refactor(thumbnails): keep the after-scan queue's store rule and pin the write lock (#320 )

A planned target keeps the plan's own containment rule (inside the store, as the thumbnail job writes it); captures keep the serve rule. The structural test also covers PREVIEW_FOLDER joins and the repo-root modules; the write-lock test asserts the lock instead of waiting on a timer; new tests cover nested roots in the after-scan queue and a legacy upper-case preview served through the resolver.
refactor(thumbnails): one resolver for where previews live on disk (#320 )
2026-10-31 19:11:21 -07:00 · 2026-10-31 18:51:18 -07:00 · 2026-11-01 01:24:27 +00:00 · 2026-11-01 00:41:13 +00:00 · 2026-11-01 00:41:12 +00:00 · 2026-11-01 00:04:27 +00:00
174 changed files with 5628 additions and 1725 deletions
@@ -1,9 +1,9 @@
-name: Windows and macOS
+name: Windows

 permissions:
  contents: read

-# Non-blocking portability runs (#420): never on pull requests or in the merge queue, and no context
+# Non-blocking Windows runs (#420; macOS dropped from CI in #571): never on pull requests or in the merge queue, and no context
 # here is a required check. A red run is fixed at its cause before the workspace cutover (#334).
 on:
  push:
@@ -25,10 +25,7 @@ env:
 # run counts (tests/vendor/ci-workflow.test.mjs recomputes it, #493).
 # Measured 2026-10-29 on main runs 40935337099 (dd247e3), 40938407252 (dd247e3), 40941240624 (dd247e3):
 #   slowest leg: 7m24s (py3.12 windows) / 7m31s (py3.13 windows) / 7m32s (py3.14 windows) -> 15 min
-#     (windows 4m56s-7m32s, macos 4m39s-6m14s)
-#   native-trash (#499) has no green main runs yet: its probe, run 40949370943 (2026-10-29), took
-#     about 1 minute per macOS leg, so ceil(1.5 x 2) + 3 gives it 6 minutes (step 4). Recalibrate
-#     after three green runs.
+#     (windows 4m56s-7m32s)
 #   native-trash-linux (#543) has no green main runs yet: it installs the dev requirements and runs
 #     one test module, about 1 minute by the same estimate, so ceil(1.5 x 2) + 3 gives it 6 minutes.
 #     Recalibrate after three green runs.
@@ -40,7 +37,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [windows-latest, macos-latest]
+        os: [windows-latest]
        python-version: ["3.12", "3.13", "3.14"]

    steps:
@@ -60,7 +57,7 @@ jobs:

      # The runner's TEMP is on C:, the OS disk, where a flush took about 6 ms
      # and a test database's create-to-delete about 111 ms; on the D: work
-      # disk the same took 0.5 ms and 23 ms (macOS: 19 ms). Tests write their
+      # disk the same took 0.5 ms and 23 ms. Tests write their
      # databases under TEMP, so it moves to a folder on D: (measured in #487,
      # run 40915866444). The runner's TEMP was an 8.3 short name
      # (C:\Users\RUNNER~1\...), so the new one is spelled by its short name too
@@ -83,31 +80,6 @@ jobs:
          PM_TEST_SLOWEST: "40"
        run: python -m tests.run_suite -v

-  # The real Trash on both macOS CPUs (#499 design §10.2). It runs apart from the suite, so a red
-  # suite never skips the native proof.
-  native-trash:
-    name: native trash on ${{ matrix.os }}
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 6
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [macos-latest, macos-15-intel]
-
-    steps:
-      - uses: actions/checkout@v7
-
-      - name: Set up Python
-        uses: actions/setup-python@v7
-        with:
-          python-version: "3.12"
-
-      - name: Native trash proof
-        timeout-minutes: 4
-        env:
-          PM_NATIVE_TRASH: macos
-        run: python -m unittest tests.test_trash_macos_native tests.test_trash_macos -v
-
  # The same tests as the fake mount table, on a real ext4 mount used as the output root (#543). A
  # runner can mount with sudo; the tests run as the normal user, so owner and mode checks are real.
  native-trash-linux:
@@ -28,7 +28,7 @@ env:
 #   py matrix, slowest py3.10 on windows-latest: 12m43s / 15m54s / 14m53s -> 27 min
 #     (ubuntu 5m27s-6m27s, macos 6m14s-8m30s, windows 11m42s-15m54s)
 #     3.10 and 3.11 left the matrix and 3.14 joined it in #356; re-measure after three green main runs.
-#     Windows and macOS moved to portability.yml (#420), which has its own measured limit (#493);
+#     Windows moved to portability.yml (#420; macOS left CI in #571), which has its own measured limit (#493);
 #     this Linux-only matrix keeps 27 minutes until it is re-measured.
 #   real ComfyUI compatibility: 13m32s / 8m55s / 11m46s -> 24 min
 #   coverage gate (85%): 7m26s / 7m22s / 7m54s -> 15 min
@@ -39,7 +39,7 @@ env:
 # Pull requests run a fast subset (#420): Python 3.12 on ubuntu-latest, coverage, lint and frontend
 # modules. The merge queue (merge_group), pushes to main and manual runs add Python 3.13 and 3.14 on
 # Linux and the real ComfyUI job. "all tests" is the required gate that holds the queue to that set.
-# Windows and macOS run in portability.yml (push to main, nightly, on demand) and never gate a merge.
+# Windows runs in portability.yml (push to main, nightly, on demand) and never gate a merge.
 jobs:
  test:
    name: py${{ matrix.python-version }} on ${{ matrix.os }}
@@ -41,9 +41,13 @@ concurrency:
 # 7.3m-12.2m), because --shard splits by test count and the slow concept specs sort into shard 1. The page
 # workflows now run in three shards per browser with the limits unchanged; the per-shard times are
 # re-measured after three green main runs.
+# #563: coverage shards reached their 18-minute step limit three times on 2026-10-31 with no failing
+# test (PR #560 shard 2/3: 814 passed in 17.9m; queue run 41206495451 shard 1/3: 827 passed; PR #564
+# shard 2/3 twice), against recent green shards of 11m-17m. Coverage now runs in four shards with the
+# limits unchanged; the per-shard times are re-measured after three green main runs.
 jobs:
  frontend-coverage:
-    name: frontend coverage (shard ${{ matrix.shard }}/3)
+    name: frontend coverage (shard ${{ matrix.shard }}/4)
    runs-on: ubuntu-latest
    # Layout comparisons depend on the fonts each browser falls back to, so browser jobs run in the
    # same pinned Playwright image as local runs (tag = @playwright/test in tools/vendor/package-lock.json;
@@ -59,7 +63,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        shard: [1, 2, 3]
+        shard: [1, 2, 3, 4]
    steps:
      - uses: actions/checkout@v7
      # The image's own Python 3.12 and Node 24: setup-python/setup-node install the runner's toolcache
@@ -88,13 +92,13 @@ jobs:
      - run: npm ci --prefix tools/vendor --ignore-scripts
      # Shard 1 also runs the node units and the viewer suite, so the vendor pins and the tooling tests
      # run on the lightest shard instead.
-      - if: matrix.shard == 3
+      - if: matrix.shard == 4
        run: npm run --prefix tools/vendor check
-      - if: matrix.shard == 3
+      - if: matrix.shard == 4
        run: npm run --prefix tools/vendor test
-      - name: Page workflows with coverage, shard ${{ matrix.shard }}/3
+      - name: Page workflows with coverage, shard ${{ matrix.shard }}/4
        timeout-minutes: 18
-        run: npm run --prefix tools/vendor test:coverage:shard -- ${{ matrix.shard }}/3
+        run: npm run --prefix tools/vendor test:coverage:shard -- ${{ matrix.shard }}/4
      - name: Upload raw coverage
        uses: actions/upload-artifact@v7
        with:
@@ -136,13 +140,13 @@ jobs:
        with:
          pattern: coverage-raw-*
          path: ${{ runner.temp }}/coverage-raw
-      # coverage:merge only checks that raw files exist; merging two of three shards would report
+      # coverage:merge only checks that raw files exist; merging three of four shards would report
      # partial coverage, so a missing or empty shard artifact fails here.
      - name: Verify every shard's raw coverage arrived
        shell: bash
        env:
          STAGED_RAW: ${{ runner.temp }}/coverage-raw
-          EXPECTED_SHARDS: 3
+          EXPECTED_SHARDS: 4
        run: |
          found=0
          for shard in $(seq 1 "$EXPECTED_SHARDS"); do
@@ -74,14 +74,14 @@ V8 files it writes under `coverage/js/raw`:

 ```sh
 PM_TEST_WORKERS=8 npm run --prefix tools/vendor test:coverage            # whole run, one report
-npm run --prefix tools/vendor test:coverage:shard -- 1/3                 # node units, viewer suite, workflows 1/3
-npm run --prefix tools/vendor test:coverage:shard -- 2/3                 # workflows 2/3 (likewise 3/3)
+npm run --prefix tools/vendor test:coverage:shard -- 1/4                 # node units, viewer suite, workflows 1/4
+npm run --prefix tools/vendor test:coverage:shard -- 2/4                 # workflows 2/4 (likewise 3/4, 4/4)
 npm run --prefix tools/vendor coverage:merge                             # report and baseline check of every raw file
 npm run --prefix tools/vendor test:workflows -- --project webkit --shard 2/2
 ```

 `coverage:merge` refuses an empty raw directory; it does not count shards, so run
-every shard first (CI's merge job checks all three arrived). Measured on a 32-CPU
+every shard first (CI's merge job checks all four arrived). Measured on a 32-CPU
 machine in the pinned image (2026-10-21): `test:coverage` takes about 5 minutes
 with 8 workers and 24 minutes with 1; all four projects, 8 workers, each test 3
 times (6132 tests), 24 minutes. A CI-sized run (`docker run --cpus=4`,
@@ -189,14 +189,14 @@ check, so run it before pushing a new or deleted frontend file instead of
 waiting for the `frontend coverage` jobs.

 The `viewerjs` check runs on every PR, including backend-only changes. It is an
-aggregate job. It requires the three `frontend coverage (shard N/3)` jobs and
+aggregate job. It requires the four `frontend coverage (shard N/4)` jobs and
 `frontend coverage (merge)` to succeed on every event. The four
 `page workflows (firefox|webkit, shard N/2)` jobs run only in the merge queue,
 on `main` and on `workflow_dispatch` (see "Pull requests and the merge queue").
 `viewerjs` requires them to be skipped on a pull request and to succeed
 everywhere else. Any other failed, cancelled or skipped job fails it. Every browser job runs with `PM_TEST_WORKERS: 3` (the public
-runners have 4 vCPUs). Each coverage shard runs `test:coverage:shard -- N/3`
-(shard 1 also runs the node units and the viewer suite, shard 3 the vendor pins
+runners have 4 vCPUs). Each coverage shard runs `test:coverage:shard -- N/4`
+(shard 1 also runs the node units and the viewer suite, shard 4 the vendor pins
 and tooling tests) and uploads its raw V8 files as `coverage-raw-N` (kept 3
 days). The merge job downloads them, fails unless all three arrived with raw
 files and without clashing names, then runs `coverage:merge` (report plus
@@ -261,7 +261,7 @@ the process exits non-zero.
  job fails anyway and the dump is what matters.
 - `PM_TEST_SLOWEST=N` (off by default) lists the N slowest tests after the
  summary, each timed from its `start:` line to the next one like the hang
-  limit. The Windows and macOS jobs (`portability.yml`) set it to 40, so every
+  limit. The Windows jobs (`portability.yml`) set it to 40, so every
  run shows where its time went (#487). The list prints only when the run
  ends: a job GitHub cancels or a watchdog exit prints none, so read the
  timestamps between `start:` lines instead.
@@ -327,7 +327,7 @@ Python 3.13/3.14, real ComfyUI and Firefox/WebKit failures first show up in the
 merge queue, on the merge-group commit rather than the
 pushed one. Find that run with `gh run list --event merge_group --workflow test.yml`
 (or `viewerjs-check.yml`) and match its head branch
-(`gh-readonly-queue/main/pr-<N>-...`). Windows and macOS failures show up only
+(`gh-readonly-queue/main/pr-<N>-...`). Windows failures show up only
 after the merge, in `gh run list --workflow portability.yml`.

 Start fixing as soon as a failed log shows the cause, but push the fix only after
@@ -345,11 +345,16 @@ and the time left. The steps, in order:
   monitor's callbacks (Needs review recorder, preview queue, Images listing
   listener).
 2. `ImageMonitor.stop_monitoring` works against one 5 s deadline. Closing the
-   image handler joins the image worker; watchdog's `observer.stop()` (not
-   bounded here) and the observer join get what is left, which can be 0 s.
-3. `close_auto_thumbnails(final=True)` stops the preview worker (30 s) and
-   kills ffmpeg.
-4. `PromptTracker.shutdown` stops the prompt cleanup thread (2 s).
+   image handler joins the image worker; watchdog's `observer.stop()` and the
+   observer join get what is left, which can be 0 s. `stop()` joins watchdog's
+   emitters without a limit, so it runs on a daemon thread and is waited for
+   only until the deadline; a later stop waits for that same call (#561).
+3. `close_auto_thumbnails(final=True)` stops the preview worker (30 s),
+   kills ffmpeg and shuts the interactive image pool down.
+4. `shutdown_job_pool` (`utils/parallel.py`) cancels the long-lived job pool's
+   queued items and joins its threads (5 s; part `workers`, only when a job
+   used the pool, #523).
+5. `PromptTracker.shutdown` stops the prompt cleanup thread (2 s).

 A failing step, or a second Ctrl+C, is logged with its traceback and does not
 skip the later steps. A clean run logs one INFO line to PromptManager's log:
@@ -361,6 +366,15 @@ stored, with the parts not reached False, and the `atexit` callback is
 removed: the later steps are skipped, no summary line is logged, and a later
 call returns that result and runs nothing.

+The observer is started from a short-lived daemon thread, so every thread it
+creates is a daemon (a thread inherits that flag from the thread that creates
+it). watchdog 7 on Windows starts a plain `threading.Thread` per watch for its
+`ReadDirectoryChangesW` reader; created from ComfyUI's main thread it would not
+be a daemon, and the interpreter waits for every such thread before it runs any
+`atexit` callback, so the teardown would never start (#561).
+`tests/test_package_exit.py` runs a child whose observer does both (a plain
+reader thread, a `stop()` that never returns) and requires its exit.
+
 ComfyUI never runs aiohttp's `on_cleanup` hooks, because it never calls
 `runner.cleanup()`. So `atexit` is the live host's path. It runs on Ctrl+C
 (`main.py` catches `KeyboardInterrupt` and returns) and on a normal exit.
@@ -445,12 +459,44 @@ A hot SQLite read that returns many rows aggregates them into one step
 (`json_group_array`) instead of stepping once per row, so it does not wait for
 the GIL once per row while ComfyUI generates (#354, `get_image_link_matches`).

+A metadata read never decodes pixels (#523). Pillow's `PngImageFile.text` loads
+every pixel to reach text chunks after IDAT; the scan (`_extract_comfyui_metadata`)
+and the image monitor (`ComfyUIMetadataExtractor.extract_metadata`) read PNG text
+through `utils/png_text.py`, which runs Pillow's own chunk handlers after the
+first IDAT and seeks over pixel data. The legacy `.text` read is the floor:
+`tests/test_png_text.py` compares both readers on every image under
+`tests/fixtures`, a curated corpus (text after IDAT, zTXt, iTXt, split IDAT, bad
+checksums, truncations, oversized text, APNG) and a seeded fuzz, and asserts that
+neither reader decodes pixels by patching `ImageFile.load`. The only reads that
+differ are files whose pixel data is undecodable or cut short: legacy found
+nothing, the walk keeps the text before the pixels. Animated PNGs still use
+`.text`.
+
+Image work runs on PromptManager's own threads (#523). glibc keeps each thread's
+malloc arena at its high-water mark, so image buffers spread over the default
+executor's threads stay resident. Interactive image work (view previews behind their
+gate, workspace card facts, both inspector routes) runs on the API's fixed
+`pm-image` pool (`IMAGE_POOL_SIZE` 3, `_run_image`, `_map_image`; card facts already
+cached answer without a trip; while the gate's 3 preview writes hold every thread, a
+card or inspector read waits for one of them, by design of the merged pool; after the
+package teardown the pool is not recreated and late calls use the default executor). Jobs (scan metadata and file facts, thumbnail and
+convert jobs, the legacy gallery generation, capture previews) run through
+`map_parallel` on one long-lived `pm-worker` pool of Worker threads, reused between
+jobs; a new Worker threads value replaces it (the teardown also joins a replaced pool
+still finishing), and a call made from a job thread runs inline. After a scan, thumbnail or convert job, or the legacy gallery generation,
+`release_free_memory` (`utils/native_memory.py`) calls glibc's `malloc_trim(0)` once;
+it does nothing on Windows, macOS and musl and never raises. No allocator setting
+changes. `tests/test_image_pools.py` asserts the thread of each read and write and the
+trim; `tests/test_utils_parallel.py` the pool's reuse, resize, nesting and shutdown.
+`tools/perf/memory_drive.py` (manual, Linux, never in CI) measures RSS, heap, threads
+and arenas under the #523 load against the disposable browser test server.
+
 The `perf budget` job in `.github/workflows/test.yml` is the reference
 measurement: `ubuntu-latest`, one Python, no coverage, only the wall-clock tests.
 It runs on every push to `main` and on `workflow_dispatch`, never on pull
 requests, because shared-runner timing must not block a merge. Dispatch it on a
 branch to measure before merging.
-Shared Windows and macOS runners do not run them; the structural tests cover
+Shared Windows runners do not run them; the structural tests cover
 portability. Run it locally with
 `PROMPTMANAGER_PERF_BUDGET=1 python -m unittest tests.test_api_workspace_images.TestWorkspaceImages.test_filter_budget`
 and quote the printed p95 in the PR body.
@@ -646,10 +692,10 @@ Before changing paths, SQLite, streams, restore or cleanup:
  ordinary busy timeout; cross-thread handoffs wait on events with generous
  ceilings, never a short wall clock (#242).
 - Run native Windows CI early for these changes. Pull requests and the merge
-  queue run only Linux, so start Windows and macOS on the branch with
+  queue run only Linux, so start Windows on the branch with
  `gh workflow run portability.yml --ref <branch>`.
-  Include a Windows impact and evidence note in the PR. All six Windows/macOS
-  combinations in that run, every Linux leg and every applicable
+  Include a Windows impact and evidence note in the PR. All three Windows
+  legs in that run, every Linux leg and every applicable
  exact-head check must pass before merge. Portable `ntpath`/`PureWindowsPath`
  controls do not establish native filesystem, locking or cleanup success.

@@ -664,11 +710,11 @@ what runs:
 | `py3.13 on ubuntu-latest`, `py3.14 on ubuntu-latest` | not created | run |
 | `real ComfyUI compatibility` | skipped | runs |
 | `coverage gate (85%)`, `black and flake8`, `frontend modules`, `bandit (high severity)` | run | run |
-| `frontend coverage (shard N/3)`, `frontend coverage (merge)` (vendor pins and tooling tests on shard 3) | run | run |
+| `frontend coverage (shard N/4)`, `frontend coverage (merge)` (vendor pins and tooling tests on shard 4) | run | run |
 | `page workflows (firefox\|webkit, shard N/2)` | skipped | run |
 | `all tests`, `viewerjs` (gates) | run | run |
 | `perf budget` | skipped | push and dispatch only (not in the queue) |
-| `py3.12-3.14 on windows-latest/macos-latest` (`portability.yml`) | not run | push to `main`, nightly, `workflow_dispatch` only; never required |
+| `py3.12-3.14 on windows-latest` (`portability.yml`) | not run | push to `main`, nightly, `workflow_dispatch` only; never required |

 GitHub has one required set for pull requests and the queue. A job skipped by
 its `if:` reports Success. A dropped matrix leg never reports, so it would stay
@@ -681,8 +727,9 @@ guarantee:
 So a merge group cannot turn green unless all three Linux Python legs, real
 ComfyUI and the four browser shards passed.

-Windows and macOS (Python 3.12-3.14) are out of the blocking path for now
-(maintainer, 2026-10-28). They run in `portability.yml` on every push to `main`,
+Windows (Python 3.12-3.14) is out of the blocking path for now
+(maintainer, 2026-10-28). macOS is not tested in CI (maintainer, 2026-10-31, #571);
+its code stays and support is best-effort. They run in `portability.yml` on every push to `main`,
 nightly and on demand, and no context there is required. A red portability run
 is still a failure: fix it at its cause, not by rerunning, and have every one
 green before the workspace cutover (#334). `tests/vendor/ci-workflow.test.mjs` pins the
@@ -1407,6 +1454,8 @@ is shorter than the row it reserves.
 Each Overview card is the count of the page it names: the shell's Library, Images and Tags sidebar counts, one source,
 so a card and its badge cannot differ. `/prompt_manager/stats` is for the legacy page and counts raw rows. A visit re-reads
 the three unless a read is in flight. An unread or failed card shows a dash; Retry re-reads only the failed counts.
+System › Overview's Images metric reads the same shell count (#555), so it, the Overview card and the Images badge show
+one number; its Statistics dialog labels the legacy row counts as "Database records".
 Tests: `tests/js/workspace-state.test.js`, `tests/browser/workspace.spec.mjs`, `tests/comfyui/workspace.spec.mjs`.

