prompt_metadata", "prompt"),
-            ("parameters", "parameters"),
-        )
-        if key in metadata
-    }
-    info = {
-        "file_size": file_size,
-        "width": width,
-        "height": height,
-        "format": image_format,
-    }
-    snapshots.update({key: value for key, value in info.items() if value is not None})
-    changed = False
-    if existing:
-        image_id = existing["id"]
-        # Compared as stored text, whichever form the row is in.
-        current = resolve_image_row(DocumentReader(conn), existing)
-        updates = {
-            key: value for key, value in snapshots.items() if current[key] != value
-        }
-        if updates:
-            replaced = [
-                existing[reference]
-                for column, reference in TEXT_COLUMNS
-                if column in updates
-            ]
-            updates = _document_form(conn, updates)
-            conn.execute(
-                "UPDATE generated_images SET "
-                + ",".join(f"{key}=?" for key in updates)
-                + " WHERE id=?",
-                [*updates.values(), image_id],
-            )
-            release_documents(conn, replaced)
-            changed = True
-    else:
-        stored = _document_form(conn, snapshots)
-        columns = ["prompt_id", "image_path", "filename", "file_path", *stored]
-        values = [
-            pair["positive_prompt_id"],
-            image_path,
-            os.path.basename(image_path),
-            normalized,
-            *stored.values(),
-        ]
-        image_id = conn.execute(
-            "INSERT INTO generated_images("
-            + ",".join(columns)
-            + ") VALUES("
-            + ",".join("?" for _ in columns)
-            + ")",
-            values,
-        ).lastrowid
-    linked = conn.execute(
-        "SELECT 1 FROM image_prompt_pairs WHERE pair_id=? "
-        "AND image_id=? AND provenance=?",
-        (pair_id, image_id, encoded),
-    ).fetchone()
-    db._link_image_to_pair(conn, pair_id, image_id, provenance)
-    status = (
-        "added"
-        if existing is None
-        else "enriched" if changed or not linked else "unchanged"
+    provenance = {"resolver_version": 1, "positive": positive, "negative": negative}
+    encoded = json.dumps(
+        provenance, sort_keys=True, separators=(",", ":"), allow_nan=False
    )
-    return {
-        "status": status,
-        "pairs_added": pairs_added,
-        "links_added": int(not linked),
-        "pair_id": pair_id,
-        "image_id": image_id,
-    }
-
-
-def _save_marked_pair(
-    conn: Any,
-    db: Any,
-    positive_text: str,
-    negative_text: str,
-    marks: Marks,
-    name: str,
-) -> int:
-    """``_save_pair`` that marks each component it creates."""
-    texts = [positive_text] + ([negative_text] if negative_text.strip() else [])
-    ids = []
-    for text in texts:
-        prompt_id, created = db._pair_component_outcome(conn, text)
-        if created:
-            mark_created(conn, db, prompt_id, marks, name)
-        ids.append(prompt_id)
-    negative_id = ids[1] if len(ids) > 1 else None
-    return db._save_pair_components(conn, ids[0], negative_id)[0]
-
-
-def _document_form(conn: Any, values: Dict[str, Any]) -> Dict[str, Any]:
-    """``values`` with the workflow and prompt graph texts stored once.
-
-    Each of those columns becomes NULL beside its document id (new form);
-    every other column is unchanged.
-    """
-    texts = {
-        column: values[column]
-        for column, _reference in TEXT_COLUMNS
-        if column in values
-    }
-    rest = {key: value for key, value in values.items() if key not in texts}
-    return {**rest, **stored_values(conn, texts)}
+    with db._pair_transaction() as conn:
+        images = conn.execute(
+            "SELECT gi.*,p.hash AS positive_hash FROM generated_images gi "
+            "JOIN prompts p ON p.id=gi.prompt_id "
+            "WHERE gi.file_path=? OR gi.image_path=?",
+            (normalized, image_path),
+        ).fetchall()
+        if len(images) > 1 or (
+            images and images[0]["positive_hash"] != generate_prompt_hash(positive_text)
+        ):
+            return {"status": "conflict", "pairs_added": 0, "links_added": 0}
+        existing = images[0] if images else None
+        if existing:
+            prior = conn.execute(
+                "SELECT n.hash AS negative_hash FROM image_prompt_pairs ip "
+                "JOIN prompt_pairs pp ON pp.id=ip.pair_id "
+                "LEFT JOIN prompts n ON n.id=pp.negative_prompt_id WHERE ip.image_id=?",
+                (existing["id"],),
+            ).fetchall()
+            expected = (
+                generate_prompt_hash(negative_text) if negative_text.strip() else None
+            )
+            if any(row["negative_hash"] != expected for row in prior):
+                return {"status": "conflict", "pairs_added": 0, "links_added": 0}
+        prior_pair = conn.execute(
+            "SELECT pp.id FROM prompt_pairs pp "
+            "JOIN prompts p ON p.id=pp.positive_prompt_id "
+            "LEFT JOIN prompts n ON n.id=pp.negative_prompt_id "
+            "WHERE p.hash=? AND n.hash IS ?",
+            (
+                generate_prompt_hash(positive_text),
+                generate_prompt_hash(negative_text) if negative_text.strip() else None,
+            ),
+        ).fetchone()
+        pair_id = db._save_pair(conn, positive_text, negative_text)
+        pair = conn.execute(
+            "SELECT * FROM prompt_pairs WHERE id=?", (pair_id,)
+        ).fetchone()
+        pairs_added = int(prior_pair is None)
+        file_size, width, height, image_format = _coerce_file_info(metadata)
+        snapshots = {
+            column: json.dumps(metadata[key], sort_keys=True, allow_nan=False)
+            for column, key in (
+                ("workflow_data", "workflow"),
+                ("prompt_metadata", "prompt"),
+                ("parameters", "parameters"),
+            )
+            if key in metadata
+        }
+        info = {
+            "file_size": file_size,
+            "width": width,
+            "height": height,
+            "format": image_format,
+        }
+        snapshots.update(
+            {key: value for key, value in info.items() if value is not None}
+        )
+        changed = False
+        if existing:
+            image_id = existing["id"]
+            updates = {
+                key: value for key, value in snapshots.items() if existing[key] != value
+            }
+            if updates:
+                conn.execute(
+                    "UPDATE generated_images SET "
+                    + ",".join(f"{key}=?" for key in updates)
+                    + " WHERE id=?",
+                    [*updates.values(), image_id],
+                )
+                changed = True
+        else:
+            columns = ["prompt_id", "image_path", "filename", "file_path", *snapshots]
+            values = [
+                pair["positive_prompt_id"],
+                image_path,
+                os.path.basename(image_path),
+                normalized,
+                *snapshots.values(),
+            ]
+            image_id = conn.execute(
+                "INSERT INTO generated_images("
+                + ",".join(columns)
+                + ") VALUES("
+                + ",".join("?" for _ in columns)
+                + ")",
+                values,
+            ).lastrowid
+        linked = conn.execute(
+            "SELECT 1 FROM image_prompt_pairs WHERE pair_id=? "
+            "AND image_id=? AND provenance=?",
+            (pair_id, image_id, encoded),
+        ).fetchone()
+        db._link_image_to_pair(conn, pair_id, image_id, provenance)
+        status = (
+            "added"
+            if existing is None
+            else "enriched" if changed or not linked else "unchanged"
+        )
+        return {
+            "status": status,
+            "pairs_added": pairs_added,
+            "links_added": int(not linked),
+            "pair_id": pair_id,
+            "image_id": image_id,
+        }
@@ -1,452 +0,0 @@
-"""Pair category and tags repair (#550): the ``pair_metadata`` maintenance plan.
-
-Before #546 a Pair node run saved its category and tags on the saved pair
-only; the positive prompt it created stayed Uncategorized and untagged. This
-plan fills the **empty** category and the **empty** tag set of those prompts
-from their saved pairs (``docs/egm/post-3.4.1/550-design.md``):
-
- Considered: prompts the Pair node created as a positive (their earliest
-  pair, in either role, has them as the positive and its ``created_at`` is
-  within ``PAIR_CREATED_TOLERANCE`` of theirs) whose category is blank
-  and/or that have no tags.
- Sources: the prompt's non-archived pairs where it is the positive. Pairs
-  with a blank category or no tags are ignored for that field. A field fills
-  when exactly one value remains (category: trimmed, case-sensitive; tags:
-  the tag-id set).
- Kept (protected), in this order: archived prompt, edited prompt
-  (``updated_at`` not within the tolerance of ``created_at``), pairs that
-  disagree, a tag set over ``MAX_LIBRARY_TAGS``.
-
-The apply runs in the caller's ``BEGIN IMMEDIATE`` transaction, recomputes
-the fingerprint, then writes guarded statements (the field must still be
-empty) that never touch a pair, a negative or ``updated_at``. A guard that
-hits nothing raises ``PlanChanged`` so the whole transaction rolls back.
-"""
-
-import datetime
-
-from . import maintenance as _maintenance
-from .library_commands import MAX_LIBRARY_TAGS
-from .maintenance import (
-    MAX_DETAILS,
-    MaintenanceDraft,
-    PlanChanged,
-    _excerpt,
-    _Fingerprint,
-    _marks,
-    _plural,
-)
-
-OPERATION = "pair_metadata"
-# Seconds: the Pair save stamps its new prompt and its pair with separate
-# utc_now_iso() calls in one transaction (microseconds apart).
-PAIR_CREATED_TOLERANCE = 2.0
-# Fill prompts one plan applies; the rest are applied by the next review.
-# Bounds the complete record a job keeps in memory (about 100 bytes a row).
-MAX_PLAN_FILLS = 20000
-DETAIL_VALUES = 3
-DETAIL_TAGS = 5
-MEDIA_LABEL = "No image file or saved pair is changed."
-EMPTY_LABEL = "No Pair prompts are missing a category or tags"
-RECORD_NOTE = (
-    "The job's report lists every filled field. Download it to keep it: "
-    "Activity forgets jobs after a restart."
-)
-# Protected classes in precedence order: (key, detail, reason one, many).
-EDITED_DETAIL = (
-    "Kept: edited after it was saved; its empty category or tags may be intentional"
-)
-PROTECTED = (
-    (
-        "archived",
-        "Kept: archived in the Library",
-        "archived in the Library",
-        "archived in the Library",
-    ),
-    (
-        "edited",
-        EDITED_DETAIL,
-        "edited after it was saved",
-        "edited after they were saved",
-    ),
-    ("conflict", None, "where pairs disagree", "where pairs disagree"),
-    (
-        "too-many-tags",
-        f"Kept: its pair has more than {MAX_LIBRARY_TAGS} tags",
-        f"whose pair has more than {MAX_LIBRARY_TAGS} tags",
-        f"whose pair has more than {MAX_LIBRARY_TAGS} tags",
-    ),
-)
-_PROTECTED_ORDER = [key for key, *_rest in PROTECTED]
-# Detail rows: what the user can act on (a conflict) first.
-DETAIL_ORDER = ("conflict", "edited", "archived", "too-many-tags")
-
-_CANDIDATES_SQL = """
-    SELECT p.id, p.hash, p.text, p.created_at, p.updated_at,
-           COALESCE(TRIM(p.category), '') = '' AS blank_category,
-           NOT EXISTS (SELECT 1 FROM prompt_tags pt WHERE pt.prompt_id = p.id)
-               AS untagged,
-           EXISTS (SELECT 1 FROM prompt_archive pa WHERE pa.prompt_id = p.id)
-               AS archived,
-           (SELECT CASE WHEN pp.positive_prompt_id = p.id
-                        THEN pp.created_at END
-              FROM prompt_pairs pp
-             WHERE pp.positive_prompt_id = p.id OR pp.negative_prompt_id = p.id
-             ORDER BY pp.id LIMIT 1) AS first_pair_at
-      FROM prompts p
-     WHERE EXISTS (SELECT 1 FROM prompt_pairs pp WHERE pp.positive_prompt_id = p.id)
-       AND (COALESCE(TRIM(p.category), '') = ''
-            OR NOT EXISTS (SELECT 1 FROM prompt_tags pt WHERE pt.prompt_id = p.id))
-     ORDER BY p.id
-"""
-_SOURCES_SQL = (
-    "SELECT id, positive_prompt_id, TRIM(COALESCE(category, '')) FROM prompt_pairs "
-    "WHERE archived = 0 AND positive_prompt_id IN ({marks}) ORDER BY id"
-)
-_PAIR_TAGS_SQL = (
-    "SELECT ppt.pair_id, t.id, t.name FROM prompt_pair_tags ppt "
-    "JOIN tags t ON t.id = ppt.tag_id WHERE ppt.pair_id IN ({marks}) "
-    "ORDER BY ppt.pair_id, t.id"
-)
-
-
-def parse_stamp(value):
-    """A stored timestamp as an aware UTC datetime, or None when unreadable."""
-    if not isinstance(value, str) or not value.strip():
-        return None
-    try:
-        stamp = datetime.datetime.fromisoformat(value.strip())
-    except ValueError:
-        return None
-    if stamp.tzinfo is None:
-        stamp = stamp.replace(tzinfo=datetime.timezone.utc)
-    return stamp
-
-
-def _close(first, second):
-    """Whether two stored stamps parse and lie within the tolerance."""
-    a, b = parse_stamp(first), parse_stamp(second)
-    if a is None or b is None:
-        return False
-    return abs((a - b).total_seconds()) <= PAIR_CREATED_TOLERANCE
-
-
-def _batches(ids):
-    size = _maintenance.ID_BATCH
-    for start in range(0, len(ids), size):
-        yield ids[start : start + size]
-
-
-def _sources(conn, ids):
-    """``{prompt_id: [(pair_id, category, ((tag_id, name), ...)), ...]}``."""
-    pairs = {}
-    for batch in _batches(ids):
-        for pair_id, prompt_id, category in conn.execute(
-            _SOURCES_SQL.format(marks=_marks(batch)), batch
-        ):
-            pairs.setdefault(prompt_id, []).append([pair_id, category, []])
-    by_pair = {pair[0]: pair for group in pairs.values() for pair in group}
-    pair_ids = sorted(by_pair)
-    for batch in _batches(pair_ids):
-        for pair_id, tag_id, name in conn.execute(
-            _PAIR_TAGS_SQL.format(marks=_marks(batch)), batch
-        ):
-            by_pair[pair_id][2].append((tag_id, name))
-    return {
-        prompt_id: [(pid, category, tuple(tags)) for pid, category, tags in group]
-        for prompt_id, group in pairs.items()
-    }
-
-
-def _field(values, guard):
-    """``(class, value)`` of one field from its distinct values, or None."""
-    if not values:
-        return None
-    if guard:
-        return (guard, None)
-    if len(values) > 1:
-        return ("conflict", sorted(values))
-    return ("fill", next(iter(values)))
-
-
-def _classify(row, sources):
-    """The result of one considered prompt, or None when nothing applies."""
-    guard = None
-    if row["archived"]:
-        guard = "archived"
-    elif not _close(row["updated_at"], row["created_at"]):
-        guard = "edited"
-    category = tags = None
-    tag_pair = None
-    if row["blank_category"]:
-        category = _field({c for _p, c, _t in sources if c}, guard)
-    if row["untagged"]:
-        sets = {}
-        for pair_id, _category, pair_tags in sources:
-            if pair_tags:
-                sets.setdefault(frozenset(pair_tags), pair_id)
-        tags = _field(set(sets), guard)
-        if tags and tags[0] == "fill":
-            tag_pair = sets[tags[1]]
-            if len(tags[1]) > MAX_LIBRARY_TAGS:
-                tags = ("too-many-tags", None)
-            else:
-                tags = ("fill", tuple(sorted(tags[1])))
-        elif tags and tags[0] == "conflict":
-            tags = ("conflict", [sorted(s) for s in sorted(sets, key=sorted)])
-    if category is None and tags is None:
-        return None
-    return {
-        "id": row["id"],
-        "hash": row["hash"],
-        "text": row["text"],
-        "category": category,
-        "tags": tags,
-        "tag_pair": tag_pair if tags and tags[0] == "fill" else None,
-        "pairs": [pair_id for pair_id, _c, _t in sources],
-    }
-
-
-def _state(conn):
-    """``(results, fingerprint)``: every considered prompt's result, by id."""
-    considered = []
-    for row in conn.execute(_CANDIDATES_SQL):
-        row = dict(
-            zip(
-                (
-                    "id",
-                    "hash",
-                    "text",
-                    "created_at",
-                    "updated_at",
-                    "blank_category",
-                    "untagged",
-                    "archived",
-                    "first_pair_at",
-                ),
-                tuple(row),
-            )
-        )
-        if _close(row["created_at"], row["first_pair_at"]):
-            considered.append(row)
-    sources = _sources(conn, [row["id"] for row in considered])
-    fingerprint = _Fingerprint(OPERATION)
-    results = []
-    for row in considered:
-        result = _classify(row, sources.get(row["id"], []))
-        if result is None:
-            continue
-        results.append(result)
-        fingerprint.add(
-            [
-                result["id"],
-                result["hash"],
-                result["category"],
-                result["tags"],
-                result["tag_pair"],
-                result["pairs"],
-            ]
-        )
-    return results, fingerprint.hexdigest()
-
-
-def _fills(result):
-    return (
-        bool(result["category"] and result["category"][0] == "fill"),
-        bool(result["tags"] and result["tags"][0] == "fill"),
-    )
-
-
-def _targets(results):
-    targets = []
-    for result in results:
-        category, tags = _fills(result)
-        if category or tags:
-            targets.append([result["id"], category, tags])
-    return targets[:MAX_PLAN_FILLS]
-
-
-def _protected_classes(result):
-    """The protected classes of a result's fields, in precedence order."""
-    found = {
-        field[0]
-        for field in (result["category"], result["tags"])
-        if field and field[0] != "fill"
-    }
-    return [key for key in _PROTECTED_ORDER if key in found]
-
-
-def _more(values, limit):
-    shown = ", ".join(values[:limit])
-    return shown + (", …" if len(values) > limit else "")
-
-
-def _fill_detail(result):
-    parts = []
-    category, tags = _fills(result)
-    if category:
-        parts.append(f"category “{result['category'][1]}”")
-    if tags:
-        names = sorted(name for _id, name in result["tags"][1])
-        noun = "tag" if len(names) == 1 else "tags"
-        parts.append(f"{len(names)} {noun}: {_more(names, DETAIL_TAGS)}")
-    pairs = [str(pair_id) for pair_id in result["pairs"]]
-    label = "pair" if len(pairs) == 1 else "pairs"
-    return f"Fills {' and '.join(parts)} ({label} {_more(pairs, DETAIL_VALUES)})"
-
-
-def _protected_detail(result, key):
-    if key != "conflict":
-        return next(detail for k, detail, *_r in PROTECTED if k == key)
-    if result["category"] and result["category"][0] == "conflict":
-        values = result["category"][1]
-        return f"Kept: pairs disagree on category: {_more(values, DETAIL_VALUES)}"
-    return "Kept: pairs disagree on tags"
-
-
-def _kept(results):
-    """One row per kept prompt, its review reasons without "Kept: " (#550)."""
-    rows = []
-    for result in results:
-        classes = set(_protected_classes(result))
-        if classes:
-            rows.append(
-                {
-                    "prompt_id": result["id"],
-                    "reasons": [
-                        _protected_detail(result, key).removeprefix("Kept: ")
-                        for key in DETAIL_ORDER
-                        if key in classes
-                    ],
-                }
-            )
-    return rows
-
-
-def _details(results, targets):
-    rows = []
-    for key in DETAIL_ORDER:
-        for result in results:
-            if key in _protected_classes(result):
-                rows.append(
-                    {
-                        "label": _excerpt(result["text"]),
-                        "detail": _protected_detail(result, key),
-                    }
-                )
-    planned = {target[0] for target in targets}
-    for result in results:
-        if result["id"] in planned:
-            rows.append(
-                {"label": _excerpt(result["text"]), "detail": _fill_detail(result)}
-            )
-    if not targets:
-        return rows[:MAX_DETAILS]
-    return rows[: MAX_DETAILS - 1] + [{"label": "Record", "detail": RECORD_NOTE}]
-
-
-def _scope_label(targets, total):
-    if not targets:
-        return EMPTY_LABEL
-    categories = sum(1 for _id, category, _tags in targets if category)
-    tag_sets = sum(1 for _id, _category, tags in targets if tags)
-    label = (
-        f"{_plural(len(targets), 'prompt')} to fill: "
-        f"{_plural(categories, 'category', 'categories')}, "
-        f"{_plural(tag_sets, 'tag set')}"
-    )
-    if total > len(targets):
-        label += (
-            f" (the first {len(targets):,} of {total:,}; review again for the rest)"
-        )
-    return label
-
-
-def plan_pair_metadata(conn):
-    """The reviewed ``pair_metadata`` plan on ``conn``'s snapshot."""
-    results, fingerprint = _state(conn)
-    targets = _targets(results)
-    total = sum(1 for result in results if any(_fills(result)))
-    counts = {key: 0 for key in _PROTECTED_ORDER}
-    held = 0
-    for result in results:
-        classes = _protected_classes(result)
-        held += bool(classes)
-        for key in classes:
-            counts[key] += 1
-    reasons = [
-        f"{counts[key]:,} {one if counts[key] == 1 else many}"
-        for key, _detail, one, many in PROTECTED
-        if counts[key]
-    ]
-    return MaintenanceDraft(
-        operation=OPERATION,
-        fingerprint=fingerprint,
-        targets=targets,
-        scope={"count": len(targets), "label": _scope_label(targets, total)},
-        protected={"count": held, "reasons": reasons},
-        media={"deletes_files": False, "label": MEDIA_LABEL},
-        details=_details(results, targets),
-    )
-
-
-def _fill_categories(conn, fills):
-    """Set each blank category; raises PlanChanged when one is no longer blank."""
-    cursor = conn.executemany(
-        "UPDATE prompts SET category = ? WHERE id = ? "
-        "AND COALESCE(TRIM(category), '') = ''",
-        fills,
-    )
-    if cursor.rowcount != len(fills):
-        raise PlanChanged(OPERATION)
-
-
-def _fill_tags(conn, fills, expected):
-    """Copy each source pair's tags onto its untagged prompt."""
-    cursor = conn.executemany(
-        "INSERT INTO prompt_tags(prompt_id, tag_id) "
-        "SELECT ?, ppt.tag_id FROM prompt_pair_tags ppt "
-        "JOIN tags t ON t.id = ppt.tag_id WHERE ppt.pair_id = ? "
-        "AND NOT EXISTS (SELECT 1 FROM prompt_tags WHERE prompt_id = ?)",
-        fills,
-    )
-    if cursor.rowcount != expected:
-        raise PlanChanged(OPERATION)
-
-
-def apply_pair_metadata(conn, fingerprint, targets):
-    """Apply the reviewed fills on ``conn`` (inside BEGIN IMMEDIATE).
-
-    Returns ``{changed, categories, tag_sets, rows, kept}``; ``rows`` lists
-    every filled prompt (``{prompt_id, category?, tags?}``) and ``kept`` every
-    prompt the plan keeps (``{prompt_id, reasons}``, in the review's wording
-    and order), both never capped.
-    """
-    results, current = _state(conn)
-    if current != fingerprint or _targets(results) != targets:
-        raise PlanChanged(OPERATION)
-    by_id = {result["id"]: result for result in results}
-    categories, tags, rows = [], [], []
-    tag_count = 0
-    for prompt_id, fill_category, fill_tags in targets:
-        result = by_id[prompt_id]
-        row = {"prompt_id": prompt_id}
-        if fill_category:
-            row["category"] = result["category"][1]
-            categories.append((row["category"], prompt_id))
-        if fill_tags:
-            row["tags"] = sorted(name for _id, name in result["tags"][1])
-            tags.append((prompt_id, result["tag_pair"], prompt_id))
-            tag_count += len(result["tags"][1])
-        rows.append(row)
-    if categories:
-        _fill_categories(conn, categories)
-    if tags:
-        _fill_tags(conn, tags, tag_count)
-    return {
-        "changed": len(rows),
-        "categories": len(categories),
-        "tag_sets": len(tags),
-        "rows": rows,
-        "kept": _kept(results),
-    }
@@ -112,14 +112,8 @@ class PairOperations:
        tags: Optional[List[str]] = None,
        rating: Optional[int] = None,
        notes: Optional[str] = None,
-        fill_new_positive: bool = False,
    ) -> int:
-        """Save an ordered pair atomically; repeat saves preserve its metadata.
-
-        ``fill_new_positive`` also gives the positive prompt the category and
-        tags, only if this save inserted its row (#546). An existing prompt
-        never changes, so a cleared category stays cleared.
-        """
+        """Save an ordered pair atomically; repeat saves preserve its metadata."""
        with self._pair_transaction() as conn:
            return self._save_pair(
                conn,
@@ -130,7 +124,6 @@ class PairOperations:
                tags=tags,
                rating=rating,
                notes=notes,
-                fill_new_positive=fill_new_positive,
            )

