Merge remote-tracking branch 'origin/main' into test/tagging-panel-settle

On a slow Windows runner the restore that the rotation test injects between
the writer's transactions outlived wait_for's 3 s worker deadline. The
subtest failed, and because every subtest shared the process-wide context
budget and left its writer running, the still-held restore cascaded: the
next subtest saw the in-flight 621-byte payload as charged, and the late
restore rotated the epoch under the last subtest's writer.

Each subtest now owns its writer and budget and closes them before the next
starts, and the handoff waits on an event set once the rotation returns,
with the existing BLOCK_SECONDS ceiling, before the short pending wait.
A new test holds a restore between transactions with events and proves the
payload is charged only while in flight, released afterwards, and that the
writer re-probes and accepts new evidence.

TESTING.md

@@ -292,8 +292,9 @@ The shared inline and collection inspector reads the current rooted file's suppo
 embedded records, exact generation facts and recorded or inferred prompt evidence.
 It renders in two concept surfaces (#249 D20–D22, D38). The Images side panel shows
 only the concept content: cover, title, filename, the evidence badge with a category
-chip, the + and − prompt blocks with copy and send, tag chips (the linked positive's
-own tags filter Images, D21), the six facts, and a footer with "Send to ComfyUI" and
+chip, the + and − prompt blocks with copy and send, tag chips (the file's own image
+tags first, D88, then the linked tags; image tags and the linked positive's own tags
+filter Images, D21), the six facts, and a footer with "Send to ComfyUI" and
 "Prompt history" only when prompt roles resolved or a link is saved; the sticky panel
 scrolls inside the window. The viewer's details (`#viewer-details`) repeat that
 content without the cover, then "File & provenance" (the honest file facts, the
@@ -397,6 +398,13 @@ naming it, here and in a detailer's image ancestry; a latent that is not a link
 reaches its own sampler is `malformed`; running out of budget is `work-limit` or
 `depth-limit`, never single stage. Each sampler's walk runs once per resolution;
 selector branch runs share it and other candidates are charged its visit cost.
+A UI workflow node whose `type` is a list or an object (read only for the overwritten
+PromptManager check) is skipped like a non-object node, since it can be neither a
+subgraph instance nor a PromptManager node, so a prompt that resolves still resolves
+and the other nodes still feed the check; a list or object `class_type` is never a
+preview output. Before #286 both raised and the inspect route answered 500
+(`test_unhashable_*` in `tests/test_api_prompt_inspector.py`, the `workflow-type-*`
+golden cases on both sides).
 Text encoders: `single` encoders (the Qwen image encoders, `TextEncodeQwenImage21`
 slot 0 `prompt` and slot 1 `negative_prompt`, `KikoTextEncode`) read one string
 input unchanged. `parts-equal` encoders (CLIPTextEncodeSDXL, Flux, SD3) resolve when
@@ -769,8 +777,12 @@ Recorded shell deviations:
   "Save", not "Apply in prototype", and its toast drops the demo's word "Sample".
 - **D31**: at `max-width: 950px` the overlay caps the one-column shell at
   `minmax(0, 1fr)`, so extreme zoom cannot widen it to the sidebar's min-content.
-- **#245 D2**: no "Auto-tag images" on the Tags heading until the image-annotation
-  slice.
+  On the Images cards (#249 C2) a card's info row stacks its text above Info and Tag
+  once the row is narrower than the narrowest bounded card (120px; a list row's info
+  is what its art leaves), and the two buttons wrap when even that row cannot hold
+  them (`stacksCardInfo`, `tests/js/workspace-image-layout.test.js`).
+- **#245 D2 (retired, #249 C2)**: the Tags heading shows the concept's "Auto-tag images";
+  it opens the Tag image dialog (D115 when nothing is selected).
 - **Brand name**: not a deviation. The brand link's accessible name matches the
   concept's, mark included, because production's `.brand-mark` is not `aria-hidden`
   either. The inventory compares `brand.name` and `brand.mark.hidden`.
@@ -793,13 +805,15 @@ zoom, the 2nd card opens the viewer titled "<title> · <filename>", Escape retur
 to it (production only: the concept re-renders its grid and drops focus), Info on the
 3rd card moves `.selected`, searches for "alpine" and for one image, and Load more with
 its toast. `mapImagesConcept` applies D3, D8 (the selection bar's real actions only),
-D9, D10, D14, D15, D17, D29, D32, D35 (singular counts) and D36 (categories
+D10, D14, D15, D17, D29, D32, D35 (singular counts) and D36 (categories
 sorted alphabetically). Removed toolbar and filter-row items flow again from the
 concept's own boxes (`reflow`), checked against the concept page with those items
 removed at runtime. Masonry tops and heights are compared unrounded, within one layout
 unit per card above in the column (D3). `one footer height for the collection (D3)`
-seeds two seedless files (`seedless_images` on `/__test__/concept/reset`) and asserts
-that every row reserves the tallest footer.
+seeds two seedless files (`seedless_images` on `/__test__/concept/reset`, with
+`short_seedless` so their "96 × 72 · PNG" subtitle stays on one line beside Info and
+Tag) and asserts that every row reserves the tallest footer and that their own footer
+is shorter than the row it reserves.
 
 ### Images page controls and recorded deviations (#249 PR C)
 
@@ -854,9 +868,10 @@ Recorded deviations on this page (spec §8):
 - **D7**: the star is a real persisted favorite with "Added to favorites." /
   "Removed from favorites." and a rollback toast on failure.
 - **D8**: every Images card has the concept's select checkbox before the star; the
-  `#bulkbar` shows "N selected" and only the real actions in the concept's order (Set
-  category, Export metadata, Clear). Add tags and Add to collection wait for image tags
-  and collections; "Remove links…" is dropped. The selection survives Load more and
+  `#bulkbar` shows "N selected" and only the real actions in the concept's order (Add
+  tags, then D85's Auto-tag selected, Set category, Export metadata, Clear). Add to
+  collection waits for collections; "Remove links…" is dropped. (Amended by #249 PR D:
+  Add tags ships, see "Bulk tagging from the selection bar".) The selection survives Load more and
   bounded re-mounting and is cleared whenever the collection is replaced (search,
   category, sort, Filters, source change, rescan, reload). A return to Images restores
   the saved collection unreplaced and keeps its selection; a full page reload starts
@@ -885,7 +900,9 @@ Recorded deviations on this page (spec §8):
   the concept` compares the bar and the checked card with one card checked; the omitted
   actions flow again from the concept's own boxes, checked against the concept page with
   them removed at runtime.
-- **D9**: no Tag button until the image-annotations slice.
+- **D9 (retired, #249 C2)**: every card shows the concept's Tag (`tagImage`, "Tag or
+  auto-tag <filename>") after Info; it opens the Tag image dialog without selecting
+  the card (see "Tag image dialog" below).
 - **D10**: the card title is the linked positive's display title, else the filename;
   the `h3` keeps the relative path in `title`.
 - **D11**: the subtitle is "W × H · EXT · Seed N" with unknown parts omitted.
@@ -943,6 +960,8 @@ Recorded deviations on this page (spec §8):
   history appear only with resolved prompt roles or a saved link; a video file keeps
   `video.detail-cover`; and only the linked positive's own tags are `button.chip`
   filters, while recipe, recorded-run and embedded tags stay plain `span.chip`.
+  Amended by D88 (#249 PR C): the file's own current image tags lead the same row
+  and are filters too; a linked tag already shown (case-insensitive) is left out.
 - **D22**: an empty positive reads "No positive prompt (explicitly empty)" (the concept
   applies its negative wording to both roles), and a confirmed `p.prompt-text` is
   focusable (`tabindex=0`, marked focus ring) so long prompts stay keyboard-readable.
@@ -1049,6 +1068,322 @@ npm run --prefix tools/vendor test:workflows -- images-concept.spec.mjs \
   --project chromium --project touch --project firefox --project webkit
 ```
 
+### Tag image dialog and recorded deviations (#249 PR C)
+
+Every Images card and every Library-embedded gallery card shows Info then the
+concept's Tag (`app.js` mediaCard). Tag opens the concept's **Tag image** dialog
+(`web/js/workspace/image-tagging.mjs` over the C1 controller
+`image-tagging-state.mjs`) in the shared modal shell with the concept's
+`tagging-modal` class, so its `.dialog-actions` stay sticky while the content
+scrolls. Focus starts on × and returns to the Tag button. The preview is the
+capture's own `preview_url` (through `ApiClient.resolveUrl`): an `img`, or a
+`video preload="metadata" muted`. The capture is released on ×, Escape, Cancel,
+Save, a route change (the shell closes its dialog) and `pagehide`, which closes the
+dialog (a page restored from the back/forward cache shows no dead dialog); the
+release `DELETE` and the Save `PUT` are sent with `keepalive` (`ApiClient`'s
+additive option), so they finish while the page unloads. A save still in flight
+when the dialog closes keeps its capture until the `PUT` settles, then releases it
+and still reports the outcome: the saved toast and every page's refresh, or the
+failure as a toast. Generate is explicit and uses the server's real defaults
+(`GET /prompt_manager/autotag/models`), and the fields show exactly those values
+(they are re-rendered when the observation lands and on a model change, never while
+typing); an invalid field reports native validity and sends nothing. A tag conflict
+shows the current set at once: the status line appends "Saved now: <tags>." and the
+manual field holds the current set ahead of the draft (repeats dropped), so the next
+Save sends what is shown against the current revision. Save writes the manual
+names, then the remaining chips, deduplicated case-insensitively (first spelling
+wins), and toasts the mock's copy verbatim, "<n> tags saved for <filename>." even
+for one tag, plus " Prompt association still awaits review." from Needs review.
+Tagging one file never changes another file (an equal-byte copy included), a
+prompt, a pair or a link. States the mock lacks (generating, busy, conflict,
+changed storage or file, expired capture, unconfirmed save, unavailable model,
+video) are text in `#tag-generation-status` only; **Retry** (D116) leads the
+actions while the controller allows it, where the other workspace dialogs place
+their Retry. The Tags
+page re-reads its lists after every confirmed save, so the Images counts follow.
+
+The image-tagging plan's deviation numbers were renumbered by +23 because the
+Inspect plan keeps D60–D66 (plan D60 → D83, D61 → D84, D65 → D88, D68 → D91).
+
+- **D83** (plan D60, ruling T4): the suggestions are removable chips instead of
+  checkbox rows: `span.chip.tag-suggestion` in a `.tags` row, in the concept's
+  checked-row tokens (accent border, `--soft-blue`), each with the name, the
+  confidence (`98%` for WD14, "Suggested" for language models) and a × "Remove
+  <tag>". A chip has the concept `.chip`'s 4px corner (the later `.tag-suggestion`
+  row rule would give 5px) around the row's own 12px text. At most the requested
+  count, all preselected. While chips exist, ruling T4's "Remove anything you do not
+  want to add." (`p.small`) leads them inside `#tag-suggestions`; removing the last
+  chip shows "All suggestions removed. Generate again or enter tags manually." The
+  opening sentence is the concept's on-screen copy, "Generate suggestions with the
+  selected model before approving.": the concept's markup carries another ("Choose a
+  model… Uncheck anything…"), but its `renderTagModelOptions` (a1062–1076) replaces it
+  as soon as the dialog opens, so the opened state is compared unmapped.
+- **D84** (plan D61, rulings T1/T2): the Tagging model options are legacy's four
+  engines in the mock's order with legacy labels and sizes (`WD14 SwinV2 · ~400
+  MB`, `WD14 ViT · ~400 MB`, `GGUF JoyCaption (Recommended) · ~4.5 GB` in the
+  mock's Ollama slot, `HuggingFace JoyCaption · ~16 GB`); the instructions start
+  from the server's `default_prompt`.
+- **D91** (plan D68, ruling T3-bulk): a **Suggestions** number field (1–100) for
+  every model, prefilled from `autotag.defaults.suggestion_limit` (10); a model
+  change keeps it.
+- **D88** (plan D65, ruling T7/C2): the inspector's chip row (side panel and viewer
+  details, after the prompt blocks) shows the file's current image tags first (the
+  B3 envelope's `image_tags`, `state: "current"`, S1), then D21's linked tags not
+  already shown (case-insensitive, the image tag's spelling wins). In the Images
+  panel every image tag is a Tags filter `button.chip` (the filter matches image
+  tags too) and linked tags keep D21's rule; in the viewer, and wherever no Tags
+  filter exists (the Library-embedded gallery, Activity and recorded runs), every
+  chip is a plain `span.chip`. `none` and `unavailable` add no chips and no other
+  chrome; a malformed facet fails the inspection like any malformed field. The
+  concept has one row of the image's own tags (`i.tags`, app.js a402), so with the
+  concept image's tags saved as its image tags production still equals the concept.
+  After a Tag save the selected file's inspection is re-read, so the panel redraws
+  the row without reselecting and the viewer, which shares that inspection, shows it.
+- **D115** (beyond the plan's list): the concept always has a selected image, so
+  its "Auto-tag images" always opens the dialog. Production opens it for the image
+  selected in Images when it was last left; with none it is `aria-disabled` and
+  pressing it toasts "Select an image in Images first." (no new chrome).
+- **D116** (ruling T5): **Retry** leads `.dialog-actions` (before Cancel and the
+  primary) while a failed observation, a failed Generate, an unconfirmed save or an
+  answer that needs a fresh observation (changed storage or file, expired capture)
+  can be retried; the concept has no failure states, so it has no Retry. After a
+  failed Generate it takes Generate's own path (an invalid field reports its
+  validity); an unconfirmed save resends the identical body; after a changed storage,
+  file or expired capture it observes again and keeps the typed draft (when the saved
+  set changed meanwhile, the current set leads the draft and the status line says
+  "The tags of this image changed since the dialog opened. Saved now: <tags>.").
+  Browser tests: "D116: Retry leads the actions after an unconfirmed save…", "D116:
+  Retry after an expired capture observes again and keeps the typed draft (M5)" and
+  the paired `production-unknown-outcome` capture.
+- **D29** (no prototype copy) in the dialog: no "Prototype · suggestions are
+  simulated…" note, the status reads "Suggestions from <model>. Approve tags to save."
+  (not "Sample suggestions from …"), and the toast has no " in this tab".
+
+After a confirmed save the selected file's inspection is re-read quietly: the panel
+and the viewer keep the current details until the new answer lands, with no "Loading
+file details…" in between (`createInspectionController().refresh()`). While a Tags
+filter or a search is active the saved file may start or stop matching, so Images
+re-reads its loaded range in place (`createImageStream().refresh()`: the same query
+from the first page until the loaded count, published once). The cards, the scroll
+position and the selection stay while the selected file still matches; when it no
+longer does, the panel follows the collection (its first file), as after a reload,
+and the selection bar keeps only the checked files still listed, so its count is what
+Set category and Export metadata apply to. A refresh never runs beside a page load
+already in flight: asked during one, it is pending and runs once that page settles
+(success or failure; a reset drops it), and Load more waits for a running refresh
+(it neither loads nor moves focus). The re-read asks for pages as large as the rest of
+the loaded range (at most 200 files, at least one batch), one after another (each
+cursor comes from the page before); a failed re-read toasts "Images could not be
+refreshed after the tag save. Refresh image collection to retry." and keeps the
+cards. A save made while Images is left (Tags › Auto-tag images) marks a saved Images
+visit with a Tags filter or a search stale: returning lists it again with its
+filters instead of restoring the old cards. Browser tests: "the post-save re-read
+keeps the panel content until the new read lands", "a save under a Tags filter
+re-reads the listing: …", "a save under a search keeps the scroll position and the
+loaded range", "a failed listing re-read after a save says so and keeps the cards
+(M2)" and "a tag save from Tags reloads a filtered Images visit instead of restoring
+it (M6)"; the pending refresh and the page sizes are unit-tested.
+
+Concept comparison (`tests/browser/tagging-concept.spec.mjs` with
+`tagging-canonical-comparison.mjs`, plan Task C4): production runs on the concept
+fixture with the concept image's own tags (`cinematic, blue_hour, architecture`)
+saved as its image tags, and the fake model answers the concept's own sample
+(`/__test__/tagging/suggestions`: mountain 0.98, observatory 0.95, snow 0.88,
+blue_hour 0.81), so the dialog's inventory (order, text, field attributes, tokens,
+preview box, chips, status, sticky actions) must equal the concept's at 1600×1100 and
+390×844, dark and light: opened, generated with WD14 and generated with a language
+model, plus the empty result (the concept above its own threshold), the review-scoped
+dialog with its scope note and the card's Info and Tag group (M1). `mapConceptTagging`
+applies only D29, D83, D84 and D91; a mutation check (the model panel's border
+removed, the primary relabelled) shows the comparison notices a change. Every
+production-versus-concept difference of PR C and its record:
+
+| Difference | Record |
+| --- | --- |
+| Removable chips with × instead of checked checkbox rows; "Remove anything…" while chips exist; the all-removed copy | D83 (ruling T4) |
+| Legacy engine labels and values, GGUF in the Ollama slot, server default instructions | D84 (rulings T1/T2) |
+| Suggestions count field | D91 (ruling T3-bulk) |
+| No prototype note, "Suggestions from …", no " in this tab" | D29 |
+| Image tags first in the inspector and viewer chip row | D88 (ruling T7/C2) |
+| Auto-tag images `aria-disabled` without a selected image | D115 |
+| Retry leads the actions when the controller allows it | D116 (ruling T5) |
+| States the concept lacks (busy, conflict, changed storage or file, unconfirmed save, unavailable model, video) | Global Constraints: `#tag-generation-status` text only |
+
+### Bulk tagging from the selection bar (#249 PR D)
+
+The Images selection bar shows the concept's **Add tags** after the count, then
+**Auto-tag selected** (D85), before Set category. Both take the checked files when
+pressed, in listing order, as their reveal identity (`{root_index, root_scope, path}`);
+more than 500 toasts "Select at most 500 images." and opens nothing. The selection
+stays after every start, refusal and review. The job's start body is bounded so 500
+targets of the longest legal path (1024 code points, even escaped as `\uXXXX`) fit:
+`500 × (1024 × 6 + 256) + 64 KiB`; a larger body answers 413
+(`tests/test_image_tag_jobs.py` "test_start_body_bounds").
+
+- **Add tags** opens the concept's `simpleInput` (app.js a1378–1383) as Set category
+  does: "Tag selected images", "Tags, separated by commas" (empty: the concept's
+  "cinematic, concept" is sample text), Cancel / Apply. The names are parsed as the Tag
+  image dialog's manual field parses them (trimmed, case-insensitive repeats dropped,
+  first spelling wins); a field that parses to no names keeps the dialog open with the
+  typed text and reports "Enter at least one tag." on the field (its native validity,
+  cleared on the next edit), and nothing is sent. Apply starts the
+  `image-tags` job (`POST /prompt_manager/jobs/image-tags`, `{mode: "add", targets,
+  tags}`) and toasts "Tagging started."; Activity shows its progress.
+- A refused start toasts why and changes nothing: another record-changing job (a scan)
+  gives "Another job is running: <title>." with a link to it (D57's toast), a held model
+  gives the server's `model-busy` sentence, any other coded refusal its own sentence,
+  and anything else "Tagging could not start. Try again." / "Auto-tagging could not
+  start. Try again.".
+- When a job this page started ends having tagged files, those files are read again
+  once: the selected file's inspection (its chips, D88) and, under a Tags filter or a
+  search, the loaded range, as after a Tag save.
+
+- **D85** (plan D62, ruling L1, beyond the concept): **Auto-tag selected** opens
+  "Auto-tag selected images" in the Tag image dialog's shell (`tagging-modal`) with
+  its model panel, headed "Auto-tag <N> image(s)" (the panel's "Auto-tag this image"
+  for N files), without the preview, the manual field, the suggestions or Generate.
+  Its fields show the server's defaults (`GET /prompt_manager/autotag/models`, the
+  D91 Suggestions count included) once that read lands; Start waits for it. A model
+  the status lists as not downloaded keeps Start `aria-disabled` and
+  `#tag-generation-status` says "<model> is not downloaded. Download it from the
+  legacy Auto-tag page." (the server's own sentence), so no job starts only to fail.
+  Start validates the fields as Generate does (native validity; nothing is sent).
+  The concept comparison (`images-concept.spec.mjs`) uses the concept page itself as
+  the oracle, with Add to collection and Remove links… removed and a copy of its Add
+  tags button reading "Auto-tag selected" inserted after it.
+- **D90** (plan D67, ruling T3-bulk): the dialog's **How to apply** radio group
+  (`.field[role=radiogroup]`, radios beside their labels): **Apply automatically**
+  (checked; primary "Start auto-tagging") starts the `image-tags` job
+  (`{mode: "auto", targets, model_type, options}`) and toasts "Auto-tagging started.";
+  **Review each image** (primary "Start review") walks the selection in the browser
+  (`images-tagging-review.mjs`). Each image opens the Tag image dialog titled "Tag
+  image · Image <i> of <M>" on the chosen model and options with Generate already
+  running; its actions are Stop reviewing, Skip and Approve and next (Approve and
+  finish on the last). Approve saves the manual field plus the remaining chips as Save
+  does, without its per-image toast, and opens the next image; Skip writes nothing and
+  advances; Stop reviewing, Escape and × end the session. While Approve's save is in
+  flight, Skip and Stop reviewing are `aria-disabled` and Escape and × do nothing, so the
+  closing count includes that save. When no suggestions are on screen (a model change
+  cleared them, or Generate was refused) the primary saves the manual field only and
+  reads "Save and next" ("Save and finish" on the last image). Each image is one gated
+  `suggest` call, so the session holds no model between images; a `model-busy` answer
+  stays on that image with its sentence in `#tag-generation-status` and D116's Retry
+  until the user retries or skips. Ending toasts "<n> of <M> images tagged." and
+  returns focus to Auto-tag selected.
+- **D91** extends to the bulk dialog: its Suggestions field is the job's and the
+  review's `suggestion_limit`.
+- **D118** (copy the concept has no line for; the concept's `bulk-apply` only toasts a
+  demo sentence): an Add tags field that parses to no names reports "Enter at least one
+  tag." on the field; a start refused for no coded reason toasts "Tagging could not start. Try
+  again." or "Auto-tagging could not start. Try again." (as D55's "The scan could not
+  start. Try again."); and the bulk dialog's model panel is headed "Auto-tag <N>
+  image(s)" where the Tag image dialog's reads "Auto-tag this image". Everything else
+  the selection bar's tagging shows is the concept's or the plan's (D85, D90, D91).
+- **D89** (plan D66, Activity for the `image-tags` job): the job's Activity item and its
+  view are the scan's (D54, D56, D57, D59) with the job kind's own counters, from one
+  per-kind table (`JOB_VIEWS` in `activity-store.mjs`; a kind without one keeps the
+  scan's tiles under "Job log" and "Cancel job"). The titles are the server's: "Add
+  tags to images" and "Auto-tag images".
+  - The pill's verb is "Tagging" ("Tagging · 41% · 8,240 / 19,622").
+  - The item line and the view's heading line read "Started HH:MM · N images · closing
+    this view does not cancel it" (the job's image count, grouped "en-US"), "Finished
+    HH:MM · N tagged · M errors", "Cancelled HH:MM at a file boundary · N tagged ·
+    completed work is kept" or "Stopped on an error at HH:MM · N tagged · M errors".
+  - The view's actions are Download report and, while running, "Cancel tagging"
+    (`.danger`); the progress bar is "<title> progress".
+  - Four `dl.stat-row` tiles in the mockup's tones: Tagged (`.added`, green),
+    Unchanged, Skipped (`.warn`, warning), Errors (`.bad`, red). They keep the
+    mockup's five-column row (two columns on a phone), so a tile is the scan's width
+    and the fifth cell stays empty.
+  - The outcome list reads Tagged, Errors, Skipped, Unchanged (what got tagged and what
+    went wrong first, as the scan's), and the view opens on the first with files.
+  - Rows under Tagged and Unchanged are D57's `button.file-row`s that open the file in
+    the viewer by its listing identity; Skipped and Errors rows are plain text.
+  - The log is "● Tagging log — raw detail, click to show".
+  - The row and log wording is the job's (D1), since neither the concept nor the
+    mockup has a line for it: "Added N tag(s)", "No new tags", and the skip reasons
+    "Video: manual tags only", "Too large to verify", "File changed", "File not found",
+    "Not a supported still image" and "The file could not be read now. Run the job again
+    for it." (the capture store stayed at capacity, for example with Tag dialogs open in
+    other tabs, after a short backoff of retries). Log prefixes are `+` tagged, `=`
+    unchanged, `-` skipped and `!` error.
+  - The progress line is the scan's: "Processing file N of M · about X min left", the
+    estimate (D56's `_time_left`) shown once two files are done, each file one batch.
+  - Download report saves `prompt-manager-image-tags-<YYYYMMDD-HHMM>.json`.
+  - The start toasts are "Tagging started." / "Auto-tagging started." (D85); the end
+    toasts follow the design's pattern with the job's counts, as the scan's: "<title>
+    finished · N tagged · M errors", "<title> cancelled · N tagged" or "<title> failed ·
+    N tagged · M errors".
+  - Tests: `tests/js/workspace-activity-store.test.js` ("image-tags jobs get their own
+    tiles outcomes and pill verb", "unknown kinds keep the generic view");
+    `tests/browser/workspace-activity.spec.mjs` ("an image tagging job shows Tagged
+    Unchanged Skipped Errors and opens tagged rows", "cancel tagging stops at a file
+    boundary", "the report download names the kind", on fake `image-tags` jobs from
+    `workspace_activity_fixture.py`); `tests/browser/activity-concept.spec.mjs` ("image
+    tagging job view follows the approved mockup", dark and light, with a mutation
+    check). The scan's view is unchanged.
+
+Browser tests (`tests/browser/workspace-tagging-bulk.spec.mjs`, on the tagging
+fixture): "selection bar shows Add tags then Auto-tag selected before Set category",
+"Add tags runs a job and the cards show the tags after it finishes", "Auto-tag
+selected with Apply automatically runs a job with the chosen model, thresholds and
+suggestion count", "a model that is not downloaded keeps Start disabled and says
+why", "Suggestions field prefills from the setting and caps chips at the entered
+count", "Review each image walks the selection one dialog at a time and only approved
+images gain tags", "Review holds Stop reviewing, Escape and × while a save is in
+flight, and names a manual-only save" and "a running scan makes the start report
+busy". Units:
+`tests/js/workspace-images-tagging-bulk.test.js`,
+`tests/js/workspace-images-tagging-review.test.js`.
+
+| Difference | Record |
+| --- | --- |
+| Add tags ships (Add to collection and Remove links… still omitted) | D8 (amended) |
+| Auto-tag selected and its dialog | D85 (ruling L1) |
+| How to apply and the Review each image session | D90 (ruling T3-bulk) |
+| Suggestions count in the bulk dialog | D91 |
+| Copy without a concept line: no tags, start fallbacks, the panel heading | D118 |
+| Activity item and job view for image tagging jobs | D89 (plan D66) |
+
+Native image tagging (#249 PR B routes, PR C UI): `POST
+/prompt_manager/image-annotations/observe` (capture one listed file, its saved set and
+`tag_revision`), `GET`/`DELETE /prompt_manager/image-annotations/capture/<token>`
+(the preview and its release), `POST /prompt_manager/image-annotations/suggest` (the
+gated top-N suggestions, at most the requested count) and `PUT
+/prompt_manager/image-annotations/tags` (re-hash, then save one byte record's set).
+Cheap reads follow spec amendment S1 (the verified `(size, mtime_ns)` fingerprint;
+residual risk above, under "Image annotations schema"). No automated test downloads
+or loads a model: the browser server injects `TestModel`, whose `download_model`
+raises, and every tagging spec asserts no `/autotag/download/` request. Capture
+limits are those of the capture store above (256 MiB per file, 8 completed captures,
+512 MiB reserved, 900 s idle, 1800 s hard). The browser fixtures release every capture
+on reset. PR C is HTML, CSS and JS only (no restart); the PR B routes it calls need a
+maintainer ComfyUI restart once.
+
+Test files: `tests/browser/workspace-tagging.spec.mjs` (the fixture is
+`tests/browser/workspace_tagging_fixture.py`: two files sharing one prompt and
+pair, an equal-byte copy, a video, an unlinked file, the fake model with `hf`, and
+no model files; every test asserts no download request),
+`tests/js/workspace-image-tagging.test.js`,
+`tests/js/workspace-image-tagging-state.test.js`,
+`tests/js/workspace-images-lifecycle.test.js`, and for D88
+`tests/js/workspace-file-inspector.test.js`,
+`tests/js/workspace-inspection-state.test.js` and `tests/browser/inspector-concept.spec.mjs`
+("image tags saved on the concept image keep the inspector equal to the concept"), and
+for the comparison `tests/browser/tagging-concept.spec.mjs` and
+`tests/js/workspace-images-state.test.js` (the in-place refresh), and on all four
+projects `tests/browser/workspace-tagging-lifecycle.spec.mjs` (leaving the page with
+the dialog open releases the capture with no console error; closing during a save
+releases it after the save and still reports it).