 ### Images page controls and recorded deviations (#249 PR C)
@@ -2549,8 +2598,8 @@ files to the system trash. **No code path unlinks or overwrites a media file.**
  ("Moving files to the Recycle Bin isn't available on Windows: files larger than the bin's
  capacity would be deleted permanently."). Library-only removal works everywhere. Tests use `tests/fake_trash.py`; the
  browser test server installs it, so no test touches a real trash. The native proof,
-  `tests/test_trash_macos_native.py`, runs only with `PM_NATIVE_TRASH=macos` in
-  portability.yml's `native-trash` job (`macos-latest` and `macos-15-intel`): the startup
+  `tests/test_trash_macos_native.py`, runs only with `PM_NATIVE_TRASH=macos` on a Mac, by hand
+  (CI dropped its `native-trash` macOS job in #571; it last passed on `macos-latest` and `macos-15-intel`): the startup
  volume, a name clash, fresh APFS and FAT32 disk images, an image used as an output root,
  a read-only image and an unwritable folder (design and probe:
  `docs/egm/499-macos-trash/`, local).
@@ -3844,8 +3893,8 @@ workspace never asks; previews are a cache the server keeps:
 - `GET /images/serve/thumbnails/<rel>_thumb<ext>` for a missing preview is refused as
  text first (traversal, a backslash, a drive or stream colon, empty or dot segments, so
  `D:/x`, `\\server\share` and a leading `/` never reach a joined path), then admitted
-  on the event loop (`_PreviewGate`): 3 previews are written at once on the API's own
-  `pm-preview` pool (never the default executor), one flight runs per file (the history
+  on the event loop (`_PreviewGate`): 3 previews are written at once on the API's
+  interactive `pm-image` pool (never the default executor; #523), one flight runs per file (the history
  route shares the flight key and the admission), and at most 64 requests wait; one
  more gets its fallback at once without listing a folder. Inside the admission the
  preview maps back to its media file under the same root (exact names, then one folder
@@ -3878,7 +3927,7 @@ workspace never asks; previews are a cache the server keeps:
  `exclusive` job runs (`_auto_thumbnail_blocker`), checked when a write starts (after
  its slot) and again just before its rename.
 - Shutdown is bounded and logged: the worker stops at a file boundary, ffmpeg is
-  killed, an idle worker leaves (the next output starts a fresh one), the view pool
+  killed, an idle worker leaves (the next output starts a fresh one), the image pool
  shuts down, and after the app's cleanup a late monitor event
  starts nothing. A package reload stops the workers the previous import left.
 - Cards and strips load previews only: Images in every layout and size, Library cards,
@@ -4006,7 +4055,11 @@ the per-section hand-off panel, was retired by S12 (#329): every section is nati
  "Save preferences" is `aria-disabled` (opacity .55, `not-allowed`) while clean or
  saving; a setting the last save could not save gets a red outline. CSS under D92.
 - **D93** (Overview): real values. The metrics are the Library's eligible positives
-  and active saved negatives and the indexed `generated_images` rows (Q2). "Database
+  and active saved negatives and the Images count (#555, amending Q2's indexed
+  `generated_images` rows): the shell's Images sidebar count, the Images page's own
+  total, which also lists files no row links, as the concept's `images.length` is
+  both. A visit re-reads it unless a read is in flight; "–" until read or after a
+  failed read. `images.indexed` stays in the API and is not shown. "Database
  integrity" is "Not checked" until a check ran this session, then "N issues" (checks
  that found issues, even beside a check that could not run), "Passed" or "Incomplete".
  The review row is "N ambiguous image links" (the Needs review queue's pending count,
@@ -4044,10 +4097,11 @@ the per-section hand-off panel, was retired by S12 (#329): every section is nati
 - **D96** (Statistics; amended by D153): "Usage statistics" without the sample note: the
  concept's "Runs by category" table without its Avg. rating column (Category / Runs)
  with the real runs of eligible parents per category ("Uncategorized"), then a second
-  table "Library totals" (Total / Count: Prompts, Tags, Images from the legacy
-  statistics; no Rated images). The API still reports `average_rating` and
+  table "Database records" (Total / Count: Prompt records, Tags on prompts, Image
+  records: the raw row counts of the legacy statistics, labelled as rows so they never
+  read as the Library or Images page counts, #555; no Rated images). The API still reports `average_rating` and
  `rated_images`; the workspace does not show them.
-  The Overview row says "Runs by category, with library totals." because
+  The Overview row says "Runs by category, with database record counts." because
  that is what the dialog shows (the concept's own dialog shows only "Runs by
  category"); per-prompt run counts, prompt tags and dated runs are recorded, but no
  table of them exists yet. A failed read toasts "Statistics could not
@@ -4350,6 +4404,23 @@ the per-section hand-off panel, was retired by S12 (#329): every section is nati
  choice. The host's checks still refuse a linked field or a changed workflow, and the
  sender also refuses if the destination's `revision` (node object plus graph version)
  moved since discovery; it is undefined on an older tab, which skips the comparison. A host error reads as a refusal, not "may have applied".
+- **D191** (#542, beyond the concept; maintainer 2026-10-31, Q542-1 A to 5 A): a window with two or more
+  eligible nodes adds a last Destination node option "All N eligible nodes" (`ALL_NODES` in
+  `prompt-sender.mjs`), never selected for you (D173). Eligible is D173's filter; the nodes it leaves out
+  stay counted in the discovery sentence. One window only. Preview stays optional (D175): Preview changes
+  shows one `section.prompt-sender-node` per node, headed "#<id> <title>", in send order (node id,
+  numeric). Apply previews every node first and writes nothing if any refuses ("#<id> <title>: <reason>
+  Nothing was sent."). Then it sends one node after another. Only the first node of a pass taken in that
+  click keeps its ticket; every other node, and every node of a held Preview (host tickets expire after
+  30 s), takes a fresh ticket that is refused unless its Before texts and composition equal the reviewed
+  ones. That fresh preview checks the discovered revision until something has been posted, and not after,
+  since our own write may move the graph version. Refusals are best effort: "Sent to 2 of 3 nodes in
+  <window>. #12 <title>: <host's refusal>."; Apply stays available and a retry sends to every node again
+  (rewriting the same text). A lost reply stops the run, names that node as unknown and lists the nodes
+  not sent. Closing the dialog stops after the current node. The review sections are labelled by their
+  `h4` node heading. Unit tests in `tests/js/prompt-sender.test.js`, a fake three-node host in
+  `tests/browser/prompt-inspector.spec.mjs`, real Classic and Nodes 2.0 widgets in
+  `tests/comfyui/prompt-sender.spec.mjs`.
 - **D106** (Integrations, S10, Q8): the send bridge always asks for the ComfyUI window
  and node, and the nodes always follow ComfyUI's own renderer, so "Default send
  destination" offers only "Ask each time" and "Host compatibility" only "Follow host
@@ -5413,7 +5484,7 @@ list stay unscoped: any row's control proves them.
 | Worker threads | `admin.html:437–445` | S4 Sources | covered | `sources` · slider · "Worker threads" | worker range max is cpu_count (workspace-system-sources.spec.mjs) |
 | LoraManager badge, enable, path, trigger words, CivitAI key, clear key | `admin.html:448–490`; `admin.js:1052–1156` | S10 Integrations | covered | `integrations` · switch · "LoraManager integration" | LoRA rows show detected / enabled / cache-loaded separately (workspace-system-integrations.spec.mjs) |
 | LoRA data import with progress | `admin.html:492–498,517–541`; `admin.js:1157` | S10 Integrations | covered | `integrations` · button · "Review import" | Review import shows replacement, blocked items and network effects with the backup box; Start opens the job (D107) (workspace-system-integrations.spec.mjs) |
-| Statistics | `admin.html:159`; `admin.js:1627` | S2 Overview | covered | `overview` · button · "Explore" | statistics dialog lists runs by category and library totals (workspace-system.spec.mjs) |
+| Statistics | `admin.html:159`; `admin.js:1627` | S2 Overview | covered | `overview` · button · "Explore" | statistics dialog lists runs by category and database record counts (workspace-system.spec.mjs) |
 | Export components JSON `/export` | `admin.html:163`; `admin.js:1607`; `py/api/prompts.py:238` | S9 Backup & export | covered | `backups` · button · "Export all prompts JSON" | Export JSON downloads /library/export; secondary buttons download all prompts (/export) and /pairs/export (D103) (workspace-system-backups.spec.mjs) |
 | Saved pairs export | `py/api/pairs.py:84` | S9 Backup & export | covered | `backups` · button · "Export saved pairs JSON" | Export JSON downloads /library/export; secondary buttons download all prompts (/export) and /pairs/export (D103) (workspace-system-backups.spec.mjs) |
 | Library export | `py/api/library.py:223` | S9 Backup & export | covered | `backups` · button · "Export JSON" | Export JSON downloads /library/export; secondary buttons download all prompts (/export) and /pairs/export (D103) (workspace-system-backups.spec.mjs) |
@@ -6797,7 +6868,7 @@ checkout or point this harness at a live ComfyUI checkout.

 The package-qualified config import also corrects #211: the configured database
 path is honored when PromptManager runs as a ComfyUI custom node. Follow the
-[database path compatibility and safe backup sequence](README.md#database-path-compatibility-211)
+[database path compatibility and safe backup sequence](README-legacy.md#database-path-compatibility-211)
 before restarting an existing deployment.

 The ledger records only new dequeued jobs and observed outcomes. Existing
@@ -120,6 +120,7 @@ except Exception as e:
        logger = get_logger("prompt_manager.init")
        logger.error(f"Failed to register API routes: {e}")
    except Exception:
+        # logging failed too; a report must never stop the node loading
        pass

 # Shared database, set up with the monitoring system below. Stays None when that
@@ -279,11 +280,11 @@ def _teardown_logger():


 def _stop_background_work():
-    """Stop the image monitor, the preview worker and the prompt cleanup
-    thread against one TEARDOWN_SECONDS deadline, once.
+    """Stop the image monitor, the preview worker, the job worker threads
+    and the prompt cleanup thread against one TEARDOWN_SECONDS deadline, once.

-    Returns ``{"monitor", "thumbnails", "tracker"}`` booleans (True: it
-    stopped), leaving out parts that never started. Later calls return a
+    Returns ``{"monitor", "thumbnails", "workers", "tracker"}`` booleans
+    (True: it stopped), leaving out parts that never started. Later calls return a
    copy of the first result. A Ctrl+C inside a step is logged and the
    step is False; one between steps is re-raised after the result (parts
    not reached are False) is stored and the ``atexit`` entry removed.
@@ -297,11 +298,14 @@ def _stop_background_work():
            api,
            _global_prompt_tracker,
        )
+        from .utils import parallel
+
        # A part whose global is set has started; False until its step says
        # otherwise, so an interrupt between steps leaves an honest result.
        started = (
            ("monitor", monitor),
            ("thumbnails", thumbnails),
+            ("workers", parallel.job_pool_started() or None),
            ("tracker", tracker),
        )
        result = {name: False for name, part in started if part is not None}
@@ -344,6 +348,16 @@ def _stop_background_work():
                result["thumbnails"] = _teardown_step(
                    "the preview worker", close_previews, logger
                )
+            if "workers" in result:
+
+                def stop_workers():
+                    from .utils.parallel import JOB_POOL_JOIN_SECONDS
+
+                    return parallel.shutdown_job_pool(left(JOB_POOL_JOIN_SECONDS))
+
+                result["workers"] = _teardown_step(
+                    "the job worker threads", stop_workers, logger
+                )
            if tracker is not None:

                def stop_tracker():
@@ -411,6 +425,7 @@ except Exception as e:
            f"Failed to register the exit signal: {e}"
        )
    except Exception:
+        # logging failed too; a report must never stop the node loading
        pass

 try:
@@ -428,16 +443,14 @@ except Exception as e:
            f"Failed to register the background work teardown: {e}"
        )
    except Exception:
+        # logging failed too; a report must never stop the node loading
        pass

 __all__ = ["NODE_CLASS_MAPPINGS", "NODE_DISPLAY_NAME_MAPPINGS", "WEB_DIRECTORY"]

-# Print startup message with loaded tools
-print()
-print(f"\033[94m[ComfyUI-PromptManager] Version:\033[0m {get_version()}")
-for node_key, display_name in NODE_DISPLAY_NAME_MAPPINGS.items():
-    # ASCII only: a Windows console using a legacy code page cannot print emoji,
-    # and a UnicodeEncodeError here would abort loading the whole node.
-    print(f"  \033[94mLoaded:\033[0m {display_name}")
-print(f"\033[94mTotal: {len(NODE_CLASS_MAPPINGS)} tools loaded\033[0m")
-print()
+# One startup line. ASCII only: a Windows console using a legacy code page
+# cannot print emoji, and a UnicodeEncodeError here would abort loading the node.
+print(
+    f"\033[94m[ComfyUI-PromptManager] Version:\033[0m {get_version()}"
+    f" - {len(NODE_CLASS_MAPPINGS)} tools loaded"
+)
@@ -590,6 +590,7 @@ class _Move:
            try:
                os.rmdir(self.plan.target_dir)
            except OSError:
+                # not empty or already gone: the undo leaves it alone
                pass


@@ -35,38 +35,51 @@ from __future__ import annotations

 import contextlib
 import logging
+import operator
+import sys
 import threading
 import time
 import weakref
-from typing import Iterable, Iterator, List, Optional
+from collections import deque
+from typing import Any, Callable, Iterable, Iterator, List, Optional

 import sqlite3

 CLOSED_MESSAGE = "Cannot operate on a closed database."
 # Rows fetched per step when a cursor is iterated: the connection is marked
 # in use once per chunk instead of once per row (iteration costs about what
-# a plain cursor costs). A loop that stops early leaves up to this many rows
-# fetched; ``fetchone``/``fetchmany`` after a partial loop skip them.
+# a plain cursor costs). Prefetched rows belong to the cursor so iteration
+# and explicit fetches always advance the same position.
 ITER_CHUNK = 128


 class ManagedCursor(sqlite3.Cursor):
    """A cursor whose calls into SQLite count as its connection being in use."""

+    def __init__(self, *args: Any, **kwargs: Any) -> None:
+        super().__init__(*args, **kwargs)
+        self._pending = deque()
+        self._closed = False
+
    def execute(self, sql, parameters=(), /):
-        conn = self.connection
-        conn._enter()
-        try:
-            return super().execute(sql, parameters)
-        finally:
-            conn._leave()
+        return self._run_statement(super().execute, sql, parameters)

    def executemany(self, sql, seq_of_parameters, /):
+        return self._run_statement(super().executemany, sql, seq_of_parameters)
+
+    def _run_statement(self, operation: Callable, *args: Any) -> ManagedCursor:
        conn = self.connection
        conn._enter()
+        description = self.description
+        completed = False
        try:
-            return super().executemany(sql, seq_of_parameters)
+            result = operation(*args)
+            completed = True
+            return result
        finally:
+            # Argument parsing can fail before SQLite replaces the old statement.
+            if completed or self.description is not description:
+                self._pending.clear()
            conn._leave()

    def executescript(self, sql_script, /):
@@ -81,6 +94,8 @@ class ManagedCursor(sqlite3.Cursor):
        conn = self.connection
        conn._enter()
        try:
+            if self._pending and not self._closed:
+                return self._pending.popleft()
            return super().fetchone()
        finally:
            conn._leave()
@@ -89,7 +104,20 @@ class ManagedCursor(sqlite3.Cursor):
        conn = self.connection
        conn._enter()
        try:
-            return super().fetchmany(*args, **kwargs)
+            # Let SQLite validate the original arguments, including version-specific
+            # handling of zero/negative sizes, before touching prefetched rows.
+            rows = super().fetchmany(*args, **kwargs)
+            if not self._pending:
+                return rows
+            size = operator.index(
+                kwargs.get("size", args[0] if args else self.arraysize)
+            )
+            # Python 3.12 reads all rows for size=0; 3.13+ reads none.
+            if size == 0 and sys.version_info >= (3, 13):
+                return rows
+            self._pending.extend(rows)
+            count = len(self._pending) if size <= 0 else min(size, len(self._pending))
+            return [self._pending.popleft() for _ in range(count)]
        finally:
            conn._leave()

@@ -97,25 +125,31 @@ class ManagedCursor(sqlite3.Cursor):
        conn = self.connection
        conn._enter()
        try:
-            return super().fetchall()
+            rows = super().fetchall()
+            pending = list(self._pending)
+            self._pending.clear()
+            return pending + rows
        finally:
            conn._leave()

    def __iter__(self) -> Iterator:
-        return self._chunks()
-
-    def _chunks(self) -> Iterator:
-        while True:
-            rows = self.fetchmany(ITER_CHUNK)
-            if not rows:
-                return
-            yield from rows
+        return self

    def __next__(self):
        conn = self.connection
+        pending = self._pending
+        # Buffered Python rows need no SQLite lock, but retirement and cursor
+        # close must still stop an iterator obtained before either operation.
+        if conn._retired or self._closed:
+            raise sqlite3.ProgrammingError(CLOSED_MESSAGE)
+        if pending:
+            return pending.popleft()
        conn._enter()
        try:
-            return super().__next__()
+            pending.extend(super().fetchmany(ITER_CHUNK))
+            if not pending:
+                raise StopIteration
+            return pending.popleft()
        finally:
            conn._leave()

@@ -126,7 +160,10 @@ class ManagedCursor(sqlite3.Cursor):
        except sqlite3.ProgrammingError:
            return super().close()  # the connection is closed or closing
        try:
-            return super().close()
+            result = super().close()
+            self._pending = deque()
+            self._closed = True
+            return result
        finally:
            conn._leave()

@@ -293,6 +330,9 @@ class ManagedConnection(sqlite3.Connection):
            cursors = list(self._cursors)
        try:
            for cursor in cursors:
+                if isinstance(cursor, ManagedCursor):
+                    cursor._pending = deque()
+                    cursor._closed = True
                with contextlib.suppress(sqlite3.Error):
                    sqlite3.Cursor.close(cursor)
            super().close()
@@ -34,7 +34,7 @@ from .history_reads import HistoryReadOperations
 from .health import HealthOperations, iter_consistency_issues
 from .duplicate_copies import DuplicateCopyOperations
 from .workflow_storage import WorkflowStorageOperations
-from .category_import import CategoryImportOperations, EmptyReplacement  # noqa: F401
+from .category_import import CategoryImportOperations
 from .image_categories import ImageCategoryOperations
 from .workflow_documents import (
    DocumentReader,
@@ -46,6 +46,7 @@ def remove_quietly(*paths):
            if path and os.path.exists(path):
                os.remove(path)
        except OSError:
+            # cleanup after a failure must not replace that failure
            pass


@@ -66,7 +66,6 @@ def _tag_rows(page: str, order: str = "page.id") -> str:
    )


-_TAG_PAGE = _tag_rows("SELECT id,name FROM tags WHERE id>? ORDER BY id LIMIT ?")
 # #444 tag sorts: sort -> (key expression on tags/counted, direction). Ties and
 # "created" follow the id, so every order is total and keyset pages are exact.
 TAG_SORTS = {
@@ -85,6 +85,8 @@ try:
    from ...database.operations import PromptDatabase
    from ...utils.file_prompt import parse_comfyui_prompt
    from ...utils.logging_config import get_logger
+    from ...utils.native_memory import release_free_memory
+    from ...utils.png_text import png_text
    from ...utils.video_metadata import is_video_path, read_video_metadata
 except ImportError:
    import sys
@@ -95,6 +97,8 @@ except ImportError:
    from database.operations import PromptDatabase
    from utils.file_prompt import parse_comfyui_prompt
    from utils.logging_config import get_logger
+    from utils.native_memory import release_free_memory
+    from utils.png_text import png_text
    from utils.video_metadata import is_video_path, read_video_metadata


@@ -526,6 +530,14 @@ class PromptManagerAPI(
            return await loop.run_in_executor(None, call)
        return await loop.run_in_executor(None, func, *args)

+    async def _release_job_memory(self):
+        """After a scan or thumbnail job: glibc's free heap pages go back to
+        the OS once (``malloc_trim(0)``; nothing elsewhere, #523)."""
+        try:
+            await self._run_in_executor(release_free_memory)
+        except Exception:  # best effort: the job's result already stands
+            self.logger.debug("Releasing free memory failed", exc_info=True)
+
    def _root_listing(self, root) -> RootListing:
        """The shared listing record of one output root (created empty)."""
        return self._root_listings.setdefault(str(root), RootListing())
@@ -1048,6 +1060,8 @@ class PromptManagerAPI(
    def _extract_comfyui_metadata(self, image_path):
        """Embedded ComfyUI metadata of an image (PNG text chunks) or a video.

+        PNG text is read without decoding the pixels (``utils.png_text``, #523).
+
        Videos go through ffprobe (see utils/video_metadata). Unreadable files
        are a warning, not an error: a scan over a large output tree meets
        truncated and foreign files, and it carries on past them.
@@ -1056,7 +1070,7 @@ class PromptManagerAPI(
            return read_video_metadata(image_path)
        try:
            with Image.open(image_path) as img:
-                return dict(getattr(img, "text", None) or {})
+                return png_text(img)
        except Exception as e:
            self.logger.warning(
                f"Unreadable image {os.path.basename(str(image_path))}: {e}"
@@ -176,7 +176,7 @@ def _physical_file_key(path, stat):
    volumes on Windows) falls back to the resolved, case-folded path.
    """
    if stat.st_ino:
-        return ("inode", stat.st_dev, stat.st_ino)
+        return ("inode", (stat.st_dev, stat.st_ino))
    return ("path", os.path.normcase(os.path.realpath(str(path))))


@@ -539,6 +539,7 @@ def _diagnose_output_dirs(configured_dirs, public_path=None):

        candidates.append(folder_paths.get_output_directory())
    except ImportError:
+        # outside ComfyUI there is no output folder to add
        pass

    output_dirs = []
@@ -1453,6 +1454,7 @@ class AdminRoutesMixin:
            verb = "cancelled" if state == "cancelled" else "finished"
            job.log_line(f"Scan {verb} · {_plural(job.processed, 'file')} processed")
        job.finish(state)
+        await self._release_job_memory()
        if state == "finished":
            # After the scan, so the guarded thumbnail job is admitted (#249).
            await self._hand_off_scan_thumbnails(job, output_dirs)
@@ -1667,9 +1669,10 @@ class AdminRoutesMixin:
    def _extract_batch_metadata_sync(self, file_batch):
        """Extract metadata from a batch of files in one executor call.