    def _save_pair(
@@ -144,7 +137,6 @@ class PairOperations:
        tags: Optional[List[str]] = None,
        rating: Optional[int] = None,
        notes: Optional[str] = None,
-        fill_new_positive: bool = False,
    ) -> int:
        """Save an ordered pair atomically; repeat saves preserve its metadata."""
        if not isinstance(positive_text, str) or not positive_text.strip():
@@ -152,13 +144,8 @@ class PairOperations:
        if not isinstance(negative_text, str):
            raise ValueError("Negative prompt text must be a string; use '' for empty")
        # Validate metadata before any component insertion.
-        tags = _validate_metadata(title, category, tags, rating, notes)
-        positive, created = self._pair_component_outcome(conn, positive_text)
-        if created and fill_new_positive:
-            conn.execute(
-                "UPDATE prompts SET category = ? WHERE id = ?", (category, positive)
-            )
-            self._sync_prompt_tags(conn, positive, tags or [])
+        _validate_metadata(title, category, tags, rating, notes)
+        positive = self._pair_component(conn, positive_text)
        negative = (
            self._pair_component(conn, negative_text) if negative_text.strip() else None
        )
@@ -1,107 +0,0 @@
-"""Library parent archive (#443, D152): prompts hidden from the shelf, restorable.
-
-A row means the Library parent is archived; no row means it is on the shelf.
-Nothing else about the prompt changes: its text, metadata, tags, run count,
-image links, pairs and recorded runs stay. Restore deletes the row. Deleting
-the prompt (any path) drops the row by cascade.
-
-A table of its own, not a column: ``prompt_library_state`` is validated by its
-exact definition, so a new column there would make older builds refuse the
-upgraded database, while older builds ignore an unknown table (they show the
-archived prompts again and keep the rows). Optional in old backups, required
-once a database is current.
-"""
-
-import re
-import sqlite3
-
-TABLE = "prompt_archive"
-MAX_STAMP_BYTES = 64
-# What ``utc_now_iso`` writes starts with a date; anything else was not written here.
-_STAMP_GLOB = "[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]T*"
-_DDL = (
-    f"CREATE TABLE {TABLE} (prompt_id INTEGER PRIMARY KEY, "
-    "archived_at TEXT NOT NULL, "
-    "FOREIGN KEY(prompt_id) REFERENCES prompts(id) ON DELETE CASCADE)"
-)
-_COLUMNS = (("prompt_id", "INTEGER", 0, 1), ("archived_at", "TEXT", 1, 0))
-_FOREIGN_KEYS = {("prompt_id", "prompts", "id", "CASCADE")}
-# A predicate on ``p`` (the prompts alias): the parent is not archived.
-SHELVED = f"NOT EXISTS(SELECT 1 FROM {TABLE} pa WHERE pa.prompt_id=p.id)"
-ARCHIVED = f"EXISTS(SELECT 1 FROM {TABLE} pa WHERE pa.prompt_id=p.id)"
-
-
-def _compact(sql: str) -> str:
-    return re.sub(r"\s+", "", sql or "").lower()
-
-
-def _structure_error(conn: sqlite3.Connection, allow_missing: bool) -> str | None:
-    objects = conn.execute(
-        "SELECT type,sql FROM sqlite_master WHERE name=? "
-        "OR (type IN ('index','trigger') AND tbl_name=?)",
-        (TABLE, TABLE),
-    ).fetchall()
-    if not objects:
-        return None if allow_missing else "Missing prompt archive schema"
-    tables = [sql for kind, sql in objects if kind == "table"]
-    if len(tables) != 1 or len(objects) != 1:
-        return "Prompt archive name is reserved by an unsupported schema object"
-    if _compact(tables[0]) != _compact(_DDL):
-        return "Prompt archive has an invalid table definition"
-    columns = tuple(
-        (row[1], row[2].upper(), row[3], row[5])
-        for row in conn.execute(f"PRAGMA table_info({TABLE})")
-    )
-    if columns != _COLUMNS:
-        return "Prompt archive has invalid columns"
-    foreign_keys = {
-        (row[3], row[2], row[4], row[6])
-        for row in conn.execute(f"PRAGMA foreign_key_list({TABLE})")
-    }
-    if foreign_keys != _FOREIGN_KEYS:
-        return "Prompt archive has invalid foreign key definitions"
-    return None
-
-
-def prompt_archive_schema_error(
-    conn: sqlite3.Connection, *, allow_missing: bool = True
-) -> str | None:
-    """Reject an unsupported archive schema or values; reads only.
-
-    A missing table is acceptable for backups that predate it unless
-    ``allow_missing`` is false.
-    """
-    error = _structure_error(conn, allow_missing)
-    if error is not None:
-        return error
-    if not conn.execute(
-        "SELECT 1 FROM sqlite_master WHERE type='table' AND name=?", (TABLE,)
-    ).fetchone():
-        return None
-    if conn.execute(f"PRAGMA foreign_key_check({TABLE})").fetchone():
-        return "Prompt archive contains foreign key violations"
-    if conn.execute(
-        f"SELECT 1 FROM {TABLE} WHERE typeof(archived_at)!='text' "  # nosec B608
-        f"OR length(CAST(archived_at AS BLOB))>{MAX_STAMP_BYTES} "
-        f"OR archived_at NOT GLOB '{_STAMP_GLOB}' LIMIT 1"
-    ).fetchone():
-        return "Prompt archive contains invalid values"
-    return None
-
-
-def migrate_prompt_archive(conn: sqlite3.Connection) -> None:
-    """Install the table atomically; validate before and after (no backfill)."""
-    conn.execute("SAVEPOINT prompt_archive_schema")
-    try:
-        error = _structure_error(conn, True)
-        if error:
-            raise sqlite3.DatabaseError(error)
-        conn.execute(_DDL.replace("CREATE TABLE", "CREATE TABLE IF NOT EXISTS", 1))
-        error = _structure_error(conn, False)
-        if error:
-            raise sqlite3.DatabaseError(error)
-        conn.execute("RELEASE prompt_archive_schema")
-    except BaseException:
-        conn.execute("ROLLBACK TO prompt_archive_schema")
-        conn.execute("RELEASE prompt_archive_schema")
-        raise
@@ -1,376 +0,0 @@
-"""A restore in two steps: stage the upload, then publish it (#249 System S8).
-
-**Stage** (``stage_restore``) never touches the live database or the source.
-In a new folder ``.pm-restore-*`` in the library's own folder (#318: never
-the system temp folder, which may be another disk), it:
-
-1. checks the source (``verify_database_file`` without reading every
-   workflow document: a damaged one is repaired below, not refused);
-2. copies it with SQLite's backup API (a rollback-journal file and a WAL file
-   alike) and opens the copy as a ``PromptModel``, which migrates an older
-   schema;
-3. repairs damaged workflow documents (``repair_damaged_documents``),
-   rotates the history epoch and counts what the copy holds;
-4. makes the copy one self-contained file and verifies it fully (every
-   current table, every document);
-5. records the copy's SHA-256, so publishing binds exactly these bytes.
-
-**Publish** (``publish_staged``) re-hashes the stage (``StageChanged`` if it
-differs), keeps the current database as a uniquely named, standalone safety
-backup beside it (``database/safety_backup.py``; not verified, because the
-database being replaced may be the damaged one), copies the stage over the
-live pages through the backup API (no file is swapped under open handles; an
-``OperationalError`` there leaves the live data intact, #226), then
-checkpoints the WAL with TRUNCATE so the copied pages do not leave a
-database-sized ``-wal`` behind. A reader that keeps a snapshot past the busy
-wait is logged, not fatal: the restore itself is done.
-
-Every handle on the stage is closed before its folder is removed (Windows).
-``sweep_restore_temps`` removes what an interrupted restore left (startup).
-"""
-
-import hashlib
-import logging
-import os
-import sqlite3
-import tempfile
-from contextlib import closing
-from dataclasses import dataclass, field
-from pathlib import Path
-from typing import Dict, Optional
-
-from . import workflow_documents as wd
-from .execution_history_schema import rotate_history_epoch
-from .safety_backup import take_safety_backup
-
-logger = logging.getLogger("prompt_manager.database.restore_stage")
-
-STAGE_PREFIX = ".pm-restore-"
-UPLOAD_PREFIX = ".pm-restore-upload-"
-STAGED_NAME = "staged.db"
-# How long the post-restore TRUNCATE checkpoint waits for readers to leave.
-CHECKPOINT_BUSY_MS = 30_000
-_HASH_CHUNK = 1024 * 1024
-SUMMARY_KEYS = (
-    "prompts",
-    "positives",
-    "pairs",
-    "archived_pairs",
-    "image_links",
-    "runs",
-    "saved_views",
-    "collections",
-)
-
-
-class StageChanged(ValueError):
-    """The staged file is no longer the bytes that were reviewed."""
-
-
-@dataclass
-class StagedRestore:
-    """A verified, migrated copy of an upload, ready to publish."""
-
-    path: str
-    digest: str
-    size: int
-    summary: Dict[str, int]
-    schema: Dict[str, bool]
-    documents: Dict[str, int] = field(
-        default_factory=lambda: {"repaired": 0, "cleared": 0, "images": 0}
-    )
-
-    @property
-    def directory(self) -> str:
-        return os.path.dirname(self.path)
-
-    def discard(self) -> None:
-        """Remove the stage folder (idempotent; its handles are all closed)."""
-        remove_stage_folder(self.directory)
-
-
-def remove_stage_folder(directory: str) -> None:
-    """Remove a stage folder and its files, logging what cannot be removed."""
-    if not directory or not os.path.isdir(directory):
-        return
-    for name in os.listdir(directory):
-        try:
-            os.remove(os.path.join(directory, name))
-        except OSError as error:
-            logger.warning(f"Could not remove restore stage file {name}: {error}")
-    try:
-        os.rmdir(directory)
-    except OSError as error:
-        logger.warning(f"Could not remove the restore stage folder: {error}")
-
-
-def file_digest(path: str) -> str:
-    """``sha256:<hex>`` of the file's bytes (blocking)."""
-    digest = hashlib.sha256()
-    with open(path, "rb") as handle:
-        for chunk in iter(lambda: handle.read(_HASH_CHUNK), b""):
-            digest.update(chunk)
-    return "sha256:" + digest.hexdigest()
-
-
-def _readonly(path: str) -> sqlite3.Connection:
-    return sqlite3.connect(Path(path).resolve().as_uri() + "?mode=ro", uri=True)
-
-
-def _schema(path: str) -> list:
-    """The file's schema objects, to tell whether staging migrated it."""
-    with closing(_readonly(path)) as conn:
-        return sorted(
-            conn.execute(
-                "SELECT type, name, tbl_name, sql FROM sqlite_master "
-                "WHERE name NOT LIKE 'sqlite_%'"
-            ).fetchall(),
-            key=repr,
-        )
-
-
-def _count(conn: sqlite3.Connection, table: str, where: str = "") -> int:
-    exists = conn.execute(
-        "SELECT 1 FROM sqlite_master WHERE type='table' AND name=?", (table,)
-    ).fetchone()
-    if not exists:
-        return 0
-    # ``table`` and ``where`` are constants of library_summary, never input.
-    return conn.execute(f"SELECT COUNT(*) FROM {table} {where}").fetchone()[0]  # nosec
-
-
-def library_summary(conn: sqlite3.Connection) -> Dict[str, int]:
-    """What a library holds, for a restore's review (reads only).
-
-    ``positives`` are the Library's prompts (``library_counts``'s
-    ``positive_prompts``); ``pairs`` the active saved pairs and
-    ``archived_pairs`` the archived ones; ``image_links`` the indexed image
-    rows; ``runs`` the recorded executions; ``collections`` the image
-    collections (#331).
-    """
-    from .library import _ELIGIBLE
-    from .prompt_archive import SHELVED, TABLE as ARCHIVE
-
-    has_state = conn.execute(
-        "SELECT 1 FROM sqlite_master WHERE type='table' AND "
-        "name='prompt_library_state'"
-    ).fetchone()
-    has_pairs = conn.execute(
-        "SELECT 1 FROM sqlite_master WHERE type='table' AND name='prompt_pairs'"
-    ).fetchone()
-    has_archive = conn.execute(
-        "SELECT 1 FROM sqlite_master WHERE type='table' AND name=?", (ARCHIVE,)
-    ).fetchone()
-    if has_state and has_pairs:
-        # Archived parents (#443) are off the shelf, as in library_counts.
-        positives = conn.execute(
-            "SELECT COUNT(*) FROM prompts p WHERE "
-            + _ELIGIBLE
-            + (" AND " + SHELVED if has_archive else "")
-        ).fetchone()[0]
-    else:
-        positives = _count(conn, "prompts")
-    return {
-        "prompts": _count(conn, "prompts"),
-        "positives": positives,
-        "pairs": _count(conn, "prompt_pairs", "WHERE archived=0"),
-        "archived_pairs": _count(conn, "prompt_pairs", "WHERE archived<>0"),
-        "image_links": _count(conn, "generated_images"),
-        "runs": _count(conn, "execution_runs"),
-        "saved_views": _count(conn, "saved_views"),
-        "collections": _count(conn, "image_collections"),
-    }
-
-
-# The newest row of each table a restore would overwrite: with the counts,
-# a write after the review (a new run, image, prompt or edit) changes it.
-_FINGERPRINT_SQL = (
-    ("prompts", "SELECT MAX(id), MAX(updated_at), MAX(last_used_at) FROM prompts"),
-    ("generated_images", "SELECT MAX(id) FROM generated_images"),
-    ("prompt_pairs", "SELECT MAX(id), MAX(updated_at) FROM prompt_pairs"),
-    ("execution_runs", "SELECT COUNT(*), MAX(rowid) FROM execution_runs"),
-    ("saved_views", "SELECT MAX(rowid) FROM saved_views"),
-    ("image_collections", "SELECT MAX(rowid) FROM image_collections"),
-)
-
-
-def live_fingerprint(conn: sqlite3.Connection):
-    """``(summary, fingerprint)`` of a live library, read in one snapshot.
-
-    The fingerprint changes when rows are added to or removed from the
-    tables a restore replaces, or when a prompt, pair, run or saved view is
-    the newest edited (counts plus the newest row and edit of each table);
-    the apply refuses with ``plan-changed`` then. It does not see every
-    edit (a tag, favorite or collection membership change on an older row);
-    those are kept in the restore's safety backup. A read transaction the
-    caller already has is used and left open; one opened here is ended here.
-    """
-    import json
-
-    opened = not conn.in_transaction
-    if opened:
-        conn.execute("BEGIN")  # one read snapshot for every count
-    try:
-        summary = library_summary(conn)
-        newest = []
-        for table, sql in _FINGERPRINT_SQL:
-            try:
-                newest.append([table, list(conn.execute(sql).fetchone())])
-            except sqlite3.OperationalError:
-                newest.append([table, None])  # no such table or column
-    finally:
-        if opened:
-            conn.rollback()  # it only read
-    text = json.dumps([summary, newest], sort_keys=True, default=str)
-    return summary, "sha256:" + hashlib.sha256(text.encode("utf-8")).hexdigest()
-
-
-def _copy(src_path: str, staged_path: str) -> None:
-    source = _readonly(src_path)
-    try:
-        with closing(sqlite3.connect(staged_path)) as destination:
-            source.backup(destination)
-    finally:
-        source.close()
-
-
-def _standalone(path: str) -> None:
-    with closing(sqlite3.connect(path)) as conn:
-        conn.execute("PRAGMA journal_mode=DELETE").fetchone()
-
-
-def stage_restore(model_cls, db_path: str, src_path: str) -> StagedRestore:
-    """Stage ``src_path`` beside ``db_path`` (blocking); see the module docstring.
-
-    Raises ValueError with a readable reason when the source or the migrated
-    stage does not verify; the stage folder is then already removed.
-    """
-    ok, reason = model_cls.verify_database_file(src_path, documents=False)
-    if not ok:
-        raise ValueError(reason)
-    before = _schema(src_path)
-    with closing(_readonly(src_path)) as conn:
-        library_state = bool(
-            conn.execute(
-                "SELECT 1 FROM sqlite_master WHERE type='table' AND "
-                "name='prompt_library_state'"
-            ).fetchone()
-        )
-    folder = os.path.dirname(os.path.abspath(db_path))
-    directory = tempfile.mkdtemp(prefix=STAGE_PREFIX, dir=folder)
-    staged_path = os.path.join(directory, STAGED_NAME)
-    staged_key = os.path.normcase(os.path.realpath(staged_path))
-    try:
-        _copy(src_path, staged_path)
-        staged = None
-        try:
-            staged = model_cls(staged_path)
-            conn = staged.get_connection()
-            documents = wd.repair_damaged_documents(conn)
-            rotate_history_epoch(conn)
-            summary = library_summary(conn)
-        finally:
-            if staged is not None:
-                staged.close_all()
-        _standalone(staged_path)
-        ok, reason = model_cls.verify_database_file(
-            staged_path, require_library_state=True
-        )
-        if not ok:
-            raise ValueError(reason)
-        result = StagedRestore(
-            path=staged_path,
-            digest=file_digest(staged_path),
-            size=os.path.getsize(staged_path),
-            summary=summary,
-            schema={
-                "migrated": _schema(staged_path) != before,
-                "library_state": library_state,
-            },
-            documents=documents,
-        )
-    except BaseException:
-        remove_stage_folder(directory)
-        raise
-    finally:
-        with model_cls._init_lock:
-            model_cls._initialized_paths.discard(staged_key)
-    return result
-
-
-def checkpoint_truncate(conn: sqlite3.Connection) -> bool:
-    """Checkpoint the WAL and truncate it to 0 bytes; False when a reader held it."""
-    previous = conn.execute("PRAGMA busy_timeout").fetchone()[0]
-    try:
-        conn.execute(f"PRAGMA busy_timeout = {int(CHECKPOINT_BUSY_MS)}")
-        busy = conn.execute("PRAGMA wal_checkpoint(TRUNCATE)").fetchone()[0]
-    finally:
-        conn.execute(f"PRAGMA busy_timeout = {int(previous)}")
-    return not busy
-
-
-def publish_staged(model, staged: StagedRestore) -> str:
-    """Publish ``staged`` over ``model``'s database; return the safety backup path.
-
-    "" when there was no database to back up. Raises StageChanged before
-    anything is written when the stage's bytes changed since staging, and
-    SafetyBackupFailed when the current database could not be kept. An
-    ``OperationalError`` from the page copy propagates with
-    ``_prompt_manager_restore_backup_created`` set; the live data is intact.
-    """
-    if not os.path.isfile(staged.path) or file_digest(staged.path) != staged.digest:
-        raise StageChanged("The staged restore changed since it was reviewed")
-    backup_path = ""
-    if os.path.exists(model.db_path):
-        backup_path = take_safety_backup(model, verify=False)
-        logger.info(f"Current database backed up to: {os.path.basename(backup_path)}")
-    try:
-        model._replace_contents_from(staged.path)
-    except sqlite3.OperationalError as exc:
-        exc._prompt_manager_restore_backup_created = bool(backup_path)
-        raise
-    with model._init_lock:
-        model._initialized_paths.add(model._schema_key())
-    _truncate_wal(model)
-    return backup_path
-
-
-def _truncate_wal(model) -> Optional[bool]:
-    """TRUNCATE-checkpoint the live WAL after a publish (never raises)."""
-    try:
-        conn = model.get_connection()
-        with conn.using():
-            truncated = checkpoint_truncate(conn)
-    except sqlite3.Error as error:
-        logger.warning(f"The database log could not be truncated: {error}")
-        return None
-    if not truncated:
-        logger.warning(
-            "The database log could not be truncated after the restore: a "
-            "reader kept it open. It shrinks at the next checkpoint with no "
-            "reader."
-        )
-    return truncated
-
-
-def sweep_restore_temps(db_path: str) -> list:
-    """Remove the stages and uploads an interrupted restore left (startup)."""
-    folder = os.path.dirname(os.path.abspath(db_path))
-    removed = []
-    try:
-        names = os.listdir(folder)
-    except OSError:
-        return removed
-    for name in names:
-        path = os.path.join(folder, name)
-        if name.startswith(UPLOAD_PREFIX) and os.path.isfile(path):
-            try:
-                os.remove(path)
-                removed.append(name)
-            except OSError:
-                continue
-        elif name.startswith(STAGE_PREFIX) and os.path.isdir(path):
-            remove_stage_folder(path)
-            if not os.path.exists(path):
-                removed.append(name)
-    return removed
@@ -1,648 +0,0 @@
-"""Needs review items (#249): persist and read capture-bound ambiguous evidence.
-
-An item is one ambiguous resolver result for one annotation byte record (the
-whole-file SHA-256 of one physical file at one locator), keyed by
-``(byte_id, resolver_version, evidence_hash)``. Recording is idempotent: the
-same evidence for the same bytes is a duplicate and never touches an existing
-item, its state, revision or decisions. Changed bytes are a new byte record
-and therefore a new pending item; the old one stays.
-
-Callers pass verified facts (the capture's digest, size and ``mtime_ns``);
-nothing here reads the filesystem. Writes run in one ``_pair_transaction``
-fenced by the storage epoch the capture was taken under.
-"""
-
-import hashlib
-import json
-import os
-import re
-import sqlite3
-from typing import Iterator
-
-try:
-    from ..utils.hashing import generate_prompt_hash
-except ImportError:
-    from utils.hashing import generate_prompt_hash
-
-from .annotation_schema import (
-    BYTES_TABLE,
-    FILES_TABLE,
-    METADATA_TABLE as ANNOTATION_METADATA_TABLE,
-)
-from .annotations import _new_id, _validate_locator, _validate_target
-from .models import normalize_image_path, utc_now_iso
-from .review_changes import notify_review_change
-from .review_schema import (
-    DECISIONS_TABLE,
-    ITEMS_TABLE,
-    MAX_CANDIDATES,
-    MAX_SPELLED_PATH_BYTES,
-    METADATA_TABLE,
-    canonical_evidence,
-    evidence_digest,
-    evidence_offers_choice,
-)
-
-# Only this module's table constants are interpolated into the SQL below.
-_INSERT_ITEM = (
-    f"INSERT OR IGNORE INTO {ITEMS_TABLE}(id,byte_id,spelled_path,"  # nosec B608
-    "resolver_version,evidence_hash,evidence,candidate_count,limited,state,"
-    "revision,created_at,updated_at) VALUES(?,?,?,?,?,?,?,?,'pending',0,?,?)"
-)
-_BUMP_REVIEW_INDEX = (
-    f"UPDATE {METADATA_TABLE} SET "  # nosec B608
-    "review_index_revision=review_index_revision+1 WHERE singleton_id=1"
-)
-# A later spelling of the same locator (a case-only rename on a case-folding
-# filesystem) replaces the recorded one, so targets keep formatting.
-_REFRESH_SPELLING = (
-    f"UPDATE {ITEMS_TABLE} SET spelled_path=? "  # nosec B608
-    f"WHERE spelled_path<>? AND byte_id IN (SELECT b.id FROM {BYTES_TABLE} b "
-    f"JOIN {FILES_TABLE} f ON f.id=b.file_id WHERE f.locator=?)"
-)
-_REVIEW_INDEX = (
-    f"SELECT review_index_revision FROM {METADATA_TABLE} "  # nosec B608
-    "WHERE singleton_id=1"
-)
-_BUMP_IMAGE_INDEX = (
-    f"UPDATE {ANNOTATION_METADATA_TABLE} SET "  # nosec B608
-    "image_index_revision=image_index_revision+1 WHERE singleton_id=1"
-)
-_ITEMS_OF_LOCATOR = (
-    "SELECT i.id,i.byte_id,i.resolver_version,i.evidence_hash,"  # nosec B608
-    "i.evidence,i.candidate_count,i.limited,i.state,i.revision,i.created_at,"
-    f"i.updated_at,b.sha256 FROM {FILES_TABLE} f "
-    f"JOIN {BYTES_TABLE} b ON b.file_id=f.id "
-    f"JOIN {ITEMS_TABLE} i ON i.byte_id=b.id "
-    "WHERE f.locator=? ORDER BY i.created_at,i.id"
-)
-_QUEUED = (
-    f"SELECT 1 FROM {FILES_TABLE} f "  # nosec B608
-    f"JOIN {BYTES_TABLE} b ON b.file_id=f.id "
-    f"JOIN {ITEMS_TABLE} i ON i.byte_id=b.id "
-    "WHERE f.locator=? AND b.size=? AND b.mtime_ns=? AND i.resolver_version=? "
-    "LIMIT 1"
-)
-_PENDING_AT = (
-    f"SELECT 1 FROM {FILES_TABLE} f "  # nosec B608
-    f"JOIN {BYTES_TABLE} b ON b.file_id=f.id "
-    f"JOIN {ITEMS_TABLE} i ON i.byte_id=b.id "
-    "WHERE f.locator=? AND b.size=? AND b.mtime_ns=? AND i.resolver_version=? "
-    "AND i.state='pending' LIMIT 1"
-)
-# Bytes verified at this stat whose item carries a decision (any version).
-_DECIDED_AT = (
-    f"SELECT 1 FROM {FILES_TABLE} f "  # nosec B608
-    f"JOIN {BYTES_TABLE} b ON b.file_id=f.id "
-    f"JOIN {ITEMS_TABLE} i ON i.byte_id=b.id "
-    "WHERE f.locator=? AND b.size=? AND b.mtime_ns=? "
-    "AND (i.state<>'pending' OR i.revision<>0 OR EXISTS (SELECT 1 FROM "
-    f"{DECISIONS_TABLE} d WHERE d.item_id=i.id)) LIMIT 1"
-)
-# The other items of one byte record (another version or evidence), with
-# whether each may be superseded: pending, revision 0, no decision row.
-_OTHER_ITEMS_OF_BYTES = (
-    "SELECT i.id, (i.state='pending' AND i.revision=0 AND NOT EXISTS "  # nosec B608
-    f"(SELECT 1 FROM {DECISIONS_TABLE} d WHERE d.item_id=i.id)) "
-    f"FROM {ITEMS_TABLE} i WHERE i.byte_id=? "
-    "AND NOT (i.resolver_version=? AND i.evidence_hash=?)"
-)
-# Pending items of the bytes verified at one stat, with their versions.
-_PENDING_AT_STAT = (
-    f"SELECT i.id,i.resolver_version FROM {FILES_TABLE} f "  # nosec B608
-    f"JOIN {BYTES_TABLE} b ON b.file_id=f.id "
-    f"JOIN {ITEMS_TABLE} i ON i.byte_id=b.id "
-    "WHERE f.locator=? AND b.size=? AND b.mtime_ns=? AND i.state='pending'"
-)
-# Pending items of one file: the candidates a link settles.
-_PENDING_OF_LOCATOR = (
-    f"SELECT i.id FROM {FILES_TABLE} f "  # nosec B608
-    f"JOIN {BYTES_TABLE} b ON b.file_id=f.id "
-    f"JOIN {ITEMS_TABLE} i ON i.byte_id=b.id "
-    "WHERE f.locator=? AND i.state='pending'"
-)
-# Pending items of one file with their evidence: an untraced file's settle.
-_PENDING_EVIDENCE_OF_LOCATOR = (
-    f"SELECT i.id,i.evidence FROM {FILES_TABLE} f "  # nosec B608
-    f"JOIN {BYTES_TABLE} b ON b.file_id=f.id "
-    f"JOIN {ITEMS_TABLE} i ON i.byte_id=b.id "
-    "WHERE f.locator=? AND i.state='pending'"
-)
-# Only an undecided item goes: a decision row (RESTRICT) is never deleted.
-_SETTLE_ITEM = (
-    f"DELETE FROM {ITEMS_TABLE} WHERE id=? AND state='pending' "  # nosec B608
-    f"AND revision=0 AND NOT EXISTS (SELECT 1 FROM {DECISIONS_TABLE} d "
-    f"WHERE d.item_id={ITEMS_TABLE}.id)"
-)
-_EPOCH = "SELECT storage_epoch FROM execution_history_metadata WHERE singleton_id=1"
-_PENDING_COUNT = (
-    f"SELECT COUNT(*) FROM {ITEMS_TABLE} WHERE state='pending'"  # nosec B608
-)
-_QUEUE_COLUMNS = (
-    "id",
-    "state",
-    "revision",
-    "created_at",
-    "candidate_count",
-    "limited",
-    "spelled_path",
-    "locator",
-)
-_QUEUE_SELECT = (
-    "SELECT i.id,i.state,i.revision,i.created_at,i.candidate_count,"  # nosec B608
-    f"i.limited,i.spelled_path,f.locator FROM {ITEMS_TABLE} i "
-    f"JOIN {BYTES_TABLE} b ON b.id=i.byte_id "
-    f"JOIN {FILES_TABLE} f ON f.id=b.file_id "
-)
-_QUEUE_FIRST = _QUEUE_SELECT + (
-    "WHERE i.state='pending' ORDER BY i.created_at,i.id LIMIT ?"
-)
-_QUEUE_AFTER = _QUEUE_SELECT + (
-    "WHERE i.state='pending' AND (i.created_at,i.id)>(?,?) "
-    "ORDER BY i.created_at,i.id LIMIT ?"
-)
-_DETAIL_COLUMNS = _QUEUE_COLUMNS + (
-    "byte_id",
-    "resolver_version",
-    "evidence_hash",
-    "evidence",
-    "updated_at",
-    "sha256",
-)
-_DETAIL = (
-    "SELECT i.id,i.state,i.revision,i.created_at,i.candidate_count,"  # nosec B608
-    "i.limited,i.spelled_path,f.locator,i.byte_id,i.resolver_version,"
-    "i.evidence_hash,i.evidence,i.updated_at,b.sha256 "
-    f"FROM {ITEMS_TABLE} i JOIN {BYTES_TABLE} b ON b.id=i.byte_id "
-    f"JOIN {FILES_TABLE} f ON f.id=b.file_id WHERE i.id=?"
-)
-# The legacy rows and pair links the ingester's compatibility rules read.
-_DEPENDENT_IMAGES = (
-    "SELECT gi.id,p.hash,gi.image_path FROM generated_images gi "
-    "JOIN prompts p ON p.id=gi.prompt_id "
-    "WHERE gi.file_path=? OR gi.image_path=? ORDER BY gi.id"
-)
-_DEPENDENT_LINKS = (
-    "SELECT DISTINCT ip.pair_id,n.hash FROM image_prompt_pairs ip "
-    "JOIN prompt_pairs pp ON pp.id=ip.pair_id "
-    "LEFT JOIN prompts n ON n.id=pp.negative_prompt_id "
-    "WHERE ip.image_id=? ORDER BY ip.pair_id"
-)
-# Rows whose spelling ends with the file's name: the candidates for another
-# spelling of the same physical file (the link summaries' filename fallback).
-_SAME_NAME_ROWS = (
-    "SELECT id,image_path FROM generated_images "
-    "WHERE image_path LIKE ? ESCAPE '\\' ORDER BY id"
-)
-_TITLES = (
-    "SELECT p.hash,s.title FROM prompts p "
-    "JOIN prompt_library_state s ON s.prompt_id=p.id "
-    "WHERE p.hash IN ({marks}) AND s.title IS NOT NULL ORDER BY p.id"
-)
-_ITEM_ID = re.compile(r"[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}")
-_ITEM_COLUMNS = (
-    "id",
-    "byte_id",
-    "resolver_version",
-    "evidence_hash",
-    "evidence",
-    "candidate_count",
-    "limited",
-    "state",
-    "revision",
-    "created_at",
-    "updated_at",
-    "sha256",
-)
-
-
-def _validate_spelling(spelled_path: object, locator: str) -> None:
-    if (
-        not isinstance(spelled_path, str)
-        or not spelled_path
-        or len(spelled_path.encode("utf-8", "surrogatepass")) > MAX_SPELLED_PATH_BYTES
-        or os.path.normcase(spelled_path) != locator
-    ):
-        raise ValueError("spelled_path must be the file's spelling of its locator")
-
-
-def dependent_images(conn: sqlite3.Connection, spellings) -> list:
-    """``(id, image_path, positive_hash)`` of every legacy row of the file.
-
-    ``spellings`` are the paths the file is linked under (the Apply path and
-    every alias of the same physical file); each is matched as the ingester
-    matches one path. Rows are distinct and ordered by id.
-    """
-    found = {}
-    for spelled in dict.fromkeys(spellings):
-        for row in conn.execute(
-            _DEPENDENT_IMAGES, (normalize_image_path(spelled), spelled)
-        ):
-            found[row[0]] = (row[0], row[2], row[1])
-    return [found[key] for key in sorted(found)]
-
-
-def same_name_rows(conn: sqlite3.Connection, name: str) -> list:
-    """``(id, image_path)`` of rows whose spelling may end with ``name``."""
-    # Imported here: operations composes this module's mixin.
-    from .operations import escape_like
-
-    return [
-        (row[0], row[1])
-        for row in conn.execute(_SAME_NAME_ROWS, (f"%{escape_like(name)}",))
-    ]
-
-
-def dependency_fingerprint(
-    conn: sqlite3.Connection, image_path: str, aliases=()
-) -> str:
-    """SHA-256 of what Apply's compatibility depends on for ``image_path``.
-
-    The exact legacy rows of the file under ``image_path`` and every alias
-    spelling of it, with their positive hashes, and each row's pair links
-    with the negative hash, read as the ingester reads them. Unrelated prompt
-    changes (tags, titles) do not move it.
-    """
-    rows = []
-    for image_id, _spelled, positive_hash in dependent_images(
-        conn, (image_path, *aliases)
-    ):
-        links = conn.execute(_DEPENDENT_LINKS, (image_id,)).fetchall()
-        rows.append([image_id, positive_hash, [list(link) for link in links]])
-    text = canonical_evidence({"v": 1, "images": rows})
-    return hashlib.sha256(text.encode("utf-8")).hexdigest()
-
-
-class ReviewOperations:
-    """PromptDatabase mixin: insert and read Needs review items."""
-
-    def record_review_item(
-        self,
-        *,
-        locator: str,
-        spelled_path: str,
-        sha256: str,
-        size: int,
-        mtime_ns: int,
-        epoch: str,
-        resolver_version: int,
-        evidence: dict,
-        candidate_count: int,
-        limited: bool,
-    ) -> bool:
-        """Store one ambiguous result for these exact bytes; True when new.
-
-        The byte record is created (or its verified fingerprint refreshed)
-        like an observe. ``spelled_path`` is the file's own spelling (it must
-        fold to ``locator``); targets are formatted from it. Raises
-        ``LibraryCommandError("storage-changed")`` when the storage epoch is
-        no longer ``epoch`` (a restore since the capture) and ``ValueError``
-        for invalid facts or evidence.
-
-        One file never holds two pending items for the same bytes: the new
-        item supersedes the byte record's other items (an older resolver or
-        semantics version) when every one is pending and undecided (the safe
-        delete of the self-heal); when one carries a decision or a later
-        revision, it is kept and nothing new is stored (False).
-        """
-        _validate_target(locator, sha256, size, mtime_ns)
-        _validate_spelling(spelled_path, locator)
-        if type(resolver_version) is not int or resolver_version < 1:
-            raise ValueError("resolver_version must be a positive integer")
-        if (
-            type(candidate_count) is not int
-            or not 0 <= candidate_count <= MAX_CANDIDATES
-        ):
-            raise ValueError(f"candidate_count must be between 0 and {MAX_CANDIDATES}")
-        if not isinstance(limited, bool) or (limited and candidate_count):
-            raise ValueError("A limited item carries no candidates")
-        text = canonical_evidence(evidence)
-        evidence_hash = evidence_digest(text)
-        with self._pair_transaction() as conn:
-            self._library_epoch(conn, epoch)
-            now = utc_now_iso()
-            file_id = self._annotation_owner(conn, locator, now)
-            byte_id, _revision, created, moved = self._annotation_byte(
-                conn, file_id, sha256, size, mtime_ns, now
-            )
-            if created or moved:
-                conn.execute(_BUMP_IMAGE_INDEX)
-            # The byte record is created or refreshed even when the item is
-            # refused below (an observe would do the same); that commits
-            # with the image index bump, and the review queue is unchanged.
-            others = conn.execute(
-                _OTHER_ITEMS_OF_BYTES, (byte_id, resolver_version, evidence_hash)
-            ).fetchall()
-            if any(not removable for _id, removable in others):
-                return False
-            superseded = sum(
-                conn.execute(_SETTLE_ITEM, (item_id,)).rowcount
-                for item_id, _removable in others
-            )
-            cursor = conn.execute(
-                _INSERT_ITEM,
-                (
-                    _new_id(),
-                    byte_id,
-                    spelled_path,
-                    resolver_version,
-                    evidence_hash,
-                    text,
-                    candidate_count,
-                    int(limited),
-                    now,
-                    now,
-                ),
-            )
-            inserted = cursor.rowcount > 0
-            refreshed = _refresh_spelling(conn, locator, spelled_path)
-            if inserted or refreshed or superseded:
-                conn.execute(_BUMP_REVIEW_INDEX)
-        if inserted or refreshed or superseded:
-            notify_review_change(self.model.db_path)
-        return inserted
-
-    def refresh_review_spelling(self, locator: str, spelled_path: str) -> bool:
-        """Record ``spelled_path`` as the spelling of every item at ``locator``.
-
-        The rescan's skip calls it for a file it does not copy again: a
-        case-only rename keeps size and ``mtime_ns``, and a target formatted
-        from the old spelling would be refused. True when a spelling changed
-        (the review index revision moves; item revisions do not, so an open
-        decision stays valid).
-        """
-        _validate_locator(locator)
-        _validate_spelling(spelled_path, locator)
-        with self._pair_transaction() as conn:
-            refreshed = _refresh_spelling(conn, locator, spelled_path)
-            if refreshed:
-                conn.execute(_BUMP_REVIEW_INDEX)
-        if refreshed:
-            notify_review_change(self.model.db_path)
-        return refreshed
-
-    def review_index_revision(self) -> int:
-        """The queue's revision (moved by every queue change)."""
-        row = self.model.get_connection().execute(_REVIEW_INDEX).fetchone()
-        if row is None:
-            raise sqlite3.DatabaseError("Missing review queue metadata")
-        return row[0]
-
-    def review_queue_version(self) -> dict:
-        """``{library_epoch, review_revision}`` of the queue, from one snapshot.
-
-        The pair a list read answers: equal pairs mean the same queue (a
-        restore moves the epoch, every queue change moves the revision).
-        """
-        with self._annotation_read() as conn:
-            epoch = conn.execute(_EPOCH).fetchone()
-            revision = conn.execute(_REVIEW_INDEX).fetchone()
-        if epoch is None or revision is None:
-            raise sqlite3.DatabaseError("Missing review queue metadata")
-        return {"library_epoch": epoch[0], "review_revision": revision[0]}
-
-    def review_items_for(self, locator: str) -> list:
-        """Every item of the file at ``locator``, oldest first, evidence parsed."""
-        _validate_locator(locator)
-        return list(self._iter_review_items(locator))
-
-    def _iter_review_items(self, locator: str) -> Iterator[dict]:
-        conn = self.model.get_connection()
-        for row in conn.execute(_ITEMS_OF_LOCATOR, (locator,)):
-            item = dict(zip(_ITEM_COLUMNS, tuple(row)))
-            item["evidence"] = json.loads(item["evidence"])
-            item["limited"] = bool(item["limited"])
-            yield item
-
-    # -- queue reads (#249 E3) -------------------------------------------------
-
-    def review_fingerprint_queued(
-        self, locator: str, size: int, mtime_ns: int, resolver_version: int
-    ) -> bool:
-        """True when an item cites a byte record verified at this exact stat.
-
-        A rescan uses it to skip the copy and hash of a file it already
-        queued: the same ``(size, mtime_ns)`` the bytes were verified with.
-        """
-        row = (
-            self.model.get_connection()
-            .execute(_QUEUED, (locator, size, mtime_ns, resolver_version))
-            .fetchone()
-        )
-        return row is not None
-
-    def review_decided_at(self, locator: str, size: int, mtime_ns: int) -> bool:
-        """True when bytes verified at this stat carry a decided item.
-
-        Any version: a newer resolver or table never adds an item beside a
-        decision, so the rescan need not copy those bytes again.
-        """
-        row = (
-            self.model.get_connection()
-            .execute(_DECIDED_AT, (locator, size, mtime_ns))
-            .fetchone()
-        )
-        return row is not None
-
-    def review_pending_at(
-        self, locator: str, size: int, mtime_ns: int, resolver_version: int
-    ) -> bool:
-        """True when a *pending* item cites bytes verified at this exact stat.
-
-        ``review_fingerprint_queued`` also matches decided items; a file whose
-        only item is decided is not in the queue.
-        """
-        row = (
-            self.model.get_connection()
-            .execute(_PENDING_AT, (locator, size, mtime_ns, resolver_version))
-            .fetchone()
-        )
-        return row is not None
-
-    def review_file_linked(self, spellings) -> bool:
-        """True when a saved row links the file under any of ``spellings``."""
-        with self._annotation_read() as conn:
-            return bool(dependent_images(conn, spellings))
-
-    def settle_linked_review_items(self, files) -> int:
-        """Remove the pending, undecided items of files that are now linked.
-
-        ``files`` holds ``(locator, spellings)`` per file. An item leaves the
-        queue only when it is still ``pending`` at revision 0 with no decision
-        row and a saved row links its file under one of ``spellings``; a
-        decided item is never touched. Files without a pending item cost one
-        indexed read and open no write transaction. Returns how many items
-        were removed (the review index revision moves when any was).
-        """
-        files = [(locator, tuple(spellings)) for locator, spellings in files]
-        for locator, _spellings in files:
-            _validate_locator(locator)
-        conn = self.model.get_connection()
-        candidates = [
-            (locator, spellings)
-            for locator, spellings in files
-            if conn.execute(_PENDING_OF_LOCATOR, (locator,)).fetchone() is not None
-        ]
-        if not candidates:
-            return 0
-        removed = 0
-        with self._pair_transaction() as conn:
-            for locator, spellings in candidates:
-                if not dependent_images(conn, spellings):
-                    continue
-                for (item_id,) in conn.execute(
-                    _PENDING_OF_LOCATOR, (locator,)
-                ).fetchall():
-                    removed += conn.execute(_SETTLE_ITEM, (item_id,)).rowcount
-            if removed:
-                conn.execute(_BUMP_REVIEW_INDEX)
-        if removed:
-            notify_review_change(self.model.db_path)
-        return removed
-
-    def settle_stale_review_items(
-        self, locator: str, size: int, mtime_ns: int, versions
-    ) -> int:
-        """Remove pending, undecided items of the bytes verified at this stat
-        whose ``resolver_version`` is not one of ``versions``.
-
-        The caller found these bytes untraced under the current versions, so
-        an older version's item could only refuse Apply. The same safe delete
-        as the other settles; one indexed read when nothing is pending.
-        """
-        _validate_locator(locator)
-        current = set(versions)
-        conn = self.model.get_connection()
-        stale = [
-            item_id
-            for item_id, version in conn.execute(
-                _PENDING_AT_STAT, (locator, size, mtime_ns)
-            )
-            if version not in current
-        ]
-        if not stale:
-            return 0
-        removed = 0
-        with self._pair_transaction() as conn:
-            for item_id in stale:
-                removed += conn.execute(_SETTLE_ITEM, (item_id,)).rowcount
-            if removed:
-                conn.execute(_BUMP_REVIEW_INDEX)
-        if removed:
-            notify_review_change(self.model.db_path)
-        return removed
-
-    def settle_untraced_review_items(self, locators) -> int:
-        """Remove the pending, undecided items that offer nothing to choose.
-
-        ``locators`` are files the caller found ambiguous without a choice
-        (fewer than two candidates carry a prompt). Of their items, one leaves
-        the queue only when its own stored evidence offers no choice either
-        (``evidence_offers_choice``) and it is still ``pending`` at revision 0
-        with no decision row, the same safe delete as
-        ``settle_linked_review_items``. Files without a pending item cost one
-        indexed read and open no write transaction. Returns how many items
-        were removed (the review index revision moves when any was).
-        """
-        locators = list(locators)
-        for locator in locators:
-            _validate_locator(locator)
-        conn = self.model.get_connection()
-        pending = [
-            locator
-            for locator in locators
-            if conn.execute(_PENDING_OF_LOCATOR, (locator,)).fetchone() is not None
-        ]
-        if not pending:
-            return 0
-        removed = 0
-        with self._pair_transaction() as conn:
-            for locator in pending:
-                rows = conn.execute(_PENDING_EVIDENCE_OF_LOCATOR, (locator,)).fetchall()
-                for item_id, evidence in rows:
-                    if evidence_offers_choice(json.loads(evidence)):
-                        continue
-                    removed += conn.execute(_SETTLE_ITEM, (item_id,)).rowcount
-            if removed:
-                conn.execute(_BUMP_REVIEW_INDEX)
-        return removed
-
-    def review_queue_page(self, *, limit: int, after: tuple | None = None) -> dict:
-        """One page of pending items, oldest first, from one snapshot.
-
-        ``after`` is the ``(created_at, id)`` keyset of the last item already
-        shown. Returns ``{epoch, revision, total, items, more}``; ``total`` is
-        the exact pending count and ``items`` carry their ``spelled_path`` and
-        ``locator`` (server-side only).
-        """
-        if type(limit) is not int or limit < 1:
-            raise ValueError("limit must be a positive integer")
-        with self._annotation_read() as conn:
-            epoch = conn.execute(_EPOCH).fetchone()
-            revision = conn.execute(_REVIEW_INDEX).fetchone()
-            if epoch is None or revision is None:
-                raise sqlite3.DatabaseError("Missing review queue metadata")
-            total = conn.execute(_PENDING_COUNT).fetchone()[0]
-            if after is None:
-                rows = conn.execute(_QUEUE_FIRST, (limit + 1,)).fetchall()
-            else:
-                rows = conn.execute(_QUEUE_AFTER, (*after, limit + 1)).fetchall()
-        items = [_queue_row(row, _QUEUE_COLUMNS) for row in rows[:limit]]
-        return {
-            "epoch": epoch[0],
-            "revision": revision[0],
-            "total": total,
-            "items": items,
-            "more": len(rows) > limit,
-        }
-
-    def review_item(self, item_id: str) -> dict | None:
-        """One item with its parsed evidence and the pending total, or None."""
-        if not isinstance(item_id, str) or _ITEM_ID.fullmatch(item_id) is None:
-            return None
-        with self._annotation_read() as conn:
-            epoch = conn.execute(_EPOCH).fetchone()
-            if epoch is None:
-                raise sqlite3.DatabaseError("Missing execution history metadata")
-            row = conn.execute(_DETAIL, (item_id,)).fetchone()
-            if row is None:
-                return None
-            item = _queue_row(row, _DETAIL_COLUMNS)
-            item["evidence"] = json.loads(item["evidence"])
-            item["epoch"] = epoch[0]
-            item["total"] = conn.execute(_PENDING_COUNT).fetchone()[0]
-        return item
-
-    def review_dependency_fingerprint(self, image_path: str, aliases=()) -> str:
-        with self._annotation_read() as conn:
-            return dependency_fingerprint(conn, image_path, aliases)
-
-    def review_same_name_rows(self, name: str) -> list:
-        """``(id, image_path)`` of legacy rows that may spell a file ``name``."""
-        with self._annotation_read() as conn:
-            return same_name_rows(conn, name)
-
-    def stored_prompt_titles(self, texts) -> dict:
-        """Library titles of saved prompts by text (dedup hash), when set."""
-        hashes = {generate_prompt_hash(text): text for text in texts if text.strip()}
-        if not hashes:
-            return {}
-        marks = ",".join("?" * len(hashes))
-        found: dict[str, tuple] = {}
-        conn = self.model.get_connection()
-        for prompt_hash, title in conn.execute(
-            _TITLES.format(marks=marks), list(hashes)
-        ):
-            text = hashes[prompt_hash]
-            found[text] = found.get(text, ()) + (title,)
-        return found
-
-
-def _refresh_spelling(conn: sqlite3.Connection, locator: str, spelled: str) -> bool:
-    return conn.execute(_REFRESH_SPELLING, (spelled, spelled, locator)).rowcount > 0
-
-
-def _queue_row(row, columns) -> dict:
-    item = dict(zip(columns, tuple(row)))
-    item["limited"] = bool(item["limited"])
-    return item
@@ -1,75 +0,0 @@
-"""Needs review queue change notices (#249 PR F2).
-
-Every committed change to the pending queue (an item recorded by the scan or
-the monitor, a spelling refresh, a decision) calls ``notify_review_change``
-after its transaction, from whichever thread wrote it. The review event
-stream (``py/api/review_events.py``) subscribes, so an open Needs review page
-re-reads its queue when it changes instead of polling. Observers are keyed by
-the database file, like ``subscribe_history_restore``; an observer that fails
-is logged and never fails the write.
-"""
-
-import os
-import threading
-from typing import Callable
-
-try:
-    from ..utils.logging_config import get_logger
-except ImportError:
-    from utils.logging_config import get_logger
-
-_logger = get_logger("prompt_manager.database.review_changes")
-_lock = threading.Lock()
-_observers: dict[str, dict[object, Callable[[], None]]] = {}
-
-
-def _identity(db_path: str) -> str:
-    return os.path.normcase(os.path.realpath(db_path))
-
-
-def subscribe_review_changes(
-    db_path: str, callback: Callable[[], None]
-) -> Callable[[], None]:
-    """Call ``callback()`` after each committed queue change; return the unsubscribe."""
-    identity = _identity(db_path)
-    token = object()
-    with _lock:
-        _observers.setdefault(identity, {})[token] = callback
-
-    def unsubscribe() -> None:
-        with _lock:
-            observers = _observers.get(identity)
-            if observers is not None:
-                observers.pop(token, None)
-                if not observers:
-                    _observers.pop(identity, None)
-
-    return unsubscribe
-
-
-def observer_count(db_path: str) -> int:
-    """How many observers watch ``db_path`` (tests and diagnostics)."""
-    with _lock:
-        return len(_observers.get(_identity(db_path), {}))
-
-
-def notify_review_change(db_path: str) -> None:
-    """Tell every observer of ``db_path``; call it after the commit."""
-    with _lock:
-        callbacks = tuple(_observers.get(_identity(db_path), {}).values())
-    for callback in callbacks:
-        try:
-            callback()
-        except Exception:
-            _logger.warning("Needs review change observer failed", exc_info=True)
-
-
-def rekey_review_changes(old_path: str, new_path: str) -> None:
-    """Move the observers of ``old_path`` to ``new_path`` (Move library)."""
-    old, new = _identity(old_path), _identity(new_path)
-    if old == new:
-        return
-    with _lock:
-        observers = _observers.pop(old, None)
-        if observers:
-            _observers.setdefault(new, {}).update(observers)
@@ -1,397 +0,0 @@
-"""Needs review decisions (#249 E3): explicit, auditable and compatible-only.
-
-A decision is one row of ``media_review_decisions`` for one item revision.
-``selected`` links the chosen candidate's pair to the file through the public
-ingester's compatible-only rules (``_ingest_resolved_pair_in``) in the same
-``_pair_transaction`` as the decision row, the item's new state and revision
-and the review index revision; any conflict or later failure rolls all of it
-back. ``manual`` (#536) is the same but for a Library prompt the reviewer chose:
-its link's provenance names a manual choice and carries no prompt sides, so it
-cannot pose as file evidence, and the decision's ``candidate_hash`` (the table
-requires one) is the digest of that choice. ``unresolved`` records the decision
-and links nothing. No decision counts a run, touches usage or calls an execution
-writer.
-
-Callers verify the file first (the capture must be the item's bytes and the
-current file must still hash to them); nothing here reads the filesystem.
-"""
-
-import os
-import sqlite3
-
-from .annotation_schema import BYTES_TABLE
-from .annotations import _new_id
-from .library import _ELIGIBLE, _FROM, SHELVED
-from .library_commands import LibraryCommandError
-from .models import utc_now_iso
-from .review import (
-    _BUMP_REVIEW_INDEX,
-    _DETAIL,
-    _DETAIL_COLUMNS,
-    _PENDING_COUNT,
-    _queue_row,
-    dependency_fingerprint,
-    dependent_images,
-    same_name_rows,
-)
-from .review_changes import notify_review_change
-from .review_schema import (
-    DECISIONS_TABLE,
-    ITEMS_TABLE,
-    canonical_evidence,
-    evidence_digest,
-)
-
-DECISION_KIND = "user-selection"
-MANUAL_KIND = "manual-link"
-_MANUAL_POSITIVE = (
-    f"SELECT p.id,p.text FROM {_FROM} "  # nosec B608
-    f"WHERE p.id=? AND {_ELIGIBLE} AND {SHELVED}"
-)
-_MANUAL_PAIR = (
-    "SELECT COALESCE(n.text,'') AS negative FROM prompt_pairs pp "
-    "LEFT JOIN prompts n ON n.id=pp.negative_prompt_id "
-    "WHERE pp.id=? AND pp.positive_prompt_id=? AND pp.archived=0"
-)
-_ARCHIVED_BARE_PAIR = (
-    "SELECT 1 FROM prompt_pairs WHERE positive_prompt_id=? "
-    "AND negative_prompt_id IS NULL AND archived=1"
-)
-_INSERT_DECISION = (
-    f"INSERT INTO {DECISIONS_TABLE}(id,item_id,decision_revision,"  # nosec B608
-    "created_at,outcome,candidate_hash,evidence,pair_id,image_id) "
-    "VALUES(?,?,?,?,?,?,?,?,?)"
-)
-_ADVANCE_ITEM = (
-    f"UPDATE {ITEMS_TABLE} SET state=?,revision=revision+1,"  # nosec B608
-    "updated_at=? WHERE id=? AND revision=?"
-)
-_ITEM_BYTES = (
-    f"SELECT b.sha256 FROM {ITEMS_TABLE} i "  # nosec B608
-    f"JOIN {BYTES_TABLE} b ON b.id=i.byte_id WHERE i.id=?"
-)
-
-
-class ReviewCommandError(LibraryCommandError):
-    """A decision lost a race or would rewrite an association.
-
-    ``code`` is ``review-conflict`` (the item was decided or changed since it
-    was read), ``association-conflict`` (the choice is not compatible with
-    the file's saved links, or those links changed), ``file-changed`` (the
-    item is not about these bytes) or ``review-missing``. ``item`` is the
-    current item read inside the transaction, ``total`` the pending count and
-    ``fingerprint`` the current dependency fingerprint, when known;
-    ``changed`` marks an association conflict caused by links that changed
-    since the reviewer read them (rather than an incompatible choice).
-    ``prompt-missing``: the Library prompt or recipe of a manual link is gone,
-    archived or not that prompt's.
-    """
-
-    def __init__(
-        self, code, epoch, *, item=None, total=None, fingerprint=None, changed=False
-    ):
-        super().__init__(code, epoch)
-        self.item = item
-        self.total = total
-        self.fingerprint = fingerprint
-        self.changed = changed
-        # The public view of ``item``, set by the API when it formats one.
-        self.view = None
-
-
-class _Rollback(Exception):
-    """Raised inside the transaction so the context manager rolls back."""
-
-    def __init__(self, error: ReviewCommandError):
-        super().__init__(error.code)
-        self.error = error
-
-
-class ReviewDecisionOperations:
-    """PromptDatabase mixin: record one decision on one Needs review item."""
-
-    def decide_review_item(
-        self,
-        *,
-        item_id: str,
-        expected_epoch: str,
-        expected_revision: int,
-        sha256: str,
-        outcome: str,
-        candidate: dict | None = None,
-        manual: dict | None = None,
-        image_path: str | None = None,
-        metadata: dict | None = None,
-        expected_fingerprint: str | None = None,
-        aliases: tuple = (),
-        known_rows: frozenset | None = None,
-    ) -> dict:
-        """Record the decision; return ``{item, total, pair}``.
-
-        ``selected`` needs the evidence ``candidate`` (with its ``hash``) or
-        ``manual`` (``{positive_id, pair_id}``; a null ``pair_id`` is no
-        negative), the
-        ``image_path`` the scan and the monitor link under, the captured
-        ``metadata`` and the ``expected_fingerprint`` the reviewer saw.
-        ``aliases`` are the other spellings legacy rows of the same physical
-        file use (a symlinked, junctioned or mapped root) and ``known_rows``
-        the ids of every same-name row the caller classified; a same-name row
-        it did not see is a changed association.
-        Raises ``LibraryCommandError("storage-changed")`` after a restore and
-        :class:`ReviewCommandError` for every refused decision, with zero
-        writes either way.
-        """
-        if outcome not in ("selected", "unresolved"):
-            raise ValueError("outcome must be selected or unresolved")
-        if outcome == "selected" and (
-            (not isinstance(candidate, dict)) == (not isinstance(manual, dict))
-            or not image_path
-        ):
-            raise ValueError(
-                "A selected decision needs one candidate or manual choice and a file"
-            )
-        try:
-            with self._pair_transaction() as conn:
-                decided = self._decide_in(
-                    conn,
-                    item_id=item_id,
-                    expected_epoch=expected_epoch,
-                    expected_revision=expected_revision,
-                    sha256=sha256,
-                    outcome=outcome,
-                    candidate=candidate,
-                    manual=manual,
-                    image_path=image_path,
-                    metadata=metadata or {},
-                    expected_fingerprint=expected_fingerprint,
-                    aliases=tuple(aliases),
-                    known_rows=known_rows,
-                )
-        except _Rollback as rollback:
-            raise rollback.error from None
-        # After the commit: open Needs review pages re-read their queue.
-        notify_review_change(self.model.db_path)
-        return decided
-
-    def _decide_in(self, conn: sqlite3.Connection, **command) -> dict:
-        epoch = self._library_epoch(conn, command["expected_epoch"])
-        item_id = command["item_id"]
-        current = _current_item(conn, item_id)
-        if current is None:
-            raise _Rollback(ReviewCommandError("review-missing", epoch))
-        total = conn.execute(_PENDING_COUNT).fetchone()[0]
-        if (
-            current["state"] != "pending"
-            or current["revision"] != command["expected_revision"]
-        ):
-            raise _Rollback(
-                ReviewCommandError("review-conflict", epoch, item=current, total=total)
-            )
-        if conn.execute(_ITEM_BYTES, (item_id,)).fetchone()[0] != command["sha256"]:
-            raise _Rollback(ReviewCommandError("file-changed", epoch))
-        decision_id = _new_id()
-        pair = None
-        selected = command["outcome"] == "selected"
-        candidate = command["candidate"] if selected else None
-        manual = command["manual"] if selected else None
-        candidate_hash = candidate["hash"] if candidate is not None else None
-        if candidate is not None:
-            pair = self._apply_candidate(
-                conn, epoch, current, decision_id, total, **command
-            )
-        elif manual is not None:
-            pair = self._apply_manual(
-                conn, epoch, current, decision_id, total, **command
-            )
-            manual = {"positive_id": manual["positive_id"], "pair_id": pair["id"]}
-            candidate_hash = evidence_digest(
-                canonical_evidence({"kind": MANUAL_KIND, **manual})
-            )
-        evidence = {
-            "kind": MANUAL_KIND if manual is not None else DECISION_KIND,
-            "decision_id": decision_id,
-            "outcome": command["outcome"],
-            "reviewed_digest": command["sha256"],
-            "item_evidence_hash": current["evidence_hash"],
-            "resolver_version": current["resolver_version"],
-            "candidate": candidate,
-            "dependency_fingerprint": command["expected_fingerprint"],
-            "pair": pair,
-        }
-        if manual is not None:
-            evidence["manual"] = manual
-        now = utc_now_iso()
-        self._insert_review_decision(
-            conn,
-            (
-                decision_id,
-                item_id,
-                current["revision"] + 1,
-                now,
-                command["outcome"],
-                candidate_hash,
-                canonical_evidence(evidence),
-                pair["id"] if pair else None,
-                pair["image_id"] if pair else None,
-            ),
-        )
-        conn.execute(
-            _ADVANCE_ITEM, (command["outcome"], now, item_id, current["revision"])
-        )
-        conn.execute(_BUMP_REVIEW_INDEX)
-        return {
-            "item": _current_item(conn, item_id),
-            "total": conn.execute(_PENDING_COUNT).fetchone()[0],
-            "pair": pair,
-            "decision_id": decision_id,
-        }
-
-    def _apply_candidate(
-        self, conn, epoch, current, decision_id, total, **command
-    ) -> dict:
-        """Link the candidate's pair, compatible-only; raise on any conflict."""
-        candidate = command["candidate"]
-        positive, negative = candidate["positive"], candidate["negative"]
-        provenance = {
-            "kind": DECISION_KIND,
-            "decision_id": decision_id,
-            "reviewed_digest": command["sha256"],
-            "candidate_hash": candidate["hash"],
-            "resolver_version": current["resolver_version"],
-            "positive": positive,
-            "negative": negative,
-        }
-        return self._link_compatible(
-            conn, epoch, current, total, positive, negative, provenance, command
-        )
-
-    def _apply_manual(self, conn, epoch, current, decision_id, total, **command):
-        """Link the chosen Library prompt, compatible-only; raise otherwise."""
-        missing = _Rollback(
-            ReviewCommandError("prompt-missing", epoch, item=current, total=total)
-        )
-        positive_id = command["manual"]["positive_id"]
-        pair_id = command["manual"]["pair_id"]
-        row = conn.execute(_MANUAL_POSITIVE, (positive_id,)).fetchone()
-        if row is None:
-            raise missing
-        positive_text, negative_text = row[1], ""
-        if pair_id is not None:
-            chosen = conn.execute(_MANUAL_PAIR, (pair_id, positive_id)).fetchone()
-            if chosen is None:
-                raise missing
-            negative_text = chosen[0]
-        elif conn.execute(_ARCHIVED_BARE_PAIR, (positive_id,)).fetchone():
-            raise missing
-        provenance = {
-            "kind": MANUAL_KIND,
-            "decision_id": decision_id,
-            "reviewed_digest": command["sha256"],
-            "resolver_version": current["resolver_version"],
-            "positive_id": positive_id,
-            "pair_id": pair_id,
-        }
-        # The sides name no provenance: only the ingester reads them.
-        pair = self._link_compatible(
-            conn,
-            epoch,
-            current,
-            total,
-            {"text": positive_text},
-            {"text": negative_text},
-            provenance,
-            command,
-        )
-        # A prompt whose stored hash is stale reaches another row: never link that.
-        reached = conn.execute(
-            "SELECT positive_prompt_id FROM prompt_pairs WHERE id=?", (pair["id"],)
-        ).fetchone()[0]
-        if reached != positive_id or pair_id not in (None, pair["id"]):
-            raise missing
-        return pair
-
-    def _link_compatible(
-        self,
-        conn,
-        epoch,
-        current,
-        total,
-        positive,
-        negative,
-        provenance,
-        command,
-    ) -> dict:
-        # Imported here: pair_ingestion imports operations, which composes this.
-        from .pair_ingestion import _ingest_resolved_pair_in
-
-        image_path = command["image_path"]
-        aliases = command["aliases"]
-        fingerprint = dependency_fingerprint(conn, image_path, aliases)
-        known = command["known_rows"]
-        unseen = known is not None and any(
-            row_id not in known
-            for row_id, _path in same_name_rows(conn, os.path.basename(image_path))
-        )
-        if unseen or fingerprint != command["expected_fingerprint"]:
-            raise _Rollback(
-                ReviewCommandError(
-                    "association-conflict",
-                    epoch,
-                    item=current,
-                    total=total,
-                    fingerprint=fingerprint,
-                    changed=True,
-                )
-            )
-        rows = dependent_images(conn, (image_path, *aliases))
-        if len(rows) > 1:
-            # One file linked under several spellings: no single row to enrich.
-            raise _Rollback(
-                ReviewCommandError(
-                    "association-conflict",
-                    epoch,
-                    item=current,
-                    total=total,
-                    fingerprint=fingerprint,
-                )
-            )
-        if rows:
-            # Enrich the one row of this file under the spelling it was
-            # linked with, so the ingester's compatibility rules see it.
-            image_path = rows[0][1]
-        result = _ingest_resolved_pair_in(
-            conn,
-            self,
-            image_path,
-            command["metadata"],
-            {"state": "resolved", "positive": positive, "negative": negative},
-            provenance=provenance,
-        )
-        if result["status"] == "conflict":
-            raise _Rollback(
-                ReviewCommandError(
-                    "association-conflict",
-                    epoch,
-                    item=current,
-                    total=total,
-                    fingerprint=fingerprint,
-                )
-            )
-        return {
-            "id": result["pair_id"],
-            "image_id": result["image_id"],
-            "status": result["status"],
-        }
-
-    @staticmethod
-    def _insert_review_decision(conn: sqlite3.Connection, values: tuple) -> None:
-        conn.execute(_INSERT_DECISION, values)
-
-
-def _current_item(conn: sqlite3.Connection, item_id: str) -> dict | None:
-    row = conn.execute(_DETAIL, (item_id,)).fetchone()
-    if row is None:
-        return None
-    item = _queue_row(row, _DETAIL_COLUMNS)
-    item.pop("evidence")
-    return item
@@ -1,515 +0,0 @@
-"""Needs review schema group (#249): capture-bound ambiguous items and decisions.
-
-The group installs like ``image_annotations``: optional in old backups,
-required once a database is current, and valid only beside a valid image
-annotation group, because every item cites one annotation byte record. It owns
-
- ``media_review_metadata``: one row, the group's schema version and the
-  review index revision (moved by every queue change);
- ``media_review_items``: one ambiguous resolver result for one byte record,
-  keyed by ``(byte_id, resolver_version, evidence_hash)``, with the file's
-  spelling when it was recorded (the locator is case-folded on Windows, a
-  target is not), its canonical evidence, candidate count, ``limited`` flag,
-  state and revision;
- ``media_review_decisions``: the auditable decision history of an item, one
-  row per decision revision, with optional navigation to the pair and image
-  the decision linked (nulled, never cascaded, when those are deleted).
-
-Evidence is canonical JSON (:func:`canonical_evidence`): one object, sorted
-keys, no whitespace, ASCII only (so characters, bytes and the 8 MiB bound
-agree and lone surrogates survive), no NaN or infinity. ``evidence_hash`` is
-the SHA-256 of the item's evidence text.
-
-Installation never backfills anything and never touches the filesystem.
-Validation reads only: catalog objects compared after whitespace compaction,
-columns and foreign keys through the PRAGMAs, persisted values in single
-bounded SQL passes, then one streamed pass that re-canonicalizes each evidence
-document (one row in memory at a time).
-"""
-
-import hashlib
-import json
-import re
-import sqlite3
-from typing import Any, Optional
-
-from .annotation_schema import BYTES_TABLE
-from .annotation_schema import TABLES as ANNOTATION_TABLES
-from .annotation_schema import _catalog as _annotation_catalog
-from .annotation_schema import annotation_schema_error
-
-try:
-    from ..utils.json_strict import dumps_strict
-except ImportError:
-    from utils.json_strict import dumps_strict
-
-SCHEMA_VERSION = 1
-METADATA_TABLE = "media_review_metadata"
-ITEMS_TABLE = "media_review_items"
-DECISIONS_TABLE = "media_review_decisions"
-TABLES = (METADATA_TABLE, ITEMS_TABLE, DECISIONS_TABLE)
-MAX_EVIDENCE_BYTES = 8 * 1024 * 1024
-MAX_CANDIDATES = 16
-# The file's own spelling when it was recorded (bytes of UTF-8 text). Locators
-# are case-folded on Windows, so a target is formatted from this instead.
-MAX_SPELLED_PATH_BYTES = 16384
-ITEM_STATES = ("pending", "selected", "unresolved")
-DECISION_OUTCOMES = ("selected", "unresolved")
-_TIMESTAMP_BYTES = 64
-_HEX64 = "length({c})=64 AND {c} NOT GLOB '*[^0-9a-f]*'"
-_EVIDENCE_CHECK = f"CHECK(length(CAST(evidence AS BLOB)) <= {MAX_EVIDENCE_BYTES})"
-
-_TABLE_DDL = {
-    METADATA_TABLE: (
-        f"CREATE TABLE {METADATA_TABLE} (singleton_id INTEGER PRIMARY KEY "
-        "CHECK(singleton_id=1), schema_version INTEGER NOT NULL "
-        f"CHECK(schema_version={SCHEMA_VERSION}), "
-        "review_index_revision INTEGER NOT NULL DEFAULT 0 "
-        "CHECK(review_index_revision>=0))"
-    ),
-    ITEMS_TABLE: (
-        f"CREATE TABLE {ITEMS_TABLE} (id TEXT PRIMARY KEY CHECK(length(id)=36), "
-        f"byte_id TEXT NOT NULL REFERENCES {BYTES_TABLE}(id) ON DELETE RESTRICT, "
-        "spelled_path TEXT NOT NULL CHECK(length(CAST(spelled_path AS BLOB)) "
-        f"BETWEEN 1 AND {MAX_SPELLED_PATH_BYTES}), "
-        "resolver_version INTEGER NOT NULL, evidence_hash TEXT NOT NULL "
-        f"CHECK({_HEX64.format(c='evidence_hash')}), "
-        f"evidence TEXT NOT NULL {_EVIDENCE_CHECK}, "
-        "candidate_count INTEGER NOT NULL "
-        f"CHECK(candidate_count BETWEEN 0 AND {MAX_CANDIDATES}), "
-        "limited INTEGER NOT NULL CHECK(limited IN (0,1)), "
-        "state TEXT NOT NULL CHECK(state IN ('pending','selected','unresolved')), "
-        "revision INTEGER NOT NULL CHECK(revision>=0), created_at TEXT NOT NULL, "
-        "updated_at TEXT NOT NULL, UNIQUE(byte_id, resolver_version, evidence_hash))"
-    ),
-    DECISIONS_TABLE: (
-        f"CREATE TABLE {DECISIONS_TABLE} (id TEXT PRIMARY KEY "
-        "CHECK(length(id)=36), item_id TEXT NOT NULL "
-        f"REFERENCES {ITEMS_TABLE}(id) ON DELETE RESTRICT, "
-        "decision_revision INTEGER NOT NULL, created_at TEXT NOT NULL, "
-        "outcome TEXT NOT NULL CHECK(outcome IN ('selected','unresolved')), "
-        "candidate_hash TEXT CHECK(candidate_hash IS NULL OR "
-        f"({_HEX64.format(c='candidate_hash')})), "
-        f"evidence TEXT NOT NULL {_EVIDENCE_CHECK}, "
-        "pair_id INTEGER REFERENCES prompt_pairs(id) ON DELETE SET NULL, "
-        "image_id INTEGER REFERENCES generated_images(id) ON DELETE SET NULL, "
-        "UNIQUE(item_id, decision_revision), "
-        "CHECK((outcome='selected') = (candidate_hash IS NOT NULL)))"
-    ),
-}
-_INDEX_DDL = {
-    # The queue reads pending items oldest first with a stable tiebreak.
-    "idx_media_review_items_queue": (
-        "CREATE INDEX idx_media_review_items_queue ON "
-        f"{ITEMS_TABLE}(state, created_at, id)"
-    ),
-    # Deleting a pair or an image nulls decision navigation by index, not scan.
-    "idx_media_review_decisions_pair": (
-        "CREATE INDEX idx_media_review_decisions_pair ON " f"{DECISIONS_TABLE}(pair_id)"
-    ),
-    "idx_media_review_decisions_image": (
-        "CREATE INDEX idx_media_review_decisions_image ON "
-        f"{DECISIONS_TABLE}(image_id)"
-    ),
-}
-# ``sqlite_autoindex_<table>_<n>``: the TEXT primary key and the UNIQUE key.
-_AUTOINDEXES = {ITEMS_TABLE: 2, DECISIONS_TABLE: 2}
-# (name, declared type, not null, default, primary key position)
-_COLUMNS = {
-    METADATA_TABLE: (
-        ("singleton_id", "INTEGER", 0, None, 1),
-        ("schema_version", "INTEGER", 1, None, 0),
-        ("review_index_revision", "INTEGER", 1, "0", 0),
-    ),
-    ITEMS_TABLE: (
-        ("id", "TEXT", 0, None, 1),
-        ("byte_id", "TEXT", 1, None, 0),
-        ("spelled_path", "TEXT", 1, None, 0),
-        ("resolver_version", "INTEGER", 1, None, 0),
-        ("evidence_hash", "TEXT", 1, None, 0),
-        ("evidence", "TEXT", 1, None, 0),
-        ("candidate_count", "INTEGER", 1, None, 0),
-        ("limited", "INTEGER", 1, None, 0),
-        ("state", "TEXT", 1, None, 0),
-        ("revision", "INTEGER", 1, None, 0),
-        ("created_at", "TEXT", 1, None, 0),
-        ("updated_at", "TEXT", 1, None, 0),
-    ),
-    DECISIONS_TABLE: (
-        ("id", "TEXT", 0, None, 1),
-        ("item_id", "TEXT", 1, None, 0),
-        ("decision_revision", "INTEGER", 1, None, 0),
-        ("created_at", "TEXT", 1, None, 0),
-        ("outcome", "TEXT", 1, None, 0),
-        ("candidate_hash", "TEXT", 0, None, 0),
-        ("evidence", "TEXT", 1, None, 0),
-        ("pair_id", "INTEGER", 0, None, 0),
-        ("image_id", "INTEGER", 0, None, 0),
-    ),
-}
-# (column, parent table, parent column, on delete)
-_FOREIGN_KEYS = {
-    METADATA_TABLE: set(),
-    ITEMS_TABLE: {("byte_id", BYTES_TABLE, "id", "RESTRICT")},
-    DECISIONS_TABLE: {
-        ("item_id", ITEMS_TABLE, "id", "RESTRICT"),
-        ("pair_id", "prompt_pairs", "id", "SET NULL"),
-        ("image_id", "generated_images", "id", "SET NULL"),
-    },
-}
-
-
-class _NonCanonical(ValueError):
-    pass
-
-
-def _reject_constant(name: str) -> Any:
-    raise _NonCanonical(f"JSON constant {name} is not allowed")
-
-
-# Built once: validation re-encodes every stored document at startup.
-_ENCODER = json.JSONEncoder(
-    sort_keys=True, separators=(",", ":"), ensure_ascii=True, allow_nan=False
-)
-_DECODER = json.JSONDecoder(parse_constant=_reject_constant)
-
-
-def canonical_evidence(value: Any) -> str:
-    """Serialize one evidence object canonically; ``ValueError`` when invalid.
-
-    The text is a JSON object with sorted keys, no whitespace, ASCII only and
-    no NaN/infinity, at most ``MAX_EVIDENCE_BYTES`` bytes. A non-finite number
-    (ComfyUI stamps ``NaN`` into graphs) is written as ``null``, the store's
-    policy everywhere (``utils.json_strict.dumps_strict``).
-    """
-    if not isinstance(value, dict):
-        raise ValueError("Review evidence must be a JSON object")
-    try:
-        try:
-            text = _ENCODER.encode(value)
-        except ValueError as error:
-            if "Out of range float" not in str(error):
-                raise
-            text = dumps_strict(
-                value, sort_keys=True, separators=(",", ":"), ensure_ascii=True
-            )
-    except (TypeError, RecursionError) as error:
-        raise ValueError(f"Review evidence is not serializable: {error}") from None
-    if len(text) > MAX_EVIDENCE_BYTES:
-        raise ValueError("Review evidence is larger than 8 MiB")
-    return text
-
-
-def choosable(candidate: Any) -> bool:
-    """True when a candidate offers a prompt to choose: it is ``resolved`` and
-    its positive side carries non-blank text. The page disables any other
-    candidate, so it is never something to choose.
-    """
-    if not isinstance(candidate, dict) or candidate.get("state") != "resolved":
-        return False
-    positive = candidate.get("positive")
-    if not isinstance(positive, dict):
-        return False
-    text = positive.get("text")
-    return isinstance(text, str) and bool(text.strip())
-
-
-# An item is worth a decision only when at least this many candidates offer
-# a prompt; with fewer there is nothing to choose between (maintainer test of
-# #284/#288: 39 items whose candidates were all "unresolved").
-MIN_CHOOSABLE = 2
-
-
-def evidence_offers_choice(evidence: Any) -> bool:
-    """False when stored evidence provably offers nothing to choose.
-
-    Unlimited evidence must list ``MIN_CHOOSABLE`` choosable candidates. A
-    limited item stores none, only ``candidate_total``; it may offer a choice
-    (more than ``MAX_CANDIDATES`` prompts) unless that total is too small.
-    """
-    if not isinstance(evidence, dict):
-        return False
-    # The saver anchor's one pair (#390) is a suggestion to confirm.
-    needed = 1 if evidence.get("anchor") == "saver" else MIN_CHOOSABLE
-    if evidence.get("limited"):
-        total = evidence.get("candidate_total")
-        return type(total) is int and total >= needed
-    candidates = evidence.get("candidates")
-    if not isinstance(candidates, list):
-        return False
-    return sum(1 for c in candidates if choosable(c)) >= needed
-
-
-def evidence_digest(text: str) -> str:
-    """SHA-256 of canonical evidence text (ASCII, hence UTF-8 identical)."""
-    return hashlib.sha256(text.encode("utf-8")).hexdigest()
-
-
-def _is_canonical(text: Any) -> bool:
-    if not isinstance(text, str):
-        return False
-    try:
-        value = _DECODER.decode(text)
-        return canonical_evidence(value) == text
-    except (ValueError, RecursionError):
-        return False
-
-
-def _compact(sql: str) -> str:
-    return re.sub(r"\s+", "", sql).lower()
-
-
-def _uuid(column: str) -> str:
-    """SQL: *column* is a lowercase hyphenated 36-character UUID string."""
-    return (
-        f"typeof({column}) = 'text' AND length({column}) = 36 "
-        f"AND substr({column}, 9, 1) = '-' AND substr({column}, 14, 1) = '-' "
-        f"AND substr({column}, 19, 1) = '-' AND substr({column}, 24, 1) = '-' "
-        f"AND length(replace({column}, '-', '')) = 32 "
-        f"AND replace({column}, '-', '') NOT GLOB '*[^0-9a-f]*'"
-    )
-
-
-def _timestamp(column: str) -> str:
-    return (
-        f"typeof({column}) = 'text' "
-        f"AND length(CAST({column} AS BLOB)) <= {_TIMESTAMP_BYTES}"
-    )
-
-
-def _non_negative(column: str) -> str:
-    return f"typeof({column}) = 'integer' AND {column} >= 0"
-
-
-def _hex64(column: str) -> str:
-    return f"typeof({column}) = 'text' AND " + _HEX64.format(c=column)
-
-
-def _evidence(column: str) -> str:
-    # Type and size only: the streamed pass below proves the text canonical
-    # (which implies printable ASCII), so a pattern scan here would read every
-    # document a second time.
-    return (
-        f"typeof({column}) = 'text' "
-        f"AND length(CAST({column} AS BLOB)) BETWEEN 2 AND {MAX_EVIDENCE_BYTES}"
-    )
-
-
-def _nullable_integer(column: str) -> str:
-    return f"({column} IS NULL OR typeof({column}) = 'integer')"
-
-
-def _in(column: str, values: tuple) -> str:
-    return f"typeof({column}) = 'text' AND {column} IN ({repr(values)[1:-1]})"
-
-
-# Every row of a table must satisfy its predicate; one pass each, LIMIT 1.
-_ROW_PREDICATES = {
-    ITEMS_TABLE: " AND ".join(
-        (
-            _uuid("id"),
-            _uuid("byte_id"),
-            "typeof(spelled_path) = 'text' AND length(CAST(spelled_path AS BLOB)) "
-            f"BETWEEN 1 AND {MAX_SPELLED_PATH_BYTES}",
-            "typeof(resolver_version) = 'integer'",
-            _hex64("evidence_hash"),
-            _evidence("evidence"),
-            _non_negative("candidate_count"),
-            f"candidate_count <= {MAX_CANDIDATES}",
-            "typeof(limited) = 'integer' AND limited IN (0, 1)",
-            _in("state", ITEM_STATES),
-            _non_negative("revision"),
-            _timestamp("created_at"),
-            _timestamp("updated_at"),
-        )
-    ),
-    DECISIONS_TABLE: " AND ".join(
-        (
-            _uuid("id"),
-            _uuid("item_id"),
-            _non_negative("decision_revision"),
-            _timestamp("created_at"),
-            _in("outcome", DECISION_OUTCOMES),
-            "(CASE WHEN outcome = 'selected' THEN "
-            f"{_hex64('candidate_hash')} ELSE candidate_hash IS NULL END)",
-            _evidence("evidence"),
-            _nullable_integer("pair_id"),
-            _nullable_integer("image_id"),
-        )
-    ),
-}
-
-
-def _expected_catalog() -> set:
-    objects = {("table", name, _compact(sql)) for name, sql in _TABLE_DDL.items()}
-    objects |= {("index", name, _compact(sql)) for name, sql in _INDEX_DDL.items()}
-    objects |= {
-        ("index", f"sqlite_autoindex_{table}_{n}", "")
-        for table, count in _AUTOINDEXES.items()
-        for n in range(1, count + 1)
-    }
-    return objects
-
-
-def _catalog(conn: sqlite3.Connection) -> list:
-    names = TABLES + tuple(_INDEX_DDL)
-    marks = ",".join("?" * len(names))
-    table_marks = ",".join("?" * len(TABLES))
-    return conn.execute(  # only "?" placeholders are interpolated
-        "SELECT type,name,sql FROM sqlite_master "
-        f"WHERE name IN ({marks}) OR tbl_name IN ({table_marks})",  # nosec B608
-        names + TABLES,
-    ).fetchall()
-
-
-def _structure_error(conn: sqlite3.Connection) -> Optional[str]:
-    for table, expected in _COLUMNS.items():
-        columns = tuple(
-            (row[1], row[2].upper(), row[3], row[4], row[5])
-            for row in conn.execute(f"PRAGMA table_info({table})")
-        )
-        if columns != expected:
-            return f"Review queue table {table} has invalid columns"
-        foreign_keys = {
-            (row[3], row[2], row[4], row[6])
-            for row in conn.execute(f"PRAGMA foreign_key_list({table})")
-        }
-        if foreign_keys != _FOREIGN_KEYS[table]:
-            return f"Review queue table {table} has invalid foreign keys"
-        if conn.execute(f"PRAGMA foreign_key_check({table})").fetchone():
-            return f"Review queue table {table} contains foreign key violations"
-    return None
-
-
-def _evidence_error(conn: sqlite3.Connection) -> Optional[str]:
-    """Stream every evidence document once; one row is held at a time.
-
-    Rows are read with ``fetchone``: iterating a managed connection's cursor
-    would prefetch ``ITER_CHUNK`` (128) rows (``database/managed_connection.py``).
-    """
-    items = conn.execute(
-        f"SELECT evidence_hash, evidence FROM {ITEMS_TABLE}"  # nosec B608
-    )
-    while (row := items.fetchone()) is not None:
-        evidence_hash, text = row[0], row[1]
-        if not _is_canonical(text) or evidence_digest(text) != evidence_hash:
-            return f"Review queue table {ITEMS_TABLE} contains invalid evidence"
-    decisions = conn.execute(f"SELECT evidence FROM {DECISIONS_TABLE}")  # nosec B608
-    while (row := decisions.fetchone()) is not None:
-        text = row[0]
-        if not _is_canonical(text):
-            return f"Review queue table {DECISIONS_TABLE} contains invalid evidence"
-    return None
-
-
-def _value_error(conn: sqlite3.Connection) -> Optional[str]:
-    # Only this module's constants are interpolated into the SQL below.
-    rows = conn.execute(
-        "SELECT COUNT(*), MIN(typeof(singleton_id) = 'integer' "  # nosec B608
-        "AND singleton_id = 1 AND typeof(schema_version) = 'integer' "
-        f"AND schema_version = {SCHEMA_VERSION} "
-        f"AND {_non_negative('review_index_revision')}) FROM {METADATA_TABLE}"
-    ).fetchone()
-    if rows[0] != 1 or rows[1] != 1:
-        return "Review queue metadata is invalid"
-    for table, predicate in _ROW_PREDICATES.items():
-        if conn.execute(
-            f"SELECT 1 FROM {table} WHERE NOT ({predicate}) LIMIT 1"  # nosec B608
-        ).fetchone():
-            return f"Review queue table {table} contains invalid values"
-    return _evidence_error(conn)
-
-
-def review_without_annotations_error(conn: sqlite3.Connection) -> Optional[str]:
-    """Catalog only: a review group present without its annotation tables.
-
-    Startup asks this before the annotation group installs, which would make
-    a review group copied without it look valid. It reads no rows; the full
-    validation runs once in :func:`migrate_review_state`.
-    """
-    if not _catalog(conn):
-        return None
-    present = {
-        name for kind, name, _sql in _annotation_catalog(conn) if kind == "table"
-    }
-    if present != set(ANNOTATION_TABLES):
-        return (
-            "Review queue schema requires a valid image annotation schema: "
-            "Missing image annotation schema"
-        )
-    return None
-
-
-def review_schema_error(
-    conn: sqlite3.Connection,
-    *,
-    allow_missing: bool = True,
-    annotations_valid: bool = False,
-) -> Optional[str]:
-    """Reject partial or unsupported review schemas and invalid rows.
-
-    Reads only: nothing is ever repaired. A database without any of the
-    group's objects is acceptable for backups that predate it unless
-    ``allow_missing`` is false. A present group requires a present, valid
-    image annotation group; ``annotations_valid`` says the caller has just
-    validated it (startup's annotation install), so only its presence is
-    checked again.
-    """
-    objects = _catalog(conn)
-    if not objects:
-        return None if allow_missing else "Missing review queue schema"
-    if annotations_valid:
-        annotation_error = review_without_annotations_error(conn)
-    else:
-        annotation_error = annotation_schema_error(conn, allow_missing=False)
-        if annotation_error:
-            annotation_error = (
-                "Review queue schema requires a valid image annotation schema: "
-                + annotation_error
-            )
-    if annotation_error:
-        return annotation_error
-    present = {name for kind, name, _sql in objects if kind == "table"}
-    if present != set(TABLES):
-        return "Incomplete review queue schema"
-    actual = {(kind, name, _compact(sql or "")) for kind, name, sql in objects}
-    if actual != _expected_catalog():
-        return "Review queue has an invalid schema definition"
-    return _structure_error(conn) or _value_error(conn)
-
-
-def migrate_review_state(conn: sqlite3.Connection) -> None:
-    """Install the group atomically; validate before and after creating it.
-
-    Runs after ``migrate_annotation_state`` (which has just validated the
-    annotation group): the group is only valid beside the annotation group it
-    cites. A present group is validated once, evidence included.
-    """
-    conn.execute("SAVEPOINT media_review_schema")
-    try:
-        installed = bool(_catalog(conn))
-        error = review_schema_error(conn, annotations_valid=True)
-        if error:
-            raise sqlite3.DatabaseError(error)
-        if installed:
-            # Already complete and valid: nothing to create, and the evidence
-            # pass is the expensive part of validation, so it runs once.
-            conn.execute("RELEASE media_review_schema")
-            return
-        for sql in _TABLE_DDL.values():
-            conn.execute(sql.replace("CREATE TABLE", "CREATE TABLE IF NOT EXISTS", 1))
-        for sql in _INDEX_DDL.values():
-            conn.execute(sql.replace("INDEX", "INDEX IF NOT EXISTS", 1))
-        conn.execute(
-            f"INSERT OR IGNORE INTO {METADATA_TABLE} "
-            "(singleton_id, schema_version, review_index_revision) VALUES (1, ?, 0)",
-            (SCHEMA_VERSION,),
-        )
-        error = review_schema_error(conn, allow_missing=False, annotations_valid=True)
-        if error:
-            raise sqlite3.DatabaseError(error)
-        conn.execute("RELEASE media_review_schema")
-    except BaseException:
-        conn.execute("ROLLBACK TO media_review_schema")
-        conn.execute("RELEASE media_review_schema")
-        raise
@@ -1,369 +0,0 @@
-"""Attribute an output file to a stored prompt through recorded history (#342).
-
-Execution history records, per run, the files ComfyUI reported
-(``execution_run_outputs``) and the PromptManager texts the run used
-(``execution_run_contexts``, whose ``positive_prompt_id`` hint is set only
-while the raw text matches exactly one stored prompt). A file is attributed
-only when all of this holds:
-
- exactly one recorded run reported the file's output location (same output
-  root, subfolder and name);
- the file was last written while that run was executing, from its dequeue
-  to its terminal event (else the finish callback): a later run that history
-  did not record may have reused the name;
- every positive context of that run names the same stored prompt.
-
-Anything else returns None: the caller leaves the file unlinked. Read-only.
-
-``recorded_output`` applies the first two rules and returns, for the
-inspector (#386), the one output node (save node) that run reported the file
-from and the texts PromptManager recorded at execution per sampler.
-
-Lookups are batched (``stored_run_prompts``): one parameterized query per
-chunk of at most ``LOOKUP_CHUNK`` distinct file names, matched in memory. The
-history schema is left exactly as it is (no extra index), so older builds can
-still open the library.
-"""
-
-import logging
-import os
-import sqlite3
-import threading
-import weakref
-from dataclasses import dataclass
-from typing import Any, Callable, Dict, Iterable, List, Optional
-
-try:
-    from ..utils.execution_outputs import snapshot_output_roots
-    from ..utils.library_location import import_folder_paths
-except ImportError:
-    from utils.execution_outputs import snapshot_output_roots
-    from utils.library_location import import_folder_paths
-
-# File times may trail or lead the recorded run times a little (coarse file
-# system clocks, the write finishing just after the host reported it).
-MTIME_SLACK_MS = 2000
-
-# Distinct file names per lookup query: well under SQLite's bound-parameter
-# limit (999 on old builds), so a scan batch costs one query per chunk.
-LOOKUP_CHUNK = 500
-
-_RUNS_FOR_NAMES = (
-    "SELECT DISTINCT o.filename, o.subfolder, o.root_key, o.path_style, o.run_id, "
-    "r.observed_dequeue_at, COALESCE(r.terminal_event_at, r.observed_callback_at), "
-    "o.output_node_id "
-    "FROM execution_run_outputs o JOIN execution_runs r ON r.run_id = o.run_id "
-    "WHERE o.folder_type = 'output' AND o.filename IN ({marks})"
-)
-
-
-def host_output_directory() -> Optional[str]:
-    """ComfyUI's output directory, or None outside ComfyUI."""
-    folder_paths = import_folder_paths()
-    if folder_paths is None:
-        return None
-    try:
-        value = folder_paths.get_output_directory()
-    except Exception:
-        return None
-    return value if isinstance(value, str) and value else None
-
-
-def _inside(image_path: str, output_root: str) -> Optional[str]:
-    """``image_path`` relative to ``output_root``, or None when outside it."""
-    try:
-        relative = os.path.relpath(image_path, output_root)
-    except ValueError:  # another drive on Windows
-        return None
-    if os.path.isabs(relative) or relative == os.pardir:
-        return None
-    if relative.startswith(os.pardir + os.sep):
-        return None
-    return relative
-
-
-def _resolved(path: str) -> str:
-    try:
-        return os.path.realpath(path)
-    except (OSError, ValueError):
-        return os.path.abspath(path)
-
-
-def _location(image_path: str, output_root: str, path_style: str):
-    """(root key, subfolder, filename) as history records them, or None.
-
-    The root key is always the host's own spelling of its output folder,
-    because history recorded that one. The file may be spelled through the
-    same folder or through its resolved path (a symlinked or junction output
-    folder, as scan roots are): the lexical spelling is tried first, then
-    both sides resolved.
-    """
-    root_key = snapshot_output_roots(path_style, output_root, output_root).output_key
-    if root_key is None:
-        return None
-    relative = _inside(os.path.abspath(image_path), os.path.abspath(output_root))
-    if relative is None:
-        relative = _inside(_resolved(image_path), _resolved(output_root))
-    if relative is None:
-        return None
-    subfolder, filename = os.path.split(relative)
-    if not filename:
-        return None
-    return root_key, subfolder, filename
-
-
-def in_output_folder(image_path: str, output_root: Optional[str]) -> bool:
-    """Whether history could ever attribute ``image_path`` (inside the host's
-    output folder, in either spelling)."""
-    if not image_path or not output_root:
-        return False
-    style = "windows" if os.name == "nt" else "posix"
-    return _location(image_path, output_root, style) is not None
-
-
-def _written_during(image_path: str, started: Any, finished: Any) -> bool:
-    if not isinstance(started, int) or not isinstance(finished, int):
-        return False
-    try:
-        written = os.stat(image_path).st_mtime_ns // 1_000_000
-    except OSError:
-        return False
-    return started - MTIME_SLACK_MS <= written <= finished + MTIME_SLACK_MS
-
-
-def stored_run_prompt(
-    db: Any,
-    image_path: str,
-    output_root: Optional[str],
-    path_style: Optional[str] = None,
-) -> Optional[int]:
-    """The stored prompt id history attributes to ``image_path``, else None."""
-    if not image_path:
-        return None
-    return stored_run_prompts(db, [image_path], output_root, path_style).get(image_path)
-
-
-def _runs_by_location(db: Any, names: List[str]) -> Optional[Dict[tuple, dict]]:
-    """``{(filename, subfolder, root_key, style): {run_id: (start, end, nodes)}}``.
-
-    ``nodes`` is the set of output node ids that reported the location in that
-    run. One query per ``LOOKUP_CHUNK`` names; None without history tables.
-    """
-    found: Dict[tuple, dict] = {}
-    conn = db.model.get_connection()
-    for start in range(0, len(names), LOOKUP_CHUNK):
-        chunk = names[start : start + LOOKUP_CHUNK]
-        query = _RUNS_FOR_NAMES.format(marks=",".join("?" for _ in chunk))
-        try:
-            rows = conn.execute(query, chunk).fetchall()  # nosec B608
-        except sqlite3.Error:
-            return None  # no history tables (a library without history)
-        for name, subfolder, root_key, style, run_id, began, ended, node in rows:
-            runs = found.setdefault((name, subfolder, root_key, style), {})
-            runs.setdefault(run_id, (began, ended, set()))[2].add(node)
-    return found
-
-
-def recorded_runs(
-    db: Any,
-    image_paths: Iterable[str],
-    output_root: Optional[str],
-    path_style: Optional[str],
-) -> Dict[str, tuple]:
-    """``{path: (run_id, output node ids)}`` for each file history attributes.
-
-    A file is attributed when exactly one recorded run reported its location
-    and it was last written while that run executed.
-    """
-    paths = list(dict.fromkeys(path for path in image_paths if path))
-    if not paths or not output_root:
-        return {}
-    style = path_style or ("windows" if os.name == "nt" else "posix")
-    located = {}
-    for path in paths:
-        location = _location(path, output_root, style)
-        if location is not None:
-            located[path] = location
-    if not located:
-        return {}
-    names = sorted({filename for _key, _sub, filename in located.values()})
-    runs = _runs_by_location(db, names)
-    if not runs:
-        return {}
-    attributed = {}
-    for path, (root_key, subfolder, filename) in located.items():
-        reported = runs.get((filename, subfolder, root_key, style), {})
-        if len(reported) != 1:
-            continue
-        ((run_id, (began, ended, nodes)),) = reported.items()
-        if _written_during(path, began, ended):
-            attributed[path] = (run_id, nodes)
-    return attributed
-
-
-def named_prompt(db: Any, run_id: str) -> Optional[int]:
-    """The one stored prompt every positive context of ``run_id`` names, else None."""
-    contexts = db.get_execution_contexts(run_id).get("contexts") or []
-    named = {
-        context.get("positive_prompt_id")
-        for context in contexts
-        if context.get("positive") is not None
-    }
-    if len(named) != 1:
-        return None
-    (prompt_id,) = named
-    return prompt_id if isinstance(prompt_id, int) else None
-
-
-def stored_run_prompts(
-    db: Any,
-    image_paths: Iterable[str],
-    output_root: Optional[str],
-    path_style: Optional[str] = None,
-) -> Dict[str, Optional[int]]:
-    """``{path: stored prompt id or None}`` for many files in few queries.
-
-    The output lookup is one query per ``LOOKUP_CHUNK`` distinct names; each
-    run that alone reported a file is then read once for its contexts.
-    """
-    paths = list(dict.fromkeys(path for path in image_paths if path))
-    result: Dict[str, Optional[int]] = dict.fromkeys(paths)
-    prompts: Dict[str, Optional[int]] = {}
-    for path, (run_id, _nodes) in recorded_runs(
-        db, paths, output_root, path_style
-    ).items():
-        if run_id not in prompts:
-            prompts[run_id] = named_prompt(db, run_id)
-        result[path] = prompts[run_id]
-    return result
-
-
-@dataclass(frozen=True)
-class RecordedOutput:
-    """What recorded history knows about the run that wrote one file (#386).
-
-    ``saver_id`` is the one output node the run reported the file from (None
-    when several did). ``texts`` maps each sampler anchor of the run to the
-    effective texts PromptManager recorded at execution for its roles
-    (``{"positive": text or None, "negative": text or None}``); a role whose
-    text was only inferred from the graph is None.
-    """
-
-    saver_id: Optional[str]
-    texts: Dict[str, Dict[str, Optional[str]]]
-
-
-def _recorded_texts(db: Any, run_id: str) -> Dict[str, Dict[str, Optional[str]]]:
-    texts = {}
-    for context in db.get_execution_contexts(run_id).get("contexts") or []:
-        evidence = context.get("evidence") or {}
-        roles = {}
-        for role in ("positive", "negative"):
-            values = context.get(role) or {}
-            proof = (evidence.get(role) or {}).get("effective") or {}
-            value = values.get("effective")
-            recorded = proof.get("provenance") == "recorded"
-            roles[role] = value if recorded and isinstance(value, str) else None
-        texts[context["anchor_id"]] = roles
-    return texts
-
-
-def recorded_output(
-    db: Any,
-    image_path: str,
-    output_root: Optional[str],
-    path_style: Optional[str] = None,
-) -> Optional[RecordedOutput]:
-    """The recorded run facts for ``image_path``, else None (#386).
-
-    The file must be attributed to one run (``recorded_runs``: one run
-    reported its location and it was written during that run). Read-only; it
-    never links anything.
-    """
-    if not image_path:
-        return None
-    conn = db.model.get_connection()
-    own_transaction = not conn.in_transaction
-    if own_transaction:  # outputs and texts from one state of history
-        conn.execute("BEGIN")
-    try:
-        found = recorded_runs(db, [image_path], output_root, path_style)
-        if image_path not in found:
-            return None
-        run_id, nodes = found[image_path]
-        saver = next(iter(nodes)) if len(nodes) == 1 else None
-        return RecordedOutput(saver, _recorded_texts(db, run_id))
-    finally:
-        if own_transaction:
-            conn.rollback()
-
-
-_LOGGER = logging.getLogger("prompt_manager.run_attribution")
-
-
-def recorded_output_lookup(
-    db: Any, *, close: bool = False, reference: Optional[dict] = None
-) -> Callable[[Any], Any]:
-    """``lookup(path) -> RecordedOutput or None`` for the inspect routes (#386).
-
-    Uses ComfyUI's output folder. Any failure (no history, a locked library)
-    is logged and names no node, so the file is judged from its own metadata.
-    ``close`` closes the calling thread's connection afterwards, for routes
-    that close theirs after reading. ``reference`` (a history occurrence's
-    output reference) spells the file as history recorded it: the route's
-    target is case-normalized on Windows, and history matches names exactly.
-    """
-
-    def lookup(path: Any) -> Optional[RecordedOutput]:
-        root = host_output_directory()
-        if reference is not None:
-            if reference.get("folder_type") != "output" or not root:
-                return None
-            path = os.path.join(
-                root, reference.get("subfolder") or "", reference.get("filename") or ""
-            )
-        try:
-            return recorded_output(db, str(path), root)
-        except (sqlite3.Error, OSError, ValueError):
-            _LOGGER.warning("Recorded run lookup failed", exc_info=True)
-            return None
-        except Exception:
-            _LOGGER.exception("Recorded run lookup failed unexpectedly")
-            return None
-        finally:
-            if close:
-                db.model.close()
-
-    return lookup
-
-
-_SEALED_LISTENERS: List[weakref.WeakMethod] = []
-_SEALED_LOCK = threading.Lock()
-
-
-def subscribe_outputs_sealed(method: Callable[[str, List[dict]], None]) -> None:
-    """Call bound ``method(run_id, references)`` after a run's outputs are recorded.
-
-    Held weakly: a listener that is garbage collected is dropped.
-    """
-    with _SEALED_LOCK:
-        _SEALED_LISTENERS.append(weakref.WeakMethod(method))
-
-
-def notify_outputs_sealed(run_id: str, references: Iterable[dict]) -> None:
-    """Tell listeners a run's output references were just committed.
-
-    A listener failure is logged and never reaches the history writer.
-    """
-    references = list(references)
-    with _SEALED_LOCK:
-        alive = [ref for ref in _SEALED_LISTENERS if ref() is not None]
-        _SEALED_LISTENERS[:] = alive
-        listeners = [ref() for ref in alive]
-    for listener in listeners:
-        if listener is None:
-            continue
-        try:
-            listener(run_id, references)
-        except Exception:
-            _LOGGER.warning("Output seal listener failed", exc_info=True)
@@ -1,186 +0,0 @@
-"""Safety backups beside the live database: one writer for every caller.
-
-A safety backup is ``<db>.<label>_<YYYYmmdd_HHMMSS_ffffff>[_n]`` in the
-library's own folder. It is written by SQLite's backup API into a temp file
-beside the database (``SAFETY_TEMP_PREFIX``, swept at startup after a crash),
-made one self-contained file (rollback journal), optionally verified, fsynced,
-made private (``0o600`` on POSIX) and only then given its unique name, so a
-backup name never carries a half-written file. The names are unique within
-one second (microseconds, then a counter): on Windows two backups in the same
-second must not overwrite each other.
-
-Maintenance applies take a verified backup (``py/api/maintenance.py``); a
-restore takes an unverified one, because the database it replaces may be the
-damaged one the user is recovering from (``database/restore_stage.py``).
-"""
-
-import datetime
-import os
-import sqlite3
-import tempfile
-from contextlib import closing
-
-SAFETY_TEMP_PREFIX = ".pm-safety-"
-_NAME_ATTEMPTS = 1000
-
-
-class SafetyBackupFailed(Exception):
-    """The safety backup could not be written, verified or put in place.
-
-    ``reason`` is the verify reason when the copy did not verify.
-    """
-
-    def __init__(self, message, reason=None):
-        super().__init__(message)
-        self.reason = reason
-
-
-def _now():
-    return datetime.datetime.now()
-
-
-def remove_quietly(*paths):
-    """Remove each existing path, ignoring errors (cleanup after a failure)."""
-    for path in paths:
-        try:
-            if path and os.path.exists(path):
-                os.remove(path)
-        except OSError:
-            # cleanup after a failure must not replace that failure
-            pass
-
-
-def backup_names(db_path, label="backup"):
-    """Candidate names, unique within one second (microseconds, then ``_n``)."""
-    base = f"{db_path}.{label}_{_now().strftime('%Y%m%d_%H%M%S_%f')}"
-    for attempt in range(_NAME_ATTEMPTS):
-        yield base if attempt == 0 else f"{base}_{attempt}"
-
-
-def reserve_backup_name(db_path, label="backup"):
-    """Create and return an unused ``<db>.<label>_<stamp>[_n]`` (O_EXCL)."""
-    for candidate in backup_names(db_path, label):
-        try:
-            fd = os.open(candidate, os.O_CREAT | os.O_EXCL | os.O_WRONLY, 0o600)
-        except FileExistsError:
-            continue
-        os.close(fd)
-        return candidate
-    raise SafetyBackupFailed("No free backup name")
-
-
-def place_backup(temp, db_path, label="backup"):
-    """Give the finished ``temp`` its unique backup name; return that path.
-
-    ``os.link`` is atomic and refuses an existing name, so no empty or half
-    file ever carries a backup name, even across a crash. A filesystem
-    without hard links falls back to reserving the name (``O_EXCL``) and
-    ``os.replace``. The temp file is removed by the caller.
-    """
-    for candidate in backup_names(db_path, label):
-        try:
-            os.link(temp, candidate)
-        except FileExistsError:
-            continue
-        except (OSError, NotImplementedError):
-            break  # no hard links here
-        else:
-            return candidate
-    else:
-        raise SafetyBackupFailed("No free backup name")
-    final = reserve_backup_name(db_path, label)
-    try:
-        os.replace(temp, final)
-    except OSError:
-        remove_quietly(final)
-        raise
-    return final
-
-
-def sweep_safety_temps(db_path):
-    """Remove the temp copies an interrupted safety backup left (blocking).
-
-    Called once at startup, before any job can take a backup. Returns the
-    names removed.
-    """
-    folder = os.path.dirname(os.path.abspath(db_path))
-    removed = []
-    try:
-        names = os.listdir(folder)
-    except OSError:
-        return removed
-    for name in names:
-        if not (name.startswith(SAFETY_TEMP_PREFIX) and ".tmp" in name):
-            continue
-        try:
-            os.remove(os.path.join(folder, name))
-            removed.append(name)
-        except OSError:
-            continue
-    return removed
-
-
-def make_standalone(path):
-    """Make the copy one self-contained file (rollback journal, not WAL).
-
-    The backup API copies the live database's WAL flag; a WAL file opened
-    read-only later (a verify, a restore preview) would leave ``-wal`` and
-    ``-shm`` sidecars beside it.
-    """
-    try:
-        with closing(sqlite3.connect(path)) as conn:
-            conn.execute("PRAGMA journal_mode=DELETE").fetchone()
-    except sqlite3.Error as exc:
-        raise SafetyBackupFailed("The backup could not be finished") from exc
-
-
-def fsync_file(path):
-    with open(path, "rb+") as handle:
-        os.fsync(handle.fileno())
-
-
-def safety_temp(db_path):
-    """A new, closed temp file beside the database (``SAFETY_TEMP_PREFIX``)."""
-    fd, temp = tempfile.mkstemp(
-        dir=os.path.dirname(os.path.abspath(db_path)),
-        prefix=SAFETY_TEMP_PREFIX,
-        suffix=".tmp",
-    )
-    os.close(fd)
-    return temp
-
-
-def take_safety_backup(model, label="backup", *, verify=True):
-    """Write (and by default verify) a safety backup; return its path (blocking).
-
-    The copy is made in a temp file beside the database and only renamed
-    onto its final, unique name ``<db>.<label>_<stamp>`` once it is complete
-    (and verified), so a backup file on disk is always a whole one. ``label``
-    "backup" joins the pruned pool; another label (the workflow storage
-    migration's ``pre-workflow-storage``) is kept until the user removes it.
-    Raises SafetyBackupFailed, leaving no file.
-    """
-    db_path = os.path.abspath(model.db_path)
-    temp = safety_temp(db_path)
-    final = None
-    try:
-        if not model.backup_database(temp):
-            raise SafetyBackupFailed("The backup could not be written")
-        make_standalone(temp)
-        if verify:
-            ok, reason = model.verify_database_file(temp)
-            if not ok:
-                raise SafetyBackupFailed("The backup did not verify", reason)
-        fsync_file(temp)
-        if os.name != "nt":
-            os.chmod(temp, 0o600)
-        final = place_backup(temp, db_path, label)
-        return final
-    except OSError as exc:
-        remove_quietly(final)
-        raise SafetyBackupFailed("The backup could not be put in place") from exc
-    except SafetyBackupFailed:
-        remove_quietly(final)
-        raise
-    finally:
-        remove_quietly(temp, temp + "-journal", temp + "-wal", temp + "-shm")
@@ -1,359 +0,0 @@
-"""Persisted saved views (D16): a named Images or Library toolbar state.
-
-A view's state holds exactly its page's toolbar values and its Refine-this-view
-refinements, whitelisted per page and stored as compact JSON of at most 4 KB.
-
-Writes (the API's POST and PATCH) validate strictly. Startup and restore check
-only the structure (the table, its columns and each row's types, sizes and JSON
-object), never the value rules: a row saved under older rules must not stop the
-database from opening. Startup is more tolerant still: a row whose state is not
-a JSON object is logged by id, left in place and skipped by every read, while
-restore rejects such a backup. Reads normalize instead, so a stale row opens with its
-usable values and defaults for the rest. Optional in old backups, required once
-a database is current (see ``library_schema.py``).
-"""
-
-import json
-import logging
-import re
-import sqlite3
-from typing import Optional
-
-# The models logger's parent ("prompt_manager.database.models" logs there too).
-_LOGGER = logging.getLogger("prompt_manager.database.saved_views")
-
-TABLE = "saved_views"
-PAGES = ("images", "library")
-# The schema check's literal SQL repeats the name and state caps (names in
-# bytes, at most 4 per character); keep them in step.
-MAX_NAME_LENGTH = 100
-MAX_STATE_BYTES = 4096
-MAX_TAGS = 20
-MAX_TAG_LENGTH = 50
-_IMAGE_SORTS = ("newest", "oldest", "name", "name-desc", "rating")
-_LIBRARY_SORTS = ("newest", "oldest", "name", "rating")
-_MEDIA = ("all", "image", "video")
-# How a Library view's Tags match (#444): every tag, any of them, or parents
-# without tags ("untagged" never goes with tags; the listing refuses both).
-_TAG_MODES = ("all", "any", "untagged")
-_CONTROL = re.compile(r"[\x00-\x1f\x7f]")
-_SOURCE = re.compile(r"all|0|[1-9][0-9]{0,8}")
-# A collection id as the listing's ``collection`` query takes it (#331): none
-# ("") or 1 to 9 digits without a leading zero.
-_COLLECTION = re.compile(r"|[1-9][0-9]{0,8}")
-FALLBACK_NAME = "Saved view"
-
-
-class SavedViewInvalid(ValueError):
-    """A request's page, name or state breaks the write rules (a 400)."""
-
-
-# (kind, limit-or-choices, default) per state key; "text" values are
-# length-capped. The defaults match the client's (saved-views.mjs FIELDS).
-_STATE_FIELDS = {
-    "images": {
-        "q": ("text", 500, ""),
-        "category": ("text", 100, ""),
-        "sort": ("choice", _IMAGE_SORTS, "newest"),
-        "source": ("source", None, "all"),
-        "folder": ("text", 1024, ""),
-        "media": ("choice", _MEDIA, "all"),
-        "tags": ("tags", None, ()),
-        # The Favorites page's filter (#249 D51): a view saved there reopens it.
-        "favorites": ("bool", None, False),
-        # A view saved on a collection page (#331 D140) reopens that
-        # collection; never together with favorites.
-        "collection": ("collection", None, ""),
-    },
-    "library": {
-        "q": ("text", 500, ""),
-        "category": ("text", 100, ""),
-        "sort": ("choice", _LIBRARY_SORTS, "newest"),
-        "tags": ("tags", None, ()),
-        # #444: the Tags match and the output folder (relative, "/"-joined).
-        "tag_mode": ("choice", _TAG_MODES, "all"),
-        "folder": ("text", 1024, ""),
-    },
-}
-
-_DDL = (
-    f"CREATE TABLE {TABLE} (id INTEGER PRIMARY KEY AUTOINCREMENT, "
-    "page TEXT NOT NULL CHECK(page IN ('images','library')), "
-    "name TEXT NOT NULL, state TEXT NOT NULL, position INTEGER NOT NULL, "
-    "created_at TEXT NOT NULL, updated_at TEXT NOT NULL)"
-)
-_COLUMNS = (
-    ("id", "INTEGER", 0, 1),
-    ("page", "TEXT", 1, 0),
-    ("name", "TEXT", 1, 0),
-    ("state", "TEXT", 1, 0),
-    ("position", "INTEGER", 1, 0),
-    ("created_at", "TEXT", 1, 0),
-    ("updated_at", "TEXT", 1, 0),
-)
-_SELECT = "SELECT id, page, name, state FROM saved_views"
-
-
-def _compact(sql: str) -> str:
-    return re.sub(r"\s+", "", sql).lower()
-
-
-def validate_name(name: object) -> str:
-    """The trimmed name, 1 to 100 characters without control characters."""
-    if not isinstance(name, str):
-        raise SavedViewInvalid("Name must be a string")
-    trimmed = name.strip()
-    if not 1 <= len(trimmed) <= MAX_NAME_LENGTH:
-        raise SavedViewInvalid(f"Name must be 1 to {MAX_NAME_LENGTH} characters")
-    if _CONTROL.search(trimmed):
-        raise SavedViewInvalid("Name contains control characters")
-    return trimmed
-
-
-def _validate_value(key: str, kind: str, limit, value: object) -> None:
-    """Raise ``SavedViewInvalid`` when *value* breaks *key*'s write rule."""
-    if kind == "tags":
-        if not isinstance(value, list) or len(value) > MAX_TAGS:
-            raise SavedViewInvalid(
-                f"State '{key}' must be a list of at most {MAX_TAGS}"
-            )
-        for tag in value:
-            if (
-                not isinstance(tag, str)
-                or not tag.strip()
-                or len(tag) > MAX_TAG_LENGTH
-                or "," in tag
-                or _CONTROL.search(tag)
-            ):
-                raise SavedViewInvalid(f"State '{key}' holds an invalid tag")
-        return
-    if kind == "bool":
-        if not isinstance(value, bool):
-            raise SavedViewInvalid(f"State '{key}' must be true or false")
-        return
-    if not isinstance(value, str):
-        raise SavedViewInvalid(f"State '{key}' must be a string")
-    if kind == "choice" and value not in limit:
-        raise SavedViewInvalid(f"State '{key}' is not a supported value")
-    if kind == "source" and not _SOURCE.fullmatch(value):
-        raise SavedViewInvalid(f"State '{key}' must be 'all' or a source index")
-    if kind == "collection" and not _COLLECTION.fullmatch(value):
-        raise SavedViewInvalid(f"State '{key}' must be empty or a collection id")
-    if kind == "text" and (len(value) > limit or _CONTROL.search(value)):
-        raise SavedViewInvalid(f"State '{key}' is too long or has control characters")
-
-
-def encode_state(page: object, state: object) -> str:
-    """Validate *state* for *page* and return its compact JSON (at most 4 KB)."""
-    if page not in PAGES:
-        raise SavedViewInvalid("Page must be 'images' or 'library'")
-    fields = _STATE_FIELDS[page]
-    if not isinstance(state, dict):
-        raise SavedViewInvalid("State must be an object")
-    if set(state) != set(fields):
-        raise SavedViewInvalid(
-            f"State for {page} must contain exactly " + ", ".join(sorted(fields))
-        )
-    for key, (kind, limit, _default) in fields.items():
-        _validate_value(key, kind, limit, state[key])
-    if state.get("favorites") is True and state.get("collection"):
-        raise SavedViewInvalid("A view cannot filter by favorites and a collection")
-    if state.get("tag_mode") == "untagged" and state.get("tags"):
-        raise SavedViewInvalid("A view cannot list untagged prompts and filter tags")
-    encoded = json.dumps(
-        {key: state[key] for key in fields}, ensure_ascii=False, separators=(",", ":")
-    )
-    if len(encoded.encode("utf-8")) > MAX_STATE_BYTES:
-        raise SavedViewInvalid("State must encode to at most 4 KB")
-    return encoded
-
-
-def _decode_object(raw: object) -> Optional[dict]:
-    """The JSON object stored in *raw*, or None when it holds no object."""
-    if isinstance(raw, dict):
-        return raw
-    if not isinstance(raw, str):
-        return None
-    try:
-        decoded = json.loads(raw)
-    except (ValueError, RecursionError):
-        return None
-    return decoded if isinstance(decoded, dict) else None
-
-
-def normalize_state(page: str, raw: object) -> dict:
-    """The page's full state from a stored row, never raising.
-
-    Every key of the page's current whitelist is present: a stored value that
-    passes today's write rule is kept, anything else (missing, invalid, or a
-    row that is not a JSON object) takes the key's default, and keys the
-    whitelist no longer has are dropped. An unknown page has no keys.
-    """
-    fields = _STATE_FIELDS.get(page, {})
-    stored = _decode_object(raw) or {}
-    state = {}
-    for key, (kind, limit, default) in fields.items():
-        value = stored.get(key, default)
-        try:
-            _validate_value(key, kind, limit, value)
-        except SavedViewInvalid:
-            value = default
-        state[key] = list(value) if kind == "tags" else value
-    # Never written by this build; a stored row with both opens the collection,
-    # as the listing does for a URL with both (#331 D140).
-    if state.get("favorites") is True and state.get("collection"):
-        state["favorites"] = False
-    # Never written by this build either: the tags win.
-    if state.get("tag_mode") == "untagged" and state.get("tags"):
-        state["tag_mode"] = "all"
-    return state
-
-
-def normalize_name(name: object) -> str:
-    """A stored name made displayable: trimmed, capped, never empty."""
-    text = _CONTROL.sub("", name) if isinstance(name, str) else ""
-    trimmed = text.strip()[:MAX_NAME_LENGTH].strip()
-    return trimmed or FALLBACK_NAME
-
-
-def saved_views_schema_error(
-    conn: sqlite3.Connection,
-    *,
-    allow_missing: bool = True,
-    check_states: bool = True,
-) -> Optional[str]:
-    """Reject unsupported saved-views schemas and structurally invalid rows.
-
-    Reads only. Checks the table, its columns, each row's types and sizes and
-    that each state is a JSON object; never the value rules, which change
-    between versions and are normalized on read instead. A missing table is
-    acceptable for backups that predate it unless ``allow_missing`` is false.
-    ``check_states=False`` (live startup) skips the JSON-object check; such
-    rows are reported by ``unusable_view_ids`` and skipped on read.
-    """
-    objects = conn.execute(
-        "SELECT type,name,sql FROM sqlite_master WHERE name=? "
-        "OR (type IN ('index','trigger') AND tbl_name=?)",
-        (TABLE, TABLE),
-    ).fetchall()
-    if not objects:
-        return None if allow_missing else "Missing saved views schema"
-    tables = [sql for kind, _name, sql in objects if kind == "table"]
-    if len(tables) != 1 or len(objects) != 1:
-        return "Saved views name is reserved by an unsupported schema object"
-    if _compact(tables[0] or "") != _compact(_DDL):
-        return "Saved views has an invalid table definition"
-    columns = tuple(
-        (row[1], row[2].upper(), row[3], row[5])
-        for row in conn.execute(f"PRAGMA table_info({TABLE})")
-    )
-    if columns != _COLUMNS:
-        return "Saved views has invalid columns"
-    # Literal SQL: the table name and limits are constants of this module.
-    if conn.execute(
-        "SELECT 1 FROM saved_views WHERE typeof(page) != 'text' "
-        "OR page NOT IN ('images','library') "
-        "OR typeof(name) != 'text' OR typeof(state) != 'text' "
-        "OR typeof(position) != 'integer' OR typeof(created_at) != 'text' "
-        "OR typeof(updated_at) != 'text' "
-        "OR length(CAST(name AS BLOB)) > 400 "
-        "OR length(CAST(state AS BLOB)) > 4096 "
-        "OR length(CAST(created_at AS BLOB)) > 64 "
-        "OR length(CAST(updated_at AS BLOB)) > 64 LIMIT 1"
-    ).fetchone():
-        return "Saved views contains invalid values"
-    if check_states and unusable_view_ids(conn):
-        return "Saved views contains invalid values"
-    return None
-
-
-def unusable_view_ids(conn: sqlite3.Connection) -> list[int]:
-    """Ids of rows whose state is not a JSON object (never listed)."""
-    return [
-        view_id
-        for view_id, state in conn.execute("SELECT id, state FROM saved_views")
-        if _decode_object(state) is None
-    ]
-
-
-def migrate_saved_views(conn: sqlite3.Connection) -> None:
-    """Install the table atomically; validate before and after creating it."""
-    conn.execute("SAVEPOINT saved_views_schema")
-    try:
-        error = saved_views_schema_error(conn, check_states=False)
-        if error:
-            raise sqlite3.DatabaseError(error)
-        conn.execute(_DDL.replace("CREATE TABLE", "CREATE TABLE IF NOT EXISTS", 1))
-        error = saved_views_schema_error(conn, allow_missing=False, check_states=False)
-        if error:
-            raise sqlite3.DatabaseError(error)
-        # A corrupt state never stops the live database from opening: the row
-        # stays (no data is destroyed) and reads skip it. Only its id is logged.
-        for view_id in unusable_view_ids(conn):
-            _LOGGER.warning(
-                "Saved view id %d has an unreadable state and is hidden", view_id
-            )
-        conn.execute("RELEASE saved_views_schema")
-    except BaseException:
-        conn.execute("ROLLBACK TO saved_views_schema")
-        conn.execute("RELEASE saved_views_schema")
-        raise
-
-
-def _view(row) -> dict:
-    view_id, page, name, state = row
-    return {
-        "id": view_id,
-        "page": page,
-        "name": normalize_name(name),
-        "state": normalize_state(page, state),
-    }
-
-
-class SavedViewOperations:
-    """PromptDatabase mixin: list, create, rename and delete saved views."""
-
-    def list_saved_views(self) -> list[dict]:
-        """Every view, in list order (position, then creation)."""
-        rows = self.model.get_connection().execute(_SELECT + " ORDER BY position, id")
-        # A row whose state is no JSON object (logged at startup) is never listed.
-        return [_view(row) for row in rows if _decode_object(row[3]) is not None]
-
-    def create_saved_view(self, page: object, name: object, state: object) -> dict:
-        """Validate and append one view at the end of the list."""
-        from .models import utc_now_iso  # models imports this module's schema
-
-        encoded = encode_state(page, state)
-        trimmed = validate_name(name)
-        now = utc_now_iso()
-        with self.model.get_connection() as conn:
-            cursor = conn.execute(
-                "INSERT INTO saved_views (page, name, state, position, "
-                "created_at, updated_at) SELECT ?, ?, ?, "
-                "COALESCE(MAX(position), -1) + 1, ?, ? FROM saved_views",
-                (page, trimmed, encoded, now, now),
-            )
-            row = conn.execute(
-                _SELECT + " WHERE id = ?", (cursor.lastrowid,)
-            ).fetchone()
-        return _view(row)
-
-    def rename_saved_view(self, view_id: int, name: object) -> Optional[dict]:
-        """The renamed view, or None when no view has *view_id*."""
-        from .models import utc_now_iso
-
-        trimmed = validate_name(name)
-        with self.model.get_connection() as conn:
-            conn.execute(
-                "UPDATE saved_views SET name = ?, updated_at = ? WHERE id = ?",
-                (trimmed, utc_now_iso(), view_id),
-            )
-            row = conn.execute(_SELECT + " WHERE id = ?", (view_id,)).fetchone()
-        # A hidden (unreadable) view is not found, as in the listing.
-        return _view(row) if row and _decode_object(row[3]) is not None else None
-
-    def delete_saved_view(self, view_id: int) -> bool:
-        """True when a view was removed."""
-        with self.model.get_connection() as conn:
-            cursor = conn.execute("DELETE FROM saved_views WHERE id = ?", (view_id,))
-        return cursor.rowcount > 0
@@ -1,87 +0,0 @@
-"""Link an output file to the prompt of one text, creating it when new (#247).
-
-The store step of ingestion from file metadata when the decision is a
-positive text (``utils.file_prompt``). The prompt insert and the link run in
-one ``BEGIN IMMEDIATE`` transaction: two writers never store one text twice,
-a failed link leaves no new prompt behind, and a file stays linked to one
-prompt (a file already linked to another prompt is a ``conflict``).
-"""
-
-import logging
-import os
-from typing import Any, Dict, Optional, Tuple
-
-from .pair_ingestion import Marks, file_link_rows, link_conflict, mark_created
-
-try:
-    from ..utils.hashing import generate_prompt_hash
-except ImportError:
-    from utils.hashing import generate_prompt_hash
-
-_LOGGER = logging.getLogger("prompt_manager.database.scanned_prompts")
-
-
-def store_scanned_prompt_or_raise(
-    db: Any, path: str, canonical: Dict[str, Any], text: str, marks: Marks
-) -> Tuple[str, Optional[int]]:
-    """``(status, prompt id)`` after linking ``path`` to ``text``'s prompt.
-
-    ``added`` (prompt created, carrying ``marks``), ``linked`` (stored text
-    reused), ``unchanged`` (already linked to it) or ``conflict`` (linked to
-    another prompt; nothing written, id None). Database errors are raised
-    and roll the whole store back, so a caller can run it again.
-    """
-    with db._pair_transaction() as conn:
-        rows = file_link_rows(conn, path)
-        if link_conflict(rows, generate_prompt_hash(text)):
-            return "conflict", None
-        if rows:
-            return "unchanged", rows[0]["prompt_id"]
-        prompt_id, created = db._pair_component_outcome(conn, text)
-        if created:
-            mark_created(conn, db, prompt_id, marks, os.path.basename(path))
-        db._insert_image_link(conn, prompt_id, path, canonical)
-        return ("added" if created else "linked"), prompt_id
-
-
-def store_scanned_prompt(
-    db: Any, path: str, canonical: Dict[str, Any], text: str, marks: Marks
-) -> Tuple[str, Optional[int]]:
-    """The scan's form: an error is logged and reported as ``("found", None)``.
-
-    A write that failed because Move library switched runs again on the new
-    library (``survive_library_switch``); the rerun re-checks the link rows.
-    """
-    try:
-        return db.survive_library_switch(
-            lambda: store_scanned_prompt_or_raise(db, path, canonical, text, marks)
-        )
-    except Exception as error:
-        _LOGGER.error(
-            f"Failed to store the prompt of {os.path.basename(path)}: {error}"
-        )
-        return "found", None
-
-
-def link_stored_prompt_or_raise(
-    db: Any, path: str, canonical: Dict[str, Any], prompt_id: int
-) -> Optional[str]:
-    """Link ``path`` to the stored prompt ``prompt_id`` (recorded history, #342).
-
-    ``linked``, ``unchanged`` (already linked to it), ``conflict`` (linked to
-    another prompt; nothing written) or None when the prompt is gone. One
-    ``BEGIN IMMEDIATE`` transaction; database errors are raised.
-    """
-    with db._pair_transaction() as conn:
-        rows = file_link_rows(conn, path)
-        if len(rows) > 1 or (rows and rows[0]["prompt_id"] != prompt_id):
-            return "conflict"
-        if rows:
-            return "unchanged"
-        exists = conn.execute(
-            "SELECT 1 FROM prompts WHERE id = ?", (prompt_id,)
-        ).fetchone()
-        if exists is None:
-            return None
-        db._insert_image_link(conn, prompt_id, path, canonical)
-        return "linked"
@@ -3,9 +3,6 @@
 A count is the number of eligible Library parents that carry the value
 directly or through one active saved pair, which is exactly what
 ``list_library(tags=[name])`` / ``list_library(category=value)`` return.
-A tag row's ``image_count`` is the number of files (private locators) with any
-byte record carrying the tag (#249), so a file counts once however many of its
-byte versions carry it, and equal bytes at two paths count twice.