+
+```sh
+node --test tests/js/workspace-image-tagging*.test.js tests/js/workspace-images-lifecycle.test.js
+npm run --prefix tools/vendor test:workflows -- workspace-tagging.spec.mjs tagging-concept.spec.mjs \
+  workspace-vocabulary.spec.mjs images-concept.spec.mjs --project chromium --project touch
+npm run --prefix tools/vendor test:workflows -- workspace-tagging-lifecycle.spec.mjs tagging-concept.spec.mjs \
+  --project firefox --project webkit
+```
+
 ### Prompt library cards and recorded deviations (#249 PR E)
 
 The shelf uses the shared concept toolbar and caption (E1) and the concept's
@@ -1240,6 +1575,227 @@ npm run --prefix tools/vendor test:workflows -- history-concept.spec.mjs \
   workspace-history.spec.mjs --project chromium --project touch --project firefox --project webkit
 ```
 
+### Inspect a file page and recorded deviations (#249 local Inspect, PR L2)
+
+`#/inspect` ("Inspect a file") is a native workspace route; it no longer hands off to
+the legacy metadata page, which stays reachable from Overview's "Open existing metadata
+inspector" card (`/prompt_manager/gallery.html`). The page is the concept's `#metadata`
+(app.js `renderMetadata` a740–748, selection a1715–1729; style.css 709–722, 1180–1194,
+1543–1545, 1559–1564) in the concept's own classes (`.surface`, `.file-drop`,
+`.spaced-20`, `.local-file-preview`, all from the synced `concept.css`), with no
+`workspace.css` override. One local image (PNG/JPEG/WebP) or video (MP4/MOV/M4V/WebM/MKV;
+AVI/WMV preview only), chosen or dropped, previews inline. The heading's one action opens
+the shared viewer with the full inspector on a record read entirely in this browser
+(`web/js/workspace/inspect.mjs`, `local-session.mjs`, `local-inspection.mjs` and the L1
+readers `png-metadata.js`, `local-video.mjs`, `local-projection.mjs`). Nothing is
+uploaded, imported or stored. PRs L1 and L2 change only HTML and JS, so they need no
+ComfyUI restart; PR L3 does (below).
+
+Local roles (#249 PR L3, decision LI-1): the prompts and resolution of a local record are
+the server inspector's for the same records. `web/js/workspace/local-resolver.mjs` (with
+`local-resolver-support.mjs`, `local-resolver-stages.mjs`, `local-parameters.mjs` and
+`py-json.mjs`) ports `inspect_prompt_evidence` with `INSPECTION_PROFILE`: execution
+evidence, graph tracing, every bound, several sampler candidates with the
+identical-branch rule (#270), preview-only stages, detailer stages (multistage) and A1111
+`parameters`. It reads the server's own node table, `web/js/inspection-semantics.json`,
+which the page fetches once through the API client as it mounts, before any selection
+(`local-semantics.mjs`; `/prompt_manager/js/inspection-semantics.json` is the one JSON
+file the static route serves, by exact path). A table that cannot be fetched answers
+"The inspector's node table is unavailable." as the server does. The legacy fill in
+`projectInspectionPayload` then applies to a local record exactly where it applies to the
+Images answer for the same bytes. Python is the oracle:
+`tests/test_local_inspect_parity.py` `LocalResolverParityTests` compares the local
+evidence byte for byte with `inspect_prompt_evidence` for every parity PNG and inspection
+vector (prompts, resolution and facts), the golden and selection record sets
+(`tests/local_resolver_cases.py`, `tests/local_resolver_selection_cases.py`), every work
+bound and 1,200 seeded fuzz cases; `tests/fixtures/local-inspect/resolver-vectors.json`
+holds the committed answers the Node unit test reads. The browser spec `chooser shows the
+Images roles and resolution for every parity PNG` compares the rail with Images for all
+25 committed parity PNGs. The static route change and the resolver fixes (Python) need a
+ComfyUI restart.
+
+Main thread (M4): the resolver runs on the page's thread, not a worker. On a desktop
+(Node 26) `resolveLocalEvidence` on maximal 2 MiB graphs (a 19,990-sampler chain, 6,600
+independent samplers, a consumer-dense scan, a 100,000-node PromptManager workflow) took
+130–455 ms; the server took 80–905 ms on the same inputs. `localFileAdapter.read` runs in
+bounded steps (read, table, parse and resolve, project, fit) with a turn of the event
+loop between them, every wait ends with the selection's signal (a stalled table request
+included), and the inspector carries `aria-busy="true"` with "Loading file details…"
+until the answer lands. `tests/js/workspace-local-inspection.test.js` pins a 2,500 ms
+budget per step on maximal independent-sampler and stage-chain graphs, checks that the
+stepped read answers byte for byte as one synchronous build, and that an abort at any
+step ends the read.
+
+Bounds (the server's own budgets, ported by PR L1; see "Follow-up: local Inspect parity"
+under "Chronological Library history" for the known divergences):
+- PNG: at most 10,000 chunks; keyword 1–79 bytes; every chunk range checked against the
+  File's size before slicing. Role records (`prompt`, `parameters`,
+  `comfyassets_prompt_pairs`) share 2 MiB encoded and 2 MiB decoded (over that, the read
+  fails); a workflow over 4 MiB is `limited`; duplicates are capped at 8 MiB (workflow)
+  and 4 MiB (roles, decoded `parameters`). The sum of slices read from any PNG, however
+  large or sparse, is at most 19,794,389 bytes.
+- Video: the same record rule over the container's tags (per-key carrier first, then the
+  `comment` envelope, then `description`); at most 10,000 boxes or elements; no slice
+  inside `mdat` or a Cluster beyond its header.
+- JPEG/WebP: at most 64 KiB, for dimensions only.
+- Response: 8 MiB of actual UTF-8 JSON; omission order workflow graph, prompt graph, all
+  raw. The whole File is never read with `arrayBuffer()`, `text()` or `stream()`.
+
+Privacy, asserted by `local inspection makes no content request or storage write` and
+`local roles send exactly` in `tests/browser/workspace-inspect.spec.mjs`, and by the
+managed-host spec below: the only static file Inspect reads is its node table, once per
+page and before any selection; no request carries the file's bytes, name or text (fetch, XHR,
+beacon, WebSocket, EventSource); Inspect writes nothing to `localStorage`,
+`sessionStorage` or IndexedDB; only an explicit Send crosses the host bridge, and its
+payload carries neither the `blob:` URL nor the filename; no console message names the
+file or quotes its prompts (asserted on the managed host). The selection's `blob:` URL belongs to one local session and is revoked once,
+on replacement, route change, unmount or `pagehide`, never while an element in the page holds it: the inline preview
+and, when it is open, the viewer drop their media first. The page, not the session, owns `pagehide`: it closes the
+viewer, releases the inline media, then ends the selection and clears the chooser, so a page restored from the
+back-forward cache shows an empty chooser beside the empty selection (`URLs and media end with their owning
+session`, which also leaves with the viewer open).
+
+Recorded deviations on this page (maintainer rulings LI-3, LI-6; plan "Mock inventory and
+mapped differences"):
+- **D60** (heading action, LI-3): "Open file metadata" (`ca-primary`) replaces the
+  concept's "Open sample metadata". It is `aria-disabled="true"` and
+  `aria-describedby="local-file-note"` (the drop note) until a classified selection is
+  ready, then opens the shared viewer on that file.
+- **D61** (copy, LI-3): the surface `p` reads "Read embedded metadata in this browser.
+  The file is not uploaded or added to your library."; the drop note "Your file stays in
+  this browser. Its metadata opens with “Open file metadata”."; the chooser label "Choose
+  an image or video for a local preview"; the toast "Local preview only. No file
+  uploaded; metadata is available above.". The h2 "Inspect without importing" is the
+  concept's, verbatim.
+- **D62** (accept and video): `accept` is the concept's
+  `image/png,image/jpeg,image/webp` plus `video/*,.mp4,.mov,.m4v,.webm,.mkv,.avi,.wmv`. A
+  video previews in the same `#local-preview` slot as `video.local-file-preview` with
+  native `controls`, `playsInline`, `preload="metadata"` and `muted`, never autoplays
+  inline. On replacement or dispose it is paused, has its `src` removed, is reset with
+  `load()` (which frees its decoder) and is removed from the page, before its URL is
+  revoked. Each preview owns its listeners, so the page never pins a released node.
+  A video replaced while still starting (a source, but neither metadata nor an error yet)
+  stays where it is, inert and `aria-hidden`, with the new preview inserted after it, and
+  the session's revoke of its URL waits; once it reports metadata or an error (or after
+  15 s) it is released as above and only then is its URL revoked. Page leave and dispose
+  release it at once. Cause, found with native stacks of the hung WPE web process in the
+  pinned image: WebKit (GStreamer) deadlocks when a video leaves the page or the viewport
+  before its pipeline has started. The main thread changes the pipeline state and waits
+  for the source's streaming thread, which is itself waiting on the main thread in a
+  synchronous bus handler. Removing the video, hiding it, or only pushing it below the
+  fold with a taller preview inserted before it all hung (7 to 21 of 120 fresh pages each,
+  replaced at `loadstart` + 0–7 ms), and none of the earlier steps (`pause()`, removing
+  `src`, `load()`, revoking the URL) was the cause on its own; pushing it out after
+  `loadedmetadata` hung 0 of 180. Specs: `replacing a video that just started loading
+  never blocks the page`, and `a video replaced while still starting is reset once it
+  settles`, which now runs on WebKit too (15 fresh pages, replaced at `loadstart` + 0–4
+  ms). The viewer's own video teardown was checked the same way (`closing the viewer on a
+  video that just started never blocks the page`, 15 fresh pages on WebKit) and needed no
+  change.
+- **D63** (status line): one `p.small.spaced-16` in `#local-preview`, for states the
+  concept never shows: "Drop one file at a time.", "Folders cannot be inspected. Choose
+  one image or video file.", "This file type cannot be previewed or inspected here.
+  Choose an image or video file.", "The preview could not be displayed. Metadata and the
+  original remain available in the viewer." and "Embedded metadata could not be read."
+  (the shared inspector's own copy) are `role="alert"`; "Metadata in AVI and WMV files
+  is not read here. The preview and the original remain available." is `role="status"`.
+  A rejected chooser or drop ("Drop one file at a time.", folders, an unsupported drop)
+  keeps the selection and its status line: its alert is a second line after it, removed
+  by the next selection attempt or after the concept's toast interval (6.5 s). The toast
+  "Local preview only…; metadata is available above." shows only for a selection whose
+  status is empty or the AVI/WMV note, never beside an unreadable or failed preview.
+- **D64** (drop, LI-6): `dragover`/`drop` on `.file-drop` accept exactly one File, read
+  only `dataTransfer.files`/`items` (never its strings) and change nothing visually.
+  While the page is mounted, `window` `dragover`/`drop` call `preventDefault`, so a missed
+  drop cannot navigate away. A drop is ignored while a dialog is open.
+- **D65** (no revoke on load): unlike the concept, the preview's `blob:` URL is not
+  revoked on `load`: the viewer and Download original use it until the session ends.
+- **D66** (local rail, in `file-inspector.mjs` for `identity.kind === 'local-file'`): the
+  viewer and rail title is the filename; "File & provenance" opens with "Selected local
+  file · read in this browser", lists Source, Size, Dimensions, Format, Media type and
+  Modified with no Path row and no Show in folder, and ends with "Local file; no saved
+  library association was checked." and Download original. There is no Prompt history
+  action and no category or tag chips.
+- **D117** (Copy settings summary, LI-4): the legacy metadata
+  page's COPY ALL, consolidated into the shared full inspector (the viewer's
+  `#viewer-details`, so Images, the recorded history's current file and Inspect all have
+  it). The concept has no such action. One plain button "Copy settings summary" follows
+  the six facts (before "File & provenance"); the Images side panel keeps the concept's
+  footer and has none. Its text is the legacy `copyAllData` template, line for line:
+  `Checkpoint`, `Positive Prompt`, `Negative Prompt`, `Steps`, `CFG Scale`, `Sampler`,
+  `Seed`, with the legacy placeholders ("Unknown", "No prompt found", "No negative prompt
+  found"). The values are the ones the inspector shows: a confirmed prompt and a known
+  fact verbatim, anything else (an explicitly empty prompt included, as the legacy parse
+  treats '') the placeholder. Against the legacy page, for the same file, only these
+  differ: numbers keep the server's spelling ("8.0" where the legacy page wrote 8); a fact
+  the legacy parse could not read can be known; and a negative the #249 ZeroOut guard
+  zeroed reads "No negative prompt found" where the legacy parse read the positive's text
+  through the zero-out. `workspace-file-inspector.test.js` runs the template taken from
+  `web/metadata.html` itself on the legacy parse of every parity PNG: 22 of 25 are
+  byte-equal, f01b and f23 differ by the ZeroOut guard and f17 by facts the legacy parse
+  missed. Copying works as the concept's prompt copy: the toast "Settings summary
+  copied.", or, without a clipboard or when it is refused, the select-to-copy dialog
+  titled "Copy settings summary". `.ca-tools #viewer-details > div > button` wraps
+  (`white-space: normal`) in the narrow rail at 200% zoom, as D20's buttons do. The concept
+  comparisons add the button to the concept's viewer at runtime (a copy of its own plain
+  button) and to the Inspect rail's section order.
+
+The chooser keeps naming the chosen file, as the concept's does: it is cleared as the
+picker opens (so choosing the same file again is a new selection), not after `change`,
+and named again with the current File (through a `DataTransfer`, which fires no
+`change`) when the picker is cancelled. An accepted drop names the dropped file, so the
+chooser never names a replaced file and never reads "No file chosen" beside a selection.
+
+Legacy floor (`web/metadata.html`), dispositions:
+- PNG by chooser and by drop: kept (`#local-file`, D64).
+- Positive and negative with Copy: kept, in the shared inspector's prompt blocks.
+- Full text (the old "Show more"): the prompt blocks show the whole text.
+- Raw workflow view and Download workflow JSON: kept, in "Workflow & raw metadata".
+- Copy all summary and filename copy (LI-4): the filename is selectable text in the rail
+  and Download original saves the file under its name. COPY ALL is the shared full
+  inspector's "Copy settings summary" (D117), with the legacy text.
+- Fully browser-local reading: kept and asserted (privacy above).
+- Case-variant keys `Workflow|comfy|ComfyUI|Prompt|Parameters` (LI-5): a separate
+  backend issue; Inspect follows the server's readers, so the two never disagree.
+
+`tests/browser/inspect-concept.spec.mjs` compares the page with the immutable concept's
+`#metadata` on the concept fixture, at 1600×1100 and 390×844 in both themes, on Chromium
+and touch, in three states: initial, selected (`f02.png` from the parity corpus set into
+both `#local-file` inputs with a real `setInputFiles`) and viewer-open (the heading
+action). `withProductionCopy` applies D60–D62 to the open concept page before it is
+measured (it throws if the concept's own copy changed), so the browser lays the concept
+out with production's words; `mapViewerConcept` applies D66 (title, no tag chips, no
+Prompt history). The diff of the heading, surface, drop area (icon, label, input, note),
+preview and viewer (dialog box, layout below its header, toolbar control order, rail
+section order) must then be empty. Pinned values are asserted on production: surface
+padding 22px and radius 7px; drop area dashed 1px border, radius 7px, min-height 170px,
+gap 12px, padding 22px, margin-top 20px; h2 17px/600; p 12px; input 12px and
+max-width 100%; preview max-height 400px, `object-fit: contain`, margin-top 20px. The
+chooser's displayed name is asserted to be `f02.png` in both documents. `mutation is
+noticed` makes the drop border solid (noticed on all four sides and nowhere else),
+renames the label and removes the note. Paired captures
+(`{concept,production}-{initial,selected,viewer}-{dark,light}-{1600,390}.png`) and
+`inspect-geometry.json` are attached as test artifacts; there are no PNG baselines.
+
+`tests/comfyui/inspect-sender.spec.mjs` (`local file roles send exactly across renderer
+transitions`) runs on the managed CPU host: the Inspect page reads a PNG whose positive
+spans lines and whose negative is a ConditioningZeroOut (explicitly empty) and
+`core-tags.webm`, and sends each pair to a Prompt Manager (+/-) node in Classic and
+Nodes 2.0, switching both ways with a graph reload each time. Each send previews the
+node's current and new roles, writes exactly those roles, and neither queues nor loads a
+workflow. A connected `negative_text` input rejects the whole preview with no change. The
+workspace page makes no non-GET request and logs neither filename nor prompt text.
+Follow-up (pair node, separate investigation): the node's `text` widget ignored a value
+set after a `PrimitiveString` linked `negative_text` (it kept its prior value), so this spec
+and `library-sender.spec.mjs` set the positive before connecting the negative input.
+
+```sh
+node --test tests/js/workspace-local-session.test.js tests/js/workspace-state.test.js
+npm run --prefix tools/vendor test:workflows -- inspect-concept.spec.mjs workspace-inspect.spec.mjs \
+  --project chromium --project touch --project firefox --project webkit
+npm run --prefix tools/vendor test:comfyui -- inspect-sender.spec.mjs
+```
+
 ## Workspace data fields for the concept pages (#249)
 
 These fields are additive. The legacy `/prompt_manager/images/output` listing (no
@@ -1747,8 +2303,8 @@ page lifecycle recovery retain their separate behavioral tests.
 Initial production acceptance requires maintainer inspection of paired PNGs and
 geometry; never update snapshots automatically or mask content to bless a gap.
 Data-dependent text/images/counts and the clearly labeled saved/frozen/current
-distinctions are documented in the comparison helper. The Images card tag
-button (#249 D9) remains outside #209; every prompt block now renders the concept's
+distinctions are documented in the comparison helper. The gallery cards carry the
+concept's Tag button beside Info (#249 C2 retired D9); every prompt block now renders the concept's
 `section.prompt-section` (D22), so the shared role-block spacing, padding and glyph
 gap is closed, and only the production-only surfaces above keep their own rules
 (D48). The
@@ -1790,12 +2346,41 @@ skip without ffmpeg). The remaining known divergences, checked against ffprobe 9
   `unreadable`); ffprobe reads such files.
 - An EBML DocType other than `matroska`/`webm` is an invalid container locally; ffmpeg
   only warns and reads it.
-- Envelope JSON deeper than 1,000 levels is refused locally as Python's default
-  recursion limit refuses it; the server's real limit depends on the interpreter and
-  call stack. A duplicate key in an object enclosing a nest deeper than the running
+- Deep JSON (local roles, PR L3, and video envelopes): both browser CPython-JSON
+  parsers (`py-json.mjs`, `local-video.mjs`) share one cap, `JSON_MAX_DEPTH` = 1,000
+  nested arrays or objects (each counts, an empty one too); past it a record is invalid
+  JSON locally. The server's `json.loads` raises RecursionError at a limit that depends
+  on the Python, measured on Linux x86-64: 993 levels from a bare script on 3.10 and
+  3.11 (the 1,000 recursion limit minus the caller's frames, so about 990 inside the
+  server), 9,997 on 3.12 and 9,998 on 3.13 (the C recursion counter; lower on Windows
+  builds), and about 52,150 on 3.14 (stack-based, varies with the thread's stack).
+  The record kinds answer: a deep `prompt` graph (or `comfyassets_prompt_pairs`
+  envelope) is malformed; a deep `workflow` is ignored, so the overwritten PromptManager
+  check (R1) does not run and a prompt can resolve; a deep video `comment` or
+  `description` envelope makes the file unreadable on both sides (the server's
+  RecursionError reaches `read_inspection_file`). That gives two directions:
+  - 3.10/3.11, between the server's limit and 1,000: the server refuses and the local
+    page reads, so a deep prompt resolves locally while the server says malformed, and
+    a deep workflow can make R1 refuse locally where the server resolves.
+  - 3.12 and newer, from 1,001 up to the server's limit: the local page refuses and
+    the server reads, so a deep prompt is malformed locally while the server resolves,
+    and a deep workflow is ignored locally while the server can refuse it under R1.
+  Past both limits they agree. `test_local_json_depth_cap_at_its_boundary` checks the
+  local answer at 999, 1,000 and 1,001 for both kinds and that any server difference
+  is only one of the two directions above.
+- Local roles (PR L3): `\d` in the A1111 settings footer is any Unicode decimal
+  digit on both sides, but the browser's Unicode version can be newer than the server
+  Python's, so a footer whose step count uses a digit added after Unicode 15 can differ.
+  `str.lower()` and `toLowerCase()` differ only for characters no node class name uses.
+- A duplicate key in an object enclosing a nest deeper than the running
   Python's json limit is `malformed` locally and `limited` on that Python.
 - Decimal exponent limits assume CPython's C `_decimal`; on a `_pydecimal` interpreter
   the server would read the over-limit exponents the local projection refuses.
+- Follow-up (two CPython-JSON emulations, review M6): `local-video.mjs`
+  (`pythonJsonLoads`/`pythonFloatRepr`, numbers kept as lexemes) and `py-json.mjs`
+  (`pyJsonLoads`/`pyFloatRepr`, Python value kinds) both emulate `json.loads`; only the
+  depth cap is shared so far. A fix to one parser can miss the other, so the video
+  reader should move onto `py-json.mjs` in a later PR.
 
 Preserve raw logs, failed traces, paired PNGs, geometry, runtime versions and
 source hashes before later managed commands clear their output directories.
@@ -1912,7 +2497,7 @@ legacy admin page. The screen consumes only the `/prompt_manager/vocabulary/*` r
 above and adds no route, so PR B needs no ComfyUI restart: a browser refresh is enough.
 
 Screen: a `+ Create tag` heading action, a Tag vocabulary table (columns Tag, Prompts,
-Images shown as "—" with hidden "Not available yet", and Actions with Browse and
+Images counting the files that carry the tag (`image_count`, #249 C2), and Actions with Browse and
 Rename / merge), and a Categories panel whose category rows end with the Manage
 category row (Review). Lists load 100 rows at a time, append when scrolled into view
 and keep `Load more tags` / `Load more categories` while more remain. Prompts counts
@@ -1953,8 +2538,7 @@ npm run --prefix tools/vendor test:workflows -- \
   --project chromium --project touch --project firefox --project webkit
 ```
 
-Recorded deviations from the concept (maintainer acceptance): no Auto-tag images
-button and an Images "—" cell until the image-annotation slice; bounded lists with
+Recorded deviations from the concept (maintainer acceptance): bounded lists with
 Load more; title "Tags"; Manage categories adds a Category select and Preview before
 Apply; "Apply" instead of "Apply in prototype"; Delete tag… inside Rename or merge;
 Browse sets the exact filter; singular "1 positive prompt"; the production list appends

docs/application-redesign.md

@@ -12,6 +12,7 @@ code. This plan proposes implementation order and acceptance gates.
 - The native Prompt Library merged in [#210](https://github.com/ComfyAssets/ComfyUI_PromptManager/pull/210) for [#208](https://github.com/ComfyAssets/ComfyUI_PromptManager/issues/208): one positive parent, saved negative variants, full selected text and a shared filtered image gallery. It does not invent chronological runs from counters or scan dates.
 - [Durable history storage](prompt-history-storage.md) records job attempts and outcomes from [#212](https://github.com/ComfyAssets/ComfyUI_PromptManager/pull/212), frozen prompt contexts from [#213](https://github.com/ComfyAssets/ComfyUI_PromptManager/pull/213), and observed run-owned output locators from [#214](https://github.com/ComfyAssets/ComfyUI_PromptManager/pull/214). Those locators do not verify file bytes or establish gallery-image associations. That association contract and the chronological execution timeline remain pending under [#209](https://github.com/ComfyAssets/ComfyUI_PromptManager/issues/209).
 - [#215](https://github.com/ComfyAssets/ComfyUI_PromptManager/issues/215) brings the shell, Images and natural-height Prompt Library presentation into the approved geometry and themes while retaining their existing operations. [#216](https://github.com/ComfyAssets/ComfyUI_PromptManager/issues/216) adds the shared current-file inspector with exact generation facts, scoped provenance, raw/download evidence and loaded-collection viewer controls, including a slideshow that pauses at native video. This delivery does not establish whole-application parity, change the default entry point or constitute a release. Recorded chronological run/context browsing continues under [#209](https://github.com/ComfyAssets/ComfyUI_PromptManager/issues/209); image tagging/review, System consolidation and remaining organization capabilities continue under #196.
+- Local Inspect (#249, PRs L1–L2) replaces the `#/inspect` handoff with the concept's native "Inspect a file" page: one local image or video previews inline and opens the shared viewer and full inspector on a record read entirely in the browser, with nothing uploaded, imported or stored. The legacy metadata page (`web/metadata.html`, served at `/prompt_manager/gallery.html`) stays reachable from Overview; its capabilities map to the shared inspector, except its one-click COPY ALL summary, whose ruled replacement ("Copy settings summary") is pending. Recorded deviations D60–D66 are in [TESTING.md](../TESTING.md). Local roles equal to the server's resolver follow in PR L3.
 
 ## Scope and compatibility
 

py/api/__init__.py

@@ -7,6 +7,7 @@ Split into domain-specific mixins for maintainability:
 - LoggingRoutesMixin: log management endpoints
 - AutotagRoutesMixin: auto-tagging model management and tagging
 - JobRoutesMixin: the session job registry behind Activity (py/api/jobs.py)
+- ImageTagJobsMixin: bulk Add tags / Auto-tag as image-tags jobs
 """
 
 import asyncio
@@ -31,7 +32,9 @@ from .saved_views import SavedViewRoutesMixin
 from .history import HistoryRoutesMixin
 from .images import ImageRoutesMixin
 from .admin import AdminRoutesMixin
+from .settings_routes import SettingsRoutesMixin
 from .job_routes import JobRoutesMixin
+from .image_tag_jobs import ImageTagJobsMixin
 from .jobs import JobRegistry
 from .logging_routes import LoggingRoutesMixin
 from .autotag_routes import AutotagRoutesMixin
@@ -105,16 +108,20 @@ STATIC_MIME_TYPES = {
     ".html": "text/html",
 }
 _STATIC_SEPARATORS = re.compile(r"[\\/]+")
+# Served by exact request path beside the extension allow-list: the browser's
+# copy of the inspection node table (local Inspect resolves with it, #249).
+STATIC_EXACT_FILES = {("js", "inspection-semantics.json"): "application/json"}
 
 
-def _resolve_static_file(root, filepath):
+def _resolve_static_file(root, filepath, allowed=STATIC_MIME_TYPES):
     """Real path of ``filepath`` under ``root``, or None when it must not be served.
 
     The request path is untrusted. It is rejected when it is empty, carries a
     ``..`` segment, is absolute on any platform (a leading slash or backslash,
     a drive letter such as ``C:`` or a UNC ``\\\\server\\share`` prefix all
     re-anchor ``os.path.join`` on Windows), has an extension outside
-    STATIC_MIME_TYPES, or resolves (symlinks included) outside ``root``.
+    ``allowed`` (STATIC_MIME_TYPES), or resolves (symlinks included) outside
+    ``root``.
     """
     if not isinstance(filepath, str) or not filepath:
         return None
@@ -127,7 +134,7 @@ def _resolve_static_file(root, filepath):
     segments = _STATIC_SEPARATORS.split(filepath)
     if any(segment in ("", ".", "..") for segment in segments):
         return None
-    if os.path.splitext(filepath)[1].lower() not in STATIC_MIME_TYPES:
+    if os.path.splitext(filepath)[1].lower() not in allowed:
         return None
     try:
         root_real = Path(os.path.normcase(os.path.realpath(root)))
@@ -259,7 +266,9 @@ class PromptManagerAPI(
     PromptRoutesMixin,
     ImageRoutesMixin,
     AdminRoutesMixin,
+    SettingsRoutesMixin,
     JobRoutesMixin,
+    ImageTagJobsMixin,
     LoggingRoutesMixin,
     AutotagRoutesMixin,
     LoraIntegrationMixin,
@@ -358,6 +367,24 @@ class PromptManagerAPI(
         """409 envelope for a long job that is already running."""
         return _json_error(f"{label} already running", 409)
 
+    async def _run_held(self, kind, title, admission, operation):
+        """Run a legacy-page operation under a registry hold (D80).
+
+        While ``operation()`` runs, the registry lists it as a running,
+        non-cancellable job, so workspace jobs its admission class conflicts
+        with are refused, naming it. When the registry refuses the hold, the
+        legacy 409 envelope names the running job and nothing is done. A
+        response of 400 or above ends the hold ``failed``.
+        """
+        busy = self._jobs.blocker(kind, admission=admission)
+        if busy is not None:
+            return self._long_job_busy_response(busy.title)
+        async with self._jobs.hold(kind, title, admission=admission) as job:
+            response = await operation()
+            if getattr(response, "status", 200) >= 400:
+                job.finish("failed")
+            return response
+
     async def _run_in_executor(self, func, *args, **kwargs):
         """Run a blocking function in the default thread pool executor.
 
@@ -453,6 +480,7 @@ class PromptManagerAPI(
         self._register_prompt_routes(routes)
         self._register_image_routes(routes)
         self._register_admin_routes(routes)
+        self._register_settings_routes(routes)
         self._register_job_routes(routes)
         self._register_logging_routes(routes)
         self._register_autotag_routes(routes)
@@ -475,15 +503,20 @@ class PromptManagerAPI(
     def _serve_static_file(self, subdir, filepath):
         """Serve ``web/<subdir>/<filepath>``; 403 outside it, 404 when missing."""
         root = os.path.join(_get_project_root(), "web", subdir)
-        file_path = _resolve_static_file(root, filepath)
+        exact = STATIC_EXACT_FILES.get((subdir, filepath))
+        # An exact file passes the same containment check, its extension only.
+        allowed = STATIC_MIME_TYPES if exact is None else {".json"}
+        file_path = _resolve_static_file(root, filepath, allowed)
         if file_path is None:
             return web.Response(text="Forbidden", status=403)
+        content_type = (
+            exact or STATIC_MIME_TYPES[os.path.splitext(file_path)[1].lower()]
+        )
         if not os.path.isfile(file_path):
             return web.Response(text="Not Found", status=404)
-        ext = os.path.splitext(file_path)[1].lower()
         with open(file_path, "rb") as f:
             content = f.read()
-        return web.Response(body=content, content_type=STATIC_MIME_TYPES[ext])
+        return web.Response(body=content, content_type=content_type)
 
     def _serve_html_page(self, filename, title, cache=True):
         """Serve ``web/<filename>``; 404 when missing, 500 when unreadable."""

py/api/admin.py

@@ -22,16 +22,17 @@ from .jobs import (
     SCAN_GROUP_NAMES,
     SCAN_GROUPS,
     SCAN_SCOPES,
+    DUPLICATE_CLEANUP_JOB_KIND,
+    MAINTENANCE_JOB_KIND,
+    RESTORE_JOB_KIND,
     Job,
     JobBusy,
 )
 
 try:
     from ...utils.parallel import map_parallel
-    from ...utils.validators import validate_result_timeout, validate_worker_threads
 except ImportError:
     from utils.parallel import map_parallel
-    from utils.validators import validate_result_timeout, validate_worker_threads
 
 try:
     from ...database.operations import PromptDatabase
@@ -198,13 +199,22 @@ def _plural(count, word):
     return f"{count} {word}" if count == 1 else f"{count} {word}s"
 
 
+def _time_left(done, total, batches, elapsed):
+    """ " · about X min left" once enough batches ran, else "" (D56).