-        Files are read on ``PromptManagerConfig.WORKER_THREADS`` threads:
-        Pillow decodes the whole image to reach trailing text chunks and
-        releases the GIL while doing so.
+        Files are read on the long-lived job pool of
+        ``PromptManagerConfig.WORKER_THREADS`` threads (#523).
+        PNG text is read chunk by chunk without decoding pixels (#523); file
+        reads and ffprobe release the GIL.
        """
        from ..config import PromptManagerConfig

@@ -13,7 +13,6 @@ import math
 from ..tagging_defaults import (  # noqa: F401 - re-exported for the route
    LLM_MODEL_TYPES as LLM_MODELS,
    MAX_INSTRUCTION_BYTES,
-    MAX_INSTRUCTION_CHARS,
    MODEL_TYPES,
    WD14_MODEL_TYPES as WD14_MODELS,
    validate_template,
@@ -20,7 +20,7 @@ from .jobs import (

 from .maintenance import disk_plan
 from .prompts import thumbnail_url_for
-from . import thumbnail_settings
+from . import preview_store, thumbnail_settings
 from .. import model_gate

 try:
@@ -424,6 +424,7 @@ class AutotagRoutesMixin:
        title = f"Tagging model download · {label}"
        _download_titles.clear()
        _download_titles[owner] = title
+        admitted = False
        try:
            job = self._jobs.start(
                MODEL_DOWNLOAD_JOB_KIND,
@@ -439,13 +440,13 @@ class AutotagRoutesMixin:
                    self._run_model_download, service, model_type, owner
                ),
            )
-        except BaseException as refused:
-            # JobBusy, or anything else the registry raised: give the gate back.
-            model_gate.release(owner)
-            _download_titles.pop(owner, None)
-            if isinstance(refused, JobBusy):
-                return None, busy_response(refused)
-            raise
+            admitted = True
+        except JobBusy as refused:
+            return None, busy_response(refused)
+        finally:
+            if not admitted:  # JobBusy, or anything else: give the gate back.
+                model_gate.release(owner)
+                _download_titles.pop(owner, None)

        def ended(_task):
            model_gate.release(owner)
@@ -1041,12 +1042,12 @@ class AutotagRoutesMixin:
                return self._bad_request('existing must be "skip" or "merge"')
            try:
                options = self._single_options(data, model_type)
+            except OptionError as error:
+                return self._bad_request(str(error))
            except (ValueError, TypeError):
                return self._bad_request(
                    "general_threshold and character_threshold must be numeric"
                )
-            except OptionError as error:
-                return self._bad_request(str(error))
            target, error = await self._select_autotag_target(data)
            if error is not None:
                return error
@@ -1370,7 +1371,8 @@ class AutotagRoutesMixin:
            files = await self._run_in_executor(
                self._without_removed, output_path, files
            )
-            has_thumbnails = (output_path / "thumbnails").is_dir()
+            store = preview_store.store_dir(output_path)
+            has_thumbnails = store is not None and store.is_dir()

            images = []
            for image_path in files:
@@ -971,6 +971,7 @@ class BackupRestoreRoutesMixin:
        line = restored_line(staged.summary)
        job.log_line(line)
        job.update(progress=100, status_line=line)
+        return None


 async def _outlive_cancel(future):
@@ -574,12 +574,13 @@ class DuplicateFilesMixin:
            return _fail_job(job, "sources-changed", SOURCES_CHANGED)
        ok, backup = await self._safety_backup_step(job, db, backup_on)
        if not ok:
-            return
+            return None
        try:
            await self._remove_duplicates(job, db, plan, backup)
        finally:
            if backup:
                await self._prune_backup_pool(job, db)
+        return None

    async def _remove_duplicates(self, job, db, plan, backup):
        targets = plan.payload["targets"]
@@ -27,7 +27,7 @@ def _identity(path):
    except OSError:
        return None
    if info.st_ino:
-        return ("inode", info.st_dev, info.st_ino)
+        return ("inode", (info.st_dev, info.st_ino))
    return ("path", os.path.normcase(os.path.realpath(str(path))))


@@ -843,7 +843,10 @@ class HistoryRoutesMixin:
                raise

        async def execute():
-            pending = asyncio.create_task(self._run_in_executor(project))
+            # An inspection reads the file's header and text: the
+            # interactive image pool (#523); media stays on the default.
+            run = self._run_image if kind == "inspection" else self._run_in_executor
+            pending = asyncio.create_task(run(project))
            try:
                return await asyncio.shield(pending)
            except asyncio.CancelledError:
@@ -15,10 +15,10 @@ from typing import BinaryIO

 from aiohttp import web

-from . import thumbnail_settings
+from . import preview_store, thumbnail_settings
 from .images import _canonical, _public_path, SERVABLE_EXTENSIONS, VIDEO_EXTENSIONS
 from .images import in_trash_below_roots
-from .images import existing_media_thumbnail, media_thumbnail_rel
+from .images import existing_media_thumbnail, media_preview_path

 try:
    from ...utils.execution_outputs import (
@@ -326,12 +326,10 @@ class _OpenedCurrentMedia:


 def _preview_writable(root: Path, preview: Path) -> bool:
-    """A preview may be written: ``thumbnails`` and every link segment of the
-    preview's folder resolve inside *root* (the serve route's rule, #249)."""
-    folder = root / "thumbnails"
-    return _canonical(folder).is_relative_to(_canonical(root)) and _canonical(
-        preview
-    ).is_relative_to(_canonical(folder))
+    """A preview may be written: the store of *root* and every link segment
+    of the preview's folder resolve inside it (the serve route's rule, #249;
+    ``preview_store.owns``)."""
+    return preview_store.owns(root, preview)


 def _is_jxl(path) -> bool:
@@ -381,8 +379,12 @@ def _cover_target(resolved, ensure_preview, placeholder, accepts_jxl):
        return _canonical(preview)
    if preview is not None:
        return _canonical(preview)
-    preview = resolved.gallery_root / media_thumbnail_rel(relative)
-    if ensure_preview is not None and _preview_writable(resolved.gallery_root, preview):
+    preview = media_preview_path(resolved.gallery_root, relative)
+    if (
+        ensure_preview is not None
+        and preview is not None
+        and _preview_writable(resolved.gallery_root, preview)
+    ):
        ensure_preview(target, preview, is_video)
    if is_video and placeholder is not None:
        return _placeholder_media(placeholder)
@@ -330,12 +330,13 @@ class ImageDeleteMixin:
            return _fail_job(job, "sources-changed", SOURCES_CHANGED)
        ok, backup = await self._safety_backup_step(job, db, backup_on)
        if not ok:
-            return
+            return None
        try:
            await self._delete_images(job, db, targets, mode, backup)
        finally:
            if backup:
                await self._prune_backup_pool(job, db)
+        return None

    async def _delete_images(self, job, db, targets, mode, backup):
        job.update(total=len(targets), status_line=TITLES[mode])
@@ -531,6 +531,7 @@ class ImageTagJobsMixin:
        run = AutotagRun(
            model_type, existing, options, keep_in_memory, backup_on, owner
        )
+        admitted = False
        try:
            job = self._jobs.start(
                AUTOTAG_BATCH_JOB_KIND,
@@ -541,11 +542,12 @@ class ImageTagJobsMixin:
                groups=AUTOTAG_GROUP_NAMES,
                runner=functools.partial(self._run_autotag_batch, run),
            )
-        except BaseException as refused:
-            model_gate.release(owner)
-            if isinstance(refused, JobBusy):
-                return None, _busy_refusal(refused)
-            raise
+            admitted = True
+        except JobBusy as refused:
+            return None, _busy_refusal(refused)
+        finally:
+            if not admitted:
+                model_gate.release(owner)
        job.task.add_done_callback(lambda _task: model_gate.release(owner))
        return job, None

@@ -34,15 +34,13 @@ from .gallery_listing import (
    WalkOutcome,
    walk_root,
 )
-from . import thumbnail_settings
+from . import preview_store, thumbnail_settings
 from .thumbnail_encode import (
    PREVIEW_HELD,
    EncoderClosed,
    PreviewWriteHeld,
-    replace_unless_held,
    run_encoder,
    sweep_stray_temps,
-    temp_sibling,
    thumbnail_frame,
    writer_settings,
    write_thumbnail,
@@ -339,11 +337,6 @@ def _thumbnail_batch_size(workers):
    return max(4, workers * 2)


-# Preview files are written by thumbnail_encode in the configured format
-# (thumbnail_settings, #317); these names stay importable from here.
-_temp_sibling = temp_sibling
-_replace_unless_held = replace_unless_held
-
 # A preview that could not be replaced (#249 S5 M6). Windows refuses to rename
 # over a file another process has open (WinError 5 or 32), such as a preview
 # the gallery is serving; the old preview stays and the file counts as an error.
@@ -396,6 +389,7 @@ def _video_placeholder_image(thumbnail_size):
            font=font,
        )
    except (OSError, AttributeError):
+        # a placeholder without its label still works
        pass
    return img

@@ -499,6 +493,7 @@ def _preview_names(folders, folder):
                    except OSError:
                        continue
        except OSError:
+            # an unreadable folder lists as empty; nothing there to cache
            pass
        folders[folder] = names
    return names
@@ -1073,13 +1068,20 @@ def _iter_media_files(output_path, max_files):


 def media_thumbnail_rel(rel_path, settings=None):
-    """``thumbnails/<rel>_thumb<ext>`` (POSIX) for the media file *rel_path*:
-    the name the preview gets when it is written now (#317), images and
-    videos alike (``writer_settings``' extension)."""
+    """``thumbnails/<rel>_thumb<ext>`` (POSIX URL text) for the media file
+    *rel_path*: the name the preview gets when it is written now (#317),
+    images and videos alike (``writer_settings``' extension). Where it is on
+    disk is ``media_preview_path``."""
    settings = settings or writer_settings()
    return thumbnail_settings.thumbnail_rel(rel_path, settings.extension)


+def media_preview_path(output_path, rel_path, settings=None):
+    """Where the preview of *rel_path* is written now (``preview_store``)."""
+    settings = settings or writer_settings()
+    return preview_store.preview_path(output_path, rel_path, settings.extension)
+
+
 def existing_media_thumbnail(output_path, rel_path):
    """The existing preview *rel_path* owns that a listing or cover shows
    (the format written now first, then older ones), or None. The Images
@@ -2803,13 +2805,32 @@ class ImageRoutesMixin:
                    output_dirs[0], filepath, int(root_param), len(outputs)
                )

+            # Preview text is mapped by the resolver (#320); any other text,
+            # ``Thumbnails/...`` media on a case-sensitive disk included,
+            # keeps the plain join.
+            preview_parts = (
+                tuple(filepath.split("/"))
+                if preview_store.is_preview_text(filepath)
+                else None
+            )
            for output_path in output_dirs:
-                image_path = output_path / filepath
+                if preview_parts is None:
+                    image_path = output_path / filepath
+                else:
+                    image_path = preview_store.request_path(output_path, preview_parts)
+                    if image_path is None:
+                        continue
                if not image_path.exists():
                    continue
-                # A symlink that points outside the root is a hard deny, not
-                # a fall-through to the next root.
-                if not _is_within(image_path, output_path):
+                # A symlink that points outside the root (a preview: outside
+                # the folder holding its store) is a hard deny, not a
+                # fall-through to the next root.
+                container = (
+                    output_path
+                    if preview_parts is None
+                    else preview_store.store_container(output_path)
+                )
+                if not _is_within(image_path, container):
                    return _forbidden()
                if in_trash_below_roots(image_path, output_dirs):
                    return _file_not_found()
@@ -2980,6 +3001,7 @@ class ImageRoutesMixin:
            result = await self._run_in_executor(
                self._generate_gallery_thumbnails_sync, output_dirs
            )
+            await self._release_job_memory()
            return web.json_response(result)

        except Exception as e:
@@ -2992,6 +3014,7 @@ class ImageRoutesMixin:
        """Blocking thumbnail generation loop (run in executor)."""
        settings = writer_settings(settings)
        start = _time.monotonic()
+        thumbnails_dir = preview_store.given_store(output_path, thumbnails_dir)
        plan = self._plan_thumbnails(output_path, thumbnails_dir, settings=settings)
        payload = self._execute_thumbnail_plan(plan, settings, start)
        payload["thumbnails_path"] = _public_path(thumbnails_dir)
@@ -3004,7 +3027,8 @@ class ImageRoutesMixin:
        start = _time.monotonic()
        plan = self._plan_gallery_thumbnails(output_dirs, settings=settings)
        payload = self._execute_thumbnail_plan(plan, settings, start)
-        payload["thumbnails_path"] = _public_path(output_dirs[0] / "thumbnails")
+        store = preview_store.store_dir(output_dirs[0])
+        payload["thumbnails_path"] = None if store is None else _public_path(store)
        return payload

    def _execute_thumbnail_plan(self, plan: dict, settings, start: float) -> dict:
@@ -3047,9 +3071,12 @@ class ImageRoutesMixin:
            if stop is not None and stop():
                break
            root = Path(root)
+            store = preview_store.store_dir(root)
+            if store is None:
+                continue
            plan = self._plan_thumbnails(
                root,
-                root / "thumbnails",
+                store,
                mode=mode,
                stop=stop,
                settings=settings,
@@ -3133,7 +3160,7 @@ class ImageRoutesMixin:
        """
        settings = writer_settings(settings)
        output_path = Path(output_path)
-        thumbnails_dir = Path(thumbnails_dir)
+        thumbnails_dir = preview_store.given_store(output_path, thumbnails_dir)
        plan = {key: 0 for key in _PLAN_COUNTS}
        plan.update(targets=[], fresh_files=[])
        folders = {}
@@ -3225,6 +3252,9 @@ class ImageRoutesMixin:
            "dir": src.parent.name,
            "type": "video" if is_video else "image",
        }
+        # Taken when the write starts: a thumbnail location switched since
+        # then drops the write at its rename (#320).
+        guard = preview_store.write_guard(guard)
        dst = Path(dst)
        if dst.suffix != settings.extension:
            dst = dst.with_suffix(settings.extension)
@@ -3505,8 +3535,8 @@ class ImageRoutesMixin:
            self.logger.debug(f"No roots to sweep for preview temp files: {exc}")
            return 0
        for output_path in output_dirs:
-            folder = Path(output_path) / "thumbnails"
-            if folder.is_symlink() or not folder.is_dir():
+            folder = preview_store.store_dir(output_path)
+            if folder is None or folder.is_symlink() or not folder.is_dir():
                continue
            removed += sweep_stray_temps(folder)[0]
        if removed:
@@ -3524,13 +3554,16 @@ class ImageRoutesMixin:
        directories = []
        for output_path in output_dirs:
            output_path = Path(output_path)
-            thumbnails_dir = output_path / "thumbnails"
+            thumbnails_dir = preview_store.store_dir(output_path)
+            if thumbnails_dir is None:
+                continue
            if not thumbnails_dir.exists() and not thumbnails_dir.is_symlink():
                continue
+            container = preview_store.store_container(output_path)
            if (
                thumbnails_dir.is_symlink()
-                or not _is_within(thumbnails_dir, output_path)
-                or _canonical(thumbnails_dir) == _canonical(output_path)
+                or not _is_within(thumbnails_dir, container)
+                or _canonical(thumbnails_dir) == _canonical(container)
            ):
                raise ValueError(
                    "Safety check failed: invalid thumbnails directory path"
@@ -4002,7 +4035,8 @@ class ImageRoutesMixin:
                    **observed,
                )

-            body = await self._run_in_executor(inspect)
+            # Header and text reads: the interactive image pool (#523).
+            body = await self._run_image(inspect)
            if body is None:
                return web.json_response(
                    {
@@ -4215,6 +4249,22 @@ class ImageRoutesMixin:
        # (which Windows refuses on open files) is not held up by it.
        return _CardFacts(width, height, *self._card_parse(path, records))

+    def _cached_card_facts(self, entry: tuple) -> _CardFacts | None:
+        path, mtime, root, index = entry[:4]
+        return self._workspace_card_cache.get((index, str(root)), {}).get((path, mtime))
+
+    def _card_facts_of(self, entries: list, *, parse: bool) -> list[_CardFacts]:
+        """Card facts of *entries*, in order; files not cached yet are read on
+        the interactive image pool (#523), cached ones answer here."""
+        found = [self._cached_card_facts(entry) for entry in entries]
+        missing = [i for i, facts in enumerate(found) if facts is None]
+        read = self._map_image(
+            lambda i: self._card_facts(entries[i], parse=parse), missing
+        )
+        for i, facts in zip(missing, read):
+            found[i] = facts
+        return found
+
    def _card_facts(self, entry: tuple, *, parse: bool) -> _CardFacts:
        """One listed image's card facts, read once per ``(path, mtime)``.

@@ -4223,11 +4273,11 @@ class ImageRoutesMixin:
        and drops the rest, and a roots change drops them all. Only files of
        the current scan are stored, so the cache is bounded by the listing.
        """
-        path, mtime, root, index = entry[:4]
-        root_key, key = (index, str(root)), (path, mtime)
-        cached = self._workspace_card_cache.get(root_key, {}).get(key)
+        cached = self._cached_card_facts(entry)
        if cached is not None:
            return cached
+        path, mtime, root, index = entry[:4]
+        root_key, key = (index, str(root)), (path, mtime)
        facts = self._read_card_facts(path, parse=parse)
        if facts is None:
            # Not stored: a locked or half-written file may read next time.
@@ -4253,15 +4303,17 @@ class ImageRoutesMixin:
            if linked
            else {}
        )
+        # Videos: the card reads no video metadata. Library previews show
+        # no card facts, so they skip the parse (``parse=linked``).
+        stills = [image for image in images if not image["is_video"]]
+        read = self._card_facts_of(
+            [entries[(image["root_index"], image["path"])] for image in stills],
+            parse=linked,
+        )
+        facts_of = {id(image): facts for image, facts in zip(stills, read)}
        for image in images:
            entry = entries[(image["root_index"], image["path"])]
-            # Videos: the card reads no video metadata. Library previews show
-            # no card facts, so they skip the parse (``parse=linked``).
-            facts = (
-                _NO_CARD_FACTS
-                if image["is_video"]
-                else self._card_facts(entry, parse=linked)
-            )
+            facts = facts_of.get(id(image), _NO_CARD_FACTS)
            image["width"], image["height"] = facts.width, facts.height
            if not linked:
                continue
@@ -250,7 +250,7 @@ class JobRoutesMixin:
        try:
            await response.write(_summary_event(job))
            async with contextlib.aclosing(job.events()) as events:
-                async for _payload in events:
+                async for _ in events:
                    await response.write(_summary_event(job))
            # The last event is published before the job takes its final state.
            await response.write(_summary_event(job))
@@ -207,6 +207,7 @@ class LibraryLocationRoutesMixin:
        try:
            size = os.path.getsize(location.db_path)
        except OSError:
+            # no library file yet: report size 0
            pass
        return {
            "path": self._library_public_path(location.db_path),
@@ -373,6 +374,7 @@ class LibraryLocationRoutesMixin:
        line += ". Logs move at the next restart."
        job.log_line(line)
        job.update(progress=100, status_line=line)
+        return None