 Tag commands run in one ``_pair_transaction``: the storage epoch is checked
 first, then the exact ``{id, name}`` identity, and the receipt is read on the
@@ -13,15 +10,12 @@ same connection before commit. Owner rows and their timestamps never change.

 Category consolidation is previewed in one ``library_snapshot`` and applied in
 one ``_pair_transaction`` that recomputes the owner projection and requires the
-preview's ``impact_token``; only rows carrying the exact source change. Image
-rows holding the source (``image_categories``, #332) are owners too: they are
-counted, hashed into the token and renamed with the prompts and pairs.
+preview's ``impact_token``; only rows carrying the exact source change.
 """

 import sqlite3

-from .library import _ELIGIBLE, SHELVED_PAIR, UNTAGGED, _escape, _limit
-from .prompt_archive import SHELVED
+from .library import _ELIGIBLE, _limit
 from .library_commands import _TOKEN, LibraryCommandError, _validate_epoch
 from .library_tokens import canonical_token
 from .models import utc_now_iso
@@ -32,82 +26,28 @@ except ImportError:
    from utils.validators import validate_category, validate_tags

 _CATEGORY_DOMAIN = "prompt-manager-vocabulary-category:v1\n"
-# Files carrying a tag through any of their byte records (#249 image tags).
-_IMAGE_FILES = (
-    "SELECT mit.tag_id,COUNT(DISTINCT b.file_id) FROM media_image_tags mit "
-    "JOIN media_annotation_bytes b ON b.id=mit.byte_id"
-)


-def _tag_rows(page: str, order: str = "page.id") -> str:
+def _tag_rows(page: str) -> str:
    """Count rows for the registry rows selected by ``page`` (id, name)."""
-    # Eligible parent components on the shelf carrying a tag in the page,
-    # plus the positive parent of every active pair carrying it (always
-    # eligible) when that parent is on the shelf: archived parents (#443)
-    # are hidden with their pairs, so Browse lists what was counted.
+    # Eligible parent components carrying a tag in the page, plus the
+    # positive parent of every active pair carrying it (always eligible).
    return (
        "WITH page AS (" + page + "),"
        "owners(tag_id,pid) AS ("
        "SELECT pt.tag_id,p.id FROM prompts p "
        "JOIN prompt_tags pt ON pt.prompt_id=p.id "
        "WHERE pt.tag_id IN (SELECT id FROM page) AND " + _ELIGIBLE + " "
-        "AND " + SHELVED + " "
        "UNION SELECT ppt.tag_id,pp.positive_prompt_id FROM prompt_pairs pp "
        "JOIN prompt_pair_tags ppt ON ppt.pair_id=pp.id "
-        "WHERE pp.archived=0 AND " + SHELVED_PAIR + " "
-        "AND ppt.tag_id IN (SELECT id FROM page)),"
-        "images(tag_id,n) AS (" + _IMAGE_FILES + " "
-        "WHERE mit.tag_id IN (SELECT id FROM page) GROUP BY mit.tag_id) "
-        "SELECT page.id,page.name,COUNT(DISTINCT owners.pid) AS prompt_count,"
-        "COALESCE(MAX(images.n),0) AS image_count "
+        "WHERE pp.archived=0 AND ppt.tag_id IN (SELECT id FROM page)) "
+        "SELECT page.id,page.name,COUNT(DISTINCT owners.pid) AS prompt_count "
        "FROM page LEFT JOIN owners ON owners.tag_id=page.id "
-        "LEFT JOIN images ON images.tag_id=page.id "
-        "GROUP BY page.id ORDER BY " + order
+        "GROUP BY page.id ORDER BY page.id"
    )


-# #444 tag sorts: sort -> (key expression on tags/counted, direction). Ties and
-# "created" follow the id, so every order is total and keyset pages are exact.
-TAG_SORTS = {
-    "created": (None, "ASC"),
-    "name": ("name COLLATE NOCASE", "ASC"),
-    "name-desc": ("name COLLATE NOCASE", "DESC"),
-    "prompts": ("prompt_count", "DESC"),
-    "prompts-asc": ("prompt_count", "ASC"),
-}
-_MAX_SEARCH = 200
-_TAG_SEARCH = "name LIKE ? ESCAPE '\\'"
-# Every matching tag ranked by the prompt count its row shows (the owners rule
-# of ``_tag_rows``), then one keyset page of it with its image counts.
-_RANKED_TAG_PAGE = (
-    "WITH owners(tag_id,pid) AS ("
-    "SELECT pt.tag_id,p.id FROM prompts p "
-    "JOIN prompt_tags pt ON pt.prompt_id=p.id WHERE " + _ELIGIBLE + " "
-    "AND " + SHELVED + " "
-    "UNION SELECT ppt.tag_id,pp.positive_prompt_id FROM prompt_pairs pp "
-    "JOIN prompt_pair_tags ppt ON ppt.pair_id=pp.id WHERE pp.archived=0 "
-    "AND " + SHELVED_PAIR + "),"
-    "counted AS (SELECT t.id,t.name,COUNT(DISTINCT o.pid) AS prompt_count "
-    "FROM tags t LEFT JOIN owners o ON o.tag_id=t.id WHERE {search} "
-    "GROUP BY t.id),"
-    "page AS (SELECT id,name,prompt_count FROM counted WHERE {after} "
-    "ORDER BY prompt_count {direction},id LIMIT ?),"
-    "images(tag_id,n) AS (" + _IMAGE_FILES + " "
-    "WHERE mit.tag_id IN (SELECT id FROM page) GROUP BY mit.tag_id) "
-    "SELECT page.id,page.name,page.prompt_count,"
-    "COALESCE(images.n,0) AS image_count FROM page "
-    "LEFT JOIN images ON images.tag_id=page.id "
-    "ORDER BY page.prompt_count {direction},page.id"
-)
-_UNTAGGED_COUNT = (
-    "SELECT COUNT(*) FROM prompts p WHERE ("
-    + _ELIGIBLE
-    + ") AND "
-    + UNTAGGED
-    # Untagged prompts opens the shelf, which hides archived parents (#443).
-    + " AND "
-    + SHELVED
-)
+_TAG_PAGE = _tag_rows("SELECT id,name FROM tags WHERE id>? ORDER BY id LIMIT ?")
 _TAG_ONE = _tag_rows("SELECT id,name FROM tags WHERE id=?")
 # Every owner kind a tag can sit on, for the delete confirmation.
 _TAG_IMPACT = (
@@ -121,10 +61,7 @@ _TAG_IMPACT = (
    "AS negative_variants,"
    "(SELECT COUNT(*) FROM prompt_pairs pp JOIN prompt_pair_tags ppt "
    "ON ppt.pair_id=pp.id WHERE ppt.tag_id=:tag AND pp.archived!=0) "
-    "AS archived_negative_variants,"
-    "(SELECT COUNT(DISTINCT b.file_id) FROM media_image_tags mit "
-    "JOIN media_annotation_bytes b ON b.id=mit.byte_id WHERE mit.tag_id=:tag) "
-    "AS images"
+    "AS archived_negative_variants"
 )
 _MAX_ID = 2**63 - 1

@@ -145,34 +82,16 @@ def _validate_tag_id(tag_id: object) -> None:
        raise ValueError("Invalid tag ID")


-# Category values in Tags & categories (#332 §7): the prompt-backed values
-# (nonblank values on eligible parents or on active pairs; ``prompt_count``
-# counts only parents on the shelf, so a value only archived parents (#443)
-# hold stays listed with 0, as a tag does; grouped exactly, so
-# whitespace and case variants stay distinct; /library/options lists the same
-# prompt-backed set with its own query) plus the values only image rows hold.
-# A prompt-backed value is ordered by its oldest owning positive; an image-only
-# value sorts after all of them (first_pid is SQLite's INTEGER maximum, above
-# any prompt id), then by value. ``image_count`` counts stored rows, including
-# files missing on disk. No FULL OUTER JOIN, so it runs on SQLite 3.31+.
-_IMAGE_ONLY_FIRST_PID = 2**63 - 1
-_CATEGORY_ROWS = (
-    "WITH owners(value,pid,shelved) AS ("
-    "SELECT p.category,p.id," + SHELVED + " FROM prompts p "
-    "WHERE p.category IS NOT NULL AND TRIM(p.category)!='' AND " + _ELIGIBLE + " "
-    "UNION SELECT pp.category,pp.positive_prompt_id," + SHELVED_PAIR + " "
-    "FROM prompt_pairs pp "
+# The /library/options universe: nonblank values on eligible parents or on
+# active pairs, grouped exactly (whitespace and case variants stay distinct).
+_CATEGORY_GROUPS = (
+    "WITH owners(value,pid) AS ("
+    "SELECT p.category,p.id FROM prompts p WHERE p.category IS NOT NULL "
+    "AND TRIM(p.category)!='' AND " + _ELIGIBLE + " "
+    "UNION SELECT pp.category,pp.positive_prompt_id FROM prompt_pairs pp "
    "WHERE pp.archived=0 AND pp.category IS NOT NULL AND TRIM(pp.category)!=''),"
-    "image_values(value,image_count) AS ("
-    "SELECT category,COUNT(*) FROM image_categories GROUP BY category),"
-    "grouped(value,first_pid,prompt_count) AS ("
-    "SELECT value,MIN(pid),COUNT(DISTINCT CASE WHEN shelved THEN pid END) "
-    "FROM owners GROUP BY value "
-    "UNION ALL SELECT value," + str(_IMAGE_ONLY_FIRST_PID) + ",0 FROM image_values "
-    "WHERE value NOT IN (SELECT value FROM owners)),"
-    "counted AS (SELECT g.value,g.first_pid,g.prompt_count,"
-    "COALESCE(i.image_count,0) AS image_count FROM grouped g "
-    "LEFT JOIN image_values i ON i.value=g.value) "
+    "grouped AS (SELECT value,MIN(pid) AS first_pid,"
+    "COUNT(DISTINCT pid) AS prompt_count FROM owners GROUP BY value) "
 )


@@ -183,23 +102,15 @@ _CATEGORY_COMPONENTS = (
    "WHERE p.category=? ORDER BY p.id"
 )
 _CATEGORY_PAIRS = "SELECT id,archived FROM prompt_pairs WHERE category=? ORDER BY id"
-# Image rows holding one exact value (#332 DC7), an index search.
-_IMAGE_CATEGORY_ROWIDS = (
-    "SELECT rowid FROM image_categories WHERE category=? ORDER BY rowid"
-)
 _CATEGORY_EXISTS = (
    "SELECT EXISTS(SELECT 1 FROM prompts WHERE category=:v)"
    " OR EXISTS(SELECT 1 FROM prompt_pairs WHERE category=:v)"
-    " OR EXISTS(SELECT 1 FROM image_categories WHERE category=:v)"
 )

-# Pairs after components and image rows last, so a failing update rolls every
-# earlier one back. An image row is keyed by its file, never by its value, so
-# merging into a value other files already hold cannot conflict.
+# Pairs after components, so a failing pair update rolls both back.
 _CATEGORY_UPDATES = (
    "UPDATE prompts SET category=?,updated_at=? WHERE category=?",
    "UPDATE prompt_pairs SET category=?,updated_at=? WHERE category=?",
-    "UPDATE image_categories SET category=?,updated_at=? WHERE category=?",
 )


@@ -210,15 +121,8 @@ def category_impact_token(
    target_exists: bool,
    components: list,
    pairs: list,
-    *,
-    images: list = (),
 ) -> str:
-    """Hash a category projection like ``library_edit_token`` (no secret).
-
-    ``images`` are the rowids of the image rows holding ``source`` (#332 DC7).
-    With none the preimage has no ``images`` key, so a prompt-only token keeps
-    the value it had before image categories existed.
-    """
+    """Hash a category projection like ``library_edit_token`` (no secret)."""
    preimage = {
        "epoch": epoch,
        "source": source,
@@ -227,8 +131,6 @@ def category_impact_token(
        "components": sorted([int(i), bool(flag)] for i, flag in components),
        "pairs": sorted([int(i), bool(flag)] for i, flag in pairs),
    }
-    if images:
-        preimage["images"] = sorted(int(i) for i in images)
    return canonical_token(_CATEGORY_DOMAIN, preimage)


@@ -260,28 +162,6 @@ def _tag_after(after: object) -> int:
    return after


-def _tag_search(search: object) -> str:
-    if not isinstance(search, str) or len(search) > _MAX_SEARCH:
-        raise ValueError(f"Tag search must be text of at most {_MAX_SEARCH} characters")
-    return search.strip()
-
-
-def _sorted_tag_after(after: object, sort: str) -> tuple | None:
-    """The ``[key, id]`` cursor of a name or prompt-count sort."""
-    if after is None:
-        return None
-    key_type = str if sort.startswith("name") else int
-    if (
-        not isinstance(after, list)
-        or len(after) != 2
-        or type(after[0]) is not key_type
-        or type(after[1]) is not int
-        or after[1] <= 0
-    ):
-        raise ValueError("Invalid vocabulary cursor")
-    return after[0], after[1]
-
-
 def _category_after(after: object) -> tuple[int, str] | None:
    if after is None:
        return None
@@ -325,16 +205,7 @@ class VocabularyOperations:
            "SELECT COUNT(DISTINCT pair_id) FROM prompt_pair_tags WHERE tag_id=?",
            (tag_id,),
        ).fetchone()[0]
-        images = conn.execute(
-            "SELECT COUNT(DISTINCT b.file_id) FROM media_image_tags mit "
-            "JOIN media_annotation_bytes b ON b.id=mit.byte_id WHERE mit.tag_id=?",
-            (tag_id,),
-        ).fetchone()[0]
-        return {
-            "components_changed": components,
-            "pairs_changed": pairs,
-            "images_changed": images,
-        }
+        return {"components_changed": components, "pairs_changed": pairs}

    def create_vocabulary_tag(self, name: str, *, expected_epoch: str) -> dict:
        """Insert an unused registry row, or reuse the exact existing name."""
@@ -379,7 +250,6 @@ class VocabularyOperations:
                "SELECT id FROM tags WHERE name=?", (new_name,)
            ).fetchone()
            if target is None:
-                self._bump_image_tag_bytes(conn, tag_id)
                conn.execute("UPDATE tags SET name=? WHERE id=?", (new_name, tag_id))
                result_id = tag_id
            else:
@@ -405,7 +275,6 @@ class VocabularyOperations:
            epoch = self._library_epoch(conn, expected_epoch)
            self._vocabulary_identity(conn, epoch, tag_id, name)
            counts = self._tag_owner_counts(conn, tag_id)
-            self._bump_image_tag_bytes(conn, tag_id)
            conn.execute("DELETE FROM tags WHERE id=?", (tag_id,))
            return {"library_epoch": epoch, "deleted": True, **counts}

@@ -430,8 +299,7 @@ class VocabularyOperations:
        pairs = [
            [row[0], bool(row[1])] for row in conn.execute(_CATEGORY_PAIRS, (source,))
        ]
-        images = [row[0] for row in conn.execute(_IMAGE_CATEGORY_ROWIDS, (source,))]
-        if not components and not pairs and not images:
+        if not components and not pairs:
            raise LibraryCommandError("vocabulary-conflict", epoch)
        target_exists = bool(
            conn.execute(_CATEGORY_EXISTS, {"v": target}).fetchone()[0]
@@ -445,10 +313,9 @@ class VocabularyOperations:
                "other_prompts": len(components) - eligible,
                "negative_variants": len(pairs) - archived,
                "archived_negative_variants": archived,
-                "images": len(images),
            },
            "impact_token": category_impact_token(
-                epoch, source, target, target_exists, components, pairs, images=images
+                epoch, source, target, target_exists, components, pairs
            ),
        }

@@ -472,8 +339,7 @@ class VocabularyOperations:
    def apply_vocabulary_category(
        self, *, expected_epoch: str, source: str, target: str, impact_token: str
    ) -> dict:
-        """Set the exact ``source`` to ``target`` on every component, pair
-        and image row.
+        """Set the exact ``source`` to ``target`` on every component and pair.

        The recomputed projection must still match the preview's token; a
        mismatch is ``vocabulary-conflict`` with nothing written.
@@ -503,80 +369,22 @@ class VocabularyOperations:
        epoch: str,
        *,
        limit: int = 100,
-        after: object = None,
-        search: str = "",
-        sort: str = "created",
+        after: int | None = None,
    ) -> dict:
-        """One page of tags matching ``search`` (a literal, case-insensitive
-        substring) in ``sort`` order, with the untagged parents' count."""
        _limit(limit)
-        search = _tag_search(search)
-        if not isinstance(sort, str) or sort not in TAG_SORTS:
-            raise ValueError("sort must be one of " + ", ".join(TAG_SORTS))
-        where, params = "1=1", []
-        if search:
-            where, params = _TAG_SEARCH, [f"%{_escape(search)}%"]
-        total, untagged = conn.execute(
-            f"SELECT (SELECT COUNT(*) FROM tags WHERE {where}),({_UNTAGGED_COUNT})",
-            params,
-        ).fetchone()
-        rows = [
-            dict(row) for row in self._tag_page(conn, where, params, sort, after, limit)
-        ]
+        start = _tag_after(after)
+        total = conn.execute("SELECT COUNT(*) FROM tags").fetchone()[0]
+        rows = [dict(row) for row in conn.execute(_TAG_PAGE, (start, limit + 1))]
        has_more = len(rows) > limit
        rows = rows[:limit]
-        key, _direction = TAG_SORTS[sort]
-        next_key = None
-        if has_more:
-            last = rows[-1]
-            next_key = (
-                last["id"]
-                if key is None
-                else [
-                    last["prompt_count" if key == "prompt_count" else "name"],
-                    last["id"],
-                ]
-            )
        return {
            "library_epoch": epoch,
            "tags": rows,
            "total": total,
-            "untagged_count": untagged,
-            # Echoed so a client can tell this read applied its search and sort.
-            "search": search,
-            "sort": sort,
            "has_more": has_more,
-            "next_key": next_key,
+            "next_key": rows[-1]["id"] if has_more else None,
        }

-    @staticmethod
-    def _tag_page(conn, where, params, sort, after, limit):
-        key, direction = TAG_SORTS[sort]
-        if key is None:
-            page = (
-                f"SELECT id,name FROM tags WHERE {where} AND id>? ORDER BY id LIMIT ?"
-            )
-            return conn.execute(
-                _tag_rows(page), [*params, _tag_after(after), limit + 1]
-            )
-        cursor = _sorted_tag_after(after, sort)
-        operator = ">" if direction == "ASC" else "<"
-        keyset, keys = "1=1", []
-        if cursor is not None:
-            keyset = f"({key}{operator}? OR ({key}=? AND id>?))"
-            keys = [cursor[0], cursor[0], cursor[1]]
-        if key == "prompt_count":
-            sql = _RANKED_TAG_PAGE.format(
-                search=where, after=keyset, direction=direction
-            )
-            return conn.execute(sql, [*params, *keys, limit + 1])
-        page = (
-            f"SELECT id,name FROM tags WHERE {where} AND {keyset} "
-            f"ORDER BY {key} {direction},id LIMIT ?"
-        )
-        order = f"page.{key} {direction},page.id"
-        return conn.execute(_tag_rows(page, order), [*params, *keys, limit + 1])
-
    def _vocabulary_categories(
        self,
        conn: sqlite3.Connection,
@@ -588,15 +396,15 @@ class VocabularyOperations:
        _limit(limit)
        key = _category_after(after)
        total = conn.execute(
-            _CATEGORY_ROWS + "SELECT COUNT(*) FROM counted"
+            _CATEGORY_GROUPS + "SELECT COUNT(*) FROM grouped"
        ).fetchone()[0]
        where, params = "", []
        if key is not None:
            where = " WHERE first_pid>? OR (first_pid=? AND value>?)"
            params = [key[0], key[0], key[1]]
        rows = conn.execute(
-            _CATEGORY_ROWS
-            + "SELECT value,first_pid,prompt_count,image_count FROM counted"
+            _CATEGORY_GROUPS
+            + "SELECT value,first_pid,prompt_count FROM grouped"
            + where
            + " ORDER BY first_pid,value LIMIT ?",
            [*params, limit + 1],
@@ -606,11 +414,7 @@ class VocabularyOperations:
        return {
            "library_epoch": epoch,
            "categories": [
-                {
-                    "value": row["value"],
-                    "prompt_count": row["prompt_count"],
-                    "image_count": row["image_count"],
-                }
+                {"value": row["value"], "prompt_count": row["prompt_count"]}
                for row in rows
            ],
            "total": total,
@@ -620,18 +424,9 @@ class VocabularyOperations:
            ),
        }

-    def list_vocabulary_tags(
-        self,
-        *,
-        limit: int = 100,
-        after: object = None,
-        search: str = "",
-        sort: str = "created",
-    ):
+    def list_vocabulary_tags(self, *, limit: int = 100, after: int | None = None):
        with self.library_snapshot() as (conn, epoch, _ceiling):
-            return self._vocabulary_tags(
-                conn, epoch, limit=limit, after=after, search=search, sort=sort
-            )
+            return self._vocabulary_tags(conn, epoch, limit=limit, after=after)