+
+    Shared by every Activity job that reports "Processing file N of M": the
+    scan counts its batches, the image tagging job each file.
+    """
+    if batches < MIN_BATCHES_FOR_ESTIMATE or done <= 0 or done >= total:
+        return ""
+    minutes = max(1, math.ceil(elapsed / done * (total - done) / 60))
+    return f" · about {minutes} min left"
+
+
 def _scan_status_line(done, total, batches, elapsed):
     """ "Processing file N of M", with an estimate once enough batches ran."""
     line = f"Processing file {done:,} of {total:,}"
-    if batches < MIN_BATCHES_FOR_ESTIMATE or done <= 0 or done >= total:
-        return line
-    minutes = max(1, math.ceil(elapsed / done * (total - done) / 60))
-    return f"{line} · about {minutes} min left"
+    return line + _time_left(done, total, batches, elapsed)
 
 
 def _file_size(path):
@@ -493,14 +503,6 @@ class AdminRoutesMixin:
         async def get_stats_route(request):
             return await self.get_statistics(request)
 
-        @routes.get("/prompt_manager/settings")
-        async def get_settings_route(request):
-            return await self.get_settings(request)
-
-        @routes.post("/prompt_manager/settings")
-        async def save_settings_route(request):
-            return await self.save_settings(request)
-
         @routes.get("/prompt_manager/backup")
         async def backup_database_route(request):
             return await self.backup_database(request)
@@ -642,7 +644,15 @@ class AdminRoutesMixin:
             job.finish()
 
     async def cleanup_duplicates_endpoint(self, request):
-        """Cleanup duplicate prompts endpoint."""
+        """Cleanup duplicate prompts endpoint (holds the registry: records)."""
+        return await self._run_held(
+            MAINTENANCE_JOB_KIND,
+            "Prompt cleanup (admin page)",
+            "records",
+            self._cleanup_duplicates,
+        )
+
+    async def _cleanup_duplicates(self):
         try:
             removed_count = await self._run_in_executor(self.db.cleanup_duplicates)
 
@@ -757,26 +767,39 @@ class AdminRoutesMixin:
         return hash_sha256.hexdigest()
 
     async def delete_duplicate_images_endpoint(self, request):
-        """Delete duplicate image files from disk (single flight with the scan)."""
-        job = self._acquire_long_job(self.LONG_JOB_DUPLICATES)
-        if job is None:
+        """Delete duplicate image files from disk.
+
+        Single flight with the duplicate scan, and a records hold on the
+        registry, so no scan, restore or tagging job runs meanwhile. A body
+        without paths is refused before the hold (it is no job).
+        """
+        data, error_response = await _read_json(request)
+        if error_response is not None:
+            return error_response
+        image_paths = data.get("image_paths", [])
+        if not image_paths or not isinstance(image_paths, list):
+            return web.json_response(
+                {"success": False, "error": "No image paths provided"},
+                status=400,
+            )
+        guard = self._acquire_long_job(self.LONG_JOB_DUPLICATES)
+        if guard is None:
             return self._long_job_busy_response("Duplicate scan or delete")
-        async with job:
-            return await self._delete_duplicate_images(request)
 
-    async def _delete_duplicate_images(self, request):
+        async def delete():
+            # No await since the check above: the lock is still free.
+            async with guard:
+                return await self._delete_duplicate_images(image_paths)
+
+        return await self._run_held(
+            DUPLICATE_CLEANUP_JOB_KIND,
+            "Duplicate image delete (gallery page)",
+            "records",
+            delete,
+        )
+
+    async def _delete_duplicate_images(self, image_paths):
         try:
-            data, error_response = await _read_json(request)
-            if error_response is not None:
-                return error_response
-            image_paths = data.get("image_paths", [])
-
-            if not image_paths or not isinstance(image_paths, list):
-                return web.json_response(
-                    {"success": False, "error": "No image paths provided"},
-                    status=400,
-                )
-
             output_dir = await self._run_in_executor(self._find_comfyui_output_dir)
             result = await self._run_in_executor(
                 self._delete_duplicate_images_sync, image_paths, output_dir
@@ -873,208 +896,6 @@ class AdminRoutesMixin:
                 status=500,
             )
 
-    async def get_settings(self, request):
-        """Get current settings."""
-        try:
-            from ..config import PromptManagerConfig, GalleryConfig
-
-            root_paths = [
-                self._public_path(d) for d in GalleryConfig.MONITORING_DIRECTORIES
-            ]
-            return web.json_response(
-                {
-                    "success": True,
-                    "settings": {
-                        "result_timeout": PromptManagerConfig.RESULT_TIMEOUT,
-                        "webui_display_mode": PromptManagerConfig.WEBUI_DISPLAY_MODE,
-                        "infinite_scroll": PromptManagerConfig.INFINITE_SCROLL,
-                        "worker_threads": PromptManagerConfig.WORKER_THREADS,
-                        "cpu_count": PromptManagerConfig.max_worker_threads(),
-                        "gallery_root_paths": root_paths,
-                        "gallery_root_path": root_paths[0] if root_paths else "",
-                        "monitored_directories": [
-                            self._public_path(d) for d in self._monitored_directories()
-                        ],
-                    },
-                }
-            )
-        except Exception as e:
-            self.logger.error(f"Get settings error: {e}", exc_info=True)
-            return web.json_response(
-                {"success": False, "error": "Failed to get settings"},
-                status=500,
-            )
-
-    def _monitored_directories(self):
-        """Directories the running image monitor watches, else the configured roots."""
-        from ..config import GalleryConfig
-
-        monitor = _current_image_monitor()
-        if monitor is not None:
-            return list(getattr(monitor, "monitored_directories", []))
-        return list(GalleryConfig.MONITORING_DIRECTORIES)
-
-    async def save_settings(self, request):
-        """Save settings: the whole payload is validated before anything changes."""
-        try:
-            from ..config import PromptManagerConfig
-
-            data, error_response = await _read_json(request)
-            if error_response is not None:
-                return error_response
-
-            try:
-                updates = self._validate_settings(data)
-            except ValueError as ve:
-                return web.json_response(
-                    {"success": False, "error": str(ve)}, status=400
-                )
-
-            new_roots, error = self._parse_gallery_roots(data)
-            if error:
-                return web.json_response({"success": False, "error": error}, status=400)
-
-            for name, value in updates.items():
-                setattr(PromptManagerConfig, name, value)
-            restart_required = False
-            if new_roots is not None:
-                restart_required = self._apply_gallery_roots(new_roots)
-
-            self._persist_settings()
-
-            return web.json_response(
-                {
-                    "success": True,
-                    "message": "Settings saved successfully",
-                    "restart_required": restart_required,
-                }
-            )
-        except Exception as e:
-            self.logger.error(f"Save settings error: {e}", exc_info=True)
-            return web.json_response(
-                {"success": False, "error": "Failed to save settings"},
-                status=500,
-            )
-
-    @staticmethod
-    def _validate_settings(data):
-        """Scalar settings of a payload as ``{CONFIG_ATTR: value}``.
-
-        Raises ValueError with a user-facing message on the first bad value;
-        nothing is applied until every value passed.
-        """
-        from ..config import PromptManagerConfig
-
-        updates = {}
-        if "result_timeout" in data:
-            updates["RESULT_TIMEOUT"] = validate_result_timeout(data["result_timeout"])
-        if "webui_display_mode" in data:
-            mode = data["webui_display_mode"]
-            if mode not in ("popup", "newtab"):
-                raise ValueError("webui_display_mode must be 'popup' or 'newtab'")
-            updates["WEBUI_DISPLAY_MODE"] = mode
-        if "infinite_scroll" in data:
-            if not isinstance(data["infinite_scroll"], bool):
-                raise ValueError("infinite_scroll must be true or false")
-            updates["INFINITE_SCROLL"] = data["infinite_scroll"]
-        if "worker_threads" in data:
-            updates["WORKER_THREADS"] = validate_worker_threads(
-                data["worker_threads"], PromptManagerConfig.max_worker_threads()
-            )
-        return updates
-
-    def _parse_gallery_roots(self, data):
-        """Extract and validate gallery roots from a settings payload.
-
-        Accepts ``gallery_root_paths`` (list, preferred) or the legacy single
-        ``gallery_root_path`` string. Blank entries are dropped.
-
-        Returns:
-            (roots, error): ``roots`` is the validated list, or ``None`` when
-            the payload carries no gallery root key; ``error`` is a message
-            when validation failed (and ``roots`` is then ``None``).
-        """
-        if "gallery_root_paths" in data:
-            raw = data["gallery_root_paths"]
-            if not isinstance(raw, list):
-                return None, "gallery_root_paths must be a list"
-        elif "gallery_root_path" in data:
-            raw = [data["gallery_root_path"]]
-        else:
-            return None, None
-
-        from ..config import GalleryConfig
-
-        roots = []
-        for entry in raw:
-            if not isinstance(entry, str):
-                return None, "Gallery root paths must be strings"
-            entry = entry.strip()
-            if not entry:
-                continue
-            ok, reason = GalleryConfig.validate_gallery_root(entry)
-            if not ok:
-                return (
-                    None,
-                    f"Invalid gallery root '{os.path.basename(entry)}': {reason}",
-                )
-            roots.append(GalleryConfig.resolve_gallery_root(entry))
-        return roots, None
-
-    def _apply_gallery_roots(self, roots):
-        """Install validated gallery roots; returns True when they changed."""
-        from ..config import GalleryConfig
-
-        if roots == list(GalleryConfig.MONITORING_DIRECTORIES):
-            return False
-        GalleryConfig.MONITORING_DIRECTORIES = roots
-        self._cached_output_dir = None
-        self.reset_gallery_roots_cache()
-        return True
-
-    def _persist_settings(self):
-        """Merge the user-editable settings into the configured config.json.
-
-        Only the keys this endpoint owns are rewritten; every other section
-        (integrations, database, performance, ...) and every other key in
-        ``web_ui``/``gallery`` is kept as it was. A config file that cannot
-        be parsed is replaced.
-        """
-        from ..config import GalleryConfig, PromptManagerConfig, write_private_json
-
-        config_file = PromptManagerConfig.get_config_path()
-        existing = self._read_config_file(config_file)
-        web_ui = dict(existing.get("web_ui") or {})
-        web_ui["result_timeout"] = PromptManagerConfig.RESULT_TIMEOUT
-        web_ui["webui_display_mode"] = PromptManagerConfig.WEBUI_DISPLAY_MODE
-        web_ui["infinite_scroll"] = PromptManagerConfig.INFINITE_SCROLL
-        gallery = dict(existing.get("gallery") or {})
-        monitoring = dict(gallery.get("monitoring") or {})
-        monitoring["directories"] = list(GalleryConfig.MONITORING_DIRECTORIES)
-        gallery["monitoring"] = monitoring
-        performance = dict(existing.get("performance") or {})
-        performance["worker_threads"] = PromptManagerConfig.WORKER_THREADS
-        config_data = {
-            **existing,
-            "web_ui": web_ui,
-            "gallery": gallery,
-            "performance": performance,
-        }
-        try:
-            write_private_json(config_file, config_data)
-            self.logger.info(f"Settings saved to {config_file}")
-        except OSError as save_err:
-            self.logger.warning(f"Could not save config file: {save_err}")
-
-    def _read_config_file(self, config_file):
-        """Current contents of config.json as a dict, or {} when unusable."""
-        try:
-            with open(config_file, "r", encoding="utf-8") as f:
-                data = json.load(f)
-        except (OSError, ValueError):
-            return {}
-        return data if isinstance(data, dict) else {}
-
     async def run_diagnostics(self, request):
         """Run comprehensive system diagnostics and health checks."""
         try:
@@ -1167,6 +988,11 @@ class AdminRoutesMixin:
         "vacuum",
         "cleanup_orphaned_images",
     )
+    # Operations that only read; a run of only these holds the registry as
+    # "read", every other run as "records".
+    READ_ONLY_MAINTENANCE_OPERATIONS = frozenset(
+        {"check_hash_duplicates", "statistics", "check_consistency"}
+    )
 
     async def run_maintenance(self, request):
         """Perform database maintenance operations and report each outcome."""
@@ -1179,7 +1005,27 @@ class AdminRoutesMixin:
             operations = data.get(
                 "operations", list(self.DEFAULT_MAINTENANCE_OPERATIONS)
             )
+        except Exception as e:
+            self.logger.error(f"Maintenance error: {e}", exc_info=True)
+            return web.json_response(
+                {"success": False, "error": "Maintenance failed"}, status=500
+            )
+        writes = not (
+            isinstance(operations, list)
+            and all(
+                isinstance(name, str) and name in self.READ_ONLY_MAINTENANCE_OPERATIONS
+                for name in operations
+            )
+        )
+        return await self._run_held(
+            MAINTENANCE_JOB_KIND,
+            "Maintenance (admin page)",
+            "records" if writes else "read",
+            lambda: self._run_maintenance(operations),
+        )
 
+    async def _run_maintenance(self, operations):
+        try:
             results = await self._run_in_executor(
                 self._run_maintenance_operations, operations
             )
@@ -1333,8 +1179,18 @@ class AdminRoutesMixin:
 
         The upload is streamed to a temp file (capped at restore_max_bytes),
         verified with PromptModel.verify_database_file and only then copied
-        over the live database, which is backed up first.
+        over the live database, which is backed up first. The whole request
+        holds the registry (records): it is refused while a scan or another
+        record-changing job runs, and those are refused while it runs.
         """
+        return await self._run_held(
+            RESTORE_JOB_KIND,
+            "Database restore (admin page)",
+            "records",
+            lambda: self._restore_database(request),
+        )
+
+    async def _restore_database(self, request):
         max_bytes = getattr(self, "restore_max_bytes", 100 * 1024 * 1024)
         temp_path = None
         try:

py/api/autotag_routes.py

@@ -8,6 +8,7 @@ from pathlib import Path
 from typing import Optional
 from urllib.parse import quote
 
+from .jobs import AUTOTAG_BATCH_JOB_KIND
 from .prompts import thumbnail_url_for
 from .. import model_gate
 
@@ -63,6 +64,12 @@ def path_is_within(candidate, root) -> bool:
     return child != parent and child.is_relative_to(parent)
 
 
+async def _refusal(title):
+    """The single error event of an auto-tag batch refused by another job."""
+    message = f"{title} already running"
+    yield {"type": "error", "status": "error", "message": message}
+
+
 class AutotagRoutesMixin:
     """Mixin providing auto-tagging API endpoints."""
 
@@ -425,6 +432,8 @@ class AutotagRoutesMixin:
                 "general_threshold and character_threshold must be numeric"
             )
 
+        errors = []  # an error event ends the run; Activity lists it failed
+
         async def events():
             try:
                 from ..autotag import get_autotag_service
@@ -432,14 +441,40 @@ class AutotagRoutesMixin:
                 async for event in self._autotag_batch_events(
                     get_autotag_service(), opts
                 ):
+                    if event.get("type") == "error":
+                        errors.append(event)
                     yield event
             except Exception:
                 self.logger.exception("AutoTag error")
+                errors.append(_INTERNAL_ERROR)
                 yield {
                     "type": "error",
                     "message": _INTERNAL_ERROR,
                 }
 
+        # The batch writes prompt tags: a records hold on the registry, so it
+        # never runs beside a scan, restore or the workspace tagging job.
+        busy = self._jobs.blocker(AUTOTAG_BATCH_JOB_KIND, admission="records")
+        if busy is not None:
+            if busy.kind == AUTOTAG_BATCH_JOB_KIND:  # unchanged payload
+                return web.json_response(
+                    {"success": False, "error": _BUSY_ERROR}, status=409
+                )
+            # Both legacy pages read this route as a stream, where a 409 reads
+            # as a lost connection: refuse with one error frame instead (the
+            # admin page keys on ``type``, the gallery on ``status``).
+            return await self._stream_sse(request, _refusal(busy.title))
+        async with self._jobs.hold(
+            AUTOTAG_BATCH_JOB_KIND,
+            "Auto-tag images (legacy page)",
+            admission="records",
+        ) as job:
+            response = await self._start_autotag_batch(request, opts, events)
+            if response.status >= 400 or errors:
+                job.finish("failed")
+            return response
+
+    async def _start_autotag_batch(self, request, opts, events):
         if not _autotag_batch_lock.acquire(blocking=False):
             return web.json_response(
                 {"success": False, "error": _BUSY_ERROR}, status=409

py/api/image_tag_jobs.py

@@ -0,0 +1,509 @@
+"""Bulk image tagging as an Activity job: Add tags and Auto-tag (#249 D1).
+
+``POST /prompt_manager/jobs/image-tags`` starts one ``image-tags`` job over
+1..500 listed images, named by the listing identity ``{root_index,
+root_scope, path}``. The job is record-changing (it writes image tag sets and
+new vocabulary names), so it never runs beside the metadata scan.
+
+- **Add tags** (``mode: "add"``) hashes each current file and unions a fixed
+  tag set into the record of exactly those bytes.
+- **Auto-tag** (``mode: "auto"``) copies each still image into a private
+  capture, asks one legacy engine for its top N tags on the capture, re-hashes
+  the current file and unions the suggestions only when the bytes are still
+  the captured ones. It holds the shared model gate for the whole job, loads
+  the model once and never downloads one.
+
+Every step reuses the Tag dialog's pieces: the capture store, the model gate,
+the suggestion worker and the storage call ``add_image_tags``. Files are
+handled one at a time and the job stops at a file boundary when cancelled,
+keeping what it already wrote. Rows and log lines carry root-relative paths
+and public root labels only.
+"""
+
+import asyncio
+import functools
+import os
+import time
+from dataclasses import dataclass, field
+
+from aiohttp import web
+
+from .. import model_gate
+from .admin import _plural, _time_left
+from .annotation_suggest import (
+    OptionError,
+    unavailable_message,
+    validate_options,
+)
+from .annotations import (
+    _MESSAGES,
+    MAX_TARGET_PATH,
+    _coded,
+    _error,
+    _pinned_suggestions,
+    _settled,
+    _submit,
+    _target,
+)
+from .autotag_routes import model_busy_response
+from .images import _public_path
+from .job_routes import busy_response
+from .jobs import IMAGE_TAG_GROUP_NAMES, IMAGE_TAG_JOB_KIND, JobBusy
+from .prompts import bad_request
+
+try:
+    from ...database.annotations import ImageTagLimitError, normalize_image_tags
+    from ...database.library_commands import LibraryCommandError
+    from ...utils.media_capture import (
+        CaptureCapacity,
+        CaptureChanged,
+        CaptureDenied,
+        CaptureError,
+        CaptureTooLarge,
+    )
+    from ...utils.video_metadata import is_video_path
+except ImportError:
+    from database.annotations import ImageTagLimitError, normalize_image_tags
+    from database.library_commands import LibraryCommandError
+    from utils.media_capture import (
+        CaptureCapacity,
+        CaptureChanged,
+        CaptureDenied,
+        CaptureError,
+        CaptureTooLarge,
+    )
+    from utils.video_metadata import is_video_path
+
+MAX_JOB_TARGETS = 500
+# 500 maximal targets plus the options: a path of MAX_TARGET_PATH code points
+# takes at most 6 bytes each on the wire (a \uXXXX escape; raw UTF-8 is at most
+# 4), and the root index and scope fit in 256. The annotation routes' 64 KiB
+# bound is for one target, too small for a full selection.
+MAX_JOB_BODY_BYTES = MAX_JOB_TARGETS * (MAX_TARGET_PATH * 6 + 256) + 64 * 1024
+# A busy capture worker (a Tag dialog in another tab) is waited for this long,
+# try by try, before the file is left for a rerun.
+CAPACITY_BACKOFF = (0.1, 0.2, 0.4, 0.8)
+
+ADD_TITLE = "Add tags to images"
+AUTO_TITLE = "Auto-tag images"
+GATE_OWNER_KIND = "image-tag-job"
+
+_FIELDS = {
+    "add": frozenset({"mode", "targets", "tags"}),
+    "auto": frozenset({"mode", "targets", "model_type", "options"}),
+}
+_VERBS = {"add": "Add tags", "auto": "Auto-tag"}
+_LOG_PREFIXES = {"tagged": "+", "unchanged": "=", "skipped": "-", "errors": "!"}
+
+NO_NEW_TAGS = "No new tags"
+VIDEO_SKIPPED = "Video: manual tags only"
+TOO_LARGE = "Too large to verify"
+FILE_CHANGED = "File changed"
+FILE_NOT_FOUND = "File not found"
+NOT_A_STILL = "Not a supported still image"
+INFERENCE_FAILED = "Auto-tagging failed. Check server logs for details."
+SAVE_FAILED = "The tags could not be saved. Check server logs for details."
+READ_FAILED = "The file could not be read."
+SOURCE_CHANGED = "The source changed. Refresh the image collection."
+STORAGE_RESTORED = "Prompt storage was restored; start the job again."
+BUSY_RETRY = "The file could not be read now. Run the job again for it."
+
+_monotonic = time.monotonic  # the job's clock (a test can fake it)
+
+
+class _JobStopped(Exception):
+    """No later file can be written (prompt storage was restored)."""
+
+
+@dataclass
+class _Run:
+    """One running job: its request, the gate owner and the resolved roots.
+
+    ``roots`` maps each target's ``(root_index, root_scope)`` to ``(root,
+    label)``, read once per job off the event loop; ``root`` is None when the
+    scope no longer names a current root.
+    """
+
+    job: object
+    spec: object
+    epoch: str
+    owner: object
+    service: object = None
+    roots: dict = field(default_factory=dict)
+
+
+@dataclass(frozen=True)
+class _Spec:
+    """A validated start request."""
+
+    mode: str
+    targets: tuple
+    tags: tuple = ()
+    model_type: str | None = None
+    options: dict | None = None
+
+    @property
+    def title(self) -> str:
+        return ADD_TITLE if self.mode == "add" else AUTO_TITLE
+
+    def scope(self) -> dict:
+        scope = {"mode": self.mode, "images": len(self.targets)}
+        if self.mode == "auto":
+            scope["model_type"] = self.model_type
+        return scope
+
+
+def _parse_targets(raw):
+    """Unique validated targets in request order, or ``(None, error)``."""
+    if not isinstance(raw, list) or not 1 <= len(raw) <= MAX_JOB_TARGETS:
+        return None, bad_request(f"targets must list 1 to {MAX_JOB_TARGETS} images")
+    seen, targets = set(), []
+    for item in raw:
+        target, error = _target(item)
+        if error is not None:
+            return None, error
+        if target not in seen:
+            seen.add(target)
+            targets.append(target)
+    return tuple(targets), None
+
+
+def _parse_add(targets, data):
+    try:
+        tags = normalize_image_tags(data["tags"])
+    except ImageTagLimitError as exc:
+        return None, _error(400, "tag-limit", str(exc))
+    except ValueError as exc:
+        return None, bad_request(str(exc))
+    if not tags:
+        return None, bad_request("tags must name at least one tag")
+    return _Spec("add", targets, tags=tuple(tags)), None
+
+
+def _parse_auto(targets, data):
+    from ..config import MAX_SUGGESTION_LIMIT, AutotagConfig
+
+    try:
+        model_type, options = validate_options(
+            data["model_type"],
+            data["options"],
+            default_limit=AutotagConfig.suggestion_limit(),
+            max_limit=MAX_SUGGESTION_LIMIT,
+        )
+    except OptionError as exc:
+        return None, bad_request(str(exc))
+    return _Spec("auto", targets, model_type=model_type, options=options), None
+
+
+def parse_image_tag_request(data: dict):
+    """A :class:`_Spec` for a start body, or ``(None, error response)``.
+
+    ``{mode:"add", targets, tags}`` or ``{mode:"auto", targets, model_type,
+    options}`` exactly; options follow the Tag dialog's Generate rules.
+    """
+    fields = _FIELDS.get(data.get("mode"))
+    if fields is None:
+        return None, bad_request('mode must be "add" or "auto"')
+    if set(data) != fields:
+        return None, bad_request(
+            "Request must contain exactly " + ", ".join(sorted(fields))
+        )
+    targets, error = _parse_targets(data["targets"])
+    if error is not None:
+        return None, error
+    if data["mode"] == "add":
+        return _parse_add(targets, data)
+    return _parse_auto(targets, data)
+
+
+def _capture_outcome(exc: CaptureError, root, relative: str):
+    """The (group, detail) of a file the capture store refused to read."""
+    if isinstance(exc, CaptureTooLarge):
+        return "skipped", TOO_LARGE
+    if isinstance(exc, CaptureDenied):
+        return "skipped", FILE_NOT_FOUND
+    if isinstance(exc, CaptureChanged):
+        path = os.path.join(root, *relative.split("/"))
+        return "skipped", FILE_CHANGED if os.path.lexists(path) else FILE_NOT_FOUND
+    if isinstance(exc, CaptureCapacity):
+        return "skipped", BUSY_RETRY
+    return "errors", READ_FAILED
+
+
+async def _capacity_retried(job, attempt):
+    """``await attempt()``, tried again while the capture store is at capacity.
+
+    Raises the last ``CaptureCapacity`` once ``CAPACITY_BACKOFF`` is spent or the
+    job was cancelled meanwhile.
+    """
+    for delay in CAPACITY_BACKOFF:
+        try:
+            return await attempt()
+        except CaptureCapacity:
+            if job.cancelled:
+                raise
+        await asyncio.sleep(delay)
+    return await attempt()
+
+
+def _load_model(service, model_type: str, use_gpu: bool) -> None:
+    """Worker thread: load (or swap to) *model_type*; never downloads."""
+    if service.is_model_loaded() and service.get_loaded_model_type() == model_type:
+        return
+    if service.load_model(model_type, use_gpu) is False:
+        raise RuntimeError(f"{model_type} could not be loaded")
+
+
+class ImageTagJobsMixin:
+    """The ``image-tags`` job kind: start route and runner."""
+
+    async def start_image_tag_job(self, request: web.Request) -> web.Response:
+        """Start bulk tagging (202), or 409 ``busy`` / ``model-busy``.
+
+        Every target's root scope is checked before the job starts
+        (``source-changed``). Auto-tag takes the model gate here, so a start
+        while anything else holds it is refused at once.
+        """
+        data, error = await self._read_json_body(request, max_bytes=MAX_JOB_BODY_BYTES)
+        if error is not None:
+            return error
+        spec, error = parse_image_tag_request(data)
+        if error is not None:
+            return error
+        roots = await self._run_in_executor(self._job_roots, spec.targets)
+        if any(root is None for root, _label in roots.values()):
+            return _coded("source-changed")
+        epoch = await self._run_in_executor(self.db.get_execution_epoch)
+        # A running job in the way answers first: it says which job to wait for.
+        blocker = self._jobs.blocker(IMAGE_TAG_JOB_KIND, record_changing=True)
+        if blocker is not None:
+            return busy_response(JobBusy(blocker))
+        owner = None
+        if spec.mode == "auto":
+            owner = model_gate.new_owner(GATE_OWNER_KIND)
+            if not model_gate.try_acquire(owner):
+                return model_busy_response()
+        try:
+            job = self._jobs.start(
+                IMAGE_TAG_JOB_KIND,
+                spec.title,
+                record_changing=True,
+                scope=spec.scope(),
+                runner=functools.partial(self._run_image_tag_job, spec, epoch, owner),
+                groups=IMAGE_TAG_GROUP_NAMES,
+            )
+        except JobBusy as busy:
+            if owner is not None:
+                model_gate.release(owner)
+            return busy_response(busy)
+        if owner is not None:
+            # Also when the task is cancelled before its runner ever starts.
+            job.task.add_done_callback(lambda _task: model_gate.release(owner))
+        return web.json_response({"success": True, "job": job.summary()}, status=202)
+
+    # -- runner ----------------------------------------------------------------
+
+    def _job_roots(self, targets) -> dict:
+        """Worker thread: ``{(index, scope): (root or None, label)}`` (see _Run)."""
+        roots = list(self._get_all_output_dirs())
+        resolved = {}
+        for index, scope in dict.fromkeys((t[0], t[1]) for t in targets):
+            label = _public_path(roots[index]) if index < len(roots) else ""
+            error = self._gallery_scope_error(
+                {"root_scope": scope, "root": str(index)}, roots
+            )
+            resolved[(index, scope)] = (roots[index] if error is None else None, label)
+        return resolved
+
+    async def _run_image_tag_job(self, spec: _Spec, epoch: str, owner, job) -> None:
+        verb = _VERBS[spec.mode]
+        total = len(spec.targets)
+        job.update(total=total, status_line=f"Processing file 0 of {total:,}")
+        started = f"{verb} started · {_plural(total, 'image')}"
+        if spec.mode == "auto":
+            started += f" · {spec.model_type}"
+        job.log_line(started)
+        run = _Run(job, spec, epoch, owner)
+        try:
+            if spec.mode == "auto":
+                run.service = await self._prepare_tagging_model(job, spec, owner)
+                if run.service is None:
+                    job.finish("failed")
+                    return
+            if not await self._tag_each_file(run):
+                job.log_line(f"{verb} stopped · {STORAGE_RESTORED}")
+                job.finish("failed")
+                return
+            state = "cancelled" if job.cancelled else "finished"
+            job.log_line(f"{verb} {state} · {_plural(job.processed, 'file')} processed")
+            job.publish({"type": state, "progress": job.progress})
+            job.finish(state)
+        finally:
+            if owner is not None:
+                model_gate.release(owner)
+
+    async def _tag_each_file(self, run: _Run) -> bool:
+        """Tag the targets in order; False when the job had to stop."""