    @staticmethod
    def _fail_library_move(job, code, message):
@@ -205,3 +205,4 @@ class LogCleanupMixin:
            line += f", {failed} could not be deleted"
        job.log_line(line)
        job.update(processed=len(files), progress=100, status_line=line)
+        return None
@@ -436,7 +436,7 @@ class LoraImportRoutesMixin:
            job.log_line(f"{CANCELLED} {CACHE_NOTE}")
            job.update(status_line=CANCELLED)
            job.finish("cancelled")
-            return
+            return None
        except Exception:
            self.logger.exception("LoRA import staging failed")
            return _fail_job(job, "import-failed", f"{FAILED} {CACHE_NOTE}")
@@ -455,10 +455,10 @@ class LoraImportRoutesMixin:
            job.log_line(f"{CANCELLED} {CACHE_NOTE}")
            job.update(status_line=CANCELLED)
            job.finish("cancelled")
-            return
+            return None
        ok, _backup = await self._safety_backup_step(job, db, backup_on)
        if not ok:
-            return
+            return None
        # I1: the files are listed and fingerprinted again right before the
        # replace, so a file changed, removed or added while the downloads ran
        # (LoraManager refreshing its CivitAI info) aborts with nothing deleted.
@@ -466,6 +466,7 @@ class LoraImportRoutesMixin:
            return _fail_job(job, "plan-changed", f"{SOURCE_CHANGED} {CACHE_NOTE}")
        job.update(status_line="Replacing the LoRA collection", progress=95)
        await self._replace_in_job(job, db, plan, staged)
+        return None

    def _count_downloads(self, job, staged):
        downloaded = staged.stats.get("downloaded", 0)
@@ -518,3 +519,4 @@ class LoraImportRoutesMixin:
            staged.stats.get("download_errors", 0),
        )
        job.update(progress=100, processed=job.total, status_line=line)
+        return None
@@ -44,6 +44,7 @@ _FILES_CHANGED = (
    "The LoRA metadata files changed during the scan; the previous imports "
    "were kept. Run the scan again."
 )
+_LORA_SCAN_FAILED = "The LoRA import failed. Check the server log for details."
 _IMPORTS_CHANGED = (
    "The imported LoRA prompts changed during the scan; the previous imports "
    "were kept. Run the scan again."
@@ -407,10 +408,21 @@ class LoraIntegrationMixin:
            return
        if isinstance(error, PlanChanged):
            message = _IMPORTS_CHANGED
-        elif isinstance(error, (LoraFilesChanged, LoraSettingsUnusable)):
+        elif isinstance(
+            error,
+            (
+                LoraFilesChanged,
+                LoraSettingsUnusable,
+                EmptyReplacement,
+                PairDependencyError,
+            ),
+        ):
            message = str(error)
-        else:
+        elif isinstance(error, OSError):
+            # Reduced to its reason and the file's basename.
            message = self._public_error(error)
+        else:
+            message = _LORA_SCAN_FAILED
        if isinstance(
            error,
            (
@@ -536,6 +548,7 @@ class LoraIntegrationMixin:
                except asyncio.CancelledError:
                    interrupted = True
                except Exception:
+                    # the await after this loop raises it for the caller
                    pass
            if interrupted:
                raise asyncio.CancelledError
@@ -673,6 +673,7 @@ class MaintenanceRoutesMixin:
        line = _changed_line(plan.operation, result["changed"], result.get("marks", 0))
        job.log_line(line)
        job.update(progress=100, status_line=f"{line} · {backup_note(backup)}")
+        return None

    def _maintenance_rows(self, operation, described):
        """Outcome rows for the changed records (root-relative paths only)."""
@@ -0,0 +1,206 @@
+"""Where previews live on disk (#320): the one resolver.
+
+Every mapping between an image source (a "root"), one of its media files and
+that file's preview on disk goes through this module. URL text stays in
+``thumbnail_settings`` (``thumbnail_rel``: ``thumbnails/<rel>_thumb<ext>``,
+the shape the serve route, ``inspection-state.mjs`` and ``admin.js`` share);
+this module answers where such a preview is on disk.
+
+The store of a source is where its previews live. With the default location
+(mode ``source``, "Inside each source") it is ``<source>/thumbnails``, exactly
+the folder every caller joined by hand before, so nothing moves.
+
+Writes and the switch: every preview writer takes ``write_guard`` when it
+starts (it records the location's ``generation``); the final rename runs
+under ``write_lock`` and only when the generation is unchanged and no hold
+applies (``thumbnail_encode.replace_unless_held``). Changing the location
+bumps the generation under the same lock, so no write that began before can
+land in the old store afterwards. Nothing reads or commits config while
+``write_lock`` is held. The hold check runs under it too, so hold checks take
+no lock (the job registry's ``running()`` is a lock-free snapshot) and
+``bump_generation`` is never called with a registry or config lock held.
+
+All functions are blocking: call them off the event loop.
+"""
+
+import os
+import threading
+from contextlib import contextmanager
+from dataclasses import dataclass
+from pathlib import Path
+
+from . import thumbnail_settings
+
+try:
+    from ...utils.media_folders import PREVIEW_FOLDER
+except ImportError:  # tests import the package top-level
+    from utils.media_folders import PREVIEW_FOLDER
+
+SOURCE_MODE = "source"
+
+
+@dataclass(frozen=True)
+class Location:
+    """One snapshot of the thumbnail location (take one per request or job)."""
+
+    mode: str = SOURCE_MODE
+    path: str | None = None
+    available: bool = True
+    problem: str | None = None
+    generation: int = 0
+
+
+write_lock = threading.Lock()
+_generation = 0
+
+
+def current():
+    """The thumbnail location now."""
+    return Location(generation=_generation)
+
+
+def generation():
+    return _generation
+
+
+def bump_generation():
+    """Invalidate every write that started before (under ``write_lock``)."""
+    global _generation
+    with write_lock:
+        _generation += 1
+        return _generation
+
+
+def _canonical(path):
+    """Resolved and case-folded, so paths compare on every OS."""
+    return Path(os.path.normcase(os.path.realpath(str(path))))
+
+
+def _within(path, folder):
+    return _canonical(path).is_relative_to(_canonical(folder))
+
+
+# ── stores ───────────────────────────────────────────────────────────
+
+
+def store_container(root, location=None):
+    """The folder a store of *root* must stay inside: the source itself."""
+    return Path(root)
+
+
+def store_dir(root, location=None):
+    """The store of *root* (``<source>/thumbnails``)."""
+    return Path(root) / PREVIEW_FOLDER
+
+
+def ensure_store(root, location=None):
+    """``store_dir`` for a writer. Preview folders below it are made by the
+    write itself."""
+    return store_dir(root, location)
+
+
+def given_store(root, store):
+    """A caller's explicit store argument: the default spelling
+    (``<root>/thumbnails``) means the resolver's store; another folder (only
+    tests pass one) is used as given."""
+    store = Path(store)
+    if store == Path(root) / PREVIEW_FOLDER:
+        return store_dir(root)
+    return store
+
+
+def preview_path(root, media_rel, ext=None, location=None):
+    """Where the preview of *media_rel* (relative to *root*) is, or is to be
+    written, in *ext* (the extension written now when None)."""
+    store = store_dir(root, location)
+    if store is None:
+        return None
+    if ext is None:
+        from .thumbnail_encode import writer_settings
+
+        ext = writer_settings().extension
+    return store / (thumbnail_settings.preview_stem(media_rel) + ext)
+
+
+def request_path(root, parts, location=None):
+    """The disk path of the URL parts ``("thumbnails", ...)``, or None when
+    *parts* is not under an exact ``thumbnails`` first part. The text is
+    checked before (``is_preview_text``)."""
+    parts = tuple(parts)
+    if len(parts) < 2 or parts[0] != PREVIEW_FOLDER:
+        return None
+    store = store_dir(root, location)
+    if store is None:
+        return None
+    return store.joinpath(*parts[1:])
+
+
+def owns(root, path, location=None):
+    """Whether *path* lies inside the store of *root*, resolved: the store
+    stays inside its container and no link takes *path* out of the store."""
+    store = store_dir(root, location)
+    if store is None:
+        return False
+    return _within(store, store_container(root, location)) and _within(path, store)
+
+
+# ── preview text ─────────────────────────────────────────────────────
+
+
+def is_preview_text(filepath):
+    """URL text naming a preview: ``thumbnails/<...>/<name>_thumb<ext>``.
+
+    Text only, before any join: no backslash, drive or stream colon, and no
+    empty, ``.`` or ``..`` segment; ``thumbnails`` exactly as the first part
+    and nowhere else among the folders; the extension, in any case, one a
+    preview may carry (``X_thumb.JPG`` of an older release included).
+    """
+    if not filepath or "\\" in filepath or ":" in filepath:
+        return False
+    parts = filepath.split("/")
+    if len(parts) < 2 or parts[0] != PREVIEW_FOLDER:
+        return False
+    if any(part in ("", ".", "..") for part in parts):
+        return False
+    if PREVIEW_FOLDER in parts[1:-1]:
+        return False
+    stem, extension = os.path.splitext(parts[-1])
+    return (
+        stem.endswith(thumbnail_settings.THUMB_SUFFIX)
+        and len(stem) > len(thumbnail_settings.THUMB_SUFFIX)
+        and extension.lower() in thumbnail_settings.THUMBNAIL_EXTENSIONS
+    )
+
+
+# ── writes ───────────────────────────────────────────────────────────
+
+
+class _WriteGuard:
+    """``guard()`` for one preview write: true while the location has not
+    changed since the write started and *hold* (if any) allows it."""
+
+    __slots__ = ("generation", "_hold")
+
+    def __init__(self, hold=None):
+        self.generation = _generation
+        self._hold = hold
+
+    def __call__(self):
+        if self.generation != _generation:
+            return False
+        return self._hold is None or bool(self._hold())
+
+
+def write_guard(hold=None):
+    """Take when a preview write starts; hand to its final rename."""
+    if isinstance(hold, _WriteGuard):
+        return hold
+    return _WriteGuard(hold)
+
+
+@contextmanager
+def committed(guard=None):
+    """Around a preview's final rename: holds ``write_lock`` and yields
+    whether the write may land (``guard()``, re-checked under the lock)."""
+    with write_lock:
+        yield guard is None or bool(guard())
@@ -8,7 +8,8 @@ previews behind those URLs are made here, in three ways:
 - **On first view.** ``GET /prompt_manager/images/serve/thumbnails/<rel>_thumb
  <ext>`` for a preview that does not exist yet is admitted on the event loop
  (``_PreviewGate``): at most ``ON_DEMAND_LIMIT`` previews are written at once,
-  on this API's own small pool (never the default executor), one flight runs
+  on this API's interactive image pool (``IMAGE_POOL_SIZE`` threads, shared
+  with card facts and inspector reads; never the default executor), one flight runs
  per file, and the requests waiting are capped (``MAX_WAITING``); past the
  cap a request gets its fallback at once. Inside the admission the preview is
  mapped back to its media file under the same root (the request text is
@@ -24,7 +25,8 @@ previews behind those URLs are made here, in three ways:
 - **On capture.** The image monitor hands every new output it settles to
  ``queue_capture_thumbnail``, which queues its preview for one background
  worker thread (``AutoThumbnailer``). Each wake takes at most Worker threads
-  (``WORKER_THREADS``) files and writes them on that many threads; enqueuing
+  (``WORKER_THREADS``) files and writes them on the long-lived job pool
+  (``utils.parallel``, shared with scans and thumbnail jobs); enqueuing
  is O(1), so the monitor and ComfyUI's queue never wait. A file already
  queued is not queued again, the queue is bounded (``MAX_QUEUED``) and a
  preview left out is made on its first view instead.
@@ -49,7 +51,7 @@ write starts (after its slot) and again just before its rename.

 Shutdown: ``close_auto_thumbnails`` stops the worker at a file boundary,
 kills a running ffmpeg, waits a bounded time (and logs when the wait ran
-out) and shuts the view pool down; after the app's cleanup
+out) and shuts the image pool down; after the app's cleanup
 (``final=True``) nothing starts a worker again. Importing this module again
 (a package reload) stops the workers the previous import left.
 """
@@ -60,12 +62,12 @@ import functools
 import io
 import os
 import threading
-from concurrent.futures import ThreadPoolExecutor
+from concurrent.futures import CancelledError, ThreadPoolExecutor
 from pathlib import Path

 from aiohttp import web

-from . import thumbnail_settings
+from . import preview_store, thumbnail_settings
 from .images import (
    in_trash_below_roots,
    MEDIA_EXTENSIONS,
@@ -76,7 +78,7 @@ from .images import (
    _thumbnail_is_fresh,
    _video_placeholder_image,
    _worker_threads,
-    media_thumbnail_rel,
+    media_preview_path,
 )
 from .jobs import (
    DUPLICATE_CLEANUP_JOB_KIND,
@@ -104,8 +106,11 @@ PLACEHOLDER_SIZE = (thumbnail_settings.DEFAULT_EDGE, thumbnail_settings.DEFAULT_
 PLACEHOLDER_QUALITY = 85
 # Source extensions in the order a shared preview name looks for them (R2).
 _SOURCE_ORDER = thumbnail_settings.IMAGE_SOURCE_ORDER + tuple(sorted(VIDEO_EXTENSIONS))
-# Previews views may write at once (the size of the view pool).
-ON_DEMAND_LIMIT = 3
+# Threads of the interactive image pool (#523): view previews, card facts and
+# inspector reads. Fixed, so image buffers stay in a few threads' arenas.
+IMAGE_POOL_SIZE = 3
+# Previews views may write at once (the whole image pool).
+ON_DEMAND_LIMIT = IMAGE_POOL_SIZE
 # View requests that may wait on the gate; one more gets its fallback at once.
 MAX_WAITING = 64
 # How long a pool thread waits for the capture worker's flight of the same file.
@@ -124,7 +129,7 @@ AUTO_REFUSED_KINDS = frozenset(
    {RESTORE_JOB_KIND, DUPLICATE_CLEANUP_JOB_KIND, SOURCE_CHANGE_JOB_KIND}
 )
 WORKER_NAME = "PromptManagerThumbnailWorker"
-POOL_PREFIX = "pm-preview"
+POOL_PREFIX = "pm-image"
 # Identifies this import's workers: a reload stops the ones it did not start.
 _MODULE_TOKEN = object()

@@ -153,6 +158,36 @@ def _dst_key(dst):
    return flight_key(Path(dst).parent, (Path(dst).name,))


+class DeferredPreview:
+    """The preview of *rel* under *root*, resolved when its write starts
+    (#320): a queued capture follows the thumbnail location at write time,
+    not the one when it was queued."""
+
+    __slots__ = ("root", "rel", "strict")
+
+    def __init__(self, root, rel, *, strict=True):
+        self.root = Path(root)
+        self.rel = Path(rel)
+        # A capture refuses a store linked out of its container (the serve
+        # route's rule); a planned target keeps the plan's rule: inside the
+        # store, as the thumbnail job writes it.
+        self.strict = strict
+
+    def resolve(self):
+        """The preview's path now, or None when nothing may be written."""
+        dst = media_preview_path(self.root, self.rel)
+        if dst is None:
+            return None
+        if self.strict:
+            return dst if preview_store.owns(self.root, dst) else None
+        store = preview_store.store_dir(self.root)
+        return dst if _is_within(dst, store) else None
+
+
+def _resolved(dst):
+    return dst.resolve() if isinstance(dst, DeferredPreview) else Path(dst)
+
+
@functools.lru_cache(maxsize=1)
 def video_placeholder_jpeg():
    """The placeholder frame as JPEG bytes (a video whose preview is missing)."""
@@ -210,10 +245,19 @@ def _candidates(parts):
 def _current_preview(root, parts):
    """The preview *parts* names, in the format written now (#317): a request
    for an older name (``_thumb.png`` before a conversion) is answered with
-    the current file."""
+    the current file. None when the store of *root* has no place for it."""
    _folder, base, _wanted = _candidates(parts)
    name = base + thumbnail_settings.THUMB_SUFFIX + writer_settings().extension
-    return Path(root).joinpath(*parts[:-1], name)
+    return preview_store.request_path(root, (*parts[:-1], name))
+
+
+def _request_key(root, parts):
+    """The flight key of the preview *parts* under *root*: the key of its
+    disk path (so the serve and history routes share one flight)."""
+    path = preview_store.request_path(root, parts)
+    if path is None:
+        return flight_key(root, parts)
+    return _dst_key(path)


 def _quick_source(root, parts):
@@ -254,12 +298,10 @@ def _thumbnail_source(root, parts):
    if in_trash_below_roots(found, [root]):
        return None
    rel = Path(*folder_parts, found.name)
-    dst = root / media_thumbnail_rel(rel)
-    if dst != _current_preview(root, parts):
+    dst = media_preview_path(root, rel)
+    if dst is None or dst != _current_preview(root, parts):
        return None
-    if not _is_within(root / "thumbnails", root) or not _is_within(
-        dst, root / "thumbnails"
-    ):
+    if not preview_store.owns(root, dst):
        dst = None
    return found, dst, found.suffix.lower() in VIDEO_EXTENSIONS

@@ -279,6 +321,21 @@ def _scan_folder(folder, base, extensions):
    return None


+def _deferred(roots, src, dst):
+    """The ``DeferredPreview`` of a planned ``(src, dst)``: the root whose
+    store the plan wrote *dst* into (nested roots plan one each); *dst* as
+    planned when none matches."""
+    src = Path(src)
+    for root in roots:
+        root = Path(root)
+        if not src.is_relative_to(root):
+            continue
+        rel = src.relative_to(root)
+        if media_preview_path(root, rel) == Path(dst):
+            return DeferredPreview(root, rel, strict=False)
+    return dst
+
+
 def _stop_stale_workers():
    """Stop capture workers a previous import of this module started."""
    for thread in threading.enumerate():
@@ -294,7 +351,7 @@ class AutoThumbnailer:
    ``generate(src, dst, is_video, *, stop, guard, track)`` writes one
    preview and returns ``_generate_one``'s result dict; ``may_write()``
    says whether automatic previews may be written now. Views call
-    ``ensure`` on the view pool, the monitor calls ``enqueue`` from its
+    ``ensure`` on the image pool, the monitor calls ``enqueue`` from its
    thread.
    """

@@ -420,16 +477,23 @@ class AutoThumbnailer:

    def enqueue(self, src, dst, is_video):
        """Queue *dst*'s preview for the worker; False when already queued,
-        full, closed or its worker is refused at interpreter exit. Never
-        blocks on a write."""
-        key = _dst_key(dst)
+        full, closed, nowhere to write it or its worker is refused at
+        interpreter exit. Never blocks on a write. *dst* may be a
+        ``DeferredPreview``: its path is resolved again when the write
+        starts."""
+        now = _resolved(dst)
+        if now is None:
+            return False
+        key = _dst_key(now)
+        if not isinstance(dst, DeferredPreview):
+            dst = now
        with self._changed:
            if self._closed or key in self._queued:
                return False
            if len(self._queue) >= self._max_queued:
                return False
            self._queued.add(key)
-            self._queue.append((key, Path(src), Path(dst), bool(is_video)))
+            self._queue.append((key, Path(src), dst, bool(is_video)))
            self._busy = True
            started = True
            if self._start_worker and not self._worker_running:
@@ -491,12 +555,15 @@ class AutoThumbnailer:
                    self._worker_running = False
                    self._changed.notify_all()
                    return
-                take = min(len(self._queue), max(1, int(self._workers() or 1)))
+                workers = max(1, int(self._workers() or 1))
+                take = min(len(self._queue), workers)
                batch = [self._queue.popleft() for _ in range(take)]
                self._batch = len(batch)
                self._changed.notify_all()
            try:
-                map_parallel(self._write_queued, batch, len(batch))
+                # The job pool's size is the setting; a smaller batch uses
+                # fewer of its threads (#523: one long-lived pool).
+                map_parallel(self._write_queued, batch, workers)
            finally:
                with self._changed:
                    self._batch = 0
@@ -506,6 +573,9 @@ class AutoThumbnailer:
    def _write_queued(self, item):
        _key, src, dst, is_video = item
        try:
+            dst = _resolved(dst)
+            if dst is None:
+                return  # nowhere to write it now: made on its first view
            self.ensure(src, dst, is_video)
        except Exception:  # one file never stops the worker
            self._logger.warning(
@@ -533,6 +603,7 @@ class AutoThumbnailer:
            try:
                process.kill()
            except OSError:
+                # the process has already exited
                pass
        if worker is None:
            return True
@@ -566,7 +637,7 @@ class _PreviewGate:
    """Admission of view requests on the event loop (#249 I2).

    Waiters are coroutines: at most ``limit`` previews are written at once
-    on the view pool, one flight runs per key, and past ``MAX_WAITING``
+    on the image pool, one flight runs per key, and past ``MAX_WAITING``
    waiting requests ``run`` answers ``OVER`` at once.
    """

@@ -621,13 +692,17 @@ class _PreviewGate:
                flight.set_result(result)


+def _on_image_thread():
+    return threading.current_thread().name.startswith(POOL_PREFIX + "_")
+
+
 class AutoThumbnailMixin:
    """Automatic previews on the API: views, the monitor's queue, scans."""

    _auto_thumbnailer = None
    _auto_thumbnails_shut = False
    _preview_gate_obj = None
-    _preview_pool_obj = None
+    _image_pool_obj = None
    _auto_thumbnailer_lock = threading.Lock()

    def _auto_thumbnails(self):
@@ -650,7 +725,7 @@ class AutoThumbnailMixin:
            self._auto_thumbnails_shut = True

    def close_auto_thumbnails(self, final=False, timeout=None):
-        """Stop the capture worker and the view pool, and forget them.
+        """Stop the capture worker and the image pool, and forget them.

        Bounded by ``timeout`` (see AutoThumbnailer.close). ``final`` (the
        package teardown) also keeps a late monitor event from starting a
@@ -661,7 +736,7 @@ class AutoThumbnailMixin:
            if final:
                self._auto_thumbnails_shut = True
            thumbnailer, self._auto_thumbnailer = self._auto_thumbnailer, None
-            pool, self._preview_pool_obj = self._preview_pool_obj, None
+            pool, self._image_pool_obj = self._image_pool_obj, None
            self._preview_gate_obj = None
        closed = True
        if thumbnailer is not None:
@@ -705,16 +780,67 @@ class AutoThumbnailMixin:
            gate = self._preview_gate_obj = _PreviewGate(ON_DEMAND_LIMIT, self.logger)
        return gate

-    def _preview_pool(self):
-        with AutoThumbnailMixin._auto_thumbnailer_lock:
-            if self._preview_pool_obj is None:
-                self._preview_pool_obj = ThreadPoolExecutor(
-                    ON_DEMAND_LIMIT, thread_name_prefix=POOL_PREFIX
-                )
-            return self._preview_pool_obj
+    def _image_pool(self):
+        """The interactive image pool (#523): IMAGE_POOL_SIZE threads for view
+        previews (behind their gate), card facts and inspector reads, so
+        image buffers never spread over the default executor's threads.