    def list_vocabulary_categories(
        self, *, limit: int = 100, after: list | None = None
@@ -1,652 +0,0 @@
-"""Each workflow and prompt graph stored once, compressed (#249 S6 carry-over).
-
-``generated_images.workflow_data`` (the UI workflow) and ``prompt_metadata``
-(the API prompt graph) used to hold the same large JSON text again for every
-image of a run. Now each distinct text is one ``workflow_documents`` row:
-
- ``sha256``: the SHA-256 of the text's exact UTF-8 bytes (unique key);
- ``byte_length``: the length of those bytes;
- ``data``: ``zlib.compress`` of those bytes.
-
-An image row references its texts through ``workflow_document_id`` and
-``prompt_document_id``. Two forms coexist until the migration has rewritten
-every row, and both stay readable forever:
-
- old form: the text inline in ``workflow_data`` / ``prompt_metadata``, no id;
- new form: the inline column NULL and the document id set.
-
-The text is stored and hashed exactly as written, never parsed and
-re-serialized, because a JSON round trip can change bytes (key order,
-spacing, number spelling, duplicate keys, ComfyUI's ``NaN`` tokens).
-
-``read_stored_text`` is the one decoder. Inline text, when present, wins (a
-row an older app version rewrote inline stays right); otherwise the document
-is read by its rowid, decompressed within its recorded length and checked
-against its length and hash. A document that fails a check reads as
-unreadable (None, logged), never as other text. ``resolve_image_row`` puts
-the texts back into a ``generated_images`` row and drops the id keys, so
-every payload keeps its shape.
-
-No trigger: every restore validator refuses triggers in a restored file. A
-document is removed in code: ``release_documents`` in the same transaction
-that drops a row's last reference, and ``sweep_documents`` (at startup, after
-the migration and before Reclaim space) for anything a path missed.
-"""
-
-import hashlib
-import logging
-import re
-import sqlite3
-import zlib
-from collections import OrderedDict
-from typing import Any, Dict, Iterable, Optional, Set
-
-logger = logging.getLogger("prompt_manager.database.workflow_documents")
-
-TABLE = "workflow_documents"
-# (inline text column, document id column) on generated_images.
-TEXT_COLUMNS = (
-    ("workflow_data", "workflow_document_id"),
-    ("prompt_metadata", "prompt_document_id"),
-)
-DOCUMENT_ID_COLUMNS = tuple(reference for _column, reference in TEXT_COLUMNS)
-INDEXES = {
-    "workflow_document_id": "idx_image_workflow_document",
-    "prompt_document_id": "idx_image_prompt_document",
-}
-COMPRESSION_LEVEL = 6
-# A text larger than this stays inline: a document is decompressed in one
-# piece, and its recorded length bounds that (a restored file cannot make a
-# small row expand without limit).
-MAX_DOCUMENT_BYTES = 256 * 2**20
-ID_BATCH = 400  # ids bound per statement (under SQLite's old 999 limit)
-
-_DDL = (
-    f"CREATE TABLE {TABLE} (id INTEGER PRIMARY KEY, sha256 BLOB NOT NULL UNIQUE, "
-    "byte_length INTEGER NOT NULL, data BLOB NOT NULL)"
-)
-_AUTOINDEX = f"sqlite_autoindex_{TABLE}_1"
-_REFERENCE_TYPE = f"INTEGER REFERENCES {TABLE}(id)"
-
-_UNREFERENCED = (
-    "NOT EXISTS (SELECT 1 FROM generated_images g "
-    "WHERE g.workflow_document_id=workflow_documents.id) "
-    "AND NOT EXISTS (SELECT 1 FROM generated_images g "
-    "WHERE g.prompt_document_id=workflow_documents.id)"
-)
-LOOKUP_SQL = (
-    "SELECT id, sha256, byte_length, data FROM workflow_documents WHERE sha256=?"
-)
-REPAIR_SQL = "UPDATE workflow_documents SET byte_length=?, data=? WHERE id=?"
-ALL_DOCUMENTS_SQL = "SELECT sha256, byte_length, data, id FROM workflow_documents"
-READ_SQL = "SELECT sha256, byte_length, data FROM workflow_documents WHERE id=?"
-INSERT_SQL = (
-    "INSERT INTO workflow_documents (sha256, byte_length, data) VALUES (?, ?, ?)"
-)
-# Built from constants only; the ids are bound as "?" marks.
-RELEASE_SQL = "DELETE FROM workflow_documents WHERE id IN ({marks}) AND "
-RELEASE_SQL += _UNREFERENCED
-# The sweep walks the ids through the small unique index, not the blobs.
-SWEEP_SQL = (
-    "DELETE FROM workflow_documents WHERE id IN (SELECT id FROM workflow_documents "
-    "INDEXED BY sqlite_autoindex_workflow_documents_1 WHERE "
-)
-SWEEP_SQL += _UNREFERENCED + ")"
-IMAGE_DOCUMENTS_SQL = (
-    "SELECT workflow_document_id, prompt_document_id FROM generated_images WHERE "
-)
-
-# Statements whose query plans tests/test_workflow_documents.py records.
-QUERY_PLAN_STATEMENTS = {
-    "lookup by hash": (LOOKUP_SQL, (b"\0" * 32,)),
-    "read by id": (READ_SQL, (1,)),
-    "release": (RELEASE_SQL.format(marks="?,?"), (1, 2)),
-    "sweep": (SWEEP_SQL, ()),
-    "documents of images": (IMAGE_DOCUMENTS_SQL + "id IN (?,?)", (1, 2)),
-    "documents of prompts": (IMAGE_DOCUMENTS_SQL + "prompt_id IN (?,?)", (1, 2)),
-}
-
-
-class DocumentMismatch(Exception):
-    """A document would not give back exactly the text it was made from."""
-
-
-def _compact(sql: str) -> str:
-    return re.sub(r"\s+", "", sql or "").lower()
-
-
-# ── schema ────────────────────────────────────────────────────────────
-
-
-def _reference_columns(conn: sqlite3.Connection) -> Dict[str, tuple]:
-    return {
-        row[1]: tuple(row)
-        for row in conn.execute("PRAGMA table_info(generated_images)")
-        if row[1] in DOCUMENT_ID_COLUMNS
-    }
-
-
-def _reference_error(conn: sqlite3.Connection, columns: Dict[str, tuple]):
-    for name, info in columns.items():
-        # (cid, name, type, notnull, default, pk)
-        if (str(info[2]).upper(), info[3], info[4], info[5]) != ("INTEGER", 0, None, 0):
-            return "Workflow document references have an invalid column"
-    keys = {
-        (row[3], row[2], row[4])
-        for row in conn.execute("PRAGMA foreign_key_list(generated_images)")
-        if row[3] in DOCUMENT_ID_COLUMNS
-    }
-    if keys != {(name, TABLE, "id") for name in DOCUMENT_ID_COLUMNS}:
-        return "Workflow document references have invalid foreign keys"
-    for column, index in INDEXES.items():
-        info = conn.execute(f'PRAGMA index_info("{index}")').fetchall()
-        owner = conn.execute(
-            "SELECT tbl_name FROM sqlite_master WHERE type='index' AND name=?",
-            (index,),
-        ).fetchone()
-        if [row[2] for row in info] != [column] or not owner:
-            return "Workflow document references are missing their index"
-        if owner[0] != "generated_images":
-            return "Workflow document references are missing their index"
-    return None
-
-
-def _value_error(conn: sqlite3.Connection):
-    if conn.execute(
-        "SELECT 1 FROM workflow_documents WHERE typeof(sha256)!='blob' "
-        "OR length(sha256)!=32 OR typeof(byte_length)!='integer' OR byte_length<0 "
-        "OR byte_length>? OR typeof(data)!='blob' LIMIT 1",
-        (MAX_DOCUMENT_BYTES,),
-    ).fetchone():
-        return "Workflow documents contain invalid values"
-    for column in DOCUMENT_ID_COLUMNS:
-        # typeof() reads no overflow page; a dangling id is a rowid probe.
-        # ``column`` is one of DOCUMENT_ID_COLUMNS, never caller data.
-        sql = (
-            f"SELECT 1 FROM generated_images g WHERE typeof(g.{column}) "  # nosec B608
-            f"NOT IN ('null','integer') OR (g.{column} IS NOT NULL AND NOT EXISTS "
-            f"(SELECT 1 FROM workflow_documents d WHERE d.id=g.{column})) LIMIT 1"
-        )
-        if conn.execute(sql).fetchone():
-            return "Workflow document references point at missing documents"
-    return None
-
-
-def damaged_message(document_id: int) -> str:
-    """The verify reason for a damaged document: which one, and what to do."""
-    return (
-        f"Workflow document {document_id} is damaged: its text no longer matches "
-        "its checksum, and the images that use it show no workflow. To fix it, "
-        "restore a backup from before the damage, or store a new image with the "
-        "same workflow (that repairs it)."
-    )
-
-
-def _damaged_document(conn: sqlite3.Connection) -> Optional[int]:
-    """The first document failing its length or hash check, or None."""
-    for row in conn.execute(ALL_DOCUMENTS_SQL):
-        if _decode(row[:3], row[3], quiet=True) is None:
-            return row[3]
-    return None
-
-
-def workflow_documents_schema_error(
-    conn: sqlite3.Connection, *, allow_missing: bool = True, documents: bool = False
-) -> Optional[str]:
-    """Reject an unsupported document schema or invalid stored values (reads only).
-
-    A database from before the dedupe has neither the table nor the id
-    columns; that is acceptable unless ``allow_missing`` is false. Half of
-    the schema never is.
-    """
-    objects = conn.execute(
-        "SELECT type,name,sql FROM sqlite_master WHERE name=? "
-        "OR (type IN ('index','trigger') AND tbl_name=?)",
-        (TABLE, TABLE),
-    ).fetchall()
-    has_images = conn.execute(
-        "SELECT 1 FROM sqlite_master WHERE type='table' AND name='generated_images'"
-    ).fetchone()
-    columns = _reference_columns(conn) if has_images else {}
-    if not objects and not columns:
-        if allow_missing or not has_images:
-            return None
-        return "Missing workflow document schema"
-    if not objects or set(columns) != set(DOCUMENT_ID_COLUMNS):
-        return "Incomplete workflow document schema"
-    tables = [sql for kind, _name, sql in objects if kind == "table"]
-    others = {(kind, name, sql) for kind, name, sql in objects if kind != "table"}
-    if len(tables) != 1 or others != {("index", _AUTOINDEX, None)}:
-        return "Workflow documents name is reserved by an unsupported schema object"
-    # The exact definition fixes the columns, their types and constraints.
-    if _compact(tables[0]) != _compact(_DDL):
-        return "Workflow documents have an invalid table definition"
-    error = _reference_error(conn, columns) or _value_error(conn)
-    if error is None and documents:
-        # Restore and backup verification only: every document is read.
-        damaged = _damaged_document(conn)
-        if damaged is not None:
-            return damaged_message(damaged)
-    return error
-
-
-def migrate_workflow_documents(conn: sqlite3.Connection) -> None:
-    """Install the table, the id columns and their indexes atomically.
-
-    Runs after every older migration (the table rebuilds only run on
-    databases without ``file_path``, before this). Validates before and
-    after, then sweeps documents no row references.
-    """
-    conn.execute("SAVEPOINT workflow_documents_schema")
-    try:
-        error = workflow_documents_schema_error(conn)
-        if error:
-            raise sqlite3.DatabaseError(error)
-        conn.execute(_DDL.replace("CREATE TABLE", "CREATE TABLE IF NOT EXISTS", 1))
-        present = _reference_columns(conn)
-        for column in DOCUMENT_ID_COLUMNS:
-            if column not in present:
-                conn.execute(
-                    f"ALTER TABLE generated_images ADD COLUMN {column} "
-                    f"{_REFERENCE_TYPE}"
-                )
-        for column, index in INDEXES.items():
-            conn.execute(
-                f"CREATE INDEX IF NOT EXISTS {index} ON generated_images({column})"
-            )
-        error = workflow_documents_schema_error(conn, allow_missing=False)
-        if error:
-            raise sqlite3.DatabaseError(error)
-        sweep_documents(conn)
-        conn.execute("RELEASE workflow_documents_schema")
-    except BaseException:
-        conn.execute("ROLLBACK TO workflow_documents_schema")
-        conn.execute("RELEASE workflow_documents_schema")
-        raise
-
-
-# ── write ─────────────────────────────────────────────────────────────
-
-
-def storable(text: Any) -> bool:
-    """Whether ``text`` can be a document (text within MAX_DOCUMENT_BYTES)."""
-    if not isinstance(text, str):
-        return False
-    # UTF-8 takes at most 4 bytes a character: most texts need no encoding.
-    if len(text) * 4 <= MAX_DOCUMENT_BYTES:
-        return True
-    return len(text.encode("utf-8")) <= MAX_DOCUMENT_BYTES
-
-
-def store_text(
-    conn: sqlite3.Connection, text: Optional[str], verified: Optional[set] = None
-) -> Optional[int]:
-    """The id of the document holding exactly ``text``; None for None.
-
-    Reuses the document with the same hash, or inserts a new one whose
-    compressed bytes were checked to decompress to ``text``'s bytes. A reused
-    document is decompressed and checked first; a damaged one (a restored
-    file's corruption under a valid hash) is repaired from ``text``, whose
-    hash is its key, so every row that references it reads right again.
-    ``verified``, when given, holds the ids already checked (a migration
-    batch), which are then not read again. Opens a write transaction first
-    when none is open, so a concurrent ``release_documents`` cannot remove a
-    reused document before the caller references it. Raises TypeError for a
-    non-text value and ValueError for a text over MAX_DOCUMENT_BYTES.
-    """
-    if text is None:
-        return None
-    if not isinstance(text, str):
-        raise TypeError("Only text is stored as a workflow document")
-    raw = text.encode("utf-8")
-    if len(raw) > MAX_DOCUMENT_BYTES:
-        raise ValueError("Text is too large for a workflow document")
-    digest = hashlib.sha256(raw).digest()
-    if not conn.in_transaction:
-        conn.execute("BEGIN IMMEDIATE")
-    row = conn.execute(LOOKUP_SQL, (digest,)).fetchone()
-    if row is not None and verified is not None and row[0] in verified:
-        return row[0]
-    data = zlib.compress(raw, COMPRESSION_LEVEL)
-    if zlib.decompress(data) != raw:  # pragma: no cover - zlib is exact
-        raise DocumentMismatch("Compression did not round-trip")
-    if row is None:
-        document_id = conn.execute(INSERT_SQL, (digest, len(raw), data)).lastrowid
-    else:
-        document_id = row[0]
-        if _decode(row[1:], document_id, quiet=True) != text:
-            logger.warning(f"Workflow document {document_id} was damaged; repaired")
-            conn.execute(REPAIR_SQL, (len(raw), data, document_id))
-    if verified is not None:
-        verified.add(document_id)
-    return document_id
-
-
-def stored_values(
-    conn: sqlite3.Connection, texts: Dict[str, Optional[str]]
-) -> Dict[str, Any]:
-    """New-form column values for ``{text column: text}`` (writers).
-
-    Each text becomes ``{column: None, id column: document id}``; None
-    stays ``{column: None, id column: None}``; a value that cannot be a
-    document (not text, or too large) stays inline with no id.
-    """
-    references = dict(TEXT_COLUMNS)
-    values: Dict[str, Any] = {}
-    for column, text in texts.items():
-        reference = references[column]
-        if text is None or not storable(text):
-            values[column], values[reference] = text, None
-        else:
-            values[column], values[reference] = None, store_text(conn, text)
-    return values
-
-
-# ── read ──────────────────────────────────────────────────────────────
-
-
-def _decode(row, document_id, quiet=False) -> Optional[str]:
-    """``(sha256, byte_length, data)`` as checked text, or None (logged)."""
-    if row is None:
-        logger.warning(f"Workflow document {document_id} is missing")
-        return None
-    digest, length, data = bytes(row[0]), row[1], row[2]
-    try:
-        if not isinstance(length, int) or not 0 <= length <= MAX_DOCUMENT_BYTES:
-            raise ValueError("invalid length")
-        inflater = zlib.decompressobj()
-        raw = inflater.decompress(bytes(data), length + 1)
-        if len(raw) != length or inflater.unconsumed_tail or not inflater.eof:
-            raise ValueError("length differs")
-        if hashlib.sha256(raw).digest() != digest:
-            raise ValueError("hash differs")
-        return raw.decode("utf-8")
-    except (zlib.error, ValueError, TypeError) as error:
-        if not quiet:
-            logger.warning(f"Workflow document {document_id} is unreadable: {error}")
-        return None
-
-
-def read_stored_text(
-    conn: sqlite3.Connection, inline: Any, document_id: Optional[int]
-) -> Any:
-    """The stored text of one column: inline when present, else the document.
-
-    Returns None when there is neither, or when the document is missing or
-    fails its checks (logged). An inline value is returned unchanged.
-    """
-    if inline is not None:
-        return inline
-    if document_id is None:
-        return None
-    return _decode(conn.execute(READ_SQL, (document_id,)).fetchone(), document_id)
-
-
-class DocumentReader:
-    """``read_stored_text`` with a small memo for list reads on one connection."""
-
-    MEMO = 32
-
-    def __init__(self, conn: sqlite3.Connection):
-        self.conn = conn
-        self._memo: "OrderedDict[int, Optional[str]]" = OrderedDict()
-
-    def text(self, inline: Any, document_id: Optional[int]) -> Any:
-        if inline is not None or document_id is None:
-            return read_stored_text(self.conn, inline, document_id)
-        if document_id in self._memo:
-            self._memo.move_to_end(document_id)
-            return self._memo[document_id]
-        text = read_stored_text(self.conn, None, document_id)
-        self._memo[document_id] = text
-        if len(self._memo) > self.MEMO:
-            self._memo.popitem(last=False)
-        return text
-
-
-def resolve_image_row(reader: DocumentReader, row) -> Dict[str, Any]:
-    """A ``generated_images`` row as a dict with its texts read back.
-
-    The id columns are dropped, so a payload built from it has the shape it
-    had before the dedupe. Columns the row did not select stay absent.
-    """
-    data = dict(row)
-    for column, reference in TEXT_COLUMNS:
-        has_reference = reference in data
-        document_id = data.pop(reference, None)
-        if column in data or has_reference:
-            data[column] = reader.text(data.get(column), document_id)
-    return data
-
-
-# ── garbage ───────────────────────────────────────────────────────────
-
-
-def _chunks(values):
-    values = list(values)
-    for start in range(0, len(values), ID_BATCH):
-        yield values[start : start + ID_BATCH]
-
-
-def image_documents(conn: sqlite3.Connection, where: str, params) -> Set[int]:
-    """The document ids the image rows matching ``where`` reference.
-
-    ``where`` is a fixed condition written in this package (``id IN (...)``,
-    ``prompt_id IN (...)``), never caller data; values go in ``params``.
-    """
-    ids: Set[int] = set()
-    sql = IMAGE_DOCUMENTS_SQL + where
-    for row in conn.execute(sql, list(params)):  # nosec B608
-        ids.update(value for value in row if value is not None)
-    return ids
-
-
-def documents_of_rows(
-    conn: sqlite3.Connection, column: str, values: Iterable[Any]
-) -> Set[int]:
-    """Document ids of the image rows whose ``column`` is in ``values``.
-
-    ``column`` is ``id`` or ``prompt_id`` (the rows a prompt delete cascades to).
-    """
-    if column not in ("id", "prompt_id"):
-        raise ValueError(f"Unsupported column {column!r}")
-    ids: Set[int] = set()
-    for chunk in _chunks(values):
-        marks = ",".join("?" for _ in chunk)
-        ids |= image_documents(conn, f"{column} IN ({marks})", chunk)
-    return ids
-
-
-def release_documents(conn: sqlite3.Connection, ids: Iterable[Optional[int]]) -> int:
-    """Delete the documents in ``ids`` that no image row references now.
-
-    Runs in the caller's transaction, right after the delete or update that
-    dropped the references. Returns how many documents were removed.
-    """
-    removed = 0
-    for chunk in _chunks(sorted({i for i in ids if i is not None})):
-        marks = ",".join("?" for _ in chunk)
-        # Only "?" marks are interpolated.
-        sql = RELEASE_SQL.format(marks=marks)
-        removed += conn.execute(sql, chunk).rowcount  # nosec B608
-    return removed
-
-
-def sweep_documents(conn: sqlite3.Connection) -> int:
-    """Delete every document no image row references; returns the count."""
-    return conn.execute(SWEEP_SQL).rowcount
-
-
-# ── repair (a restore's stage) ────────────────────────────────────────
-
-INLINE_TEXTS_SQL = (
-    "SELECT workflow_data, prompt_metadata FROM generated_images "
-    "WHERE workflow_data IS NOT NULL OR prompt_metadata IS NOT NULL"
-)
-REKEY_SQL = "UPDATE workflow_documents SET sha256=?, byte_length=? WHERE id=?"
-
-
-def _rows(conn: sqlite3.Connection, sql: str, params=()):
-    """Each row of ``sql``, read one at a time.
-
-    Iterating a managed connection's cursor prefetches ``ITER_CHUNK`` (128)
-    rows, and a document or inline text can be megabytes.
-    """
-    cursor = conn.execute(sql, params)
-    while (row := cursor.fetchone()) is not None:
-        yield row
-
-
-def _inflated(data) -> Optional[bytes]:
-    """The complete text bytes ``data`` inflates to, or None.
-
-    Complete means the zlib stream ends (its Adler-32 checked) within
-    MAX_DOCUMENT_BYTES with nothing after it: the body is intact even when
-    the row's recorded hash or length is not.
-    """
-    try:
-        inflater = zlib.decompressobj()
-        raw = inflater.decompress(bytes(data), MAX_DOCUMENT_BYTES + 1)
-        if not inflater.eof or inflater.unconsumed_tail or inflater.unused_data:
-            return None
-        if len(raw) > MAX_DOCUMENT_BYTES:
-            return None
-        raw.decode("utf-8")
-        return raw
-    except (zlib.error, TypeError, UnicodeDecodeError):
-        return None
-
-
-def _one_column_off(row, raw: bytes) -> bool:
-    """Whether only the recorded hash or only the recorded length is wrong.
-
-    The two columns check the body independently. When the body inflates
-    completely and one of them still agrees with it, that column vouches for
-    the body and the other one is the damaged value. When both disagree, the
-    body itself is the suspect (another valid stream), so it is not trusted.
-    """
-    hash_ok = hashlib.sha256(raw).digest() == bytes(row[0])
-    length_ok = row[1] == len(raw)
-    return hash_ok != length_ok
-
-
-def _inline_copies(conn: sqlite3.Connection, wanted: Dict[bytes, int]):
-    """``{document id: text}`` for each wanted hash an inline row still holds."""
-    found: Dict[int, str] = {}
-    for row in _rows(conn, INLINE_TEXTS_SQL):
-        for text in row:
-            if not isinstance(text, str) or not storable(text):
-                continue
-            document_id = wanted.get(hashlib.sha256(text.encode("utf-8")).digest())
-            if document_id is not None and document_id not in found:
-                found[document_id] = text
-        if len(found) == len(wanted):
-            break
-    return found
-
-
-def _rekey(conn: sqlite3.Connection, document_id: int, raw: bytes) -> Optional[int]:
-    """Give an intact body its true key, or merge it into the document that has it.
-
-    Returns the holder's id when its own body was damaged and has just been
-    rewritten from ``raw`` (it is repaired, never to be cleared), else None.
-    """
-    digest = hashlib.sha256(raw).digest()
-    holder = conn.execute(LOOKUP_SQL, (digest,)).fetchone()
-    if holder is None or holder[0] == document_id:
-        conn.execute(REKEY_SQL, (digest, len(raw), document_id))
-        return None
-    for column in DOCUMENT_ID_COLUMNS:
-        # ``column`` is one of DOCUMENT_ID_COLUMNS, never caller data.
-        conn.execute(
-            f"UPDATE generated_images SET {column}=? WHERE {column}=?",  # nosec B608
-            (holder[0], document_id),
-        )
-    conn.execute("DELETE FROM workflow_documents WHERE id=?", (document_id,))
-    if _decode(holder[1:], holder[0], quiet=True) is None:
-        conn.execute(
-            REPAIR_SQL, (len(raw), zlib.compress(raw, COMPRESSION_LEVEL), holder[0])
-        )
-        return holder[0]
-    return None
-
-
-def repair_damaged_documents(conn: sqlite3.Connection) -> Dict[str, int]:
-    """Repair or clear every document failing its checks; commit (writes).
-
-    For a restore's stage only, never the live library. In order:
-
-    1. A document whose body inflates completely and whose recorded hash or
-       length (not both) disagrees is re-keyed from its text, or merged
-       into the document that already holds that text (``_one_column_off``).
-    2. A damaged body whose exact text an inline row still holds (the same
-       SHA-256, its key) is stored again from that text.
-    3. Any other damaged document is unreadable for good: its images'
-       references are cleared (they already showed no workflow) and the
-       document is removed, so the stage verifies.
-
-    Returns ``{repaired, cleared, images}``: documents repaired (1 and 2),
-    documents cleared and the distinct image rows whose reference was
-    cleared. Rows are read one at a time.
-    """
-    damaged: Dict[bytes, int] = {}
-    intact: Dict[int, bytes] = {}
-    for row in _rows(conn, ALL_DOCUMENTS_SQL):
-        if _decode(row[:3], row[3], quiet=True) is None:
-            raw = _inflated(row[2])
-            if raw is not None and _one_column_off(row, raw):
-                intact[row[3]] = raw
-            else:
-                damaged[bytes(row[0])] = row[3]
-    result = {"repaired": 0, "cleared": 0, "images": 0}
-    if not damaged and not intact:
-        return result
-    with conn:
-        healed = []
-        for document_id, raw in intact.items():
-            holder = _rekey(conn, document_id, raw)
-            if holder is not None and holder in damaged.values():
-                # Rewritten from the merged body: repaired, not to be cleared
-                # (it now also holds the merged images' references).
-                damaged = {k: v for k, v in damaged.items() if v != holder}
-                healed.append(holder)
-        copies = _inline_copies(conn, damaged) if damaged else {}
-        for document_id, text in copies.items():
-            raw = text.encode("utf-8")
-            data = zlib.compress(raw, COMPRESSION_LEVEL)
-            conn.execute(REPAIR_SQL, (len(raw), data, document_id))
-        lost = sorted(set(damaged.values()) - set(copies))
-        images: Set[int] = set()
-        for chunk in _chunks(lost):
-            marks = ",".join("?" * len(chunk))
-            # ``marks`` is only "?" placeholders; the ids are bound.
-            for (image_id,) in _rows(
-                conn,
-                "SELECT id FROM generated_images WHERE "  # nosec B608
-                f"workflow_document_id IN ({marks}) OR prompt_document_id IN ({marks})",
-                chunk + chunk,
-            ):
-                images.add(image_id)
-            for column in DOCUMENT_ID_COLUMNS:
-                conn.execute(
-                    f"UPDATE generated_images SET {column}=NULL "  # nosec B608
-                    f"WHERE {column} IN ({marks})",
-                    chunk,
-                )
-            conn.execute(
-                f"DELETE FROM workflow_documents WHERE id IN ({marks})",  # nosec B608
-                chunk,
-            )
-    for document_id in list(intact) + healed + list(copies):
-        logger.warning(f"Workflow document {document_id} was damaged; repaired")
-    if lost:
-        logger.warning(
-            f"{len(lost)} damaged workflow document(s) could not be repaired; "
-            f"{len(images)} image(s) show no workflow"
-        )
-    result.update(
-        repaired=len(intact) + len(healed) + len(copies),
-        cleared=len(lost),
-        images=len(images),
-    )
-    return result
@@ -1,460 +0,0 @@
-"""The workflow storage migration and Reclaim space (#249 S6 carry-over).
-
-``migrate_workflow_storage`` rewrites old-form image rows (workflow and
-prompt graph text inline) to the new form (a ``workflow_documents`` id,
-``database/workflow_documents.py``) in batches:
-
- each batch is one ``BEGIN IMMEDIATE`` transaction over at most
-  ``BATCH_ROWS`` rows or about ``BATCH_BYTES`` of text, found by a rowid
-  range search (``NEXT_IDS_SQL``) and read one row at a time, so memory is
-  bounded by one row plus the batch's distinct documents;
- each text is stored (or its document reused) and read back through the
-  one accessor before its row changes; a text that would not come back
-  identical fails the batch (``DocumentMismatch``) and rolls it back whole;
- a value that is not text (or is over ``MAX_DOCUMENT_BYTES``) stays inline
-  and is counted as protected;
- each row runs in its own savepoint: one that cannot be rewritten (text
-  SQLite cannot decode, a text that would not come back) stays inline and
-  is listed, and the rest of the batch goes on;
- a batch ends after ``BATCH_SECONDS``, and the write lock is then left
-  free for ``BATCH_PAUSE``, so other writers are never starved.
-
-A crash or a stop between batches leaves committed batches in the new form
-and the rest in the old form; both read the same, and a rerun continues
-from the first old-form row. Only database rows change: no image or video
-file is opened.
-
-``reclaim_space`` is the VACUUM afterwards: it sweeps unreferenced
-documents, rebuilds the file and checkpoints the WAL with TRUNCATE, so the
-freed pages go back to the disk.
-"""
-
-import logging
-import os
-import sqlite3
-import time
-from contextlib import closing
-
-from .workflow_documents import (
-    TEXT_COLUMNS,
-    DocumentMismatch,
-    read_stored_text,
-    release_documents,
-    storable,
-    store_text,
-    sweep_documents,
-)
-
-OPERATION = "workflow_storage"
-# The first apply's backup: ``<db>.pre-workflow-storage_<stamp>``, outside the
-# pruned ``<db>.backup_*`` pool. Only one is ever made; later applies take a
-# pooled safety backup.
-PRE_MIGRATION_LABEL = "pre-workflow-storage"
-BATCH_ROWS = 200
-BATCH_BYTES = 16 * 2**20  # characters of text rewritten per transaction
-# A batch holds the write lock: it ends after this long, and the loop then
-# leaves the lock free for BATCH_PAUSE, longer than SQLite's longest busy
-# poll (100 ms), so the image monitor and the run counting get in between.
-BATCH_SECONDS = 0.5
-BATCH_PAUSE = 0.15
-
-
-def _row_error(error) -> bool:
-    """Whether ``error`` is one row's own cause, which keeps only that row inline.
-
-    Text SQLite cannot decode for Python, and a text that would not come
-    back identical. Anything else (a full disk, an I/O error, a malformed
-    database, a bug) fails the whole batch. The decode error is matched by
-    its message: ``sqlite_errorcode`` needs Python 3.11.
-    """
-    if isinstance(error, (DocumentMismatch, UnicodeError)):
-        return True
-    return isinstance(error, sqlite3.OperationalError) and str(error).startswith(
-        "Could not decode"
-    )
-
-
-logger = logging.getLogger("prompt_manager.database.workflow_storage")
-_clock = time.monotonic
-
-# typeof() reads a column's type from the record header: no overflow page.
-NEXT_IDS_SQL = (
-    "SELECT id FROM generated_images WHERE id>? AND "
-    "(typeof(workflow_data)!='null' OR typeof(prompt_metadata)!='null') "
-    "ORDER BY id LIMIT ?"
-)
-ROW_SQL = (
-    "SELECT workflow_data, prompt_metadata, workflow_document_id, "
-    "prompt_document_id FROM generated_images WHERE id=?"
-)
-UPDATE_SQL = (
-    "UPDATE generated_images SET {assignments} WHERE id=?"  # columns are constants
-)
-# One pass over the record headers: rows with inline text, and inline
-# values that are not text (they stay inline).
-INLINE_COUNTS_SQL = (
-    "SELECT "
-    "SUM(typeof(workflow_data)='text' OR typeof(prompt_metadata)='text'), "
-    "SUM(typeof(workflow_data) NOT IN ('null','text')) "
-    "+ SUM(typeof(prompt_metadata) NOT IN ('null','text')) "
-    "FROM generated_images"
-)
-# octet_length() (SQLite 3.43+) reads no overflow page either.
-INLINE_BYTES_SQL = (
-    "SELECT SUM(octet_length(workflow_data)), SUM(octet_length(prompt_metadata)) "
-    "FROM generated_images"
-)
-
-QUERY_PLAN_STATEMENTS = {
-    "next old-form rows": (NEXT_IDS_SQL, (0, BATCH_ROWS)),
-    "one row": (ROW_SQL, (1,)),
-}
-
-
-def _rewrite_row(conn, image_id, row, verified, checked):
-    """Store the row's inline texts as documents; returns (changed, kept, size).
-
-    ``kept`` names the columns whose value stays inline (not text).
-
-    ``verified`` maps document ids already read back in this batch to their
-    text, and ``checked`` holds the reused ids ``store_text`` already
-    checked, so a document shared by many rows is decompressed once.
-    """
-    changes, replaced, kept = {}, [], []
-    size = 0
-    for index, (column, reference) in enumerate(TEXT_COLUMNS):
-        value, current = row[index], row[index + len(TEXT_COLUMNS)]
-        if value is None:
-            continue
-        if not storable(value):
-            kept.append(column)
-            continue
-        document_id = store_text(conn, value, checked)
-        if document_id not in verified:
-            verified[document_id] = read_stored_text(conn, None, document_id)
-        if verified[document_id] != value:
-            raise DocumentMismatch(f"Image {image_id}: {column} would change")
-        changes[column], changes[reference] = None, document_id
-        if current is not None and current != document_id:
-            replaced.append(current)
-        size += len(value)
-    if changes:
-        assignments = ",".join(f"{key}=?" for key in changes)
-        conn.execute(
-            UPDATE_SQL.format(assignments=assignments),
-            [*changes.values(), image_id],
-        )
-    release_documents(conn, replaced)
-    return bool(changes), kept, size
-
-
-def migrate_batch(
-    conn,
-    after_id,
-    max_rows=BATCH_ROWS,
-    max_bytes=BATCH_BYTES,
-    max_seconds=BATCH_SECONDS,
-):
-    """Rewrite the next batch after ``after_id`` in one transaction.
-
-    The batch ends after ``max_rows`` rows, about ``max_bytes`` of text or
-    ``max_seconds``, whichever comes first. Each row runs in its own
-    savepoint: a row that cannot be rewritten (``_row_error``) is rolled
-    back alone, stays inline and is listed in ``errors``; anything else rolls
-    the whole batch back and propagates. Returns ``{last_id, rows,
-    protected, kept, errors, done}``: the last row looked at, rows
-    rewritten, inline values kept (not text) and each of them as ``(image
-    id, column)`` (#586), the ids kept by an error and whether there was
-    nothing left to look at.
-    """
-    if conn.in_transaction:
-        raise RuntimeError("The migration needs its own transaction")
-    started = _clock()
-    conn.execute("BEGIN IMMEDIATE")
-    try:
-        ids = [row[0] for row in conn.execute(NEXT_IDS_SQL, (after_id, max_rows))]
-        result = {
-            "last_id": after_id,
-            "rows": 0,
-            "protected": 0,
-            "kept": [],
-            "errors": [],
-            "done": not ids,
-        }
-        verified, checked, size = {}, set(), 0
-        for image_id in ids:
-            conn.execute("SAVEPOINT workflow_row")
-            try:
-                row = conn.execute(ROW_SQL, (image_id,)).fetchone()
-                changed, kept, row_size = _rewrite_row(
-                    conn, image_id, row, verified, checked
-                )
-            except Exception as error:
-                if not _row_error(error):
-                    raise
-                conn.execute("ROLLBACK TO workflow_row")
-                conn.execute("RELEASE workflow_row")
-                verified.clear()  # the row's documents were rolled back too
-                checked.clear()
-                logger.warning(f"Image record {image_id} kept inline: {error}")
-                result["errors"].append(image_id)
-                changed, kept, row_size = False, [], 0
-            else:
-                conn.execute("RELEASE workflow_row")
-            result["rows"] += int(changed)
-            result["protected"] += len(kept)
-            result["kept"].extend((image_id, column) for column in kept)
-            result["last_id"] = image_id
-            size += row_size
-            if size >= max_bytes or _clock() - started >= max_seconds:
-                break
-        conn.commit()
-        return result
-    except BaseException:
-        conn.rollback()
-        raise
-
-
-def pre_migration_backups(db_path):
-    """The kept pre-migration backups beside ``db_path``, earliest first."""
-    db_path = os.path.abspath(db_path)
-    prefix = os.path.basename(db_path) + "." + PRE_MIGRATION_LABEL + "_"
-    folder = os.path.dirname(db_path)
-    try:
-        names = os.listdir(folder)
-    except OSError:
-        return []
-    return sorted(
-        name
-        for name in names
-        if name.startswith(prefix) and os.path.isfile(os.path.join(folder, name))
-    )
-
-
-def _file_bytes(db_path):
-    return sum(
-        os.path.getsize(path)
-        for path in (db_path, db_path + "-wal")
-        if os.path.exists(path)
-    )
-
-
-class WorkflowStorageOperations:
-    """PromptDatabase mixin: the workflow storage migration and Reclaim space."""
-
-    def migrate_workflow_storage(
-        self,
-        *,
-        on_batch=None,
-        should_stop=None,
-        max_rows=BATCH_ROWS,
-        max_bytes=BATCH_BYTES,
-    ) -> dict:
-        """Rewrite every old-form row, batch by batch (blocking).
-
-        ``on_batch(progress)`` runs after each committed batch with the
-        running totals ``{rows, protected, batches, last_id}``;
-        ``should_stop()`` is asked before each batch. Each committed batch is
-        followed by ``BATCH_PAUSE`` with the write lock free. Returns
-        ``{rows, protected, batches, stopped, errors, documents_removed}``
-        (``errors``: the ids of rows kept inline by an error). Unreferenced
-        documents are swept once every row was looked at.
-        """
-        totals = {"rows": 0, "protected": 0, "batches": 0, "last_id": 0}
-        errors = []
-        stopped = False
-        while True:
-            if should_stop is not None and should_stop():
-                stopped = True
-                break
-            batch = self.migrate_workflow_batch(totals["last_id"], max_rows, max_bytes)
-            if batch["done"]:
-                break
-            time.sleep(BATCH_PAUSE)  # leave the write lock to other writers
-            errors += batch["errors"]
-            totals["rows"] += batch["rows"]
-            totals["protected"] += batch["protected"]
-            totals["batches"] += 1
-            totals["last_id"] = batch["last_id"]
-            if on_batch is not None:
-                on_batch(dict(totals))
-        removed = 0 if stopped else self.sweep_workflow_documents()
-        return {
-            "rows": totals["rows"],
-            "protected": totals["protected"],
-            "batches": totals["batches"],
-            "stopped": stopped,
-            "errors": errors,
-            "documents_removed": removed,
-        }
-
-    def migrate_workflow_batch(
-        self, after_id, max_rows=BATCH_ROWS, max_bytes=BATCH_BYTES
-    ) -> dict:
-        """One batch on the calling thread's connection (``migrate_batch``)."""
-        return migrate_batch(self.model.get_connection(), after_id, max_rows, max_bytes)
-
-    def sweep_workflow_documents(self) -> int:
-        """Remove every document no image row references (one transaction)."""
-        conn = self.model.get_connection()
-        with conn:
-            return sweep_documents(conn)
-
-    def workflow_storage_status(self) -> dict:
-        """``workflow_storage_counts`` on one read-only snapshot (blocking)."""
-        from .maintenance import _read_snapshot
-
-        return _read_snapshot(self.model.db_path, self.workflow_storage_counts)
-
-    def workflow_storage_counts(self, conn) -> dict:
-        """``{rows, protected, documents, inline_bytes}`` on ``conn`` (reads only).
-
-        ``inline_bytes`` is None where SQLite has no ``octet_length``.
-        """
-        rows, protected = conn.execute(INLINE_COUNTS_SQL).fetchone()
-        documents = conn.execute("SELECT COUNT(*) FROM workflow_documents").fetchone()
-        inline_bytes = None
-        if sqlite3.sqlite_version_info >= (3, 43, 0):
-            row = conn.execute(INLINE_BYTES_SQL).fetchone()
-            inline_bytes = sum(value or 0 for value in row)
-        return {
-            "rows": rows or 0,
-            "protected": protected or 0,
-            "documents": documents[0],
-            "inline_bytes": inline_bytes,
-        }
-
-    def reclaim_space(self) -> dict:
-        """Sweep, VACUUM and truncate the WAL (blocking); file bytes before/after.
-
-        The caller holds the registry's ``exclusive`` slot. Raises whatever
-        stopped VACUUM; the database is then unchanged.
-        """
-        db_path = self.model.db_path
-        removed = self.sweep_workflow_documents()
-        before = _file_bytes(db_path)
-        self.model.vacuum_database()
-        with closing(sqlite3.connect(db_path)) as checkpoint:
-            busy = checkpoint.execute("PRAGMA wal_checkpoint(TRUNCATE)").fetchone()[0]
-        return {
-            "before_bytes": before,
-            "after_bytes": _file_bytes(db_path),
-            "documents_removed": removed,
-            "checkpoint_busy": bool(busy),
-        }
-
-    # ── preview ───────────────────────────────────────────────────────
-
-    def _plan_workflow_storage(self):
-        """The reviewed plan of the migration (one read-only snapshot)."""
-        from .maintenance import (
-            MaintenanceDraft,
-            _Fingerprint,
-            _megabytes,
-            _plural,
-            _read_snapshot,
-        )
-
-        def read(conn):
-            sizes = [
-                conn.execute(f"PRAGMA {name}").fetchone()[0]
-                for name in ("page_size", "page_count", "freelist_count")
-            ]
-            return sizes, self.workflow_storage_counts(conn)
-
-        (page_size, page_count, free_pages), counts = _read_snapshot(
-            self.model.db_path, read
-        )
-        size = page_size * page_count
-        details = [
-            {
-                "label": "Database file",
-                "detail": f"{_megabytes(size)}, of which "
-                f"{_megabytes(free_pages * page_size)} is free pages",
-            },
-            {
-                "label": "Image records",
-                "detail": f"{_plural(counts['rows'], 'record')} keep their workflow "
-                "or prompt graph inline; each distinct text is stored once, "
-                "compressed",
-            },
-        ]
-        if not counts["rows"]:
-            details[1]["detail"] = NOTHING_TO_DO
-        if counts["inline_bytes"] is not None:
-            details.append(
-                {
-                    "label": "Inline text",
-                    "detail": f"{_megabytes(counts['inline_bytes'])} now",
-                }
-            )
-        if counts["documents"]:
-            details.append(
-                {
-                    "label": "Already stored once",
-                    "detail": _plural(counts["documents"], "workflow document"),
-                }
-            )
-        name = os.path.basename(self.model.db_path)
-        kept = pre_migration_backups(self.model.db_path)
-        backup = (
-            POOLED_BACKUP_NOTE.format(
-                name=f"{name}.backup_<date and time>", kept=kept[0]
-            )
-            if kept
-            else BACKUP_NOTE.format(
-                name=f"{name}.{PRE_MIGRATION_LABEL}_<date and time>"
-            )
-        )
-        details += [
-            {"label": "Backup", "detail": backup},
-            {"label": "Reclaim space", "detail": RECLAIM_NOTE},
-            {"label": "Older versions", "detail": OLDER_VERSIONS_NOTE},
-        ]
-        protected = counts["protected"]
-        return MaintenanceDraft(
-            operation=OPERATION,
-            fingerprint=_Fingerprint(OPERATION).hexdigest(),
-            targets=[],
-            scope={
-                "count": counts["rows"],
-                "label": (
-                    _plural(counts["rows"], "image record") + " to rewrite"
-                    if counts["rows"]
-                    else "Nothing to rewrite"
-                ),
-            },
-            protected={
-                "count": protected,
-                "reasons": (
-                    [f"{_plural(protected, 'stored value')} not text; kept as is"]
-                    if protected
-                    else []
-                ),
-            },
-            media={"deletes_files": False, "label": MEDIA_NOTE},
-            details=details,
-        )
-
-
-MEDIA_NOTE = "No image or video file is opened or changed; only the database."
-RECLAIM_NOTE = (
-    "When every record is rewritten, Reclaim space runs alone to give the freed "
-    "space back to the disk (VACUUM). The database is locked while it runs."
-)
-BACKUP_NOTE = (
-    "Always taken first, whatever the safety backup setting: {name} beside "
-    "the database, verified, and kept until you remove it (it is never pruned)."
-)
-POOLED_BACKUP_NOTE = (
-    "A safety backup is taken first, whatever the safety backup setting: {name} "
-    "among the pooled backups; the pre-migration backup {kept} is already kept."
-)
-NOTHING_TO_DO = "Every image record already stores its workflow once."
-OLDER_VERSIONS_NOTE = (
-    "This version stores the workflows of images it records in the new form, "
-    "whether or not this job runs, and this job rewrites the rest. An older "
-    "Prompt Manager version shows those images without their workflow until you "
-    "update again. The way back to an older version is the earliest "
-    "pre-workflow-storage backup."
-)
@@ -12,8 +12,6 @@ code. This plan proposes implementation order and acceptance gates.
 - The native Prompt Library merged in [#210](https://github.com/ComfyAssets/ComfyUI_PromptManager/pull/210) for [#208](https://github.com/ComfyAssets/ComfyUI_PromptManager/issues/208): one positive parent, saved negative variants, full selected text and a shared filtered image gallery. It does not invent chronological runs from counters or scan dates.
 - [Durable history storage](prompt-history-storage.md) records job attempts and outcomes from [#212](https://github.com/ComfyAssets/ComfyUI_PromptManager/pull/212), frozen prompt contexts from [#213](https://github.com/ComfyAssets/ComfyUI_PromptManager/pull/213), and observed run-owned output locators from [#214](https://github.com/ComfyAssets/ComfyUI_PromptManager/pull/214). Those locators do not verify file bytes or establish gallery-image associations. That association contract and the chronological execution timeline remain pending under [#209](https://github.com/ComfyAssets/ComfyUI_PromptManager/issues/209).
 - [#215](https://github.com/ComfyAssets/ComfyUI_PromptManager/issues/215) brings the shell, Images and natural-height Prompt Library presentation into the approved geometry and themes while retaining their existing operations. [#216](https://github.com/ComfyAssets/ComfyUI_PromptManager/issues/216) adds the shared current-file inspector with exact generation facts, scoped provenance, raw/download evidence and loaded-collection viewer controls, including a slideshow that pauses at native video. This delivery does not establish whole-application parity, change the default entry point or constitute a release. Recorded chronological run/context browsing continues under [#209](https://github.com/ComfyAssets/ComfyUI_PromptManager/issues/209); image tagging/review, System consolidation and remaining organization capabilities continue under #196.
- Local Inspect (#249, PRs L1–L3) replaces the `#/inspect` handoff with the concept's native "Inspect a file" page: one local image or video previews inline and opens the shared viewer and full inspector on a record read entirely in the browser, with nothing uploaded, imported or stored. The legacy metadata page (`web/metadata.html`, served at `/prompt_manager/gallery.html`) stays reachable from Overview; its capabilities map to the shared inspector, including its one-click COPY ALL summary, which is the shared inspector's "Copy settings summary" (D117, LI-4). PR L3 ([#286](https://github.com/ComfyAssets/ComfyUI_PromptManager/pull/286)) shipped that button and local roles equal to the server's resolver (`web/js/workspace/local-resolver.mjs`, TESTING.md "Local roles (#249 PR L3, decision LI-1)"). Recorded deviations D60–D66 and D117 are in [TESTING.md](../TESTING.md).
- Collections ([#331](https://github.com/ComfyAssets/ComfyUI_PromptManager/issues/331), three PRs) adds named, hand-picked groups of images, stored in the library database by file location as favorites are: a COLLECTIONS sidebar group whose rows open Images filtered to one collection (`#/collection/<id>`) with rename and delete, Add to collection and Remove from collection in the Images selection bar, a Collections… checklist in the shared inspector for the side panel and the viewer, and saved views that keep a collection. Membership survives restarts, source reordering and System › Maintenance duplicate cleanup; no file is copied, moved or changed.