+        job, total = run.job, len(run.spec.targets)
+        run.roots = await self._run_in_executor(self._job_roots, run.spec.targets)
+        started = _monotonic()
+        for number, target in enumerate(run.spec.targets, 1):
+            if job.cancelled:
+                break
+            # The scan's estimate (D56), with each finished file as one batch.
+            left = _time_left(number - 1, total, number - 1, _monotonic() - started)
+            job.update(status_line=f"Processing file {number:,} of {total:,}{left}")
+            job.publish({"type": "progress", "progress": job.progress})
+            stopped = False
+            try:
+                group, detail = await self._tag_one_file(run, target)
+            except _JobStopped:
+                stopped, group, detail = True, "errors", STORAGE_RESTORED
+            except Exception:
+                self.logger.exception("Image tagging failed for one file")
+                group, detail = "errors", SAVE_FAILED
+            self._record_tag_outcome(run, target, group, detail)
+            job.update(processed=number, progress=number * 100 // total)
+            if stopped:
+                return False
+        return True
+
+    async def _prepare_tagging_model(self, job, spec: _Spec, owner):
+        """The loaded service, or None (logged) when the job cannot run."""
+        from ..autotag import MODELS, get_autotag_service
+
+        service = get_autotag_service()
+        status = await self._run_in_executor(service.get_models_status)
+        if not status.get(spec.model_type, {}).get("downloaded"):
+            name = MODELS.get(spec.model_type, {}).get("name", spec.model_type)
+            message = unavailable_message(name)
+            job.update(status_line=message)
+            job.log_line(f"! {message}")
+            return None
+        try:
+            await model_gate.run(
+                owner,
+                _load_model,
+                service,
+                spec.model_type,
+                spec.options["use_gpu"],
+            )
+        except Exception:
+            self.logger.exception("The auto-tag job could not load its model")
+            job.update(status_line=INFERENCE_FAILED)
+            job.log_line(f"! {INFERENCE_FAILED}")
+            return None
+        return service
+
+    async def _verified(self, run: _Run, store, root, relative):
+        """The current file's facts, waiting out a busy capture store."""
+        return await _capacity_retried(
+            run.job, lambda: self._run_in_executor(store.verify, root, relative)
+        )
+
+    async def _tag_one_file(self, run: _Run, target):
+        """The (group, detail) of one target; raises _JobStopped on a restore."""
+        index, scope, relative = target
+        root, _label = run.roots[(index, scope)]
+        if root is None:
+            return "errors", SOURCE_CHANGED
+        store = self._capture_store()
+        if run.spec.mode == "add":
+            try:
+                facts = await self._verified(run, store, root, relative)
+            except CaptureError as exc:
+                return _capture_outcome(exc, root, relative)
+            return await self._union_image_tags(facts, list(run.spec.tags), run.epoch)
+        if is_video_path(relative):
+            return "skipped", VIDEO_SKIPPED
+        try:
+            capture = await _capacity_retried(
+                run.job,
+                lambda: _settled(
+                    _submit(
+                        store.capture,
+                        root,
+                        relative,
+                        epoch=run.epoch,
+                        scope=scope,
+                        root_index=index,
+                    ),
+                    lambda made: made is not None and store.release(made.token),
+                ),
+            )
+        except CaptureError as exc:
+            return _capture_outcome(exc, root, relative)
+        try:
+            return await self._auto_tag_capture(run, store, capture, root, relative)
+        finally:
+            store.release(capture.token)
+
+    async def _auto_tag_capture(self, run: _Run, store, capture, root, relative):
+        """Suggest on the capture, then union only onto the same current bytes."""
+        if not capture.inferable:
+            return "skipped", NOT_A_STILL
+        if store.acquire(capture.token) is None:
+            raise _JobStopped  # every capture was invalidated (restore)
+        spec = run.spec
+        try:
+            pairs = await model_gate.run(
+                run.owner,
+                _pinned_suggestions,
+                store,
+                capture.token,
+                run.service,
+                capture,
+                spec.model_type,
+                spec.options,
+                on_skipped=functools.partial(store.release_use, capture.token),
+            )
+        except Exception:
+            self.logger.exception("Auto-tagging failed for one file")
+            return "errors", INFERENCE_FAILED
+        try:
+            facts = await self._verified(run, store, root, relative)
+        except CaptureError as exc:
+            return _capture_outcome(exc, root, relative)
+        if facts.locator != capture.locator or facts.sha256 != capture.sha256:
+            return "skipped", FILE_CHANGED
+        names = [str(name) for name, _score in pairs]
+        if not names:
+            return "unchanged", NO_NEW_TAGS
+        return await self._union_image_tags(facts, names, run.epoch)
+
+    async def _union_image_tags(self, facts, tags: list, epoch: str):
+        """``add_image_tags`` on the verified bytes, as a (group, detail)."""
+        try:
+            receipt = await self._run_in_executor(
+                self.db.add_image_tags,
+                locator=facts.locator,
+                sha256=facts.sha256,
+                size=facts.size,
+                mtime_ns=facts.mtime_ns,
+                expected_epoch=epoch,
+                tags=tags,
+            )
+        except LibraryCommandError as exc:
+            if exc.code == "storage-changed":
+                raise _JobStopped from None
+            if exc.code == "tag-limit":
+                return "errors", _MESSAGES["tag-limit"]
+            self.logger.warning(f"Image tags not saved ({exc.code})")
+            return "errors", SAVE_FAILED
+        except ValueError:
+            self.logger.exception("Image tags were refused")
+            return "errors", SAVE_FAILED
+        added = receipt.get("added", 0)
+        if added:
+            return "tagged", f"Added {_plural(added, 'tag')}"
+        return "unchanged", NO_NEW_TAGS
+
+    def _record_tag_outcome(self, run: _Run, target, group: str, detail: str) -> None:
+        index, scope, relative = target
+        _root, label = run.roots[(index, scope)]
+        where = f"{label}/{relative}" if label else relative
+        run.job.record(
+            group,
+            {"path": relative, "root": label, "root_index": index, "detail": detail},
+            f"{_LOG_PREFIXES[group]} {where} · {detail}",
+        )

py/api/images.py

@@ -19,6 +19,7 @@ from typing import Callable, NamedTuple
 from aiohttp import web
 from PIL import Image, UnidentifiedImageError
 
+from .jobs import THUMBNAILS_JOB_KIND
 from .prompts import bad_request, parse_page_params, publish_image_paths
 from .prompts import thumbnail_url_for
 from .prompts import safe_error_message as _safe_error
@@ -104,6 +105,10 @@ def _card_header(path: Path) -> tuple:
     return inspection.width, inspection.height, records
 
 
+# The legacy gallery page's thumbnail generation, as Activity lists it (D80).
+THUMBNAIL_GENERATION_TITLE = "Thumbnail generation (gallery page)"
+
+
 class _CardFacts(NamedTuple):
     """One image file's card facts, derived from its header alone.
 
@@ -1736,11 +1741,24 @@ class ImageRoutesMixin:
         return cls.THUMBNAIL_SIZES.get(quality, cls.THUMBNAIL_SIZES["medium"])
 
     async def generate_thumbnails(self, request):
-        """Generate every thumbnail in one executor job (POST, blocking)."""
+        """Generate every thumbnail in one executor job (POST, blocking).
+
+        Holds the registry as guarded work: refused while a record-changing
+        job runs, and such jobs are refused while it runs. A body that cannot
+        be read is refused before the hold, so it is never listed as a job.
+        """
+        data, error = await _json_body_or_error(request)
+        if error is not None:
+            return error
+        return await self._run_held(
+            THUMBNAILS_JOB_KIND,
+            THUMBNAIL_GENERATION_TITLE,
+            "guarded",
+            lambda: self._generate_thumbnails(data),
+        )
+
+    async def _generate_thumbnails(self, data):
         try:
-            data, error = await _json_body_or_error(request)
-            if error is not None:
-                return error
             thumbnail_size = self._thumbnail_size(data.get("quality", "medium"))
 
             output_dirs = self._get_all_output_dirs()
@@ -1935,14 +1953,32 @@ class ImageRoutesMixin:
                 "Connection": "keep-alive",
             },
         )
-        await response.prepare(request)
+        busy = self._jobs.blocker(THUMBNAILS_JOB_KIND, admission="guarded")
+        if busy is not None:
+            # The gallery reads this stream: refuse with its error event.
+            await response.prepare(request)
+            message = f"{busy.title} already running"
+            await self._emit_sse(
+                response, "error", {"error": message, "message": message}
+            )
+            return response
+        async with self._jobs.hold(
+            THUMBNAILS_JOB_KIND, THUMBNAIL_GENERATION_TITLE, admission="guarded"
+        ) as job:
+            await response.prepare(request)
+            if not await self._thumbnail_progress_stream(response, thumbnail_size):
+                job.finish("failed")  # an error event ended the stream
+        return response
+
+    async def _thumbnail_progress_stream(self, response, thumbnail_size) -> bool:
+        """Stream one generation run; False when it ended with an error event."""
         try:
             output_dirs = self._get_all_output_dirs()
             if not output_dirs:
                 await self._emit_sse(
                     response, "error", {"error": "ComfyUI output directory not found"}
                 )
-                return response
+                return False
 
             await self._emit_sse(
                 response,
@@ -1960,6 +1996,7 @@ class ImageRoutesMixin:
                 remaining=plan["remaining"],
             )
             self.invalidate_gallery_cache()
+            return True
         except Exception:
             self.logger.exception("Thumbnail generation failed")
             await self._emit_sse(
@@ -1970,7 +2007,7 @@ class ImageRoutesMixin:
                     "message": "Thumbnail generation failed. Check server logs.",
                 },
             )
-        return response
+            return False
 
     async def _stream_thumbnails(
         self, response, targets, thumbnail_size, skipped=0, remaining=0
@@ -2179,8 +2216,17 @@ class ImageRoutesMixin:
         """Clear generated thumbnails across gallery roots, preserving originals.
 
         Invalid thumbnail directories return 400; unavailable gallery roots
-        return 404, and unexpected filesystem failures return 500.
+        return 404, and unexpected filesystem failures return 500. Holds the
+        registry as guarded work, like generation.
         """
+        return await self._run_held(
+            THUMBNAILS_JOB_KIND,
+            "Thumbnail clear (gallery page)",
+            "guarded",
+            self._clear_thumbnails,
+        )
+
+    async def _clear_thumbnails(self) -> web.Response:
         try:
             output_dirs = self._get_all_output_dirs()
             if not output_dirs:

py/api/job_routes.py

@@ -1,8 +1,9 @@
 """Session job routes (Activity): list, inspect, follow and cancel jobs.
 
-The registry itself is ``py/api/jobs.py``; the scan job's runner is in
-``py/api/admin.py``. Every response leaves out absolute server paths: job
-rows already carry root-relative paths and public root labels.
+The registry itself is ``py/api/jobs.py``. The scan job's runner is in
+``py/api/admin.py``, the image tagging job's in ``py/api/image_tag_jobs.py``.
+Every response leaves out absolute server paths: job rows already carry
+root-relative paths and public root labels.
 """
 
 import contextlib
@@ -42,6 +43,20 @@ async def _scan_scope(request):
     return scope if scope in SCAN_SCOPES else None
 
 
+def busy_response(busy: JobBusy):
+    """``409 busy``, naming the running job that holds the slot."""
+    running = busy.running
+    return web.json_response(
+        {
+            "success": False,
+            "code": "busy",
+            "error": str(busy),
+            "running": {"id": running.id, "title": running.title},
+        },
+        status=409,
+    )
+
+
 def _summary_event(job):
     return f"data: {json.dumps(job.summary())}\n\n".encode("utf-8")
 
@@ -58,6 +73,10 @@ class JobRoutesMixin:
         async def start_scan_job_route(request):
             return await self.start_scan_job(request)
 
+        @routes.post("/prompt_manager/jobs/image-tags")
+        async def start_image_tag_job_route(request):
+            return await self.start_image_tag_job(request)
+
         @routes.get("/prompt_manager/jobs/{job_id}")
         async def job_detail_route(request):
             return await self.job_detail(request)
@@ -121,16 +140,7 @@ class JobRoutesMixin:
         try:
             job = self._start_scan_job(files)
         except JobBusy as busy:
-            running = busy.running
-            return web.json_response(
-                {
-                    "success": False,
-                    "code": "busy",
-                    "error": str(busy),
-                    "running": {"id": running.id, "title": running.title},
-                },
-                status=409,
-            )
+            return busy_response(busy)
         return web.json_response({"success": True, "job": job.summary()}, status=202)
 
     async def job_events(self, request):

py/api/jobs.py

@@ -9,8 +9,21 @@ as a snapshot and then every event published after it, until the job ends.
 
 Jobs live only in server memory and are gone after a restart. The registry
 keeps the running jobs and this session's last ``MAX_FINISHED_JOBS`` finished
-ones. Record-changing jobs (the metadata scan, and later maintenance, cleanup
-and restore) never run together, and one job of a kind runs at a time.
+ones. One job of a kind runs at a time, and each job has an admission class
+(``ADMISSIONS``) that decides what may run beside it:
+
+- ``records`` changes library records or files (the metadata scan, bulk image
+  tagging, and the legacy restore, maintenance, cleanup, duplicate delete,
+  LoRA import and batch auto-tag routes). It is refused while any
+  ``records`` or ``guarded`` job runs.
+- ``guarded`` must not overlap record changes but may overlap other guarded
+  work (thumbnail generation and clearing, later backup). It is refused while
+  a ``records`` job runs.
+- ``read`` only reads; it is refused only by a running job of its own kind.
+
+A short legacy-page operation takes a ``hold``: a running, non-cancellable
+job that lasts as long as the request, so the Activity page lists it and a
+workspace job is refused while it runs (and the other way round).
 """
 
 import asyncio
@@ -54,6 +67,46 @@ SCAN_GROUPS = {
     "failed": "errors",
 }
 
+# Bulk image tagging (#249 D1): Add tags and Auto-tag over selected images.
+# Record-changing: it writes image tag sets and new vocabulary names.
+IMAGE_TAG_JOB_KIND = "image-tags"
+IMAGE_TAG_GROUP_NAMES = ("tagged", "unchanged", "skipped", "errors")
+
+ADMISSIONS = ("read", "guarded", "records")
+# What each admission class is refused beside (besides its own kind).
+_REFUSED_BESIDE = {
+    "read": frozenset(),
+    "guarded": frozenset({"records"}),
+    "records": frozenset({"records", "guarded"}),
+}
+
+# Kinds of the legacy-page operations that hold the registry (D80; titles in
+# their handlers end in "(admin page)", "(gallery page)" or "(legacy page)").
+RESTORE_JOB_KIND = "restore"
+MAINTENANCE_JOB_KIND = "maintenance"
+DUPLICATE_CLEANUP_JOB_KIND = "duplicate_cleanup"
+THUMBNAILS_JOB_KIND = "thumbnails"
+LORA_IMPORT_JOB_KIND = "lora_import"
+AUTOTAG_BATCH_JOB_KIND = "autotag"
+
+
+def resolve_admission(admission=None, record_changing=None) -> str:
+    """The admission class for a start call; ``record_changing`` is an alias.
+
+    ``record_changing=True`` means ``records`` and ``False`` means ``read``;
+    with neither given the class is ``read``. Raises ValueError for an
+    unknown class or one that contradicts ``record_changing``.
+    """
+    if admission is None:
+        return "records" if record_changing else "read"
+    if admission not in ADMISSIONS:
+        raise ValueError(f"Unknown job admission {admission!r}")
+    if record_changing is not None and record_changing != (admission == "records"):
+        raise ValueError(
+            f"record_changing={record_changing!r} contradicts admission {admission!r}"
+        )
+    return admission
+
 
 def _relative_path(path) -> str:
     """``path`` as a root-relative POSIX path; an absolute one keeps its name."""
@@ -79,13 +132,23 @@ class Job:
     """One tracked operation: state, counters, outcomes, log and subscribers."""
 
     def __init__(
-        self, kind, title, *, record_changing=False, scope=None, groups=(), clock=None
+        self,
+        kind,
+        title,
+        *,
+        admission=None,
+        record_changing=None,
+        cancellable=True,
+        scope=None,
+        groups=(),
+        clock=None,
     ):
         self._clock = clock or time.time
         self.id = uuid.uuid4().hex
         self.kind = kind
         self.title = title
-        self.record_changing = record_changing
+        self.admission = resolve_admission(admission, record_changing)
+        self.cancellable = bool(cancellable)
         self.scope = dict(scope or {})
         self.state = "running"
         self.started_at = self._clock()
@@ -104,6 +167,10 @@ class Job:
         self.task = None
         self._subscribers = set()
 
+    @property
+    def record_changing(self):
+        return self.admission == "records"
+
     @property
     def running(self):
         return self.state == "running"
@@ -234,6 +301,9 @@ class Job:
             # What detail() lists, so a view re-reads it only when it changed.
             "listed": {group: len(rows) for group, rows in self.outcomes.items()},
             "log_length": len(self.log),
+            # A view offers Cancel only when the server can stop the job.
+            "cancellable": self.cancellable,
+            "admission": self.admission,
         }
 
     def detail(self):
@@ -285,27 +355,89 @@ class JobRegistry:
         self._logger = logger_ or logger
         self._jobs = {}
 
-    def start(self, kind, title, *, record_changing, scope, runner, groups=()) -> Job:
+    def start(
+        self,
+        kind,
+        title,
+        *,
+        admission=None,
+        record_changing=None,
+        cancellable=True,
+        scope=None,
+        runner,
+        groups=(),
+    ) -> Job:
         """Create a job and run ``runner(job)`` as a task.
 
-        Raises JobBusy, naming the job in the way, when a job of ``kind`` is
-        running or when ``record_changing`` and another record-changing job
-        runs. Must be called from the event loop.
+        ``admission`` is one of ``ADMISSIONS``; ``record_changing=True`` is
+        the older spelling of ``records`` and ``False`` of ``read``. One of
+        the two is required (TypeError otherwise), so no new job runs as
+        ``read`` beside a scan by omission. Raises JobBusy, naming the job in
+        the way, when the admission class refuses it (see the module
+        docstring). Must be called from the event loop.
+        """
+        if admission is None and record_changing is None:
+            raise TypeError(
+                f"JobRegistry.start({kind!r}) needs an admission class "
+                "(admission= or record_changing=)"
+            )
+        job = self._admit(
+            kind,
+            title,
+            admission=admission,
+            record_changing=record_changing,
+            cancellable=cancellable,
+            scope=scope,
+            groups=groups,
+        )
+        job.task = asyncio.ensure_future(self._run(job, runner))
+        return job
+
+    def hold(self, kind, title, *, admission, scope=None):
+        """A running, non-cancellable job for a legacy-page operation.
+
+        Returns an async context manager. Entering it registers the job and
+        yields it, or raises JobBusy at once, without waiting, when the
+        admission class refuses it; nothing is registered until then, so a
+        hold that is never entered leaves no job behind. The job ends when
+        the block exits: ``finished``, or ``failed`` when it raised (unless
+        the body already ended it). A caller that answers a refusal in its
+        own way checks ``blocker(kind, admission=...)`` first, with no await
+        before the ``async with``.
+        """
+        resolve_admission(admission)  # an unknown class fails at the call
+        return _Hold(
+            lambda: self._admit(
+                kind, title, admission=admission, cancellable=False, scope=scope
+            )
+        )
+
+    def _admit(self, kind, title, *, admission, record_changing=None, **job_args):
+        resolved = resolve_admission(admission, record_changing)
+        blocker = self.blocker(kind, admission=resolved)
+        if blocker is not None:
+            raise JobBusy(blocker)
+        self._prune()
+        job = Job(kind, title, admission=resolved, **job_args)
+        self._jobs[job.id] = job
+        return job
+
+    def blocker(self, kind, *, admission=None, record_changing=None):
+        """The running job a new ``kind`` job would be refused for, or None.
+
+        The same kind refuses first; then the oldest running job whose class
+        the new job's admission class may not run beside.
         """
         same_kind = self.active(kind)
         if same_kind is not None:
-            raise JobBusy(same_kind)
-        if record_changing:
-            for job in self._jobs.values():
-                if job.running and job.record_changing:
-                    raise JobBusy(job)
-        self._prune()
-        job = Job(
-            kind, title, record_changing=record_changing, scope=scope, groups=groups
-        )
-        self._jobs[job.id] = job
-        job.task = asyncio.ensure_future(self._run(job, runner))
-        return job
+            return same_kind
+        refused = _REFUSED_BESIDE[resolve_admission(admission, record_changing)]
+        running = [job for job in self._jobs.values() if job.running]
+        running.sort(key=lambda job: job._started_seq)
+        for job in running:
+            if job.admission in refused:
+                return job
+        return None
 
     async def _run(self, job, runner):
         try:
@@ -349,11 +481,28 @@ class JobRegistry:
     def cancel(self, job_id) -> bool:
         """Ask a running job to stop at its next safe boundary.
 
-        Returns whether a cancellation was requested: False for a finished or
-        unknown job, so a cancel after the end is a no-op.
+        Returns whether a cancellation was requested: False for a finished,
+        unknown or non-cancellable job, so a cancel after the end is a no-op.
         """
         job = self._jobs.get(job_id)
-        if job is None or job.finished:
+        if job is None or job.finished or not job.cancellable:
             return False
         job.cancelled = True
         return True
+
+
+class _Hold:
+    """The async context manager ``JobRegistry.hold`` returns."""
+
+    def __init__(self, admit):
+        self._admit = admit
+        self._job = None
+
+    async def __aenter__(self):
+        self._job = self._admit()
+        return self._job
+
+    async def __aexit__(self, exc_type, exc, tb):
+        if self._job.running:
+            self._job.finish("finished" if exc_type is None else "failed")
+        return False

py/api/lora_integration.py

@@ -5,12 +5,47 @@ from pathlib import Path
 
 from aiohttp import web
 
+from ..config_store import ConfigUnreadable, RevisionConflict, get_config_store
+from .jobs import LORA_IMPORT_JOB_KIND
+
+# Flags of POST /lora/enable; each must be a JSON boolean when present.
+_LORA_FLAGS = ("enabled", "trigger_words_enabled", "clear_civitai_api_key")
+
 _LORA_PATH_ERROR = (
     "LoraManager path must be a directory under ComfyUI's custom_nodes "
     "whose name contains 'lora'"
 )
 
 
+def _lora_settings_mutation(values):
+    """The config commit for a LoRA save: only ``integrations.lora_manager``.
+
+    The submitted keys replace their values; other LoRA keys, other
+    integrations and every other section stay as they are on disk.
+    """
+
+    def mutate(config):
+        integrations = config.get("integrations")
+        integrations = dict(integrations) if isinstance(integrations, dict) else {}
+        lora = integrations.get("lora_manager")
+        lora = dict(lora) if isinstance(lora, dict) else {}
+        lora.update(values)
+        integrations["lora_manager"] = lora
+        config["integrations"] = integrations
+        return config
+
+    return mutate
+
+
+def _lora_error_frame(message):
+    """An import stream's error event, as the admin page's modal reads it.
+
+    The modal shows ``status`` and ``progress`` from every frame and closes
+    on ``type: error``, naming ``message``.
+    """
+    return {"type": "error", "status": message, "progress": 0, "message": message}
+
+
 class LoraIntegrationMixin:
     """Mixin providing LoraManager detection, scanning, and trigger word endpoints."""
 
@@ -131,14 +166,25 @@ class LoraIntegrationMixin:
         return allowed, None
 
     async def lora_enable(self, request):
-        """Enable or disable LoraManager integration and save to config.json."""
+        """Enable or disable LoraManager integration and save it to config.json.
+
+        The values are committed through the config store first (#220) and
+        published at runtime only once config.json holds them; a save that
+        cannot be written reports ``persisted: false`` and changes nothing.
+        The CivitAI key is never echoed back.
+        """
         try:
-            data = await request.json()
+            data, error = await self._read_json_body(request)
+            if error is not None:
+                return error
+            for flag in _LORA_FLAGS:
+                if flag in data and not isinstance(data[flag], bool):
+                    return self._bad_lora_request(f"{flag} must be true or false")
             enabled = data.get("enabled", False)
             path = data.get("path", "")
             trigger_words = data.get("trigger_words_enabled", False)
 
-            from ..config import IntegrationConfig, PromptManagerConfig
+            from ..config import IntegrationConfig
             from ..lora_utils import get_trigger_cache
 
             # The key is never echoed back to the UI, so a blank or absent
@@ -161,20 +207,40 @@ class LoraIntegrationMixin:
                 if error is not None:
                     return error
 
-            # Update in-memory config
-            IntegrationConfig.LORA_MANAGER_ENABLED = enabled
-            IntegrationConfig.LORA_MANAGER_PATH = path
-            IntegrationConfig.LORA_TRIGGER_WORDS_ENABLED = trigger_words
-            IntegrationConfig.CIVITAI_API_KEY = civitai_key
+            values = {
+                "enabled": enabled,
+                "path": path,
+                "trigger_words_enabled": trigger_words,
+                "civitai_api_key": civitai_key,
+            }
 
-            # Persist to the configured config.json
-            PromptManagerConfig.save_to_file()
+            def publish(_config):
+                # Under the commit lock, so the last save written is the one
+                # the runtime keeps.
+                IntegrationConfig.LORA_MANAGER_ENABLED = enabled
+                IntegrationConfig.LORA_MANAGER_PATH = path
+                IntegrationConfig.LORA_TRIGGER_WORDS_ENABLED = trigger_words
+                IntegrationConfig.CIVITAI_API_KEY = civitai_key
+
+            try:
+                _saved, revision = await self._run_in_executor(
+                    get_config_store().commit,
+                    _lora_settings_mutation(values),
+                    expected_revision=None,
+                    publish=publish,
+                )
+            except (ConfigUnreadable, RevisionConflict, OSError) as exc:
+                return self._config_commit_failure(exc)
 
-            # Load trigger word cache if enabling
             cache = get_trigger_cache()
             if enabled and trigger_words and path:
-                count = await self._run_in_executor(cache.load, path)
-                self.logger.info(f"Trigger word cache loaded: {count} LoRAs")
+                try:
+                    count = await self._run_in_executor(cache.load, path)
+                    self.logger.info(f"Trigger word cache loaded: {count} LoRAs")
+                except Exception as e:
+                    # Saved and enabled; only the trigger words are missing.
+                    self.logger.warning(f"Trigger word cache could not be loaded: {e}")
+                    cache.clear()
             elif not enabled:
                 cache.clear()
 
@@ -184,6 +250,10 @@ class LoraIntegrationMixin:
                     "enabled": enabled,
                     "path": self._public_path(path),
                     "trigger_words_enabled": trigger_words,
+                    "persisted": True,
+                    "revision": revision,
+                    "runtime_applied": True,
+                    "cache_loaded": cache.is_loaded,
                 }
             )
         except Exception as e:
@@ -218,19 +288,33 @@ class LoraIntegrationMixin:
                 reason="OK",
                 headers={"Content-Type": "text/event-stream"},
             )
-            await response.prepare(request)
 
             async def send_progress(data):
                 line = f"data: {json.dumps(data)}\n\n"
                 await response.write(line.encode("utf-8"))
 
-            try:
-                await self._lora_scan_stream(allowed, send_progress)
-            except Exception as e:
-                self.logger.exception("LoRA scan failed")
-                await send_progress({"type": "error", "message": self._public_error(e)})
+            # The import replaces prompts and images: a records hold, so it
+            # never runs beside a scan, restore or tagging job.
+            busy = self._jobs.blocker(LORA_IMPORT_JOB_KIND, admission="records")
+            if busy is not None:
+                await response.prepare(request)
+                message = f"{busy.title} already running"
+                await send_progress(_lora_error_frame(message))
+                await response.write_eof()
+                return response
 
-            await response.write_eof()
+            async with self._jobs.hold(
+                LORA_IMPORT_JOB_KIND, "LoRA import (admin page)", admission="records"
+            ) as job:
+                await response.prepare(request)
+                try:
+                    await self._lora_scan_stream(allowed, send_progress)
+                except Exception as e:
+                    self.logger.exception("LoRA scan failed")
+                    job.finish("failed")
+                    await send_progress(_lora_error_frame(self._public_error(e)))
+
+                await response.write_eof()
             return response
 
         except Exception as e:

py/api/settings_routes.py

@@ -0,0 +1,339 @@
+"""Settings API routes: GET and POST /prompt_manager/settings (#220).
+
+A save validates the payload, commits it to config.json through the config
+store and publishes it at runtime inside that commit; a save that cannot be
+written changes nothing at runtime and says so. ``_config_commit_failure``
+is shared with the LoRA integration's save.
+"""
+
+import os
+
+from aiohttp import web
+
+from ..config_store import (
+    ConfigUnreadable,
+    RevisionConflict,
+    get_config_store,
+)
+from .admin import _current_image_monitor
+
+try:
+    from ...utils.validators import validate_result_timeout, validate_worker_threads
+except ImportError:
+    from utils.validators import validate_result_timeout, validate_worker_threads
+
+
+# Settings owned by POST /settings: config attribute -> (section, key).
+_SETTINGS_FILE_KEYS = {
+    "RESULT_TIMEOUT": ("web_ui", "result_timeout"),
+    "WEBUI_DISPLAY_MODE": ("web_ui", "webui_display_mode"),
+    "INFINITE_SCROLL": ("web_ui", "infinite_scroll"),
+    "WORKER_THREADS": ("performance", "worker_threads"),
+}
+
+
+def _section(config, name):
+    """``config[name]`` as a fresh dict (a non-object section starts empty)."""
+    value = config.get(name)
+    return dict(value) if isinstance(value, dict) else {}
+
+
+def _settings_mutation(updates, new_roots):
+    """The config commit for a settings save: only the submitted keys change.
+
+    Every other section and key (integrations and the CivitAI key, database,
+    unknown sections) is kept as it is on disk.
+    """
+
+    def mutate(config):
+        for name, value in updates.items():
+            section, key = _SETTINGS_FILE_KEYS[name]
+            merged = _section(config, section)
+            merged[key] = value
+            config[section] = merged
+        if new_roots is not None:
+            gallery = _section(config, "gallery")
+            monitoring = _section(gallery, "monitoring")
+            monitoring["directories"] = list(new_roots)
+            gallery["monitoring"] = monitoring
+            config["gallery"] = gallery
+        return config
+
+    return mutate
+
+
+async def _read_json(request):
+    """Parse a JSON object body through the package's capped reader."""