-    def _preview_pool_threads(self):
-        pool = self._preview_pool_obj
+        None after the package teardown (``close_auto_thumbnails(final=True)``):
+        a late request then runs on the default executor (``run_in_executor``
+        with None) and starts no thread the teardown no longer stops.
+        """
+        with AutoThumbnailMixin._auto_thumbnailer_lock:
+            if self._image_pool_obj is None and not self._auto_thumbnails_shut:
+                self._image_pool_obj = ThreadPoolExecutor(
+                    IMAGE_POOL_SIZE, thread_name_prefix=POOL_PREFIX
+                )
+            return self._image_pool_obj
+
+    async def _run_image(self, func, *args, **kwargs):
+        """``_run_in_executor`` for interactive image work: the image pool.
+
+        After the teardown, or with the pool shut down in between (a test
+        reset), the call runs on the default executor as before.
+        """
+        call = functools.partial(func, *args, **kwargs)
+        loop = asyncio.get_running_loop()
+        try:
+            future = loop.run_in_executor(self._image_pool(), call)
+        except RuntimeError:  # submit refused: the pool was shut down
+            future = loop.run_in_executor(None, call)
+        return await future
+
+    def _map_image(self, func, items):
+        """``func`` over *items* on the image pool, in order (blocking).
+
+        Called from an image pool thread, after the teardown, or with the
+        pool shut down in between (its queued items are cancelled), the
+        items it did not run run on the calling thread.
+        """
+        items = list(items)
+        pool = None if not items or _on_image_thread() else self._image_pool()
+        if pool is None:
+            return [func(item) for item in items]
+        futures = []
+        try:
+            for item in items:
+                futures.append(pool.submit(func, item))
+        except RuntimeError:
+            pass  # shut down in between: the rest run here
+        results = []
+        for index, item in enumerate(items):
+            future = futures[index] if index < len(futures) else None
+            if future is None or future.cancelled():
+                results.append(func(item))
+                continue
+            try:
+                results.append(future.result())
+            except CancelledError:  # cancelled while this caller waited
+                results.append(func(item))
+        return results
+
+    def _image_pool_threads(self):
+        pool = self._image_pool_obj
        return [] if pool is None else list(getattr(pool, "_threads", ()))

    def _video_placeholder_bytes(self):
@@ -729,7 +855,7 @@ class AutoThumbnailMixin:
        return await self._preview_gate().run(
            flight_key(Path(dst).parent, (Path(dst).name,)),
            functools.partial(self._ensure_view, src, dst, is_video),
-            self._preview_pool(),
+            self._image_pool(),
        )

    def _ensure_view(self, src, dst, is_video):
@@ -773,17 +899,17 @@ class AutoThumbnailMixin:
        The flight answers only the outcome (a history flight may be the one
        joined); the file it previews is derived here: the preview path is
        the request's own, and a fallback looks its source up again on the
-        view pool (bounded by it, never the default executor).
+        image pool (bounded by it, never the default executor).
        """
        if _has_traversal(filepath) or not _is_preview_request(filepath):
            return None
        parts = tuple(filepath.split("/"))
        gate = self._preview_gate()
-        pool = self._preview_pool()
+        pool = self._image_pool()
        for root in output_dirs:
            root = Path(root)
            outcome = await gate.run(
-                flight_key(root, parts),
+                _request_key(root, parts),
                functools.partial(self._preview_on_demand, root, parts),
                pool,
            )
@@ -796,7 +922,7 @@ class AutoThumbnailMixin:
                    continue
                return self._preview_response(BUSY, quick[0], None, quick[1])
            dst = _current_preview(root, parts)
-            if outcome == READY:
+            if outcome == READY and dst is not None:
                return self._file_response(dst)
            located = await gate.loop.run_in_executor(
                pool, _thumbnail_source, root, parts
@@ -819,17 +945,31 @@ class AutoThumbnailMixin:
        """
        if self._auto_thumbnails_shut:
            return "skipped"
-        located = self._capture_target(image_path)
+        located = self._capture_source(image_path)
        if located is None:
            return "skipped"
-        src, dst, is_video = located
+        src, root, rel, is_video = located
+        dst = DeferredPreview(root, rel).resolve()
+        if dst is None:
+            return "skipped"
        if _thumbnail_is_fresh(src, dst):
            return "fresh"
-        if self._auto_thumbnails().enqueue(src, dst, is_video):
+        if self._auto_thumbnails().enqueue(src, DeferredPreview(root, rel), is_video):
            return "queued"
        return "skipped"

    def _capture_target(self, image_path):
+        """``(src, dst, is_video)`` of a new output's preview now, or None."""
+        located = self._capture_source(image_path)
+        if located is None:
+            return None
+        src, root, rel, is_video = located
+        dst = DeferredPreview(root, rel).resolve()
+        return None if dst is None else (src, dst, is_video)
+
+    def _capture_source(self, image_path):
+        """``(src, root, rel, is_video)`` of a media file under a current
+        root (not a preview, a link or in a trash folder), or None."""
        path = Path(os.path.abspath(str(image_path)))
        if path.suffix.lower() not in MEDIA_EXTENSIONS or not _regular_file(path):
            return None
@@ -842,12 +982,7 @@ class AutoThumbnailMixin:
            rel = Path(os.path.relpath(path, root))
            if "thumbnails" in rel.parts[:-1] or in_trash_below_roots(path, [root]):
                return None
-            dst = root / media_thumbnail_rel(rel)
-            if not _is_within(root / "thumbnails", root) or not _is_within(
-                dst, root / "thumbnails"
-            ):
-                return None
-            return path, dst, path.suffix.lower() in VIDEO_EXTENSIONS
+            return path, root, rel, path.suffix.lower() in VIDEO_EXTENSIONS
        return None

    # ── after a scan ──────────────────────────────────────────────────
@@ -889,7 +1024,7 @@ class AutoThumbnailMixin:
            return "none"
        thumbnailer = self._auto_thumbnails()
        for src, dst, is_video in plan["targets"]:
-            thumbnailer.enqueue(src, dst, is_video)
+            thumbnailer.enqueue(src, _deferred(output_dirs, src, dst), is_video)
        self.logger.info(f"{missing:,} previews missing after the scan; queued")
        return "queued"

@@ -153,6 +153,7 @@ class ThumbnailConvertMixin:
            job.log_line("Conversion failed · internal error")
            state = "failed"
        job.finish(state)
+        await self._release_job_memory()

    async def _convert_job_body(self, job, options):
        output_dirs = await self._run_in_executor(self._get_all_output_dirs)
@@ -46,7 +46,7 @@ from pathlib import Path

 from PIL import Image

-from . import thumbnail_settings
+from . import preview_store, thumbnail_settings

 try:
    from ...utils.logging_config import get_logger
@@ -101,10 +101,15 @@ def temp_sibling(dst, tag="part"):


 def replace_unless_held(tmp, dst, guard=None):
-    """Rename *tmp* over *dst*, unless ``guard()`` is false (PreviewWriteHeld)."""
-    if guard is not None and not guard():
-        raise PreviewWriteHeld(PREVIEW_HELD)
-    os.replace(tmp, dst)
+    """Rename *tmp* over *dst*, unless ``guard()`` is false (PreviewWriteHeld).
+
+    The check and the rename run under ``preview_store.write_lock`` (#320): a
+    guard from ``preview_store.write_guard`` also refuses a write that started
+    before the thumbnail location changed."""
+    with preview_store.committed(guard) as allowed:
+        if not allowed:
+            raise PreviewWriteHeld(PREVIEW_HELD)
+        os.replace(tmp, dst)


 # ``temp_sibling``'s names: ``.<stem>.<tag>-<pid>-<thread id><ext>``.
@@ -158,6 +163,7 @@ def _unlink_quietly(path):
    try:
        Path(path).unlink()
    except FileNotFoundError:
+        # already gone, which is what was wanted
        pass
    except OSError as exc:
        logger.debug(f"Could not remove temp file {Path(path).name}: {exc}")
@@ -221,6 +227,7 @@ def shutdown_encoders():
        try:
            process.kill()
        except OSError:
+            # the process has already exited
            pass


@@ -359,10 +366,12 @@ def thumbnail_frame(img, edge):
    try:
        img.seek(0)
    except (EOFError, AttributeError, ValueError):
+        # not seekable or a single frame: use the current one
        pass
    try:
        img.draft("RGB", (edge, edge))  # JPEG: decode at a reduced scale
    except (AttributeError, ValueError, OSError):
+        # draft is only a speedup; the full decode below still works
        pass
    frame = img.convert("RGB") if img.mode != "RGB" else img.copy()
    frame.thumbnail((edge, edge), Image.Resampling.LANCZOS)
@@ -226,6 +226,7 @@ class ThumbnailJobsMixin:
            )
            state = "failed"
        job.finish(state)
+        await self._release_job_memory()

    async def _thumbnail_job_body(self, job, options):
        """Plan, then generate in worker batches; returns the final state.
@@ -114,9 +114,16 @@ def validate_edge(value):
 # ── names ────────────────────────────────────────────────────────────


+def preview_stem(rel_path):
+    """``<rel without extension>_thumb`` (POSIX): a preview's name inside the
+    store of its source (``preview_store``)."""
+    return f"{Path(rel_path).with_suffix('').as_posix()}{THUMB_SUFFIX}"
+
+
 def thumbnail_stem_rel(rel_path):
-    """``thumbnails/<rel without extension>_thumb`` (POSIX)."""
-    return f"thumbnails/{Path(rel_path).with_suffix('').as_posix()}{THUMB_SUFFIX}"
+    """``thumbnails/<rel without extension>_thumb`` (POSIX): URL text only.
+    Where the preview is on disk is ``preview_store``'s answer."""
+    return f"thumbnails/{preview_stem(rel_path)}"


 def thumbnail_rel(rel_path, extension=None):
@@ -207,8 +214,13 @@ def owned_in_folder(folder, stem, source_extension, preferred=None):


 def _owned(root, rel_path, preferred):
+    from . import preview_store
+
    rel_path = Path(rel_path)
-    stem = Path(root) / thumbnail_stem_rel(rel_path)
+    store = preview_store.store_dir(root)
+    if store is None:
+        return iter(())
+    stem = store / preview_stem(rel_path)
    return owned_in_folder(stem.parent, stem.name, rel_path.suffix, preferred)


@@ -275,3 +275,4 @@ class WorkflowStorageRoutesMixin:
        job.record_counted("changed", 1)
        job.log_line(line)
        job.update(progress=100, status_line=line)
+        return None
@@ -109,6 +109,7 @@ def _write_atomically(path: str, payload: bytes) -> None:
        try:
            os.unlink(temp_path)
        except OSError:
+            # nothing to clean up; the original error is raised below
            pass
        raise

@@ -642,6 +642,7 @@ def layout_summary(layout: LoraManagerLayout, home: Path) -> Dict:
            relative = Path(settings_file).relative_to(home)
            settings_file = os.path.join("~", str(relative))
        except ValueError:
+            # outside the home folder: show the full path
            pass
    return {
        "source": layout.source,
@@ -585,6 +585,7 @@ def _read_capped(resp, cap: int) -> Optional[bytes]:
            if int(declared) > cap:
                return None
        except ValueError:
+            # a bad header says nothing; the read below enforces the cap
            pass

    chunks = []
@@ -707,6 +708,7 @@ def _save_atomically(image, local_path: Path) -> None:
        try:
            os.remove(temp)
        except OSError:
+            # nothing to clean up; the original error is raised below
            pass
        raise

@@ -1,7 +1,7 @@
 [project]
 name = "promptmanager"
 description = "A powerful ComfyUI custom node that extends the standard text encoder with persistent prompt storage, advanced search capabilities, and an automatic image gallery system using SQLite."
-version = "3.3.1"
+version = "3.4.1"
 license = {file = "LICENSE"}
 requires-python = ">=3.12"
 dependencies = ["watchdog>=2.1.0", "Pillow>=8.0.0"]
@@ -1,4 +1,4 @@
 # Runtime dependencies for PromptManager.
 # aiohttp, numpy and torch come from ComfyUI itself and are not listed here.
-watchdog>=2.1.0              # Output directory monitoring
+watchdog>=2.1.0               # Output directory monitoring
 Pillow>=8.0.0                # Image metadata extraction and thumbnails
@@ -6,7 +6,6 @@ import { THEMES, seedConcept, openConcept, openProduction, diffInventory, mutate
 // app.js 1428–1432) and its backup box with the concept's System `.notice`; the differences are D55. The job view
 // has no concept counterpart: it is compared with the approved mockup `activity-scan.html` (a local, ignored file),
 // whose structure and CSS values are restated below (D56). Each comparison is shown to notice a mutation.
-const workspace = '/prompt_manager/workspace';

 test.beforeEach(async ({ page, request, browserName }) => {
    await startCoverage(page, browserName);
@@ -320,3 +320,44 @@ test('copy toast and fallback dialog',async({page})=>{
    await expect(fallback).toContainText('Automatic clipboard access requires a secure browser context.');
    await page.keyboard.press('Escape');await expect(fallback).toBeHidden();await expect(copy).toBeFocused();
 });
+
+// #542 D191: "All N eligible nodes" previews every node, sends one after another and names each refusal.
+test('All eligible nodes previews each node, sends in node id order and names a refusal',async({page,context},testInfo)=>{
+    const host=await context.newPage();await host.goto('/prompt_manager/workspace#/overview');
+    await host.evaluate(async()=>{
+        const {createBridgeHost}=await import('/prompt_manager/js/shared/toolkit/prompt-bridge.js');
+        const targets=['12','3','7'].map(id=>({id,label:id==='7'?'Edited in ComfyUI':'Prompt Manager (+/-)',type:'PromptManagerPair',roles:['positive','negative']}));
+        window.hostValues=Object.fromEntries(targets.map(target=>[target.id,{positive:`Existing ${target.id}`,negative:'Existing negative'}]));window.applied=[];
+        window.fixtureHost=createBridgeHost({origin:location.origin,namespace:'/',label:'Test ComfyUI',adapter:{
+            listTargets:()=>targets,
+            preview:(id,roles)=>{const target=targets.find(item=>item.id===id);return{preview:{target,fields:Object.entries(roles).map(([role,after])=>({role,before:window.hostValues[id][role],after}))},snapshot:{id,roles}};},
+            apply:({id,roles})=>{if(id==='7')throw new Error('Workflow or prompt changed. Preview again.');Object.assign(window.hostValues[id],roles);window.applied.push(id);return{targetId:id,values:roles};},
+        }});
+    });
+    try {
+        await page.goto(workspace);await select(page,'0:shared/same.png');await details(page).getByRole('button',{name:/^Send prompt pair to ComfyUI: /}).click();
+        const sender=dialog(page);const nodes=sender.getByRole('combobox',{name:'Destination node',exact:true});
+        await sender.getByRole('combobox',{name:'ComfyUI window',exact:true}).selectOption({label:'Test ComfyUI'});
+        await expect(nodes.locator('option')).toHaveText(['Choose a destination node','#12 Prompt Manager (+/-)','#3 Prompt Manager (+/-)','#7 Edited in ComfyUI','All 3 eligible nodes']);
+        await expect(nodes).toHaveValue('');
+        await nodes.selectOption({label:'All 3 eligible nodes'});
+        await expect(sender.getByRole('status')).toHaveText('Sending to all 3 eligible nodes in Test ComfyUI. Apply to send it, or preview the changes first.');
+        await page.screenshot({path:testInfo.outputPath('send-all-option.png')});
+        await sender.getByRole('button',{name:'Preview changes',exact:true}).click();
+        const reviews=sender.locator('section.prompt-sender-node');
+        await expect(reviews.locator('> h4')).toHaveText(['#3 Prompt Manager (+/-)','#7 Edited in ComfyUI','#12 Prompt Manager (+/-)']);
+        await expect(sender.getByRole('region',{name:'#12 Prompt Manager (+/-)',exact:true})).toContainText('Existing 12');
+        expect(await host.evaluate(()=>window.applied)).toEqual([]);
+        await sender.getByRole('button',{name:'Apply to ComfyUI',exact:true}).click();
+        await expect(sender.getByRole('alert')).toHaveText('Sent to 2 of 3 nodes in Test ComfyUI. #7 Edited in ComfyUI: Workflow or prompt changed. Preview again.');
+        expect(await host.evaluate(()=>window.applied)).toEqual(['3','12']);
+        expect(await host.evaluate(()=>window.hostValues['7'].positive)).toBe('Existing 7');
+        await page.screenshot({path:testInfo.outputPath('send-all-result.png')});
+        await page.setViewportSize({width:390,height:844});
+        await sender.getByRole('button',{name:'Preview changes',exact:true}).click();await expect(reviews).toHaveCount(3);
+        await reviews.last().scrollIntoViewIfNeeded();
+        expect(await page.evaluate(()=>document.querySelector('dialog.prompt-sender').scrollWidth<=document.querySelector('dialog.prompt-sender').clientWidth+1)).toBe(true);
+        await page.screenshot({path:testInfo.outputPath('send-all-mobile.png')});
+        const apply=sender.getByRole('button',{name:'Apply to ComfyUI',exact:true});await apply.focus();await expect(apply).toBeFocused();
+    } finally {await host.evaluate(()=>window.fixtureHost.dispose());await host.close();}
+});
@@ -109,6 +109,7 @@ class ResetWatch:
            stream.write(text)
            stream.flush()
        except (OSError, ValueError):
+            # the stream closed; a watcher must not fail the server
            pass


@@ -162,13 +162,15 @@ async function serverJson(request, url) {
 }

 const number = value => value.toLocaleString('en-US');
+// The sidebar's Images count (state.mjs), which System's Images metric shows (#555).
+const IMAGES_COUNT_URL = '/prompt_manager/images/output?mode=workspace&limit=1';

 /** The concept's shell and Overview with the recorded deviations applied, given the server's real overview. */
-function mapOverviewConcept(reference, overview) {
+function mapOverviewConcept(reference, overview, images) {
    // D165: the discreet legacy-pages line follows the settings layout.
    reference = { ...reference, tree: [...reference.tree, 'p.legacy-pages.small'] };
    const relabel = { 'Database integrity': 'Not checked', 'Positive prompts': number(overview.library.positive_prompts),
-        'Negative variants': number(overview.library.negative_variants), Images: number(overview.images.indexed) };
+        'Negative variants': number(overview.library.negative_variants), Images: number(images) };
    const rows = {
        // D93: the real pending count; Review metadata opens Needs review (the concept's go-review).
        '3 ambiguous image links': row => ({ ...row,
@@ -179,8 +181,9 @@ function mapOverviewConcept(reference, overview) {
        'One display configuration': row => ({ ...row, description: 'Grid and density settings are shared across views.' }),
        // D93: the real sources, not samples.
        '2 sample output sources': row => ({ ...row, title: `${number(overview.sources.effective)} output sources` }),
-        // D96: the dialog shows runs by category and library totals, not prompt, tag or date usage (D153: no ratings).
-        Statistics: row => ({ ...row, description: 'Runs by category, with library totals.' }),
+        // D96: the dialog shows runs by category and database record counts, not prompt, tag or date usage (D153: no
+        // ratings; #555: the counts are labelled as records, not as the Library or Images page counts).
+        Statistics: row => ({ ...row, description: 'Runs by category, with database record counts.' }),
    };
    const surfaces = reference.columns.surfaces.map(surface => ({ ...surface,
        rows: surface.rows.map(row => (rows[row.title] ?? (value => value))(row)) }));
@@ -218,6 +221,8 @@ async function conceptOverview(page, theme) {
 async function productionOverview(page, theme) {
    await openProduction(page, 'system/overview', theme);
    await expect(page.locator('#workspace-main .summary-metrics')).toBeVisible();
+    // #555: the Images metric is the shell's Images count: compare once it was read.
+    await expect(page.locator('#workspace-main .summary-metrics > .metric:nth-child(3) strong')).toHaveText(/^[\d,]+$/);
    // The thumbnail row is its own read (I2): compare once it answered.
    await expect(page.locator('#workspace-main .operation h3').filter({ hasText: 'thumbnails' })).toHaveText('No missing thumbnails');
    // So is the backup row (S9).
@@ -231,6 +236,7 @@ for (const theme of THEMES) for (const [width, height] of SIZES) {
    test(`system shell and overview match the concept ${theme} ${width}x${height}`, async ({ page, request }, testInfo) => {
        await page.setViewportSize({ width, height });
        const overview = await serverJson(request, '/prompt_manager/system/overview');
+        const images = (await serverJson(request, IMAGES_COUNT_URL)).total;
        // The fixture's thumbnails all exist, so the concept's "No missing thumbnails" is also the real title.
        expect((await serverJson(request, '/prompt_manager/images/thumbnails/status')).pending).toBe(0);
        const concept = await conceptOverview(page, theme);
@@ -239,7 +245,7 @@ for (const theme of THEMES) for (const [width, height] of SIZES) {
        await page.screenshot({ path: testInfo.outputPath(`concept-system-${theme}-${width}.png`), fullPage: true });
        const production = await productionOverview(page, theme);
        await page.screenshot({ path: testInfo.outputPath(`production-system-${theme}-${width}.png`), fullPage: true });
-        expect(diffInventory(mapOverviewConcept(concept, overview), production)).toEqual([]);
+        expect(diffInventory(mapOverviewConcept(concept, overview, images), production)).toEqual([]);
        expect(production.pageScroll).toBe(false);
    });
 }
@@ -265,8 +271,9 @@ const UNMAPPED_PATHS = [
 test('system comparison detects mutations', async ({ page, request }) => {
    await page.setViewportSize({ width: 1600, height: 1100 });
    const overview = await serverJson(request, '/prompt_manager/system/overview');
+    const images = (await serverJson(request, IMAGES_COUNT_URL)).total;
    const concept = await conceptOverview(page, 'dark');
-    const expected = mapOverviewConcept(concept, overview);
+    const expected = mapOverviewConcept(concept, overview, images);
    const production = await productionOverview(page, 'dark');
    expect(diffInventory(expected, production)).toEqual([]);
    // Unmapped, the concept differs exactly where a deviation is recorded, and nowhere else.
@@ -290,7 +297,7 @@ test('system comparison detects mutations', async ({ page, request }) => {
 });