 ## Scope and compatibility

@@ -1,409 +0,0 @@
-# Review and clean: review-only audit
-
-Date: 2026-11-01. Baseline: `main` at `7e11d9cae266b74e0820799eb0d74ab493e66026` (version **3.4.1**).
-
-**REVIEW ONLY — DO NOT MERGE. Keep this PR in draft.** The maintainer approved sharing this audit for additional review; this branch contains no cleanup implementation.
-
-All measurements and source-line references describe commit `7e11d9cae266b74e0820799eb0d74ab493e66026`, not the latest main. Main subsequently gained #592 (thumbnail location) at `043403d09e0ac199123d7da88c5a6c3e33c8bc46`; that addition is outside this audit snapshot. The documentation branch starts from that newer main so its only diff is this report.
-
-## Recommendation
-
-Proceed with a small cleanup of proven dead helpers, test-only scaffolding and unused assets, preceded by the risk-focused tests below. Keep the legacy pages for now. Two legacy jobs still need a retirement decision: prompt sorting by use, and managing the underlying records used only as negative components. Do not build replacements as part of this audit.
-
-The most consequential code findings are inconsistent Windows UNC handling in SQLite readers, a write-only prompt registry that grows with executions, and model unloading on the server event loop. These are independent of deleting the old pages. The first and third need narrow regression tests and fixes; removal of the registry needs an explicit compatibility decision.
-
-The audit changed no production source, tests, workflows, protected assets or configuration. This review branch publishes only the report at the maintainer's request. No cleanup, service restart or release is included. Raw logs, scripts, databases, archives and machine-specific files remain outside Git. This is a review-only exception to the normal policy that EGM reports stay local.
-
-## Expected payoff
-
-These are measured projections, not completed reductions. No projected reduction has been implemented.
-
-| Work | Before → proposed after | Reduction / limits |
-| --- | --- | --- |
-| Legacy UI retirement | 121,845 → **111,707 runtime lines** | **10,138 lines / 8.3%**, across 16 files. Requires parity approval; replacement bookmark shims may reduce the net saving. |
-| Small dead-helper cleanup | About **150 runtime lines removed**, plus obsolete tests | Modest: the measured helper/class spans total 149 lines before adjacent fields, comments and test changes. |
-| Development-file package exclusions | **17,348,582 → 6,766,947 bytes ZIP** | **61.0% smaller** in a local preview excluding `tests/`, `tools/`, `docs/` and `.github/`; 1,028 → 362 archived files. Runtime completeness still needs installation testing. |
-| Unused image artifacts | **1,737,407 bytes removed** from the current tree | Three files. This does not shrink existing Git history. |
-
-Line counts include comments and whitespace. Package savings concern the Registry packaging path, not Git clones or history. Both ZIPs were local audit previews; neither is included in this branch or published to the Registry.
-
-The strongest return is packaging exclusions, targeted correctness fixes and eventual legacy retirement: retiring the old UI removes two large controllers and their supporting code. The first helper-removal batch has a small numerical payoff. Defer broad file splitting and cosmetic reorganization until there is a demonstrated maintenance benefit. With Python coverage at 95.10% and frontend line coverage at 90.55%, prioritize safety invariants over percentage increases.
-
-## 1. Scope, method and limits
-
-Read the audit brief, local `CLAUDE.md` and `AGENTS.md`, [README.md](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/README.md), [pyproject.toml](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/pyproject.toml), the redesign plan, the testing contract's execution/safety/portability/parity sections, the available directory contracts, and relevant EGM designs and drift records. The EGM records for #444, #447, #550, #523 and #556 distinguish approved redesign changes from actual gaps. `openspec/AGENTS.md` does not exist at this head; no substitute spec was invented.
-
-The review scans the tracked tree and takes deeper passes through registration, HTTP routes, prompt/image identity, backup/restore, library movement, deletion, model lifecycle, and the legacy/workspace UI entry points. It is not a claim that every line of the roughly 122,000 runtime source lines received a separate manual review.
-
-Raw audit evidence was retained locally and is not part of this branch. The observations, results and limitations needed for review are summarized here. Inventory uses `git ls-files`; generated environments, the copied local briefs and audit artifacts do not enter the counts. Vulture 60%/80% output and coverage were treated as leads. Candidate decisions also checked browser script tags/imports, node schemas, route registration, dynamic `getattr`, SQL/config names, shutdown hooks, packaging and tool/test callers. Names inside comments, a same-named unrelated test helper, or a same-named local JS function do not constitute a caller.
-
-Disposable probes exercised the findings without editing production code: 1,000 unique registry registrations and forced expiry; SQLite URI construction for a non-local UNC authority; unload call/thread identity; invalid save-request shapes; and native-Library eligibility of a negative-only record. Results appear with the corresponding findings. These were audit probes, not committed regression tests or proof of a fix.
-
-### Baseline measurements
-
-| Measurement | Before / current audit head |
-| --- | ---: |
-| Tracked files | 1,028 |
-| Runtime `.py`, `.js`, `.mjs`, `.css`, `.html` files outside protected directories | 295 |
-| Lines in those runtime files | 121,845 |
-| Test/tooling source files in the same language set | 532 |
-| Test/tooling source lines | 214,122 |
-| Runtime files over 800 lines | 34 |
-| Runtime Python functions over 50 lines | 212 |
-| Python test files | 238 |
-| Frontend unit-test files | 103 |
-| Tooling unit-test files | 17 |
-| Page-workflow spec files | 67 |
-| Real-host spec files | 14 |
-| Frontend files with coverage baselines | 123 |
-
-The runtime count includes the 1,703-line generated `workspace/concept.css` mirror; it is not a hand-editing candidate. Protected sources and the approved concept are counted separately in `inventory.json`. Line totals are physical lines, including whitespace/comments, with no claim that minified/vendor code and handwritten code have the same cost. No removal has happened, so before and after are currently identical.
-
-Largest runtime files, in lines:
-
-| File | Lines | Review implication |
-| --- | ---: | --- |
-| [py/api/images.py](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/api/images.py) | 4,315 | Several real seams: listing/cursors, file access, thumbnails, inspection. |
-| [web/js/admin.js](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/web/js/admin.js) | 3,102 | Legacy; retire after parity, avoid an interim cosmetic rewrite. |
-| [web/js/gallery.js](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/web/js/gallery.js) | 3,053 | Legacy; same. |
-| [database/operations.py](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/database/operations.py) | 2,854 | Prompt/tag/link operations share a large facade. |
-| [utils/prompt_pair_resolver.py](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/utils/prompt_pair_resolver.py) | 2,749 | Complex resolver with differential contracts; split only with a demonstrated seam and parity evidence. |
-| [py/api/admin.py](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/api/admin.py) | 1,893 | Both live scan/maintenance machinery and legacy routes remain. |
-| [utils/image_monitor.py](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/utils/image_monitor.py) | 1,539 | Metadata-first attribution, queue fallback and shutdown behavior are coupled. |
-| [py/api/autotag_routes.py](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/api/autotag_routes.py) | 1,534 | Native and compatibility routes plus model/stream/job policies. |
-
-Counts and function spans were computed from the tracked files at the audit commit. Only the summarized results are published here.
-
-### Baseline checks
-
-| Check | Result | Evidence |
-| --- | --- | --- |
-| Python 3.12.9, `python -m coverage run -m tests.run_suite -q` | **PASS: 6,104 tests, 75 skips; 335.479 s** | `python-baseline.log` |
-| `coverage combine`; `coverage report --fail-under=85` | **PASS: 95.10% combined**; 38,237 statements, 12,364 branches | `python-coverage.txt`, `python-coverage.json` |
-| Frontend units, Node 24.22.2 | **PASS: 1,444 tests** | Frontend baseline log |
-| Viewer fixture suite in pinned image | **PASS: 18 passed, 2 skipped** | Frontend baseline log |
-| Full Chromium + touch workflows and combined frontend gate | **PASS: 2,473 passed, 1 skipped (23.7 min); 123-file coverage gate passed** | `frontend-baseline.log` |
-| Tooling tests with the project Python selected | **PASS: 124 tests** | `tooling-baseline.log` |
-| Viewer.js, Toolkit and concept stylesheet verification | **PASS**: Viewer.js 1.15.2, Toolkit 0.2.0, stylesheet 30,447 bytes | `vendor-check.log` |
-| `black --check .` | **PASS: 452 files unchanged** | `black.log` |
-| `flake8 .` | **PASS** | `flake8.log` |
-| Frontend source/baseline membership | **PASS: 123 files** | `frontend-baseline-structure.log` |
-| Existing System parity-table validation | **PASS: 54 rows, no structural/test-reference errors** | `system-parity.json` |
-| Tracked-file distribution preview | **1,028 files; 32,088,917 bytes uncompressed / 17,348,582-byte ZIP**; includes tests/tooling/docs | `distribution-preview.json`, `tracked-bundle-preview.zip` |
-| Standard sdist/wheel build, from a clean tracked snapshot | **FAIL: setuptools rejects multiple top-level packages**; separate from Registry packaging | `tracked-package-build.log` |
-| Native Windows, other Python versions, Firefox/WebKit, real ComfyUI and cross-pack matrix | **Not run in this audit**; retain CI/managed-host gates | See verification plan |
-
-Combined frontend coverage is **90.55% lines/statements, 93.52% functions and 92.61% branches** (37,918 measured lines, 18,664 branches). The source/baseline membership check also passes. The table above records the final results; raw reports are not committed.
-
-The Python measurement is on macOS. The browser run uses `mcr.microsoft.com/playwright:v1.64.1-noble`, ARM64, limited to four CPUs and four workers, under the browser-suite lock. Its image digest is `sha256:47b510dd9230bf0b9bfc9b20102241e577ea7a99334ab4c3ca19f19770e9b8ea`. It runs Chromium/touch only, not the full browser matrix. The Python environment is confined to this worktree's ignored `venv/`.
-
-Initial setup attempts were invalid and are retained rather than hidden. A global disposable data-directory override defeated fixture isolation: the initial Python run had 19 failures/55 errors, and browser workers shared a database (`the live database changed while the seed ran`). That browser run was stopped. Removing the override restored the suites' own disposable fixtures. The first tooling attempt selected a Python without watchdog; setting `PM_TEST_PYTHON` fixed that prerequisite. An initial `.venv` also fell outside the repository's `venv/` lint/coverage exclusions; it was replaced with `venv/`. These are setup corrections, not source fixes or reruns of a failing CI head. The invalid attempts are retained in the local audit evidence separately from the corrected baseline. No watchdog limit was raised, no test weakened, and no live state was involved.
-
-## 2. Quality findings
-
-### F01 — HIGH: several retained SQLite readers reject Windows UNC libraries
-
-Locations: [database/models.py:1202](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/database/models.py#L1202) and `:1310`; [database/restore_stage.py:117](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/database/restore_stage.py#L117); [database/library_move.py:321](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/database/library_move.py#L321); [utils/history_read_fence.py:57](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/utils/history_read_fence.py#L57); [py/api/backup_restore.py:189](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/api/backup_restore.py#L189); [py/api/admin.py:402](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/api/admin.py#L402).
-
-These readers independently build a SQLite URI with `Path(...).as_uri()`. On Windows a network path becomes `file://server/share/...`; the normal SQLite build rejects that non-local URI authority. The project already implements the compatible empty-authority form in [database/health.py:98](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/database/health.py#L98) (`readonly_uri`), with portable and native-control tests at [tests/test_database_health.py:337](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/tests/test_database_health.py#L337) and `:363`.
-
-Cost: a library may be opened by ordinary filesystem-path connections yet fail backup verification/download, staging, Move library verification, or fenced history reads. Safety-backed operations can be refused before writing. This is a recovery/availability defect, not evidence of observed data loss.
-
-Evidence: the probe produces `file://server/share/prompts.db?mode=ro` and SQLite's `invalid uri authority: server`; the shared helper produces `file:////server/share/prompts.db?mode=ro`. **No native Windows share was exercised here.**
-
-Proposed fix: use one low-level SQLite read-only URI helper at every retained call site, retaining each caller's timeout, `trusted_schema`, snapshot and closure policies. Start with failing URI-boundary tests, then native Windows backup/restore/history controls on a disposable share. Do not infer native success from a `PureWindowsPath` assertion. Avoid a new dependency cycle by putting the helper below models/health, or preserving an appropriate facade.
-
-### F02 — HIGH: the prompt metadata registry retains each execution indefinitely
-
-Locations: [utils/comfyui_integration.py:89](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/utils/comfyui_integration.py#L89), `:128`, `:178`; writers at `prompt_manager.py:263`, `prompt_manager_text.py:234`, `prompt_manager_pair.py:177`; construction in `prompt_manager_base.py:89`.
-
-Each executed node invents a time-based ID and adds full text/metadata to both a thread-local dictionary and the process-global dictionary. Production code writes this registry but never calls its reader or cleanup method. Even explicit `cleanup_old_prompts` removes only global entries. It does not bound or clear the execution thread's dictionary.
-
-Evidence: 1,000 unique registrations leave 1,000 entries in both stores; after forcing every global entry to expire, global count is zero while the thread-local count remains 1,000. The current 91.95% combined coverage for this file exercises lookup behavior but has no bounded-growth invariant. ComfyUI saves metadata from node inputs; the old SaveImage patch is deliberately absent (#75).
-
-Proposed fix: determine whether the registry has a supported external consumer. If not, remove the obsolete registry and its node-side writes, preserving the tests that SaveImage is untouched and outputs/history still carry the proper text. If an external contract exists, add an explicit bounded lifecycle to both stores with deterministic long-run tests. Do not simply delete the tested reader and leave production writes accumulating. This is an **UNSURE removal candidate**, despite its write-only internal use.
-
-### F03 — MEDIUM: Unload blocks ComfyUI's event loop
-
-Locations: [py/api/autotag_routes.py:1403](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/api/autotag_routes.py#L1403)–`:1426`; [py/autotag.py:911](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/autotag.py#L911); consumer [web/js/workspace/system-tagging.mjs:53](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/web/js/workspace/system-tagging.mjs#L53).
-
-`unload_autotag_model` takes the model gate but calls `service.unload_model()` synchronously. That operation destroys the model, runs `gc.collect()` and may empty CUDA caches. It can stall unrelated UI/API/queue work. The existing image-tag job already calls the same operation through `await model_gate.run(...)` ([py/api/image_tag_jobs.py:614](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/api/image_tag_jobs.py#L614)).
-
-Evidence: the audit probe records identical event-loop and unload thread IDs. [tests/test_api_autotag.py:734](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/tests/test_api_autotag.py#L734) tests success/failure/counts, not event-loop responsiveness or cancellation while the worker is still unloading.
-
-Proposed fix: run unload through the existing model-gate executor mechanism; hold the gate until the worker is finished even if the request is cancelled. Add an event-gated fake unload that proves an unrelated loop callback can complete while unload waits, and that another model user remains refused until release. No model download is needed to test this.
-
-### F04 — MEDIUM: malformed save requests escape validation as server errors
-
-Location: [py/api/prompts.py:727](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/api/prompts.py#L727)–`:745`.
-
-The handler calls `.get()` and `.strip()` before validating the JSON object and field types. `[]`, `{"text":123}`, and `{"text":"fixture","category":123}` all return a 500 envelope with an AttributeError logged, instead of a bounded 400 validation refusal. The save route is still registered and must remain compatible with existing consumers.
-
-Evidence: all three outcomes are reproduced in `probes.log`. Existing invalid-rating coverage does not cover these shapes. The 96.39% combined coverage for this file therefore does not establish its input contract.
-
-Proposed fix: validate shape/types with the existing bounded JSON-body helper before normalization; add table-driven route tests proving 400 responses, unchanged database rows, and unchanged behavior for valid legacy payloads. This intentionally changes invalid-input responses, so it is a bug fix requiring approval, not a behavior-neutral refactor.
-
-### F05 — MEDIUM: image API responsibilities are too interwoven for safe retirement
-
-Location: [py/api/images.py:1455](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/api/images.py#L1455)–`:4315` (also the helpers/cache structures above its mixin).
-
-One 4,315-line file combines route wiring, legacy and workspace listing, signed cursors, source scopes, file containment, thumbnails/video subprocesses, favorites, inspection and prompt lookup. Other mixins import helpers from it. Removing legacy paths without identifying those dependencies risks deleting shared workspace/node behavior.
-
-Proposed fix: after caller-led removal, extract only useful seams—thumbnail generation, media access/containment, and workspace listing/formatting—keeping the current mixin/helper facade while callers transition. Add behavior tests for retained boundaries before moving them. Do not split to satisfy a line target or rewrite the resolver alongside it.
-
-### F06 — MEDIUM: a second configuration writer survives only for tests
-
-Locations: [py/config.py:81](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/config.py#L81) (`write_private_json`), `:1059` (`save_to_file`); contrast [py/config_store.py:81](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/config_store.py#L81) and `:157`.
-
-This unused production path truncates the existing file before JSON serialization, bypasses the commit lock/revision contract, loses unknown sections, and logs failures instead of returning them. Only tests call it. Keeping it makes it easy for future code to bypass the safe `ConfigStore` writer.
-
-Proposed fix: remove the **TEST-ONLY** save method and its private writer together, replacing fixture setup through existing disposable fixture helpers where needed. Remove their own tests only with their implementation; retain `ConfigStore` atomicity, unknown-key preservation and permission tests. Do not remove the live `load_from_file` reader or change old configuration formats.
-
-### F07 — LOW: instructions and status documentation disagree with the implementation
-
-Locations/evidence:
-
- `CLAUDE.md:30` says 3.3.x; [pyproject.toml:4](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/pyproject.toml#L4) says 3.4.1.
- `CLAUDE.md:1` and `AGENTS.md:2` refer to absent `openspec/AGENTS.md`.
- `AGENTS.md:84` still says macOS runs in portability CI; `portability.yml:40` runs Windows only. [README.md:18](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/README.md#L18) also says the Python suite runs on all three OSes, contradicting its own final testing section.
- `AGENTS.md:126` says three coverage shards/two other-browser shards; current `viewerjs-check.yml:66` and `:206` use **four** and **three**. `CLAUDE.md:158` also still says two other-browser shards. [TESTING.md](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/TESTING.md) retains some old three-/four-shard and two-/three-shard prose together.
- [docs/application-redesign.md:73](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/docs/application-redesign.md#L73) names Python 3.10–3.13 and macOS CI, and `:78` asks for PR screenshots. The actual floor is Python 3.12 and the maintainer prohibits PR image uploads.
- The redesign plan describes history under #209 as pending although the chronological Library exists; default entry points already changed under #525.
- `CLAUDE.md`'s general HTML-refresh rule needs the [TESTING.md:7561](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/TESTING.md#L7561) exception: `workspace.html` is server-cached and needs a ComfyUI restart when edited.
- Several EGM line anchors and run-counting descriptions predate the cached-runtime receipt work; they are context, not authority for deleting code.
-
-Proposed fix: reconcile README, TESTING, redesign status and the two local briefs from current code/workflows; preserve the test parsers' required sections. Keep the managed OpenSpec block intact while recording the missing-file situation locally or recovering its authoritative source after a maintainer ruling. Do not regenerate the protected concept or add screenshots. Keep local briefs untracked.
-
-### F08 — LOW: two automation jobs are outside the timeout contract
-
-Locations: [.github/workflows/publish.yml:15](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/.github/workflows/publish.yml#L15), [.github/workflows/viewerjs-update.yml:21](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/.github/workflows/viewerjs-update.yml#L21); guard coverage at [tests/vendor/ci-workflow.test.mjs:279](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/tests/vendor/ci-workflow.test.mjs#L279).
-
-These jobs declare no `timeout-minutes`. The current guard enumerates the four test/quality/portability workflows, so tooling green does not enforce the repository's broader “every CI job” rule. A stalled publish/update can hold a runner much longer than intended.
-
-Proposed fix: first obtain the required three green-main duration measurements, then add limits and comments and extend the guard to all workflows. Do not invent durations or change a limit to hide a failure. Do not dispatch the publishing workflow for this audit.
-
-### F09 — MEDIUM: the packaging path has no exclusions for development content
-
-Location: [pyproject.toml:9](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/pyproject.toml#L9)–`:11`, [.github/workflows/publish.yml:4](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/.github/workflows/publish.yml#L4)–`:9`.
-
-There is no `.comfyignore` or export-ignore manifest. The inspected [publish action](https://raw.githubusercontent.com/Comfy-Org/publish-node-action/v1/action.yml) runs `comfy node publish`; the current [upstream packager](https://raw.githubusercontent.com/Comfy-Org/comfy-cli/main/comfy_cli/file_utils.py) includes tracked files when no exclusion specification is present. On that basis, a future clean-checkout publish would include the development tree. This is an inference from the current upstream source, not inspection of an already published Registry artifact.
-
-The local tracked-file preview confirms 1,028 files / 32,088,917 uncompressed bytes: `tests/` alone contributes 549 files / 11,739,034 bytes, `docs/` 73 / 8,727,000, and `tools/` 36 / 239,782. These costs are separate from working runtime dependencies. See `distribution-preview.json`; the ZIP is only a local audit artifact and was not uploaded.
-
-Proposed fix: add reviewed `.comfyignore` exclusions and a non-publishing archive-content check, preserving all runtime Python/web assets, semantics JSON, required licenses and install metadata. Verify the exact supported CLI version and archive before release. No publishing command was run. The action's unpinned CLI installation also makes its future packaging behavior version-dependent.
-
-Separately, `uv build` fails from a clean tracked snapshot because setuptools discovers multiple top-level packages. That does not establish a Registry failure; wheel support is a separate scope decision. Do not casually edit [pyproject.toml](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/pyproject.toml): **any change to that file on main matches the publish trigger**, even with the same version. No packaging metadata was edited here.
-
-### Checks that did not establish a defect
-
- The reviewed dynamic SQL identifiers/orders were local constants or whitelists; no exploitable SQL injection was demonstrated. `library._ORDERS`, pair/tag sort maps and fixed history ordering are safe exceptions to the blanket `order_by_clause` prose. Do not mechanically force unrelated sort domains through one function.
- The several Python/browser resolvers are necessary ports for local, non-uploaded inspection; differential tests enforce agreement. They are not duplicate metadata inspectors to delete based on filenames.
- Prompt hashes ultimately use `utils.hashing.generate_prompt_hash`; no second live prompt-hash algorithm was found in the reviewed paths.
- The restore fingerprint deliberately does not cover every older-row tag/favorite edit; the safety backup retains them. That limitation is already recorded in TESTING and is not a newly discovered data-loss bug.
- npm installation emitted four moderate-severity advisory notices. A later **offline** audit of the correct `tools/vendor` package returned no advisory entries; that does not disprove the install notice or provide a trustworthy fresh advisory assessment. No dependency versions or vendor pins were changed. Keep this discrepancy as an unassessed tooling-dependency item, not a claim of four exploitable runtime vulnerabilities.
-
-## 3. Dead-code candidate decisions
-
-`DEAD` below means no reachable caller found after the entry-point checks, and removal is proposed for the implementation pass. **Nothing in this table has been removed yet.** Counts/spans are recorded in `candidate-spans.json` and the tracked-file/name/line search results in `reference-audit.json`; the vulture reports include rejected false positives as well as leads.
-
-| Candidate | Label | Evidence and disposition |
-| --- | --- | --- |
-| [database/annotations.py:294](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/database/annotations.py#L294), `_current_set` | DEAD | Only the definition occurs as a symbol; the similarly named test describes a result, not a call. Current annotation paths construct their own result. Remove the six-line helper. |
-| [py/api/autotag_routes.py:946](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/api/autotag_routes.py#L946), `_gated_runner` | DEAD | No member caller, callback registration or dynamic method selection. [tests/test_jobs.py](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/tests/test_jobs.py) defines an unrelated local helper with this name. Remove nine lines; retain `model_gate.run`. |
-| [py/api/thumbnail_jobs.py:92](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/api/thumbnail_jobs.py#L92), `from_query` parameter | DEAD | The value is never read; one internal call supplies it. Remove the keyword/argument only, preserving body/query behavior. Do not remove `thumbnail_options`. |
-| `image_meta_data.png` | DEAD | No tracked text, test fixture, page, tooling or packaging reference; not under `WEB_DIRECTORY` or a static media root. Remove unused 86,639-byte artifact. |
-| `test_metadata_file.png` | DEAD | Same checks; not used by the PNG/metadata tests. Remove unused 1,616,051-byte artifact. |
-| `images/pm-lora-results.png` | DEAD | Unlike the ten other `images/` assets, it is not linked by [README-legacy.md](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/README-legacy.md) or any tracked caller. Remove 34,717 bytes. |
-| [py/api/__init__.py:478](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/api/__init__.py#L478), `_acquire_long_job`; `_LongJobGuard` and `_long_jobs` field | TEST-ONLY | Only tests/doc examples use this old lock. Production admissions use `JobRegistry`. Remove this test-only cluster and its tests/assertions. **Keep `_long_job_busy_response`**, which several live admin paths call. |
-| [py/api/__init__.py:1080](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/api/__init__.py#L1080), `_parse_comfyui_prompt` | TEST-ONLY | Only [tests/test_api_core.py](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/tests/test_api_core.py) calls the wrapper. Remove wrapper; move any distinct parser assertions to retained `utils/file_prompt.parse_comfyui_prompt` tests rather than losing legacy-data-reader coverage. Keep the actual parser. |
-| [py/config.py:1059](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/config.py#L1059), `save_to_file`, and its sole helper `write_private_json` | TEST-ONLY | Calls are confined to `test_config.py` / `test_thumbnail_settings.py`; live writers use ConfigStore. See F06. |
-| [utils/hashing.py:129](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/utils/hashing.py#L129), `is_duplicate_prompt` | TEST-ONLY | Only `test_hashing.py` and its own module examples refer to it. Remove wrapper/tests/docs; retain the shared hash, text/key functions and SQL registrations. |
-| [utils/validators.py:300](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/utils/validators.py#L300), `parse_tags_string` | TEST-ONLY | Only `test_validators.py` calls it. Not in `utils.__all__`; not an API/config parser. Remove with its own tests. |
-| `prompt_manager_base.py:436`, `search_prompts_api`; `:440`, `get_recent_prompts_api`; `:458`, `get_gallery_status` | TEST-ONLY | Only node-contract tests call them; none is a ComfyUI `FUNCTION`, route or JS callback. Remove if no supported direct-Python consumer is claimed; keep actual `_search_prompts`, DB reads and monitor/tracker status methods. |
-| [database/review_changes.py:50](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/database/review_changes.py#L50), `observer_count` | TEST-ONLY | Keep: it lets lifecycle tests prove observer unsubscribe/leak behavior without inspecting internals. Explicit testing seam, not a user feature. |
-| [py/api/duplicate_files.py:110](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/api/duplicate_files.py#L110), `query_plan_sql` | TEST-ONLY | Keep: exposes the real query shape for structural database/performance tests. Removing it only to shrink code would weaken useful assertions. |
-| [py/api/thumbnail_encode.py:229](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/api/thumbnail_encode.py#L229), `reset_encoders`; [utils/video_metadata.py:52](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/utils/video_metadata.py#L52), `reset_missing_notice` | TEST-ONLY | Keep: deterministic test/fixture reset seams prevent state leakage across suites. |
-| [utils/execution_contexts.py:87](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/utils/execution_contexts.py#L87), `context_digest` | TEST-ONLY | Candidate for removal with its focused tests; do not remove live snapshot/content digests, persisted encodings or schema validators. Low priority until its historical API intent is checked. |
-| [py/lora_utils.py:408](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/lora_utils.py#L408), `get_civitai_image_urls` | TEST-ONLY | Candidate for removal with its extraction tests; the live allow-listed download planner is separate and stays. Confirm direct-Python bridge consumers before deleting this public helper. |
-| [utils/prompt_graph.py:298](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/utils/prompt_graph.py#L298), `positive_prompt_nodes` | TEST-ONLY | Keep pending an explicit public-helper decision. It is a conservative graph projection used by attribution tests, while runtime counting uses `run_prompt_nodes` / component projections. Do not delete the latter or weaken attribution assertions. |
-| [utils/prompt_inspector.py:466](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/utils/prompt_inspector.py#L466), `read_inspection_metadata`; `:769`, `inspect_prompt_roles` | TEST-ONLY | **Keep**: explicitly documented compatibility projections over the current reader/resolver. The brief protects legacy-data readers; these tiny facades cost little and must not be confused with old HTML inspectors. |
-| DB convenience methods including `get_prompts_by_category`, `get_top_rated_prompts`, `delete_prompts_by_category`, `get_image_paths_matching`, `list_library_images`, older context/output reads | TEST-ONLY | Keep in this pass: compatibility/data-reader or destructive-operation surfaces need a stronger contract review. The facade documentation names several; low call counts do not authorize dropping old data access. |
-| `PromptModel.restore_from_file`, migrations/schema helpers, inline/document workflow readers | TEST-ONLY where applicable | Keep regardless of call count: required recovery, upgrade and old-data compatibility. `reset_schema_cache` is also a necessary test isolation seam. |
-| [utils/prompt_tracker.py:440](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/utils/prompt_tracker.py#L440), `extend_prompt_timeout`'s `additional_seconds` | UNSURE | Public compatibility parameter is explicitly documented as unused; current behavior resets a timestamp. Keep the signature and do not invent new timeout semantics during cleanup. |
-| Entire [utils/comfyui_integration.py](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/utils/comfyui_integration.py) registry and its node writes | UNSURE | Reachable writes, test-only reads, no automatic cleanup; F02. Resolve the external-consumer question before removal. |
-| Existing HTTP routes with no workspace caller, including old search, pair, scan, restore and image endpoints | UNSURE | Public HTTP consumers and node/bridge clients may exist. Keep until each route's consumer contract is checked; do not call them dead from frontend absence. |
-
-### Legacy-only UI inventory
-
-All 16 files below are currently reachable from registered HTML entry points and therefore **LEGACY-ONLY**, not DEAD. Together they account for **10,138 physical lines**. This is a candidate retirement envelope, not a promised net deletion: bookmark shims and retained tests may remain.
-
- Pages: [web/admin.html](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/web/admin.html) (997), [web/gallery.html](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/web/gallery.html) (624), [web/metadata.html](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/web/metadata.html) (431).
- Controllers: [web/js/admin.js](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/web/js/admin.js) (3,102), `gallery.js` (3,053), `tags-page.js` (1,146).
- Modules loaded only by those pages/controllers: `data-actions.js` (51), `html-escape.js` (42), `image-helpers.js` (162), `list-state.js` (64), `prompt-list-sort.js` (64), `scan-progress.js` (121), `sse-stream.js` (154), `tag-autocomplete.js` (61), `view-router.js` (27), `theme-bridge.js` (39).
-
-[web/comfy/prompt_manager.js](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/web/comfy/prompt_manager.js) has a same-named local `escapeHtml` method but does not load the `html-escape.js` module. Conversely, **keep** `api-client.js`, `gallery-settings.js`, `png-metadata.js`, `comfy-metadata.js`, `cache-ownership.js`, node editors, prompt-library/bridge adapters, and `workspace-entry.js`: the workspace and/or canvas still use them. Keep [web/index.html](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/web/index.html)'s compatibility redirect. Never hand-edit `web/lib/`, `web/js/shared/`, `reference/`, the concept or its generated stylesheet mirror.
-
-Rejected static false positives include `RETURN_TYPES`, `FUNCTION`, `OUTPUT_IS_LIST`, `IS_CHANGED`, `NODE_CLASS_MAPPINGS`, decorator-registered handlers, dynamically selected health checks, SQL/schema constants imported from tests or validators, and context-manager/redirect-handler signature arguments. Unused signature arguments do not authorize breaking those interfaces.
-
-## 4. Legacy parity and retirement gate
-
-The approved concept and later rulings allow consolidation and some explicit removals. This table evaluates jobs, not whether every old button has a clone. “Covered” identifies an actual native destination and a declared test; it does not certify behavior on a running user host. “Blocked” means no equivalent job was demonstrated and no specific removal ruling was found. The complete System table is reproduced below.
-
-### Browsing, editing, metadata and page lifetime
-
-| Legacy capability / current evidence | Workspace destination | Proof / retirement status |
-| --- | --- | --- |
-| Dashboard recent/search list; text/category/tag filtering | Prompt library toolbar and Refine | `workspace-library.spec.mjs`: “search, category and tag filters preserve their constraints and return standalone positives”. Covered. |
-| Folder filtering of prompts | Prompt library → Refine → Folder | `workspace-library-filters.spec.mjs`: “Refine offers Folder, Tags and Tag match; a folder narrows the shelf to prompts with images there”. Covered (#444). |
-| Multiple tags AND/OR; untagged prompts | Library Tag match; Tags → Untagged prompts | `workspace-library-filters.spec.mjs`: “Tag match Any shows every prompt carrying one of the tags; changing only the match applies it”; vocabulary/state tests cover untagged. Covered. |
-| Newest/oldest and A–Z prompt sorting | Library sort | `workspace-library-state.test.js`, `workspace-library.spec.mjs` toolbar/sort cases. Covered for these orders. |
-| **Recently Used, Most Used, Z–A prompt sorting** (`prompt-list-sort.js:16`–`:22`) | **None**; native `library.mjs:39` and `library-state.mjs:13` allow only newest/name/oldest | **BLOCKER B1.** No equivalent was found. Preserve legacy. Decide whether each job is required or intentionally retired; do not implement it in this pass. Ratings sorts are a separate approved removal. |
-| Add prompt; category/tags/notes editing; duplicate rejection | New prompt / Edit metadata | `workspace-library-editor.spec.mjs`: “editor modes persist through reload with selected saved negative”; editor recovery cases. Covered for eligible parents and saved-pair metadata. |
-| Change existing prompt text in place | Create text revision | Same editor test proves a new positive/pair is created and old text remains. Consolidated with **different deliberate semantics**; include that difference in retirement approval rather than claiming identical mutation. Keep underlying legacy text-update API until consumer audit. |
-| **Manage the actual prompt-level category/tags/notes/text of a record used only as a negative component** | **No native component-management surface demonstrated**; pair metadata belongs to the pair | **BLOCKER B2 / contract decision.** `library.py:12` and `:449` exclude pure-negative records; `workspace-library.spec.mjs:47` asserts the grouping intentionally. Probe: old component is readable, absent from native parents, native detail is null. Grouping itself is approved; retiring management of that record's own metadata needs an explicit decision. No replacement screen in this pass. |
-| Prompt rating/minimum rating/Highest or Lowest Rated | No native rating controls | **Approved removal**, D153 / #447, [TESTING.md:3085](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/TESTING.md#L3085); keep stored ratings and the node/API contracts that still use them. Do not replace ratings with favorites in the data model. |
-| Select prompts; bulk category and tags | Prompt library selection bar | `workspace-library-selection.spec.mjs`: “Set category writes the selected prompts on the server, reloads the shelf and clears the selection”; “Add tags adds prompt tags to the selected prompts, suggests the vocabulary and reloads the shelf”. Covered. |
-| Confirm/retry prompt deletion | Library Delete… / archived shelf / Delete prompt… | `workspace-library-delete.spec.mjs`: “Delete… reviews the selection, deletes the unpaired, archives the paired and keeps the protected”; paired permanent-delete cases. Covered, with approved reference-safe archive/delete rules. |
-| View a prompt's images / filmstrip | Its Library history gallery and shared viewer | `workspace-library.spec.mjs`: “history displays the selected full negative beneath its positive and filters one shared physical gallery”. Covered. |
-| Tag list search; alphabetical and count sorts | Tags & categories toolbar | `workspace-vocabulary-state.test.js`, `workspace-vocabulary.spec.mjs`, #444 tag-sort cases. Covered; TAG_SORTS includes both directions and most/fewest prompts. |
-| Rename/delete/merge tags and browse associated prompts | Tags & categories | `workspace-vocabulary.spec.mjs`: “rename and merge persist and collapse duplicate links”, “delete tag confirms real impact and removes only the vocabulary name”, “prompt counts equal Library Browse results”. Covered. |
-| Gallery colliding filenames, source/folder/media filters, filename search | Images | `workspace-images.spec.mjs`: “native Images keeps colliding filenames distinct and inspects the selected source”; source/folder/media filter and filename-search tests. Covered. |
-| Grid/list, thumbnail size, continuous browsing | Images Grid/List/Masonry, thumbnail size, append + Load more | `workspace-images.spec.mjs`: “layout changes retain selection and use one collection in Grid, List and Masonry”; “continuous loading appends without replacing cards or losing selected details”. Covered. Manual columns/page-size/paged mode have an explicit simplified/approved-removal record, not a replacement control. |
-| Video playback; autoplay/mute/loop; mixed-media navigation | Shared viewer + Appearance | `workspace-system.spec.mjs`: “video defaults reach the viewer”; Images/video viewer cases; `workspace-inspect.spec.mjs`: “local video plays inline and in the viewer with real tags”. Covered. |
-| Slideshow, zoom/rotate/flip/fullscreen, keyboard/touch navigation | Shared media viewer | `tests/vendor` viewer fixture suite and [tests/browser/workspace-viewer-keys.spec.mjs](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/tests/browser/workspace-viewer-keys.spec.mjs) / `workspace-viewer-mode.spec.mjs`; viewer key and teardown tests. Keep the actual viewer tests when legacy controller tests go away. |
-| Metadata sidebar, full positive/negative text, settings, raw workflow, downloads | Shared current-file inspector/viewer | `full-inspector.spec.mjs`, `prompt-inspector.spec.mjs`, `workspace-history.spec.mjs`; the same file/prompt inspection contract is used throughout. Covered. |
-| Local PNG chooser/drag-and-drop, workflow download, copy individual prompts | Inspect a file | `workspace-inspect.spec.mjs`: “chooser opens the shared full inspector without a second read”, “drop accepts exactly one File and never navigates”, “local inspection makes no content request or storage write”; inspector download tests. Covered; local video extends it. |
-| Metadata COPY ALL summary | Shared inspector → Copy settings summary | `workspace-inspect.spec.mjs`: “Copy settings summary copies the same legacy summary in Images and Inspect”; no-clipboard fallback case. Covered (#249 L3 / D117). |
-| Per-image manual/automatic tags; batch generate/review/save | Images selection/tag dialog, Needs review, System tagging | `workspace-tagging-bulk.spec.mjs`, image-tagging/review specs, and native System table below. Covered with the approved image-owned tag model. Do not delete annotation/review persistence with old UI code. |
-| Add a prompt with category/tags/notes from the gallery (`gallery.js:2383`, `:2591`) | Images → New prompt / shared editor | `workspace-library-editor.spec.mjs`: “new from Images cancel preserves browse” also saves on its second open and checks navigation to the saved history; “editor modes persist through reload with selected saved negative” covers metadata persistence. Covered. The legacy form is a blank editor, not an automatic metadata import. Keep `/save` for existing consumers. |
-| Protect a prompt from cleanup; deliberately unprotect it | New native parents are retained by Library state; explicit `__protected__` tags remain editable through metadata/tag controls | Maintenance and `workspace-library-delete.spec.mjs` protected-record cases; [TESTING.md:2870](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/TESTING.md#L2870) / `:2924` records how to unprotect and the intentionally stronger deletion rule. Consolidated, with the default/explicit-delete semantics included in retirement approval rather than cloning the checkbox. |
-| Scan/duplicate job progress, reconnect, cancellation | Activity and shared review/job UI | `workspace-activity.spec.mjs`, System sources/maintenance tests. Covered; jobs remain session-only and lost jobs are shown honestly. |
-| Old static URLs and `admin#/tags/<tags>?mode=or` bookmarks | Plain-page mappings proposed below; deep filter URLs unresolved | **Approval gate.** Current URLs intentionally remain usable under #525. Hash fragments never reach the HTTP handler, so a blanket server redirect cannot preserve tag bookmarks. |
-| Bootstrap failure fallback and no-JS links | Current inline `workspace-boot-failure` links point to the legacy pages | **Retirement dependency**, not dead markup. `workspace.spec.mjs` tests module-fetch and startup-throw failures. Replace the fallback with a working reload/canvas/help path before removing its destinations. |
-
-### System parity: complete current inventory
-
-Source: [TESTING.md:5619](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/TESTING.md#L5619)–`:5708`. Its validator currently reports **54 rows: 48 covered, 4 kept in legacy, 2 approved removals**, with no missing declared-test references. S13 already removed many old System controls after coverage was approved. Those historical anchors do not imply the controls are still in the current HTML.
-
-| Capability | Legacy reference (historical) | Native destination/control | Current disposition | Declared proof |
-| --- | --- | --- | --- | --- |
-| Image scan directories add/remove | `admin.html:377–390`; `admin.js:200,1273–1323` | S4 Sources; `sources` · button · "+ Add source" | covered | Add source validates on the server, then marks the host draft dirty; Save persists (workspace-system-sources.spec.mjs) |
-| Currently monitoring list + Refresh | `admin.html:392–400`; `admin.js:1032` | S4 Sources; `sources` · button · "Refresh" | covered | watching only with a live observer; restart pending otherwise (workspace-system-sources.spec.mjs) |
-| Monitoring enabled | `py/config.py:212,248` | S4 Sources; `sources` · switch · "Watch for new outputs" | covered | Watch for new outputs saves monitoring_enabled; a restart applies it (workspace-system-sources.spec.mjs) |
-| Search results auto-hide `result_timeout` | `admin.html:407–412` | S3 Appearance; `appearance` · spinbutton · "Node search auto-hide (seconds)" | covered | host fields round-trip through /settings with revision (workspace-system.spec.mjs) |
-| Web UI display mode | `admin.html:414–422` | S3 Appearance; `appearance` · combobox · "Open from ComfyUI" | covered | host fields round-trip through /settings with revision (workspace-system.spec.mjs) |
-| Infinite scrolling default | `admin.html:424–430`; `admin.js:689–727` | Legacy prompt list (README continuous browsing); read-only in the report; — | kept in legacy | shouldLoadMore asks for the next page only near the bottom with pages left (list-state.test.js) |
-| Worker threads | `admin.html:437–445` | S4 Sources; `sources` · slider · "Worker threads" | covered | worker range max is cpu_count (workspace-system-sources.spec.mjs) |
-| LoraManager badge, enable, path, trigger words, CivitAI key, clear key | `admin.html:448–490`; `admin.js:1052–1156` | S10 Integrations; `integrations` · switch · "LoraManager integration" | covered | LoRA rows show detected / enabled / cache-loaded separately (workspace-system-integrations.spec.mjs) |
-| LoRA data import with progress | `admin.html:492–498,517–541`; `admin.js:1157` | S10 Integrations; `integrations` · button · "Review import" | covered | Review import shows replacement, blocked items and network effects with the backup box; Start opens the job (D107) (workspace-system-integrations.spec.mjs) |
-| Statistics | `admin.html:159`; `admin.js:1627` | S2 Overview; `overview` · button · "Explore" | covered | statistics dialog lists runs by category and database record counts (workspace-system.spec.mjs) |
-| Export components JSON `/export` | `admin.html:163`; `admin.js:1607`; [py/api/prompts.py:238](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/api/prompts.py#L238) | S9 Backup & export; `backups` · button · "Export all prompts JSON" | covered | Export JSON downloads /library/export; secondary buttons download all prompts (/export) and /pairs/export (D103) (workspace-system-backups.spec.mjs) |
-| Saved pairs export | [py/api/pairs.py:84](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/api/pairs.py#L84) | S9 Backup & export; `backups` · button · "Export saved pairs JSON" | covered | Export JSON downloads /library/export; secondary buttons download all prompts (/export) and /pairs/export (D103) (workspace-system-backups.spec.mjs) |
-| Library export | [py/api/library.py:223](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/api/library.py#L223) | S9 Backup & export; `backups` · button · "Export JSON" | covered | Export JSON downloads /library/export; secondary buttons download all prompts (/export) and /pairs/export (D103) (workspace-system-backups.spec.mjs) |
-| Diagnostics run | `admin.html:171,659`; `admin.js:1984` | S12 Diagnostics; `diagnostics` · button · "Run checks" | covered | Run checks opens the shared Health report (workspace-system-diagnostics.spec.mjs) |
-| Synthetic image-link test | `admin.html:662`; `admin.js:2101` | S12 Diagnostics; `diagnostics` · button · "Create test link…" | covered | Create test link confirms first and names the prompt (workspace-system-diagnostics.spec.mjs) |
-| Maintenance cleanup_duplicates, vacuum, cleanup_orphaned_images, prune_orphaned_prompts | `admin.html:692–748`; `admin.js:1834` | S6/S7 Maintenance; `maintenance` · button · "Review plan" · in "Duplicate prompt text" | covered | Apply reviewed operation closes, toasts, opens the job in Activity (workspace-system-maintenance.spec.mjs) |
-| Maintenance check_hash_duplicates, check_consistency | `admin.html:692–748`; `admin.js:1834` | S2 Health report (Maintenance notice, D123); `maintenance` · button · "Run health checks" | covered | Run health checks opens Health report and updates metric 4 (workspace-system.spec.mjs) |
-| Maintenance statistics (database info) | `admin.html:692–748`; `admin.js:1834` | S12 Diagnostics; `diagnostics` · term · "Database" | covered | meta-grid shows real database and source status, the pinned Viewer.js version and the host renderers (workspace-system-diagnostics.spec.mjs) |
-| Maintenance select all / clear all / run | `admin.html:754–762`; `admin.js:1822–1833` | S7 per-operation review; `maintenance` · button · "Review plan" | covered | plan dialog shows the server's scope, protected, backup policy and media lines with the backup box (D100); Cancel writes nothing (workspace-system-maintenance.spec.mjs) |
-| Prompt cleanup `/cleanup` | [py/api/admin.py:620](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/api/admin.py#L620) | S6/S7 Maintenance; `maintenance` · button · "Review plan" · in "Duplicate prompt text" | covered | test_duplicate_prompts_plan_counts_the_legacy_groups (test_maintenance_plans.py) |
-| Database backup | `admin.html:179,824`; `admin.js:2139,2454` | S9 Backup & export; `backups` · button · "Back up" | covered | Back up downloads through the api client and revokes the object URL (D103) (workspace-system-backups.spec.mjs) |
-| Restore from file | `admin.html:183,616–642`; `admin.js:2177–2248` | S8/S9 Backup & export; `backups` · button · "Review restore…" | covered | Review restore stages the chosen file and shows the real summary with the backup box (D105) (workspace-system-backups.spec.mjs) |
-| Metadata scan with progress, cancel, pill | `admin.html:187,805–865`; `admin.js:2336–2500` | S4 Sources; `sources` · button · "Review scan" | covered | Review scan opens the shared Review metadata scan with all sources (workspace-system-sources.spec.mjs) |
-| Rescan-required notice + dismiss | `admin.html:1367–1410`; `admin.js:991–1011` | S4 Sources; `sources` · button · "Later" | covered | notice Later persists the 3.2.0 dismissal (pm_update_notice_dismissed) without scanning (workspace-system-sources.spec.mjs) |
-| View logs with level and limit | `admin.html:195,885–907,974`; `admin.js:2579–2641` | S12 Logs; `diagnostics` · combobox · "Level" | covered | level filter is minimum-level over all six choices (workspace-system-diagnostics.spec.mjs) |
-| Log statistics | `admin.html:921–941`; `admin.js:2512` | S12 Logs; `diagnostics` · status · "Log statistics" | covered | log statistics show entries, errors, warnings, files and size (workspace-system-diagnostics.spec.mjs) |
-| Log files list and download | `admin.html:910,982–985`; `admin.js:2545,2642,2679` | S12 Logs; `diagnostics` · button · "Download log" | covered | each listed file downloads by its returned name and a link has no Download (workspace-system-diagnostics.spec.mjs) |
-| Clear/truncate logs | `admin.html:915`; `admin.js:2704` | S12 Logs; `diagnostics` · button · "Clear all logs…" | covered | Clear all logs states both counts, confirms first and reads everything again (workspace-system-diagnostics.spec.mjs) |
-| Rotated-log cleanup (new, #329) | — | S12 Logs; `diagnostics` · button · "Review log cleanup" | covered | Review log cleanup lists only rotated copies and keeps the rest (workspace-system-diagnostics.spec.mjs) |
-| Set log level (incl. CRITICAL), console logging | `admin.html:948–966`; `admin.js:2530,2729` | S12 Logs; `diagnostics` · combobox · "Runtime log level" | covered | runtime level (including CRITICAL) and console logging save and say they apply until the server restarts (workspace-system-diagnostics.spec.mjs) |
-| Log file_logging / max_file_size / backup_count / buffer_size | `py/api/logging_routes.py:56,285–299` | S12 Logs (read-only); `diagnostics` · group · "Log files & retention" | covered | each listed file downloads by its returned name and a link has no Download (workspace-system-diagnostics.spec.mjs) |
-| Auto-tag model list with status | `admin.html:1095–1148`; `admin.js:3641` | S11 Auto-tagging; `tagging` · combobox · "Tagging model" | covered | model options are the four real engines with size and the description shows live status (workspace-system-tagging.spec.mjs) |
-| Auto-tag model download | `admin.html:1413–1438`; `admin.js:3680–3747`; `gallery.js:3412` | S11 Auto-tagging; `tagging` · button · "Download" | covered | Download starts the job and Activity shows it without Cancel (workspace-system-tagging.spec.mjs) |
-| Unload model | `gallery.js:3480` | S11 Auto-tagging; `tagging` · button · "Unload" | covered | Unload is enabled only while a model is loaded, and a held gate's refusal names the operation (workspace-system-tagging.spec.mjs) |
-| Tag template, WD14 thresholds, already-tagged mode | `admin.html:1150–1198`; `admin.js:3748` | S11 Auto-tagging; `tagging` · combobox · "Existing tags" | covered | defaults save through Save preferences and the Tag image dialog uses them (workspace-system-tagging.spec.mjs) |
-| Batch auto-tag output images | `admin.html:191,1210,1279–1318`; `admin.js:3748–3840` | S11 Auto-tagging; `tagging` · button · "Review" | covered | Tag output images reviews the images, tags each one and never a prompt (#379) (workspace-system-tagging.spec.mjs) |
-| Batch review loop | `admin.html:1206,1218–1364`; `admin.js:3841–4172` | S11 + image-tagging plan; `tagging` · button · "Preview tagging review" | covered | Preview tagging review opens the Tag image dialog for the selected image (workspace-system-tagging.spec.mjs) |
-| Gallery per-image auto-tag / review | `gallery.html:601,605`; `gallery.js:3506,3674–3753` | Image-tagging plan (selection bar); — | covered | Auto-tag selected with Apply automatically runs a job with the chosen model, thresholds and suggestion count (workspace-tagging-bulk.spec.mjs) |
-| Gallery thumbnail generation | `gallery.js:1852,1967` | S5/S7; `sources` · button · "Review options" · in "Thumbnail generation" | covered | Start closes the dialog, toasts, and opens the job in Activity (workspace-system-sources.spec.mjs) |
-| Clear server thumbnails | `gallery.js:2175–2192` | S7 Maintenance; `maintenance` · button · "Review options" · in "Thumbnail cache" | covered | Thumbnail cache opens the S5 dialog (workspace-system-maintenance.spec.mjs) |
-| Browser cache clear | `gallery.js:2194–2207` | S7 Maintenance; `maintenance` · button · "Review plan" · in "Metadata cache" | covered | Metadata cache reviews and clears only owned browser entries when there are some (D102) (workspace-system-maintenance.spec.mjs) |
-| Refresh file listing | `gallery.js:2209` | S4 Sources; `sources` · button · "Refresh" · in "Refresh files" | covered | Refresh files calls /gallery/rescan and toasts its counts (workspace-system-sources.spec.mjs) |
-| Duplicate image scan, review, delete | `gallery.js:2234–2577` | S6/S7 Maintenance; `maintenance` · button · "Find duplicates" | covered | Find duplicates starts a job; its view links Review groups; Keep radios build a duplicate_files plan (D101) (workspace-system-maintenance.spec.mjs) |
-| Default view mode, image quality | `gallery-settings.js:26–27` | S3 Appearance; `appearance` · combobox · "Default layout" | covered | defaults apply to a new visit but not to the current view or a saved view (workspace-system.spec.mjs) |
-| Auto-load metadata, cache metadata, show file paths | `gallery-settings.js:31–33` | S3 Appearance; `appearance` · switch · "Load metadata on selection" | covered | metadata off shows an explicit load and loads once on request (workspace-system.spec.mjs) |
-| Video autoplay, mute, loop | `gallery-settings.js:40–42` | S3 Appearance; `appearance` · switch · "Autoplay videos" | covered | video defaults reach the viewer (workspace-system.spec.mjs) |
-| Image info on cards; sidebar collapsed | `gallery-settings.js:30,34` | S3 Appearance; `appearance` · switch · "Show image details on cards" | covered | added rows reach their consumers (workspace-system.spec.mjs) |
-| Reset gallery settings | `gallery.js:1813` | S3 Appearance; `appearance` · button · "Reset" | covered | reset restores defaults without touching other keys (workspace-system.spec.mjs) |
-| Lazy loading | `gallery-settings.js:25` | Legacy gallery (native always lazy); — | kept in legacy | a legacy gallery Save keeps the workspace keys and every other stored key (gallery-settings.test.js) |
-| Results per page / grid columns / paged mode | `gallery-settings.js:28–29,35` | README continuous browsing; — | approved removal | numeric strings from <select> values are accepted and columns are clamped (gallery-settings.test.js) |
-| Startup thumbnail prompt | `gallery-settings.js:38–39`; `gallery.js:2578` | README; Overview thumbnail row; — | approved removal | thumbnail row reflects the status endpoint (workspace-system.spec.mjs) |
-| Client debug output `debugMode` | `gallery-settings.js:36` | Legacy gallery (S12-10); — | kept in legacy | a legacy gallery Save keeps the workspace keys and every other stored key (gallery-settings.test.js) |
-| API timeout `apiTimeout` | `gallery-settings.js:37` | Legacy gallery (S12-10; read by no request); — | kept in legacy | defaults are a complete, sane settings object (gallery-settings.test.js) |
-| config.json-only keys | `py/config.py:212–234,722–739`; [py/api/diagnostics_report.py:185](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/api/diagnostics_report.py#L185) | S12 report (read-only); `diagnostics` · button · "Download diagnostic report" | covered | test_report_lists_config_only_keys (test_api_diagnostics_report.py) |
-
-The four kept-in-legacy settings are presentation/debug preferences, not four missing maintenance tools: legacy infinite-scroll default, lazy-loading toggle, debug output and an API-timeout value read by no request. The native app always uses continuous browsing/lazy loading. Include disposition of these old controls/keys in the retirement approval; keep existing stored preferences readable and preserve unrelated keys. Do not invent new native settings to reproduce inert controls.
-
-### Bookmark proposal (not approved)
-
-1. Keep the old HTTP entry points long term, even after their HTML/controllers retire.
-2. Plain `/admin` → workspace Library; plain `/gallery` → Images; `/gallery.html` → Inspect. Preserve any reverse-proxy mount prefix.
-3. Serve a tiny `/admin` compatibility shim for fragments, because the server cannot see `#/tags`. Bare `#/tags` can map to workspace Tags. Selected-tag AND/OR bookmarks require a separately approved mapping or explicit retirement of their filter semantics; until that decision, keep their legacy path functional.
-4. Do not drop unknown query/hash state silently or redirect a tag bookmark to unfiltered Images. Add tests for direct visits, proxy prefixes, Back navigation and fragment handling.
-5. Replace/remove every old link, including the static boot-failure/noscript fallback and README links, before deleting page files. `workspace.html` edits require a host restart because its response is cached.
-
-### Backend retirement boundary
-
-Retirement is not permission to delete every route old controllers called. The workspace still uses `/export`, backup/restore, prompt/pair/tag operations, settings, scans, thumbnails, logs, shared file serving and the model routes. The node library and bridge also call the HTTP surface independently. Keep schemas, migrations, restore/old-data readers, public node names/input order and root node modules. Review each apparently unused route as a separate contract decision after the frontend is gone.
-
-## 5. Coverage work, ranked by risk
-
-The aggregate gate is already strong. The useful additions are the following behavioral invariants, not a general percentage chase.
-
-| Priority | Retained boundary / evidence | Test work before refactoring |
-| --- | --- | --- |
-| 1 | UNC-backed backup, restore, Move library, history fence (F01) | Assert each reader uses the valid URI; then native Windows share round trips, old-schema restore, handle closure and rollback/no-write-on-failure. `history_read_fence.py` is 98.39% covered yet misses this whole platform contract. |
-| 1 | Backup/restore cancellation/adoption and library-move copy failures | `backup_restore.py` is 88.19% combined (78.79% branches); relevant gaps include `:506`, `:558`–`:563`, `:576`–`:577`, `:956`–`:970`. Exercise a cancelled worker that fails, post-publish cleanup failures that must not report an unperformed restore, and stage/handle retirement. In `library_move.py:517`–`:519` and `:538`–`:539`, fail a real copy operation and prove source/old library remain usable and only owned temps are cleaned. |
-| 1 | Delete/trash and removed-image recovery | Keep original bytes and reference-protection assertions; prove file/stream release before cleanup on Windows. The local macOS run measures [utils/trash.py](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/utils/trash.py) at 29.15% because Linux/BSD branches are skipped; do not treat that as missing Linux tests or lower a floor. Preserve `test_trash_freedesktop.py`, mount-root and route-audit coverage. This audit did not mount a filesystem or exercise native Windows locking. |
-| 2 | Prompt/image linking, cached run counts and metadata | Retain conservative ambiguous/unlinked results, FIFO cleanup, saved negative roles, document/inline-reader parity and Python/browser differential tests. Add a bounded-growth test before changing F02; do not replace the registry-reader tests without proving saved image metadata, run counting and history remain correct. |
-| 3 | API shape/type/oversize boundaries | F04's three cases must fail before the fix, then return 400 and preserve storage. Retain envelope/error-redaction tests; audit the other `.json()`-then-normalize handlers using the same case matrix. |
-| 3 | Model unload responsiveness and cancellation | Event-gated worker tests for F03; success/failure-only fake service tests are insufficient. Keep model-gate refusal/release tests. |
-| 4 | Shared code whose legacy tests would disappear | Before deleting legacy specs, move distinct shared PNG/Comfy metadata parsing, API-client/proxy-prefix behavior, gallerySettings unknown-key preservation, Viewer lifecycle, backup/restore and data-safety assertions into native/shared tests. Remove tests only for code actually removed. |
-
-Existing frontend floors are only 47% lines for admin, 54% for gallery and 57% for tags-page; these are legacy-specific baselines, not permission to give extracted new modules low coverage. New files need at least 80% lines and all retained per-file floors remain. Removing a measured file must remove its obsolete baseline entry and pass `coverage:baseline-check`; retained shared modules still enter combined coverage.
-
-## 6. Repository organization and distribution
-
- Remove the three unreferenced image artifacts listed as DEAD: **1,737,407 bytes** in the current tree. Deleting them does not shrink old Git history, and no history rewrite is proposed.
- Keep [README-legacy.md](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/README-legacy.md): README links it for the still-shipped old UI and the upgrade/rollback history, and TESTING links its database-path compatibility section. Do not remove old-data/recovery instructions just because the old controls retire. Later split the useful historical upgrade notes from page-only instructions, updating every link.
- Ten of the eleven `images/` files are live documentation assets. Keep them while the legacy README points to them; do not move them for cosmetic root cleanup. `assets/readme/` is the current README's live image set.
- Keep root node files exactly where ComfyUI imports them. Do not introduce a `src/` migration or rename a node/input during cleanup.
- `docs/` is broadly ignored, including the audit and local plans. Existing tracked concept/design/docs remain tracked; new required tests/spec references in that tree must be explicitly accounted for. Local `EGM.md`, CLAUDE and AGENTS stay excluded. No needed currently tracked runtime file was found hidden by an ignore rule.
- TESTING is 7,562 lines / 585,548 bytes. It combines execution commands, a safety contract, machine-parsed parity tables and a large decision/deviation ledger. A later organization commit can split reference material by feature while leaving a short testing entry point, stable links and parser inputs. Update `legacy-coverage.mjs` and its meaningful tests in the same change if tables move. Do not blindly move headings the guard parses.
- Defer large facade splits until actual removals show the durable seams. [database/operations.py](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/database/operations.py) can eventually keep the public facade while delegating prompt search, vocabulary and image links. Avoid copying database logic into the API or creating divergent Toolkit controls.
- The local tracked-bundle preview includes tests, tooling, docs and screenshots (F09); upstream packaging-source inspection explains why the absence of `.comfyignore` matters. Add a non-publishing artifact-content check and exclusions for the next approved release. No standard Python artifact was produced because the clean-snapshot build failed. Do not make an opportunistic version/build-metadata change or upload the local audit ZIPs.
-
-## 7. Proposed PR order — approval required
-
-These are proposed future implementation batches, not work included in this review-only PR. Use issue-linked implementation branches once the maintainer supplies an existing issue or approves creating/updating one. No issue will be posted as an incidental audit action. This review branch uses #334 as the related cutover context and does not close it or any other issue. Each PR needs exact-head checks, bot-review handling, Windows impact/evidence and a `Manual check:` line. Keep required checks/coverage thresholds unchanged.
-
-| Order | Proposed scope and logical commits | Validation / manual tier |
-| --- | --- | --- |
-| 1 — tests and small dead-code cleanup | About 4–6 commits: (1) add distinct retained data-safety coverage that does not just mirror implementation; (2) remove `_current_set`, `_gated_runner` and the unused keyword; (3) remove the old lock/scaffolding and safe test-only wrappers with their own tests; (4) remove the unused config writer while preserving ConfigStore behavior; (5) remove the three unreferenced assets; (6) reconcile root docs/local briefs. Defer public/compatibility helpers marked keep/UNSURE. | Targeted Python/Node tests, full Python suite and both coverage gates, baseline check, vendor/tooling checks, black/flake8 and pre-push. Legacy pages stay. **Manual check: none** for the behavior-neutral portion. |
-| 2 — narrow recovery/lifecycle fixes, before large refactors | About 4–6 commits, tests before each fix: UNC-safe SQLite reads and native controls; off-loop model unload/cancellation; invalid save-body refusals. These are explicit bug fixes, not a claim of byte-for-byte unchanged failure behavior. The registry only joins if its external-contract question is resolved and host tests prove removal safe. | Native Windows run is mandatory for UNC/handles. Managed Classic/Nodes 2.0 execution/reload tests for node-side changes. **Manual check: quick** for model unload/host behavior; upgrade to **required** if the real dependency behavior cannot be proved with the managed test host, and then keep that work out of a batch until tested. Python changes need a maintainer restart later. |
-| 3 — maintainability/organization only if still useful | About 3–5 commits: tests protecting the chosen seam; extract retained image/thumbnail/media helpers behind stable facades; remove genuinely redundant private helpers; split testing reference material with stable links/guards; define an artifact-content check without publishing. Avoid moving root node modules or touching pyproject/vendor/concept pins. Do not refactor legacy controllers destined for deletion. | Retained behavior/persistence/failure/cleanup tests and coverage on every new source file (80%+ for JS). **Manual check: none** unless host-facing behavior is involved; then isolate/validate it. |
-| Separate retirement stage — blocked | Only after parity-table approval and B1/B2/bookmark/fallback decisions. Small commits: links/compatibility entry points; old pages; controllers and proven legacy-only helper modules; application-owned obsolete CSS if any; route/query review last. No protected CSS/vendor edits. Keep database recovery/compatibility code. | Native workspace/shared tests replace distinct legacy coverage first; remove only obsolete tests, rerun baseline check and full frontend gate, and use the CI browser/real-host matrix. **Manual check: required**: targeted maintainer upgrade, bookmarked URL and real-host check. This stage is its own PR(s) and cannot join an untested cleanup batch. |
-
-If multiple approved PRs are ready together, follow the brief's combined-branch/one-commit-per-PR queue policy. Do not consume additional queue runs merely to parallelize cosmetic cleanup. Do not push a fix while the preceding head's CI still runs. No merging, publication or running-install modification is part of the current authorization.
-
-## 8. Open decisions and unresolved evidence
-
-1. **The maintainer approved sharing the audit for further review. Review the proposed implementation batches before starting cleanup.** Public compatibility helpers marked keep/UNSURE and all legacy pages remain unless separately approved.
-2. **B1:** preserve Recently Used / Most Used / reverse-alphabetical prompt browsing via separate work, or explicitly retire those jobs. Recommendation: keep the legacy page until a ruling; do not quietly remove them.
-3. **B2:** decide what users should do with prompt-level metadata on pure-negative component records. Recommendation: retain existing management access until that data contract is settled. Positive-parent grouping and pair metadata are already intentional; they do not themselves answer this question.
-4. **Registry:** identify any supported external consumer. Recommendation: remove the write-only registry only if there is none; otherwise bound both stores. Its public-looking method names and regression assertions merit an explicit decision.
-5. Approve bookmark mappings and the bootstrap-failure fallback before retirement. Deep tag-filter fragments cannot be preserved by a plain server redirect.
-6. Standard wheel support and the exact previously published Registry archive remain unverified. The local preview establishes development-file inclusion for the current tracked-file packaging path; `.comfyignore` and an artifact guard are proposed for approval, with no release or pyproject change. npm's initial notices and later offline result do not establish a current vulnerability verdict.
-7. The audit has no native Windows run, full Firefox/WebKit run, managed real-host matrix, live user test or fresh exact-head CI observation. Those are implementation/retirement verification gates, not results claimed here. No Windows claim is based solely on the macOS pass or the URI probe.
-
-The next action is additional review of this report. **Keep this PR in draft; do not mark ready, enqueue or merge it. Implementation belongs in separately approved branches.**
@@ -29,12 +29,6 @@ Each role has `status` (`resolved`, `absent`, `unresolved`, or `ambiguous`), `te
 (string only when resolved, otherwise null), and `source`. Inspection does not
 index files, alter saved prompts, run scans, or decode image pixels. PNG text and
 video probe output are bounded; unsupported or malformed evidence remains
-unresolved rather than becoming sendable placeholder text. Videos are read from
-one container carrier: the per-key tags written by core SaveVideo/SaveWEBM and
-current VideoHelperSuite (`prompt`, `workflow`, `parameters`,
-`comfyassets_prompt_pairs`), else the old VideoHelperSuite `comment` envelope,
-else `description`. The admin scan reads the same carrier, so Images and
-ingestion agree on a video's prompts (see TESTING.md for the order and budgets;
-the live monitor processes images only).
+unresolved rather than becoming sendable placeholder text.

 Python route changes require restarting ComfyUI. Browser assets require a refresh.
@@ -18,13 +18,9 @@ protocol and peer checks reject unrelated messages. Same-origin scripts are
 trusted; this transport is not authentication against other scripts on that origin.
 Unsupported messaging is reported without breaking existing ComfyUI nodes.

-Apply works in one click: without a preview, the sender requests the ticket itself
-and applies it. Preview remains optional, and shows the exact change first.
-
 An apply timeout or abort after posting means the outcome is unknown. It cannot
 prove the host cancelled the write. The sender must inspect a fresh destination
-preview or choose the destination again before sending again; automatic retry must
-not overwrite edits. An error the host returned is a refusal: nothing was written.
+preview before deciding to send again; automatic retry must not overwrite edits.

 ## PromptManager adapter

@@ -35,9 +31,7 @@ field. Unknown/ambiguous metadata must not become an empty string.

 Previews show original and requested text plus positive prepend/append composition.
 Connected composition is marked unknown rather than guessing upstream values.
-Connected destination fields reject writes. The sender compares the destination's revision
-(node object and graph version) from discovery with the one at the preview, and refuses if the workflow changed.
-Applying rechecks graph, node, widgets,
+Connected destination fields reject writes. Applying rechecks graph, node, widgets,
 values and connections. Ordinary serialization cache synchronization is accepted
 only when it preserves live values. Both requested roles are checked before writing.

@@ -26,13 +26,13 @@ except ImportError:
    InputTypeDict = dict

 try:
-    from .prompt_manager_base import SAVE_TO_LIBRARY_INPUT, PromptManagerBase
+    from .prompt_manager_base import PromptManagerBase
 except ImportError:
    import os
    import sys

    sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
-    from prompt_manager_base import SAVE_TO_LIBRARY_INPUT, PromptManagerBase
+    from prompt_manager_base import PromptManagerBase


 class PromptManager(PromptManagerBase, ComfyNodeABC):
@@ -115,7 +115,6 @@ class PromptManager(PromptManagerBase, ComfyNodeABC):
                        )
                    },
                ),
-                "save_to_library": SAVE_TO_LIBRARY_INPUT,
            },
            "hidden": {
                # The queued graph and this node's id: used to tell the positive
@@ -153,7 +152,6 @@ class PromptManager(PromptManagerBase, ComfyNodeABC):
        append_text: str = "",
        prompt: Optional[Dict[str, Any]] = None,
        unique_id: Optional[str] = None,
-        save_to_library: bool = True,
    ) -> Tuple[Any]:
        """
        Encode the text prompt and save it to the database.
@@ -166,7 +164,6 @@ class PromptManager(PromptManagerBase, ComfyNodeABC):
            search_text: Text to search for in past prompts
            prepend_text: Text to prepend to the main prompt
            append_text: Text to append to the main prompt
-            save_to_library: Off: nothing is saved, counted or tracked (#90)

        Returns:
            Tuple containing the conditioning for the diffusion model and the final
@@ -208,9 +205,7 @@ class PromptManager(PromptManagerBase, ComfyNodeABC):
        # Save prompt to database and set execution context for gallery tracking
        prompt_id = None
        extended_tags = []
-        if not save_to_library:
-            self._skip_not_saved(prompt, unique_id)
-        elif storage_text and storage_text.strip():
+        if storage_text and storage_text.strip():
            self.logger.debug(f"Processing prompt text: {storage_text[:100]}...")

            # Add prepend/append info to tags if they exist
@@ -243,9 +238,6 @@ class PromptManager(PromptManagerBase, ComfyNodeABC):
            except Exception as e:
                # Log error but don't fail the encoding
                self.logger.warning(f"Failed to save prompt to database: {e}")
-                self._mark_untracked(prompt, unique_id)
-        else:
-            self._skip_empty_prompt(prompt, unique_id)

        # Perform standard CLIP text encoding using the combined text
        self.logger.debug(
@@ -254,11 +246,6 @@ class PromptManager(PromptManagerBase, ComfyNodeABC):
        tokens = clip.tokenize(encoding_text)
        conditioning = clip.encode_from_tokens_scheduled(tokens)

-        self.logger.info(f"CLIP encoding completed, text: {repr(encoding_text)[:80]}")
-        result = (conditioning, encoding_text)
-        if not save_to_library:
-            return result  # #90: no metadata registration, no history text
-
        # Register with ComfyUI integration for standard metadata compatibility
        node_id = f"promptmanager_{int(time.time() * 1000)}"
        self.comfyui_integration.register_prompt(
@@ -272,15 +259,12 @@ class PromptManager(PromptManagerBase, ComfyNodeABC):
                "append_text": append_text.strip() if append_text else None,
            },
        )
+
+        self.logger.info(f"CLIP encoding completed, text: {repr(encoding_text)[:80]}")
+        result = (conditioning, encoding_text)
        record_runtime_context(
            type(self).__name__, text, prepend_text, append_text, encoding_text
        )
-        self._record_cached_item(
-            unique_id,
-            (encoding_text,),
-            storage_text,
-            fields=((text, prepend_text, append_text),),
-        )
        return result

    @classmethod
@@ -23,16 +23,8 @@ try:
    from .utils.image_monitor import get_image_monitor
    from .utils.prompt_tracker import get_prompt_tracker
    from .utils.hashing import generate_prompt_hash
-    from .utils.prompt_graph import resolve_text, run_prompt_nodes, save_setting
-    from .utils.run_keys import executing_run_id, prompt_node_key
+    from .utils.prompt_graph import resolve_text, run_prompt_nodes
    from .utils.usage_tracking import PENDING_FIRST_USE
-    from .utils.cached_runs import (
-        CACHED_RUNS,
-        Role,
-        Seen,
-        own_counts,
-        stored_facts,
-    )
 except ImportError:
    import sys

@@ -42,32 +34,8 @@ except ImportError:
    from utils.image_monitor import get_image_monitor
    from utils.prompt_tracker import get_prompt_tracker
    from utils.hashing import generate_prompt_hash
-    from utils.prompt_graph import resolve_text, run_prompt_nodes, save_setting
-    from utils.run_keys import executing_run_id, prompt_node_key
+    from utils.prompt_graph import resolve_text, run_prompt_nodes
    from utils.usage_tracking import PENDING_FIRST_USE
-    from utils.cached_runs import (
-        CACHED_RUNS,
-        Role,
-        Seen,
-        own_counts,
-        stored_facts,
-    )
-
-
-# The optional input every PromptManager node declares last (#90): declared
-# last so no widget value of a workflow saved before it shifts.
-SAVE_TO_LIBRARY_INPUT = (
-    "BOOLEAN",
-    {
-        "default": True,
-        "label_on": "save",
-        "label_off": "skip",
-        "tooltip": (
-            "Save this node's prompt to the library, count its runs and link its "
-            "images. Off: PromptManager ignores the run; the output is unchanged."
-        ),
-    },
-)


 class PromptManagerBase:
@@ -101,10 +69,8 @@ class PromptManagerBase:
        """Save the prompt to the SQLite database.

        Runs are normally counted by the queue hook (utils/usage_tracking.py), so a
-        save only counts one when asked to (text the hook could not see, unless
-        this job already counted the node from ComfyUI's cache) or when the hook
-        queued this prompt before it existed. The two are independent: the
-        pending catch-up is written even when ``count_run`` is False.
+        save only counts one when asked to (batch items whose text the hook could not
+        see) or when the hook queued this prompt before it existed.

        Args:
            text: The prompt text
@@ -172,9 +138,7 @@ class PromptManagerBase:
        resolved = resolve_text(prompt_graph, node_id)
        return {
            "is_run_prompt": node_id in run_prompt_nodes(prompt_graph),
-            # The hook skips a switch it cannot read (#90): the node counts
            "seen_at_queue": resolved is not None
-            and save_setting(prompt_graph, node_id) is True
            and generate_prompt_hash(resolved) == generate_prompt_hash(text),
            "known": True,
        }
@@ -201,137 +165,17 @@ class PromptManagerBase:
        batch_item = (
            role["known"] and role["is_run_prompt"] and not role["seen_at_queue"]
        )
-        counts = own_counts(
-            type(self).__name__,
-            stored_facts(text),
-            Role(
-                frozenset({"text"} if role["known"] and role["is_run_prompt"] else ())
-            ),
-            Seen(text=role["seen_at_queue"]),
-        )
        prompt_id = self._save_prompt_to_database(
-            text=text,
-            category=category,
-            tags=tags,
-            count_run=bool(counts) and not self._replayed(unique_id),
+            text=text, category=category, tags=tags, count_run=batch_item
        )
-        if role["is_run_prompt"] and not prompt_id:
-            # The save failed: an older entry of this key must not stand in (#342)
-            self._mark_untracked(prompt_graph, unique_id)
-        elif role["is_run_prompt"]:
+        if prompt_id and role["is_run_prompt"]:
            self.prompt_tracker.set_current_prompt(
                prompt_text=encoding_text,
                additional_data={**additional_data, "prompt_id": prompt_id},
                push_to_queue=batch_item or not role["known"],
-                **self._run_identity(prompt_graph, unique_id),
            )
        return prompt_id

-    def _cached_runs(self) -> Any:
-        return getattr(self, "cached_runs", CACHED_RUNS)
-
-    def _replayed(self, unique_id: Any) -> bool:
-        """This job already counted the node from ComfyUI's cache (#347).
-
-        A RAM-pressure cache can free the entry after ``execution_cached``, so
-        the node executes in a job that replayed it: its own count is skipped.
-        """
-        try:
-            return unique_id is not None and self._cached_runs().replayed(unique_id)
-        except Exception as error:
-            self.logger.debug(f"Could not check the cached-run replay: {error}")
-            return False
-
-    def _record_cached_item(
-        self,
-        unique_id: Any,
-        outputs: tuple,
-        text: Any,
-        negative_text: Any = None,
-        fields: Optional[tuple] = None,
-    ) -> None:
-        """Remember this execution's outputs and stored text for cached jobs (#347).
-
-        ``fields`` are the ``(raw, prepend, append)`` texts this execution gave
-        ``record_runtime_context`` for each output, so a cached job's history
-        can record them too (#403).
-        """
-        if unique_id is None:
-            return
-        try:
-            self._cached_runs().record_item(
-                unique_id, outputs, stored_facts(text, negative_text), fields
-            )
-        except Exception as error:
-            self.logger.debug(f"Could not record the cached-run receipt: {error}")
-
-    @staticmethod
-    def _run_identity(prompt_graph: Any, unique_id: Any) -> Dict[str, Any]:
-        """The tracker's proof that an image belongs to this execution (#342)."""
-        return {
-            "run_key": prompt_node_key(prompt_graph, unique_id),
-            "run_id": executing_run_id(),
-        }
-
-    def _skip_not_saved(self, prompt_graph: Any = None, unique_id: Any = None) -> None:
-        """``save_to_library`` is off: nothing is saved, counted or tracked (#90).
-
-        A literal off makes the node no run prompt (``utils.prompt_graph``), so
-        no image looks up its run key. A switch wired from a node the graph
-        cannot read keeps the node a run prompt: its run key is marked like an
-        empty editor's, so an earlier run's entry of that key never links this
-        run's images.
-        """
-        message = (
-            "Save to library is off for this node: its prompt is not saved, the "
-            "run is not counted and its images are not linked"
-        )
-        if isinstance(prompt_graph, dict) and unique_id is not None:
-            self._mark_untracked(prompt_graph, unique_id, message)
-        else:
-            self.logger.info(message)
-
-    def _skip_empty_prompt(self, prompt_graph: Any, unique_id: Any) -> None:
-        """The ``text`` editor is empty: save and track nothing (#342).
-
-        Prepend and append text are deliberately never stored as the prompt, so
-        an empty editor has no prompt to save, count or link. For the run's
-        positive node this is logged at info and the node's run key is marked
-        empty (``_mark_untracked``).
-        """
-        self._mark_untracked(
-            prompt_graph,
-            unique_id,
-            "Prompt text is empty (prepend and append text are not stored): "
-            "nothing saved or tracked, and this run's images stay unlinked",
-        )
-
-    def _mark_untracked(
-        self, prompt_graph: Any, unique_id: Any, message: Optional[str] = None
-    ) -> None:
-        """This execution of a positive node has no prompt to link (#342).
-
-        An empty editor, or a save or tracking failure. The node's run key is
-        marked with a placeholder, so no earlier prompt of that key can be
-        linked to this run's images, and a batch item keeps its queue place.
-        ``message`` is logged at info for a positive node.
-        """
-        try:
-            role = self._prompt_role(prompt_graph, unique_id, "")
-            if not role["is_run_prompt"]:
-                if message:
-                    self.logger.debug("Empty text on a non-positive node; not saved")
-                return
-            if message:
-                self.logger.info(message)
-            self.prompt_tracker.mark_empty(
-                push_to_queue=role["known"],
-                **self._run_identity(prompt_graph, unique_id),
-            )
-        except Exception as error:
-            # Tracking must never block generation
-            self.logger.warning(f"Could not mark the untracked prompt: {error}")
-
    def _record_use(self, prompt_id: int, times: int = 1) -> None:
        """Count runs; a tracking failure must never block generation."""
        try:
@@ -369,10 +213,8 @@ class PromptManagerBase:

        cache = get_trigger_cache()

-        # Lazy-load cache on first use; a failed load waits before the next try
-        # (#355: never a rescan of LoraManager's folders on every run).
-        retry_due = getattr(cache, "retry_due", lambda: True)
-        if not cache.is_loaded and IntegrationConfig.LORA_MANAGER_PATH and retry_due():
+        # Lazy-load cache on first use
+        if not cache.is_loaded and IntegrationConfig.LORA_MANAGER_PATH:
            cache.load(IntegrationConfig.LORA_MANAGER_PATH)

        modified, injected = inject_trigger_words(text, cache)
@@ -12,21 +12,9 @@ else:

 try:
    from .prompt_manager import IO, InputTypeDict, PromptManagerFocused
-    from .utils.cached_runs import (
-        PAIR,
-        Role,
-        Seen,
-        own_counts,
-        pair_components,
-        stored_facts,
-    )
    from .utils.hashing import generate_prompt_hash
    from .utils.pair_execution import record_pair_execution
-    from .utils.prompt_graph import (
-        intrinsic_pair_nodes,
-        run_prompt_components,
-        save_setting,
-    )
+    from .utils.prompt_graph import intrinsic_pair_nodes, run_prompt_components
    from .utils.prompt_pair_resolver import resolve_text_input
    from .utils.usage_tracking import (
        PENDING_FIRST_USE,
@@ -35,21 +23,9 @@ try:
    )
 except ImportError:
    from prompt_manager import IO, InputTypeDict, PromptManagerFocused
-    from utils.cached_runs import (
-        PAIR,
-        Role,
-        Seen,
-        own_counts,
-        pair_components,
-        stored_facts,
-    )
    from utils.hashing import generate_prompt_hash
    from utils.pair_execution import record_pair_execution
-    from utils.prompt_graph import (
-        intrinsic_pair_nodes,
-        run_prompt_components,
-        save_setting,
-    )
+    from utils.prompt_graph import intrinsic_pair_nodes, run_prompt_components
    from utils.prompt_pair_resolver import resolve_text_input
    from utils.usage_tracking import (
        PENDING_FIRST_USE,
@@ -98,13 +74,8 @@ class PromptManagerPair(PromptManagerFocused):
        prompt: Optional[Dict[str, Any]] = None,
        unique_id: Optional[str] = None,
        extra_pnginfo: Optional[Dict[str, Any]] = None,
-        save_to_library: bool = True,
    ) -> Tuple[Any, Any, str, str]:
-        """Encode both sides once; database and tracking failures never block CLIP.
-
-        With ``save_to_library`` off nothing is saved, counted, tracked or
-        recorded (#90); the four outputs are the same.
-        """
+        """Encode both sides once; database and tracking failures never block CLIP."""
        if clip is None:
            raise RuntimeError("ERROR: clip input is invalid: None")
        if not isinstance(text, str) or not isinstance(negative_text, str):
@@ -122,10 +93,6 @@ class PromptManagerPair(PromptManagerFocused):
        negative_conditioning = clip.encode_from_tokens_scheduled(
            clip.tokenize(negative_text)
        )
-        result = positive_conditioning, negative_conditioning, positive, negative_text
-        if not save_to_library:
-            self._skip_not_saved(prompt, unique_id)
-            return result
        record_pair_execution(
            extra_pnginfo,
            unique_id,
@@ -150,29 +117,85 @@ class PromptManagerPair(PromptManagerFocused):
        )
        is_positive = "text" in used_fields
        pair_used = node_id in intrinsic_pair_nodes(prompt) if known else True
-        if not text.strip():
-            # Nothing to store: prepend/append are never the stored prompt (#342)
-            self._skip_empty_prompt(prompt, unique_id)
-        else:
-            try:
-                pair_id, prompt_id = self._save_and_track_pair(
-                    text,
+        try:
+            pair_id = self.db.save_prompt_pair(
+                text,
+                negative_text,
+                category=category.strip() or None,
+                tags=self._parse_tags(tags),
+            )
+            pair = self.db.get_prompt_pair(pair_id)
+            prompt_id = pair["positive_prompt_id"]
+            resolved_positive = (
+                resolve_text_input(prompt, node_id, "text") if known else None
+            )
+            resolved_negative = (
+                resolve_text_input(prompt, node_id, "negative_text") if known else None
+            )
+            positive_seen = resolved_positive is not None and generate_prompt_hash(
+                resolved_positive
+            ) == generate_prompt_hash(text)
+            pair_seen = (
+                positive_seen
+                and resolved_negative is not None
+                and generate_prompt_hash(resolved_negative)
+                == generate_prompt_hash(negative_text)
+            )
+            positive_pending = getattr(self, "pending_first_use", PENDING_FIRST_USE)
+            pair_pending = getattr(
+                self, "pending_pair_first_use", PENDING_PAIR_FIRST_USE
+            )
+            counted = set()
+            for field, component_text, resolved_text, component_id in (
+                ("text", text, resolved_positive, prompt_id),
+                (
+                    "negative_text",
                    negative_text,
-                    positive,
-                    category=category,
-                    tags=tags,
-                    prepend_text=prepend_text,
-                    append_text=append_text,
-                    prompt=prompt,
-                    unique_id=unique_id,
-                    used_fields=used_fields,
-                    is_positive=is_positive,
-                    pair_used=pair_used,
+                    resolved_negative,
+                    pair["negative_prompt_id"],
+                ),
+            ):
+                component_hash = generate_prompt_hash(component_text)
+                if (
+                    field not in used_fields
+                    or not component_id
+                    or component_hash in counted
+                ):
+                    continue
+                counted.add(component_hash)
+                seen_at_queue = (
+                    resolved_text is not None
+                    and generate_prompt_hash(resolved_text) == component_hash
                )
-            except Exception as error:
-                self.logger.warning(f"Could not save or track paired prompt: {error}")
-                if is_positive:
-                    self._mark_untracked(prompt, unique_id)
+                runs = positive_pending.consume(component_hash) + int(not seen_at_queue)
+                if runs:
+                    self.db.record_prompt_use(component_id, times=runs)
+            if pair_used:
+                runs = pair_pending.consume(pair_run_key(text, negative_text)) + int(
+                    not pair_seen
+                )
+                if runs:
+                    self.db.record_prompt_pair_use(pair_id, times=runs)
+            if is_positive:
+                self.prompt_tracker.set_current_prompt(
+                    prompt_text=positive,
+                    additional_data={
+                        "prompt_id": prompt_id,
+                        "pair_id": pair_id if pair_used else None,
+                        "positive_text": positive,
+                        "negative_text": negative_text,
+                        "positive_storage_text": text.strip(),
+                        "negative_storage_text": negative_text.strip(),
+                        "prepend_text": prepend_text.strip(),
+                        "append_text": append_text.strip(),
+                        "final_text": positive,
+                        "category": category.strip() or None,
+                        "tags": self._parse_tags(tags) or [],
+                    },
+                    push_to_queue=not positive_seen or (pair_used and not pair_seen),
+                )
+        except Exception as error:
+            self.logger.warning(f"Could not save or track paired prompt: {error}")
        try:
            self.comfyui_integration.register_prompt(
                f"promptmanager_pair_{time.time_ns()}",
@@ -186,6 +209,7 @@ class PromptManagerPair(PromptManagerFocused):
            )
        except Exception as error:
            self.logger.warning(f"Could not register paired metadata: {error}")
+        result = positive_conditioning, negative_conditioning, positive, negative_text
        record_runtime_context(
            type(self).__name__,
            text,
@@ -197,115 +221,8 @@ class PromptManagerPair(PromptManagerFocused):
        record_runtime_context(
            type(self).__name__, negative_text, "", "", negative_text, role="negative"
        )
-        self._record_cached_item(
-            unique_id,
-            (positive, negative_text),
-            text,
-            negative_text,
-            fields=((text, prepend_text, append_text), (negative_text, "", "")),
-        )
        return result

-    def _save_and_track_pair(
-        self,
-        text: str,
-        negative_text: str,
-        positive: str,
-        *,
-        category: str,
-        tags: str,
-        prepend_text: str,
-        append_text: str,
-        prompt: Optional[Dict[str, Any]],
-        unique_id: Optional[str],
-        used_fields: set,
-        is_positive: bool,
-        pair_used: bool,
-    ) -> Tuple[Optional[int], Optional[int]]:
-        """Save the recipe, count its runs and register the positive for linking."""
-        known = isinstance(prompt, dict) and unique_id is not None
-        node_id = str(unique_id)
-        pair_id = self.db.save_prompt_pair(
-            text,
-            negative_text,
-            category=category.strip() or None,
-            tags=self._parse_tags(tags),
-            # The Library shows the prompt's own category and tags, not the pair's.
-            fill_new_positive=True,
-        )
-        pair = self.db.get_prompt_pair(pair_id)
-        prompt_id = pair["positive_prompt_id"]
-        resolved_positive = (
-            resolve_text_input(prompt, node_id, "text") if known else None
-        )
-        resolved_negative = (
-            resolve_text_input(prompt, node_id, "negative_text") if known else None
-        )
-        if known and save_setting(prompt, node_id) is not True:
-            # The hook skips a switch it cannot read (#90): the node counts
-            resolved_positive = resolved_negative = None
-        positive_seen = resolved_positive is not None and generate_prompt_hash(
-            resolved_positive
-        ) == generate_prompt_hash(text)
-        pair_seen = (
-            positive_seen
-            and resolved_negative is not None
-            and generate_prompt_hash(resolved_negative)
-            == generate_prompt_hash(negative_text)
-        )
-        negative_seen = resolved_negative is not None and generate_prompt_hash(
-            resolved_negative
-        ) == generate_prompt_hash(negative_text)
-        positive_pending = getattr(self, "pending_first_use", PENDING_FIRST_USE)
-        pair_pending = getattr(self, "pending_pair_first_use", PENDING_PAIR_FIRST_USE)
-        facts = stored_facts(text, negative_text)
-        role = Role(frozenset(used_fields), pair_used)
-        # Own counts are skipped when this job already counted the node from
-        # ComfyUI's cache (#347); the pending first-use catch-up never is.
-        counts = (
-            []
-            if self._replayed(unique_id)
-            else own_counts(
-                PAIR, facts, role, Seen(positive_seen, negative_seen, pair_seen)
-            )
-        )
-        component_ids = {"text": prompt_id, "negative_text": pair["negative_prompt_id"]}
-        for field, component_hash in pair_components(facts, role):
-            component_id = component_ids[field]
-            if not component_id:
-                continue
-            runs = positive_pending.consume(component_hash) + int(
-                ("prompt", component_hash) in counts
-            )
-            if runs:
-                self.db.record_prompt_use(component_id, times=runs)
-        if pair_used:
-            runs = pair_pending.consume(pair_run_key(text, negative_text)) + int(
-                ("pair", facts.positive_hash, facts.negative_hash) in counts
-            )
-            if runs:
-                self.db.record_prompt_pair_use(pair_id, times=runs)
-        if is_positive:
-            self.prompt_tracker.set_current_prompt(
-                prompt_text=positive,
-                additional_data={
-                    "prompt_id": prompt_id,
-                    "pair_id": pair_id if pair_used else None,
-                    "positive_text": positive,
-                    "negative_text": negative_text,
-                    "positive_storage_text": text.strip(),
-                    "negative_storage_text": negative_text.strip(),
-                    "prepend_text": prepend_text.strip(),
-                    "append_text": append_text.strip(),
-                    "final_text": positive,
-                    "category": category.strip() or None,
-                    "tags": self._parse_tags(tags) or [],
-                },
-                push_to_queue=not positive_seen or (pair_used and not pair_seen),
-                **self._run_identity(prompt, unique_id),
-            )
-        return pair_id, prompt_id
-
    @classmethod
    def IS_CHANGED(
        cls,
@@ -26,13 +26,13 @@ except ImportError:
    InputTypeDict = dict

 try:
-    from .prompt_manager_base import SAVE_TO_LIBRARY_INPUT, PromptManagerBase
+    from .prompt_manager_base import PromptManagerBase
 except ImportError:
    import os
    import sys

    sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
-    from prompt_manager_base import SAVE_TO_LIBRARY_INPUT, PromptManagerBase
+    from prompt_manager_base import PromptManagerBase


 class PromptManagerText(PromptManagerBase, ComfyNodeABC):
@@ -115,7 +115,6 @@ class PromptManagerText(PromptManagerBase, ComfyNodeABC):
                        ),
                    },
                ),
-                "save_to_library": SAVE_TO_LIBRARY_INPUT,
            },
            "hidden": {
                # The queued graph and this node's id: used to tell the positive
@@ -150,7 +149,6 @@ class PromptManagerText(PromptManagerBase, ComfyNodeABC):
        append_text: str = "",
        prompt: Optional[Dict[str, Any]] = None,
        unique_id: Optional[str] = None,
-        save_to_library: bool = True,
    ) -> Tuple[str]:
        """
        Process the text prompt and save it to the database.
@@ -162,7 +160,6 @@ class PromptManagerText(PromptManagerBase, ComfyNodeABC):
            search_text: Text to search for in past prompts
            prepend_text: Text to prepend to the main prompt
            append_text: Text to append to the main prompt
-            save_to_library: Off: nothing is saved, counted or tracked (#90)

        Returns:
            Tuple containing the final processed text string
@@ -187,9 +184,7 @@ class PromptManagerText(PromptManagerBase, ComfyNodeABC):
        # Save prompt to database and set execution context for gallery tracking
        prompt_id = None
        extended_tags = []
-        if not save_to_library:
-            self._skip_not_saved(prompt, unique_id)
-        elif storage_text and storage_text.strip():
+        if storage_text and storage_text.strip():
            self.logger.debug(f"Processing prompt text: {storage_text[:100]}...")