+    from . import _read_json_body
+
+    return await _read_json_body(request)
+
+
+class SettingsRoutesMixin:
+    """Mixin providing the settings read and save endpoints."""
+
+    def _register_settings_routes(self, routes):
+        @routes.get("/prompt_manager/settings")
+        async def get_settings_route(request):
+            return await self.get_settings(request)
+
+        @routes.post("/prompt_manager/settings")
+        async def save_settings_route(request):
+            return await self.save_settings(request)
+
+    async def get_settings(self, request):
+        """Get current settings."""
+        try:
+            from ..config import PromptManagerConfig, GalleryConfig
+
+            root_paths = [
+                self._public_path(d) for d in GalleryConfig.MONITORING_DIRECTORIES
+            ]
+            revision = await self._run_in_executor(self._config_revision)
+            return web.json_response(
+                {
+                    "success": True,
+                    **revision,
+                    "settings": {
+                        "result_timeout": PromptManagerConfig.RESULT_TIMEOUT,
+                        "webui_display_mode": PromptManagerConfig.WEBUI_DISPLAY_MODE,
+                        "infinite_scroll": PromptManagerConfig.INFINITE_SCROLL,
+                        "worker_threads": PromptManagerConfig.WORKER_THREADS,
+                        "cpu_count": PromptManagerConfig.max_worker_threads(),
+                        "gallery_root_paths": root_paths,
+                        "gallery_root_path": root_paths[0] if root_paths else "",
+                        "monitored_directories": [
+                            self._public_path(d) for d in self._monitored_directories()
+                        ],
+                    },
+                }
+            )
+        except Exception as e:
+            self.logger.error(f"Get settings error: {e}", exc_info=True)
+            return web.json_response(
+                {"success": False, "error": "Failed to get settings"},
+                status=500,
+            )
+
+    def _monitored_directories(self):
+        """Directories the running image monitor watches, else the configured roots."""
+        from ..config import GalleryConfig
+
+        monitor = _current_image_monitor()
+        if monitor is not None:
+            return list(getattr(monitor, "monitored_directories", []))
+        return list(GalleryConfig.MONITORING_DIRECTORIES)
+
+    async def save_settings(self, request):
+        """Save settings: validate, commit to config.json, then publish (#220).
+
+        Nothing changes at runtime until config.json holds the new values, so
+        a save that cannot be written reports ``persisted: false`` and leaves
+        the running settings as they were. ``expected_revision`` (the
+        ``revision`` from GET) refuses to overwrite a file changed meanwhile;
+        without it the payload merges into what is on disk (legacy page).
+        """
+        try:
+            data, error_response = await _read_json(request)
+            if error_response is not None:
+                return error_response
+
+            expected_revision = data.get("expected_revision")
+            if expected_revision is not None and not isinstance(expected_revision, str):
+                return web.json_response(
+                    {"success": False, "error": "expected_revision must be a string"},
+                    status=400,
+                )
+            try:
+                updates = self._validate_settings(data)
+            except ValueError as ve:
+                return web.json_response(
+                    {"success": False, "error": str(ve)}, status=400
+                )
+
+            new_roots, error = self._parse_gallery_roots(data)
+            if error:
+                return web.json_response({"success": False, "error": error}, status=400)
+
+            published = {}
+
+            def publish(_config):
+                # Under the commit lock: saves reach the runtime in the order
+                # they were written, so the runtime ends on the last one.
+                published.update(self._publish_settings(updates, new_roots))
+
+            try:
+                _saved, revision = await self._run_in_executor(
+                    get_config_store().commit,
+                    _settings_mutation(updates, new_roots),
+                    expected_revision=expected_revision,
+                    publish=publish,
+                )
+            except (ConfigUnreadable, RevisionConflict, OSError) as exc:
+                return self._config_commit_failure(exc)
+
+            return web.json_response(
+                {
+                    "success": True,
+                    "message": "Settings saved successfully",
+                    "restart_required": bool(published["restart_required_fields"]),
+                    "persisted": True,
+                    "revision": revision,
+                    **published,
+                }
+            )
+        except Exception as e:
+            self.logger.error(f"Save settings error: {e}", exc_info=True)
+            return web.json_response(
+                {"success": False, "error": "Failed to save settings"},
+                status=500,
+            )
+
+    def _publish_settings(self, updates, new_roots):
+        """Install committed settings at runtime (inside the config commit).
+
+        The values are already durable. A publication that fails is reported
+        as ``runtime_applied: false`` with the fields that need a restart;
+        nothing is retried or rolled back. Never raises.
+        """
+        from ..config import PromptManagerConfig
+
+        for name, value in updates.items():
+            setattr(PromptManagerConfig, name, value)
+        restart_fields = []
+        runtime_applied = True
+        if new_roots is not None:
+            try:
+                if self._apply_gallery_roots(new_roots):
+                    restart_fields.append("gallery_root_paths")
+            except Exception as e:
+                self.logger.error(
+                    f"Saved gallery roots could not be applied: {e}", exc_info=True
+                )
+                runtime_applied = False
+                restart_fields.append("gallery_root_paths")
+        return {
+            "runtime_applied": runtime_applied,
+            "restart_required_fields": restart_fields,
+        }
+
+    def _config_commit_failure(self, exc):
+        """The response for a config commit that wrote nothing."""
+        not_saved = {"success": False, "persisted": False, "runtime_applied": False}
+        if isinstance(exc, ConfigUnreadable):
+            self.logger.warning(f"Settings not saved: {exc}")
+            return web.json_response(
+                {
+                    **not_saved,
+                    "code": "config-unreadable",
+                    "error": (
+                        "config.json cannot be read, so nothing was saved. "
+                        "Fix or remove the file, then save again."
+                    ),
+                },
+                status=409,
+            )
+        if isinstance(exc, RevisionConflict):
+            return web.json_response(
+                {
+                    **not_saved,
+                    "code": "settings-changed",
+                    "error": "Settings changed since they were loaded. Reload them.",
+                    "revision": exc.current,
+                },
+                status=409,
+            )
+        self.logger.error(f"Could not write config.json: {exc}")
+        return web.json_response(
+            {
+                **not_saved,
+                "code": "config-write-failed",
+                "error": "Settings could not be written to config.json.",
+            },
+            status=500,
+        )
+
+    @staticmethod
+    def _config_revision():
+        """``{"revision": ...}``, or a null revision with ``config_error``."""
+        try:
+            _data, revision = get_config_store().read()
+        except ConfigUnreadable:
+            return {"revision": None, "config_error": "config-unreadable"}
+        return {"revision": revision}
+
+    @staticmethod
+    def _validate_settings(data):
+        """Scalar settings of a payload as ``{CONFIG_ATTR: value}``.
+
+        Raises ValueError with a user-facing message on the first bad value;
+        nothing is applied until every value passed.
+        """
+        from ..config import PromptManagerConfig
+
+        updates = {}
+        if "result_timeout" in data:
+            updates["RESULT_TIMEOUT"] = validate_result_timeout(data["result_timeout"])
+        if "webui_display_mode" in data:
+            mode = data["webui_display_mode"]
+            if mode not in ("popup", "newtab"):
+                raise ValueError("webui_display_mode must be 'popup' or 'newtab'")
+            updates["WEBUI_DISPLAY_MODE"] = mode
+        if "infinite_scroll" in data:
+            if not isinstance(data["infinite_scroll"], bool):
+                raise ValueError("infinite_scroll must be true or false")
+            updates["INFINITE_SCROLL"] = data["infinite_scroll"]
+        if "worker_threads" in data:
+            updates["WORKER_THREADS"] = validate_worker_threads(
+                data["worker_threads"], PromptManagerConfig.max_worker_threads()
+            )
+        return updates
+
+    def _parse_gallery_roots(self, data):
+        """Extract and validate gallery roots from a settings payload.
+
+        Accepts ``gallery_root_paths`` (list, preferred) or the legacy single
+        ``gallery_root_path`` string. Blank entries are dropped.
+
+        Returns:
+            (roots, error): ``roots`` is the validated list, or ``None`` when
+            the payload carries no gallery root key; ``error`` is a message
+            when validation failed (and ``roots`` is then ``None``).
+        """
+        if "gallery_root_paths" in data:
+            raw = data["gallery_root_paths"]
+            if not isinstance(raw, list):
+                return None, "gallery_root_paths must be a list"
+        elif "gallery_root_path" in data:
+            raw = [data["gallery_root_path"]]
+        else:
+            return None, None
+
+        from ..config import GalleryConfig
+
+        roots = []
+        for entry in raw:
+            if not isinstance(entry, str):
+                return None, "Gallery root paths must be strings"
+            entry = entry.strip()
+            if not entry:
+                continue
+            ok, reason = GalleryConfig.validate_gallery_root(entry)
+            if not ok:
+                return (
+                    None,
+                    f"Invalid gallery root '{os.path.basename(entry)}': {reason}",
+                )
+            roots.append(GalleryConfig.resolve_gallery_root(entry))
+        return roots, None
+
+    def _apply_gallery_roots(self, roots):
+        """Install validated gallery roots; returns True when they changed."""
+        from ..config import GalleryConfig
+
+        if roots == list(GalleryConfig.MONITORING_DIRECTORIES):
+            return False
+        GalleryConfig.MONITORING_DIRECTORIES = roots
+        self._cached_output_dir = None
+        self.reset_gallery_roots_cache()
+        return True

py/config_store.py

@@ -0,0 +1,197 @@
+"""The one serialized writer of config.json (#220).
+
+Every save that changes config.json goes through ``ConfigStore.commit``: the
+settings page, the LoRA integration and, later, every System section. A
+commit runs under one process-wide lock, re-reads the file inside it, applies
+the caller's change to a copy and replaces the file atomically. So two saves
+never overwrite each other's keys, sections this process does not know are
+kept byte-for-byte in meaning, and a write that fails leaves the old file in
+place and raises instead of being logged and reported as saved.
+
+A revision names the file content a client last saw: ``"sha256:<hex>"`` of
+the file bytes, or ``"absent"`` when there is no file. A commit that names a
+revision refuses to write over different content (``RevisionConflict``).
+
+Reads take the same lock, so a read handle is never open while the file is
+replaced (Windows refuses that), and a caller's ``publish`` runs inside the
+lock right after its write, so runtimes publish saves in the order they were
+written. A symlinked config.json is written beside its real target.
+
+config.json can hold the CivitAI key, so the file is written owner-only.
+"""
+
+import copy
+import hashlib
+import json
+import os
+import tempfile
+import threading
+import time
+from typing import Callable, Optional, Tuple
+
+ABSENT_REVISION = "absent"
+
+# One lock for the process: every ConfigStore writes the same file. It is
+# re-entrant so a commit's ``publish`` callback may read the config again.
+_COMMIT_LOCK = threading.RLock()
+
+# Windows: an antivirus, indexer or backup handle on config.json makes
+# os.replace fail with PermissionError for a moment, so it is retried briefly.
+_REPLACE_ATTEMPTS = 5 if os.name == "nt" else 1
+_REPLACE_BACKOFF_SECONDS = 0.05
+
+
+class ConfigUnreadable(Exception):
+    """config.json exists but is not a readable JSON object; it is left alone."""
+
+
+class RevisionConflict(Exception):
+    """config.json changed since the revision the caller saw."""
+
+    def __init__(self, current: str):
+        super().__init__("config.json changed since it was read")
+        self.current = current
+
+
+def revision_of(data: Optional[bytes]) -> str:
+    """The revision of a file's bytes; ``None`` means the file is absent."""
+    if data is None:
+        return ABSENT_REVISION
+    return "sha256:" + hashlib.sha256(data).hexdigest()
+
+
+def _default_path() -> str:
+    from .config import PromptManagerConfig
+
+    return PromptManagerConfig.get_config_path()
+
+
+def _replace(source: str, target: str) -> None:
+    """``os.replace`` with a short retry on a transient Windows PermissionError."""
+    for attempt in range(1, _REPLACE_ATTEMPTS + 1):
+        try:
+            os.replace(source, target)
+            return
+        except PermissionError:
+            if attempt == _REPLACE_ATTEMPTS:
+                raise
+            time.sleep(_REPLACE_BACKOFF_SECONDS)
+
+
+def _write_atomically(path: str, payload: bytes) -> None:
+    """Replace ``path`` with ``payload``: temp file beside it, fsync, replace.
+
+    The descriptor is closed before ``os.replace`` (Windows refuses to replace
+    over an open handle), and on any failure the temp file is closed and
+    removed, so a failed write leaves the old file and no stray temp file.
+    ``path`` is resolved first: a symlink keeps pointing at the updated
+    target. A single-file bind mount cannot be replaced (EBUSY) and fails as
+    an OSError, which callers report as not saved.
+    """
+    path = os.path.realpath(path)
+    parent = os.path.dirname(path) or "."
+    os.makedirs(parent, exist_ok=True)
+    fd, temp_path = tempfile.mkstemp(dir=parent, prefix=".config-", suffix=".tmp")
+    try:
+        try:
+            handle = os.fdopen(fd, "wb")
+        except BaseException:
+            os.close(fd)
+            raise
+        with handle:  # closed before the replace, also when a write fails
+            handle.write(payload)
+            handle.flush()
+            os.fsync(handle.fileno())
+        if os.name == "posix":
+            os.chmod(temp_path, 0o600)
+        _replace(temp_path, path)
+    except BaseException:
+        try:
+            os.unlink(temp_path)
+        except OSError:
+            pass
+        raise
+
+
+class ConfigStore:
+    """Serialized, atomic reads and commits of config.json."""
+
+    def __init__(self, path_getter: Optional[Callable[[], str]] = None):
+        self._path_getter = path_getter or _default_path
+
+    @property
+    def path(self) -> str:
+        """The config file this store reads and writes (resolved per call)."""
+        return self._path_getter()
+
+    def read(self) -> Tuple[dict, str]:
+        """``(config, revision)``; a missing file is ``({}, "absent")``.
+
+        Raises ConfigUnreadable when the file cannot be read, is not JSON, or
+        is not a JSON object. Waits for a running commit (see the module
+        docstring).
+        """
+        with _COMMIT_LOCK:
+            return self._read(self.path)
+
+    @staticmethod
+    def _read(path: str) -> Tuple[dict, str]:
+        try:
+            with open(path, "rb") as handle:
+                raw = handle.read()
+        except (FileNotFoundError, NotADirectoryError):
+            # No file there (a parent that is a file cannot hold one either);
+            # a commit then fails on the write, as config-write-failed.
+            return {}, ABSENT_REVISION
+        except OSError as exc:
+            raise ConfigUnreadable(f"config.json cannot be read: {exc}") from exc
+        try:
+            data = json.loads(raw.decode("utf-8"))
+        except (UnicodeDecodeError, ValueError) as exc:
+            raise ConfigUnreadable("config.json is not valid JSON") from exc
+        if not isinstance(data, dict):
+            raise ConfigUnreadable("config.json is not a JSON object")
+        return data, revision_of(raw)
+
+    def commit(
+        self,
+        mutate: Callable[[dict], dict],
+        *,
+        expected_revision: Optional[str],
+        publish: Optional[Callable[[dict], None]] = None,
+    ) -> Tuple[dict, str]:
+        """Apply ``mutate`` to the current config and write the result.
+
+        ``mutate`` receives a deep copy of the file's content and returns the
+        whole new config (an object). ``expected_revision`` None merges into
+        whatever is on disk (legacy partial updates); a revision refuses to
+        write over different content. Returns ``(config, revision)`` as
+        written. Raises ConfigUnreadable, RevisionConflict, TypeError (a
+        non-object result) or OSError (the write failed; the old file stays).
+
+        ``publish(config)``, when given, runs under the lock once the file
+        holds the new config, so concurrent saves reach the runtime in the
+        order they were written. It must handle its own errors: the values
+        are already durable when it runs.
+        """
+        with _COMMIT_LOCK:
+            path = self.path
+            current, revision = self._read(path)
+            if expected_revision is not None and expected_revision != revision:
+                raise RevisionConflict(revision)
+            candidate = mutate(copy.deepcopy(current))
+            if not isinstance(candidate, dict):
+                raise TypeError("A config commit must produce a JSON object")
+            payload = json.dumps(candidate, indent=2).encode("utf-8")
+            _write_atomically(path, payload)
+            if publish is not None:
+                publish(candidate)
+            return candidate, revision_of(payload)
+
+
+_store = ConfigStore()
+
+
+def get_config_store() -> ConfigStore:
+    """The process's config store (on ``PromptManagerConfig.get_config_path``)."""
+    return _store

tests/browser/activity-concept.spec.mjs

@@ -249,14 +249,16 @@ const EXPECTED_JOB_VIEW = {
     pressed: { border: true, background: true, added: true, bad: true, warn: true },
 };
 
-async function openRunningJob(page, request, theme, viewport = { width: 1600, height: 1100 }) {
+const SCAN_START = { start: { total: 19622 }, step: { processed: 8240,
+    counters: { known: 6511, review: 37, no_metadata: 254, errors: 18 },
+    records: [{ group: 'added', path: 'CCC/mabes9sans-dataset-v1/IMG_GEN_00369_.png', detail: 'Added to the Library as “Mabes portrait”' }] } };
+
+async function openRunningJob(page, request, theme, viewport = { width: 1600, height: 1100 }, data = SCAN_START) {
     await page.setViewportSize(viewport);
-    const started = await request.post('/__test__/jobs/start', { data: { total: 19622 } });
+    const started = await request.post('/__test__/jobs/start', { data: data.start });
     await expect(started).toBeOK();
     const { job } = await started.json();
-    await expect(await request.post(`/__test__/jobs/${job.id}/step`, { data: { processed: 8240,
-        counters: { known: 6511, review: 37, no_metadata: 254, errors: 18 },
-        records: [{ group: 'added', path: 'CCC/mabes9sans-dataset-v1/IMG_GEN_00369_.png', detail: 'Added to the Library as “Mabes portrait”' }] } })).toBeOK();
+    await expect(await request.post(`/__test__/jobs/${job.id}/step`, { data: data.step })).toBeOK();
     await openProduction(page, `activity/${job.id}`, theme);
     await expect(page.locator('#workspace-main .file-row')).toHaveCount(1);
     return job;
@@ -278,6 +280,30 @@ for (const theme of THEMES) test(`job view follows the approved mockup ${theme}`
     expect(await page.evaluate(measureJobView)).toEqual(EXPECTED_JOB_VIEW);
 });
 
+// D89 (plan D66): an image tagging job's view is the same mockup with its own four tiles (Tagged green, Unchanged,
+// Skipped warning, Errors red) in the mockup's five-column row, its own outcome list and "Tagging log".
+const TAG_START = { start: { kind: 'image-tags', title: 'Auto-tag images', mode: 'auto', images: 4, total: 4 }, step: { processed: 2,
+    counters: { unchanged: 1, errors: 1 }, records: [{ group: 'tagged', path: 'CCC/mabes9sans-dataset-v1/IMG_GEN_00369_.png', detail: 'Added 3 tags' }] } };
+const EXPECTED_TAG_VIEW = {
+    ...EXPECTED_JOB_VIEW,
+    progress: [MOCKUP_PROGRESS[0], MOCKUP_PROGRESS[1], 'dl.stat-row(div.added.stat,div.stat,div.stat.warn,div.bad.stat)'],
+    summary: '● Tagging log — raw detail, click to show',
+};
+
+for (const theme of THEMES) test(`image tagging job view follows the approved mockup ${theme}`, async ({ page, request }) => {
+    await seedConcept(request);
+    await openRunningJob(page, request, theme, undefined, TAG_START);
+    expect(await page.evaluate(measureJobView)).toEqual(EXPECTED_TAG_VIEW);
+    await expect(page.locator('#workspace-main .outcome-list > button')).toHaveText(['Tagged1', 'Errors1', 'Skipped0', 'Unchanged1']);
+    // Mutation check: the scan's five tiles and the scan's log label are both noticed.
+    expect(diffInventory(EXPECTED_JOB_VIEW, await page.evaluate(measureJobView)).map(item => item.path).sort())
+        .toEqual(['progress.2', 'summary']);
+    const undoCss = await mutate(page, { css: '#workspace-main .stat-row .stat.warn dd { color: red; }' });
+    expect(diffInventory(EXPECTED_TAG_VIEW, await page.evaluate(measureJobView)).map(item => item.path)).toEqual(['pressed.warn']);
+    await undoCss();
+    expect(await page.evaluate(measureJobView)).toEqual(EXPECTED_TAG_VIEW);
+});
+
 test('job view fits a phone without page scroll', async ({ page, request }) => {
     await seedConcept(request);
     await openRunningJob(page, request, 'dark', { width: 390, height: 844 });

tests/browser/concept-inventory.mjs

@@ -78,6 +78,34 @@ export async function seedConcept(request,data={}) {
     return response.json();
 }
 
+/**
+ * Seed the concept fixture and fix the browser's clock at the fixture's own instant (`manifest.now`), so the page and
+ * the fixture read one "now": a prompt used now reads "Used today" and the caption names the fixture's day even when
+ * the run crosses midnight between seeding and rendering. Timers keep running; only `Date` stands still.
+ */
+export async function seedConceptAt(page,request,data={}) {
+    const manifest=await seedConcept(request,data);
+    await page.clock.setFixedTime(new Date(manifest.now*1000));
+    return manifest;
+}
+
+/**
+ * Save `tags` as the current image tag set of the listed file at `path` (root 0) through the real observe and tag
+ * routes (#249 PR C), releasing the capture afterwards; returns the receipt's saved names.
+ */
+export async function saveImageTags(request,path,tags) {
+    const listing=await (await request.get('/prompt_manager/images/output?mode=workspace&limit=40')).json();
+    const target={root_index:0,root_scope:listing.images.find(item=>item.root_index===0).root_scope,path};
+    const observed=await (await request.post('/prompt_manager/image-annotations/observe',{data:{target}})).json();
+    expect(observed.success).toBe(true);
+    try {
+        const receipt=await (await request.put('/prompt_manager/image-annotations/tags',{data:{target,capture_token:observed.capture.token,
+            sha256:observed.capture.sha256,expected_epoch:observed.library_epoch,expected_tag_revision:observed.tag_revision,tags}})).json();
+        expect(receipt.success).toBe(true);
+        return receipt.tags;
+    } finally {await request.delete(`/prompt_manager/image-annotations/capture/${observed.capture.token}`);}
+}
+
 async function selectTheme(page,theme) {
     await page.getByRole('combobox',{name:'Theme',exact:true}).selectOption(theme);
 }
@@ -121,10 +149,12 @@ export async function hoverStateOf(page,locator) {
 /**
  * Mutate the open page so a comparison can be shown to notice a change (the A7 mutation check): `css` is appended as
  * the last stylesheet, so it wins over equally specific concept rules, and every element matching a `remove` selector
- * is detached. Returns an async undo that restores the stylesheet and the removed elements in place.
+ * is detached; each `clone` ({selector, text}) inserts a copy of the first match after it, holding `text` and no
+ * `data-action` (a control production adds beside a concept one, D85). Returns an async undo that restores the
+ * stylesheet and the removed elements in place and drops the copies.
  */
-export async function mutate(page,{css=null,remove=[]}={}) {
-    const token=await page.evaluate(({css,remove})=>{
+export async function mutate(page,{css=null,remove=[],clone=[]}={}) {
+    const token=await page.evaluate(({css,remove,clone})=>{
         const token=`mutation-${Math.random().toString(36).slice(2)}`;
         const undo=[];
         if(css) {
@@ -139,9 +169,15 @@ export async function mutate(page,{css=null,remove=[]}={}) {
                 node.remove();undo.push(()=>parent.insertBefore(node,next));
             }
         }
+        for(const {selector,text} of clone) {
+            const node=document.querySelector(selector);
+            if(!node)throw new Error(`mutate: nothing matches ${selector}`);
+            const copy=node.cloneNode(true);copy.textContent=text;copy.removeAttribute('data-action');
+            node.after(copy);undo.push(()=>copy.remove());
+        }
         (window.__conceptMutations??=new Map()).set(token,undo);
         return token;
-    },{css,remove});
+    },{css,remove,clone});
     return ()=>page.evaluate(token=>{
         const undo=window.__conceptMutations?.get(token);
         if(!undo)throw new Error('mutate: this mutation was already undone or the page reloaded');

tests/browser/full-inspector.spec.mjs

@@ -92,7 +92,7 @@ test('inspection wire preserves exact rooted envelope', async ({ request }) => {
 const inspector=page=>page.locator('.detail-panel');
 /** D19: the selected card's image opens the viewer (the side panel has no full-preview cover). */
 const openSelected=page=>page.locator('.media-card.selected .image-open').click();
-const selectFile=async(page,name,root=0)=>page.locator(`article[data-image-key="${root}:inspector/${name}"] .image-card-actions button`).click();
+const selectFile=async(page,name,root=0)=>page.locator(`article[data-image-key="${root}:inspector/${name}"] .image-card-actions button:first-child`).click();
 async function fullFixture(page,request) {
     await expect(await request.post('/__test__/reset',{data:{full_inspector:true}})).toBeOK();
     await page.goto('/prompt_manager/workspace#/images');await selectFile(page,'complete.png');
@@ -237,9 +237,12 @@ const viewerStructure=details=>details.evaluate(node=>{
 test('viewer details hold provenance, raw records and downloads',async({page,request})=>{
     await page.setViewportSize({width:1600,height:1100});const reads=await patchInspection(page);
     await fullFixture(page,request);let details=await viewerDetails(page,'complete.png');
-    // The panel content without the cover, then the two disclosures, then the pair send and history buttons (D20).
+    // The panel content without the cover, D117's Copy settings summary after the facts, then the two disclosures,
+    // then the pair send and history buttons (D20).
     expect(await viewerStructure(details)).toEqual({outer:['div','button.send','button'],
-        inner:['div.panel-heading','p.small','div.tags','section.prompt-section.positive','section.prompt-section.negative','div.tags','dl.meta-grid','details','details']});
+        inner:['div.panel-heading','p.small','div.tags','section.prompt-section.positive','section.prompt-section.negative','div.tags','dl.meta-grid','button.settings-summary','details','details']});
+    await expect(details.locator(':scope > div > button')).toHaveText('Copy settings summary');
+    await expect(details.locator(':scope > div > button.settings-summary')).toHaveCSS('white-space','normal');
     await expect(details.locator('.detail-cover,.detail-inner,.detail-footer')).toHaveCount(0);
     await expect(details.locator('.panel-heading h2')).toHaveText(POSITIVE_TITLE);await expect(details.locator('.panel-heading .chip')).toHaveText('PNG');
     await expect(details.locator(':scope > div > p.small')).toHaveText('complete.png');
@@ -460,7 +463,7 @@ test('full inspector labels container representations and releases action URLs',
 test('full inspector distinguishes missing, limited and legacy unknown generation facts',async({page,request})=>{
     await fullFixture(page,request);const panel=inspector(page);
     await selectFile(page,'empty.png');await expect(panel.locator('.meta-grid dd')).toHaveText(Array(6).fill('Not recorded'));
-    await page.locator('article[data-image-key="0:architecture/study-01.png"] .image-card-actions button').click();await expect(panel.locator('.meta-grid dd')).toHaveText(Array(6).fill('Not recorded'));
+    await page.locator('article[data-image-key="0:architecture/study-01.png"] .image-card-actions button:first-child').click();await expect(panel.locator('.meta-grid dd')).toHaveText(Array(6).fill('Not recorded'));
     await selectFile(page,'control-heavy.png');
     const explanation='Configuration exceeds inspection limits; download the original file to inspect it locally.';
     await expect(panel.getByText(explanation,{exact:true})).toHaveCount(1);await expect(panel.getByText(explanation,{exact:true})).toBeVisible();
@@ -637,7 +640,7 @@ test('collection viewer follows filtered loaded order beyond mounted cards',asyn
     // #249 D26: the whole positive's images are in the All images dialog's own embedded gallery.
     await page.getByRole('button',{name:'All images for this positive',exact:true}).click();
     const listing=page.getByRole('dialog',{name:'All images for this positive',exact:true});
-    await listing.locator('article[data-image-key="0:inspector/complete.png"] .image-card-actions button').click();
+    await listing.locator('article[data-image-key="0:inspector/complete.png"] .image-card-actions button:first-child').click();
     await listing.locator('.media-card.selected .image-open').click();await expect(mediaDialog(page).locator('.viewer-canvas img')).toBeVisible();
     await expect(position(page)).toContainText('of 2 loaded:');
 });
@@ -930,7 +933,7 @@ test('collection viewer matches approved responsive frame',async({page,request},
     await page.screenshot({path:testInfo.outputPath('viewer-mobile-wider-font-2x.png')});
     await modal.getByRole('button',{name:'Close image viewer',exact:true}).click();await page.evaluate(()=>{document.documentElement.style.zoom='1';});await settleViewport(390);
     const longFiles=await(await request.get('/prompt_manager/images/output?mode=workspace&q=a-very-long&limit=40')).json();const long=longFiles.images[0];
-    await page.locator(`article[data-image-key="${long.root_index}:${long.path}"] .image-card-actions button`).click();await openCollection(page);
+    await page.locator(`article[data-image-key="${long.root_index}:${long.path}"] .image-card-actions button:first-child`).click();await openCollection(page);
     await page.evaluate(()=>{document.documentElement.style.zoom='2';});await settleViewport(390);await modal.evaluate(node=>{node.scrollTop=0;});
     await expect(modal.getByRole('button',{name:'Close image viewer',exact:true})).toBeInViewport();
 });

tests/browser/history-canonical-comparison.mjs

@@ -17,7 +17,6 @@ export const canonicalDifferences = {
     // Closed by #249: the gallery's checkbox is Images-only (#259) and the role blocks are the concept's (PR D, F); the
     // exact history comparison is tests/browser/history-concept.spec.mjs.
     remainingApplicationPolish: [
-        'Gallery card tag button (#249 D9, image-annotations slice) remains outside #209',
         'Production keeps mobile toolbar inside media panel and readable scrolling details; the concept toolbar collision is not reproduced',
     ],
 };

tests/browser/images-concept.spec.mjs

@@ -1,7 +1,7 @@
 import {writeFile} from 'node:fs/promises';
 import {test,expect} from './fixtures.mjs';
 import {captureCanonicalState} from './history-canonical-comparison.mjs';
-import {SIZES,THEMES,MOTIONS,seedConcept,openConcept,openProduction,inventoryOf,diffInventory,mutate,stripExact,countCopy,reflow,withoutItems} from './concept-inventory.mjs';
+import {SIZES,THEMES,MOTIONS,seedConceptAt,openConcept,openProduction,inventoryOf,diffInventory,mutate,stripExact,countCopy,reflow,withoutItems} from './concept-inventory.mjs';
 
 // Task C7 of #249: the production Images page against the immutable concept, on the concept-shaped real fixture (24
 // images of the concept's six prompts, its seeds, sizes and favorites). Heading, toolbar, filter row, caption, grid,
@@ -30,9 +30,11 @@ function captionDay(seconds,now=new Date()) {
     return `${name} · ${date.toLocaleDateString('en-US',options)}`;
 }
 
-/** D8: the selection bar's real actions only; Add tags, Add to collection and Remove links… are left out. */
-const OMITTED_BULK=Object.freeze(['Add tags','Add to collection','Remove links…']);
-const OMITTED_BULK_SELECTORS=Object.freeze(['bulk-tags','bulk-collection','bulk-remove'].map(action=>`#bulkbar [data-action="${action}"]`));
+/** D8 (amended by #249 PR D): the selection bar's real actions only; Add to collection and Remove links… are left out. */
+const OMITTED_BULK=Object.freeze(['Add to collection','Remove links…']);
+const OMITTED_BULK_SELECTORS=Object.freeze(['bulk-collection','bulk-remove'].map(action=>`#bulkbar [data-action="${action}"]`));
+/** D85: Auto-tag selected follows the concept's Add tags, a concept button of its own text. */
+const AUTO_TAG_CLONE=Object.freeze([{selector:'#bulkbar [data-action="bulk-tags"]',text:'Auto-tag selected'}]);
 
 /**
  * `withoutItems` for a row with padding and a border (the `.bulkbar`): its items flow again inside the content box,
@@ -59,12 +61,12 @@ function mapBulkbar(bulkbar,rise) {
 }
 
 /**
- * A list row's info once D9 narrows its actions to `actionsWidth`, from the concept's boxes:
+ * A list row's info with its actions `actionsWidth` wide, from the concept's boxes:
  * - D3 (the measurable list row, `.list-grid .media-info` in the overlay): the info fills the row beside the art and may
  *   shrink below a long nowrap title (`min-width: 0`), so it is the card's inner width less the art, and the actions
  *   end at its right padding; it keeps its own height (text or actions plus padding), centred in the row the concept
  *   stretches it across, so the text, centred in either, moves only by half the lines it lost;
- * - D9: the wider text column fits a subtitle the concept wrapped when its one-line width (`maxContent`) now fits.