 /**
- * D96: the concept's table, its rows the real ones; then "Library totals" in the same table markup. D153 (#447): the
+ * D96: the concept's table, its rows the real ones; then "Database records" (#555) in the same table markup. D153 (#447): the
 * concept's "Avg. rating" column and a "Rated images" total are not drawn.
 */
 function mapStatisticsConcept(reference, statistics) {
@@ -302,9 +309,10 @@ function mapStatisticsConcept(reference, statistics) {
        tables: [
            { ...runs, head: runs.head.filter(([, , text]) => text !== 'Avg. rating'),
                rows: statistics.by_category.map(row => [row.category ?? 'Uncategorized', number(row.runs)]) },
-            { caption: 'Library totals', head: [['th', 'col', 'Total'], ['th', 'col', 'Count']],
-                rows: [['Prompts', number(statistics.totals.total_prompts)], ['Tags', number(statistics.totals.total_tags)],
-                    ['Images', number(statistics.totals.total_images)]] },
+            { caption: 'Database records', head: [['th', 'col', 'Total'], ['th', 'col', 'Count']],
+                rows: [['Prompt records', number(statistics.totals.total_prompts)],
+                    ['Tags on prompts', number(statistics.totals.total_tags)],
+                    ['Image records', number(statistics.totals.total_images)]] },
        ],
    };
 }
@@ -420,7 +428,7 @@ for (const theme of THEMES) test(`statistics and health dialogs match the concep
    expect(diffInventory(mapHealthConcept(concept.health), await page.evaluate(measureDialog)).map(item => item.path))
        .toEqual(['operations.rows.0.title']);
    await page.evaluate(() => { document.querySelector('#modal .operation h3').textContent = 'Integrity check'; });
-    // And a removed "Library totals" table and a changed caption in the statistics dialog.
+    // And a removed "Database records" table and a changed caption in the statistics dialog.
    await page.keyboard.press('Escape');
    await page.locator('#workspace-main .section-nav').getByRole('button', { name: 'Overview', exact: true }).click();
    await page.locator('#workspace-main').getByRole('button', { name: 'Explore', exact: true }).click();
@@ -156,8 +156,9 @@ test('at 390px the window fits the screen, actions stay reachable and the page s
    expect(frame.bottom-frame.top).toBeLessThan(844);
    expect(frame.bottom-frame.top).toBeGreaterThanOrEqual(280);
    expect(await page.evaluate(()=>document.documentElement.scrollWidth)).toBeLessThanOrEqual(390);
-    // The last row's actions can be scrolled to inside the window and fit its width.
-    const last=rows(page).last().getByRole('button',{name:'Rename / merge',exact:true});
+    // The first page's last row's actions can be scrolled to inside the window and fit its width.
+    // Pinned to row 100: reaching it loads the next page (D183), and last() would then follow row 200.
+    const last=rows(page).nth(99).getByRole('button',{name:'Rename / merge',exact:true});
    await last.scrollIntoViewIfNeeded();await expect(last).toBeInViewport();
    const [button]=await boxes(last);const [after]=await boxes(tagWindow(page));
    expect(button.right).toBeLessThanOrEqual(after.right);
@@ -233,7 +233,7 @@ test('a view stored under older rules still lists and opens with its usable valu
 // D153 (#447): the workspace no longer offers "Highest rated"; the API still stores such a view as it was saved.
 test('a view saved under Highest rated opens on Recently added on Images and the Library', async ({ page, request }) => {
    const images = await create(request, { page: 'images', name: 'Rated cats', state: { ...IMAGE_DEFAULTS, q: 'cat', sort: 'rating' } });
-    const library = await create(request, { page: 'library', name: 'Rated dogs', state: { q: 'dog', category: '', sort: 'rating', tags: [], tag_mode: 'all', folder: '' } });
+    await create(request, { page: 'library', name: 'Rated dogs', state: { q: 'dog', category: '', sort: 'rating', tags: [], tag_mode: 'all', folder: '' } });
    expect((await listed(request)).map(view => view.state.sort)).toEqual(['rating', 'rating']);
    const listings = [];
    page.on('request', item => {
@@ -60,7 +60,7 @@ async function openReview(page, request, items = 30) {
 const inViewport = (rect, page) => rect.top >= 0 && rect.bottom <= page.viewportSize().height;

 test.beforeEach(async ({ page, browserName }) => { await startCoverage(page, browserName); });
-test.afterEach(async ({ page, browserName }, testInfo) => { await saveCoverage(page, browserName, testInfo); });
+test.afterEach(async ({ page, browserName }) => { await saveCoverage(page, browserName); });

 for (const viewport of [null, PHONE]) {
    const label = viewport ? ' at 390px' : '';
@@ -284,6 +284,23 @@ test('a restore seen finishing elsewhere closes an open restore review and disca
    expect((await serverJson(request, '/__test__/system/backups')).stages).toBe(0);
 });

+// #583: in WebKit, while a page.route is armed, a file part of a FormData body is read only when the request goes on;
+// a garbage collection in between dropped the form once nothing referenced it, and the server got an empty file
+// ("Uploaded file is empty"). The page keeps the form until its upload is answered. The route holds the upload
+// through a collection; without the fix WebKit lost the file every time (0/10 in the pinned image). Chromium and
+// Firefox keep the body anyway, so there it only checks that a held upload still opens the review.
+test('a review upload survives a garbage collection while it is in flight', async ({ page, request }) => {
+    const bytes = await backupBytes(request);
+    await page.route(`**${PREVIEW_URL}`, async route => {
+        await page.requestGC();
+        await route.continue();
+    });
+    await openBackups(page);
+    expect((await chooseBackup(page, bytes)).status()).toBe(200);
+    await expect(dialog(page).locator('#modal-title')).toHaveText('Restore preview');
+    expect((await serverJson(request, '/__test__/system/backups')).stages).toBe(1);
+});
+
 test('invalid file shows the validator message; nothing is staged', async ({ page, request }) => {
    const before = await serverJson(request, '/__test__/system/digest');
    await openBackups(page);
@@ -11,7 +11,6 @@ const REPORT_URL = '/prompt_manager/system/diagnostics';
 const LOGS_URL = '/prompt_manager/logs';
 const CONFIG_URL = '/prompt_manager/logs/config';
 const PREVIEW_URL = '/prompt_manager/maintenance/preview';
-const APPLY_URL = '/prompt_manager/maintenance/apply';
 const TEST_LINK_URL = '/prompt_manager/diagnostics/test-link';
 const CHANGED = 'The log files changed since the review; nothing was deleted. Review again.';
 const KEY = 'sk-s12-browser-SECRET-0123456789';
@@ -8,6 +8,8 @@ import { readCoverageTable, parseControl, CONTROL_EXEMPTIONS } from '../../tools
 const workspace = '/prompt_manager/workspace';
 const OVERVIEW_URL = '/prompt_manager/system/overview';
 const THUMBNAILS_URL = '/prompt_manager/images/thumbnails/status';
+// The sidebar's Images count (state.mjs NAV_COUNT_SOURCES): the Images page's own total.
+const IMAGES_COUNT_URL = '/prompt_manager/images/output?mode=workspace&limit=1';
 const number = value => value.toLocaleString('en-US');

 test.beforeEach(async ({ page, request, browserName }) => {
@@ -55,6 +57,7 @@ test('overview shows real counts and Not checked', async ({ page, request }) =>
    page.on('request', item => { if (!['GET', 'HEAD', 'OPTIONS'].includes(item.method())) writes.push(item.url()); });
    const overview = await serverJson(request, OVERVIEW_URL);
    const thumbnails = await serverJson(request, THUMBNAILS_URL);
+    const images = (await serverJson(request, IMAGES_COUNT_URL)).total;
    // The concept fixture: six positives, their saved negatives and 24 linked images, all with thumbnails.
    expect([overview.library.positive_prompts, overview.images.indexed, thumbnails.pending]).toEqual([6, 24, 0]);
    // I2: the Overview never walks the sources for thumbnails; the row reads the status route itself.
@@ -66,7 +69,8 @@ test('overview shows real counts and Not checked', async ({ page, request }) =>
        [item.querySelector('strong').textContent, item.querySelector('span').textContent]))).toEqual([
        [number(overview.library.positive_prompts), 'Positive prompts'],
        [number(overview.library.negative_variants), 'Negative variants'],
-        [number(overview.images.indexed), 'Images'],
+        // #555: the Images page's own count, the same number as its sidebar badge.
+        [number(images), 'Images'],
        ['Not checked', 'Database integrity'],
    ]);
    expect(await rowsOf(layout, 'Library health')).toEqual([
@@ -79,11 +83,31 @@ test('overview shows real counts and Not checked', async ({ page, request }) =>
    expect(await rowsOf(layout, 'Workspace preferences')).toEqual([
        ['One display configuration', 'Grid and density settings are shared across views.', 'Appearance'],
        ['2 output sources', 'Monitoring and enrichment share one source list.', 'Manage sources'],
-        ['Statistics', 'Runs by category, with library totals.', 'Explore'],
+        ['Statistics', 'Runs by category, with database record counts.', 'Explore'],
    ]);
    expect(writes).toEqual([]);
 });

+test('#555: the Images metric is the sidebar Images count, not the indexed image rows', async ({ page, request }) => {
+    const overview = await serverJson(request, OVERVIEW_URL);
+    // The Images page lists files no row links (the demo library: 122 files, 110 rows); the listing says so.
+    const listed = overview.images.indexed + 12;
+    await page.route(`**${IMAGES_COUNT_URL}`, async route => {
+        const response = await route.fetch();
+        await route.fulfill({ response, json: { ...(await response.json()), total: listed } });
+    });
+    const layout = await openOverview(page);
+    const imagesMetric = layout.locator('.summary-metrics > .metric').filter({ has: page.locator('span', { hasText: /^Images$/ }) });
+    await expect(imagesMetric.locator('strong')).toHaveText(number(listed));
+    await expect(page.locator('#primary-nav a[data-route="images"] .nav-count')).toHaveText(number(listed));
+    // A failed count reads as a dash, never the row count.
+    await page.unroute(`**${IMAGES_COUNT_URL}`);
+    await page.route(`**${IMAGES_COUNT_URL}`, route => route.fulfill({ status: 503, json: { success: false, error: 'Unavailable' } }));
+    await page.goto(`${workspace}#/system/appearance`);
+    await page.locator('#workspace-main .section-nav').getByRole('button', { name: 'Overview', exact: true }).click();
+    await expect(imagesMetric.locator('strong')).toHaveText('–');
+});
+
 // D129 (#249 S6b): where the library lives. The hook makes the fixture's database read as a node-folder library; its
 // Move library is a stand-in that touches no file (workspace_system_fixture.py).
 const banner = page => page.locator('#library-banner');
@@ -364,7 +388,7 @@ test('View backups / Appearance / Manage sources switch sections', async ({ page
    }
 });

-test('statistics dialog lists runs by category and library totals', async ({ page, request }) => {
+test('statistics dialog lists runs by category and database record counts', async ({ page, request }) => {
    const statistics = await serverJson(request, '/prompt_manager/system/statistics');
    expect(statistics.by_category.length).toBeGreaterThan(1);
    const layout = await openOverview(page);
@@ -373,13 +397,14 @@ test('statistics dialog lists runs by category and library totals', async ({ pag
    const dialog = page.locator('dialog#modal[open]');
    await expect(dialog.locator('#modal-title')).toHaveText('Usage statistics');
    const tables = dialog.locator('#modal-body > table');
-    await expect(tables.locator('caption')).toHaveText(['Runs by category', 'Library totals']);
+    await expect(tables.locator('caption')).toHaveText(['Runs by category', 'Database records']);
    // D153 (#447): no rating column and no rated-images total.
    await expect(tables.first().locator('thead th')).toHaveText(['Category', 'Runs']);
    const cells = table => table.locator('tbody tr').evaluateAll(rows => rows.map(row => [...row.cells].map(cell => cell.textContent)));
    expect(await cells(tables.first())).toEqual(statistics.by_category.map(row => [row.category ?? 'Uncategorized', number(row.runs)]));
-    expect(await cells(tables.nth(1))).toEqual([['Prompts', number(statistics.totals.total_prompts)],
-        ['Tags', number(statistics.totals.total_tags)], ['Images', number(statistics.totals.total_images)]]);
+    // #555: raw rows of the legacy /stats, labelled as rows so they never read as the Library or Images page counts.
+    expect(await cells(tables.nth(1))).toEqual([['Prompt records', number(statistics.totals.total_prompts)],
+        ['Tags on prompts', number(statistics.totals.total_tags)], ['Image records', number(statistics.totals.total_images)]]);
    await page.keyboard.press('Escape');
    await expect(explore).toBeFocused();
    // A statistics read that fails says so; the Overview stays.
@@ -145,9 +145,10 @@ test('long vocabularies append and Load more is keyboard reachable',async({page,
    await expect(loadMore(page)).toHaveCount(0);
    await expect(rows(page).nth(200).getByRole('button',{name:'Browse',exact:true})).toBeFocused();
    await expect(rows(page).locator('td:nth-child(1)')).toHaveText(manifest.tags);
-    // Reload with the window at its top: Firefox restores a scrolled window, whose end then appends a page before the check.
-    await main(page).locator('.two-col .table-wrap').evaluate(node=>new Promise(resolve=>{node.scrollTop=0;requestAnimationFrame(()=>requestAnimationFrame(resolve));}));
-    await page.reload();
+    // Open the screen as a new history entry, not a reload: Firefox restores a reloaded page's scrolled tag window, and
+    // its end then appends a page before the check (#567). Scrolling the window to its top first does not always stick.
+    await page.goto('about:blank');
+    await page.goto(route);
    await expect(rows(page)).toHaveCount(100);
    // D183: the end of the list arrives inside the tag window.
    const scroll=top=>main(page).locator('.two-col .table-wrap').evaluate((node,y)=>new Promise(resolve=>{node.scrollTop=y ?? node.scrollHeight;requestAnimationFrame(()=>requestAnimationFrame(resolve));}),top);
@@ -131,11 +131,40 @@ test('native image inspector previews and sends a pair into real visible widgets
        const twinId=await page.evaluate(async()=>{const {app}=await import('/scripts/app.js');const node=LiteGraph.createNode('PromptManagerPair');app.graph.add(node);return node.id;});
        await find0.click();
        const targets=sender.getByRole('combobox',{name:'Destination node',exact:true});
-        await expect(targets.locator('option')).toHaveCount(3);
+        await expect(targets.locator('option')).toHaveCount(4);
        await expect(targets).toHaveValue('');
        await expect(apply).toBeDisabled();
        await expect(targets.locator('option').nth(2)).toHaveText(new RegExp(`^#${twinId} `));
-        await page.evaluate(async twinId=>{const {app}=await import('/scripts/app.js');app.graph.remove(app.graph.getNodeById(twinId));},twinId);
+        // #542 D191: "All 2 eligible nodes" writes both real nodes, one after another; a linked third node is not offered.
+        const linkedId=await page.evaluate(async()=>{
+            const {app}=await import('/scripts/app.js');const {convertToInput}=await import('/extensions/core/widgetInputs.js');
+            const node=LiteGraph.createNode('PromptManagerPair');app.graph.add(node);
+            const widget=node.widgets.find(widget=>widget.name==='text');
+            if(!node.inputs.some(input=>input.name==='text'))convertToInput(node,widget);
+            const source=LiteGraph.createNode('PrimitiveString');app.graph.add(source);
+            source.connect(0,node,node.inputs.findIndex(input=>input.name==='text'));
+            for(const each of app.graph._nodes.filter(item=>item.type==='PromptManagerPair')){const text=each.widgets.find(widget=>widget.name==='text');if(text)text.value=`Before all ${each.id}`;}
+            return node.id;
+        });
+        await find0.click();
+        await expect(targets.locator('option')).toHaveText(['Choose a destination node',new RegExp(`^#${id} `),new RegExp(`^#${twinId} `),'All 2 eligible nodes']);
+        await expect(sender.getByRole('status')).toContainText('1 other Prompt Manager node cannot receive this prompt.');
+        await targets.selectOption({label:'All 2 eligible nodes'});
+        await sender.getByRole('button',{name:'Preview changes',exact:true}).click();
+        await expect(sender.locator('section.prompt-sender-node > h4')).toHaveText([new RegExp(`^#${id} `),new RegExp(`^#${twinId} `)]);
+        await apply.click();
+        // The tab title gains ComfyUI's unsaved mark once the workflow changed, so the window is matched loosely.
+        await expect(sender.getByRole('status')).toHaveText(/^Sent to 2 of 2 nodes in .*ComfyUI\.$/);
+        await expect(apply).toBeDisabled();
+        const all=await page.evaluate(async ids=>{
+            const {app}=await import('/scripts/app.js');const output=(await app.graphToPrompt()).output;
+            return ids.map(nodeId=>{const node=app.graph.getNodeById(nodeId);const serialized=node.serialize();const index=node.widgets.findIndex(widget=>widget.name==='negative_text');
+                return{prompt:output[String(nodeId)]?.inputs.negative_text,serialized:serialized.widgets_values[index],text:node.widgets.find(widget=>widget.name==='text')?.value};});
+        },[id,twinId,linkedId]);
+        expect(all.slice(0,2)).toEqual([{prompt:negative,serialized:negative,text:positive},{prompt:negative,serialized:negative,text:positive}]);
+        expect(all[2].text).toBe(`Before all ${linkedId}`);
+        expect(await page.evaluate(()=>window.senderEffects.queue-window.senderSendBaseline.queue)).toBe(0);
+        await page.evaluate(async ids=>{const {app}=await import('/scripts/app.js');for(const nodeId of ids)app.graph.remove(app.graph.getNodeById(nodeId));},[twinId,linkedId]);
        // #535: the status line says why a window cannot receive.
        const find=sender.getByRole('button',{name:'Find ComfyUI windows',exact:true});
        const preview=sender.getByRole('button',{name:'Preview changes',exact:true});
@@ -21,14 +21,6 @@ function jsonResponse(status, body) {
        json: async () => body };
 }

-function sseResponse(frames) {
-    const bytes = new TextEncoder().encode(frames.map(frame => `data: ${JSON.stringify(frame)}\n\n`).join(''));
-    let sent = false;
-    return { ok: true, status: 200, body: { getReader: () => ({
-        read: async () => (sent ? { done: true } : (sent = true, { done: false, value: bytes })),
-    }) } };
-}
-
 function load(file, className, fetchUrl, extra = {}, dom = elements()) {
    const timers = [];
    const notifications = [];
@@ -63,8 +55,6 @@ function load(file, className, fetchUrl, extra = {}, dom = elements()) {
    return { page, dom, timers, notifications, storage };
 }