            # Add prepend/append info to tags if they exist
@@ -221,14 +216,6 @@ class PromptManagerText(PromptManagerBase, ComfyNodeABC):
            except Exception as e:
                # Log error but don't fail the processing
                self.logger.warning(f"Failed to save prompt to database: {e}")
-                self._mark_untracked(prompt, unique_id)
-        else:
-            self._skip_empty_prompt(prompt, unique_id)
-
-        self.logger.debug(f"Text processing completed: {final_text[:100]}...")
-        result = (final_text,)
-        if not save_to_library:
-            return result  # #90: no metadata registration, no history text

        # Register with ComfyUI integration for standard metadata compatibility
        node_id = f"promptmanagertext_{int(time.time() * 1000)}"
@@ -243,15 +230,12 @@ class PromptManagerText(PromptManagerBase, ComfyNodeABC):
                "append_text": append_text.strip() if append_text else None,
            },
        )
+
+        self.logger.debug(f"Text processing completed: {final_text[:100]}...")
+        result = (final_text,)
        record_runtime_context(
            type(self).__name__, text, prepend_text, append_text, final_text
        )
-        self._record_cached_item(
-            unique_id,
-            (final_text,),
-            storage_text,
-            fields=((text, prepend_text, append_text),),
-        )
        return result

    @classmethod
@@ -5,25 +5,7 @@ Split into domain-specific mixins for maintainability:
 - ImageRoutesMixin: gallery, thumbnails, image serving and linking
 - AdminRoutesMixin: duplicates, stats, settings, diagnostics, maintenance, backup, scan
 - LoggingRoutesMixin: log management endpoints
- LogCleanupMixin: the reviewed rotated-log cleanup (a maintenance plan)
- DiagnosticsReportMixin: the shareable diagnostic report, without secrets or paths
 - AutotagRoutesMixin: auto-tagging model management and tagging
- JobRoutesMixin: the session job registry behind Activity (py/api/jobs.py)
- ImageTagJobsMixin: bulk Add tags / Auto-tag as image-tags jobs
- ThumbnailJobsMixin: thumbnail plan, thumbnail job and the gallery stream on it
- ThumbnailLocationMixin: the thumbnail location check and payloads (#320)
- ThumbnailConvertMixin: Convert outdated thumbnails (#317), a thumbnail job mode
- AutoThumbnailMixin: previews made on first view, on capture and after a scan
- ReviewRoutesMixin: the Needs review queue, item detail and decisions
- ReviewRecordingMixin: Needs review recording for the scan and the monitor
- ReviewEventsMixin: the Needs review change stream an open page re-reads on
- SystemRoutesMixin: System health check, Overview and usage statistics
- LibraryLocationRoutesMixin: where the library lives, Move library, Keep it here
- MaintenanceRoutesMixin: reviewed maintenance plans (preview, apply)
- LibraryDeleteRoutesMixin: the Library's Delete… (archive paired) and Restore
- WorkflowStorageRoutesMixin: store each workflow once, then Reclaim space
- DuplicateFilesMixin: duplicate image files as find and removal jobs
- LoraImportRoutesMixin: the reviewed, staged LoRA reference import job
 """

 import asyncio
@@ -31,68 +13,28 @@ import datetime
 import functools
 import gzip as gzip_module
 import json
-import math
 import ntpath
 import os
 import re
-import threading
 from pathlib import Path

 from aiohttp import web
 from PIL import Image

 from .prompts import PromptRoutesMixin
-from .revalidation import revalidated_response
 from .pairs import PairRoutesMixin
 from .library import LibraryRoutesMixin
-from .library_delete import LibraryDeleteRoutesMixin
 from .vocabulary import VocabularyRoutesMixin
-from .annotations import AnnotationRoutesMixin
-from .review import ReviewRoutesMixin
-from .review_recording import ReviewRecordingMixin
-from .review_events import ReviewEventsMixin
-from .saved_views import SavedViewRoutesMixin
-from .collections import CollectionRoutesMixin
 from .history import HistoryRoutesMixin
 from .images import ImageRoutesMixin
-from .gallery_listing import WALK_STOPPED, RootListing, WalkOutcome
 from .admin import AdminRoutesMixin
-from .settings_routes import SettingsRoutesMixin
-from .job_routes import JobRoutesMixin
-from .image_tag_jobs import ImageTagJobsMixin
-from .thumbnail_jobs import ThumbnailJobsMixin
-from .thumbnail_location import ThumbnailLocationMixin
-from .thumbnail_move import ThumbnailMoveMixin
-from .thumbnail_move_plan import ThumbnailMovePlanMixin
-from .thumbnail_move_recovery import ThumbnailMoveRecoveryMixin
-from .thumbnail_prune import ThumbnailPruneMixin
-from .thumbnail_convert import ThumbnailConvertMixin
-from .thumbnail_auto import AutoThumbnailMixin
-from .system import SystemRoutesMixin
-from .library_location import LibraryLocationRoutesMixin
-from .maintenance import MaintenanceRoutesMixin
-from .backup_restore import BackupRestoreRoutesMixin
-from .workflow_storage import WorkflowStorageRoutesMixin
-from .duplicate_files import DuplicateFilesMixin
-from .maintenance_plans import PlanStore
-from .jobs import JobRegistry
 from .logging_routes import LoggingRoutesMixin
-from .log_cleanup import LogCleanupMixin
-from .diagnostics_report import DiagnosticsReportMixin
 from .autotag_routes import AutotagRoutesMixin
 from .lora_integration import LoraIntegrationMixin
-from .lora_import_routes import LoraImportRoutesMixin
-from .image_categories import ImageCategoryRoutesMixin
-from .image_delete import ImageDeleteMixin
-from .image_return import ImageReturnMixin
-from .source_rescope import SourceRescopeMixin

 try:
    from ...database.operations import PromptDatabase
-    from ...utils.file_prompt import parse_comfyui_prompt
    from ...utils.logging_config import get_logger
-    from ...utils.native_memory import release_free_memory
-    from ...utils.png_text import png_text
    from ...utils.video_metadata import is_video_path, read_video_metadata
 except ImportError:
    import sys
@@ -101,10 +43,7 @@ except ImportError:
        0, os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
    )
    from database.operations import PromptDatabase
-    from utils.file_prompt import parse_comfyui_prompt
    from utils.logging_config import get_logger
-    from utils.native_memory import release_free_memory
-    from utils.png_text import png_text
    from utils.video_metadata import is_video_path, read_video_metadata


@@ -113,18 +52,6 @@ def _get_project_root():
    return os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__))))


-# How long an executor thread waits for the loop to drop the listings.
-_OFF_LOOP_DROP_WAIT = 30
-
-
-def _running_loop():
-    """The event loop running in this thread, or None."""
-    try:
-        return asyncio.get_running_loop()
-    except RuntimeError:
-        return None
-
-
 def _public_path(path) -> str:
    """Render a server path for an API response without revealing the layout.

@@ -173,20 +100,16 @@ STATIC_MIME_TYPES = {
    ".html": "text/html",
 }
 _STATIC_SEPARATORS = re.compile(r"[\\/]+")
-# Served by exact request path beside the extension allow-list: the browser's
-# copy of the inspection node table (local Inspect resolves with it, #249).
-STATIC_EXACT_FILES = {("js", "inspection-semantics.json"): "application/json"}


-def _resolve_static_file(root, filepath, allowed=STATIC_MIME_TYPES):
+def _resolve_static_file(root, filepath):
    """Real path of ``filepath`` under ``root``, or None when it must not be served.

    The request path is untrusted. It is rejected when it is empty, carries a
    ``..`` segment, is absolute on any platform (a leading slash or backslash,
    a drive letter such as ``C:`` or a UNC ``\\\\server\\share`` prefix all
    re-anchor ``os.path.join`` on Windows), has an extension outside
-    ``allowed`` (STATIC_MIME_TYPES), or resolves (symlinks included) outside
-    ``root``.
+    STATIC_MIME_TYPES, or resolves (symlinks included) outside ``root``.
    """
    if not isinstance(filepath, str) or not filepath:
        return None
@@ -199,7 +122,7 @@ def _resolve_static_file(root, filepath, allowed=STATIC_MIME_TYPES):
    segments = _STATIC_SEPARATORS.split(filepath)
    if any(segment in ("", ".", "..") for segment in segments):
        return None
-    if os.path.splitext(filepath)[1].lower() not in allowed:
+    if os.path.splitext(filepath)[1].lower() not in STATIC_MIME_TYPES:
        return None
    try:
        root_real = Path(os.path.normcase(os.path.realpath(root)))
@@ -315,10 +238,6 @@ async def _gzip_middleware(request, handler):
    if len(compressed) >= len(body):
        return response

-    # A length the handler declared is the uncompressed one: drop it so the
-    # compressed body's own length is sent (#329: a stale length made the
-    # browser wait for bytes that never came).
-    response.headers.pop("Content-Length", None)
    response.body = compressed
    response.headers["Content-Encoding"] = "gzip"
    response.headers["Vary"] = "Accept-Encoding"
@@ -328,45 +247,14 @@ async def _gzip_middleware(request, handler):
 class PromptManagerAPI(
    PairRoutesMixin,
    LibraryRoutesMixin,
-    LibraryDeleteRoutesMixin,
    VocabularyRoutesMixin,
-    AnnotationRoutesMixin,
-    ReviewRoutesMixin,
-    ReviewRecordingMixin,
-    ReviewEventsMixin,
-    SavedViewRoutesMixin,
-    CollectionRoutesMixin,
    HistoryRoutesMixin,
    PromptRoutesMixin,
    ImageRoutesMixin,
    AdminRoutesMixin,
-    SettingsRoutesMixin,
-    JobRoutesMixin,
-    ImageTagJobsMixin,
-    ThumbnailJobsMixin,
-    ThumbnailLocationMixin,
-    ThumbnailMovePlanMixin,
-    ThumbnailMoveMixin,
-    ThumbnailMoveRecoveryMixin,
-    ThumbnailPruneMixin,
-    ThumbnailConvertMixin,
-    AutoThumbnailMixin,
-    SystemRoutesMixin,
-    LibraryLocationRoutesMixin,
-    MaintenanceRoutesMixin,
-    BackupRestoreRoutesMixin,
-    WorkflowStorageRoutesMixin,
-    DuplicateFilesMixin,
    LoggingRoutesMixin,
-    LogCleanupMixin,
-    DiagnosticsReportMixin,
    AutotagRoutesMixin,
    LoraIntegrationMixin,
-    LoraImportRoutesMixin,
-    ImageCategoryRoutesMixin,
-    ImageDeleteMixin,
-    ImageReturnMixin,
-    SourceRescopeMixin,
 ):
    """REST API handler for PromptManager operations and web interface.

@@ -391,84 +279,18 @@ class PromptManagerAPI(
        self.db = db if db is not None else PromptDatabase()
        self._history_read_fence = None
        self._history_reads_closed = False
-        # Private media captures of the annotation routes (py/api/annotations.py),
-        # created on first use with their restore subscription.
-        self._captures = None
-        # Capture tokens Generate suggestions ran on: a save of one marks the
-        # image auto-tagged (#379).
-        self._suggested_tokens = set()
-        self._captures_unsubscribe = None
-        # Set by close_annotation_captures (shutdown): no store is recreated.
-        self._captures_closed = False
        self._cached_output_dir = None  # Lazy-cached by _find_comfyui_output_dir()
        self._html_cache = {}  # Cached HTML file contents keyed by path
-        # One shared listing per output root, keyed by str(root), and the
-        # background walks refreshing them (py/api/gallery_listing.py, #348).
-        self._root_listings: dict[str, RootListing] = {}
-        self._listing_tasks: set = set()
-        # The loop the walks run on, set by the startup warm-up or the first
-        # walk; the monitor's thread hops onto it (notify_output_settled).
-        self._listing_loop = None
-        # Set by cleanup_gallery_listings: no background walk starts after it.
-        self._listings_closed = False
-        # The workspace caches rebuilt behind a stored walk that changed the
-        # listing, once the host's startup warm-up has run (#348).
-        self._workspace_warm_enabled = False
-        self._workspace_warm_task = None
-        self._workspace_warm_again = False
-        # Workspace listing values and sort orders derived from a cached scan
-        # (py/api/images.py _workspace_listed/_workspace_orders).
-        self._workspace_listed_cache = {}
-        self._workspace_order_cache = {}
-        # Card facts (dimensions, seed, positive title) per root and
-        # (path, mtime), kept and pruned with the per-file values
-        # (py/api/images.py _card_facts).
-        self._workspace_card_cache = {}
-        # Favorite keys of each root's cached scan (images._favorite_listing).
-        self._favorite_listing_cache = {}
+        self._gallery_cache = {}  # dict: path_str -> (files, timestamp)
+        self._gallery_cache_ttl = 30  # Cache TTL in seconds
        # Single-flight locks for long jobs, keyed by job family; see
        # _acquire_long_job(). Created lazily so no lock binds to an event
        # loop before the server's loop exists.
        self._long_jobs: dict = {}
-        # This session's jobs (py/api/jobs.py): the metadata scan, and later
-        # every other long operation the Activity page tracks.
-        self._jobs = JobRegistry(self.logger)
-        # The latest metadata scan job (also in self._jobs), if one was started.
+        # The current output scan (py/api/scan_job.ScanJob), if one was started.
        self._scan_job = None
-        # Duplicate-file finds by job id, with the groups each one holds for
-        # review (py/api/duplicate_files.py); the last few only.
-        self._duplicate_finds = {}
-        # The last System health report this session and the database
-        # generation it describes, bumped when a restore replaces self.db
-        # (py/api/system.py).
-        self._health_report = None
-        self._db_generation = 0
-        # Reviewed maintenance plans under single-use tokens; a restart
-        # forgets them (py/api/maintenance.py).
-        self._maintenance_plans = PlanStore()
-        # #480: the removal marks the workspace listing hides, read once now so
-        # a listing page reads no table until a mark or the database changes.
-        try:
-            self._removal_marks()
-        except Exception:
-            self.logger.warning("Removal marks could not be read", exc_info=True)
-
-        # A safety backup interrupted by a crash leaves its temp copy behind.
-        try:
-            from .maintenance import sweep_safety_temps
-
-            from .backup_restore import restore_stage
-
-            swept = sweep_safety_temps(self.db.model.db_path)
-            swept += restore_stage.sweep_restore_temps(self.db.model.db_path)
-            if swept:
-                self.logger.info(f"Removed {len(swept)} interrupted backup copies")
-        except Exception as e:
-            self.logger.warning(f"Could not sweep interrupted backup copies: {e}")
-
-        # A crash between Move library's switch and its rename left the old
-        # node-folder files under their own names (#249 S6b): rename them now.
-        self.finish_interrupted_library_move()
+        # The current duplicate scan (also a ScanJob), if one was started.
+        self._duplicate_job = None

        # Run cleanup on initialization to remove any existing duplicates
        try:
@@ -511,24 +333,6 @@ class PromptManagerAPI(
        """409 envelope for a long job that is already running."""
        return _json_error(f"{label} already running", 409)

-    async def _run_held(self, kind, title, admission, operation):
-        """Run a legacy-page operation under a registry hold (D80).
-
-        While ``operation()`` runs, the registry lists it as a running,
-        non-cancellable job, so workspace jobs its admission class conflicts
-        with are refused, naming it. When the registry refuses the hold, the
-        legacy 409 envelope names the running job and nothing is done. A
-        response of 400 or above ends the hold ``failed``.
-        """
-        busy = self._jobs.blocker(kind, admission=admission)
-        if busy is not None:
-            return self._long_job_busy_response(busy.title)
-        async with self._jobs.hold(kind, title, admission=admission) as job:
-            response = await operation()
-            if getattr(response, "status", 200) >= 400:
-                job.finish("failed")
-            return response
-
    async def _run_in_executor(self, func, *args, **kwargs):
        """Run a blocking function in the default thread pool executor.

@@ -541,132 +345,12 @@ class PromptManagerAPI(
            return await loop.run_in_executor(None, call)
        return await loop.run_in_executor(None, func, *args)

-    async def _release_job_memory(self):
-        """After a scan or thumbnail job: glibc's free heap pages go back to
-        the OS once (``malloc_trim(0)``; nothing elsewhere, #523)."""
-        try:
-            await self._run_in_executor(release_free_memory)
-        except Exception:  # best effort: the job's result already stands
-            self.logger.debug("Releasing free memory failed", exc_info=True)
+    def invalidate_gallery_cache(self):
+        """Invalidate the cached gallery file listing.

-    def _root_listing(self, root) -> RootListing:
-        """The shared listing record of one output root (created empty)."""
-        return self._root_listings.setdefault(str(root), RootListing())
-
-    def invalidate_gallery_cache(self, retire=False):
-        """Drop every root's listing, so the next read waits for a new walk.
-
-        Called after files are deleted through the app (duplicate cleanup and
-        the legacy duplicate delete), never for thumbnail writes. A walk
-        running now is not stored (its generation moved on). The workspace
-        keeps its per-file values and card facts, so the next request
-        rebuilds only new or changed files (see ImageRoutesMixin.
-        _workspace_listed and _card_facts); its sort orders are dropped, as
-        the walk replaces them anyway, and so is the favorites lookup, which
-        holds the old list.
-
-        ``retire`` (the roots changed): no background walk of a root starts
-        again until a reader or the warm-up asks for it.
+        Called by the image monitor when new files are detected.
        """
-        loop = self._listing_loop
-        if loop is not None and loop.is_running() and _running_loop() is not loop:
-            # Called from an executor thread (a settings save, a test seed):
-            # listing records are touched only on the loop, and the caller
-            # expects the drop done when this returns.
-            dropped = threading.Event()
-
-            def drop():
-                try:
-                    self._drop_listings(retire)
-                finally:
-                    dropped.set()
-
-            loop.call_soon_threadsafe(drop)
-            if not dropped.wait(_OFF_LOOP_DROP_WAIT):
-                self.logger.warning("The Images listing drop is still queued")
-            return
-        self._drop_listings(retire)
-
-    def _drop_listings(self, retire=False):
-        for record in list(self._root_listings.values()):
-            record.drop()
-            if retire:
-                # The roots changed: a removed root must not come back through
-                # a pending timer, a trailing walk or a monitor mark.
-                record.retired = True
-                record.dirty = False
-                handle, record.rewalk_handle = record.rewalk_handle, None
-                if handle is not None:
-                    handle.cancel()
-        self._workspace_order_cache = {}
-        self._favorite_listing_cache = {}
-
-    async def warm_gallery_listings(self, app=None):
-        """Start one background walk per output root (aiohttp on_startup).
-
-        Registered by the root ``__init__.py``, so the first Images open after
-        ComfyUI starts finds the listing built. It never fails startup: a
-        root that cannot be walked is retried by the first read.
-        """
-        # Each stored walk that changes a listing then rebuilds the workspace's
-        # per-file values, orders and favorites behind it (_warm_workspace).
-        self._workspace_warm_enabled = True
-        self._listing_loop = asyncio.get_running_loop()
-        self._listings_closed = False
-        try:
-            for root in self._get_all_output_dirs():
-                self._root_listing(root).retired = False
-                self._schedule_walk(root)
-        except Exception as e:
-            self.logger.warning(f"Could not warm the Images listing: {e}")
-
-    def notify_output_settled(self, path):
-        """The image monitor settled an output at *path* (any thread).
-
-        Called on the monitor's worker thread with the resolved path. It only
-        hands the path to the event loop (``output_settled``) and never
-        touches a listing from this thread; before the loop is known, or once
-        the listings are cleaned up, it does nothing.
-        """
-        loop = self._listing_loop
-        if loop is None or self._listings_closed or not loop.is_running():
-            return
-        try:
-            loop.call_soon_threadsafe(self.output_settled, path)
-        except RuntimeError:
-            pass  # the loop closed meanwhile (shutdown)
-
-    async def cleanup_gallery_listings(self, app=None):
-        """Stop the background listing walks (aiohttp on_cleanup)."""
-        self._workspace_warm_enabled = False
-        # No mark, deferred walk or trailing walk starts a walk from now on.
-        self._listings_closed = True
-        # Before any await, so no delayed refresh can start a walk meanwhile.
-        for record in self._root_listings.values():
-            handle, record.rewalk_handle = record.rewalk_handle, None
-            if handle is not None:
-                handle.cancel()
-        warm, self._workspace_warm_task = self._workspace_warm_task, None
-        if warm is not None:
-            warm.cancel()
-            await asyncio.gather(warm, return_exceptions=True)
-        tasks = list(self._listing_tasks)
-        for task in tasks:
-            task.cancel()
-        if tasks:
-            await asyncio.gather(*tasks, return_exceptions=True)
-        self._listing_tasks.clear()
-        # A walk cancelled before its first step never ran its own cleanup.
-        for record in self._root_listings.values():
-            flight, record.flight = record.flight, None
-            if flight is not None and not flight.done():
-                flight.set_result(WalkOutcome.failed(RuntimeError(WALK_STOPPED)))
-
-    def reset_gallery_roots_cache(self):
-        """Drop every cached listing and derived workspace value (roots changed)."""
-        self.invalidate_gallery_cache(retire=True)
-        self._workspace_listed_cache = {}
-        self._workspace_card_cache = {}
+        self._gallery_cache = {}

    def add_routes(self, routes):
        """Register all API routes with the ComfyUI server.
@@ -690,72 +374,48 @@ class PromptManagerAPI(

        @routes.get("/prompt_manager/workspace")
        async def serve_workspace_ui(request: web.Request) -> web.Response:
-            return self._serve_html_page(request, "workspace.html", "Workspace")
+            return self._serve_html_page("workspace.html", "Workspace")

        @routes.get("/prompt_manager/web")
        async def serve_web_ui(request):
-            return self._serve_html_page(request, "index.html", "Web UI", cache=False)
+            return self._serve_html_page("index.html", "Web UI", cache=False)

        @routes.get("/prompt_manager/gallery.html")
        async def serve_gallery_ui(request):
-            return self._serve_html_page(request, "metadata.html", "Gallery")
+            return self._serve_html_page("metadata.html", "Gallery")

        @routes.get("/prompt_manager/admin")
        async def serve_admin_ui(request):
-            return self._serve_html_page(request, "admin.html", "Admin UI")
+            return self._serve_html_page("admin.html", "Admin UI")

        @routes.get("/prompt_manager/gallery")
        async def serve_gallery_admin_ui(request):
-            return self._serve_html_page(request, "gallery.html", "Gallery")
+            return self._serve_html_page("gallery.html", "Gallery")

        # ── Static file serving ───────────────────────────────────────

        @routes.get("/prompt_manager/lib/{filepath:.*}")
        async def serve_lib_static(request):
            """Serve static library files (JS, CSS) from web/lib directory."""
-            return self._serve_static_file(
-                request, "lib", request.match_info.get("filepath")
-            )
+            return self._serve_static_file("lib", request.match_info.get("filepath"))

        @routes.get("/prompt_manager/js/{filepath:.*}")
        async def serve_js_static(request):
            """Serve static JavaScript files from web/js directory."""
-            return self._serve_static_file(
-                request, "js", request.match_info.get("filepath")
-            )
+            return self._serve_static_file("js", request.match_info.get("filepath"))

        # ── Register domain-specific routes from mixins ───────────────

        self._register_pair_routes(routes)
-        self._register_thumbnail_move_routes(routes)
        self._register_library_routes(routes)
-        self._register_library_delete_routes(routes)
        self._register_vocabulary_routes(routes)
-        self._register_annotation_routes(routes)
-        self._register_review_routes(routes)
-        self._register_review_event_routes(routes)
-        self._register_saved_view_routes(routes)
-        self._register_collection_routes(routes)
        self._register_history_routes(routes)
        self._register_prompt_routes(routes)
        self._register_image_routes(routes)
        self._register_admin_routes(routes)
-        self._register_settings_routes(routes)
-        self._register_job_routes(routes)
-        self._register_system_routes(routes)
-        self._register_diagnostics_report_routes(routes)
-        self._register_library_location_routes(routes)
-        self._register_maintenance_routes(routes)
-        self._register_backup_restore_routes(routes)
-        self._register_duplicate_routes(routes)
        self._register_logging_routes(routes)
        self._register_autotag_routes(routes)
        self._register_lora_routes(routes)
-        self._register_lora_import_routes(routes)
-        self._register_image_category_routes(routes)
-        self._register_image_delete_routes(routes)
-        self._register_image_return_routes(routes)
-        self._register_rescope_routes(routes)

        # Register gzip compression middleware (once)
        global _gzip_registered
@@ -771,32 +431,21 @@ class PromptManagerAPI(

        self.logger.info("All routes registered with decorator pattern")

-    def _serve_static_file(self, request, subdir, filepath):
-        """Serve ``web/<subdir>/<filepath>``; 403 outside it, 404 when missing.
-
-        A served file is revalidated on every reuse (#478, ``revalidation``).
-        """
+    def _serve_static_file(self, subdir, filepath):
+        """Serve ``web/<subdir>/<filepath>``; 403 outside it, 404 when missing."""
        root = os.path.join(_get_project_root(), "web", subdir)
-        exact = STATIC_EXACT_FILES.get((subdir, filepath))
-        # An exact file passes the same containment check, its extension only.
-        allowed = STATIC_MIME_TYPES if exact is None else {".json"}
-        file_path = _resolve_static_file(root, filepath, allowed)
+        file_path = _resolve_static_file(root, filepath)
        if file_path is None:
            return web.Response(text="Forbidden", status=403)
-        content_type = (
-            exact or STATIC_MIME_TYPES[os.path.splitext(file_path)[1].lower()]
-        )
        if not os.path.isfile(file_path):
            return web.Response(text="Not Found", status=404)
+        ext = os.path.splitext(file_path)[1].lower()
        with open(file_path, "rb") as f:
            content = f.read()
-        return revalidated_response(request, content, content_type)
+        return web.Response(body=content, content_type=STATIC_MIME_TYPES[ext])

-    def _serve_html_page(self, request, filename, title, cache=True):
-        """Serve ``web/<filename>``; 404 when missing, 500 when unreadable.
-
-        A served page is revalidated on every reuse (#478, ``revalidation``).
-        """
+    def _serve_html_page(self, filename, title, cache=True):
+        """Serve ``web/<filename>``; 404 when missing, 500 when unreadable."""
        html_path = os.path.join(_get_project_root(), "web", filename)
        try:
            if cache and html_path in self._html_cache:
@@ -813,9 +462,7 @@ class PromptManagerAPI(
                    content_type="text/html",
                    status=404,
                )
-            return revalidated_response(
-                request, content.encode("utf-8"), "text/html", charset="utf-8"
-            )
+            return web.Response(text=content, content_type="text/html", charset="utf-8")
        except Exception:
            self.logger.exception(f"Failed to load {title}")
            return web.Response(
@@ -828,12 +475,7 @@ class PromptManagerAPI(
    # ── Shared utilities used by multiple mixins ──────────────────────

    def _enrich_images(self, images):
-        """Add url and thumbnail_url to a flat list of image dicts.
-
-        Each dict without ``is_video`` also gets ``is_video`` and
-        ``media_type`` from its extension (#355: a linked LoraManager video
-        outside the output folders is shown as a video, not a picture).
-        """
+        """Add url and thumbnail_url to a flat list of image dicts."""
        from urllib.parse import quote as url_quote

        output_dirs = self._get_all_output_dirs()
@@ -843,11 +485,6 @@ class PromptManagerAPI(
            if not image_path_str:
                continue

-            if "is_video" not in image:
-                video = is_video_path(image_path_str)
-                image["is_video"] = video
-                image["media_type"] = "video" if video else "image"
-
            img_path = Path(image_path_str)

            # Set fallback url via image ID
@@ -864,11 +501,16 @@ class PromptManagerAPI(
                        f"{url_quote(rel_path.as_posix(), safe='/')}"
                    )

-                    # Any preview the file owns, the current format first
-                    # (#317); no store I/O here in folder mode (#320).
-                    from .images import listing_thumbnail_url
+                    # Check for thumbnail
+                    rel_no_ext = rel_path.with_suffix("")
+                    thumb_rel = (
+                        f"thumbnails/{rel_no_ext.as_posix()}_thumb{rel_path.suffix}"
+                    )
+                    from .prompts import thumbnail_url_for

-                    thumbnail_url = listing_thumbnail_url(output_path, rel_path)
+                    thumbnail_url = thumbnail_url_for(
+                        thumb_rel, output_path / thumb_rel
+                    )
                    if thumbnail_url:
                        image["thumbnail_url"] = thumbnail_url
                    break  # Found matching root, stop searching
@@ -884,12 +526,12 @@ class PromptManagerAPI(
        return prompts

    def _clean_nan_recursive(self, obj):
-        """Recursively replace NaN and Infinity in nested data with None."""
+        """Recursively clean NaN values from nested data structures."""
        if isinstance(obj, dict):
            return {key: self._clean_nan_recursive(value) for key, value in obj.items()}
        elif isinstance(obj, list):
            return [self._clean_nan_recursive(item) for item in obj]
-        elif isinstance(obj, float) and not math.isfinite(obj):
+        elif isinstance(obj, float) and str(obj) == "nan":
            return None
        else:
            return obj
@@ -1012,13 +654,6 @@ class PromptManagerAPI(
        Returns:
            List[Path]: Validated directory paths, possibly empty.
        """
-        return self._output_dirs_with_origin()[0]
-
-    def _output_dirs_with_origin(self):
-        """``(dirs, auto_detected)``: the ``_get_all_output_dirs`` list, and
-        whether it comes from detection or ComfyUI's output rather than from
-        a valid configured root (False when there is no directory at all).
-        """
        from ..config import GalleryConfig

        configured = list(GalleryConfig.MONITORING_DIRECTORIES)
@@ -1037,16 +672,15 @@ class PromptManagerAPI(
            output_dirs.append(Path(real))

        if output_dirs:
-            return output_dirs, False
+            return output_dirs

        if configured:
            # Every configured root was rejected: never let auto-detection
            # resurrect it, serve ComfyUI's own output directory instead.
-            fallback_dirs = self._comfyui_output_dir_list()
-        else:
-            fallback = self._find_comfyui_output_dir()
-            fallback_dirs = [Path(fallback)] if fallback else []
-        return fallback_dirs, bool(fallback_dirs)
+            return self._comfyui_output_dir_list()
+
+        fallback = self._find_comfyui_output_dir()
+        return [Path(fallback)] if fallback else []

    def _comfyui_output_dir_list(self):
        """ComfyUI's output directory as a one-element list, or [] if unknown."""
@@ -1063,8 +697,6 @@ class PromptManagerAPI(
    def _extract_comfyui_metadata(self, image_path):
        """Embedded ComfyUI metadata of an image (PNG text chunks) or a video.

-        PNG text is read without decoding the pixels (``utils.png_text``, #523).
-
        Videos go through ffprobe (see utils/video_metadata). Unreadable files
        are a warning, not an error: a scan over a large output tree meets
        truncated and foreign files, and it carries on past them.
@@ -1073,7 +705,7 @@ class PromptManagerAPI(
            return read_video_metadata(image_path)
        try:
            with Image.open(image_path) as img:
-                return png_text(img)
+                return dict(getattr(img, "text", None) or {})
        except Exception as e:
            self.logger.warning(
                f"Unreadable image {os.path.basename(str(image_path))}: {e}"
@@ -1082,4 +714,278 @@ class PromptManagerAPI(