+ * - the text column fits a subtitle the concept wrapped when its one-line width (`maxContent`) now fits.
  */
 function listInfo(card,actionsWidth) {
     const {info}=card,{copy,p}=info;
@@ -83,7 +85,7 @@ function listInfo(card,actionsWidth) {
 /** Recorded Images deviations only (spec §8); everything else in the concept inventory must equal production. */
 const nocase=(a,b)=>{const x=a.toLowerCase(),y=b.toLowerCase();return x<y?-1:x>y?1:a<b?-1:a>b?1:0;};
 
-export function mapImagesConcept(reference,{manifest,now=new Date()}) {
+export function mapImagesConcept(reference,{manifest,now=new Date(manifest.now*1000)}) {
     const paths=new Map(manifest.images.map(image=>[image.filename,image.path]));
     // D14: the sort appends production's two sorts. Save view is the concept's own (saved views, #249 D16 retired).
     const toolbar={...reference.toolbar};
@@ -109,21 +111,16 @@ export function mapImagesConcept(reference,{manifest,now=new Date()}) {
     const cards=reference.cards.map(card=>{
         const filename=card.open.label.replace(/^Open /,'');
         const actions=card.info.actions;
-        const tag=actions.buttons.find(button=>button.label?.startsWith('Tag or auto-tag '));
-        // D9: no Tag button until the image-annotations slice; the actions group narrows by its box and gap.
-        const freed=tag?tag.width+parseFloat(actions.columnGap):0;
         // D3: a list row's info keeps its own height (text or actions plus its padding) so bounded rendering can measure
         // it, centred in the row the concept stretches it across; the text and the actions keep their place.
-        const actionsWidth=actions.width-freed;
-        const listRow=list?listInfo(card,actionsWidth):{};
+        const listRow=list?listInfo(card,actions.width):{};
         return {...card,
             // D29: the concept's alt adds its demo-only " · sample illustration N" to the card title.
             img:{...card.img,alt:card.img.alt.replace(/ · sample illustration \d+$/,'')},
             info:{...card.info,...listRow.info,copy:{...card.info.copy,...listRow.copy},p:{...card.info.p,...listRow.p},
                 // D10: the title keeps the file's relative path (the fixture manifest's) in `title`.
                 h3:{...card.info.h3,title:paths.get(filename)??null},
-                actions:{...actions,width:actionsWidth,left:listRow.actionsLeft??actions.left+freed,
-                    buttons:actions.buttons.filter(button=>button!==tag)}}};
+                actions:{...actions,left:listRow.actionsLeft??actions.left}}};
     });
     // D17: the right-hand date is the newest result's day under Recently added, here the fixture's newest mtime.
     // D35: the count line uses the singular for one.
@@ -321,7 +318,7 @@ async function behaviorsOf(page,scope) {
     return {hover,opened,viewerTitle,focusAfterViewer,selected,layouts,search,single};
 }
 
-test.beforeEach(async({request},testInfo)=>{testInfo.manifest=await seedConcept(request);});
+test.beforeEach(async({page,request},testInfo)=>{testInfo.manifest=await seedConceptAt(page,request);});
 
 for(const [width,height] of SIZES)for(const theme of THEMES)test(`images page geometry, tokens, controls and behaviors match the concept ${width}x${height} ${theme}`,async({page,request},testInfo)=>{
     test.setTimeout(240_000);
@@ -351,7 +348,7 @@ for(const [width,height] of SIZES)for(const theme of THEMES)test(`images page ge
             importDiff:diffInventory(mapImportConcept(referenceImport),actualImport),referenceBehaviors,actualBehaviors};
     }
     // Load more in production: a fixture past one listing page appends one batch and shows the concept's toast.
-    testInfo.manifest=await seedConcept(request,{extra_images:LOAD_MORE_EXTRA});
+    testInfo.manifest=await seedConceptAt(page,request,{extra_images:LOAD_MORE_EXTRA});
     for(const motion of MOTIONS) {
         const total=FIXTURE_IMAGES+LOAD_MORE_EXTRA;
         await openProductionLoaded(page,theme,motion,total);
@@ -448,6 +445,10 @@ for(const [width,height] of SIZES)for(const theme of THEMES)test(`images selecti
     const restore=await mutate(page,{remove:[...OMITTED_BULK_SELECTORS]});
     const removed=(await inventoryOf(page,'#main')).bulkbar;
     await restore();
+    // The oracle for production's bar: the concept page itself without the omitted actions and with D85's button.
+    const restoreProduction=await mutate(page,{remove:[...OMITTED_BULK_SELECTORS],clone:AUTO_TAG_CLONE});
+    const oracle=await inventoryOf(page,'#main');
+    await restoreProduction();
     await captureCanonicalState(page,testInfo,`concept-images-selected-${width}-${theme}`);
     await openProductionLoaded(page,theme,'no-preference');
     const emptyActual=await inventoryOf(page,'#workspace-main');
@@ -459,12 +460,13 @@ for(const [width,height] of SIZES)for(const theme of THEMES)test(`images selecti
     expect.soft(reference.bulkbar.bar.items.map(item=>item.text),'concept bar').toEqual(['1 selected','Add tags','Set category',
         'Add to collection','Export metadata','Remove links…','Clear']);
     expect.soft(diffInventory(stripExact(mapBulkbar(reference.bulkbar,0).bulkbar.bar),stripExact(removed.bar)),'bar without the omitted actions').toEqual([]);
-    expect.soft(actual.bulkbar.bar.items.map(item=>item.text),'production bar').toEqual(['1 selected','Set category','Export metadata','Clear']);
+    expect.soft(actual.bulkbar.bar.items.map(item=>item.text),'production bar').toEqual(['1 selected','Add tags','Auto-tag selected',
+        'Set category','Export metadata','Clear']);
     expect.soft(compare(empty,emptyActual,manifest,['bulkbar','cards','panel']),'nothing checked').toEqual([]);
-    expect.soft(compare(reference,actual,manifest,['bulkbar','cards','panel']),'one card checked').toEqual([]);
+    expect.soft(compare(oracle,actual,manifest,['bulkbar','cards','panel']),'one card checked').toEqual([]);
     // The bar comparison notices a change to the production bar.
     await mutate(page,{css:'.bulkbar { padding: 4px }'});
-    expect(compare(reference,await inventoryOf(page,'#workspace-main'),manifest,['bulkbar']).map(item=>item.path)).toContain('bulkbar.bar.paddingTop');
+    expect(compare(oracle,await inventoryOf(page,'#workspace-main'),manifest,['bulkbar']).map(item=>item.path)).toContain('bulkbar.bar.paddingTop');
 });
 
 // The comparison is only worth something if it notices a change (spec §7 mutation check): one CSS mutation (the
@@ -512,7 +514,7 @@ test('one appended image reads in the singular',async({page,request})=>{
     test.setTimeout(120_000);
     await page.setViewportSize({width:1600,height:1100});
     const total=PRODUCTION_BATCH+1;
-    await seedConcept(request,{extra_images:total-FIXTURE_IMAGES});
+    await seedConceptAt(page,request,{extra_images:total-FIXTURE_IMAGES});
     await openProductionLoaded(page,'dark','no-preference',total);
     await expect(page.locator('.infinite-continuation > p').first()).toHaveText(countCopy(`${PRODUCTION_BATCH} of ${total} images · more load as you scroll`));
     // A dispatched press: scrolling the button into view lets the page's own observer load the one image first.
@@ -528,7 +530,7 @@ test('one image appended by scrolling reads in the singular',async({page,request
     test.setTimeout(120_000);
     await page.setViewportSize({width:1600,height:1100});
     const total=PRODUCTION_BATCH+1;
-    await seedConcept(request,{extra_images:total-FIXTURE_IMAGES});
+    await seedConceptAt(page,request,{extra_images:total-FIXTURE_IMAGES});
     await openProductionLoaded(page,'dark','no-preference',total);
     await expect(page.locator('#result-count')).toHaveText(new RegExp(`^${PRODUCTION_BATCH} of ${total} images`));
     await page.locator('.infinite-continuation').scrollIntoViewIfNeeded();
@@ -538,8 +540,9 @@ test('one image appended by scrolling reads in the singular',async({page,request
 });
 
 // D3 (one footer height for the collection): bounded rendering cannot measure unrendered cards, so every row reserves
-// the tallest measured footer. Two seedless files (D11 "W × H · PNG", one line) form the first row at 390px, where
-// every concept subtitle wraps: their row is as tall as the wrapped rows, and every concept row moves down by one.
+// the tallest measured footer. Two seedless files (D11 "W × H · PNG", one line: a short "96 × 72" beside Info and Tag)
+// form the first row at 390px, where every concept subtitle wraps: their row is as tall as the wrapped rows, and every
+// concept row moves down by one.
 test('one footer height for the collection (D3)',async({page,request})=>{
     // A second fixture seed (dozens of PNGs and their thumbnails) runs inside the test.
     test.setTimeout(120_000);
@@ -548,7 +551,7 @@ test('one footer height for the collection (D3)',async({page,request})=>{
     const reference=await inventoryOf(page,'#main');
     expect(reference.grid.columns).toBe(2);
     expect(reference.cards.every(card=>card.info.p.height>parseFloat(card.info.p.lineHeight))).toBe(true);
-    const manifest=await seedConcept(request,{seedless_images:2});
+    const manifest=await seedConceptAt(page,request,{seedless_images:2,short_seedless:true});
     await openProductionLoaded(page,'dark','no-preference',FIXTURE_IMAGES+2);
     const actual=await inventoryOf(page,'#workspace-main');
     const box=card=>({left:card.left,top:card.top,width:card.width,height:card.height});
@@ -557,7 +560,10 @@ test('one footer height for the collection (D3)',async({page,request})=>{
         ...reference.cards.slice(0,4).map(card=>({...box(card),top:card.top+pitch}))]);
     const seedless=actual.cards.slice(0,2);
     expect(seedless.map(card=>card.open.label)).toEqual(manifest.seedless.map(image=>`Open ${image.filename}`));
-    expect(seedless.map(card=>card.info.p.text)).toEqual(['1536 × 1152 · PNG','1536 × 1152 · PNG']);
+    expect(seedless.map(card=>card.info.p.text)).toEqual(['96 × 72 · PNG','96 × 72 · PNG']);
     // Their own footer is one line shorter than the row it reserves.
-    for(const card of seedless)expect(card.info.height).toBeLessThan(reference.cards[0].info.height);
+    for(const card of seedless) {
+        expect(card.info.p.height).toBeLessThanOrEqual(parseFloat(card.info.p.lineHeight)+0.5);
+        expect(card.info.height).toBeLessThan(reference.cards[0].info.height);
+    }
 });

tests/browser/inspect-concept.spec.mjs

@@ -0,0 +1,312 @@
+import { writeFile } from 'node:fs/promises';
+import { startCoverage, saveCoverage } from '../../tools/vendor/browser-coverage.mjs';
+import { test, expect } from './fixtures.mjs';
+import { captureCanonicalState } from './history-canonical-comparison.mjs';
+import { SIZES, THEMES, seedConcept, openConcept, openProduction, diffInventory, mutate } from './concept-inventory.mjs';
+import { parityPng } from './local-inspect-files.mjs';
+
+// PR L2 Task 7 of the local-Inspect plan (#249): the native "Inspect a file" page against the immutable concept's
+// `#metadata` (docs/concepts/workspace/app.js renderMetadata 740–748, selection 1715–1729, style.css 709–722,
+// 1180–1194, 1543–1545, 1559–1564), at 1600x1100 and 390x844 in both themes, in three states: initial, selected (the
+// same synthetic PNG set into both `#local-file` inputs) and viewer-open. The concept is never edited: the recorded
+// differences D60–D66 (TESTING.md) are applied to its measurement, and, where they change copy, to its page before it
+// is measured, so the browser lays the concept out with production's words. After that the diff must be empty.
+// Paired captures are artifacts only; there are no PNG baselines.
+test.use({ locale: 'en-US', timezoneId: 'UTC', reducedMotion: 'reduce' });
+
+const FILE = 'f02.png';
+/** D60 and D61, the maintainer's LI-3 copy, keyed by the concept's own copy. */
+const COPY = {
+    action: ['Open sample metadata', 'Open file metadata'],
+    intro: ['Keep the existing local-file inspection workflow. Only add the file to your library when you choose to import it.',
+        'Read embedded metadata in this browser. The file is not uploaded or added to your library.'],
+    chooser: ['Choose an image for a local preview', 'Choose an image or video for a local preview'],
+    note: ['This mock previews your file locally. Sample metadata is available with “Open sample metadata”.',
+        'Your file stays in this browser. Its metadata opens with “Open file metadata”.'],
+    toast: ['Local preview only. No file uploaded; sample metadata is available above.',
+        'Local preview only. No file uploaded; metadata is available above.'],
+};
+/** D62: the concept's image list plus the videos the local readers support. */
+const ACCEPT = ['image/png,image/jpeg,image/webp', 'image/png,image/jpeg,image/webp,video/*,.mp4,.mov,.m4v,.webm,.mkv,.avi,.wmv'];
+
+test.beforeEach(async ({ page, browserName }) => {
+    await startCoverage(page, browserName);
+    page.conceptErrors = [];
+    page.on('pageerror', error => page.conceptErrors.push(error.message));
+});
+
+test.afterEach(async ({ page, browserName }) => {
+    await saveCoverage(page, browserName);
+    expect(page.conceptErrors).toEqual([]);
+});
+
+/** Runs in the page: the Inspect surface below the heading, and the heading's actions. Self-contained. */
+function measureInspect(scope) {
+    const main = document.querySelector(scope);
+    const css = (node, ...keys) => node ? Object.fromEntries(keys.map(key => [key, getComputedStyle(node)[key]])) : null;
+    const name = node => [node.localName, ...[...node.classList].sort()].join('.');
+    const font = node => css(node, 'fontFamily', 'fontSize', 'fontWeight', 'lineHeight', 'color');
+    const origin = main.querySelector(':scope > section.surface');
+    const box = node => {
+        if (!node || !origin) return null;
+        const a = node.getBoundingClientRect(), b = origin.getBoundingClientRect();
+        return { left: Math.round(a.left - b.left), top: Math.round(a.top - b.top), width: Math.round(a.width), height: Math.round(a.height) };
+    };
+    const text = node => node ? node.textContent.replace(/\s+/g, ' ').trim() : null;
+    const heading = main.querySelector(':scope > .heading');
+    const surface = origin;
+    const drop = surface?.querySelector(':scope > .file-drop');
+    const input = drop?.querySelector('input#local-file');
+    const preview = surface?.querySelector(':scope > #local-preview');
+    const media = preview?.querySelector('.local-file-preview');
+    return {
+        heading: {
+            title: text(heading?.querySelector('h1')),
+            description: text(heading?.querySelector('p')),
+            actions: [...(heading?.querySelectorAll('.heading-actions > *') ?? [])].map(node => ({ name: name(node), text: text(node),
+                ...css(node, 'backgroundColor', 'color', 'fontSize', 'paddingTop', 'paddingLeft', 'borderTopLeftRadius'), box: box(node) })),
+        },
+        surface: surface && {
+            children: [...surface.children].map(name), box: box(surface),
+            ...css(surface, 'paddingTop', 'paddingRight', 'paddingBottom', 'paddingLeft', 'borderTopWidth', 'borderTopStyle',
+                'borderTopColor', 'borderTopLeftRadius', 'backgroundColor'),
+            h2: { text: text(surface.querySelector(':scope > h2')), ...font(surface.querySelector(':scope > h2')), box: box(surface.querySelector(':scope > h2')) },
+            p: { text: text(surface.querySelector(':scope > p')), ...font(surface.querySelector(':scope > p')),
+                ...css(surface.querySelector(':scope > p'), 'marginTop'), box: box(surface.querySelector(':scope > p')) },
+        },
+        drop: drop && {
+            children: [...drop.children].map(name), box: box(drop),
+            ...css(drop, 'display', 'placeItems', 'textAlign', 'minHeight', 'rowGap', 'columnGap', 'marginTop', 'paddingTop',
+                'paddingRight', 'paddingBottom', 'paddingLeft', 'borderTopWidth', 'borderTopStyle', 'borderTopColor',
+                'borderBottomStyle', 'borderLeftStyle', 'borderRightStyle', 'borderTopLeftRadius', 'backgroundColor'),
+            icon: { box: box(drop.querySelector(':scope > svg.icon')), viewBox: drop.querySelector(':scope > svg.icon')?.getAttribute('viewBox'),
+                d: drop.querySelector(':scope > svg.icon path')?.getAttribute('d') ?? null,
+                ...css(drop.querySelector(':scope > svg.icon'), 'color', 'strokeWidth') },
+            label: { text: text(drop.querySelector(':scope > label')), for: drop.querySelector(':scope > label')?.htmlFor ?? null,
+                ...font(drop.querySelector(':scope > label')), box: box(drop.querySelector(':scope > label')) },
+            input: input && { type: input.type, accept: input.accept, multiple: input.multiple, ...css(input, 'maxWidth', 'fontSize', 'color'),
+                box: box(input) },
+            note: { text: text(drop.querySelector(':scope > span.small')), ...font(drop.querySelector(':scope > span.small')),
+                box: box(drop.querySelector(':scope > span.small')) },
+        },
+        preview: preview && {
+            children: [...preview.children].map(name), box: box(preview),
+            media: media && { tag: media.localName, alt: media.getAttribute('alt'), blob: media.src.startsWith('blob:'),
+                ...css(media, 'width', 'maxHeight', 'objectFit', 'marginTop', 'display'), box: box(media) },
+        },
+        // The chooser's displayed name: a file input shows the last path segment of its value.
+        chosen: input ? { name: input.value.split(/[\\/]/).pop(), files: [...input.files].map(file => file.name) } : null,
+    };
+}
+
+/** Runs in the page: the open viewer's dialog box, its toolbar controls in order and its rail's sections in order. */
+function measureViewer() {
+    const dialog = document.querySelector('dialog#viewer-dialog[open]');
+    if (!dialog) return null;
+    const css = (node, ...keys) => node ? Object.fromEntries(keys.map(key => [key, getComputedStyle(node)[key]])) : null;
+    const rect = node => { const b = node.getBoundingClientRect(); return { left: Math.round(b.left), top: Math.round(b.top), width: Math.round(b.width), height: Math.round(b.height) }; };
+    const text = node => node.textContent.replace(/\s+/g, ' ').trim();
+    const rail = dialog.querySelector('#viewer-details');
+    // The rail's sections in document order, whatever wraps them.
+    const SECTIONS = [
+        ['.panel-heading', () => 'heading'],
+        ['.panel-heading + p.small', () => 'filename'],
+        ['.tags', node => node.querySelector('button.chip') ? 'tag chips' : 'badges'],
+        ['section.prompt-section.positive', () => 'positive'],
+        ['section.prompt-section.negative', () => 'negative'],
+        ['dl.meta-grid', node => node.closest('details') ? null : 'facts'],
+        ['details > summary', node => text(node)],
+        ['button.send', node => node.closest('.prompt-section') ? `send ${node.closest('.prompt-section').matches('.positive') ? 'positive' : 'negative'}` : 'send pair'],
+        ['button', node => /Prompt history/.test(node.textContent) ? 'Prompt history' : text(node) === 'Copy settings summary' ? 'settings summary' : null],
+    ];
+    const sections = [...rail.querySelectorAll('*')].map(node => {
+        for (const [selector, label] of SECTIONS) if (node.matches(selector)) return label(node);
+        return null;
+    }).filter(Boolean);
+    return {
+        dialog: rect(dialog),
+        // The layout below the header; the header's height follows the title (D66) and the rail's height its content.
+        layout: (() => {
+            const header = dialog.querySelector('.dialog-header').getBoundingClientRect().bottom;
+            const left = rect(dialog.querySelector('.viewer-left')), side = rect(rail);
+            return { left: { ...left, top: Math.round(left.top - header) }, rail: { left: side.left, width: side.width },
+                ...css(dialog.querySelector('.viewer-layout'), 'display', 'gridTemplateColumns') };
+        })(),
+        title: text(dialog.querySelector('#viewer-title')),
+        subtitle: text(dialog.querySelector('.dialog-header p')),
+        toolbar: [...dialog.querySelectorAll('#viewer-toolbar > button, #viewer-toolbar > a')].map(text),
+        railTitle: text(rail.querySelector('.panel-heading h2')),
+        sections,
+    };
+}
+
+/**
+ * D60–D62 applied to the open concept page before it is measured: production's action label, copy and accept list,
+ * so the browser lays out what follows them. The concept file itself is never touched.
+ */
+async function withProductionCopy(page) {
+    await page.evaluate(({ COPY, ACCEPT }) => {
+        const main = document.querySelector('#main');
+        const swap = (node, [from, to]) => { if (node.textContent !== from) throw new Error(`concept copy changed: ${node.textContent}`); node.textContent = to; };
+        swap(main.querySelector('.heading-actions > button'), COPY.action);
+        swap(main.querySelector('section.surface > p'), COPY.intro);
+        swap(main.querySelector('.file-drop > label'), COPY.chooser);
+        swap(main.querySelector('.file-drop > span.small'), COPY.note);
+        const input = main.querySelector('#local-file');
+        if (input.accept !== ACCEPT[0]) throw new Error(`concept accept changed: ${input.accept}`);
+        input.accept = ACCEPT[1];
+    }, { COPY, ACCEPT });
+}
+
+/**
+ * D66: the viewer of a local file is titled by its filename and has no tag chips and no Prompt history. D117 (LI-4):
+ * "Copy settings summary" follows the six facts.
+ */
+function mapViewerConcept(reference) {
+    const sections = reference.sections.filter(section => section !== 'tag chips' && section !== 'Prompt history');
+    const facts = sections.indexOf('facts');
+    return {
+        ...reference,
+        title: FILE,
+        railTitle: FILE,
+        sections: [...sections.slice(0, facts + 1), 'settings summary', ...sections.slice(facts + 1)],
+    };
+}
+
+// Two frames, then every running transition finished.
+const settle = page => page.evaluate(async () => {
+    await new Promise(resolve => requestAnimationFrame(() => requestAnimationFrame(resolve)));
+    await Promise.all(document.getAnimations().map(animation => animation.finished.catch(() => {})));
+});
+
+async function conceptStates(page, theme, testInfo, tag) {
+    await openConcept(page, 'metadata', theme);
+    await page.mouse.move(0, 0);
+    await withProductionCopy(page);
+    await settle(page);
+    const initial = await page.evaluate(measureInspect, '#main');
+    await captureCanonicalState(page, testInfo, `concept-initial-${tag}`);
+    await page.locator('#main #local-file').setInputFiles(parityPng(FILE));
+    await expect(page.locator('#main #local-preview img.local-file-preview')).toBeVisible();
+    await page.locator('#main #local-preview img').evaluate(image => image.decode().catch(() => {}));
+    await expect(page.locator('#toast')).toHaveText(COPY.toast[0]);
+    await settle(page);
+    const selected = await page.evaluate(measureInspect, '#main');
+    await captureCanonicalState(page, testInfo, `concept-selected-${tag}`);
+    await page.locator('#main .heading-actions > button').click();
+    await expect(page.locator('dialog#viewer-dialog[open] #viewer-details .panel-heading')).toBeVisible();
+    await page.mouse.move(0, 0);
+    await settle(page);
+    const viewer = await page.evaluate(measureViewer);
+    await captureCanonicalState(page, testInfo, `concept-viewer-${tag}`);
+    return { initial, selected, viewer };
+}
+
+async function productionStates(page, theme, testInfo, tag) {
+    await openProduction(page, 'inspect', theme);
+    await page.mouse.move(0, 0);
+    const action = page.locator('#workspace-main .heading-actions').getByRole('button', { name: COPY.action[1], exact: true });
+    // D60: unavailable, and described by the drop note, until a classified file is chosen.
+    await expect(action).toHaveAttribute('aria-disabled', 'true');
+    await expect(action).toHaveAttribute('aria-describedby', 'local-file-note');
+    await settle(page);
+    const initial = await page.evaluate(measureInspect, '#workspace-main');
+    await captureCanonicalState(page, testInfo, `production-initial-${tag}`);
+    await page.locator('#workspace-main #local-file').setInputFiles(parityPng(FILE));
+    await expect(page.locator('#workspace-main #local-preview img.local-file-preview')).toBeVisible();
+    await page.locator('#workspace-main #local-preview img').evaluate(image => image.decode().catch(() => {}));
+    await expect(page.locator('#workspace-toast')).toHaveText(COPY.toast[1]);
+    await expect(action).toHaveAttribute('aria-disabled', 'false');
+    // D63: a readable PNG shows no status line.
+    await expect(page.locator('#workspace-main #local-preview p.small')).toHaveCount(0);
+    await settle(page);
+    const selected = await page.evaluate(measureInspect, '#workspace-main');
+    await captureCanonicalState(page, testInfo, `production-selected-${tag}`);
+    await action.click();
+    await expect(page.locator('dialog#viewer-dialog[open] #viewer-details .panel-heading')).toBeVisible();
+    await expect(page.locator('dialog#viewer-dialog[open] #viewer-details .meta-grid').first()).toBeVisible();
+    await page.mouse.move(0, 0);
+    await settle(page);
+    const viewer = await page.evaluate(measureViewer);
+    await captureCanonicalState(page, testInfo, `production-viewer-${tag}`);
+    return { initial, selected, viewer };
+}
+
+/** The concept's fixed CSS values (style.css 709–722, 1180–1194, 1543–1545, 1559–1564), restated as the plan pins them. */
+function expectPinnedValues(state) {
+    expect(state.surface).toMatchObject({ paddingTop: '22px', paddingLeft: '22px', borderTopLeftRadius: '7px', borderTopStyle: 'solid' });
+    expect(state.surface.h2).toMatchObject({ fontSize: '17px', fontWeight: '600' });
+    expect(state.surface.p).toMatchObject({ fontSize: '12px' });
+    expect(state.drop).toMatchObject({ display: 'grid', textAlign: 'center', minHeight: '170px', rowGap: '12px', columnGap: '12px',
+        marginTop: '20px', paddingTop: '22px', paddingLeft: '22px', borderTopStyle: 'dashed', borderBottomStyle: 'dashed',
+        borderLeftStyle: 'dashed', borderRightStyle: 'dashed', borderTopWidth: '1px', borderTopLeftRadius: '7px' });
+    expect(state.drop.input).toMatchObject({ maxWidth: '100%', fontSize: '12px' });
+}
+
+for (const [width, height] of SIZES) for (const theme of THEMES) {
+    test(`inspect surface matches the concept ${width}x${height} ${theme}`, async ({ page, request }, testInfo) => {
+        await page.setViewportSize({ width, height });
+        await seedConcept(request);
+        const tag = `${theme}-${width}`;
+        const concept = await conceptStates(page, theme, testInfo, tag);
+        const production = await productionStates(page, theme, testInfo, tag);
+        const mappedViewer = mapViewerConcept(concept.viewer);
+        const diff = {
+            initial: diffInventory(concept.initial, production.initial),
+            selected: diffInventory(concept.selected, production.selected),
+            viewer: diffInventory(mappedViewer, production.viewer),
+        };
+        const path = testInfo.outputPath('inspect-geometry.json');
+        await writeFile(path, JSON.stringify({ concept, production, diff }, null, 2));
+        await testInfo.attach('inspect-geometry', { path, contentType: 'application/json' });
+
+        // The concept is what this comparison assumes: its structure, its own copy (swapped above) and its chooser.