-const BUSY = 'Scan for metadata already running';
-
 test('admin settings save shows why config.json refused it', async () => {
    const message = 'config.json cannot be read, so nothing was saved. Fix or remove the file, then save again.';
    const { page, notifications } = load('admin.js', 'PromptAdmin',
@@ -225,3 +225,141 @@ test('acknowledgement cannot claim an extra role beyond approved changes',async(
    const {createSendSession}=await source;const s=setup(createSendSession,{apply:async()=>({targetId:'one',values:{positive:'new',negative:'also changed'}})});
    await s.session.discover();s.session.selectHost('host');s.session.selectTarget('one');await s.session.preview();await s.session.apply();assert.equal(s.session.state.phase,'error');assert.match(s.session.state.message,/unexpected acknowledgement/);s.session.dispose();
 });
+// #542: "All N eligible nodes" sends to every eligible node of one window, previewing every node first (Q542-2 C).
+function allHost({nodes=['10','9','2'],revision,preview,apply,discover}={}) {
+    const calls=[];const sent=new Set();
+    const targets=nodes.map(id=>pm(id,['positive'],revision?{revision}:{}));
+    const client={
+        discover:discover ?? (async()=>[window1(targets)]),
+        preview:async(host,id,roles)=>{calls.push(['preview',id]);if(preview)return preview(id,calls,sent);return{ticket:`t-${id}-${calls.length}`,revision,target:{id,label:`Node ${id}`},fields:[{role:'positive',before:sent.has(id)?'new':'old',after:roles.positive}]};},
+        apply:async(host,ticket)=>{const id=ticket.split('-')[1];calls.push(['apply',id,ticket]);if(apply)return apply(id,calls);sent.add(id);return{targetId:id,values:{positive:'new'}};},
+        dispose:()=>calls.push(['dispose']),
+    };
+    return {client,calls,sent};
+}
+async function allSession(createSendSession,options) {
+    const host=allHost(options);const session=createSendSession({client:host.client,roles:{positive:'new'},onChange:()=>{}});
+    await session.discover();return {...host,session};
+}
+const order=calls=>calls.filter(call=>call[0]!=='dispose').map(call=>`${call[0]} ${call[1]}`);
+test('All is offered only with two or more eligible nodes and is never selected for you',async()=>{
+    const {createSendSession,ALL_NODES}=await source;
+    const one=await allSession(createSendSession,{nodes:['1']});
+    one.session.selectTarget(ALL_NODES);assert.equal(one.session.state.targetId,'');assert.equal(one.calls.length,0);one.session.dispose();
+    const two=await allSession(createSendSession,{nodes:['1','2']});
+    assert.equal(two.session.state.targetId,'');
+    two.session.selectTarget(ALL_NODES);assert.equal(two.session.state.targetId,ALL_NODES);
+    assert.match(two.session.state.message,/all 2 eligible nodes in Flow - ComfyUI/);
+    await two.session.discover();assert.equal(two.session.state.targetId,'');two.session.dispose();
+});
+test('Apply to All previews every node first, then sends one after another in node id order',async()=>{
+    const {createSendSession,ALL_NODES}=await source;const s=await allSession(createSendSession);
+    s.session.selectTarget(ALL_NODES);await s.session.apply();
+    assert.deepEqual(order(s.calls),['preview 2','preview 9','preview 10','apply 2','preview 9','apply 9','preview 10','apply 10']);
+    assert.equal(s.session.state.phase,'success');assert.equal(s.session.state.message,'Sent to 3 of 3 nodes in Flow - ComfyUI.');
+    await s.session.apply();assert.equal(s.calls.filter(call=>call[0]==='apply').length,3);s.session.dispose();
+});
+test('a double click on Apply to All sends to each node once',async()=>{
+    const {createSendSession,ALL_NODES}=await source;const s=await allSession(createSendSession,{nodes:['1','2']});
+    s.session.selectTarget(ALL_NODES);await Promise.all([s.session.apply(),s.session.apply()]);
+    assert.deepEqual(s.calls.filter(call=>call[0]==='apply').map(call=>call[1]),['1','2']);s.session.dispose();
+});
+test('a node refusing its preview stops All before anything is written and names the node',async()=>{
+    const {createSendSession,ALL_NODES}=await source;
+    const s=await allSession(createSendSession,{preview:id=>{if(id==='9')throw Error('positive is connected to an upstream input.');return{ticket:`t-${id}`,target:{id},fields:[{role:'positive',before:'old',after:'new'}]};}});
+    s.session.selectTarget(ALL_NODES);await s.session.apply();
+    assert.equal(s.calls.filter(call=>call[0]==='apply').length,0);assert.equal(s.session.state.phase,'error');
+    assert.match(s.session.state.message,/^#9 Node 9: positive is connected to an upstream input\. Nothing was sent\./);
+    assert.equal(s.session.state.outcomeUnknown,false);s.session.dispose();
+});
+test('a refusal while sending to All is reported by node and the other nodes are still sent',async()=>{
+    const {createSendSession,ALL_NODES}=await source;
+    const s=await allSession(createSendSession,{apply:id=>{if(id==='9')throw Error('Workflow or prompt changed. Preview again.');return{targetId:id,values:{positive:'new'}};}});
+    s.session.selectTarget(ALL_NODES);await s.session.apply();
+    assert.deepEqual(s.calls.filter(call=>call[0]==='apply').map(call=>call[1]),['2','9','10']);
+    assert.equal(s.session.state.phase,'error');assert.equal(s.session.state.outcomeUnknown,false);
+    assert.equal(s.session.state.message,'Sent to 2 of 3 nodes in Flow - ComfyUI. #9 Node 9: Workflow or prompt changed. Preview again.');s.session.dispose();
+});
+test('a lost reply on one node of All leaves the later nodes unsent and that outcome unknown',async()=>{
+    const {createSendSession,ALL_NODES}=await source;
+    const s=await allSession(createSendSession,{apply:id=>{if(id==='9')throw Error('Bridge request timed out');return{targetId:id,values:{positive:'new'}};}});
+    s.session.selectTarget(ALL_NODES);await s.session.apply();
+    assert.deepEqual(s.calls.filter(call=>call[0]==='apply').map(call=>call[1]),['2','9']);
+    assert.equal(s.session.state.outcomeUnknown,true);
+    assert.match(s.session.state.message,/^Sent to 1 of 3 nodes in Flow - ComfyUI\. No confirmation received from #9 Node 9; the update may have applied\. Not sent: #10 Node 10\. Check ComfyUI, then preview again\. Bridge request timed out$/);
+    await s.session.apply();assert.equal(s.calls.filter(call=>call[0]==='apply').length,2);s.session.dispose();
+});
+test('closing the dialog during All stops after the current node',async()=>{
+    const {createSendSession,ALL_NODES}=await source;let release;
+    const s=await allSession(createSendSession,{apply:id=>id==='2'?new Promise(done=>release=()=>done({targetId:id,values:{positive:'new'}})):{targetId:id,values:{positive:'new'}}});
+    s.session.selectTarget(ALL_NODES);const pending=s.session.apply();
+    for(let i=0;i<50 && !release;i++)await tick();assert.ok(release,'the first node was sent');
+    s.session.dispose();release();await pending;
+    assert.deepEqual(s.calls.filter(call=>call[0]==='apply').map(call=>call[1]),['2']);
+});
+test('All accepts the revision our own write moved, but not a workflow changed before the run',async()=>{
+    const {createSendSession,ALL_NODES}=await source;
+    // The host moves the graph version on every write: later nodes preview with the new revision.
+    let version=4;
+    const bumped=await allSession(createSendSession,{revision:'1:4',preview:id=>({ticket:`t-${id}`,revision:`1:${version}`,target:{id},fields:[{role:'positive',before:'old',after:'new'}]}),apply:id=>{version++;return{targetId:id,values:{positive:'new'}};}});
+    bumped.session.selectTarget(ALL_NODES);await bumped.session.apply();
+    assert.equal(bumped.session.state.message,'Sent to 3 of 3 nodes in Flow - ComfyUI.');bumped.session.dispose();
+    const moved=await allSession(createSendSession,{revision:'1:4',preview:id=>({ticket:`t-${id}`,revision:'1:5',target:{id},fields:[{role:'positive',before:'old',after:'new'}]})});
+    moved.session.selectTarget(ALL_NODES);await moved.session.apply();
+    assert.match(moved.session.state.message,/workflow changed since this window was found/i);assert.equal(moved.calls.filter(call=>call[0]==='apply').length,0);moved.session.dispose();
+});
+test('a node whose text changed after the preview pass is refused, not overwritten',async()=>{
+    const {createSendSession,ALL_NODES}=await source;let edited=false;
+    const s=await allSession(createSendSession,{preview:id=>({ticket:`t-${id}`,target:{id},fields:[{role:'positive',before:id==='10'&&edited?'typed in ComfyUI':'old',after:'new'}]}),apply:id=>{edited=true;return{targetId:id,values:{positive:'new'}};}});
+    s.session.selectTarget(ALL_NODES);await s.session.apply();
+    assert.deepEqual(s.calls.filter(call=>call[0]==='apply').map(call=>call[1]),['2','9']);
+    assert.match(s.session.state.message,/^Sent to 2 of 3 nodes in Flow - ComfyUI\. #10 Node 10: Its prompt changed since the preview\./);s.session.dispose();
+});
+test('Preview with All shows every node in order, and Apply sends fresh tickets that match the review',async()=>{
+    const {createSendSession,ALL_NODES}=await source;const s=await allSession(createSendSession);
+    s.session.selectTarget(ALL_NODES);await s.session.preview();
+    assert.equal(s.session.state.phase,'ready');assert.equal(s.session.state.preview,null);
+    assert.deepEqual(s.session.state.previews.map(item=>item.label),['#2 Node 2','#9 Node 9','#10 Node 10']);
+    assert.match(s.session.state.message,/Sending to all 3 eligible nodes in Flow - ComfyUI\. Review the complete changes, then apply\./);
+    const first=s.session.state.previews[0].preview.ticket;
+    await s.session.apply();
+    // A held review may have outlived the host's 30 s tickets, so even the first node takes a fresh one.
+    assert.deepEqual(order(s.calls),['preview 2','preview 9','preview 10','preview 2','apply 2','preview 9','apply 9','preview 10','apply 10']);
+    assert.notEqual(s.calls.find(call=>call[0]==='apply')[2],first);assert.equal(s.session.state.phase,'success');
+    s.session.selectTarget('2');assert.deepEqual(s.session.state.previews,[]);s.session.dispose();
+});
+test('the dialog offers All for two or more nodes and reviews each node under its name',async()=>{
+    const {createPromptSender,ALL_NODES}=await source;const {createScope}=await import('../../web/js/shared/toolkit/core.js');
+    const dom=fakeDOM();const scope=createScope();
+    const {client}=allHost({nodes:['1','2']});
+    try {
+        createPromptSender({scope,clientFactory:()=>client}).open({positive:'new'});await tick();
+        const dialog=dom.body.children.at(-1);const target=dom.find(dialog,node=>node.id==='prompt-sender-target');
+        assert.deepEqual(target.children.map(option=>[option.value,option.textContent]),[['','Choose a destination node'],['1','#1 Node 1'],['2','#2 Node 2'],[ALL_NODES,'All 2 eligible nodes']]);
+        assert.equal(target.value,'');target.value=ALL_NODES;target.dispatchEvent(new Event('change'));
+        dom.find(dialog,node=>node.textContent==='Preview changes').dispatchEvent(new Event('click'));for(let i=0;i<5;i++)await tick();
+        const sections=[];(function walk(node){if(node.className==='prompt-sender-node')sections.push(node);node.children.forEach(walk);})(dialog);
+        assert.deepEqual(sections.map(section=>section.children[0].textContent),['#1 Node 1','#2 Node 2']);
+        dom.find(dialog,node=>node.textContent==='Apply to ComfyUI').dispatchEvent(new Event('click'));for(let i=0;i<10;i++)await tick();
+        assert.ok(dom.find(dialog,node=>node.textContent==='Sent to 2 of 2 nodes in Flow - ComfyUI.'));
+    } finally {scope.dispose();dom.restore();}
+});
+test('an expired review still sends every node, and a held review checks the discovered revision first',async()=>{
+    const {createSendSession,ALL_NODES}=await source;let reviewing=true;
+    // The host refuses every ticket taken during the review, as after its 30 s expiry.
+    const s=await allSession(createSendSession,{preview:(id,calls)=>({ticket:`t-${id}-${reviewing?'old':calls.length}`,target:{id},fields:[{role:'positive',before:'old',after:'new'}]}),apply:id=>({targetId:id,values:{positive:'new'}})});
+    const realApply=s.client.apply;s.client.apply=async(host,ticket,options)=>{if(ticket.endsWith('-old'))throw Error('Preview expired or unavailable; preview again');return realApply(host,ticket,options);};
+    s.session.selectTarget(ALL_NODES);await s.session.preview();reviewing=false;await s.session.apply();
+    assert.equal(s.session.state.message,'Sent to 3 of 3 nodes in Flow - ComfyUI.');s.session.dispose();
+    const moved=await allSession(createSendSession,{revision:'1:4',preview:(id,calls)=>({ticket:`t-${id}`,revision:calls.length>3?'1:5':'1:4',target:{id},fields:[{role:'positive',before:'old',after:'new'}]})});
+    moved.session.selectTarget(ALL_NODES);await moved.session.preview();assert.equal(moved.session.state.phase,'ready');await moved.session.apply();
+    assert.match(moved.session.state.message,/^Sent to 0 of 3 nodes in Flow - ComfyUI\. #2 Node 2: The workflow changed since this window was found/);
+    assert.equal(moved.calls.filter(call=>call[0]==='apply').length,0);moved.session.dispose();
+});
+test('a changed prepend or append after the review refuses that node',async()=>{
+    const {createSendSession,ALL_NODES}=await source;let edited=false;
+    const s=await allSession(createSendSession,{preview:id=>({ticket:`t-${id}`,target:{id},fields:[{role:'positive',before:'old',after:'new'}],composition:{prepend:id==='9'&&edited?'typed':'trigger',append:'',before:'trigger old',after:'trigger new'}}),apply:id=>{edited=true;return{targetId:id,values:{positive:'new'}};}});
+    s.session.selectTarget(ALL_NODES);await s.session.apply();
+    assert.deepEqual(s.calls.filter(call=>call[0]==='apply').map(call=>call[1]),['2','10']);
+    assert.match(s.session.state.message,/^Sent to 2 of 3 nodes in Flow - ComfyUI\. #9 Node 9: Its prompt changed since the preview\./);s.session.dispose();
+});
@@ -128,6 +128,24 @@ test('invalid file shows the validator message; a refusal names its job; a lost
    assert.deepEqual(await uploadRestore(file, { ApiError, fetchUrl: async () => response(200, PREVIEW) }), PREVIEW);
 });

+// #583: WebKit reads a FormData's file part by reference, possibly after a garbage collection; the page holds the form
+// until the upload is answered, then lets it go, whether the server staged it, refused it or the request failed.
+test('a review upload keeps its form referenced until the upload is answered', async () => {
+    const { uploadRestore, uploadsInFlight } = await backups;
+    const file = new File(['bytes'], 'b.db');
+    for (const answer of [async () => response(200, PREVIEW), async () => response(400, { success: false, error: 'x' }),
+        async () => { throw new TypeError('offline'); }]) {
+        let held;
+        const upload = uploadRestore(file, { ApiError, fetchUrl: async (url, init) => {
+            held = uploadsInFlight.has(init.body) && init.body.get('database_file').size === file.size;
+            return answer();
+        } }).catch(() => {});
+        await upload;
+        assert.equal(held, true);
+        assert.equal(uploadsInFlight.size, 0);
+    }
+});
+
 test('Cancel discards the stage through the api client and never throws', async () => {
    const { discardRestore, PREVIEW_URL } = await backups;
    const calls = [];
@@ -16,12 +16,22 @@ const OVERVIEW = Object.freeze({

 test('metrics are the server counts and Not checked before any health check', async () => {
    const { metricValues } = await overviewModule;
-    assert.deepEqual(metricValues(OVERVIEW), [
+    assert.deepEqual(metricValues(OVERVIEW, 24), [
        [(1234).toLocaleString(), 'Positive prompts'], ['7', 'Negative variants'], ['24', 'Images'],
        ['Not checked', 'Database integrity'],
    ]);
 });

+test('#555: the Images metric is the Images page count (the sidebar badge), not the indexed rows', async () => {
+    const { metricValues } = await overviewModule;
+    // The demo library: 110 indexed rows, 122 files on the Images page (unlinked ones included).
+    const overview = { ...OVERVIEW, images: { indexed: 110, rated: 0 } };
+    assert.deepEqual(metricValues(overview, 122)[2], [(122).toLocaleString(), 'Images']);
+    // Not read yet (undefined) or failed (null): a dash, as on the workspace Overview, never the row count.
+    assert.deepEqual(metricValues(overview, undefined)[2], ['–', 'Images']);
+    assert.deepEqual(metricValues(overview, null)[2], ['–', 'Images']);
+});
+
 test('metric 4 is the last health result', async () => {
    const { integrityText } = await overviewModule;
    assert.equal(integrityText(null), 'Not checked');
@@ -150,7 +160,7 @@ test('statistics rows are the real runs, then the library totals, without rating
        rated_images: 20,
    };
    assert.deepEqual(categoryRows(statistics), [['Landscapes', (1200).toLocaleString()], ['Uncategorized', '3']]);
-    assert.deepEqual(totalsRows(statistics), [['Prompts', '12'], ['Tags', '15'], ['Images', '24']]);
+    assert.deepEqual(totalsRows(statistics), [['Prompt records', '12'], ['Tags on prompts', '15'], ['Image records', '24']]);
 });

 /** A fake api answering each `get`/`post` from a queue per URL, recording the calls. */
@@ -2584,7 +2584,7 @@ class TestActivityJobs(AdminAPITestCase):
    async def test_cancel_after_first_batch_keeps_partial_counts(self):
        """Review M7: the real scan stops at the batch boundary, keeping batch 1."""
        import threading
-        from unittest import mock
+        import unittest.mock as mock

        from py.api import admin

@@ -600,6 +600,33 @@ class TestAutotagSingleEdgeCases(AutotagAPITestCase):
            {"path": str(image), "general_threshold": "high"},
        )
        self.assertEqual(resp.status, 400)
+        self.assertEqual(
+            (await resp.json())["error"],
+            "general_threshold and character_threshold must be numeric",
+        )
+
+    async def test_invalid_single_options_report_the_validation_error(self) -> None:
+        image = self._make_image(self.output_dir)
+        cases = (
+            (
+                {"model_type": "wd14-vit", "general_threshold": 2},
+                "general_threshold must be between 0 and 1",
+            ),
+            (
+                {"model_type": "gguf", "prompt": "x" * 4001},
+                "instructions must be at most 4000 characters",
+            ),
+        )
+        for options, message in cases:
+            with self.subTest(options=options["model_type"]):
+                resp = await self._post_json(
+                    "/prompt_manager/autotag/single",
+                    {"path": str(image), **options},
+                )
+                self.assertEqual(resp.status, 400)
+                self.assertEqual(
+                    await resp.json(), {"success": False, "error": message}
+                )

    async def test_prompt_lookup_failure_still_returns_tags(self):
        image = self._make_image(self.output_dir)
@@ -1151,7 +1178,9 @@ class TestModelStatus(AutotagAPITestCase):
        )
        # Kept fields legacy pages and the workspace read.
        for model in models.values():
-            self.assertTrue({"name", "description", "size", "downloaded"} <= set(model))
+            self.assertLessEqual(
+                {"name", "description", "size", "downloaded"}, set(model)
+            )
        self.assertTrue(data["model_loaded"])
        self.assertEqual(data["loaded_model_type"], "wd14-vit")

@@ -351,8 +351,6 @@ class TestLongJobLock(unittest.TestCase):
        self.api = PromptManagerAPI(db=database)

    def _run(self, coro):
-        import asyncio
-
        return asyncio.run(coro)

    def test_second_acquire_is_refused_until_first_releases(self):
@@ -825,8 +823,6 @@ class TestInstanceHelpers(FolderPathsFixture):
        self.addCleanup(setattr, GalleryConfig, "MONITORING_DIRECTORIES", orig_dirs)

    def _run(self, coro):
-        import asyncio
-
        return asyncio.run(coro)

    def test_run_in_executor_with_kwargs(self):
@@ -16,7 +16,7 @@ import re
 import sqlite3
 import sys
 import unittest
-from unittest import mock
+import unittest.mock as mock
 from unittest.mock import MagicMock

 _mock_server = MagicMock()
@@ -381,7 +381,7 @@ class TestAnotherMount(SafetyTestCase):
        self.assertTrue(other.is_file() and keeper.is_file())

    async def test_a_volume_without_file_ids_is_named_truthfully(self):
-        keeper, other, patches = self.mount("x.png", "x.png")
+        self.mount("x.png", "x.png")

        def zero(path, *args, **kwargs):
            return _fake_stat(self.real_stat(path), st_dev=0, st_ino=0)
@@ -3713,7 +3713,7 @@ class TestSharedListing(ImageAPITestCase):

    async def test_a_root_read_again_after_the_roots_change_listens_again(self):
        make_png(self.output_dir / "a.png")
-        record = await self._listed()
+        await self._listed()
        self.api.reset_gallery_roots_cache()
        record = await self._listed()  # still configured: read and walked
        self._interval(0)
@@ -840,6 +840,23 @@ class TestLoraScanRoute(LoraAPITestCase):
            ("error", error["message"], 0),
        )

+    async def test_unexpected_scan_error_is_generic_in_the_stream(self):
+        self._enable()
+        secret = str(self.tmp_root / "x.db")
+        err = RuntimeError(f"could not open {secret}")
+        with patch.object(self.api.db, "replace_category_prompts", side_effect=err):
+            with self.assertLogs("prompt_manager.api", level="ERROR") as logs:
+                resp = await self.client.request("POST", "/prompt_manager/lora/scan")
+                body = await resp.text()  # the stream ends inside the patch
+        self.assertNotIn("x.db", body)
+        error = self._sse_events(body)[-1]
+        self.assertEqual(
+            (error["type"], error["status"], error["progress"]),
+            ("error", error["message"], 0),
+        )
+        self.assertIn("server log", error["message"])
+        self.assertIn(secret, "\n".join(logs.output))
+
    @staticmethod
    def _sse_events(text):
        return [
@@ -675,7 +675,7 @@ class TestBackupPoolAndDiskSpace(ApplyTestCase):
        self.assertEqual(len(backups), MAX_SAFETY_BACKUPS)
        self.assertNotIn(restore_style[0], backups)
        self.assertNotIn(restore_style[1], backups)
-        self.assertTrue(set(maintenance_style) <= set(backups))
+        self.assertLessEqual(set(maintenance_style), set(backups))
        # A restore prunes the same pool, maintenance backups included.
        self.old_backup("prompts.db.backup_20020101_000000", 3000)
        _prune_safety_backups(self.api.db.model.db_path)
@@ -908,20 +908,20 @@ class TestWorkspaceImages(ImageAPITestCase):

    async def test_one_cards_parse_error_spares_the_page(self):
        prompt = self._save_prompt("a fox")
-        for name, mtime in (("bad.png", 200), ("ok.png", 100)):
+        # Cards are read on the image pool (#523), in no fixed order: the
+        # parser fails on bad.png's own record (seed 6), not on a call count.
+        for name, mtime, seed in (("bad.png", 200, 6), ("ok.png", 100, 5)):
            path = records_png(
-                self.output_dir / name, seeded_records("a fox", 5), mtime
+                self.output_dir / name, seeded_records("a fox", seed), mtime
            )
            self.api.db.link_image_to_prompt(prompt, str(path))
        real_parse = header_params_of_images()

        def parsing(info):
-            if parsing.calls == 0:
-                parsing.calls += 1
+            if '"seed": 6' in info["prompt"]:
                raise RuntimeError("unexpected parser bug")
            return real_parse(info)

-        parsing.calls = 0
        with (
            patch("py.api.images.header_params", side_effect=parsing),
            self.assertLogs(self.api.logger, "WARNING") as logged,
@@ -11,7 +11,7 @@ import time
 import types
 import unittest
 from pathlib import Path
-from unittest import mock
+import unittest.mock as mock

 try:
    from tests.open_handles import assert_closed
@@ -6,7 +6,7 @@ Large frees then go back to the OS instead of fragmenting per-thread arenas.
 import ctypes
 import sys
 import unittest
-from unittest import mock
+import unittest.mock as mock

 from tests.browser import malloc_tuning

@@ -46,7 +46,6 @@ class TestResetWatch(unittest.TestCase):
        self.assertFalse(is_reset_path("/__test__/reset/extra"))

    def test_a_stalled_reset_reports_state_and_stacks_while_it_waits(self):
-        stream = io.StringIO()
        reported = threading.Event()

        class Stream(io.StringIO):
@@ -385,8 +385,8 @@ class TestArchivedReaders(LibraryDeleteCase):

    def setUp(self):
        super().setUp()
-        self.kept, _kn, _kp = self.paired("Kept cat", "kept blur")
-        self.gone, _gn, _gp = self.paired("Gone cat", "gone blur")
+        self.kept, _, _ = self.paired("Kept cat", "kept blur")
+        self.gone, _, _ = self.paired("Gone cat", "gone blur")
        for pid, category, tag in ((self.kept, "keep", "k"), (self.gone, "gone", "g")):
            self.db.update_prompt_metadata(pid, category=category, tags=[tag])
        self.apply([self.gone])
@@ -642,7 +642,7 @@ class TestPairedDelete(LibraryDeleteCase):
        # The negatives stay, and the image file stays on disk.
        self.assertTrue((self.root / "owl.png").exists())
        texts = [row[0] for row in rows(self.db, "SELECT text FROM prompts")]
-        self.assertTrue({"dark", "fog", "Bystander"} <= set(texts))
+        self.assertLessEqual({"dark", "fog", "Bystander"}, set(texts))

    def test_a_negative_used_by_another_positive_is_archived_never_deleted(self):
        shared = save(self.db, "Shared")
@@ -14,7 +14,7 @@ import threading
 import types
 import unittest
 from collections import namedtuple
-from unittest import mock
+import unittest.mock as mock

 sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))

@@ -140,8 +140,10 @@ class TestIdempotentMigrations(MigrationTestCase):
    def test_stale_prompts_new_from_a_failed_rebuild_does_not_block_startup(self):
        self._legacy_db(
            [
-                "INSERT INTO prompts (text, hash, workflow_name)"
-                " VALUES ('a', 'h1', 'wf')",
+                (
+                    "INSERT INTO prompts (text, hash, workflow_name)"
+                    " VALUES ('a', 'h1', 'wf')"
+                ),
                "CREATE TABLE prompts_new (id INTEGER PRIMARY KEY, junk TEXT)",
                "INSERT INTO prompts_new (junk) VALUES ('leftover')",
            ]
@@ -157,10 +159,14 @@ class TestIdempotentMigrations(MigrationTestCase):
        # DROP TABLE prompts with foreign keys ON cascades into generated_images
        self._legacy_db(
            [
-                "INSERT INTO prompts (text, hash, workflow_name)"
-                " VALUES ('a', 'h1', 'wf')",
-                "INSERT INTO generated_images (prompt_id, image_path, filename)"
-                " VALUES (1, '/out/a.png', 'a.png')",
+                (
+                    "INSERT INTO prompts (text, hash, workflow_name)"
+                    " VALUES ('a', 'h1', 'wf')"
+                ),
+                (
+                    "INSERT INTO generated_images (prompt_id, image_path, filename)"
+                    " VALUES (1, '/out/a.png', 'a.png')"
+                ),
            ]
        )