    def _parse_comfyui_prompt(self, metadata):
        """Parse ComfyUI and A1111 prompt data from metadata."""
-        return parse_comfyui_prompt(metadata)
+        result = {
+            "prompt": None,
+            "workflow": None,
+            "parameters": {},
+            "positive_prompt": None,
+            "negative_prompt": None,
+        }
+
+        # Check for A1111/Forge style parameters first.
+        # The chunk is one block: a possibly multi-line positive prompt, then a
+        # "Negative prompt:" section, then a trailing "Steps: ..." settings line.
+        # Taking lines[0] as the positive prompt truncates any multi-line prompt
+        # to one line, so split on the settings line instead.
+        if "parameters" in metadata:
+            import re as _re
+
+            params = metadata["parameters"]
+            body = params
+            settings = ""
+            _sm = _re.search(r"\nSteps:\s", body)
+            if _sm:
+                settings = body[_sm.start() + 1 :].strip()
+                body = body[: _sm.start()]
+            negative = None
+            _nm = _re.search(r"(?im)^\s*negative prompt:\s*", body)
+            if _nm:
+                negative = body[_nm.end() :].strip()
+                body = body[: _nm.start()]
+            elif body.lower().lstrip().startswith("negative prompt:"):
+                negative = body.lower().lstrip()[len("negative prompt:") :].strip()
+                body = ""
+            result["positive_prompt"] = body.strip() or None
+            if negative:
+                result["negative_prompt"] = negative
+            # Store raw parameters too
+            result["parameters"]["parameters"] = params
+            if settings:
+                for _f in ("Steps", "Sampler", "Schedule type", "CFG scale", "Seed"):
+                    _fm = _re.search(
+                        r"(?i)(?:^|,\s*)" + _re.escape(_f) + r":\s*([^,]+)", settings
+                    )
+                    if _fm:
+                        result["parameters"][_f.lower().replace(" ", "_")] = _fm.group(
+                            1
+                        ).strip()
+
+        # If no A1111 format found, proceed with ComfyUI parsing
+        if result["positive_prompt"] is None:
+            # Check for direct prompt field
+            if "prompt" in metadata:
+                try:
+                    prompt_data = json.loads(metadata["prompt"])
+                    result["prompt"] = prompt_data
+                except json.JSONDecodeError:
+                    result["prompt"] = metadata["prompt"]
+
+            # Check for workflow
+            if "workflow" in metadata:
+                try:
+                    workflow_data = json.loads(metadata["workflow"])
+                    result["workflow"] = workflow_data
+                except json.JSONDecodeError:
+                    result["workflow"] = metadata["workflow"]
+
+            # Check for other common ComfyUI fields
+            common_fields = [
+                "positive",
+                "negative",
+                "steps",
+                "cfg",
+                "sampler",
+                "scheduler",
+                "seed",
+            ]
+            for field in common_fields:
+                if field in metadata:
+                    try:
+                        result["parameters"][field] = json.loads(metadata[field])
+                    except json.JSONDecodeError:
+                        result["parameters"][field] = metadata[field]
+
+        return result
+
+    def _extract_readable_prompt(self, parsed_data):
+        """Extract human-readable prompt text from ComfyUI/A1111 data."""
+
+        def safe_to_string(value):
+            if isinstance(value, str):
+                return value
+            elif isinstance(value, list):
+                return " ".join(str(item) for item in value if item)
+            elif value is not None:
+                return str(value)
+            return None
+
+        # First check if we already extracted a positive prompt (A1111 format)
+        if parsed_data.get("positive_prompt"):
+            return parsed_data["positive_prompt"]
+
+        # Check if prompt is already a string
+        if isinstance(parsed_data.get("prompt"), str):
+            return parsed_data["prompt"]
+
+        # Check if prompt is a simple value that can be converted
+        if parsed_data.get("prompt") and not isinstance(
+            parsed_data.get("prompt"), dict
+        ):
+            return safe_to_string(parsed_data["prompt"])
+
+        prompt_data = parsed_data.get("prompt")
+        if isinstance(prompt_data, dict):
+            # Use the enhanced logic from parse-metadata.py
+            positive_prompt = self._extract_positive_prompt_from_comfyui_data(
+                prompt_data
+            )
+            if positive_prompt:
+                return positive_prompt
+
+        # Check workflow data if available
+        workflow_data = parsed_data.get("workflow")
+        if isinstance(workflow_data, dict):
+            positive_prompt = self._extract_positive_prompt_from_comfyui_data(
+                workflow_data
+            )
+            if positive_prompt:
+                return positive_prompt
+
+        # Check parameters for positive prompt
+        if parsed_data.get("parameters", {}).get("positive"):
+            return safe_to_string(parsed_data["parameters"]["positive"])
+
+        return None
+
+    def _get_node_inputs(self, node):
+        """Safely get inputs from a node, handling both dict and list formats.
+
+        Old format: inputs is a dict with direct key-value pairs
+            inputs = {"text": "my prompt", "seed": 123}
+
+        New format: inputs is a list of connection objects
+            inputs = [
+                {"name": "text", "type": "STRING", "link": null,
+                 "widget": {"name": "text"}},
+                {"name": "clip", "type": "CLIP", "link": 11}
+            ]
+        """
+        if not isinstance(node, dict):
+            return {}
+
+        inputs = node.get("inputs", {})
+
+        # If inputs is already a dict, return it
+        if isinstance(inputs, dict):
+            return inputs
+
+        # If inputs is a list, convert to dict format
+        if isinstance(inputs, list):
+            inputs_dict = {}
+            for input_item in inputs:
+                if isinstance(input_item, dict) and "name" in input_item:
+                    name = input_item["name"]
+                    inputs_dict[name] = input_item
+            return inputs_dict
+
+        return {}
+
+    def _find_text_in_node(self, node):
+        """Try to find text content in a node using various strategies.
+
+        Handles both old and new workflow formats.
+        """
+        if not isinstance(node, dict):
+            return None
+
+        # Strategy 1: Check normalized inputs for 'text' field
+        inputs = self._get_node_inputs(node)
+        if "text" in inputs and isinstance(inputs["text"], str):
+            return inputs["text"]
+
+        # Strategy 2: For text encoder nodes, check widgets_values
+        class_type = node.get("class_type", node.get("type", ""))
+        text_encoder_types = [
+            "CLIPTextEncode",
+            "CLIPTextEncodeSDXL",
+            "CLIPTextEncodeSDXLRefiner",
+            "CLIPTextEncodeFlux",
+            "PromptManager",
+            "PromptManagerText",
+            "BNK_CLIPTextEncoder",
+            "Text Encoder",
+            "CLIP Text Encode",
+        ]
+
+        if any(
+            encoder_type.lower() in class_type.lower()
+            for encoder_type in text_encoder_types
+        ):
+            widgets_values = node.get("widgets_values", [])
+            if widgets_values and len(widgets_values) > 0:
+                if isinstance(widgets_values[0], str) and widgets_values[0].strip():
+                    return widgets_values[0]
+
+        return None
+
+    def _extract_positive_prompt_from_comfyui_data(self, data):
+        """Extract positive prompt from ComfyUI data.
+
+        Handles both old and new formats.
+        """
+        if not isinstance(data, dict):
+            return None
+
+        # Build nodes dictionary
+        nodes_by_id = {}
+        if "nodes" in data:
+            # Handle nodes array format
+            for node in data["nodes"]:
+                if isinstance(node, dict):
+                    nid = node.get("id")
+                    if nid is not None:
+                        nodes_by_id[nid] = node
+        else:
+            # Handle flat dictionary format (node_id -> node_data)
+            for nid_str, node in data.items():
+                try:
+                    nid = int(nid_str)
+                except (ValueError, TypeError):
+                    nid = nid_str
+                if isinstance(node, dict):
+                    if "id" in node:
+                        nid = node["id"]
+                    nodes_by_id[nid] = node
+
+        if not nodes_by_id:
+            return None
+
+        # First, try to find positive/negative connection pattern
+        pos_id = None
+        for node in nodes_by_id.values():
+            if isinstance(node, dict):
+                inputs = self._get_node_inputs(node)
+                if "positive" in inputs and "negative" in inputs:
+                    try:
+                        pos_input = inputs["positive"]
+                        if isinstance(pos_input, list) and len(pos_input) > 0:
+                            pos_id = int(pos_input[0])
+                            break
+                    except (ValueError, TypeError, IndexError):
+                        continue
+
+        # Get text from the positive node
+        if pos_id is not None and pos_id in nodes_by_id:
+            text_val = self._find_text_in_node(nodes_by_id[pos_id])
+            if text_val:
+                return text_val
+
+        # Fallback: find any text encoder node with text content
+        text_nodes = []
+        for node in nodes_by_id.values():
+            if isinstance(node, dict):
+                text_val = self._find_text_in_node(node)
+                if text_val:
+                    # Try to determine if this is positive or negative
+                    node_title = node.get("title", "").lower()
+                    if "neg" not in node_title and "negative" not in node_title:
+                        # Prioritize non-negative prompts
+                        text_nodes.insert(0, text_val)
+                    else:
+                        text_nodes.append(text_val)
+
+        # Return the first positive-looking prompt
+        if text_nodes:
+            return text_nodes[0]
+
+        return None
@@ -1,134 +0,0 @@
-"""Request validation and the worker of the Tag dialog's Generate (#249 B2).
-
-``POST /prompt_manager/image-annotations/suggest`` asks one of legacy's four
-engines for the top N tags of a captured image. Options are validated
-strictly, per engine: WD14 classifiers take two thresholds, the language
-models (GGUF and HuggingFace JoyCaption) take the instructions; every engine
-takes the suggestion count and the GPU switch. Nothing here touches the
-filesystem or the database.
-"""
-
-import math
-
-from ..tagging_defaults import (  # noqa: F401 - re-exported for the route
-    LLM_MODEL_TYPES as LLM_MODELS,
-    MAX_INSTRUCTION_BYTES,
-    MODEL_TYPES,
-    WD14_MODEL_TYPES as WD14_MODELS,
-    validate_template,
-    validate_threshold,
-)
-
-SUGGEST_FIELDS = frozenset(
-    {"target", "capture_token", "expected_epoch", "model_type", "options"}
-)
-_COMMON = frozenset({"suggestion_limit", "use_gpu"})
-_WD14_REQUIRED = frozenset({"general_threshold", "character_threshold"})
-_LLM_REQUIRED = frozenset({"instructions"})
-
-UNAVAILABLE_HINT = "Download it in System › Auto-tagging."
-
-
-class OptionError(ValueError):
-    """A suggest request whose model type or options are not acceptable."""
-
-
-def _threshold(name: str, value) -> float:
-    try:
-        return validate_threshold(name, value)
-    except ValueError as error:
-        raise OptionError(str(error)) from None
-
-
-def _instructions(value) -> str:
-    try:
-        return validate_template(value)
-    except ValueError as error:
-        raise OptionError(str(error)) from None
-
-
-def validate_options(model_type, options, *, default_limit: int, max_limit: int):
-    """Normalised ``(model_type, options)`` or :class:`OptionError`.
-
-    The answer echoes every option the request will run with, the defaults
-    (suggestion count from the settings, GPU on) filled in.
-    """
-    if not isinstance(model_type, str) or model_type not in MODEL_TYPES:
-        raise OptionError("model_type must be one of " + ", ".join(sorted(MODEL_TYPES)))
-    if not isinstance(options, dict):
-        raise OptionError("options must be an object")
-    required = _WD14_REQUIRED if model_type in WD14_MODELS else _LLM_REQUIRED
-    keys = set(options)
-    if not required <= keys or not keys <= required | _COMMON:
-        raise OptionError(
-            f"options for {model_type} take exactly "
-            + ", ".join(sorted(required))
-            + " and optionally "
-            + ", ".join(sorted(_COMMON))
-        )
-    limit = options.get("suggestion_limit", default_limit)
-    if type(limit) is not int or not 1 <= limit <= max_limit:
-        raise OptionError(f"suggestion_limit must be an integer from 1 to {max_limit}")
-    use_gpu = options.get("use_gpu", True)
-    if not isinstance(use_gpu, bool):
-        raise OptionError("use_gpu must be true or false")
-    normalised = {"use_gpu": use_gpu, "suggestion_limit": limit}
-    if model_type in WD14_MODELS:
-        for name in sorted(_WD14_REQUIRED):
-            normalised[name] = _threshold(name, options[name])
-    else:
-        normalised["instructions"] = _instructions(options["instructions"])
-    return model_type, normalised
-
-
-def unavailable_message(model_name: str) -> str:
-    return f"{model_name} is not downloaded. {UNAVAILABLE_HINT}"
-
-
-def model_refusal(status: dict, model_type: str, model_name: str):
-    """Why *model_type* cannot run, from ``get_models_status()``, else None.
-
-    Not downloaded first (``unavailable_message``), then a backend package
-    that cannot be imported (#424). Both are a 409 ``model-unavailable``.
-    """
-    entry = status.get(model_type) or {}
-    if not entry.get("downloaded"):
-        return unavailable_message(model_name)
-    missing = entry.get("missing_packages") or []
-    if missing:
-        from ..autotag import missing_packages_message
-
-        return missing_packages_message(model_type, [str(name) for name in missing])
-    return None
-
-
-def run_suggestions(
-    service, capture_path: str, model_type: str, options: dict, skip=None
-):
-    """Blocking: load (or swap to) *model_type*, then suggest for the capture.
-
-    The caller holds the model gate for the whole call; nothing is ever
-    downloaded (``load_model`` refuses a model that is not on disk). ``skip``
-    is the request's or job's compiled Skipped tags (#431).
-    """
-    if not service.is_model_loaded() or service.get_loaded_model_type() != model_type:
-        service.load_model(model_type, options["use_gpu"])
-    return service.generate_tag_suggestions(
-        capture_path,
-        limit=options["suggestion_limit"],
-        prompt=options.get("instructions"),
-        general_threshold=options.get("general_threshold"),
-        character_threshold=options.get("character_threshold"),
-        skip=skip,
-    )
-
-
-def suggestion_rows(pairs) -> list:
-    """``[{name, confidence}]``; a non-finite score is reported as unknown."""
-    rows = []
-    for name, score in pairs:
-        confidence = None
-        if score is not None and math.isfinite(score):
-            confidence = float(score)
-        rows.append({"name": str(name), "confidence": confidence})
-    return rows
@@ -1,783 +0,0 @@
-"""Image annotation routes: observe, capture preview and byte-exact tag saves.
-
-Every route names its file through the listing identity ``{root_index,
-root_scope, path}`` and checks the scope against the current gallery roots
-before any file access. Observe copies the file into a private capture (the
-token the preview and Save refer to), Save re-hashes the current file and
-writes only when the bytes are still the captured ones. Responses carry no
-server path and no locator.
-"""
-
-import asyncio
-import datetime
-import functools
-import os
-import re
-import threading
-from pathlib import Path
-
-from aiohttp import web
-
-from .annotation_suggest import (
-    SUGGEST_FIELDS,
-    OptionError,
-    model_refusal,
-    run_suggestions,
-    suggestion_rows,
-    validate_options,
-)
-from .autotag_routes import model_busy_response
-
-# The target check is shared with the collection routes (#331); both names
-# stay importable from here.
-from .media_target import MAX_TARGET_PATH  # noqa: F401
-from .media_target import media_target as _target
-from .images import _unavailable_link, _verified_title
-from .prompts import bad_request
-from .. import model_gate
-from ..tagging_defaults import SkipMatcher
-
-try:
-    from ...database.annotations import (
-        MAX_IMAGE_TAGS,
-        AnnotationCommandError,
-        ImageTagLimitError,
-        normalize_image_tags,
-    )
-    from ...database.execution_history import subscribe_history_restore
-    from ...database.library_commands import LibraryCommandError
-    from ...utils.media_capture import CaptureError, CaptureStore
-except ImportError:
-    from database.annotations import (
-        MAX_IMAGE_TAGS,
-        AnnotationCommandError,
-        ImageTagLimitError,
-        normalize_image_tags,
-    )
-    from database.execution_history import subscribe_history_restore
-    from database.library_commands import LibraryCommandError
-    from utils.media_capture import CaptureError, CaptureStore
-
-# Request bodies of the annotation routes are small (a target plus a tag set).
-MAX_BODY_BYTES = 64 * 1024
-CAPTURE_URL = "/prompt_manager/image-annotations/capture/"
-_PREVIEW_CHUNK = 64 * 1024
-
-_OBSERVE_FIELDS = frozenset({"target"})
-_SAVE_FIELDS = frozenset(
-    {
-        "target",
-        "capture_token",
-        "sha256",
-        "expected_epoch",
-        "expected_tag_revision",
-        "tags",
-    }
-)
-_HEX64 = re.compile(r"[0-9a-f]{64}")
-_UUID = re.compile(r"[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}")
-# secrets.token_urlsafe(32) is 43 characters; the bound only rejects junk.
-_TOKEN = re.compile(r"[A-Za-z0-9_-]{1,128}")
-# The store is created on first use by the event loop, the scan's executor or
-# the monitor's worker (Needs review), so its creation is serialized.
-_CAPTURE_STORE_LOCK = threading.Lock()
-
-_PREVIEW_TYPES = {
-    ".png": "image/png",
-    ".jpg": "image/jpeg",
-    ".jpeg": "image/jpeg",
-    ".webp": "image/webp",
-    ".gif": "image/gif",
-    ".bmp": "image/bmp",
-    ".tiff": "image/tiff",
-    ".tif": "image/tiff",
-    ".mp4": "video/mp4",
-    ".m4v": "video/mp4",
-    ".webm": "video/webm",
-    ".mov": "video/quicktime",
-    ".mkv": "video/x-matroska",
-    ".avi": "video/x-msvideo",
-    ".wmv": "video/x-ms-wmv",
-}
-
-_STATUS = {
-    "review-capacity": 429,
-    "unsupported-media": 415,
-    "file-changed": 409,
-    "source-changed": 409,
-    "storage-changed": 409,
-    "tag-conflict": 409,
-    "capture-expired": 409,
-    "model-unavailable": 409,
-    "tag-limit": 400,
-    "metadata-conflict": 409,
-    "vocabulary-conflict": 409,
-}
-_MESSAGES = {
-    "source-changed": (
-        "The source changed. Refresh the image collection before tagging this file."
-    ),
-    "file-changed": "The file changed since it was previewed. Reopen the Tag dialog.",
-    "review-capacity": "Too many previews are open. Close a Tag dialog and try again.",
-    "storage-changed": "Prompt storage was restored; reopen the Tag dialog.",
-    "tag-conflict": (
-        "The tags of this image changed since the dialog opened; review them first."
-    ),
-    "capture-expired": "The preview expired. Open the Tag dialog again.",
-    "tag-limit": f"An image can carry at most {MAX_IMAGE_TAGS} tags.",
-}
-# Any other storage code (a conflict a later command adds) still answers a
-# coded envelope rather than a bare 500.
-_DEFAULT_STATUS = 409
-_DEFAULT_MESSAGE = "The tags could not be saved. Reopen the Tag dialog and try again."
-_OTHER_FILE = "The preview belongs to another file. Open the Tag dialog again."
-
-
-def preview_content_type(extension: str) -> str:
-    """The media type the preview is served as; never sniffed from bytes."""
-    return _PREVIEW_TYPES.get(extension.lower(), "application/octet-stream")
-
-
-def _error(status: int, code: str, message: str, **extra) -> web.Response:
-    return web.json_response(
-        {"success": False, "code": code, "error": message, **extra},
-        status=status,
-        headers={"Cache-Control": "no-store"},
-    )
-
-
-def _coded(code: str, message: str | None = None, **extra) -> web.Response:
-    status = _STATUS.get(code, _DEFAULT_STATUS)
-    return _error(
-        status, code, message or _MESSAGES.get(code, _DEFAULT_MESSAGE), **extra
-    )
-
-
-def _open_capture(path: str):
-    """Worker thread: the capture file opened for reading."""
-    return open(path, "rb")
-
-
-async def _settled(future, cleanup):
-    """Await an executor *future*; a cancelled caller still cleans up after it.
-
-    The future is shielded, so the worker call always runs to its end. When the
-    caller is cancelled first, ``cleanup(result)`` runs once the call is done
-    (``cleanup(None)`` when it failed): a handle is closed, a capture released.
-    """
-    try:
-        return await asyncio.shield(future)
-    except asyncio.CancelledError:
-        future.add_done_callback(functools.partial(_cleanup_result, cleanup))
-        raise
-
-
-def _cleanup_result(cleanup, future) -> None:
-    if future.cancelled() or future.exception() is not None:
-        cleanup(None)
-    else:
-        cleanup(future.result())
-
-
-def _submit(func, *args, **kwargs):
-    return asyncio.get_running_loop().run_in_executor(
-        None, functools.partial(func, *args, **kwargs)
-    )
-
-
-def _capture_error(exc: CaptureError) -> web.Response:
-    """The envelope for a capture outcome; messages never name a path."""
-    if exc.code not in _STATUS:
-        return _error(500, exc.code, "The file could not be captured.")
-    return _coded(exc.code, _MESSAGES.get(exc.code) or str(exc))
-
-
-def _expires_at(seconds: float | None) -> str:
-    moment = datetime.datetime.now(datetime.timezone.utc) + datetime.timedelta(
-        seconds=max(0.0, seconds or 0.0)
-    )
-    return moment.replace(microsecond=0).isoformat().replace("+00:00", "Z")
-
-
-def _capture_info(store: CaptureStore, capture) -> dict:
-    return {
-        "token": capture.token,
-        "expires_at": _expires_at(store.expires_in(capture.token)),
-        "preview_url": CAPTURE_URL + capture.token,
-        "sha256": capture.sha256,
-        "size": capture.size,
-        "width": capture.width,
-        "height": capture.height,
-        "media_type": capture.media_type,
-        "generate": {
-            "supported": capture.inferable,
-            "reason": capture.inferable_reason,
-        },
-    }
-
-
-class AnnotationRoutesMixin:
-    """Observe, capture preview and tag save routes over PR A's storage."""
-
-    def _register_annotation_routes(self, routes: web.RouteTableDef) -> None:
-        routes.post("/prompt_manager/image-annotations/observe")(self.observe_image)
-        routes.get(CAPTURE_URL + "{token}")(self.get_capture_preview)
-        routes.delete(CAPTURE_URL + "{token}")(self.release_capture)
-        routes.put("/prompt_manager/image-annotations/tags")(self.save_image_tags)
-        routes.post("/prompt_manager/image-annotations/suggest")(
-            self.suggest_image_tags
-        )
-
-    # -- capture store lifetime ------------------------------------------------
-
-    def _capture_store(self) -> CaptureStore:
-        """The process's capture store, created on first use.
-
-        Created lazily so an API object that never observes a file (most tests,
-        a server that never opens the Tag dialog) owns no temp directory. A
-        restore of the database dooms every capture (``invalidate_all``).
-        Thread-safe: Needs review recording calls it off the event loop.
-        Raises ``CaptureError`` after ``close_annotation_captures``.
-        """
-        with _CAPTURE_STORE_LOCK:
-            if getattr(self, "_captures_closed", False):
-                # A recording still in flight at shutdown must not create a
-                # new temp directory after the cleanup removed the old one.
-                raise CaptureError("The capture store is closed")
-            if self._captures is None:
-                self._captures = CaptureStore()
-            if self._captures_unsubscribe is None:
-                self._captures_unsubscribe = subscribe_history_restore(
-                    self.db.model.db_path, self._invalidate_captures
-                )
-            return self._captures
-
-    def _invalidate_captures(self) -> None:
-        store = self._captures
-        if store is not None:
-            store.invalidate_all()
-
-    def close_annotation_captures(self, *, final: bool = False) -> None:
-        """Remove every capture file and the owned directory. Idempotent.
-
-        Taken under the store lock. ``final`` (the shutdown cleanup) also makes
-        ``_capture_store`` refuse to create another store, so a recording
-        still in flight cannot leak a new temp directory after it.
-        """
-        with _CAPTURE_STORE_LOCK:
-            if final:
-                self._captures_closed = True
-            unsubscribe, self._captures_unsubscribe = self._captures_unsubscribe, None
-            store, self._captures = self._captures, None
-            self._suggested_tokens = set()
-        if unsubscribe is not None:
-            unsubscribe()
-        if store is not None:
-            store.close()
-
-    async def cleanup_annotation_captures(self, app: web.Application) -> None:
-        self.close_annotation_captures(final=True)
-
-    # -- shared request steps --------------------------------------------------
-
-    async def _annotation_body(self, request: web.Request, fields: frozenset):
-        data, error = await self._read_json_body(request, max_bytes=MAX_BODY_BYTES)
-        if error is not None:
-            return None, error
-        if set(data) != fields:
-            return None, bad_request(
-                "Request must contain exactly " + ", ".join(sorted(fields))
-            )
-        return data, None
-
-    def _scoped_root(self, index: int, scope: str):
-        """``(root, None)`` when the scope names a current root, else an error."""
-        roots = list(self._get_all_output_dirs())
-        error = self._gallery_scope_error(
-            {"root_scope": scope, "root": str(index)}, roots
-        )
-        if error is not None:
-            if error.status == 409:
-                return None, _coded("source-changed")
-            return None, error
-        return roots[index], None
-
-    # -- observe ---------------------------------------------------------------
-
-    async def observe_image(self, request: web.Request) -> web.Response:
-        """POST ``{target}``: capture the file and answer its saved tag set.
-
-        The capture is the byte-exact copy the preview and Save refer to; the
-        tags are those of exactly these bytes (an empty set at revision 0 for
-        unseen bytes). Observing never writes tags; equal bytes refresh the
-        record's verified fingerprint (S1).
-        """
-        data, error = await self._annotation_body(request, _OBSERVE_FIELDS)
-        if error is not None:
-            return error
-        target, error = _target(data["target"])
-        if error is not None:
-            return error
-        index, scope, relative = target
-        root, error = self._scoped_root(index, scope)
-        if error is not None:
-            return error
-        try:
-            store = self._capture_store()
-        except CaptureError as exc:  # the server is shutting down
-            return _capture_error(exc)
-        try:
-            epoch = await self._run_in_executor(self.db.get_execution_epoch)
-            capture = await _settled(
-                _submit(
-                    store.capture,
-                    root,
-                    relative,
-                    epoch=epoch,
-                    scope=scope,
-                    root_index=index,
-                ),
-                # A cancelled observe never hands its capture out: release it.
-                lambda made: made is not None and store.release(made.token),
-            )
-        except CaptureError as exc:
-            return _capture_error(exc)
-        except Exception:
-            self.logger.exception("Image observation failed")
-            return _error(500, "observe-failed", "The image could not be observed.")
-        try:
-            stored, title = await self._run_in_executor(
-                self._observe_capture, store, capture, root, relative
-            )
-        except asyncio.CancelledError:
-            store.release(capture.token)
-            raise
-        except Exception:
-            store.release(capture.token)
-            self.logger.exception("Image observation failed")
-            return _error(500, "observe-failed", "The image could not be observed.")
-        return web.json_response(
-            {
-                "success": True,
-                "library_epoch": capture.epoch,
-                "target": {"root_index": index, "root_scope": scope, "path": relative},
-                "capture": _capture_info(store, capture),
-                "title": title,
-                "filename": relative.rsplit("/", 1)[-1],
-                "tags": stored["tags"],
-                "tag_revision": stored["tag_revision"],
-            },
-            headers={"Cache-Control": "no-store"},
-        )
-
-    def _observe_capture(self, store: CaptureStore, capture, root, relative: str):
-        """Blocking part of observe: fingerprint refresh, tag read, title."""
-        self.db.refresh_image_fingerprint(
-            capture.locator, capture.sha256, capture.size, capture.mtime_ns
-        )
-        stored = self.db.read_image_tags(capture.locator, capture.sha256)
-        return stored, self._observed_title(store, capture, root, relative)
-
-    def _observed_title(self, store: CaptureStore, capture, root, relative: str):
-        """The dialog's title under the card and inspector rule (``_verified_title``).
-
-        A stored Library title always shows; a first-line title only when the
-        captured bytes' own records confirm it. An ambiguous association has no
-        title. Videos read no card metadata, so only a stored title shows.
-        """
-        path = str(Path(root) / relative)
-        summary = self._workspace_link_summaries([path]).get(path)
-        if summary is None:
-            summary = _unavailable_link()
-        positive_title = None
-        if (
-            capture.media_type != "video"
-            and summary.get("title_source") == "text"
-            and store.acquire(capture.token) is not None
-        ):
-            try:
-                facts = self._read_card_facts(Path(capture.path), parse=True)
-            finally:
-                store.release_use(capture.token)
-            positive_title = facts.positive_title if facts is not None else None
-        return _verified_title(summary, positive_title)
-
-    # -- capture preview -------------------------------------------------------
-
-    async def get_capture_preview(self, request: web.Request) -> web.StreamResponse:
-        """GET the captured bytes; the token is pinned while they stream."""
-        token = request.match_info["token"]
-        store = self._captures
-        if store is None or _TOKEN.fullmatch(token) is None:
-            return _error(404, "capture-expired", _MESSAGES["capture-expired"])
-        capture = store.acquire(token)
-        if capture is None:
-            return _error(404, "capture-expired", _MESSAGES["capture-expired"])
-        pinned = True
-        try:
-            _root, error = self._scoped_root(capture.root_index, capture.scope)
-            if error is not None:
-                # The roots changed under the token: it is no longer usable.
-                store.release(token)
-                return error
-            try:
-                handle = await _settled(
-                    _submit(_open_capture, capture.path),
-                    functools.partial(_close_then_release, store, token),
-                )
-            except asyncio.CancelledError:
-                # Cancelled while the file opens: the pin ends only after the
-                # handle closes (Windows cannot unlink an open file).
-                pinned = False
-                raise
-            except OSError:
-                store.release(token)
-                return _error(404, "capture-expired", _MESSAGES["capture-expired"])
-            try:
-                return await self._stream_capture(request, capture, handle)
-            finally:
-                handle.close()
-        finally:
-            if pinned:
-                store.release_use(token)
-
-    @staticmethod
-    async def _stream_capture(request, capture, handle) -> web.StreamResponse:
-        """The capture's bytes, or the one byte range a ``Range`` header asks for.
-
-        The response is written here, inside the caller's pin, so the handle
-        is closed and the pin ended only after the last byte is sent.
-        """
-        size = capture.size
-        headers = {
-            "Content-Type": preview_content_type(Path(capture.path).suffix),
-            "Accept-Ranges": "bytes",
-            "Cache-Control": "no-store",
-            "X-Content-Type-Options": "nosniff",
-        }
-        status, start, end = 200, 0, size
-        if "Range" in request.headers:
-            wanted = _byte_range(request, size)
-            if wanted is None:
-                return web.Response(
-                    status=416,
-                    headers={**headers, "Content-Range": f"bytes */{size}"},
-                )
-            status, (start, end) = 206, wanted
-            headers["Content-Range"] = f"bytes {start}-{end - 1}/{size}"
-        headers["Content-Length"] = str(end - start)
-        response = web.StreamResponse(status=status, headers=headers)
-        await response.prepare(request)
-        loop = asyncio.get_running_loop()
-        if start:
-            await loop.run_in_executor(None, handle.seek, start)
-        remaining = end - start
-        while remaining > 0 and request.method != "HEAD":
-            chunk = await loop.run_in_executor(
-                None, handle.read, min(_PREVIEW_CHUNK, remaining)
-            )
-            if not chunk:
-                break
-            remaining -= len(chunk)
-            await response.write(chunk)
-        await response.write_eof()
-        return response
-
-    async def release_capture(self, request: web.Request) -> web.Response:
-        """DELETE a capture token; releasing an unknown token is a success."""
-        token = request.match_info["token"]
-        store = self._captures
-        if store is not None and _TOKEN.fullmatch(token) is not None:
-            store.release(token)
-        self._suggested_tokens.discard(token)
-        return web.json_response(
-            {"success": True}, headers={"Cache-Control": "no-store"}
-        )
-
-    # -- save ------------------------------------------------------------------
-
-    async def save_image_tags(self, request: web.Request) -> web.Response:
-        """PUT the tag set of the previewed bytes, re-hashing the current file.
-
-        Writes only when the file still holds the captured bytes
-        (``file-changed`` with zero writes otherwise), under the storage epoch
-        and the tag revision the dialog read; an identical retry is
-        ``replayed``. The hash never runs inside a database transaction.
-        """
-        data, error = await self._annotation_body(request, _SAVE_FIELDS)
-        if error is not None:
-            return error
-        target, error = _target(data["target"])
-        if error is not None:
-            return error
-        guards, error = _save_guards(data)
-        if error is not None:
-            return error
-        token, sha256, expected_epoch, revision, tags = guards
-        index, scope, relative = target
-        root, error = self._scoped_root(index, scope)
-        if error is not None:
-            return error
-        store = self._captures
-        capture = store.get(token) if store is not None else None
-        if capture is None:
-            return _coded("capture-expired")
-        if capture.root_index != index or capture.scope != scope:
-            return _coded("capture-expired", _OTHER_FILE)
-        if sha256 != capture.sha256:
-            return bad_request("sha256 does not match the preview")
-        if expected_epoch != capture.epoch:
-            current = await self._run_in_executor(self.db.get_execution_epoch)
-            return _coded("storage-changed", library_epoch=current)
-        try:
-            facts = await self._run_in_executor(
-                _verify_captured_file, store, capture, root, relative
-            )
-        except CaptureError as exc:
-            return _capture_error(exc)
-        if facts is None or facts.locator != capture.locator:
-            return _coded("capture-expired", _OTHER_FILE)
-        if facts.sha256 != capture.sha256:
-            return _coded("file-changed")
-        # A save after Generate suggestions ran on this capture marks the
-        # image auto-tagged (#379), so a Skip batch leaves the review alone.
-        suggested = token in self._suggested_tokens
-        try:
-            receipt = await self._run_in_executor(
-                self.db.replace_image_tags,
-                locator=facts.locator,
-                sha256=facts.sha256,
-                size=facts.size,
-                mtime_ns=facts.mtime_ns,
-                expected_epoch=expected_epoch,
-                expected_tag_revision=revision,
-                tags=tags,
-                mark_autotagged=suggested,
-            )
-        except AnnotationCommandError as exc:
-            current = exc.current or {}
-            return _coded(
-                exc.code,
-                library_epoch=exc.epoch,
-                tags=current.get("tags", []),
-                tag_revision=current.get("tag_revision", 0),
-            )
-        except LibraryCommandError as exc:
-            return _coded(exc.code, library_epoch=exc.epoch)
-        except ValueError as exc:
-            return bad_request(str(exc))
-        except Exception:
-            self.logger.exception("Image tag save failed")
-            return _error(500, "save-failed", "The tags could not be saved.")
-        # Dropped only after a saved or replayed receipt: a retry after a
-        # tag-conflict still marks.
-        self._suggested_tokens.discard(token)
-        return web.json_response(
-            {"success": True, **receipt}, headers={"Cache-Control": "no-store"}
-        )
-
-    def _remember_suggested(self, store, token: str) -> None:
-        """Note that Generate ran on *token*; forget tokens whose capture is
-        gone. ``expires_in`` does not reset a capture's idle clock."""
-        self._suggested_tokens = {
-            kept
-            for kept in self._suggested_tokens
-            if store.expires_in(kept) is not None
-        }
-        self._suggested_tokens.add(token)
-
-    # -- suggest ---------------------------------------------------------------
-
-    async def suggest_image_tags(self, request: web.Request) -> web.Response:
-        """POST: the top N tags of the captured bytes from one legacy engine.
-
-        Runs only on the private capture (pinned for the whole inference),
-        under the shared model gate (``model-busy`` while anything else holds
-        it, including a legacy batch), never downloads (``model-unavailable``)
-        and never writes.
-        """
-        from ..autotag import MODELS, MissingBackendPackages, get_autotag_service
-        from ..config import MAX_SUGGESTION_LIMIT, AutotagConfig
-
-        data, error = await self._annotation_body(request, SUGGEST_FIELDS)
-        if error is not None:
-            return error
-        target, error = _target(data["target"])
-        if error is not None:
-            return error
-        try:
-            model_type, options = validate_options(
-                data["model_type"],
-                data["options"],
-                default_limit=AutotagConfig.suggestion_limit(),
-                max_limit=MAX_SUGGESTION_LIMIT,
-            )
-        except OptionError as exc:
-            return bad_request(str(exc))
-        token, epoch = data["capture_token"], data["expected_epoch"]
-        if not isinstance(token, str) or _TOKEN.fullmatch(token) is None:
-            return bad_request("Invalid capture token")
-        if not isinstance(epoch, str) or _UUID.fullmatch(epoch) is None:
-            return bad_request("expected_epoch must be a canonical UUID")
-        index, scope, relative = target
-        root, error = self._scoped_root(index, scope)
-        if error is not None:
-            return error
-        store = self._captures
-        capture = store.acquire(token) if store is not None else None
-        if capture is None:
-            return _coded("capture-expired")
-        started = False
-        try:
-            error = await self._suggest_guards(capture, target, root, epoch)
-            if error is not None:
-                return error
-            service = get_autotag_service()
-            status = await self._run_in_executor(service.get_models_status)
-            name = MODELS.get(model_type, {}).get("name", model_type)
-            refusal = model_refusal(status, model_type, name)
-            if refusal is not None:
-                return _coded("model-unavailable", refusal)
-            owner = model_gate.new_owner("image-annotations")
-            if not model_gate.try_acquire(owner):
-                return model_busy_response()
-            # #431: the Skipped tags as they are when the request is accepted.
-            skip = SkipMatcher(AutotagConfig.SKIPPED_TAGS).counting()
-            try:
-                # From here the pin is the gate's to end: the worker ends it,
-                # or ``on_skipped`` does when the worker never starts.
-                started = True
-                pairs = await model_gate.run(
-                    owner,
-                    _pinned_suggestions,
-                    store,
-                    token,
-                    service,
-                    capture,
-                    model_type,
-                    options,
-                    skip,
-                    on_skipped=functools.partial(store.release_use, token),
-                )
-            except MissingBackendPackages as exc:
-                # A package gone since the status read (load_model logged it).
-                return _coded("model-unavailable", str(exc))
-            except Exception:
-                self.logger.exception("Tag suggestion failed")
-                return _error(
-                    500,
-                    "suggest-failed",
-                    "Auto-tagging failed. Check server logs for details.",
-                )
-            finally:
-                model_gate.release(owner)
-        finally:
-            if not started:
-                store.release_use(token)
-        self._remember_suggested(store, token)
-        return web.json_response(
-            {
-                "success": True,
-                "model_type": model_type,
-                "options": options,
-                "suggestions": suggestion_rows(pairs),
-                # How many distinct suggestions the Skipped tags hid (#431).
-                "skipped": len(skip.hidden),
-            },
-            headers={"Cache-Control": "no-store"},
-        )
-
-    async def _suggest_guards(self, capture, target, root, epoch):
-        """The capture must be this target's, of this epoch, and inferable."""
-        index, scope, relative = target
-        expected = os.path.normcase(
-            os.path.join(os.path.realpath(root), *relative.split("/"))
-        )
-        if (
-            capture.root_index != index
-            or capture.scope != scope
-            or capture.locator != expected
-        ):
-            return _coded("capture-expired", _OTHER_FILE)
-        if epoch != capture.epoch:
-            current = await self._run_in_executor(self.db.get_execution_epoch)
-            return _coded("storage-changed", library_epoch=current)
-        if not capture.inferable:
-            return _coded("unsupported-media", capture.inferable_reason)
-        return None
-
-
-def _close_then_release(store: CaptureStore, token: str, handle) -> None:
-    """Close a preview handle a cancelled request opened, then end its pin."""
-    try:
-        if handle is not None:
-            handle.close()
-    finally:
-        store.release_use(token)
-
-
-def _byte_range(request: web.Request, size: int):
-    """``(start, end)`` of the one satisfiable byte range asked for, else None.
-
-    A malformed, multi-range or unsatisfiable header is None (416), as
-    aiohttp's own file responses answer it.
-    """
-    try:
-        wanted = request.http_range
-    except ValueError:
-        return None
-    start, stop = wanted.start, wanted.stop
-    if start is None:
-        return None
-    if start < 0:  # a suffix: the last -start bytes
-        start = max(0, size + start)
-        stop = size
-    stop = size if stop is None else min(stop, size)
-    if start >= size or stop <= start:
-        return None
-    return start, stop
-
-
-def _pinned_suggestions(store, token, service, capture, model_type, options, skip=None):
-    """Worker thread: infer on the capture, then end its pin (even on error)."""
-    try:
-        return run_suggestions(service, capture.path, model_type, options, skip)
-    finally:
-        store.release_use(token)
-
-
-def _verify_captured_file(store: CaptureStore, capture, root, relative: str):
-    """Re-hash the current file, or None when the token names another file.
-
-    The cheap locator comparison runs first, so a token sent for another
-    target never costs a whole-file hash.
-    """
-    expected = os.path.normcase(
-        os.path.join(os.path.realpath(root), *relative.split("/"))
-    )
-    if expected != capture.locator:
-        return None
-    return store.verify(root, relative)
-
-
-def _save_guards(data: dict):
-    """Validated ``(token, sha256, epoch, revision, tags)`` or ``(None, error)``."""
-    token = data["capture_token"]
-    if not isinstance(token, str) or _TOKEN.fullmatch(token) is None:
-        return None, bad_request("Invalid capture token")
-    sha256 = data["sha256"]
-    if not isinstance(sha256, str) or _HEX64.fullmatch(sha256) is None:
-        return None, bad_request("sha256 must be 64 lowercase hexadecimal characters")
-    epoch = data["expected_epoch"]
-    if not isinstance(epoch, str) or _UUID.fullmatch(epoch) is None:
-        return None, bad_request("expected_epoch must be a canonical UUID")
-    revision = data["expected_tag_revision"]
-    if type(revision) is not int or revision < 0:
-        return None, bad_request("expected_tag_revision must be a non-negative integer")
-    try:
-        tags = normalize_image_tags(data["tags"])
-    except ImageTagLimitError as exc:
-        return None, _error(400, "tag-limit", str(exc))
-    except ValueError as exc:
-        return None, bad_request(str(exc))
-    return (token, sha256, epoch, revision, tags), None
@@ -1,350 +0,0 @@
-"""Collections (#331): named, hand-picked groups of images.
-
-Routes under ``/prompt_manager/collections``. A file is named by its listing
-identity ``{root_index, root_scope, path}`` (``media_target.py``) and stored
-under the favorites' keys (``_favorite_root_key``, ``_favorite_relative_key``),
-which never leave the server. A stale scope (the sources were reordered) is a
-409 ``source-changed`` before anything is written. Responses are
-``{"success": bool, ...}``; an unexpected failure is a logged 500 with a
-generic message, never the exception text.
-"""
-
-import hmac
-import re
-from functools import wraps
-from typing import Callable
-
-from aiohttp import web
-
-from .images import (
-    _favorite_relative_key,
-    _favorite_root_key,
-    _forbidden,
-    _json_body_or_error,
-    collection_not_found,
-)
-from .media_target import media_target
-from .prompts import bad_request
-
-try:
-    from ...database.image_collections import (
-        CollectionFilesMissing,
-        CollectionInvalid,
-        CollectionMissing,
-        CollectionNameTaken,
-        normalize_collection_name,
-    )
-    from ...database.image_favorites import MAX_KEY_LENGTH
-except ImportError:
-    from database.image_collections import (
-        CollectionFilesMissing,
-        CollectionInvalid,
-        CollectionMissing,
-        CollectionNameTaken,
-        normalize_collection_name,
-    )
-    from database.image_favorites import MAX_KEY_LENGTH
-
-BASE = "/prompt_manager/collections"
-# The most files one add or remove names (the bulk tagging cap, MC12).
-MAX_ITEMS = 500
-MAX_ID = 999_999_999
-_PATH_ID = re.compile(r"[1-9][0-9]{0,8}")
-_ROOT_INDEX = re.compile(r"[0-9]{1,9}")
-_ADD_TARGETS = (frozenset({"collection_id", "items"}), frozenset({"name", "items"}))
-_REMOVE_FIELDS = frozenset({"collection_id", "items"})
-_RENAME_FIELDS = frozenset({"name"})
-_MEDIA_MESSAGE = "Only media files can be added to a collection"
-READ_FAILED = "Collections could not be read."
-CHANGE_FAILED = "The collection could not be changed."
-SOURCES_CHANGED = "The sources changed. Refresh the images and try again."
-FILES_NOT_FOUND = (
-    "None of the selected images could be found. Refresh the images and try again."
-)
-NAME_TAKEN = "Another collection already has this name."
-
-
-class _Refused(Exception):
-    """A request refused before any write; carries its response."""
-
-    def __init__(self, response: web.Response):
-        super().__init__(response.status)
-        self.response = response
-
-
-def _coded(status: int, code: str, message: str, **extra) -> web.Response:
-    return web.json_response(
-        {"success": False, "code": code, "error": message, **extra},
-        status=status,
-        headers={"Cache-Control": "no-store"},
-    )
-
-
-def _collection_response(failure: str) -> Callable:
-    """Map the database's refusals to their status; anything else to a 500."""
-
-    def decorate(handler: Callable) -> Callable:
-        @wraps(handler)
-        async def wrapped(self, request: web.Request) -> web.Response:
-            try:
-                return await handler(self, request)
-            except _Refused as refused:
-                return refused.response
-            except CollectionInvalid as exc:
-                return bad_request(str(exc))
-            except CollectionMissing:
-                return collection_not_found()
-            except CollectionFilesMissing:
-                return _coded(404, "files-not-found", FILES_NOT_FOUND)
-            except CollectionNameTaken as exc:
-                return _coded(
-                    409, "name-taken", NAME_TAKEN, collection_id=exc.collection_id
-                )
-            except Exception:
-                self.logger.exception("Collection request failed")
-                return web.json_response(
-                    {"success": False, "error": failure}, status=500
-                )
-
-        return wrapped
-
-    return decorate
-
-
-def _path_id(request: web.Request) -> int:
-    raw = request.match_info["collection_id"]
-    if not raw.isascii() or _PATH_ID.fullmatch(raw) is None:
-        raise _Refused(bad_request("Invalid collection id"))
-    return int(raw)
-
-
-def _body_id(value: object) -> int:
-    if type(value) is not int or not 1 <= value <= MAX_ID:
-        raise _Refused(bad_request("Invalid collection id"))
-    return value
-
-
-async def _body(request: web.Request, allowed: tuple) -> dict:
-    data, error = await _json_body_or_error(request)
-    if error is not None:
-        raise _Refused(error)
-    if frozenset(data) not in allowed:
-        names = " or ".join(", ".join(sorted(fields)) for fields in allowed)
-        raise _Refused(bad_request(f"Request must contain exactly {names}"))
-    return data
-
-
-class CollectionRoutesMixin:
-    """Mixin providing the collection routes (#331)."""
-
-    def _register_collection_routes(self, routes: web.RouteTableDef) -> None:
-        # The fixed paths go first: "/items" must never match "/{collection_id}".
-        routes.get(BASE)(self.list_collections)
-        routes.post(BASE + "/items")(self.add_collection_items)
-        routes.delete(BASE + "/items")(self.remove_collection_items)
-        routes.get(BASE + "/membership")(self.collection_membership)
-        routes.patch(BASE + "/{collection_id}")(self.rename_collection)
-        routes.delete(BASE + "/{collection_id}")(self.delete_collection)
-
-    # -- reads -------------------------------------------------------------
-
-    @_collection_response(READ_FAILED)
-    async def list_collections(self, request: web.Request) -> web.Response:
-        """Every collection with its listed ``count`` and its ``missing`` rows.
-
-        ``count`` is the members listed under every configured source (one
-        primary-key range read per source, matched against its cached
-        listing); ``missing`` the stored rows beyond it. When a scan or a read
-        fails both are null for every collection and the names still return.
-        """
-        collections = await self._run_in_executor(self.db.list_collections)
-        counts = None
-        if collections:
-            try:
-                counts = await self._collection_counts()
-            except Exception:
-                self.logger.warning(
-                    "Collection counts could not be read", exc_info=True
-                )
-        rows = []
-        for collection in collections:
-            listed, stored = (None, None) if counts is None else counts
-            count = None if listed is None else listed.get(collection["id"], 0)
-            stored_rows = None if stored is None else stored.get(collection["id"], 0)
-            rows.append(
-                {
-                    **collection,
-                    "count": count,
-                    # Clamped: never below zero, whatever the snapshot saw.
-                    "missing": None if count is None else max(0, stored_rows - count),
-                }
-            )
-        return web.json_response({"success": True, "collections": rows})
-
-    async def _collection_counts(self) -> tuple[dict, dict]:
-        """``({id: listed members}, {id: stored rows})`` over every source.
-
-        The scans come from the gallery cache; the root keys (realpath), the
-        listings and one read snapshot of every member and stored count run
-        in the executor, so a write between two reads cannot skew them.
-        """
-        roots = list(self._get_all_output_dirs())
-        root_keys = await self._run_in_executor(
-            lambda: [_favorite_root_key(root) for root in roots]
-        )
-        distinct = {}  # one folder configured twice counts once
-        for root, root_key in zip(roots, root_keys):
-            distinct.setdefault(root_key, root)
-        scans = {
-            root_key: await self._get_gallery_files(root)
-            for root_key, root in distinct.items()
-        }
-        return await self._run_in_executor(self._count_members, distinct, scans)
-
-    def _count_members(self, roots: dict, scans: dict) -> tuple[dict, dict]:
-        """Blocking: match one snapshot's members against each listing."""
-        members, stored = self.db.collection_count_snapshot(list(roots))
-        listed: dict[int, int] = {}
-        for root_key, root in roots.items():
-            listing = self._favorite_listing(root, scans[root_key])
-            for collection_id, keys in members.get(root_key, {}).items():
-                found = sum(1 for key in keys if key in listing)
-                listed[collection_id] = listed.get(collection_id, 0) + found
-        return listed, stored
-
-    @_collection_response(READ_FAILED)
-    async def collection_membership(self, request: web.Request) -> web.Response:
-        """GET ``?root_index&root_scope&path``: the ids holding that file."""
-        query = request.query
-        if len(query) != 3 or set(query) != {"root_index", "root_scope", "path"}:
-            # len() counts a repeated key (?path=a&path=b) twice.
-            return bad_request("Query must name root_index, root_scope and path once")
-        raw_index = query["root_index"]
-        if not raw_index.isascii() or _ROOT_INDEX.fullmatch(raw_index) is None:
-            return bad_request("Invalid gallery root")
-        roots = list(self._get_all_output_dirs())
-        target = {
-            "root_index": int(raw_index),
-            "root_scope": query["root_scope"],
-            "path": query["path"],
-        }
-        root_key, key = await self._run_in_executor(
-            self._collection_key, target, roots, {}
-        )
-        ids = await self._run_in_executor(self.db.file_collections, root_key, key)
-        return web.json_response({"success": True, "collection_ids": ids})
-
-    # -- writes ------------------------------------------------------------
-
-    @_collection_response(CHANGE_FAILED)
-    async def add_collection_items(self, request: web.Request) -> web.Response:
-        """POST ``{collection_id | name, items}``: add the listed files.
-
-        Only files the source's listing holds are added; the rest count in
-        ``not_found``. A new name with nothing to add creates nothing (404
-        ``files-not-found``).
-        """
-        data = await _body(request, _ADD_TARGETS)
-        target = {}
-        if "name" in data:
-            target["name"] = normalize_collection_name(data["name"])
-        else:
-            target["collection_id"] = _body_id(data["collection_id"])
-        roots = list(self._get_all_output_dirs())
-        keys = await self._run_in_executor(self._collection_items, data["items"], roots)
-        found, not_found = [], 0
-        listings = {}
-        for index, root_key, key in keys:
-            if index not in listings:
-                root = roots[index]
-                files = await self._get_gallery_files(root)
-                listings[index] = await self._run_in_executor(
-                    self._favorite_listing, root, files
-                )
-            if key in listings[index]:
-                found.append((root_key, key))
-            else:
-                not_found += 1
-        result = await self._run_in_executor(
-            lambda: self.db.add_to_collection(items=found, **target)
-        )
-        return web.json_response({"success": True, **result, "not_found": not_found})
-
-    @_collection_response(CHANGE_FAILED)
-    async def remove_collection_items(self, request: web.Request) -> web.Response:
-        """DELETE ``{collection_id, items}``: listed or not, every named file."""
-        data = await _body(request, (_REMOVE_FIELDS,))
-        collection_id = _body_id(data["collection_id"])
-        roots = list(self._get_all_output_dirs())
-        keys = await self._run_in_executor(self._collection_items, data["items"], roots)
-        result = await self._run_in_executor(
-            self.db.remove_from_collection,
-            collection_id,
-            [(root_key, key) for _index, root_key, key in keys],
-        )
-        return web.json_response({"success": True, **result})
-
-    @_collection_response(CHANGE_FAILED)
-    async def rename_collection(self, request: web.Request) -> web.Response:
-        """PATCH ``{name}``: a case variant of its own name is allowed."""
-        collection_id = _path_id(request)
-        data = await _body(request, (_RENAME_FIELDS,))
-        name = normalize_collection_name(data["name"])
-        collection = await self._run_in_executor(
-            self.db.rename_collection, collection_id, name
-        )
-        return web.json_response({"success": True, "collection": collection})
-
-    @_collection_response(CHANGE_FAILED)
-    async def delete_collection(self, request: web.Request) -> web.Response:
-        """DELETE: the collection and its members; files are never touched."""
-        collection_id = _path_id(request)
-        await self._run_in_executor(self.db.delete_collection, collection_id)
-        return web.json_response({"success": True, "deleted": True})
-
-    # -- request steps -----------------------------------------------------
-
-    def _collection_items(self, items: object, roots: list) -> list[tuple]:
-        """``(index, root key, relative key)`` per distinct file, in order.
-
-        Blocking (realpath per root, once per request): run in the executor.
-        Every item is checked before anything is written: 400 for a malformed
-        shape, 403 for an unsafe path, 409 for a stale scope. Two spellings
-        that fold to one key (Windows) count once.
-        """
-        if not isinstance(items, list) or not 1 <= len(items) <= MAX_ITEMS:
-            raise _Refused(bad_request(f"items must list 1 to {MAX_ITEMS} images"))
-        keys, sources = {}, {}
-        for item in items:
-            index = item.get("root_index") if isinstance(item, dict) else None
-            root_key, key = self._collection_key(item, roots, sources)
-            keys.setdefault((root_key, key), index)
-        return [(index, root_key, key) for (root_key, key), index in keys.items()]
-
-    def _collection_key(
-        self, item: object, roots: list, sources: dict
-    ) -> tuple[str, str]:
-        """The stored keys of one target, or raise its refusal (blocking).
-
-        *sources* caches ``{index: (scope, root key)}`` for one request, so
-        each root's realpath runs once however many items name it.
-        """
-        target, error = media_target(item, media_message=_MEDIA_MESSAGE)
-        if error is not None:
-            raise _Refused(error)
-        index, scope, relative = target
-        if index >= len(roots):
-            raise _Refused(_coded(409, "source-changed", SOURCES_CHANGED))
-        if index not in sources:
-            sources[index] = (
-                self._gallery_root_scope(roots[index], index),
-                _favorite_root_key(roots[index]),
-            )
-        current, root_key = sources[index]
-        if not hmac.compare_digest(scope, current):
-            raise _Refused(_coded(409, "source-changed", SOURCES_CHANGED))
-        key = _favorite_relative_key(relative)
-        if max(len(root_key), len(key)) > MAX_KEY_LENGTH:
-            # A stored key past the schema bound would fail the next restore.
-            raise _Refused(_forbidden("Path is too long to add to a collection"))
-        return root_key, key
@@ -1,291 +0,0 @@
-"""The shareable diagnostic report (#329 System S12).
-
-``GET /prompt_manager/system/diagnostics`` answers a report built on the
-server from an explicit list of fields: the project and Viewer.js versions,
-Python and the platform, the four checks of the legacy ``GET /diagnostics``
-(one helper, ``admin.legacy_checks``), the database's public info, source
-counts, the log configuration and statistics, the last health summary and
-the configuration keys that only ``config.json`` holds. It never copies
-``PromptManagerConfig.get_config()``: no path leaf is listed, and the CivitAI
-key is reported only as ``has_civitai_api_key``.
-
-Every path in the report goes through ``report_path``: relative to the
-closest public anchor that is not a filesystem root, else ``"outside
-ComfyUI"``, never a basename that could be a user name. As a backstop,
-``scrub`` replaces any string that still looks like an absolute path, holds
-the saved key or the home folder (with or without its root), and counts each
-replacement in ``redacted`` (0 for a correct builder).
-
-The report opens the database, so it takes a registry lease: it is refused
-(409 ``busy``) while an ``exclusive`` job (a restore) runs, and a restore
-waits for it. It is built off the event loop.
-"""
-
-import datetime
-import json
-import ntpath
-import os
-import platform
-import posixpath
-import re
-from pathlib import Path, PurePosixPath, PureWindowsPath
-
-from aiohttp import web
-
-from . import admin as _admin
-from .job_routes import busy_response
-from .jobs import JobBusy
-from .system import health_summary
-
-try:
-    from ...utils.version import project_version
-except ImportError:  # loaded as the top-level ``py`` package (tests)
-    from utils.version import project_version
-
-DIAGNOSTICS_LEASE = "Diagnostics"
-_ROOT = Path(__file__).resolve().parents[2]
-VIEWERJS_PROVENANCE = str(_ROOT / "web" / "lib" / "viewerjs" / "provenance.json")
-OUTSIDE = "outside ComfyUI"
-REMOVED = "[removed]"
-# The CivitAI key is searched for only when it is long enough to be a key.
-MIN_KEY_LENGTH = 8
-_WINDOWS_ABSOLUTE = re.compile(r"^[A-Za-z]:[\\/]")
-
-
-def anchored_path(canonical, anchors, home, pathmod=os.path):
-    """``canonical`` relative to the closest usable anchor, else ``outside ComfyUI``.
-
-    All three are already canonical (``normcase``) in ``pathmod``'s spelling.
-    A filesystem root is never usable, nor is a strict ancestor of ``home``
-    (``/home``, ``C:\\Users``), whose relative paths would start with a user
-    name; so a path inside the home folder needs an anchor at or below it.
-    """
-    flavor = PureWindowsPath if pathmod is ntpath else PurePosixPath
-    target = flavor(canonical)
-    home_path = flavor(home) if home else None
-    usable = []
-    for anchor in map(flavor, anchors):
-        if anchor.parent == anchor:
-            continue
-        if home_path is not None and home_path != anchor:
-            if home_path.is_relative_to(anchor):
-                continue
-        if target.is_relative_to(anchor):
-            usable.append(anchor)
-    if not usable:
-        return OUTSIDE
-    anchor = max(usable, key=lambda a: len(a.parts))
-    return target.relative_to(anchor).as_posix() or "."
-
-
-def _canonical(path):
-    return os.path.normcase(os.path.realpath(str(path)))
-
-
-def report_path(path):
-    """``path`` relative to a public anchor (POSIX style), else ``outside ComfyUI``."""
-    if not path:
-        return ""
-    from ..config import GalleryConfig
-
-    try:
-        canonical = _canonical(path)
-        anchors = [_canonical(anchor) for anchor in GalleryConfig.path_anchors()]
-        home = os.path.expanduser("~")
-        home = _canonical(home) if home and home != "~" else None
-    except (OSError, ValueError):
-        return OUTSIDE
-    return anchored_path(canonical, anchors, home)
-
-
-def _looks_absolute(text):
-    return (
-        posixpath.isabs(text)
-        or ntpath.isabs(text)
-        or _WINDOWS_ABSOLUTE.match(text) is not None
-        or text.startswith("\\\\")
-    )
-
-
-# The home folder is matched only as whole path parts, never inside a word.
-_PART = r"(?<![\w.-]){}(?![\w.-])"
-MIN_HOME_NAME = 3
-
-
-def _home_patterns():
-    """``(pattern, paths_only)`` for the home folder: in full, rootless, its name.
-
-    Accepted residual risk: only this process's own home folder is known, so
-    another user's home (an output folder under /home/<them> while ComfyUI
-    runs as a service account) can still be named by a report path.
-    """
-    home = os.path.expanduser("~")
-    if not home or home == "~" or len(home) < 4 or home in ("/", "\\"):
-        return ()
-    spellings = {home, home.replace("\\", "/")}
-    relative = os.path.splitdrive(home)[1].strip("\\/")
-    for spelling in (relative, relative.replace("\\", "/")):
-        if "/" in spelling or "\\" in spelling:
-            spellings.add(spelling)
-    patterns = [
-        (re.compile(_PART.format(re.escape(spelling)), re.IGNORECASE), False)
-        for spelling in spellings
-    ]
-    name = re.split(r"[\\/]", relative)[-1] if relative else ""
-    if len(name) >= MIN_HOME_NAME:
-        # The bare name only inside a path ("info/x"), not a word ("INFO").
-        patterns.append(
-            (re.compile(_PART.format(re.escape(name)), re.IGNORECASE), True)
-        )
-    return tuple(patterns)
-
-
-def scrub(report, key):
-    """``report`` with leaked paths and the key replaced, counted in ``redacted``."""
-    key = key if isinstance(key, str) and len(key) >= MIN_KEY_LENGTH else None
-    homes = _home_patterns()
-    count = 0
-
-    def clean(value):
-        nonlocal count
-        if isinstance(value, str):
-            if (
-                _looks_absolute(value)
-                or (key and key in value)
-                or any(
-                    pattern.search(value)
-                    for pattern, paths_only in homes
-                    if not paths_only or "/" in value or "\\" in value
-                )
-            ):
-                count += 1
-                return REMOVED
-            return value
-        if isinstance(value, dict):
-            return {name: clean(item) for name, item in value.items()}
-        if isinstance(value, (list, tuple)):
-            return [clean(item) for item in value]
-        return value
-
-    cleaned = clean(report)
-    cleaned["redacted"] = int(cleaned.get("redacted") or 0) + count
-    return cleaned
-
-
-def viewerjs_version(path=None):
-    """The pinned Viewer.js version from its provenance file, or ``unknown``."""
-    try:
-        with open(path or VIEWERJS_PROVENANCE, encoding="utf-8") as handle:
-            version = json.load(handle).get("version")
-    except (OSError, ValueError, AttributeError):
-        return "unknown"
-    return version if isinstance(version, str) and version else "unknown"
-
-
-def public_config():
-    """The configuration keys only ``config.json`` holds, from an explicit list."""
-    from ..config import GalleryConfig, IntegrationConfig, PromptManagerConfig
-
-    return {
-        "database": {
-            "enable_duplicate_detection": (
-                PromptManagerConfig.ENABLE_DUPLICATE_DETECTION
-            ),
-            "enable_auto_save": PromptManagerConfig.ENABLE_AUTO_SAVE,
-        },
-        "web_ui": {
-            "result_timeout": PromptManagerConfig.RESULT_TIMEOUT,
-            "show_test_button": PromptManagerConfig.SHOW_TEST_BUTTON,
-            "webui_display_mode": PromptManagerConfig.WEBUI_DISPLAY_MODE,
-            "infinite_scroll": PromptManagerConfig.INFINITE_SCROLL,
-        },
-        "performance": {
-            "max_search_results": PromptManagerConfig.MAX_SEARCH_RESULTS,
-            "enable_fuzzy_search": PromptManagerConfig.ENABLE_FUZZY_SEARCH,
-            "auto_backup_interval": PromptManagerConfig.AUTO_BACKUP_INTERVAL,
-            "worker_threads": PromptManagerConfig.WORKER_THREADS,
-        },
-        "gallery": {
-            "processing_delay": GalleryConfig.PROCESSING_DELAY,
-            "prompt_timeout": GalleryConfig.PROMPT_TIMEOUT,
-            "cleanup_interval": GalleryConfig.CLEANUP_INTERVAL,
-            "auto_cleanup_missing_files": GalleryConfig.AUTO_CLEANUP_MISSING_FILES,
-            "max_image_age_days": GalleryConfig.MAX_IMAGE_AGE_DAYS,
-            "max_concurrent_processing": GalleryConfig.MAX_CONCURRENT_PROCESSING,
-            "metadata_extraction_timeout": GalleryConfig.METADATA_EXTRACTION_TIMEOUT,
-            # config.json gallery.monitoring.save_foreign_runs (#247)
-            "save_foreign_runs": GalleryConfig.SAVE_FOREIGN_RUNS,
-        },
-        "integrations": {
-            "lora_manager_enabled": bool(IntegrationConfig.LORA_MANAGER_ENABLED),
-            "has_civitai_api_key": bool(IntegrationConfig.CIVITAI_API_KEY),
-        },
-    }
-
-
-def _source_counts(sources):
-    configured = sources.get("configured") or []
-    effective = sources.get("effective") or []
-    return {
-        "configured": len(configured),
-        "effective": len(effective),
-        "watching": sum(1 for row in effective if row.get("watch") == "watching"),
-        "unavailable": sum(1 for row in configured if row.get("valid") is False),
-    }
-
-
-class DiagnosticsReportMixin:
-    """Mixin providing ``GET /prompt_manager/system/diagnostics``."""
-
-    def _register_diagnostics_report_routes(self, routes):
-        @routes.get("/prompt_manager/system/diagnostics")
-        async def diagnostics_report_route(request):
-            return await self.get_diagnostics_report(request)
-
-    async def get_diagnostics_report(self, request):
-        """The report, built off the loop under a lease (409 ``busy`` in a restore)."""
-        from ..config import IntegrationConfig
-
-        try:
-            async with self._jobs.lease(DIAGNOSTICS_LEASE):
-                report = await self._run_in_executor(self.build_report)
-        except JobBusy as busy:
-            return busy_response(busy)
-        except Exception:
-            self.logger.exception("The diagnostic report could not be built")
-            return web.json_response(
-                {
-                    "success": False,
-                    "code": None,
-                    "error": "The diagnostic report could not be built.",
-                },
-                status=500,
-            )
-        report = scrub(report, IntegrationConfig.CIVITAI_API_KEY)
-        return web.json_response(report, headers={"Cache-Control": "no-store"})
-
-    def build_report(self):
-        """The report's fields (blocking: reads the database and the log folder)."""
-        db = self.db
-        manager = self._get_logger_manager()
-        stats = dict(manager.get_log_stats())
-        stats["log_directory"] = report_path(stats.get("log_directory"))
-        info = dict(db.model.get_database_info() or {})
-        if "database_path" in info:
-            info["database_path"] = report_path(info["database_path"])
-        sources, _monitor = self._source_status()
-        return {
-            "success": True,
-            "generated_at": datetime.datetime.now().replace(microsecond=0).isoformat(),
-            "version": project_version(_ROOT),
-            "python": platform.python_version(),
-            "platform": {"system": platform.system(), "release": platform.release()},
-            "viewerjs": viewerjs_version(VIEWERJS_PROVENANCE),
-            "checks": _admin.legacy_checks(db.model.db_path, report_path),
-            "database_info": info,
-            "sources": _source_counts(sources),
-            "logging": {"config": dict(manager.get_config()), "stats": stats},
-            "health": health_summary(self._current_health_report()),
-            "config": public_config(),
-            "redacted": 0,
-        }
@@ -1,802 +0,0 @@
-"""Duplicate image files on the job registry (#249 System S6, Task 17).
-
- ``POST /prompt_manager/jobs/duplicates`` starts the find (202 ``{job}``):
-  kind ``duplicates``, "Find duplicate image files", admission ``read``,
-  cancellable, outcome group ``groups_found``. It hashes the media files of
-  every effective source (``_hash_media_groups``, shared with the legacy
-  scan) and the server keeps the groups it found under the job id: content
-  hash, root-relative paths and each file's source index. A find is refused
-  while a duplicate removal runs, and one find runs at a time.
- ``GET /prompt_manager/maintenance/duplicates/{job_id}?offset&limit`` pages
-  those groups, at most ``MAX_GROUP_PAGE`` at a time: ``{success, job:{id,
-  state}, total, offset, limit, groups:[{group_id, size, count, files}]}``.
-  Each file names its root-relative ``path``, its source's public label and
-  index and the Images serve URLs; never an absolute path.
- ``POST /prompt_manager/maintenance/preview {operation:"duplicate_files",
-  options:{job_id, keep:[{group_id, root_index, path}]}}`` reviews a removal:
-  in each group named, the files kept are the ones listed and every other
-  copy is removed. Each keeper and each removal is checked against the held
-  group, with containment decided as text before any filesystem access
-  (``file_problem``): inside its source, a media file outside
-  ``thumbnails``, then a regular file (not a link) whose resolved path is
-  still inside the source, with the same size and content hash. A removal
-  that fails, or whose kept copy fails, is protected and listed with the
-  reason. The plan carries the files' database links, which move to the
-  kept copy.
- ``POST /prompt_manager/maintenance/apply {token}`` runs the reviewed plan
-  as the ``duplicate_cleanup`` job: admission ``records``, not cancellable,
-  groups ``removed``, ``kept`` and ``errors``. It checks the sources are
-  unchanged, takes the safety backup the policy promises (the database only;
-  removed files are not in it), then for each removal rechecks its kept copy
-  and the file itself (``file_problem``) and removes it with every handle
-  closed (``_unlink``), together with its thumbnail. A file that changed is
-  kept; the first unlink that fails stops the job, a locked file with the
-  coded ``LOCKED_FILE`` message (never the OS text), and the files after it
-  are not attempted. The database links of the files actually removed then
-  move to their kept copy (``PromptDatabase.move_file_links``).
-
-The legacy gallery routes (``/scan_duplicates``, its stream and status, and
-``/delete_duplicate_images``) keep their shapes on the same registry kinds;
-see ``py/api/admin.py``.
-"""
-
-import asyncio
-import os
-from pathlib import Path
-
-from aiohttp import web
-
-from .admin import DUPLICATE_FIND_LEGACY_TITLE, _remove_thumbnail
-from .duplicate_review import (  # noqa: F401 (CHANGED, OUTSIDE_SOURCE: public)
-    CHANGED,
-    DELETE_FAILED,
-    FIND_CANCELLED,
-    FIND_ERROR_EVENT,
-    FIND_FAILED,
-    GONE,
-    KEEPER,
-    KEEPER_CHANGED,
-    KEEPER_GONE,
-    KEEPER_WENT,
-    KEPT_COPY,
-    LOCKED_FILE,
-    MAYBE_SAME_FILE,
-    NO_FILE_ID_ROW,
-    NOT_ATTEMPTED,
-    OUTSIDE_SOURCE,
-    RECORDS_FAILED,
-    REVIEW_KEPT_DETAILS,
-    ROW_DETAILS,
-    SAME_FILE,
-    SOURCES_CHANGED,
-    SOURCES_CHANGED_REVIEW,
-    HeldFind,
-    SourcesChanged,
-    _fingerprint,
-    _group_order,
-    _identity,
-    _parse_options,
-    _plural,
-    _public_plan,
-    _select,
-    file_problem,
-    human_bytes,
-    still_kept,
-)
-from .duplicate_spellings import Spellings, copy_move
-from .images import _favorite_root_key, _output_image_entry
-from .job_routes import busy_response
-from .jobs import (
-    DUPLICATE_CLEANUP_GROUP_NAMES,
-    DUPLICATE_CLEANUP_JOB_KIND,
-    DUPLICATE_GROUP_NAMES,
-    DUPLICATES_JOB_KIND,
-    JobBusy,
-)
-from .maintenance import DUPLICATE_FILES, _fail_job, _failure, _invalid, backup_note
-
-try:
-    from ...database.duplicate_copies import FILE_LINK_SQL
-except ImportError:
-    from database.duplicate_copies import FILE_LINK_SQL
-
-DUPLICATE_FIND_TITLE = "Find duplicate image files"
-DUPLICATE_CLEANUP_TITLE = "Remove duplicate image files"
-MAX_GROUP_PAGE = 10  # groups a page lists (D69: ten at a time)
-MAX_HELD_FINDS = 3  # finds whose groups the server keeps for review
-favorite_root_key = _favorite_root_key
-
-
-def query_plan_sql():
-    """The link reconciliation's statements (EXPLAIN QUERY PLAN checks)."""
-    return list(FILE_LINK_SQL)
-
-
-def _unlink(path):
-    """Remove one file (the caller closed every handle on it)."""
-    os.remove(path)
-
-
-class DuplicateFilesMixin:
-    """Mixin providing the duplicate-file find, its groups and its removal."""
-
-    def _register_duplicate_routes(self, routes):
-        @routes.post("/prompt_manager/jobs/duplicates")
-        async def start_duplicate_find_route(request):
-            return await self.start_duplicate_find(request)
-
-        @routes.get("/prompt_manager/maintenance/duplicates/{job_id}")
-        async def duplicate_groups_route(request):
-            return await self.duplicate_groups(request)
-
-    # ── find ──────────────────────────────────────────────────────────
-
-    async def start_duplicate_find(self, request):
-        """Start the duplicate find (202), or 409 naming the job in the way."""
-        try:
-            job = self._start_duplicate_find(origin="workspace")
-        except JobBusy as busy:
-            return busy_response(busy)
-        return web.json_response({"success": True, "job": job.summary()}, status=202)
-
-    def _start_duplicate_find(self, origin):
-        """Register a find job (on the loop); raises JobBusy.
-
-        A workspace find walks every effective source; a gallery one the
-        gallery's output folder, as the legacy scan did. Both resolve their
-        folders when the job begins, so a source change later cannot move it.
-        """
-        cleanup = self._jobs.active(DUPLICATE_CLEANUP_JOB_KIND)
-        if cleanup is not None:
-            raise JobBusy(cleanup)
-        held = HeldFind(origin)
-        if origin == "workspace":
-            title = DUPLICATE_FIND_TITLE
-        else:
-            title = DUPLICATE_FIND_LEGACY_TITLE
-        job = self._jobs.start(
-            DUPLICATES_JOB_KIND,
-            title,
-            admission="read",
-            cancellable=True,
-            groups=DUPLICATE_GROUP_NAMES,
-            runner=lambda job: self._run_duplicate_find(job, held),
-        )
-        held.job_id = job.id
-        self._remember_find(held)
-        return job
-
-    def _remember_find(self, held):
-        finds = self._duplicate_finds
-        finds[held.job_id] = held
-        for job_id in list(finds):
-            if self._jobs.get(job_id) is None:
-                del finds[job_id]
-        while len(finds) > MAX_HELD_FINDS:
-            del finds[next(iter(finds))]
-
-    def _find_covers(self, job, legacy_dir):
-        held = self._duplicate_finds.get(job.id)
-        return held is not None and held.covers(legacy_dir)
-
-    def _latest_duplicate_find(self):
-        """The running find, else the newest finished one this session."""
-        for job in self._jobs.list():
-            if job.kind == DUPLICATES_JOB_KIND and job.id in self._duplicate_finds:
-                return job
-        return None
-
-    def _resolve_find_roots(self, held):
-        """Fill in where a find looks (blocking): sources and the gallery folder."""
-        listed = [os.path.abspath(str(d)) for d in self._get_all_output_dirs()]
-        held.legacy_dir = self._find_comfyui_output_dir()
-        if held.origin == "workspace":
-            held.roots = list(enumerate(listed))
-            return
-        if not held.legacy_dir or not os.path.isdir(held.legacy_dir):
-            self.logger.warning("ComfyUI output directory not found")
-            held.roots = []
-            return
-        legacy = os.path.abspath(held.legacy_dir)
-        index = next(
-            (i for i, d in enumerate(listed) if _identity(d) == _identity(legacy)),
-            None,
-        )
-        held.roots = [(index, legacy)]
-
-    def _find_progress(self, job, done, total):
-        if done < job.processed:
-            return  # hashing threads report out of order; keep the count rising
-        pct = int(done / total * 100) if total else 100
-        job.update(
-            processed=done,
-            total=total,
-            status_line=f"Hashing file {done:,} of {total:,}",
-        )
-        job.publish(
-            {
-                "type": "progress",
-                "progress": pct,
-                "status": f"Hashing file {done}/{total}...",
-                "processed": done,
-                "found": 0,
-            }
-        )
-
-    async def _run_duplicate_find(self, job, held):
-        loop = asyncio.get_running_loop()
-
-        def report(done, total):  # from the hashing threads
-            loop.call_soon_threadsafe(self._find_progress, job, done, total)
-
-        try:
-            job.update(status_line="Looking for media files")
-            job.publish(
-                {
-                    "type": "progress",
-                    "progress": 0,
-                    "status": "Collecting media files...",
-                    "processed": 0,
-                    "found": 0,
-                }
-            )
-            await self._run_in_executor(self._resolve_find_roots, held)
-            job.scope["output_folders"] = len(held.roots)
-            job.log_line(f"Searching {_plural(len(held.roots), 'source')}")
-            groups = await self._run_in_executor(
-                self._hash_media_groups,
-                [root for _index, root in held.roots],
-                report,
-                lambda: job.cancelled,
-            )
-            if job.cancelled:
-                job.update(status_line="Cancelled; nothing was changed.")
-                job.publish({"type": "error", "message": FIND_CANCELLED})
-                job.finish("cancelled")
-                return
-            await self._finish_find(job, held, groups)
-        except Exception:
-            self.logger.exception("Duplicate search failed")
-            job.update(status_line=FIND_FAILED)
-            job.publish({"type": "error", "message": FIND_ERROR_EVENT})
-            job.finish("failed")
-
-    async def _finish_find(self, job, held, groups):
-        for group in groups:
-            group["group_id"] = group["hash"]
-            for record in group["files"]:
-                index, root = held.roots[record.pop("slot")]
-                record["root_index"] = index
-                record["root"] = root
-        groups.sort(key=_group_order)
-        held.groups = groups
-        labels = {root: self._public_path(root) for _index, root in held.roots}
-        rows = [
-            {
-                "path": group["files"][0]["rel"],
-                "root": labels[group["files"][0]["root"]],
-                "root_index": group["files"][0]["root_index"],
-                "detail": f"{len(group['files'])} identical files · "
-                f"{human_bytes(group['size'])} each",
-            }
-            for group in groups
-        ]
-        job.record_counted("groups_found", len(groups), rows)
-        line = f"Found {_plural(len(groups), 'group')} of duplicate files"
-        job.log_line(line)
-        legacy = []
-        if held.covers(held.legacy_dir) and held.legacy_dir:
-            legacy = await self._run_in_executor(
-                self._legacy_duplicate_groups, groups, held.legacy_dir
-            )
-        # Every file was read by now (the last reports may still be queued).
-        job.update(progress=100, status_line=line, processed=job.total)
-        job.publish(
-            {
-                "type": "complete",
-                "processed": job.processed,
-                "found": len(legacy),
-                "duplicates": legacy,
-                "message": f"Found {len(legacy)} groups of duplicate images",
-            }
-        )
-
-    # ── groups ────────────────────────────────────────────────────────
-
-    def _held_result(self, job_id):
-        """``(held, None)`` for a finished find's groups, else an error reply."""
-        held = self._duplicate_finds.get(job_id)
-        job = self._jobs.get(job_id)
-        if held is None or job is None or job.kind != DUPLICATES_JOB_KIND:
-            return None, _failure(
-                "No duplicate search with this id. Search again.", 404, "not-found"
-            )
-        if job.running:
-            return None, _failure(
-                "The duplicate search is still running.", 409, "job-running"
-            )
-        if held.groups is None:
-            return None, _failure(
-                "This search did not finish. Search again.", 409, "no-groups"
-            )
-        return held, None
-
-    async def duplicate_groups(self, request):
-        """One page of a finished find's groups (at most MAX_GROUP_PAGE)."""
-        try:
-            offset = int(request.query.get("offset", "0"))
-            limit = int(request.query.get("limit", str(MAX_GROUP_PAGE)))
-        except ValueError:
-            return _invalid("offset and limit must be whole numbers")
-        if offset < 0 or not 0 < limit <= MAX_GROUP_PAGE:
-            return _invalid(f"limit must be 1 to {MAX_GROUP_PAGE}; offset 0 or more")
-        job_id = request.match_info["job_id"]
-        held, error = self._held_result(job_id)
-        if error is not None:
-            return error
-        page = held.groups[offset : offset + limit]
-        groups = await self._run_in_executor(self._describe_groups, page)
-        job = self._jobs.get(job_id)
-        return web.json_response(
-            {
-                "success": True,
-                "job": {"id": job.id, "state": job.state},
-                "total": len(held.groups),
-                "offset": offset,
-                "limit": limit,
-                "groups": groups,
-            },
-            headers={"Cache-Control": "no-store"},
-        )
-
-    def _describe_groups(self, groups):
-        """Public group rows (blocking: one stat per file)."""
-        return [
-            {
-                "group_id": group["group_id"],
-                "size": group["size"],
-                "count": len(group["files"]),
-                "files": [self._describe_copy(record) for record in group["files"]],
-            }
-            for group in groups
-        ]
-
-    def _describe_copy(self, record):
-        label = self._public_path(record["root"])
-        base = {
-            "filename": os.path.basename(record["rel"]),
-            "path": record["rel"],
-            "root": label,
-            "root_index": record["root_index"],
-            "url": None,
-            "thumbnail_url": None,
-            "size": record["size"],
-            "modified_time": record["mtime"],
-            "media_type": "image",
-            "missing": False,
-        }
-        if record["root_index"] is None:
-            return base
-        try:
-            entry = _output_image_entry(
-                Path(record["abs"]), Path(record["root"]), record["root_index"], label
-            )
-        except (OSError, ValueError):
-            return {**base, "missing": True}
-        return {
-            **base,
-            "url": entry["url"],
-            "thumbnail_url": entry["thumbnail_url"],
-            "size": entry["size"],
-            "modified_time": entry["modified_time"],
-            "media_type": entry["media_type"],
-        }
-
-    # ── review ────────────────────────────────────────────────────────
-
-    def _listed_sources(self):
-        """``{identity: index}`` of the effective sources now (blocking)."""
-        return {
-            _identity(d): index for index, d in enumerate(self._get_all_output_dirs())
-        }
-
-    @staticmethod
-    def _source_listed(listed, index, root):
-        return index is not None and listed.get(_identity(root)) == index
-
-    async def preview_duplicate_files(self, options):
-        """The ``duplicate_files`` plan for one finished find and its keepers."""
-        job_id, keep, message = _parse_options(options)
-        if message:
-            return _invalid(message)
-        held, error = self._held_result(job_id)
-        if error is not None:
-            return error
-        selection, message = _select(held, keep)
-        if message:
-            return _invalid(message)
-        db = self.db
-        identity = self._database_identity(db)
-        try:
-            review = await self._run_in_executor(
-                self._review_duplicate_files, db, selection
-            )
-        except SourcesChanged:
-            return _failure(SOURCES_CHANGED_REVIEW, 409, "sources-changed")
-        except Exception:
-            self.logger.exception("Duplicate file review failed")
-            return _failure("Failed to review maintenance", 500)
-        return await self._plan_response(
-            db,
-            identity,
-            DUPLICATE_FILES,
-            review["fingerprint"],
-            review["public"],
-            {
-                "targets": review["targets"],
-                "kept": review["kept"],
-                "held": review["held"],
-                "protected": review["public"]["protected"]["count"],
-            },
-        )
-
-    def _review_duplicate_files(self, db, selection):
-        """Check every keeper and removal now (blocking); the plan's parts.
-
-        No file is read: each copy is bound to what the search saw by its
-        size, mtime and inode, and never to its kept copy itself. The removal
-        job hashes each file again right before it unlinks it.
-        """
-        listed = self._listed_sources()
-        targets, kept, protected, held = [], [], {}, []
-        for group, keepers in selection.values():
-            removals = [r for r in group["files"] if r not in keepers]
-            for record in removals:
-                if record["root_index"] is not None and not self._source_listed(
-                    listed, record["root_index"], record["root"]
-                ):
-                    raise SourcesChanged(record["root"])
-            keeper = next(
-                (k for k in keepers if _bound_problem(k, group) is None), None
-            )
-            reviewed = []
-            for record in removals:
-                if keeper is None:
-                    problem = KEEPER
-                elif record["root_index"] is None:
-                    problem = OUTSIDE_SOURCE
-                else:
-                    problem = _bound_problem(record, group, keeper)
-                if problem:
-                    protected[problem] = protected.get(problem, 0) + 1
-                    held.append(self._copy_row(record, REVIEW_KEPT_DETAILS[problem]))
-                    continue
-                reviewed.append(self._target(group, record, keeper))
-            if reviewed:
-                targets.extend(reviewed)
-                kept.append(self._copy_row(keeper, KEPT_COPY))
-        records = {}
-        if targets:
-            spellings = self._source_spellings()
-            records = db.count_copy_records(
-                {
-                    t["abs"]: {
-                        "spellings": list(spellings.of(t["abs"]).values()),
-                        "locator": t["locator"],
-                        "sha256": t["hash"],
-                    }
-                    for t in targets
-                }
-            )
-        return {
-            "targets": targets,
-            "kept": kept,
-            "held": held,
-            "fingerprint": _fingerprint(targets),
-            "public": _public_plan(targets, protected, records),
-        }
-
-    def _source_spellings(self):
-        """The folder spellings records may name files by (blocking).
-
-        The search walks each source's real path, while a record names a file
-        as it was seen when written: under the folder the image monitor
-        watches, the configured spelling, ComfyUI's output folder, a symlink
-        to it, or a parent of a source added later. ``Spellings`` matches
-        them to each file by containment (``py/api/duplicate_spellings.py``).
-        """
-        from ..config import GalleryConfig
-
-        listed = [os.path.abspath(str(d)) for d in self._get_all_output_dirs()]
-        candidates = list(self._monitored_directories())
-        candidates += list(GalleryConfig.MONITORING_DIRECTORIES)
-        try:
-            import folder_paths
-
-            candidates.append(folder_paths.get_output_directory())
-        except Exception:  # nosec B110 - outside ComfyUI there is none
-            pass
-        candidates.append(self._find_comfyui_output_dir())
-        folders = [
-            os.path.abspath(str(c)) for c in candidates if c and os.path.isabs(str(c))
-        ]
-        return Spellings(folders + listed, listed)
-
-    def _target(self, group, record, keeper):
-        return {
-            "group_id": group["group_id"],
-            "hash": group["hash"],
-            "size": record["size"],
-            "root_index": record["root_index"],
-            "root": record["root"],
-            "root_label": self._public_path(record["root"]),
-            "abs": record["abs"],
-            "rel": record["rel"],
-            "keeper_abs": keeper["abs"],
-            "keeper_rel": keeper["rel"],
-            "keeper_root": keeper["root"],
-            "keeper_size": keeper["size"],
-            "locator": os.path.normcase(record["abs"]),
-            "keeper_locator": os.path.normcase(keeper["abs"]),
-        }
-
-    def _copy_row(self, record, detail):
-        return {
-            "path": record["rel"],
-            "root": self._public_path(record["root"]),
-            "root_index": record["root_index"],
-            "detail": detail,
-        }
-
-    # ── removal ───────────────────────────────────────────────────────
-
-    def _start_duplicate_cleanup(self, db, plan, backup_on):
-        """Register the removal job for a reviewed plan (on the loop)."""
-        find = self._jobs.active(DUPLICATES_JOB_KIND)
-        if find is not None:
-            raise JobBusy(find)
-        return self._jobs.start(
-            DUPLICATE_CLEANUP_JOB_KIND,
-            DUPLICATE_CLEANUP_TITLE,
-            admission="records",
-            cancellable=False,
-            scope={"operation": DUPLICATE_FILES},
-            groups=DUPLICATE_CLEANUP_GROUP_NAMES,
-            runner=lambda job: self._run_duplicate_cleanup(job, db, plan, backup_on),
-        )
-
-    def _sources_unchanged(self, targets):
-        listed = self._listed_sources()
-        return all(
-            self._source_listed(listed, t["root_index"], t["root"]) for t in targets
-        )
-
-    async def _run_duplicate_cleanup(self, job, db, plan, backup_on):
-        targets = plan.payload["targets"]
-        unchanged = await self._run_in_executor(self._sources_unchanged, targets)
-        if not unchanged:
-            return _fail_job(job, "sources-changed", SOURCES_CHANGED)
-        ok, backup = await self._safety_backup_step(job, db, backup_on)
-        if not ok:
-            return None
-        try:
-            await self._remove_duplicates(job, db, plan, backup)
-        finally:
-            if backup:
-                await self._prune_backup_pool(job, db)
-        return None
-
-    async def _remove_duplicates(self, job, db, plan, backup):
-        targets = plan.payload["targets"]
-        # #586: every copy the review protected, with its reason, and the
-        # whole group in the report.
-        held = plan.payload["held"]
-        job.record_counted("kept", len(held), held, complete=True)
-        if held:
-            copies = _plural(len(held), "copy", "copies")
-            job.log_line(f"Kept {copies} the review protected")
-        for row in plan.payload["kept"]:
-            job.record("kept", row, f"= {row['root']}/{row['path']} · {KEPT_COPY}")
-        job.update(total=len(targets), status_line="Removing duplicate files")
-        spellings = await self._run_in_executor(self._source_spellings)
-        removed, failure, keepers = 0, None, {}
-        totals = dict.fromkeys(
-            ("moved", "merged", "favorites", "tags", "review", "collections"), 0
-        )
-        totals["categories"] = 0  # image categories kept on the kept copies (#332)
-        for done, target in enumerate(targets, start=1):
-            if failure is not None:
-                self._record_target(job, "kept", target, NOT_ATTEMPTED)
-                continue
-            outcome, detail, counts = await self._run_in_executor(
-                self._remove_one_duplicate, db, target, keepers, spellings
-            )
-            for key, value in (counts or {}).items():
-                totals[key] += value
-            if outcome == "removed":
-                removed += 1
-                text = f"A copy of {target['keeper_rel']}"
-                self._record_target(job, "removed", target, text, "-")
-            elif outcome == "kept":
-                self._record_target(job, "kept", target, ROW_DETAILS[detail])
-            else:
-                failure = detail
-                self._record_target(job, "errors", target, detail, "!")
-            job.update(processed=done, progress=int(done / len(targets) * 100))
-        if removed:
-            self.invalidate_gallery_cache()
-        self._log_moved_records(job, totals)
-        line = f"Removed {_plural(removed, 'duplicate file')}"
-        if removed < len(targets):
-            line += f", {len(targets) - removed:,} not removed"
-        job.log_line(line)
-        if failure is not None:
-            line = f"Stopped after an error · {line}"
-        job.update(progress=100, status_line=f"{line} · {backup_note(backup)}")
-        if failure is not None:
-            job.publish({"type": "error", "code": "delete-failed", "message": line})
-            job.finish("failed")
-
-    @staticmethod
-    def _log_moved_records(job, totals):
-        links = totals["moved"] + totals["merged"]
-        if links:
-            job.log_line(f"Moved {_plural(links, 'database link')} to the kept copies")
-        if totals["favorites"]:
-            job.log_line(
-                f"Moved {_plural(totals['favorites'], 'favorite')} to the kept copies"
-            )
-        if totals["collections"]:
-            job.log_line(
-                f"Moved {_plural(totals['collections'], 'collection membership')} "
-                "to the kept copies"
-            )
-        if totals["tags"]:
-            job.log_line(
-                f"Added {_plural(totals['tags'], 'image tag')} to the kept copies"
-            )
-        if totals.get("categories"):
-            kept = _plural(totals["categories"], "image category", "image categories")
-            job.log_line(f"Kept {kept} on the kept copies")
-        if totals["review"]:
-            job.log_line(
-                f"Settled {_plural(totals['review'], 'Needs review item')} "
-                "of removed copies"
-            )
-
-    @staticmethod
-    def _record_target(job, group, target, detail, mark="="):
-        row = {
-            "path": target["rel"],
-            "root": target["root_label"],
-            "root_index": target["root_index"],
-            "detail": detail,
-        }
-        job.record(
-            group, row, f"{mark} {target['root_label']}/{target['rel']} · {detail}"
-        )
-
-    def _remove_one_duplicate(self, db, target, keepers, spellings):
-        """``(outcome, detail, counts)`` for one reviewed removal (blocking).
-
-        The kept copy (once per group; cached in ``keepers``) and the file
-        are checked again, hashes included, and the file must not be its kept
-        copy. Then the file's records move to the kept copy in one short
-        transaction, and only then is the file unlinked: a crash or a failed
-        unlink leaves its records on the identical kept copy, never on a
-        deleted file. A failed move leaves the file and its records alone.
-        """
-        hasher = self._calculate_file_hash
-        group_id = target["group_id"]
-        if group_id not in keepers:
-            keepers[group_id] = _kept_copy_state(target, hasher)
-        if keepers[group_id] is None:
-            return "kept", KEEPER, None
-        problem = file_problem(
-            target["abs"],
-            target["root"],
-            target["hash"],
-            target["size"],
-            hasher,
-            keeper=target["keeper_abs"],
-            keeper_root=target["keeper_root"],
-        )
-        if problem:
-            return "kept", problem, None
-        try:
-            # Held open until the unlink: on Windows, deleting the kept copy
-            # itself through another path then fails instead of removing it.
-            hold = open(target["keeper_abs"], "rb")
-        except OSError:
-            return "kept", KEEPER, None
-        with hold:
-            return self._move_then_unlink(
-                db, target, keepers[group_id], spellings, hold
-            )
-
-    def _move_then_unlink(self, db, target, kept_stat, spellings, hold):
-        try:
-            counts = db.move_copy_records(copy_move(target, kept_stat, spellings))
-        except Exception:
-            self.logger.exception(f"Could not move the records of {target['rel']}")
-            return "error", RECORDS_FAILED, None
-        if not still_kept(target, hold):
-            # The kept copy went away or changed while the records moved:
-            # keep this file and give its records back to it.
-            return "kept", KEEPER_GONE, self._move_back(db, target, spellings)
-        try:
-            _unlink(target["abs"])
-        except FileNotFoundError:
-            return "removed", None, counts
-        except PermissionError:
-            self.logger.warning(
-                f"Duplicate file is locked: {target['rel']}; "
-                "its records now name the kept copy"
-            )
-            return "error", LOCKED_FILE, counts
-        except OSError:
-            self.logger.warning(
-                f"Could not delete duplicate file {target['rel']}; "
-                "its records now name the kept copy",
-                exc_info=True,
-            )
-            return "error", DELETE_FAILED, counts
-        self.logger.info(f"Deleted duplicate file: {target['rel']}")
-        _remove_thumbnail(Path(target["root"]), Path(target["rel"]), self.logger)
-        return "removed", None, counts
-
-    def _move_back(self, db, target, spellings):
-        """Give the kept copy's records to the file that stays (blocking)."""
-        swapped = {
-            **target,
-            "abs": target["keeper_abs"],
-            "root": target["keeper_root"],
-            "rel": target["keeper_rel"],
-            "locator": target["keeper_locator"],
-            "keeper_abs": target["abs"],
-            "keeper_root": target["root"],
-            "keeper_rel": target["rel"],
-            "keeper_locator": target["locator"],
-        }
-        try:
-            return db.move_copy_records(
-                copy_move(swapped, os.stat(target["abs"]), spellings)
-            )
-        except Exception:
-            self.logger.exception(f"Could not give the records back to {target['rel']}")
-            return None
-
-
-def _bound_problem(record, group, keeper=None):
-    """``file_problem`` without reading the file: size, mtime and inode.
-
-    ``keeper`` is the kept copy's record, never offered as a copy of itself.
-    """
-    return file_problem(
-        record["abs"],
-        record["root"],
-        group["hash"],
-        record["size"],
-        hash_check=False,
-        mtime_ns=record.get("mtime_ns"),
-        inode=record.get("inode"),
-        keeper=keeper["abs"] if keeper else None,
-        keeper_root=keeper["root"] if keeper else None,
-    )
-
-
-def _kept_copy_state(target, hasher):
-    """The kept copy's ``os.stat`` when it is still the reviewed bytes, else None."""
-    problem = file_problem(
-        target["keeper_abs"],
-        target["keeper_root"],
-        target["hash"],
-        target["keeper_size"],
-        hasher,
-    )
-    if problem:
-        return None
-    try:
-        return os.stat(target["keeper_abs"])
-    except OSError:
-        return None
@@ -1,472 +0,0 @@
-"""Reviewing duplicate image files: the checks and the plan (#249 S6, T17).
-
-Pure helpers of ``py/api/duplicate_files.py``: the keep-list parsing, the
-per-file check ``file_problem`` (containment decided as text before any
-filesystem access, then a regular file of the found size and hash) and the
-public ``duplicate_files`` plan.
-"""
-
-import hashlib
-import json
-import os
-import stat as stat_module
-from dataclasses import dataclass, field
-from pathlib import Path
-
-from .admin import DELETABLE_MEDIA_EXTENSIONS
-from .maintenance import DUPLICATE_FILES
-
-try:
-    from ...utils.media_folders import in_trash_below_roots, is_trash_folder
-except ImportError:
-    from utils.media_folders import in_trash_below_roots, is_trash_folder
-
-# Keep entries one review takes; with paths of a few hundred characters the
-# list stays inside the preview body cap (DUPLICATE_PREVIEW_BODY_MAX, 1 MiB).
-MAX_KEEP = 2000
-MAX_DETAILS = 50
-MAX_JOB_ID = 64
-HASH_CHUNK = 1024 * 1024
-
-# What ``file_problem`` finds, and how a plan counts it as protected.
-OUTSIDE_SOURCE = "outside"
-LINK = "link"
-CHANGED_CONTENT = "changed"
-GONE = "gone"
-UNREADABLE = "unreadable"
-KEEPER = "keeper"
-SAME = "same"
-MAYBE_SAME = "maybe-same"
-NO_FILE_ID = "no-file-id"
-# Two mounts of one share may round mtimes differently (SMB keeps 100 ns,
-# FAT 2 s): within this, equal sizes on another device may be one file.
-MOUNT_MTIME_SLACK_NS = 2_000_000_000
-PROTECTED_REASONS = {
-    MAYBE_SAME: (
-        "file may be the same file reached through another mount or share",
-        "files may be the same file reached through another mount or share",
-    ),
-    NO_FILE_ID: (
-        "file: can't confirm this is a separate file on this drive",
-        "files: can't confirm these are separate files on this drive",
-    ),
-    SAME: (
-        "file is the same file as its kept copy",
-        "files are the same file as their kept copy",
-    ),
-    OUTSIDE_SOURCE: (
-        "file is not inside a configured source",
-        "files are not inside a configured source",
-    ),
-    LINK: ("file is a link, not a regular file", "files are links, not regular files"),
-    CHANGED_CONTENT: (
-        "file changed since the search",
-        "files changed since the search",
-    ),
-    GONE: ("file no longer exists", "files no longer exist"),
-    UNREADABLE: ("file could not be read", "files could not be read"),
-    KEEPER: (
-        "file kept: its kept copy changed or is gone",
-        "files kept: their kept copy changed or is gone",
-    ),
-}
-# The job's row for a copy the review protected (#586): the review's reason.
-REVIEW_KEPT_DETAILS = {
-    MAYBE_SAME: "Kept: may be the same file reached through another mount or share",
-    NO_FILE_ID: "Kept: can't confirm this is a separate file on this drive",
-    SAME: "Kept: the same file as its kept copy",
-    OUTSIDE_SOURCE: "Kept: not inside a configured source",
-    LINK: "Kept: a link, not a regular file",
-    CHANGED_CONTENT: "Kept: changed since the search",
-    GONE: "Kept: no longer exists",
-    UNREADABLE: "Kept: could not be read",
-    KEEPER: "Kept: its kept copy changed or is gone",
-}
-# Job outcome rows (never an OS error text).
-CHANGED = "The file changed since the review; it was kept."
-KEEPER_CHANGED = "The kept copy changed or is gone; this file was kept."
-SAME_FILE = "This is the same file as its kept copy; it was kept."
-MAYBE_SAME_FILE = (
-    "May be the same file reached through another mount or share; it was kept."
-)
-NO_FILE_ID_ROW = "Can't confirm this is a separate file on this drive; it was kept."
-KEEPER_GONE = "keeper-gone"
-KEEPER_WENT = (
-    "The kept copy changed or went away during the removal; this file was kept "
-    "and its links stay with it."
-)
-ROW_DETAILS = {
-    KEEPER_GONE: None,  # filled below
-    MAYBE_SAME: MAYBE_SAME_FILE,
-    NO_FILE_ID: NO_FILE_ID_ROW,
-    SAME: SAME_FILE,
-    OUTSIDE_SOURCE: "The file is no longer inside its source; it was kept.",
-    LINK: "The file is now a link, not a regular file; it was kept.",
-    CHANGED_CONTENT: CHANGED,
-    GONE: "The file was already gone.",
-    UNREADABLE: "The file could not be read; it was kept.",
-    KEEPER: KEEPER_CHANGED,
-}
-# An unlink fails only after the file's records moved to its kept copy.
-LOCKED_FILE = (
-    "The file is open in another program or read-only; it was not deleted, "
-    "and its links now name the kept copy."
-)
-DELETE_FAILED = "The file could not be deleted; its links now name the kept copy."
-NOT_ATTEMPTED = "Not attempted: the job stopped after an error."
-KEPT_COPY = "Kept copy"
-SOURCES_CHANGED = (
-    "The sources changed since the review; nothing was deleted. Review again."
-)
-RECORDS_FAILED = (
-    "The database could not be updated, so the file was not deleted. "
-    "Its links and tags are unchanged."
-)
-FIND_FAILED = "The duplicate search failed."
-FIND_ERROR_EVENT = "An internal error occurred. Check server logs for details."
-FIND_CANCELLED = "Duplicate scan cancelled"
-
-
-class SourcesChanged(Exception):
-    """A source a review or removal names is no longer listed at its index."""
-
-
-ROW_DETAILS[KEEPER_GONE] = KEEPER_WENT
-
-
-def still_kept(target, hold):
-    """Right before an unlink: the held kept copy is still the file at its
-    path, and the file is still not the kept copy itself (``keeper_problem``).
-    """
-    try:
-        if not os.path.samestat(os.fstat(hold.fileno()), os.stat(target["keeper_abs"])):
-            return False
-        info = os.lstat(target["abs"])
-        problem = keeper_problem(
-            target["abs"],
-            target["root"],
-            info,
-            target["keeper_abs"],
-            target["keeper_root"],
-        )
-        return problem is None
-    except OSError:
-        return False
-
-
-def _plural(count, one, many=None):
-    return f"{count:,} {one if count == 1 else (many or one + 's')}"
-
-
-def human_bytes(size):
-    """``10 B``, ``1.5 KB``, ``2.0 MB``…"""
-    if size < 1024:
-        return f"{size:,} B"
-    for unit in ("KB", "MB", "GB", "TB"):
-        size /= 1024
-        if size < 1024 or unit == "TB":
-            return f"{size:,.1f} {unit}"
-    return f"{size:,.1f} TB"  # pragma: no cover - unreachable
-
-
-def _hash_file(path):
-    digest = hashlib.sha256()
-    with open(path, "rb") as handle:
-        for chunk in iter(lambda: handle.read(HASH_CHUNK), b""):
-            digest.update(chunk)
-    return digest.hexdigest()
-
-
-def file_problem(
-    path,
-    root,
-    digest,
-    size,
-    hasher=None,
-    *,
-    hash_check=True,
-    mtime_ns=None,
-    inode=None,
-    keeper=None,
-    keeper_root=None,
-):
-    """Why ``path`` may not be treated as a copy in ``root``, or None (blocking).
-
-    Containment is decided as text first, with no filesystem access: the
-    normalized path must lie below the normalized root, outside
-    ``thumbnails``, with a media extension. Only then is the file looked at:
-    a regular file, not a link, whose resolved path is still inside the
-    resolved root and that is not ``keeper`` itself (``keeper_problem``: a
-    hardlink, one file reached through two spellings or two mounts, or a
-    volume that cannot tell files apart), of ``size`` bytes.
-    ``mtime_ns`` and ``inode`` (``[st_dev, st_ino]``), when given, bind it to
-    what the search saw; ``hash_check`` compares its content hash with
-    ``digest`` (the removal job, right before an unlink). Every handle is
-    closed when this returns.
-    """
-    # py.config imports ComfyUI's server module: only when it is in use.
-    from ..config import _canonical_path, _lexical_path, _lexically_inside
-
-    lexical = _lexical_path(str(path))
-    base = _lexical_path(str(root))
-    if lexical == base or not _lexically_inside(lexical, [base]):
-        return OUTSIDE_SOURCE
-    parts = Path(os.path.relpath(lexical, base)).parts
-    if "thumbnails" in parts or ".." in parts:
-        return OUTSIDE_SOURCE
-    if any(is_trash_folder(part) for part in parts[:-1]):
-        return OUTSIDE_SOURCE  # never removed from a trash folder (#543)
-    if os.path.splitext(lexical)[1].lower() not in DELETABLE_MEDIA_EXTENSIONS:
-        return OUTSIDE_SOURCE
-    try:
-        info = os.lstat(path)
-    except FileNotFoundError:
-        return GONE
-    except OSError:
-        return UNREADABLE
-    if stat_module.S_ISLNK(info.st_mode):
-        return LINK
-    if not stat_module.S_ISREG(info.st_mode):
-        return LINK
-    try:
-        if not _lexically_inside(_canonical_path(path), [_canonical_path(root)]):
-            return OUTSIDE_SOURCE  # a linked folder on the way
-        if in_trash_below_roots(path, [root]):
-            return OUTSIDE_SOURCE  # a linked folder into a trash folder
-        if keeper is not None:
-            same = keeper_problem(path, root, info, keeper, keeper_root)
-            if same:
-                return same
-        if info.st_size != size:
-            return CHANGED_CONTENT
-        if mtime_ns is not None and info.st_mtime_ns != mtime_ns:
-            return CHANGED_CONTENT
-        if inode is not None and [info.st_dev, info.st_ino] != list(inode):
-            return CHANGED_CONTENT
-        if hash_check and (hasher or _hash_file)(path) != digest:
-            return CHANGED_CONTENT
-    except FileNotFoundError:
-        return GONE
-    except OSError:
-        return UNREADABLE
-    return None
-
-
-def keeper_problem(path, root, info, keeper, keeper_root=None):
-    """Why ``path`` (its ``lstat`` is ``info``) may be ``keeper`` itself, or None.
-
-    - ``NO_FILE_ID``: a volume reports no file id (``st_ino`` 0), so the two
-      cannot be told apart;
-    - ``SAME``: ``os.path.samestat`` (a hardlink, or one file reached through
-      two spellings of one mount);
-    - ``MAYBE_SAME``: another device, the same size, mtimes within
-      ``MOUNT_MTIME_SLACK_NS``, and the same ``st_ino`` (NFS and SMB report
-      the server's file id) or the same path within their sources, or one
-      ending with the other on a folder name (one share mounted twice, a
-      FUSE pool over a listed disk, sources listed at different depths).
-      Protect, never guess: a true copy on another disk at the same relative
-      path is kept too.
-
-    Raises OSError when the kept copy cannot be read (the caller's GONE or
-    UNREADABLE).
-    """
-    kept = os.stat(keeper)
-    if not info.st_ino or not kept.st_ino:
-        return NO_FILE_ID
-    if os.path.samestat(info, kept):
-        return SAME
-    if info.st_dev == kept.st_dev or info.st_size != kept.st_size:
-        return None
-    if abs(info.st_mtime_ns - kept.st_mtime_ns) > MOUNT_MTIME_SLACK_NS:
-        return None
-    if info.st_ino == kept.st_ino:
-        return MAYBE_SAME
-    if keeper_root is not None and _same_tail(
-        _relative_key(path, root), _relative_key(keeper, keeper_root)
-    ):
-        return MAYBE_SAME
-    return None
-
-
-def _same_tail(one, other):
-    """Whether one relative path is the other, or ends with it on a folder name.
-
-    Two mounts of one tree may be listed at different depths (``2024/x.png``
-    in one source, ``x.png`` in the other); ``ax.png`` never matches ``x.png``.
-    """
-    if one is None or other is None:
-        return False
-    return one == other or one.endswith("/" + other) or other.endswith("/" + one)
-
-
-def _relative_key(path, root):
-    try:
-        relative = os.path.relpath(str(path), str(root))
-    except ValueError:  # another drive (Windows)
-        return None
-    return os.path.normcase(relative).replace("\\", "/")
-
-
-@dataclass
-class HeldFind:
-    """One find: where it looked and, once it finished, what it found."""
-
-    origin: str  # "workspace" or "gallery"
-    job_id: str = ""
-    roots: list = field(default_factory=list)  # [(source index or None, root)]
-    legacy_dir: str = None
-    groups: list = None  # [{group_id, hash, size, files:[record]}]
-
-    def covers(self, legacy_dir):
-        """Whether its events answer the legacy gallery for ``legacy_dir``."""
-        if self.origin == "gallery":
-            return True
-        if not legacy_dir:
-            return False
-        wanted = _identity(legacy_dir)
-        return any(_identity(root) == wanted for _index, root in self.roots)
-
-
-def _identity(path):
-    return os.path.normcase(os.path.realpath(str(path)))
-
-
-def _group_order(group):
-    return (-(len(group["files"]) - 1) * group["size"], group["hash"])
-
-
-def _keep_entry(entry):
-    """``((group_id, root_index, path), None)`` or ``(None, message)``."""
-    if not isinstance(entry, dict) or set(entry) != {"group_id", "root_index", "path"}:
-        return None, "Each keep entry is {group_id, root_index, path}"
-    group_id, index, path = entry["group_id"], entry["root_index"], entry["path"]
-    if not isinstance(group_id, str) or not 0 < len(group_id) <= 128:
-        return None, "group_id must be a group's id"
-    if index is not None and (
-        isinstance(index, bool) or not isinstance(index, int) or index < 0
-    ):
-        return None, "root_index must be a source index"
-    if not isinstance(path, str) or not 0 < len(path) <= 4096:
-        return None, "path must be a file's path in its group"
-    return (group_id, index, path), None
-
-
-def _parse_options(options):
-    """``(job_id, keep, None)`` for duplicate_files options, else a message."""
-    if not isinstance(options, dict) or set(options) != {"job_id", "keep"}:
-        return None, None, "duplicate_files takes options {job_id, keep}"
-    job_id, keep = options["job_id"], options["keep"]
-    if not isinstance(job_id, str) or not 0 < len(job_id) <= MAX_JOB_ID:
-        return None, None, "job_id must be a duplicate search's job id"
-    if not isinstance(keep, list) or not 0 < len(keep) <= MAX_KEEP:
-        return None, None, f"keep must list 1 to {MAX_KEEP:,} files to keep"
-    parsed = []
-    for entry in keep:
-        key, message = _keep_entry(entry)
-        if message:
-            return None, None, message
-        parsed.append(key)
-    return job_id, parsed, None
-
-
-def _select(held, keep):
-    """``({group_id: (group, [keeper records])}, None)`` or ``(None, message)``."""
-    groups = {group["group_id"]: group for group in held.groups}
-    selection = {}
-    for group_id, index, path in keep:
-        group = groups.get(group_id)
-        if group is None:
-            return None, "A kept file names a group this search did not find"
-        match = [
-            record
-            for record in group["files"]
-            if record["root_index"] == index and record["rel"] == path
-        ]
-        if not match:
-            return None, "A kept file is not in its group"
-        _group, keepers = selection.setdefault(group_id, (group, []))
-        if match[0] not in keepers:
-            keepers.append(match[0])
-    return selection, None
-
-
-SOURCES_CHANGED_REVIEW = (
-    "The sources changed since the search. Search for duplicates again."
-)
-
-
-def _fingerprint(targets):
-    digest = hashlib.sha256()
-    for target in sorted(targets, key=lambda t: _identity(t["abs"])):
-        part = [
-            os.path.normcase(target["abs"]),
-            target["hash"],
-            target["size"],
-            os.path.normcase(target["keeper_abs"]),
-        ]
-        digest.update(json.dumps(part).encode("utf-8") + b"\n")
-    return "sha256:" + digest.hexdigest()
-
-
-def _record_parts(records, target):
-    """What moves with one removal: its links, tags and Needs review items."""
-    found = records.get(target["abs"], {})
-    links, tags, review = (found.get(key, 0) for key in ("links", "tags", "review"))
-    parts = [
-        (
-            (
-                f"{_plural(links, 'database link')} "
-                f"{'moves' if links == 1 else 'move'} to the kept copy"
-            )
-            if links
-            else "no database links"
-        )
-    ]
-    if tags:
-        parts.append("its image tags join the kept copy's")
-    if review:
-        item = "Needs review item is" if review == 1 else "Needs review items are"
-        parts.append(f"{review:,} {item} settled")
-    return parts
-
-
-def _public_plan(targets, protected, records):
-    count = len(targets)
-    groups = len({t["group_id"] for t in targets})
-    size = sum(t["size"] for t in targets)
-    reasons = [
-        f"{n:,} {PROTECTED_REASONS[code][0 if n == 1 else 1]}"
-        for code, n in sorted(protected.items())
-    ]
-    details = [
-        {
-            "label": target["rel"],
-            "detail": f"{target['root_label']} · a copy of {target['keeper_rel']}"
-            + "".join(f" · {part}" for part in _record_parts(records, target)),
-        }
-        for target in targets[:MAX_DETAILS]
-    ]
-    label = f"{_plural(count, 'duplicate file')} in {_plural(groups, 'group')}"
-    media = (
-        f"Deletes {_plural(count, 'file')} ({human_bytes(size)}) from disk; the "
-        "kept copies stay. The safety backup covers the database, not these files."
-    )
-    tagged = sum(1 for t in targets if records.get(t["abs"], {}).get("tags"))
-    review = sum(records.get(t["abs"], {}).get("review", 0) for t in targets)
-    if tagged:
-        media += (
-            f" The image tags of {_plural(tagged, 'removed copy', 'removed copies')}"
-            " join their kept copy's."
-        )
-    if review:
-        media += (
-            f" {_plural(review, 'pending Needs review item')} of the removed "
-            f"{'copy is' if review == 1 else 'copies are'} settled."
-        )
-    return {
-        "operation": DUPLICATE_FILES,
-        "scope": {"count": count, "label": label},
-        "protected": {"count": sum(protected.values()), "reasons": reasons},
-        "media": {"deletes_files": True, "label": media},
-        "details": details,
-    }
@@ -1,157 +0,0 @@
-"""Every path a duplicate copy is recorded under (#249 System S6, Task 17).
-
-The search walks each source's real path, but a record names a file the way
-it was seen when it was written: under the folder the image monitor watches,
-the configured spelling, ComfyUI's output folder, a symlink to it, or a
-parent of a source listed later. ``Spellings`` finds them by containment:
-for each known folder spelling ``S`` (resolving to the folder ``R``) and a
-file ``P`` inside ``R``, the file is also recorded as ``S + relpath(P, R)``.
-
-Folders are compared by ``os.stat`` identity (``st_dev``, ``st_ino``), not
-by text, so a case variant on a case-insensitive filesystem (macOS, Windows)
-or a symlinked spelling matches. A volume that reports no file id falls
-back to ``normcase(realpath)``. Favorites are keyed by a listed root and the
-path below it, so ``favorites`` lists every listed root that holds a file.
-Blocking: each lookup stats the file's folders once (cached).
-"""
-
-import os
-from pathlib import Path
-
-from .images import _favorite_relative_key, _favorite_root_key, image_category_key
-
-
-def _identity(path):
-    try:
-        info = os.stat(path)
-    except OSError:
-        return None
-    if info.st_ino:
-        return ("inode", (info.st_dev, info.st_ino))
-    return ("path", os.path.normcase(os.path.realpath(str(path))))
-
-
-class Spellings:
-    """Folder spellings and listed roots, matched to files by containment."""
-
-    def __init__(self, folders, listed_roots):
-        self._cache = {}
-        self._folders = []
-        for spelled in dict.fromkeys(str(f) for f in folders if f):
-            identity = self._identity(spelled)
-            if identity is not None:
-                self._folders.append((spelled, identity))
-        self._listed = []
-        for root in dict.fromkeys(str(r) for r in listed_roots if r):
-            identity = self._identity(root)
-            if identity is not None:
-                self._listed.append((root, identity))
-
-    def _identity(self, path):
-        if path not in self._cache:
-            self._cache[path] = _identity(path)
-        return self._cache[path]
-
-    def _ancestors(self, path):
-        """``{identity: folder}`` of every folder above ``path``, nearest first."""
-        found = {}
-        folder = os.path.dirname(os.path.abspath(str(path)))
-        while True:
-            identity = self._identity(folder)
-            if identity is not None:
-                found.setdefault(identity, folder)
-            parent = os.path.dirname(folder)
-            if parent == folder:
-                return found
-            folder = parent
-
-    def of(self, path):
-        """``{folder spelling: path spelled under it}``; ``""`` is ``path`` itself."""
-        path = os.path.abspath(str(path))
-        spelled = {"": path}
-        ancestors = self._ancestors(path)
-        for folder, identity in self._folders:
-            inside = ancestors.get(identity)
-            if inside is not None:
-                spelled.setdefault(
-                    folder, os.path.join(folder, os.path.relpath(path, inside))
-                )
-        return spelled
-
-    @property
-    def listed_roots(self):
-        """The listed roots (the output sources), in order."""
-        return [root for root, _identity in self._listed]
-
-    def category_key(self, path):
-        """*path*'s image category file key (#332), or None outside every source."""
-        return image_category_key(self.listed_roots, path)
-
-    def favorites(self, path):
-        """``{listed root: path below it (POSIX)}`` for each listed root holding it."""
-        path = os.path.abspath(str(path))
-        ancestors = self._ancestors(path)
-        held = {}
-        for root, identity in self._listed:
-            inside = ancestors.get(identity)
-            if inside is not None:
-                held[root] = Path(os.path.relpath(path, inside)).as_posix()
-        return held
-
-
-def copy_move(target, kept_stat, spellings):
-    """What ``move_copy_records`` moves for one removal.
-
-    A record found under a folder spelling moves to the kept copy under
-    the same spelling when that folder holds it too, else to its real
-    path. Its favorite and its collection memberships move under every
-    listed root holding the file.
-    """
-    removed = spellings.of(target["abs"])
-    kept = spellings.of(target["keeper_abs"])
-    targets = {
-        spelled: kept.get(folder, target["keeper_abs"])
-        for folder, spelled in removed.items()
-    }
-    kept_favorites = spellings.favorites(target["keeper_abs"])
-    favorites = []
-    for root, relative in spellings.favorites(target["abs"]).items():
-        kept_root, kept_rel = (
-            (root, kept_favorites[root])
-            if root in kept_favorites
-            else (target["keeper_root"], target["keeper_rel"])
-        )
-        favorites.append(
-            (
-                _favorite_root_key(root),
-                _favorite_relative_key(relative),
-                _favorite_root_key(kept_root),
-                _favorite_relative_key(kept_rel),
-            )
-        )
-    return {
-        "removed": list(removed.values()),
-        "kept": list(kept.values()),
-        "targets": targets,
-        "kept_path": target["keeper_abs"],
-        "favorites": favorites,
-        "categories": _category_pairs(target, spellings),
-        "removed_locator": target["locator"],
-        "kept_locator": target["keeper_locator"],
-        "sha256": target["hash"],
-        "kept_size": kept_stat.st_size,
-        "kept_mtime_ns": kept_stat.st_mtime_ns,
-    }
-
-
-def _category_pairs(target, spellings):
-    """``[(removed file key, kept file key)]`` for the image category (#332).
-
-    From the two absolute paths, not the favorites tuples: those follow the
-    listed root, which differs from the file key when sources nest.
-    """
-    removed = spellings.category_key(target["abs"])
-    kept = spellings.category_key(target["keeper_abs"])
-    if removed is None or kept is None:
-        return []
-    return [(removed, kept)]
@@ -1,337 +0,0 @@
-"""One shared listing per output root, and the pure helpers behind it (#348).
-
-The API keeps one ``RootListing`` per output root (``_root_listings`` in
-``py/api/__init__.py``). The record is read and written only on the event
-loop; the walk itself, the comparison with the previous listing and both
-folder sets run in the executor through ``walk_root``. Routes live in
-``py/api/images.py`` (``_listing``); this module has no aiohttp import so
-tests can exercise it without a server.
-
-A settled output the image monitor reports is added to its root's stored
-listing without a walk (``output_settled``, ``insert_entry``), in the place
-a walk would list it. When that cannot be exact, the root is marked dirty
-(``mark_root_dirty``) instead; a dirty root gets one background walk, no
-sooner than ``rewalk_interval`` after its previous walk started (PR 2).
-"""
-
-from __future__ import annotations
-
-import asyncio
-import os
-from bisect import bisect_left
-from dataclasses import dataclass, field
-from pathlib import PurePath
-from typing import Callable, NamedTuple
-
-# A listing older than this (seconds) is served as it is, and one background
-# walk replaces it. Read as ``gallery_listing.REFRESH_AFTER`` so tests can
-# patch it.
-REFRESH_AFTER = 30
-
-# The stale read is served at once; its refresh walk starts this many seconds
-# later, so the walk does not share the GIL with the page's own requests
-# (#348 live test: reads during the walk took 2.2 s instead of 0.07 s).
-REFRESH_DELAY = 1.0
-
-# No background walk of a root starts sooner than rewalk_interval(last walk's
-# duration) after its previous walk started: FACTOR times that duration, at
-# least FLOOR and at most CAP seconds. Walks up to CAP / FACTOR (3 s) then
-# hold the GIL at most ~20% of the time; the cap keeps a new output listed
-# within ~20 s, at the cost of a higher share (back to back from 15 s) on
-# slower walks. Read through this module so tests can patch them.
-REWALK_FLOOR = 5
-REWALK_FACTOR = 5
-REWALK_CAP = 15
-
-# A deferred walk is never armed sooner than this: no zero-delay loop.
-MIN_REWALK_DELAY = 0.5
-
-# A reader with no listing gives up (500) after this many walks in a row were
-# discarded by invalidations made while they ran.
-MAX_DISCARDED_WALKS = 3
-
-WALK_STOPPED = "The listing walk was stopped"
-
-STORED = "stored"
-DISCARDED = "discarded"
-FAILED = "failed"
-
-
-class WalkOutcome(NamedTuple):
-    """What one walk ended with; a walk's flight future resolves to this."""
-
-    kind: str
-    error: BaseException | None = None
-
-    @classmethod
-    def stored(cls) -> "WalkOutcome":
-        return cls(STORED)
-
-    @classmethod
-    def discarded(cls) -> "WalkOutcome":
-        return cls(DISCARDED)
-
-    @classmethod
-    def failed(cls, error: BaseException) -> "WalkOutcome":
-        return cls(FAILED, error)
-
-
-@dataclass
-class RootListing:
-    """The shared listing of one output root.
-
-    A record is never deleted: ``drop()`` clears the listing and bumps
-    ``generation``, so a walk that started before a drop can never be stored
-    after it.
-    """
-
-    # (path, mtime) newest first, as _scan_gallery_files_sync returns it.
-    files: list | None = None
-    folders: frozenset | None = None
-    folders_with_ancestors: frozenset | None = None
-    # Monotonic time the last walk finished, stored or failed.
-    walked_at: float | None = None
-    # Number of the last walk started; a running walk is always that one.
-    walk_seq: int = 0
-    # Number of the walk whose files are stored (Rescan waits on it).
-    stored_seq: int = 0
-    generation: int = 0
-    # The running walk's future (resolves to a WalkOutcome), or None.
-    flight: asyncio.Future | None = None
-    # True while walks keep failing: one warning per streak.
-    failing: bool = False
-    # The one deferred background walk not started yet (loop.call_later), or
-    # None: a stale refresh or a dirty root's rewalk, whichever is due first.
-    rewalk_handle: asyncio.TimerHandle | None = None
-    # normcase(realpath(root)), computed by the walk in the executor: monitor
-    # paths are matched against it without file I/O on the loop.
-    resolved_root: str | None = None
-    # Monotonic start and duration of the last walk (rewalk_interval).
-    last_started_at: float | None = None
-    last_duration: float | None = None
-    # A settled output was reported under this root; cleared when a walk starts.
-    dirty: bool = False
-    # Dropped because the output roots changed: no background walk until a
-    # reader (or the warm-up) asks for this root again. The monitor keeps
-    # watching a removed root until ComfyUI restarts.
-    retired: bool = False
-    # Relative paths of settled outputs waiting to be added to ``files``
-    # without a walk, and the one task adding them (``output_settled``).
-    pending_adds: list = field(default_factory=list)
-    add_task: asyncio.Task | None = None
-    # Settled outputs added to the stored listing since the last walk stored.
-    patched: int = 0
-
-    def drop(self) -> None:
-        self.files = None
-        self.folders = None
-        self.folders_with_ancestors = None
-        self.walked_at = None
-        self.pending_adds = []
-        self.patched = 0
-        self.generation += 1
-
-
-def folder_sets(root, files) -> tuple[frozenset, frozenset]:
-    """``(folders, folders_with_ancestors)`` of the files listed under *root*.
-
-    Folders keep the spelling ``/gallery/subfolders`` has always answered:
-    ``str(relative.parent)`` (native separators) for the folders holding
-    files, plus every ancestor joined by ``/``.
-    """
-    # From the path strings: relative_to per file was half of a large walk.
-    sep, prefix = _root_prefix(root)
-    folders = set()
-    for path, _mtime in files:
-        rel_dir = _folder_of(root, path, sep, prefix)
-        if rel_dir:
-            folders.add(rel_dir)
-    with_ancestors = set(folders)
-    for folder in folders:
-        with_ancestors.update(_ancestors(folder))
-    return frozenset(folders), frozenset(with_ancestors)
-
-
-def add_folder(root, path, folders, with_ancestors) -> tuple[frozenset, frozenset]:
-    """Both folder sets once *path* is listed too (the same sets when it adds none)."""
-    sep, prefix = _root_prefix(root)
-    rel_dir = _folder_of(root, path, sep, prefix)
-    if not rel_dir or rel_dir in folders:
-        return folders, with_ancestors
-    return folders | {rel_dir}, with_ancestors | {rel_dir, *_ancestors(rel_dir)}
-
-
-def _root_prefix(root) -> tuple[str, str]:
-    # The separator is the path flavour's own (tests use PureWindowsPath).
-    sep = str(type(root)("a", "b"))[1]
-    prefix = str(root)
-    if not prefix.endswith(sep):
-        prefix += sep
-    return sep, prefix
-
-
-def _folder_of(root, path, sep, prefix) -> str:
-    """The folder ``/gallery/subfolders`` names for *path*; "" for the root."""
-    text = str(path)
-    if text.startswith(prefix):
-        rel_dir = text[len(prefix) :].rpartition(sep)[0]
-    else:
-        rel_dir = str(path.relative_to(root).parent)
-    return "" if rel_dir == "." else rel_dir
-
-
-def _ancestors(folder: str) -> list[str]:
-    parts = folder.replace("\\", "/").split("/")
-    return ["/".join(parts[:i]) for i in range(1, len(parts))]
-
-
-def relative_part(resolved_root: str, path, pathmod=os.path) -> str | None:
-    """The part of the resolved *path* below *resolved_root*, as a walk spells it.
-
-    Kept in *path*'s own case (``realpath`` gives a file's on-disk case on
-    Windows) with the native separator. None when *path* is not below the
-    root, or when the case folding changed the length so the slice would
-    not be exact.
-    """
-    sep = pathmod.sep
-    text = str(path)
-    if sep == "\\":
-        text = _plain(text.replace("/", sep), pathmod)
-    folded = pathmod.normcase(text)
-    prefix = _plain(resolved_root, pathmod)
-    if not prefix.endswith(sep):
-        prefix += sep
-    if len(folded) != len(text) or not folded.startswith(prefix):
-        return None
-    relative = text[len(prefix) :]
-    if any(part in ("", ".", "..") for part in relative.split(sep)):
-        return None
-    return relative
-
-
-def insert_entry(files: list, entry: tuple, max_files: int) -> list | None:
-    """A new listing with *entry* ``(path, mtime)`` where a walk would list it.
-
-    *files* is newest first; an entry for the same path is replaced. Returns
-    *files* itself when it already holds *entry*, and None when the place is
-    not exact: another file has the same mtime (a walk orders those by its
-    own visit order), or the listing is at the walk's *max_files* cap.
-    Blocking (one pass over *files*): run it in the executor.
-    """
-    path, mtime = entry
-    text = str(path)
-    kept = files
-    for index, (listed, listed_mtime) in enumerate(files):
-        if str(listed) == text:
-            if listed_mtime == mtime:
-                return files
-            kept = files[:index] + files[index + 1 :]
-            break
-    else:
-        if len(files) >= max_files:
-            return None
-    index = bisect_left(kept, -mtime, key=lambda item: -item[1])
-    if index < len(kept) and kept[index][1] == mtime:
-        return None
-    return [*kept[:index], entry, *kept[index:]]
-
-
-# A listing that differs from the cached one by more entries than this is
-# rebuilt in full by the workspace caches (listing_delta).
-MAX_DELTA = 256
-
-
-def listing_delta(old: list, new: list, limit: int = MAX_DELTA):
-    """``(added, removed)`` entries from *old* to *new*, or None past *limit*.
-
-    A listing patched by ``insert_entry`` shares every unchanged entry object
-    with the one it came from, so entries are told apart by identity: a walk
-    builds new tuples, shares none and is rebuilt in full. *old* must still
-    be alive (the
-    caller's cache holds it), so no identity was reused.
-    """
-    if abs(len(new) - len(old)) > limit:
-        return None
-    old_ids = set(map(id, old))
-    added = []
-    for entry in new:
-        if id(entry) not in old_ids:
-            added.append(entry)
-            if len(added) > limit:
-                return None
-    if new and len(added) == len(new):
-        return None  # nothing shared: a walk
-    if len(old) + len(added) == len(new):
-        return added, []
-    new_ids = set(map(id, new))
-    return added, [entry for entry in old if id(entry) not in new_ids]
-
-
-def rewalk_interval(last_duration) -> float:
-    """Seconds from a walk's start to the next background walk of its root."""
-    scaled = REWALK_FACTOR * (last_duration or 0.0)
-    return min(REWALK_CAP, max(REWALK_FLOOR, scaled))
-
-
-def root_contains(resolved_root: str, path, pathmod=os.path) -> bool:
-    """True when the resolved *path* lies under *resolved_root* (no file I/O).
-
-    *resolved_root* is already ``normcase``d; *path* is folded the same way,
-    so Windows matches case-insensitively and with either separator. The
-    match ends at a separator: ``/out2/x.png`` is not under ``/out``.
-    """
-    target = _plain(pathmod.normcase(str(path)), pathmod)
-    prefix = _plain(resolved_root, pathmod)
-    if not prefix.endswith(pathmod.sep):
-        prefix += pathmod.sep
-    return target.startswith(prefix)
-
-
-def _plain(path: str, pathmod) -> str:
-    """*path* (normcased or not) without a Windows extended-length prefix.
-
-    ``realpath`` may keep ``\\\\?\\`` on a file past MAX_PATH while its shorter
-    root resolves without it.
-    """
-    if pathmod.sep != "\\":
-        return path
-    if path[:8].lower() == "\\\\?\\unc\\":
-        return "\\\\" + path[8:]
-    if path.startswith("\\\\?\\"):
-        return path[4:]
-    return path
-
-
-def resolve_root(root) -> str:
-    """``normcase(realpath(root))``, the spelling monitor paths are matched in.
-
-    File I/O (realpath follows links): call it in the executor.
-    """
-    return os.path.normcase(os.path.realpath(str(root)))
-
-
-def same_listing(old, new) -> bool:
-    """True when two listings hold the same ``(path, mtime)`` pairs in order."""
-    if old is None or new is None:
-        return False
-    return old is new or old == new
-
-
-def walk_root(
-    scan_fn: Callable[[PurePath], list], root, previous_files
-) -> tuple[list, frozenset, frozenset, str]:
-    """The single executor job of a walk.
-
-    Returns ``(files, folders, with_ancestors, resolved_root)``.
-
-    Opens the root first, so a missing or unreadable root raises ``OSError``
-    instead of listing nothing. Returns *previous_files* itself when nothing
-    changed, which keeps the identity-keyed caches built on it warm.
-    """
-    with os.scandir(root):
-        pass
-    files = scan_fn(root)
-    if same_listing(previous_files, files):
-        files = previous_files
-    folders, with_ancestors = folder_sets(root, files)
-    return files, folders, with_ancestors, resolve_root(root)
@@ -5,7 +5,6 @@ import base64
 import binascii
 from functools import wraps
 import json
-import os
 import re
 import sqlite3
 from typing import Callable
@@ -21,23 +20,16 @@ from .history_current import (
    _OpenedCurrentMedia,
    _current_media_response,
    _prepare_current_media,
-    accepts_jxl,
    _reauthorize_current_target,
    candidate_locator,
    resolve_current_candidate,
    snapshot_current_output_scope,
 )
-from .inspection_service import (
-    CurrentFileChanged,
-    image_tags_reader,
-    inspect_current_file,
-)
-from .images import image_category_key
+from .inspection_service import CurrentFileChanged, inspect_current_file