+        expect(concept.initial.surface.children).toEqual(['h2', 'p', 'div.file-drop.spaced-20', 'div']);
+        expect(concept.initial.drop.children).toEqual(['svg.icon', 'label', 'input', 'span.small']);
+        expect(concept.selected.preview.children).toEqual(['img.local-file-preview']);
+        expect(concept.selected.chosen).toEqual({ name: FILE, files: [FILE] });
+        expect(concept.viewer.toolbar).toEqual(['← Previous', '−', '+', 'Fit', 'Rotate', 'Flip', 'Play', 'Download', 'Next →']);
+
+        expect(diff).toEqual({ initial: [], selected: [], viewer: [] });
+        for (const state of [production.initial, production.selected]) expectPinnedValues(state);
+        expect(production.selected.preview.media).toMatchObject({ tag: 'img', alt: 'Local file preview', blob: true,
+            maxHeight: '400px', objectFit: 'contain', marginTop: '20px' });
+        // The chooser names the chosen file after a real setInputFiles, as the concept's does.
+        expect(production.initial.chosen).toEqual({ name: '', files: [] });
+        expect(production.selected.chosen).toEqual({ name: FILE, files: [FILE] });
+        // D66 in the rail: no tag chips and no Prompt history; the title is the filename. D117 follows the facts.
+        expect(production.viewer.sections).toEqual(['heading', 'filename', 'badges', 'positive', 'send positive', 'negative',
+            'send negative', 'facts', 'settings summary', 'File & provenance', 'Workflow & raw metadata', 'send pair']);
+    });
+}
+
+test('mutation is noticed', async ({ page, request }, testInfo) => {
+    await page.setViewportSize({ width: 1600, height: 1100 });
+    await seedConcept(request);
+    await openConcept(page, 'metadata', 'dark');
+    await withProductionCopy(page);
+    const concept = await page.evaluate(measureInspect, '#main');
+    await openProduction(page, 'inspect', 'dark');
+    await page.mouse.move(0, 0);
+    expect(diffInventory(concept, await page.evaluate(measureInspect, '#workspace-main'))).toEqual([]);
+
+    // A solid border on the drop area is noticed on every side and nowhere else.
+    const undoCss = await mutate(page, { css: '#workspace-main .file-drop { border-style: solid; }' });
+    expect(diffInventory(concept, await page.evaluate(measureInspect, '#workspace-main')).map(item => item.path))
+        .toEqual(['drop.borderTopStyle', 'drop.borderBottomStyle', 'drop.borderLeftStyle', 'drop.borderRightStyle']);
+    await undoCss();
+    // A renamed label is noticed (its text; its box only if the new words lay out differently).
+    const label = page.locator('#workspace-main .file-drop > label');
+    await label.evaluate(node => { node.dataset.original = node.textContent; node.textContent = 'Choose a file'; });
+    const renamed = diffInventory(concept, await page.evaluate(measureInspect, '#workspace-main')).map(item => item.path);
+    expect(renamed).toContain('drop.label.text');
+    expect(renamed.every(path => path.startsWith('drop.label.'))).toBe(true);
+    await label.evaluate(node => { node.textContent = node.dataset.original; delete node.dataset.original; });
+    // A removed note is noticed by its path.
+    const undoDom = await mutate(page, { remove: ['#workspace-main .file-drop > span.small'] });
+    expect(diffInventory(concept, await page.evaluate(measureInspect, '#workspace-main')).map(item => item.path))
+        .toEqual(expect.arrayContaining(['drop.children.3', 'drop.note.text']));
+    await undoDom();
+    expect(diffInventory(concept, await page.evaluate(measureInspect, '#workspace-main'))).toEqual([]);
+    await captureCanonicalState(page, testInfo, 'production-after-mutations');
+});

tests/browser/inspector-concept.spec.mjs

@@ -1,7 +1,7 @@
 import {writeFile} from 'node:fs/promises';
 import {test,expect} from './fixtures.mjs';
 import {captureCanonicalState} from './history-canonical-comparison.mjs';
-import {SIZES,THEMES,seedConcept,openConcept,openProduction,inspectorOf,diffInventory,mutate,countCopy} from './concept-inventory.mjs';
+import {SIZES,THEMES,seedConcept,openConcept,openProduction,inspectorOf,diffInventory,mutate,countCopy,saveImageTags} from './concept-inventory.mjs';
 
 // Task D4 of #249: the Images side panel (app.js imageDetails a400–414) and the viewer's full details (imageDetails(i,
 // true)) against the immutable concept, on the concept-shaped real fixture, at 1600x1100 and 390x844 in both themes.
@@ -45,10 +45,10 @@ function withCategoryScope(inventory) {
 }
 
 /**
- * Recorded inspector deviations only (spec §8, TESTING.md D3, D20–D22, D34 and D38); everything else must equal
- * production. `reference.viewerPlain` is the concept's own full details
- * with its tag chips made plain (D20) and, under a coarse pointer, D34's targets, both at runtime: the browser lays out
- * what follows them, as the Images spec's removed toolbar items do.
+ * Recorded inspector deviations only (spec §8, TESTING.md D3, D20–D22, D34, D38 and D117); everything else must
+ * equal production. `reference.viewerPlain` is the concept's own full details
+ * with its tag chips made plain (D20), D117's summary button added and, under a coarse pointer, D34's targets, all at
+ * runtime: the browser lays out what follows them, as the Images spec's removed toolbar items do.
  */
 export function mapInspectorConcept(reference,{viewport}) {
     const {panel,viewerPlain,fileControls}=reference;
@@ -105,7 +105,11 @@ async function openProductionPanel(page,theme) {
     await settle(page);
 }
 
-/** The concept's tag chips in the open viewer as plain `span.chip`s (D20) and D34's coarse targets; returns an undo. */
+/**
+ * The concept's tag chips in the open viewer as plain `span.chip`s (D20), D34's coarse targets and D117's "Copy
+ * settings summary" after the six facts (LI-4), drawn as the concept's own plain button (its "Download sample JSON",
+ * without its action); returns an undo.
+ */
 async function plainViewerChips(page) {
     const restoreTargets=await mutate(page,{css:D34_COARSE_TARGETS});
     await page.evaluate(()=>{
@@ -113,10 +117,15 @@ async function plainViewerChips(page) {
             const span=document.createElement('span');span.className='chip';span.textContent=button.textContent;
             button.replaceWith(span);return [span,button];
         });
+        const summary=document.querySelector('#viewer-details [data-action="download-workflow"]').cloneNode(false);
+        for(const key of Object.keys(summary.dataset))delete summary.dataset[key];
+        summary.textContent='Copy settings summary';summary.classList.add('settings-summary');
+        document.querySelector('#viewer-details > div > dl.meta-grid').after(summary);window.__summaryButton=summary;
     });
     await settle(page);
     return async()=>{
-        await page.evaluate(()=>{for(const [span,button] of window.__plainChips)span.replaceWith(button);delete window.__plainChips;});
+        await page.evaluate(()=>{for(const [span,button] of window.__plainChips)span.replaceWith(button);delete window.__plainChips;
+            window.__summaryButton.remove();delete window.__summaryButton;});
         await restoreTargets();
     };
 }
@@ -319,9 +328,30 @@ test('a recipe-linked image without recipe metadata shows its positive prompt me
     await expect(panelOf(page).locator('.detail-footer button')).toHaveText(['Send to ComfyUI','Prompt history']);
 });
 
+// Task C3 (D88, #249 PR C): the concept's chip row is the image's own tags (`i.tags`, app.js a402). With those names
+// saved as the file's current image tags, production draws the row from them (Tags filter buttons in the panel, plain
+// in the viewer, the linked positive's equal tags not repeated) and still equals the concept, in both sizes.
+for(const [width,height] of SIZES)test(`image tags saved on the concept image keep the inspector equal to the concept ${width}x${height} (D88)`,async({page,request},testInfo)=>{
+    test.setTimeout(120_000);
+    const viewport={width,height};await page.setViewportSize(viewport);
+    await openConceptPanel(page,'dark');
+    const names=await panelOf(page).locator('.detail-inner > .tags').last().locator('button.chip').allTextContents();
+    expect(names).toEqual(['cinematic','blue_hour','architecture']);
+    await captureCanonicalState(page,testInfo,`concept-image-tags-${width}`,'#image-inspector');
+    const reference=await inventory(page,true);
+    const {path}=testInfo.manifest.images.find(item=>item.filename==='alpine_00001.png');
+    expect(await saveImageTags(request,path,names)).toEqual(names);
+    const read=page.waitForResponse(item=>new URL(item.url()).pathname===`/prompt_manager/images/inspect/${path}`);
+    await openProductionPanel(page,'dark');
+    expect((await (await read).json()).image_tags).toEqual({state:'current',tags:names});
+    await expect(panelOf(page).locator('.detail-inner > .tags').last().locator('.chip')).toHaveText(names);
+    await captureCanonicalState(page,testInfo,`production-image-tags-${width}`,'#image-inspector');
+    assertInspectorMatch(reference,await inventory(page),viewport);
+});
+
 // The comparison is only worth something if it notices a change (spec §7 mutation check): on the panel one CSS
 // mutation (the role label's letter spacing) and one DOM mutation (the footer removed); in the viewer (final review m5)
-// its pair actions removed and D38's Show in folder removed; each applied after an exact match.
+// its pair actions removed, D38's Show in folder removed and D117's summary removed; each applied after an exact match.
 test('inspector comparison detects mutations',async({page})=>{
     test.setTimeout(120_000);
     const viewport={width:1600,height:1100};
@@ -345,6 +375,9 @@ test('inspector comparison detects mutations',async({page})=>{
     expect(()=>assertInspectorMatch(reference,withoutActions,viewport)).toThrow(/viewerDetails\.actions/);
     const withoutReveal=await viewerMutated({remove:['#viewer-details button[aria-label$=" in folder"]']});
     expect(()=>assertInspectorMatch(reference,withoutReveal,viewport)).toThrow(/fileControls/);
+    // D117: the summary action after the facts is part of the mapped concept, so losing it is a difference.
+    const withoutSummary=await viewerMutated({remove:['#viewer-details > div > button']});
+    expect(()=>assertInspectorMatch(reference,withoutSummary,viewport)).toThrow(/viewerDetails\.structure\.inner/);
     assertInspectorMatch(reference,await viewerMutated(),viewport);
 
     await mutate(page,{remove:['#image-inspector > .detail-footer']});

tests/browser/library-concept.spec.mjs

@@ -1,7 +1,7 @@
 import {writeFile} from 'node:fs/promises';
 import {test,expect} from './fixtures.mjs';
 import {captureCanonicalState} from './history-canonical-comparison.mjs';
-import {SIZES,THEMES,MOTIONS,seedConcept,openConcept,openProduction,inventoryOf,diffInventory,mutate,stripExact,countCopy,reflow} from './concept-inventory.mjs';
+import {SIZES,THEMES,MOTIONS,seedConceptAt,openConcept,openProduction,inventoryOf,diffInventory,mutate,stripExact,countCopy,reflow} from './concept-inventory.mjs';
 
 // Task E3 of #249: the production Prompt library shelf against the immutable concept (app.js renderLibrary a572–586,
 // style.css s648–708), on the concept-shaped real fixture (the concept's six prompts with their negatives, categories,
@@ -37,7 +37,8 @@ export function mapLibraryConcept(reference) {
         // D43: tag chips come in the store's alphabetical order; the row flows again from the concept's own chips.
         tags:sortedTags(card.tags),
         // D23: the stars are aria-hidden, with a visually hidden "Rated N out of 5" spoken in their place. The fixture's
-        // run_count (4) and last_used_at (now) give the concept's own "4 runs" and "Used today". The two-line clamp is
+        // run_count (4) and last_used_at (its own "now", where the page's clock stands) give the concept's own "4 runs"
+        // and "Used today". The two-line clamp is
         // applied below through `clampedCards`, measured on the concept with `CLAMP_CSS` (its samples wrap at 390px).
         footer:{...card.footer,facts:{...card.footer.facts,spoken:card.footer.facts.spoken.replace(/^(★+)/,stars=>`Rated ${stars.length} out of 5`)}}}));
     return {...reference,library:{...library,toolbar,
@@ -238,7 +239,8 @@ async function openHost(context) {
 }
 
 test.beforeEach(async({page,request},testInfo)=>{
-    testInfo.manifest=await seedConcept(request);
+    // The page's clock stands at the fixture's own "now", so its last use reads "Used today" on either side of midnight.
+    testInfo.manifest=await seedConceptAt(page,request);
     // Both documents copy through the clipboard; the stub records what they wrote.
     await page.addInitScript(()=>{window.copied=[];Object.defineProperty(navigator,'clipboard',{configurable:true,value:{writeText:async text=>{window.copied.push(text);}}});});
 });
@@ -322,6 +324,27 @@ for(const theme of THEMES)test(`library grid and cards match the concept 1800x11
     expect(compare(reference,actual,{sections:['library'],library:['grid','cards','trailing']})).toEqual([]);
 });
 
+// PR #284's CI run: the fixture recorded the last use at 23:59:5x UTC and the shelf rendered at 00:00:05, so production
+// read "Used yesterday" against the concept's "Used today". Here the browser's wall clock starts at 23:59:58 UTC, the
+// fixture records its use at that instant, and midnight passes before either document opens.
+const BEFORE_MIDNIGHT=Date.UTC(2026,9,22,23,59,58);
+const PAST_MIDNIGHT_MS=5_000;
+test('a run that crosses midnight still reads the concept fixture\'s day',async({page,request})=>{
+    await page.setViewportSize({width:1800,height:1100});
+    await page.clock.install({time:BEFORE_MIDNIGHT});
+    const manifest=await seedConceptAt(page,request,{now:BEFORE_MIDNIGHT/1000});
+    expect(manifest.now*1000,'the fixture\'s now').toBe(BEFORE_MIDNIGHT);
+    const used=(await (await request.get('/prompt_manager/library')).json()).items.map(item=>Date.parse(item.last_used_at));
+    expect(used,'every last use at the fixture\'s now').toEqual(Array(CONCEPT_PROMPTS).fill(BEFORE_MIDNIGHT));
+    await page.clock.fastForward(PAST_MIDNIGHT_MS);
+    await openConceptLibrary(page,'dark','no-preference');
+    const reference=await conceptInventory(page);
+    await openProductionLibrary(page,'dark','no-preference');
+    const actual=await inventoryOf(page,'#workspace-main');
+    expect(actual.library.cards.map(card=>card.footer.facts.text.replace(/^★+ · /,''))).toEqual(Array(CONCEPT_PROMPTS).fill('Used today'));
+    expect(compare(reference,actual,{sections:['library'],library:['grid','cards','trailing']})).toEqual([]);
+});
+
 // The comparison is only worth something if it notices a change (spec §7 mutation check): one CSS mutation (the footer
 // padding) and one DOM mutation (the negative-variants chip removed), each applied after an exact match.
 test('library comparison detects mutations',async({page})=>{

tests/browser/local-inspect-files.mjs

@@ -0,0 +1,66 @@
+// Files for the Inspect page workflows, as Playwright `setInputFiles` payloads ({name, mimeType, buffer}) or as the
+// bytes a page builds a File or DataTransfer from. Built from the committed fixtures and the byte-exact PNG builders
+// the node tests use (tests/js/helpers/png-bytes.mjs), so the browser reads exactly what the unit tests pin.
+import fs from 'node:fs';
+import path from 'node:path';
+import zlib from 'node:zlib';
+import { fileURLToPath } from 'node:url';
+import { raw, ihdr, idat, iend, tEXt } from '../js/helpers/png-bytes.mjs';
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const FIXTURES = path.join(here, '..', 'fixtures');
+const read = (...parts) => fs.readFileSync(path.join(FIXTURES, ...parts));
+const file = (name, mimeType, buffer) => ({ name, mimeType, buffer: Buffer.from(buffer) });
+
+/** One committed parity PNG (tests/fixtures/inspection_parity), e.g. f02.png. */
+export const parityPng = (name, as = name) => file(as, 'image/png', read('inspection_parity', name));
+/** One committed local-inspect fixture (tests/fixtures/local-inspect). */
+export const localFixture = (name, mimeType, as = name) => file(as, mimeType, read('local-inspect', name));
+/** The committed CC0 VP8 clip with no generation metadata. */
+export const tinyWebm = () => file('tiny.webm', 'video/webm', read('tiny.webm'));
+
+/** One decodable 2×2 opaque pixel row set, so a synthetic PNG previews. */
+function pixels(width = 2, height = 2) {
+    const row = [0, ...Array.from({ length: width }, () => [40, 120, 200, 255]).flat()];
+    return zlib.deflateSync(Buffer.from(Array.from({ length: height }, () => row).flat()));
+}
+
+/**
+ * A previewable PNG whose positive spans lines and whose negative is a ConditioningZeroOut: the legacy fill shows the
+ * positive exactly and the ZeroOut guard makes the negative explicitly empty.
+ */
+export const POSITIVE_LINES = 'a lighthouse at dusk\nsoft rain, long exposure';
+export function sendablePng(name = 'send-me.png') {
+    const prompt = JSON.stringify({
+        3: { class_type: 'KSampler', inputs: { seed: 11, steps: 12, cfg: 5, sampler_name: 'euler', scheduler: 'normal', denoise: 1, model: ['4', 0], positive: ['6', 0], negative: ['8', 0], latent_image: ['5', 0] } },
+        4: { class_type: 'CheckpointLoaderSimple', inputs: { ckpt_name: 'local.safetensors' } },
+        5: { class_type: 'EmptyLatentImage', inputs: { width: 512, height: 512, batch_size: 1 } },
+        6: { class_type: 'CLIPTextEncode', inputs: { text: POSITIVE_LINES, clip: ['4', 1] } },
+        8: { class_type: 'ConditioningZeroOut', inputs: { conditioning: ['6', 0] } },
+    });
+    return file(name, 'image/png', raw(ihdr(2, 2), idat(pixels()), tEXt('prompt', prompt), iend()));
+}
+
+/** A PNG whose text chunk fails its CRC: the reader reports the metadata unreadable; the bytes stay downloadable. */
+export const corruptPng = (name = 'corrupt.png') =>
+    file(name, 'image/png', raw(ihdr(2, 2), idat(pixels()), tEXt('prompt', '{"3":{}}', { crc: 1 }), iend()));
+
+/** Bytes no reader claims, under an image or video name. */
+export const disguised = () => [
+    file('notes.png', 'image/png', Buffer.from('plain text, not an image')),
+    file('page.png', 'image/png', Buffer.from('<!doctype html><title>x</title><p>hi')),
+    file('vector.png', 'image/png', Buffer.from('<svg xmlns="http://www.w3.org/2000/svg" width="4" height="4"/>')),
+    file('stream.mp4', 'video/mp4', Buffer.from('#EXTM3U\n#EXT-X-VERSION:3\n')),
+];
+
+/**
+ * core-faststart.mp4 with its video sample entry renamed from `avc1` to `zzzz`: the container and its tags read as
+ * before, but no browser has a decoder for the stream, so the preview fails deterministically on every engine.
+ */
+export function undecodableMp4(name = 'undecodable.mp4') {
+    const bytes = Buffer.from(read('local-inspect', 'core-faststart.mp4'));
+    const at = bytes.indexOf(Buffer.from('avc1', 'latin1'), bytes.indexOf(Buffer.from('stsd', 'latin1')));
+    if (at < 0) throw new Error('core-faststart.mp4 has no avc1 sample entry');
+    bytes.write('zzzz', at, 'latin1');
+    return file(name, 'video/mp4', bytes);
+}

tests/browser/request_hold.py

@@ -0,0 +1,106 @@
+"""Hold real requests at this test server, so a page can leave while one is in flight.
+
+A Playwright ``page.route`` hold answers inside the browser's interception layer,
+which WebKit cancels differently from a request the server has not answered yet.
+These commands hold the request at the server itself:
+
+- ``POST /__test__/hold`` with ``{"path": "/prompt_manager/..."}`` holds every
+  later request for that path until it is released. With ``"stage": "body"``
+  the server answers first and holds after sending the headers and the first
+  half of the body, so the browser has a response whose body is still loading.
+- ``GET /__test__/hold`` answers ``{"held": {path: count}}``: how many requests
+  for each held path have arrived and are waiting.
+- ``POST /__test__/release`` lets every held request go on, and stops holding.
+"""
+
+import asyncio
+
+from aiohttp import web
+
+HOLDABLE_PREFIX = "/prompt_manager/"
+
+
+class RequestHolds:
+    def __init__(self) -> None:
+        self._gates: dict[str, asyncio.Event] = {}
+        self._waiting: dict[str, int] = {}
+        self._stages: dict[str, str] = {}
+
+    def hold(self, path: str, stage: str = "request") -> None:
+        self._gates.setdefault(path, asyncio.Event())
+        self._waiting.setdefault(path, 0)
+        self._stages[path] = stage
+
+    def stage(self, path: str) -> str | None:
+        return self._stages.get(path) if path in self._gates else None
+
+    def held(self) -> dict[str, int]:
+        return dict(self._waiting)
+
+    def release(self) -> None:
+        for gate in self._gates.values():
+            gate.set()
+        self._gates.clear()
+        self._waiting.clear()
+        self._stages.clear()
+
+    async def wait(self, path: str) -> None:
+        gate = self._gates.get(path)
+        if gate is None:
+            return
+        self._waiting[path] = self._waiting.get(path, 0) + 1
+        try:
+            await gate.wait()
+        finally:
+            if path in self._waiting:
+                self._waiting[path] -= 1
+
+
+def register_request_holds(app: web.Application, routes) -> RequestHolds:
+    holds = RequestHolds()
+
+    @web.middleware
+    async def hold_middleware(request: web.Request, handler):
+        stage = holds.stage(request.path)
+        if stage == "request":
+            await holds.wait(request.path)
+        response = await handler(request)
+        if stage != "body" or not isinstance(response, web.Response):
+            return response
+        body = response.body if isinstance(response.body, bytes) else b""
+        streamed = web.StreamResponse(status=response.status, headers=response.headers)
+        streamed.content_length = len(body)
+        await streamed.prepare(request)
+        await streamed.write(body[: len(body) // 2])
+        await holds.wait(request.path)
+        await streamed.write(body[len(body) // 2 :])
+        await streamed.write_eof()
+        return streamed
+
+    app.middlewares.append(hold_middleware)
+
+    @routes.post("/__test__/hold")
+    async def hold(request: web.Request) -> web.Response:
+        data = await request.json() if request.can_read_body else {}
+        path = data.get("path") if isinstance(data, dict) else None
+        stage = data.get("stage", "request") if isinstance(data, dict) else None
+        if (
+            not isinstance(path, str)
+            or not path.startswith(HOLDABLE_PREFIX)
+            or set(data) - {"path", "stage"}
+            or stage not in ("request", "body")
+        ):
+            raise web.HTTPBadRequest()
+        holds.hold(path, stage)
+        return web.json_response({"success": True})
+
+    @routes.get("/__test__/hold")
+    async def held(request: web.Request) -> web.Response:
+        return web.json_response({"success": True, "held": holds.held()})
+
+    @routes.post("/__test__/release")
+    async def release(request: web.Request) -> web.Response:
+        holds.release()
+        return web.json_response({"success": True})
+
+    return holds

tests/browser/server.py

@@ -18,10 +18,12 @@ from aiohttp.web_runner import GracefulExit
 from PIL import Image
 from PIL.PngImagePlugin import PngInfo
 
+from tests.browser.request_hold import register_request_holds
 from tests.browser.workspace_activity_fixture import register_activity_commands
 from tests.browser.workspace_concept_fixture import (
     MAX_EXTRA_IMAGES as CONCEPT_MAX_EXTRA_IMAGES,
     MAX_SEEDLESS_IMAGES as CONCEPT_MAX_SEEDLESS_IMAGES,
+    MAX_EPOCH_SECONDS as CONCEPT_MAX_EPOCH_SECONDS,
     seed_workspace_concept,
 )
 from tests.browser.workspace_visual_fixture import seed_workspace_visual
@@ -35,6 +37,7 @@ from tests.browser.workspace_library_editor_fixture import (
     register_library_editor_commands,
 )
 from tests.browser.workspace_vocabulary_fixture import register_vocabulary_commands
+from tests.browser.workspace_tagging_fixture import register_tagging_commands
 
 CANONICAL_ROOT = Path(__file__).resolve().parents[2]
 CANONICAL_ASSETS = {
@@ -57,11 +60,19 @@ class TestModel:
     wd14_character_threshold = 0.85
     custom_prompt = ""
     loaded = None
+    # Models the Tag image dialog workflows mark as not downloaded.
+    unavailable: set = set()
+    # Scored names the concept comparisons answer instead of the fixed list
+    # (``/__test__/tagging/suggestions``); None keeps the fixed list.
+    suggestions: list | None = None
 
     def get_models_status(self) -> dict:
         return {
-            name: {"downloaded": True, "loaded": self.loaded == name}
-            for name in ("gguf", "wd14-vit", "wd14-convnext", "wd14-swinv2")
+            name: {
+                "downloaded": name not in self.unavailable,
+                "loaded": self.loaded == name,
+            }
+            for name in ("gguf", "hf", "wd14-vit", "wd14-convnext", "wd14-swinv2")
         }
 
     def is_model_loaded(self) -> bool:
@@ -85,6 +96,11 @@ class TestModel:
     ) -> list[tuple[str, float | None]]:
         """Fixed scored suggestions (WD14) or unscored ones (language models)."""
         scored = self.loaded is not None and self.loaded.startswith("wd14")
+        if self.suggestions is not None:
+            return [
+                (name, confidence if scored else None)
+                for name, confidence in self.suggestions[:limit]
+            ]
         names = ["sandstone", "desert", "arch", "sky", "rock", "dune", "canyon"]
         names += [f"tag_{index:02d}" for index in range(100)]
         return [
@@ -178,8 +194,10 @@ def create_app(root: Path) -> web.Application:
     history_commands = register_workspace_history_commands(routes, api, root)
     library_editor_commands = register_library_editor_commands(routes, api, root)
     register_vocabulary_commands(routes, api, root)
+    register_tagging_commands(routes, api, root, model)
     reveal_stub = register_reveal_stub(routes, api, root)
     register_activity_commands(app, routes, api)
+    request_holds = register_request_holds(app, routes)
 
     async def canonical_asset(request: web.Request) -> web.Response:
         filename, content_type = CANONICAL_ASSETS[request.path]
@@ -359,6 +377,7 @@ def create_app(root: Path) -> web.Application:
     @routes.post("/__test__/reset")
     async def reset(request: web.Request) -> web.Response:
         nonlocal history_fixture
+        request_holds.release()
         library_editor_commands.reset()
         data = await request.json() if request.can_read_body else {}
         if not isinstance(data, dict):
@@ -471,7 +490,17 @@ def create_app(root: Path) -> web.Application:
         if (
             request.query
             or not isinstance(data, dict)
-            or set(data) - set(limits)
+            or set(data) - set(limits) - {"short_seedless", "now"}
+            or not isinstance(data.get("short_seedless", False), bool)
+            # A chosen "now" (epoch seconds) pins every time the fixture writes.
+            or (
+                "now" in data
+                and (
+                    isinstance(data["now"], bool)
+                    or not isinstance(data["now"], (int, float))
+                    or not 0 < data["now"] < CONCEPT_MAX_EPOCH_SECONDS
+                )
+            )
             or any(
                 isinstance(data.get(key, 0), bool)
                 or not isinstance(data.get(key, 0), int)
@@ -490,6 +519,8 @@ def create_app(root: Path) -> web.Application:
                 root,
                 extra_images=data.get("extra_images", 0),
                 seedless_images=data.get("seedless_images", 0),
+                short_seedless=data.get("short_seedless", False),
+                now=data.get("now"),
             )
         )
         return web.json_response({"success": True, **manifest})
@@ -524,6 +555,33 @@ def create_app(root: Path) -> web.Application:
         shutil.copyfile(root / "output" / "shared" / "same.png", destination)
         return web.json_response({"success": True})
 
+    @routes.post("/__test__/add-local-inspect-file")
+    async def add_local_inspect_file(request: web.Request) -> web.Response:
+        """Serve one committed Inspect fixture from the output folder.
+
+        The local Inspect page reads a chosen file in the browser; its page
+        workflow compares that rail with the Images viewer for the same bytes.
+        Only a committed fixture name is accepted.
+        """
+        data = await request.json() if request.can_read_body else None
+        fixtures = CANONICAL_ROOT / "tests" / "fixtures"
+        allowed = {
+            path.name: path
+            for folder in ("inspection_parity", "local-inspect")
+            for path in (fixtures / folder).iterdir()
+            if path.suffix.lower() in {".png", ".jpg", ".webp", ".webm", ".mp4"}
+        }
+        if (
+            not isinstance(data, dict)
+            or set(data) != {"name"}
+            or data["name"] not in allowed
+        ):
+            raise web.HTTPBadRequest()
+        destination = root / "output" / "local-inspect" / data["name"]
+        destination.parent.mkdir(parents=True, exist_ok=True)
+        shutil.copyfile(allowed[data["name"]], destination)
+        return web.json_response({"success": True})
+
     @routes.get("/api/settings/Comfy.ColorPalette")
     async def palette(request: web.Request) -> web.Response:
         return web.json_response("dark")

tests/browser/shell-concept.spec.mjs

@@ -119,10 +119,7 @@ function mapShellConcept(reference) {
             const spans=chrome.footer.spans.map(span=>({...span,text:'ComfyAssets · Local tools. Your library.'}));
             return {...chrome.footer,spans,buttons:[],height:remainingFooter(chrome.footer,spans)};
         })(),
-    },
-    heading:reference.heading&&{...reference.heading,actions:reference.heading.actions&&{...reference.heading.actions,
-        // #245 vocabulary ruling D2 (mapVocabularyConcept): Auto-tag images is omitted until the image-annotation slice.