@@ -172,11 +178,15 @@ class TestIdempotentMigrations(MigrationTestCase):
    def test_rebuild_keeps_library_state_rows(self):
        self._legacy_db(
            [
-                "INSERT INTO prompts (text, hash, workflow_name)"
-                " VALUES ('a', 'h1', 'wf')",
-                "CREATE TABLE prompt_library_state (prompt_id INTEGER PRIMARY KEY,"
-                " title TEXT, FOREIGN KEY(prompt_id) REFERENCES prompts(id)"
-                " ON DELETE CASCADE)",
+                (
+                    "INSERT INTO prompts (text, hash, workflow_name)"
+                    " VALUES ('a', 'h1', 'wf')"
+                ),
+                (
+                    "CREATE TABLE prompt_library_state (prompt_id INTEGER PRIMARY KEY,"
+                    " title TEXT, FOREIGN KEY(prompt_id) REFERENCES prompts(id)"
+                    " ON DELETE CASCADE)"
+                ),
                "INSERT INTO prompt_library_state VALUES (1, 'kept')",
            ]
        )
@@ -232,43 +242,59 @@ class TestIdempotentMigrations(MigrationTestCase):
        byte_id = "6a1b2c3d-4e5f-4a6b-8c9d-0e1f2a3b4c5d"
        self._legacy_db(
            [
-                "INSERT INTO prompts (text, hash, workflow_name)"
-                " VALUES ('a', 'h1', 'wf')",
-                "CREATE TABLE tags (id INTEGER PRIMARY KEY AUTOINCREMENT,"
-                " name TEXT NOT NULL UNIQUE)",
+                (
+                    "INSERT INTO prompts (text, hash, workflow_name)"
+                    " VALUES ('a', 'h1', 'wf')"
+                ),
+                (
+                    "CREATE TABLE tags (id INTEGER PRIMARY KEY AUTOINCREMENT,"
+                    " name TEXT NOT NULL UNIQUE)"
+                ),
                "INSERT INTO tags (id, name) VALUES (3, 'img-only')",
-                "CREATE TABLE media_annotation_metadata (singleton_id INTEGER"
-                " PRIMARY KEY CHECK(singleton_id=1), schema_version INTEGER NOT"
-                " NULL CHECK(schema_version=1), image_index_revision INTEGER NOT"
-                " NULL DEFAULT 0 CHECK(image_index_revision>=0))",
+                (
+                    "CREATE TABLE media_annotation_metadata (singleton_id INTEGER"
+                    " PRIMARY KEY CHECK(singleton_id=1), schema_version INTEGER NOT"
+                    " NULL CHECK(schema_version=1), image_index_revision INTEGER NOT"
+                    " NULL DEFAULT 0 CHECK(image_index_revision>=0))"
+                ),
                "INSERT INTO media_annotation_metadata VALUES (1, 1, 4)",
-                "CREATE TABLE media_annotation_files (id TEXT PRIMARY KEY"
-                " CHECK(length(id)=36), locator TEXT NOT NULL UNIQUE,"
-                " created_at TEXT NOT NULL)",
+                (
+                    "CREATE TABLE media_annotation_files (id TEXT PRIMARY KEY"
+                    " CHECK(length(id)=36), locator TEXT NOT NULL UNIQUE,"
+                    " created_at TEXT NOT NULL)"
+                ),
                f"INSERT INTO media_annotation_files VALUES ('{file_id}',"
                " '/out/a.png', '2026-10-22T00:00:00.000000+00:00')",
-                "CREATE TABLE media_annotation_bytes (id TEXT PRIMARY KEY"
-                " CHECK(length(id)=36), file_id TEXT NOT NULL REFERENCES"
-                " media_annotation_files(id) ON DELETE CASCADE, sha256 TEXT NOT"
-                " NULL CHECK(length(sha256)=64 AND sha256 NOT GLOB"
-                " '*[^0-9a-f]*'), size INTEGER NOT NULL CHECK(size>=0), mtime_ns"
-                " INTEGER NOT NULL, verified_at TEXT NOT NULL, first_seen_at TEXT"
-                " NOT NULL, tag_revision INTEGER NOT NULL DEFAULT 0"
-                " CHECK(tag_revision>=0), UNIQUE(file_id, sha256))",
-                "CREATE INDEX idx_media_annotation_bytes_fingerprint ON"
-                " media_annotation_bytes(file_id, size, mtime_ns)",
+                (
+                    "CREATE TABLE media_annotation_bytes (id TEXT PRIMARY KEY"
+                    " CHECK(length(id)=36), file_id TEXT NOT NULL REFERENCES"
+                    " media_annotation_files(id) ON DELETE CASCADE, sha256 TEXT NOT"
+                    " NULL CHECK(length(sha256)=64 AND sha256 NOT GLOB"
+                    " '*[^0-9a-f]*'), size INTEGER NOT NULL CHECK(size>=0), mtime_ns"
+                    " INTEGER NOT NULL, verified_at TEXT NOT NULL, first_seen_at TEXT"
+                    " NOT NULL, tag_revision INTEGER NOT NULL DEFAULT 0"
+                    " CHECK(tag_revision>=0), UNIQUE(file_id, sha256))"
+                ),
+                (
+                    "CREATE INDEX idx_media_annotation_bytes_fingerprint ON"
+                    " media_annotation_bytes(file_id, size, mtime_ns)"
+                ),
                f"INSERT INTO media_annotation_bytes VALUES ('{byte_id}',"
                f" '{file_id}', '{'a' * 64}', 3, 1700000000000000000,"
                " '2026-10-22T00:00:00.000000+00:00',"
                " '2026-10-22T00:00:00.000000+00:00', 2)",
-                "CREATE TABLE media_image_tags (byte_id TEXT NOT NULL REFERENCES"
-                " media_annotation_bytes(id) ON DELETE CASCADE, tag_id INTEGER"
-                " NOT NULL REFERENCES tags(id) ON DELETE CASCADE, position"
-                " INTEGER NOT NULL CHECK(position>=0), PRIMARY KEY(byte_id,"
-                " tag_id))",
+                (
+                    "CREATE TABLE media_image_tags (byte_id TEXT NOT NULL REFERENCES"
+                    " media_annotation_bytes(id) ON DELETE CASCADE, tag_id INTEGER"
+                    " NOT NULL REFERENCES tags(id) ON DELETE CASCADE, position"
+                    " INTEGER NOT NULL CHECK(position>=0), PRIMARY KEY(byte_id,"
+                    " tag_id))"
+                ),
                "CREATE INDEX idx_media_image_tags_tag ON media_image_tags(tag_id)",
-                "CREATE UNIQUE INDEX idx_media_image_tags_position ON"
-                " media_image_tags(byte_id, position)",
+                (
+                    "CREATE UNIQUE INDEX idx_media_image_tags_position ON"
+                    " media_image_tags(byte_id, position)"
+                ),
                f"INSERT INTO media_image_tags VALUES ('{byte_id}', 3, 0)",
            ]
        )
@@ -367,18 +393,28 @@ class TestIdempotentMigrations(MigrationTestCase):
    def test_image_table_is_rebuilt_with_uniqueness_by_full_path(self):
        self._legacy_db(
            [
-                "INSERT INTO prompts (text, hash, workflow_name)"
-                " VALUES ('a', 'h1', 'wf')",
+                (
+                    "INSERT INTO prompts (text, hash, workflow_name)"
+                    " VALUES ('a', 'h1', 'wf')"
+                ),
                # same basename in two folders: both must survive
-                "INSERT INTO generated_images (prompt_id, image_path, filename)"
-                " VALUES (1, '/out/2026-01-01/a.png', 'a.png')",
-                "INSERT INTO generated_images (prompt_id, image_path, filename)"
-                " VALUES (1, '/out/2026-01-02/a.png', 'a.png')",
+                (
+                    "INSERT INTO generated_images (prompt_id, image_path, filename)"
+                    " VALUES (1, '/out/2026-01-01/a.png', 'a.png')"
+                ),
+                (
+                    "INSERT INTO generated_images (prompt_id, image_path, filename)"
+                    " VALUES (1, '/out/2026-01-02/a.png', 'a.png')"
+                ),
                # two spellings of one file: only the newest row survives
-                "INSERT INTO generated_images (prompt_id, image_path, filename)"
-                " VALUES (1, '/out/x/../b.png', 'b.png')",
-                "INSERT INTO generated_images (prompt_id, image_path, filename)"
-                " VALUES (1, '/out/b.png', 'b.png')",
+                (
+                    "INSERT INTO generated_images (prompt_id, image_path, filename)"
+                    " VALUES (1, '/out/x/../b.png', 'b.png')"
+                ),
+                (
+                    "INSERT INTO generated_images (prompt_id, image_path, filename)"
+                    " VALUES (1, '/out/b.png', 'b.png')"
+                ),
            ]
        )

@@ -182,7 +182,7 @@ class TestAdminEndpointsUseConfigPath(unittest.TestCase):
                self.assertIsNone(warning)
                self.assertEqual(os.path.dirname(snapshot), folder)
                with open(snapshot, "rb") as handle:
-                    self.assertTrue(handle.read(16) == b"SQLite format 3\x00")
+                    self.assertEqual(handle.read(16), b"SQLite format 3\x00")
            finally:
                os.unlink(snapshot)
        finally:
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Vito Sansevero	38f5491da1	refactor(thumbnails): keep the after-scan queue's store rule and pin the write lock (#320 ) A planned target keeps the plan's own containment rule (inside the store, as the thumbnail job writes it); captures keep the serve rule. The structural test also covers PREVIEW_FOLDER joins and the repo-root modules; the write-lock test asserts the lock instead of waiting on a timer; new tests cover nested roots in the after-scan queue and a legacy upper-case preview served through the resolver.	2026-10-31 19:11:21 -07:00
Vito Sansevero	c0328e993a	refactor(thumbnails): one resolver for where previews live on disk (#320 ) Add py/api/preview_store.py: the store of a source, a preview's path, URL parts to disk, containment (owns), a write generation and the lock around every preview's final rename. Every preview reader, writer and remover now asks it instead of joining <source>/thumbnails by hand: serve, on-demand, capture (its path resolved when the write starts), the after-scan queue, the thumbnail plans and job payloads, clear, the temp sweep, History covers, the auto-tag listing and the owned-preview lookups. Source mode only: every path is the one built before, so nothing changes on disk or on the wire. A structural test keeps new thumbnails joins out of the backend.	2026-10-31 18:51:18 -07:00
Vito	8a81114dfc	perf(images): run image work on two own pools and trim after jobs (#523 ) (#582 ) * perf(images): read PNG text without decoding pixels (#523) Pillow's PngImageFile.text loads every pixel to reach text chunks written after IDAT. The scan's metadata batch and the image monitor now read PNG text through utils/png_text.py, which runs Pillow's own chunk handlers after the first IDAT and seeks over the pixel data. The legacy .text read is the floor: a differential test compares both readers on every fixture image, a curated corpus and a seeded fuzz. The only difference is a file whose pixel data is undecodable or cut short: it now keeps the text read before its pixels instead of reading nothing. Animated PNGs still use .text. * test(images): cover the text budget, XMP and layout guard of the PNG text walk (#523) * perf(images): run image work on two own pools and trim after jobs (#523) Image work no longer spreads over the default executor's threads, where glibc kept an image-sized malloc arena per thread. - Interactive image work (view previews behind their gate, workspace card facts, both inspector routes) runs on the API's fixed pm-image pool of 3 threads; the on-demand preview pool is merged into it. - map_parallel (scan metadata, thumbnail and convert jobs, the legacy gallery generation, capture previews) shares one long-lived pm-worker pool of Worker threads, reused between jobs. The package teardown stops it within its bound (part "workers"). - After a scan, thumbnail or convert job, glibc's malloc_trim(0) returns free pages once; a no-op on Windows, macOS and musl. - tools/perf/memory_drive.py measures RSS, heap, threads and arenas under the #523 load on the disposable browser test server (manual only). * fix(images): start no image thread after the teardown; join retired job pools (#523)	2026-11-01 01:24:27 +00:00
Vito	7a2a04b752	feat(send): send a prompt to all eligible nodes of a window (#542 ) (#578 ) * feat(send): send a prompt to all eligible nodes of a window (#542) The Destination node select offers "All N eligible nodes" when a window has two or more nodes that can receive the prompt. It is never selected for you. Apply previews every node first and writes nothing if one refuses; then it sends one node after another in node id order, each later node with a fresh ticket checked against the reviewed text, and reports "Sent to X of N" naming each refusal. A lost reply stops the run and names the node whose outcome is unknown. Recorded as D191. * fix(send): refresh held tickets and compare the reviewed composition for All (#542) A review held longer than the host's 30 s ticket lifetime would have refused the first node while sending the rest. Every node now takes a fresh ticket except the first of a pass taken in the same click, and that ticket must show the reviewed Before texts and composition. The revision is checked until something has been posted. Node review sections are labelled by their h4 heading.	2026-11-01 00:41:13 +00:00
Vito	cb94b12c1b	fix(system): keep a restore review's upload form alive until it is answered (#583 ) (#584 ) * fix(system): keep a restore review's upload form alive until it is answered (#583) WebKit can read a FormData's file part after fetch() returned, and with a request interceptor armed it does. uploadRestore held its FormData only in a local that was dead after the call, so a garbage collection in between dropped the form and the server got an empty file ("Uploaded file is empty"); the Restore preview never opened. The page now holds each upload's form until the upload is answered. * docs(system): say what the #583 regression spec proves in each browser (#583)	2026-11-01 00:41:12 +00:00
Vito	3cb90b0c1e	perf(images): read PNG text without decoding pixels (#523 ) (#577 ) * perf(images): read PNG text without decoding pixels (#523) Pillow's PngImageFile.text loads every pixel to reach text chunks written after IDAT. The scan's metadata batch and the image monitor now read PNG text through utils/png_text.py, which runs Pillow's own chunk handlers after the first IDAT and seeks over the pixel data. The legacy .text read is the floor: a differential test compares both readers on every fixture image, a curated corpus and a seeded fuzz. The only difference is a file whose pixel data is undecodable or cut short: it now keeps the text read before its pixels instead of reading nothing. Animated PNGs still use .text. * test(images): cover the text budget, XMP and layout guard of the PNG text walk (#523)	2026-11-01 00:04:27 +00:00
Vito	9a43b67008	test: reset a disposed fixture package's exit actions (#580 ) (#581 ) load_package imports the package under a test-only name; its exit actions stayed registered after cleanup_package removed it from sys.modules, so the suite ended with a ModuleNotFoundError from _kill_encoders_at_exit. cleanup_package now resets the package's exit signal.	2026-10-31 23:17:17 +00:00
Vito	c3c75c3369	fix(monitor): never store PromptSearchList search text as a prompt (#548 ) (#576 ) A PromptSearchList wired straight into CLIPTextEncode left the legacy-parser fallback tracing the positive to the node's search query ("fox"). Both the output scan and the live monitor stored that query as a prompt and linked every image of the batch to it. The fallback now leaves such files unlinked (the usual unresolved outcome) when its answer is the search text of a PromptSearchList upstream of a sampler's positive. An empty search text, and a search feeding only the negative, keep their previous outcome. The parity gate states f22 as a deliberate departure from the #170 parser, and the README says to wire the Search List through Prompt Manager Text to get the images linked.	2026-10-31 22:25:01 +00:00
Vito	93bf24f47d	fix(monitor): keep watchdog threads from holding the exit (#561 ) (#569 ) * fix(monitor): keep watchdog threads from holding the exit (#561) watchdog 7.0.0 on Windows starts a plain threading.Thread per watch for its ReadDirectoryChangesW reader (DirectoryChangeReader.start). Created from ComfyUI's main thread it is not a daemon, and the interpreter joins every non-daemon thread before it runs any atexit callback, so the package teardown that would stop the observer never ran and the process never exited. Start the observer from a short-lived daemon thread, so every thread it creates inherits the daemon flag. Run observer.stop(), which joins the emitters without a limit, on a daemon thread and wait for it only until the stop deadline; a later stop waits for the same call. Lift the watchdog<7 cap. Closes #561 * test(exit): exempt watchdog 7's process-wide inotify reader (#561) watchdog 7 on Linux reads every inotify watch through one InotifyFD daemon thread per process that no observer stop ends, by design. The exit and package tests counted every watchdog BaseThread as the package's, so the singleton failed them once the cap was lifted. Exclude it, and require instead that no non-daemon thread is left at exit.	2026-10-31 21:31:55 +00:00
Vito	e29c23de8d	chore(init): print a one-line startup banner (#574 ) Replace the version line, one Loaded line per node and the total with "[ComfyUI-PromptManager] Version: <v> - <n> tools loaded". Closes #573	2026-10-31 18:56:42 +00:00
Vito	b82e68a9d0	ci: stop testing macOS in CI (#572 ) macOS is not a popular ComfyUI platform. Drop the macOS legs from the portability workflow and its native-trash proof; Windows keeps its Python 3.12-3.14 legs. The macOS code stays, and README calls its support best-effort. Closes #571	2026-10-31 18:13:27 +00:00
Vito	fb02066cda	test(vocabulary): open the long-list check as a new page, not a reload (#567 ) (#570 ) Firefox restores the scroll position of a reloaded page's tag window, so its end scrolled into view and appended a second page before the 100-row check. Scrolling the window to its top before the reload did not always stick on CI. A fresh navigation has no position to restore.	2026-10-31 18:13:05 +00:00
Vito	ab17818792	fix(system): show the Images page count in System Overview (#568 ) System > Overview's Images metric read the overview's indexed generated_images rows, while the workspace Overview card and the Images sidebar badge show the Images page's own total, which also lists files no row links (110 against 122 on the demo library). The concept's System metric and sidebar badge are both `images.length`, so the metric now reads the shell's Images count: one source for all three, a dash until it is read or when its read failed, re-read on each visit. The Statistics dialog's "Library totals" were the legacy /stats raw row counts under the same nouns; they now read "Database records" with "Prompt records", "Tags on prompts" and "Image records". /stats and the legacy admin page are unchanged. Closes #555	2026-10-31 18:04:45 +00:00
Vito	ef97d01dbd	ci: run frontend coverage in four shards (#565 ) * ci: run frontend coverage in four shards Coverage shards reached their 18-minute step limit three times on 2026-10-31 with every test passing. Split the run into four shards with the limits unchanged; the merge job now expects four raw coverage artifacts, and the vendor checks move to shard 4. Closes #563 * test(tags): pin the 390px window check to the first page's last row Reaching the last row loads the next page (D183), and last() then followed row 200, far outside the window, so the WebKit check failed in 4-5 of 20 runs on 2 CPUs. Pinned to row 100, it passed 90 of 90 across WebKit, Chromium and Firefox. Closes #566	2026-10-31 16:47:50 +00:00
Vito	b7a43755ae	chore: release 3.4.1 (#564 ) Fixes the Windows exit hang with watchdog 7 (#562), stops LoRA scan errors from showing server details (#560), and carries the code-quality sweep (#558).	2026-10-31 15:38:28 +00:00
Vito	2c7e84dedd	fix(security): send a generic LoRA scan error to the browser (#560 ) An unexpected exception's text could reach the page in the LoRA scan's error frame, including a path or a model name. Those failures now send a fixed message and keep the detail in the server log. Expected refusals keep their wording, and an OSError still shows its reason and the file's basename. Refs #552	2026-10-31 13:59:29 +00:00
Vito	cc65d15d14	fix(deps): keep watchdog below 7 (#562 ) watchdog 7.0.0 (released 2026-10-31) makes the package's exit tests hang on Windows on Python 3.12 to 3.14; the same commit passed with 6.0.0. Cap it until observer.stop() is bounded at exit. Refs #561	2026-10-31 13:21:14 +00:00
Vito	d88cf9e7c6	fix(quality): sweep the Code Quality standard findings (#558 ) * fix(quality): preserve cursor iteration and option validation Keep prefetched rows on ManagedCursor so partial loops and explicit fetches share one position, and stop existing iterators after close or retirement. Preserve chunked reads and native SQLite result lifetime on reexecution and errors. Catch OptionError before ValueError so legacy auto-tag requests receive the actual validation error. Remove the overwritten ViewerJS title option. Regression tests failed before the fixes for lost rows, reads after close/retirement, and misleading option errors. Focused Python checks pass; cursor checks also pass on Python 3.13 and 3.14. Refs #321. * fix(quality): make the test doubles legal raises and hashes The fake queue no longer raises an attribute that starts as None. The oversized kind records hashes instead of raising from __hash__, which also catches a hash that production code swallows. Hostile.__bool__ raises the TypeError a truth test may raise. * fix(quality): drop the extra saveCoverage argument * refactor(quality): remove assignments that are overwritten before use * refactor(quality): remove the remaining overwritten test assignments * refactor(quality): drop imports repeated inside functions * refactor(quality): give duplicate identity keys one shape * refactor(quality): name the unused job event loop variable * refactor(quality): release model gates in finally, not except BaseException * refactor(quality): end the job runners with an explicit return * refactor(quality): use the precise unittest asserts * refactor(quality): import unittest.mock one way in the tests * fix(quality): say why each empty except is safe, log the broad ones * refactor(quality): stop binding values the tests never read * refactor(quality): remove the unused preview aliases and tag page query * refactor(quality): remove re-exports nothing imports * refactor(quality): parenthesize deliberate string joins in lists * refactor(quality): remove unused JavaScript variables and imports * refactor(quality): use the precise assert in the model status test	2026-10-31 05:43:48 +00:00
Vito	df70b5dfd6	docs: new README as the product page, and release bump to 3.4.0 (#545 ) * docs: new README as the product page, keep the old one as README-legacy Rename README.md to README-legacy.md with a short note saying what it is, and write a new README: hero, visual feature tour, all six nodes, then install, data locations, upgrade notes, legacy pages, limits and testing. Images are compressed WebP in assets/readme. Point the TESTING.md link at the section's new home. * docs: retake README screenshots, add shortcuts, pinned bar and trash limits * chore: release 3.4.0	2026-10-31 02:57:16 +00:00