 try:
    from ...database.execution_history import HistoryEpochChanged
    from ...database.history_gallery import read_history_gallery
-    from ...database.run_attribution import recorded_output_lookup
    from ...database.history_reads import (
        HistoryCaptureChanged,
        OutputPosition,
@@ -45,15 +37,10 @@ try:
        WindowPosition,
    )
    from ...utils.history_read_fence import HistoryReadFence
-    from ...utils.inspection_response import (
-        OWN_CATEGORY_UNREAD,
-        apply_own_category,
-        encode_history_inspection_response,
-    )
+    from ...utils.inspection_response import encode_history_inspection_response
 except ImportError:
    from database.execution_history import HistoryEpochChanged
    from database.history_gallery import read_history_gallery
-    from database.run_attribution import recorded_output_lookup
    from database.history_reads import (
        HistoryCaptureChanged,
        OutputPosition,
@@ -61,11 +48,7 @@ except ImportError:
        WindowPosition,
    )
    from utils.history_read_fence import HistoryReadFence
-    from utils.inspection_response import (
-        OWN_CATEGORY_UNREAD,
-        apply_own_category,
-        encode_history_inspection_response,
-    )
+    from utils.inspection_response import encode_history_inspection_response


 _RUN_MAX_BYTES = 8 * 1024 * 1024
@@ -159,18 +142,6 @@ def _query(request: web.Request) -> None:
        raise ValueError("Duplicate history query parameter")


-def _jxl_flag(request: web.Request) -> bool:
-    """The cover's ``jxl`` flag (#317): ``1`` when the workspace decoded a
-    JPEG XL image (a browser may not list ``image/jxl`` in Accept), ``0`` or
-    absent otherwise; anything else is a bad request."""
-    value = request.query.get("jxl")
-    if value is None:
-        return False
-    if value not in ("0", "1"):
-        raise ValueError("Invalid jxl flag")
-    return value == "1"
-
-
 def _page_limit(request: web.Request) -> int:
    limit = _decimal(request.query.get("limit", "40"), minimum=1)
    if limit > 100:
@@ -417,9 +388,6 @@ class HistoryRoutesMixin:
        routes.get("/prompt_manager/library/{positive_id}/history")(
            self.get_library_history
        )
-        routes.get(
-            "/prompt_manager/library/{positive_id}/history/pairs/{pair_id}/newest"
-        )(self.get_newest_pair_run)
        routes.get("/prompt_manager/history/runs/{run_id}")(self.get_history_run)
        routes.get("/prompt_manager/history/runs/{run_id}/outputs")(
            self.get_history_outputs
@@ -505,40 +473,6 @@ class HistoryRoutesMixin:

        return _success_response(await self._run_in_executor(project))

-    @_history_errors
-    async def get_newest_pair_run(self, request: web.Request) -> web.Response:
-        """The pair's newest recorded run for the history run dot (#249 D26)."""
-        _query(request)
-        if request.query:
-            raise ValueError("Invalid newest pair run query")
-        positive_id = _decimal(request.match_info["positive_id"], minimum=1)
-        pair_id = _decimal(request.match_info["pair_id"], minimum=1)
-        fence = self._history_fence()
-        db = self.db
-
-        def project() -> bytes:
-            generation = fence.begin()
-            try:
-                with db.recorded_history_snapshot() as epoch:
-                    result = db.get_newest_pair_run(positive_id, pair_id)
-            finally:
-                db.model.close()
-            if result is None:
-                fence.validate(epoch, generation)
-                raise HistoryReadError(404, "not-found")
-            encoded = _serialize_history(
-                {
-                    "success": True,
-                    "history_version": 1,
-                    "history_epoch": epoch,
-                    **result,
-                }
-            )
-            fence.validate(epoch, generation)
-            return encoded
-
-        return _success_response(await self._run_in_executor(project))
-
    @_history_errors
    async def get_history_run(self, request: web.Request) -> web.Response:
        _query(request)
@@ -691,32 +625,6 @@ class HistoryRoutesMixin:
    ) -> web.Response:
        return await self._history_current(request, "inspection")

-    def _history_own_category(self, reference: dict, scope):
-        """The recorded output's own category (#332), inside the snapshot.
-
-        The path is the symlink-resolved output folder plus the receipt's
-        subfolder and filename, keyed by ``image_category_key`` over the
-        configured output sources as Images keys it. A temp output or a path
-        no source holds has none. A failed read is OWN_CATEGORY_UNREAD.
-        """
-        if (
-            reference.get("folder_type") != "output"
-            or scope.canonical_output is None
-            or candidate_locator(reference, scope) is None
-        ):
-            return None
-        path = os.path.join(
-            str(scope.canonical_output), reference["subfolder"], reference["filename"]
-        )
-        try:
-            key = image_category_key(self._get_all_output_dirs(), path)
-            return None if key is None else self.db.image_category(*key)
-        except Exception:
-            self.logger.warning(
-                "History image category could not be read", exc_info=True
-            )
-            return OWN_CATEGORY_UNREAD
-
    async def _history_current(
        self, request: web.Request, kind: str
    ) -> web.StreamResponse:
@@ -741,7 +649,6 @@ class HistoryRoutesMixin:
                    if scope.current_scope != current_scope:
                        raise _current_stale()
                    result = db.get_history_occurrence(run_id, node, ordinal)
-                    own = None
                    if result is not None:
                        receipt = result["receipt"]
                        path = candidate_locator(receipt["reference"], scope)
@@ -749,10 +656,6 @@ class HistoryRoutesMixin:
                            db.model.get_connection(),
                            (path,) if path is not None else (),
                        )
-                        if kind == "inspection":
-                            own = self._history_own_category(
-                                receipt["reference"], scope
-                            )
            finally:
                db.model.close()
            if result is None:
@@ -771,27 +674,9 @@ class HistoryRoutesMixin:
                        resolved.canonical_target,
                        source_label=resolved.public["source_label"],
                        saved=saved.get("saved"),
-                        library=apply_own_category(
-                            saved.get(
-                                "library",
-                                {
-                                    "status": (
-                                        "unavailable" if saved_unavailable else "none"
-                                    )
-                                },
-                            ),
-                            own,
-                        ),
-                        # The file's own image tags, keyed as the Tag dialog
-                        # keys them: the normcased realpath (#457).
-                        image_tags=image_tags_reader(
-                            db,
-                            str(resolved.canonical_target),
-                            self.logger,
-                            close=True,
-                        ),
-                        recorded=recorded_output_lookup(
-                            db, close=True, reference=receipt["reference"]
+                        library=saved.get(
+                            "library",
+                            {"status": "unavailable" if saved_unavailable else "none"},
                        ),
                    )
                    _reauthorize_current_target(resolved, scope)
@@ -812,10 +697,7 @@ class HistoryRoutesMixin:
                        raise HistoryReadError(422, "response-limit") from None
                else:
                    prepared = _prepare_current_media(
-                        resolved,
-                        scope,
-                        thumbnail=kind == "thumbnail",
-                        **media_options,
+                        resolved, scope, thumbnail=kind == "thumbnail"
                    )
                _check_current(scope, self, fence, epoch, generation)
                return prepared
@@ -842,48 +724,25 @@ class HistoryRoutesMixin:
                    _check_current(scope, self, fence, epoch, generation)
                raise

-        async def execute():
-            # An inspection reads the file's header and text: the
-            # interactive image pool (#523); media stays on the default.
-            run = self._run_image if kind == "inspection" else self._run_in_executor
-            pending = asyncio.create_task(run(project))
-            try:
-                return await asyncio.shield(pending)
-            except asyncio.CancelledError:
-                pending.add_done_callback(_close_prepared_result)
-                raise
-            except (
-                HistoryReadError,
-                HistoryEpochChanged,
-                sqlite3.Error,
-                OSError,
-                ValueError,
-            ):
-                raise
-            except Exception as error:
-                self.logger.warning(
-                    "Current history media unavailable (%s)", type(error).__name__
-                )
-                raise _current_unavailable("temporary_unavailable") from None
-
-        # A missing preview (#249) is noted on the first read, made through
-        # the serve route's admission and single flight, then read again. A
-        # video whose preview cannot be made is the placeholder frame.
-        needed = []
-        media_options = {}
-        if kind == "thumbnail":
-            media_options = {
-                "ensure_preview": lambda *preview: needed.append(preview),
-                "placeholder": self._video_placeholder_bytes(),
-                "accepts_jxl": _jxl_flag(request) or accepts_jxl(request),
-            }
-        prepared = await execute()
-        if needed:
-            if not isinstance(prepared, bytes):
-                prepared.close()
-            await self._admit_preview(*needed[0])
-            media_options["ensure_preview"] = None
-            prepared = await execute()
+        pending = asyncio.create_task(self._run_in_executor(project))
+        try:
+            prepared = await asyncio.shield(pending)
+        except asyncio.CancelledError:
+            pending.add_done_callback(_close_prepared_result)
+            raise
+        except (
+            HistoryReadError,
+            HistoryEpochChanged,
+            sqlite3.Error,
+            OSError,
+            ValueError,
+        ):
+            raise
+        except Exception as error:
+            self.logger.warning(
+                "Current history media unavailable (%s)", type(error).__name__
+            )
+            raise _current_unavailable("temporary_unavailable") from None
        if isinstance(prepared, bytes):
            return _success_response(prepared)
        return await _current_media_response(request, prepared)
@@ -5,7 +5,6 @@ from dataclasses import dataclass
 import errno
 import hashlib
 import hmac
-import io
 import json
 import mimetypes
 import os
@@ -15,10 +14,7 @@ from typing import BinaryIO

 from aiohttp import web

-from . import preview_store, thumbnail_settings
 from .images import _canonical, _public_path, SERVABLE_EXTENSIONS, VIDEO_EXTENSIONS
-from .images import in_trash_below_roots
-from .images import existing_media_thumbnail, media_preview_path

 try:
    from ...utils.execution_outputs import (
@@ -199,9 +195,6 @@ def resolve_current_candidate(
        if namespace is None or not namespace.is_dir():
            return _unavailable("root_unavailable")
        target = _canonical(lexical)
-        if in_trash_below_roots(target, [namespace]):
-            # Every kind and the outputs listing come through here (#543).
-            return _unavailable("missing")
        if not _authorized(target, namespace, scope):
            return _unavailable("not_authorized")
        if target.suffix.lower() not in SERVABLE_EXTENSIONS:
@@ -244,41 +237,15 @@ def resolve_current_candidate(
        return _unavailable("temporary_unavailable", error=True)


-def _target_authorized(target, namespace, scope, store_root=None) -> bool:
-    """A preview in the thumbnail folder (#320, folder mode) is authorized by
-    the store of its source (``preview_store.owns``: inside the key folder,
-    no link); everything else by the output namespace and the roots."""
-    if (
-        store_root is not None
-        and preview_store.current().mode == preview_store.FOLDER_MODE
-    ):
-        return preview_store.owns(store_root, target)
-    return _authorized(target, namespace, scope)
-
-
 def _open_current_target(
-    target: Path,
-    namespace: Path,
-    scope: CurrentOutputScope,
-    preview: bool = False,
-    store_root: Path | None = None,
+    target: Path, namespace: Path, scope: CurrentOutputScope
 ) -> BinaryIO:
-    """Open only the canonical target and verify authority against the actual handle.
-
-    A *preview* (a file under ``thumbnails/``) may also be JPEG XL (#317); in
-    folder mode it is authorized by the store of *store_root* (#320)."""
+    """Open only the canonical target and verify authority against the actual handle."""
    if _canonical(target) != target:
        raise CurrentLocationUnavailable("not_authorized", stale=True)
-    if in_trash_below_roots(target, [namespace]):
-        # Also at the open: the cover chooses its preview after the candidate
-        # check, and a preview can be a link into a trash folder (#543).
-        raise CurrentLocationUnavailable("missing")
-    if not _target_authorized(target, namespace, scope, store_root):
+    if not _authorized(target, namespace, scope):
        raise CurrentLocationUnavailable("not_authorized")
-    suffix = target.suffix.lower()
-    if suffix not in SERVABLE_EXTENSIONS and not (
-        preview and suffix in thumbnail_settings.THUMBNAIL_EXTENSIONS
-    ):
+    if target.suffix.lower() not in SERVABLE_EXTENSIONS:
        raise CurrentLocationUnavailable("unsupported_media")
    flags = (
        os.O_RDONLY
@@ -306,7 +273,7 @@ def _open_current_target(
        if (
            _canonical(target) != target
            or (observed.st_dev, observed.st_ino) != (current.st_dev, current.st_ino)
-            or not _target_authorized(target, namespace, scope, store_root)
+            or not _authorized(target, namespace, scope)
        ):
            raise CurrentLocationUnavailable("not_authorized", stale=True)
        return os.fdopen(fd, "rb")
@@ -342,115 +309,34 @@ class _OpenedCurrentMedia:
        self.handle.close()


-def _preview_writable(root: Path, preview: Path) -> bool:
-    """A preview may be written: the store of *root* and every link segment
-    of the preview's folder resolve inside it (the serve route's rule, #249;
-    ``preview_store.owns``)."""
-    return preview_store.owns(root, preview)
-
-
-def _is_jxl(path) -> bool:
-    return Path(path).suffix.lower() == ".jxl"
-
-
-def _preview_without_jxl(root: Path, relative: Path) -> Path | None:
-    """The first existing preview *relative* owns that is not JPEG XL."""
-    return next(
-        (
-            path
-            for path in thumbnail_settings.owned_thumbnails(root, relative)
-            if not _is_jxl(path)
-        ),
-        None,
-    )
-
-
-def accepts_jxl(request) -> bool:
-    """Whether the request's ``Accept`` lists ``image/jxl``."""
-    accept = request.headers.get("Accept", "")
-    return any(
-        part.split(";", 1)[0].strip().lower() == "image/jxl"
-        for part in accept.split(",")
-    )
-
-
-def _placeholder_media(placeholder: bytes) -> "_OpenedCurrentMedia":
-    return _OpenedCurrentMedia(io.BytesIO(placeholder), len(placeholder), "image/jpeg")
-
-
-def _cover_target(resolved, ensure_preview, placeholder, accepts_jxl):
-    """What the cover opens: a preview path, the placeholder media, or None
-    for the original (see ``_prepare_current_media``)."""
-    target = resolved.canonical_target
-    relative = target.relative_to(resolved.gallery_root)
-    is_video = target.suffix.lower() in VIDEO_EXTENSIONS
-    # #317: any preview the file owns (the current format first); a missing
-    # one is made under the current format's name.
-    preview = existing_media_thumbnail(resolved.gallery_root, relative)
-    if preview is not None and not accepts_jxl and _is_jxl(preview):
-        preview = _preview_without_jxl(resolved.gallery_root, relative)
-        if preview is None:
-            if is_video and placeholder is not None:
-                return _placeholder_media(placeholder)
-            return None
-        return _canonical(preview)
-    if preview is not None:
-        return _canonical(preview)
-    preview = media_preview_path(resolved.gallery_root, relative, create=True)
-    if (
-        ensure_preview is not None
-        and preview is not None
-        and _preview_writable(resolved.gallery_root, preview)
-    ):
-        ensure_preview(target, preview, is_video)
-    if is_video and placeholder is not None:
-        return _placeholder_media(placeholder)
-    return None
-
-
 def _prepare_current_media(
-    resolved: ResolvedCurrentCandidate,
-    scope: CurrentOutputScope,
-    *,
-    thumbnail: bool,
-    ensure_preview=None,
-    placeholder: bytes | None = None,
-    accepts_jxl: bool = True,
+    resolved: ResolvedCurrentCandidate, scope: CurrentOutputScope, *, thumbnail: bool
 ) -> _OpenedCurrentMedia:
-    """Open the current file, or its preview for ``thumbnail``.
-
-    A missing preview that may be written is handed to
-    ``ensure_preview(src, dst, is_video)`` (the route makes it and reads
-    again, #249). Without one an image's original is opened and a video is
-    the ``placeholder`` JPEG, never the video inside an ``<img>``.
-
-    The cover's URL names no format, so a JPEG XL preview goes only to a
-    browser whose ``Accept`` lists ``image/jxl`` (*accepts_jxl*, review M3).
-    Another one gets the file's preview in another format when there is one,
-    else the original image or a video's placeholder: never a broken image.
-    """
    target = resolved.canonical_target
-    is_preview = False
    if thumbnail:
-        chosen = _cover_target(resolved, ensure_preview, placeholder, accepts_jxl)
-        if isinstance(chosen, _OpenedCurrentMedia):
-            return chosen
-        if chosen is not None:
-            target, is_preview = chosen, True
-    handle = _open_current_target(
-        target,
-        resolved.namespace,
-        scope,
-        is_preview,
-        resolved.gallery_root if is_preview else None,
-    )
+        relative = target.relative_to(resolved.gallery_root)
+        extension = (
+            ".jpg"
+            if target.suffix.lower() in VIDEO_EXTENSIONS
+            else target.suffix.lower()
+        )
+        preview = (
+            resolved.gallery_root
+            / "thumbnails"
+            / f"{relative.with_suffix('').as_posix()}_thumb{extension}"
+        )
+        try:
+            preview.stat()
+        except FileNotFoundError:
+            pass
+        else:
+            target = _canonical(preview)
+    handle = _open_current_target(target, resolved.namespace, scope)
    try:
        return _OpenedCurrentMedia(
            handle,
            os.fstat(handle.fileno()).st_size,
-            thumbnail_settings.content_type(target)
-            or mimetypes.guess_type(target.name)[0]
-            or "application/octet-stream",
+            mimetypes.guess_type(target.name)[0] or "application/octet-stream",
        )
    except BaseException:
        handle.close()
--- a/Show More
+++ b/Show More