-        buttons:reference.heading.actions.buttons.filter(item=>item.text!=='Auto-tag images')}}};
+    }};
 }
 
 /** The heading without its page-owned description copy and actions; the h1 text is the shell's and stays compared. */
@@ -181,27 +178,28 @@ async function captureFooter(page,testInfo,name) {
 
 test.beforeEach(async({request})=>{await seedConcept(request);});
 
-for(const [width,height] of SIZES)for(const theme of THEMES)test(`shell geometry, tokens and controls match the concept ${width}x${height} ${theme}`,async({page},testInfo)=>{
+// One test per route, size, theme and motion. All of them in one test per size and theme (12 page loads, 12 captures,
+// 36 hovers) steadily took 22 s median and up to 33 s on CI WebKit, past the 30 s budget with no step stalled; one
+// route in one motion is a sixth of that work under the same budget.
+for(const [route,breadcrumb] of ROUTES)for(const [width,height] of SIZES)for(const theme of THEMES)for(const motion of MOTIONS)test(`shell geometry, tokens and controls match the concept on ${route} ${width}x${height} ${theme} ${motion}`,async({page},testInfo)=>{
     await page.setViewportSize({width,height});const result={};
-    for(const motion of MOTIONS)for(const [route,breadcrumb] of ROUTES) {
-        await openConcept(page,route,theme,motion);await page.mouse.move(0,0);
-        const reference=await inventoryOf(page,'#main');
-        if(motion==='no-preference')await captureCanonicalState(page,testInfo,`concept-shell-${route}-${width}-${theme}`);
-        const referenceRings=FULL_HEADING.has(route)?await ringsOf(page,'#main'):null;
-        const referenceHovers=await hoversOf(page);
-        if(motion==='no-preference')await captureFooter(page,testInfo,`concept-footer-${route}-${width}-${theme}`);
-        await openProduction(page,route,theme,motion);await page.mouse.move(0,0);
-        const actual=await inventoryOf(page,'#workspace-main');
-        if(motion==='no-preference')await captureCanonicalState(page,testInfo,`production-shell-${route}-${width}-${theme}`);
-        const actualRings=FULL_HEADING.has(route)?await ringsOf(page,'#workspace-main'):null;
-        const actualHovers=await hoversOf(page);
-        if(motion==='no-preference')await captureFooter(page,testInfo,`production-footer-${route}-${width}-${theme}`);
-        result[`${motion} ${route}`]={route,breadcrumb,reference,actual,diff:compare(route,reference,actual),referenceRings,actualRings,
-            referenceHovers,actualHovers};
-    }
-    const path=testInfo.outputPath('shell-geometry.json');await writeFile(path,JSON.stringify(result,null,2));
-    await testInfo.attach('shell-geometry',{path,contentType:'application/json'});
-    for(const [key,{route,breadcrumb,reference,actual,diff,referenceRings,actualRings,referenceHovers,actualHovers}] of Object.entries(result)) {
+    await openConcept(page,route,theme,motion);await page.mouse.move(0,0);
+    const reference=await inventoryOf(page,'#main');
+    if(motion==='no-preference')await captureCanonicalState(page,testInfo,`concept-shell-${route}-${width}-${theme}`);
+    const referenceRings=FULL_HEADING.has(route)?await ringsOf(page,'#main'):null;
+    const referenceHovers=await hoversOf(page);
+    if(motion==='no-preference')await captureFooter(page,testInfo,`concept-footer-${route}-${width}-${theme}`);
+    await openProduction(page,route,theme,motion);await page.mouse.move(0,0);
+    const actual=await inventoryOf(page,'#workspace-main');
+    if(motion==='no-preference')await captureCanonicalState(page,testInfo,`production-shell-${route}-${width}-${theme}`);
+    const actualRings=FULL_HEADING.has(route)?await ringsOf(page,'#workspace-main'):null;
+    const actualHovers=await hoversOf(page);
+    if(motion==='no-preference')await captureFooter(page,testInfo,`production-footer-${route}-${width}-${theme}`);
+    result[`${motion} ${route}`]={reference,actual,diff:compare(route,reference,actual),referenceRings,actualRings,
+        referenceHovers,actualHovers};
+    const path=testInfo.outputPath(`shell-geometry-${route}-${motion}.json`);await writeFile(path,JSON.stringify(result,null,2));
+    await testInfo.attach(`shell-geometry-${route}-${motion}`,{path,contentType:'application/json'});
+    for(const [key,{reference,actual,diff,referenceRings,actualRings,referenceHovers,actualHovers}] of Object.entries(result)) {
         // The concept itself is what this comparison assumes: its sample counts and its shell controls.
         expect.soft(reference.chrome.navs[0].rows.map(row=>[row.text,row.count?.text??null]),`${key} concept WORKSPACE rows`)
             .toEqual([['Images','24'],['Prompt library','6'],['Tags & categories','15'],['Inspect a file',null]]);

tests/browser/tagging-canonical-comparison.mjs

@@ -0,0 +1,142 @@
+// Concept-vs-production inventory of the Tag image dialog (plan Mock inventory M2: docs/concepts/workspace/app.js
+// tagReview a1037–1061, renderTagModelOptions a1062–1076, generateTags a1077–1135; style.css s1598–1694) and of the
+// card's Info and Tag group (M1: app.js mediaCard a398, style.css s1589–1597). The *Of functions run in the page.
+// The concept is never rewritten: mapConceptTagging applies only the recorded deviations, each named with its D-number
+// or ruling; everything else must be equal.
+export {diffInventory as diffTaggingInventory} from './library-editor-canonical-comparison.mjs';
+
+/** The open Tag image dialog (`dialog#modal`), its controls in order with their concept tokens. */
+export function taggingInventory(dialog) {
+    const css=(node,...keys)=>{const style=getComputedStyle(node);return Object.fromEntries(keys.map(key=>[key,style[key]]));};
+    const px=value=>Math.round(value*2)/2;
+    const box=node=>{const rect=node.getBoundingClientRect();return {width:px(rect.width),height:px(rect.height)};};
+    const font=node=>css(node,'fontSize','fontWeight','lineHeight','color','marginTop','marginBottom');
+    const edges=node=>css(node,'paddingTop','paddingRight','paddingBottom','paddingLeft','borderTopWidth','borderTopStyle','borderTopColor',
+        'borderTopLeftRadius','backgroundColor');
+    const buttonOf=node=>({text:node.textContent.trim(),label:node.getAttribute('aria-label'),primary:node.classList.contains('ca-primary'),
+        icon:node.querySelector('svg')!==null,disabled:node.getAttribute('aria-disabled')==='true'||node.disabled,
+        ...css(node,'minHeight','fontSize','color','backgroundColor','borderTopColor','borderTopLeftRadius')});
+    const controlOf=node=>({tag:node.tagName.toLowerCase(),id:node.id,type:node.type??null,value:node.value,
+        min:node.getAttribute('min'),max:node.getAttribute('max'),step:node.getAttribute('step'),
+        describedBy:node.getAttribute('aria-describedby'),
+        options:node.tagName==='SELECT'?[...node.options].map(option=>[option.value,option.textContent]):null,
+        ...css(node,'fontSize','minHeight','backgroundColor','color','borderTopColor','borderTopLeftRadius','paddingLeft')});
+    const fieldOf=field=>{const label=field.querySelector('label'),control=field.querySelector('input,textarea,select');
+        return {label:label.textContent,labelled:label.htmlFor===control.id,...css(field,'display','rowGap','marginTop','marginBottom'),control:controlOf(control)};};
+    const header=dialog.querySelector('.dialog-header'),title=header.querySelector('h2'),close=header.querySelector('button');
+    const body=dialog.querySelector('#modal-body');
+    const heading=body.querySelector('.tag-image-heading');
+    const preview=heading.querySelector('.tag-image-preview'),copy=heading.querySelector(':scope > div');
+    const sizeChip=copy.querySelector('.chip');
+    const note=body.querySelector('.tag-scope-note');
+    const manual=body.querySelector('#manual-image-tags'),manualField=manual.closest('.field'),help=body.querySelector('#manual-tags-help');
+    const panel=body.querySelector('.tag-model-panel'),options=panel.querySelector('#image-tag-model-options');
+    const generate=[...panel.querySelectorAll('button')].at(-1);
+    const suggestions=body.querySelector('section.tag-suggestion-panel');
+    const list=suggestions.querySelector('#tag-suggestions'),status=suggestions.querySelector('#tag-generation-status');
+    const count=suggestions.querySelector('#suggestion-count');
+    const actions=body.querySelector('.dialog-actions');
+    // A suggestion is a concept checkbox row (`label.tag-suggestion`) or a production chip (`span.chip.tag-suggestion`).
+    const rows=[...list.querySelectorAll('.tag-suggestion')].map(row=>{
+        const name=row.querySelector('span:not(.tag-confidence)'),confidence=row.querySelector('.tag-confidence');
+        const checkbox=row.querySelector('input[type=checkbox]'),remove=row.querySelector('button');
+        return {name:name.textContent,confidence:confidence.textContent,
+            control:checkbox?{kind:'checkbox',checked:checkbox.checked}:remove?{kind:'remove',label:remove.getAttribute('aria-label')}:null,
+            ...css(row,'display','alignItems','borderTopColor','backgroundColor','borderTopWidth','borderTopStyle','borderTopLeftRadius','fontSize','paddingTop','paddingLeft'),
+            confidenceToken:css(confidence,'color','fontSize')};
+    });
+    return {
+        dialog:{...css(dialog,'paddingTop','paddingRight','paddingBottom','paddingLeft','borderTopLeftRadius','backgroundColor','color','overflowY'),
+            width:px(dialog.getBoundingClientRect().width),modal:dialog.matches(':modal'),tagging:dialog.classList.contains('tagging-modal'),
+            labelledBy:document.getElementById(dialog.getAttribute('aria-labelledby'))===title,
+            noHorizontalOverflow:dialog.scrollWidth<=dialog.clientWidth+1},
+        header:{title:{text:title.textContent,...font(title)},close:{label:close.getAttribute('aria-label'),text:close.textContent.trim()}},
+        demo:body.querySelector('.demo-note')?.textContent??null,
+        order:[...body.children].map(node=>node.className),
+        heading:{...css(heading,'display','columnGap','alignItems','marginBottom'),
+            preview:{tag:preview.tagName.toLowerCase(),alt:preview.getAttribute('alt'),...box(preview),...css(preview,'objectFit','borderTopLeftRadius','borderTopWidth','borderTopStyle','borderTopColor','flexShrink')},
+            h3:{text:copy.querySelector('h3').textContent,...font(copy.querySelector('h3'))},
+            filename:{text:copy.querySelector('p.small').textContent,...font(copy.querySelector('p.small'))},
+            size:sizeChip?{text:sizeChip.textContent,...css(sizeChip,'marginTop','fontSize','borderTopColor','borderTopLeftRadius','paddingLeft')}:null},
+        scopeNote:note?{text:note.textContent,...edges(note),...css(note,'borderLeftWidth','borderLeftStyle','borderLeftColor','fontSize','color')}:null,
+        manual:{...fieldOf(manualField),help:{text:help.textContent,...font(help)},described:help.id===manual.getAttribute('aria-describedby')},
+        modelPanel:{...edges(panel),...css(panel,'marginTop'),h3:{text:panel.querySelector('h3').textContent,...font(panel.querySelector('h3'))},
+            fields:[...panel.querySelectorAll('.field')].map(fieldOf),
+            twoCol:options.querySelector('.two-col')?{columns:getComputedStyle(options.querySelector('.two-col')).gridTemplateColumns.split(' ').length,
+                ...css(options.querySelector('.two-col'),'display','columnGap')}:null,
+            generate:buttonOf(generate)},
+        suggestions:{labelled:suggestions.getAttribute('aria-labelledby')===suggestions.querySelector('h3').id,...css(suggestions,'marginTop'),
+            title:{text:suggestions.querySelector('h3').textContent,...font(suggestions.querySelector('h3'))},
+            count:{text:count.textContent,...font(count)},
+            copy:list.querySelector(':scope > p.small')?.textContent??null,
+            rows,
+            status:{text:status.textContent,role:status.getAttribute('role'),...css(status,'marginTop','fontSize','color')}},
+        actions:{...css(actions,'position','bottom','marginLeft','marginRight','marginBottom','paddingTop','paddingLeft','backgroundColor',
+            'borderTopWidth','borderTopStyle','borderTopColor','zIndex','display','justifyContent','columnGap'),
+            buttons:[...actions.querySelectorAll('button')].map(buttonOf)},
+        noPageScroll:document.documentElement.scrollWidth<=innerWidth+1,
+    };
+}
+
+/** The first image card's Info and Tag group (M1), with its card's filename. */
+export function cardActionsInventory(card) {
+    const css=(node,...keys)=>{const style=getComputedStyle(node);return Object.fromEntries(keys.map(key=>[key,style[key]]));};
+    const info=card.querySelector('.media-info'),actions=info.querySelector(':scope > .image-card-actions');
+    return {
+        info:css(info,'display','justifyContent','alignItems','columnGap'),
+        actions:{...css(actions,'display','alignItems','columnGap','flexShrink','minWidth'),lastInInfo:info.lastElementChild===actions},
+        buttons:[...actions.querySelectorAll(':scope > button')].map(node=>{const rect=node.getBoundingClientRect();return {
+            className:node.className,label:node.getAttribute('aria-label'),icon:node.querySelector('svg')?.innerHTML.replace(/\s+/g,' ').trim()??null,
+            width:Math.round(rect.width),height:Math.round(rect.height),
+            ...css(node,'minWidth','minHeight','paddingLeft','paddingTop','borderTopLeftRadius','borderTopColor','backgroundColor','color')};}),
+    };
+}
+
+// D84 (plan D61): the legacy engines' values, labels and sizes, GGUF JoyCaption in the concept's Ollama slot.
+const MODEL_LABELS=Object.freeze({'wd14-swinv2':['wd14-swinv2','WD14 SwinV2 · ~400 MB'],'wd14-vit':['wd14-vit','WD14 ViT · ~400 MB'],
+    ollama:['gguf','GGUF JoyCaption (Recommended) · ~4.5 GB'],huggingface:['hf','HuggingFace JoyCaption · ~16 GB']});
+const CONCEPT_LABELS=Object.freeze({'WD14 SwinV2 · fast classifier':'WD14 SwinV2 · ~400 MB','WD14 ViT · visual tags':'WD14 ViT · ~400 MB',
+    'Ollama · local language model':'GGUF JoyCaption (Recommended) · ~4.5 GB','HuggingFace · language model':'HuggingFace JoyCaption · ~16 GB'});
+
+/**
+ * The concept inventory with the recorded deviations applied:
+ * - no prototype note (Global Constraints: `Prototype · suggestions are simulated…` is not shipped);
+ * - D83 (ruling T4): while suggestions exist, "Remove anything you do not want to add." leads them, and every
+ *   suggestion is a chip with a `Remove <name>` × instead of a checked checkbox row: the concept's own `.chip` corner
+ *   (`chip`: a concept `.chip` inventory, the heading's size chip) around the row's own text (12px) in the checked
+ *   row's colours (accent border, `--soft-blue`);
+ * - D84 (plan D61): the legacy engine labels and values, and the server's default instructions (`instructions`);
+ * - D91 (plan D68): a Suggestions count field after the model's own fields, on the concept's number field tokens
+ *   (`numberField`: the concept's General confidence field) with the configured count (`limit`);
+ * - D29: the prototype's "Sample suggestions from …" status reads "Suggestions from …".
+ * The opened state is compared unmapped: both show the concept's on-screen "Generate suggestions with the selected
+ * model before approving." (its renderTagModelOptions, a1062–1076, replaces the markup's sentence at once).
+ */
+export function mapConceptTagging(reference,{instructions,limit=10,chip,numberField}) {
+    const [select,...own]=reference.modelPanel.fields;
+    const suggestionsField={...numberField,label:'Suggestions',control:{...numberField.control,id:'image-suggestion-limit',
+        value:String(limit),min:'1',max:'100',step:'1'}};
+    const mappedOwn=own.map(field=>field.control.id==='image-tag-instructions'?{...field,control:{...field.control,value:instructions}}:field);
+    const rows=reference.suggestions.rows.map(row=>({...row,
+        control:row.control?.kind==='checkbox'&&row.control.checked?{kind:'remove',label:`Remove ${row.name}`}:row.control,
+        borderTopLeftRadius:chip.borderTopLeftRadius}));
+    const copy=rows.length&&reference.suggestions.copy===null?'Remove anything you do not want to add.':reference.suggestions.copy;
+    const status=reference.suggestions.status.text.replace(/^Sample suggestions from (.+)\. Approve tags to save\.$/,
+        (_,label)=>`Suggestions from ${CONCEPT_LABELS[label]??label}. Approve tags to save.`);
+    return {...reference,
+        demo:null,
+        order:reference.order.filter(name=>name!=='demo-note'),
+        modelPanel:{...reference.modelPanel,
+            fields:[{...select,control:{...select.control,value:MODEL_LABELS[select.control.value]?.[0]??select.control.value,
+                options:select.control.options.map(([value])=>MODEL_LABELS[value])}},...mappedOwn,suggestionsField]},
+        suggestions:{...reference.suggestions,copy,rows,status:{...reference.suggestions.status,text:status}},
+    };
+}
+
+/**
+ * Production's own chip geometry beyond the concept's `.chip` (D83): the chip's padding hugs its × button. Only the
+ * leaves D83 replaces are dropped from both sides; names, confidences, colours, radius and font stay compared.
+ */
+export function withoutChipGeometry(inventory) {
+    return {...inventory,suggestions:{...inventory.suggestions,rows:inventory.suggestions.rows.map(({paddingTop,paddingLeft,alignItems,...row})=>row)}};
+}

tests/browser/tagging-concept.spec.mjs

@@ -0,0 +1,307 @@
+// The Tag image dialog and the card's Info and Tag group against the approved concept (#249 PR C, plan Task C4, Mock
+// inventory M1 and M2). Production runs on the concept-shaped fixture with the concept image's own tags saved as its
+// image tags and the injected fake model answering the concept's own sample (alpine: mountain 98%, observatory 95%,
+// snow 88%, blue_hour 81%), so every remaining difference is a recorded deviation applied by mapConceptTagging
+// (D29, D83, D84, D91) or a test failure. No model is ever downloaded: every test checks no download request was sent.
+import { test, expect } from './fixtures.mjs';
+import { seedConcept, openConcept, openProduction, saveImageTags, mutate, SIZES, THEMES } from './concept-inventory.mjs';
+import { taggingInventory, cardActionsInventory, mapConceptTagging, diffTaggingInventory, withoutChipGeometry } from './tagging-canonical-comparison.mjs';
+
+const MODULE = '/prompt_manager/js/workspace/image-tagging.mjs';
+// The concept's first image (app.js images[0]) and its sample suggestions (generateTags, scene "alpine").
+const CONCEPT_FILE = 'alpine_00001.png';
+const CONCEPT_TAGS = ['cinematic', 'blue_hour', 'architecture'];
+const ALPINE = [['mountain', 0.98], ['observatory', 0.95], ['snow', 0.88], ['blue_hour', 0.81]];
+// The fake model's server default instructions (tests/browser/server.py TestModel.default_prompt), D84.
+const INSTRUCTIONS = 'Describe the image';
+const CONCEPT_MODEL = { gguf: 'ollama' };
+
+const tagDialog = page => page.getByRole('dialog', { name: 'Tag image', exact: true });
+const firstCard = (page, side) => page.locator(side === 'concept' ? '#image-grid > article.media-card' : '#workspace-main article[data-image-key]').first();
+
+test.beforeEach(async ({ page, request }) => {
+    const manifest = await seedConcept(request);
+    expect(manifest).toBeTruthy();
+    await expect(await request.post('/__test__/tagging/suggestions', { data: { scored: ALPINE } })).toBeOK();
+    page.downloads = [];
+    page.on('request', item => { if (/\/autotag\/download\//.test(item.url())) page.downloads.push(item.url()); });
+    page.errors = [];
+    page.on('pageerror', error => page.errors.push(error.message));
+});
+test.afterEach(async ({ page, request }) => {
+    await leave(page);
+    expect(page.downloads).toEqual([]);
+    expect(page.errors).toEqual([]);
+    await request.post('/__test__/tagging/suggestions', { data: { scored: null } });
+});
+
+async function conceptPath(request) {
+    const listing = await (await request.get('/prompt_manager/images/output?mode=workspace&limit=40')).json();
+    const image = listing.images.find(item => item.filename === CONCEPT_FILE);
+    expect(image).toBeTruthy();
+    return image.path;
+}
+
+/**
+ * Close an open Tag dialog before opening the next page, so each comparison starts from a settled page. Leaving with
+ * the dialog open is covered on its own (workspace-tagging-lifecycle.spec.mjs: the keepalive release on pagehide).
+ */
+async function leave(page) {
+    if (await tagDialog(page).count()) {
+        await page.keyboard.press('Escape');
+        await expect(tagDialog(page)).toHaveCount(0);
+    }
+}
+/** Open `side`'s Tag image dialog from its first card, settled (production: the capture preview and saved tags). */
+async function openTagDialog(page, side, theme) {
+    await leave(page);
+    if (side === 'concept') await openConcept(page, 'images', theme);
+    else await openProduction(page, 'images', theme);
+    await firstCard(page, side).getByRole('button', { name: `Tag or auto-tag ${CONCEPT_FILE}`, exact: true }).click();
+    await expect(tagDialog(page)).toBeVisible();
+    await settled(page, side);
+}
+async function settled(page, side) {
+    if (side === 'production') {
+        await expect(tagDialog(page).locator('img.tag-image-preview')).toHaveAttribute('src', /\/image-annotations\/capture\//);
+        await expect(tagDialog(page).locator('#manual-image-tags')).toHaveValue(CONCEPT_TAGS.join(', '));
+    }
+    await page.evaluate(async () => {
+        await document.fonts.ready;
+        await Promise.all([...document.querySelectorAll('#modal img')].map(image => image.decode().catch(() => {})));
+    });
+}
+async function generateWith(page, side, model) {
+    const select = tagDialog(page).getByRole('combobox', { name: 'Tagging model', exact: true });
+    if (model) await select.selectOption(side === 'concept' ? CONCEPT_MODEL[model] ?? model : model);
+    await tagDialog(page).getByRole('button', { name: 'Generate suggestions', exact: true }).click();
+    await expect(tagDialog(page).locator('#suggestion-count')).not.toHaveText('Not generated');
+}
+// The pointer rests outside the dialog, so no control is measured in its hover state.
+const inventory = async page => {
+    await page.mouse.move(0, 0);
+    return page.locator('dialog#modal').evaluate(taggingInventory);
+};
+
+/** The concept and production inventories of one dialog state, the concept mapped (D29, D83, D84, D91). */
+async function compareState(page, { theme, act = async () => {} }) {
+    await openTagDialog(page, 'concept', theme);
+    const conceptOpened = await inventory(page);
+    await act(page, 'concept');
+    const concept = await inventory(page);
+    await openTagDialog(page, 'production', theme);
+    await act(page, 'production');
+    const actual = await inventory(page);
+    const numberField = conceptOpened.modelPanel.fields.find(field => field.control.id === 'image-general-threshold');
+    const reference = mapConceptTagging(concept, { instructions: INSTRUCTIONS, chip: concept.heading.size, numberField });
+    return { reference: withoutChipGeometry(reference), actual: withoutChipGeometry(actual) };
+}
+
+for (const [width, height] of SIZES) for (const theme of THEMES) {
+    test(`concept and production Tag dialog match at ${width}x${height} ${theme}`, async ({ page, request }) => {
+        test.setTimeout(90_000);
+        await saveImageTags(request, await conceptPath(request), CONCEPT_TAGS);
+        await page.setViewportSize({ width, height });
+        // Opened, generated with WD14 (the concept's default), then generated with a language model.
+        for (const [state, act] of [
+            ['opened', async () => {}],
+            ['generated WD14', (page, side) => generateWith(page, side)],
+            ['generated GGUF', (page, side) => generateWith(page, side, 'gguf')],
+        ]) {
+            const { reference, actual } = await compareState(page, { theme, act });
+            expect(diffTaggingInventory(reference, actual), `${state} at ${width}x${height} ${theme}`).toEqual([]);
+        }
+        // Pinned concept geometry (M2), so a mapping mistake on both sides cannot pass unseen.
+        const { actual } = await compareState(page, { theme, act: (page, side) => generateWith(page, side) });
+        const small = width <= 700;
+        expect([actual.heading.preview.width, actual.heading.preview.height]).toEqual(small ? [86, 86] : [112, 100]);
+        expect(actual.heading.columnGap).toBe('16px');
+        expect([actual.modelPanel.paddingTop, actual.modelPanel.borderTopLeftRadius]).toEqual(['16px', '6px']);
+        expect(actual.actions.position).toBe('sticky');
+        expect(actual.suggestions.rows.map(row => [row.name, row.confidence, row.control.label])).toEqual(
+            ALPINE.map(([name, confidence]) => [name, `${Math.round(confidence * 100)}%`, `Remove ${name}`]));
+        const accent = await page.evaluate(() => {
+            const probe = document.createElement('i');
+            probe.style.cssText = 'border-top:1px solid var(--ca-accent);background:var(--soft-blue)';
+            document.body.append(probe);
+            const style = getComputedStyle(probe), tokens = [style.borderTopColor, style.backgroundColor];
+            probe.remove();
+            return tokens;
+        });
+        for (const row of actual.suggestions.rows) expect([row.borderTopColor, row.backgroundColor]).toEqual(accent);
+        expect(actual.dialog.noHorizontalOverflow).toBe(true);
+        expect(actual.noPageScroll).toBe(true);
+    });
+}
+
+test('an empty result matches the concept below its threshold', async ({ page, request }) => {
+    await saveImageTags(request, await conceptPath(request), CONCEPT_TAGS);
+    await expect(await request.post('/__test__/tagging/suggestions', { data: { scored: [] } })).toBeOK();
+    const { reference, actual } = await compareState(page, { theme: 'dark', act: async (page, side) => {
+        // The concept filters its sample by the General confidence; above every sample nothing is shown.
+        if (side === 'concept') await tagDialog(page).getByRole('spinbutton', { name: 'General confidence', exact: true }).fill('1');
+        await generateWith(page, side);
+        if (side === 'concept') await tagDialog(page).getByRole('spinbutton', { name: 'General confidence', exact: true }).fill('0.35');
+    } });
+    expect(actual.suggestions.copy).toBe('No suggestions met this threshold. Adjust it or enter tags manually.');
+    expect(diffTaggingInventory(reference, actual)).toEqual([]);
+});
+
+test('review-scoped dialog shows the scope note', async ({ page, request }) => {
+    const path = await conceptPath(request);
+    await saveImageTags(request, path, CONCEPT_TAGS);
+    await page.setViewportSize({ width: 1600, height: 1100 });
+    await openConcept(page, 'review', 'dark');
+    await page.locator('#main section.surface').getByRole('button', { name: 'Tag image', exact: true }).click();
+    await expect(tagDialog(page)).toBeVisible();
+    await settled(page, 'concept');
+    const opened = await inventory(page);
+    // Needs review ships with PR F; until then the review source opens the same dialog from the module.
+    await leave(page);
+    await openProduction(page, 'images', 'dark');
+    await page.evaluate(async ({ module, path }) => {
+        const { openImageTagging } = await import(module);
+        const { createScope } = await import('/prompt_manager/js/shared/toolkit/core.js');
+        const api = window.ApiClient.createApiClient();
+        const listing = await api.get('/prompt_manager/images/output?mode=workspace&limit=40');
+        openImageTagging({ api, scope: createScope(), image: listing.images.find(item => item.path === path), source: 'review' });
+    }, { module: MODULE, path });
+    await expect(tagDialog(page)).toBeVisible();
+    await settled(page, 'production');
+    const actual = await inventory(page);
+    expect(actual.scopeNote.text).toBe('Tags belong to this image. Resolve its prompt association separately in Needs review.');
+    expect(actual.order).toEqual(['tag-image-heading', 'tag-scope-note small', 'field', 'tag-model-panel', 'tag-suggestion-panel', 'dialog-actions']);
+    const numberField = opened.modelPanel.fields.find(field => field.control.id === 'image-general-threshold');
+    const reference = mapConceptTagging(opened, { instructions: INSTRUCTIONS, chip: opened.heading.size, numberField });
+    expect(diffTaggingInventory(reference, actual)).toEqual([]);
+});
+
+for (const [width, height] of SIZES) test(`card action group matches M1 at ${width}x${height}`, async ({ page }) => {
+    await page.setViewportSize({ width, height });
+    await openConcept(page, 'images', 'dark');
+    const reference = await firstCard(page, 'concept').evaluate(cardActionsInventory);
+    await openProduction(page, 'images', 'dark');
+    const actual = await firstCard(page, 'production').evaluate(cardActionsInventory);
+    expect(actual.buttons.map(button => button.label)).toEqual([`Inspect ${CONCEPT_FILE}`, `Tag or auto-tag ${CONCEPT_FILE}`]);
+    expect(diffTaggingInventory(reference, actual)).toEqual([]);
+});
+
+test('the comparison notices a changed panel border or primary label', async ({ page, request }) => {
+    await saveImageTags(request, await conceptPath(request), CONCEPT_TAGS);
+    const { reference, actual } = await compareState(page, { theme: 'dark' });
+    expect(diffTaggingInventory(reference, actual)).toEqual([]);
+    const undo = await mutate(page, { css: '.tag-model-panel { border: 0 !important; }' });
+    const borderless = withoutChipGeometry(await inventory(page));
+    expect(diffTaggingInventory(reference, borderless).map(item => item.path)).toEqual(
+        expect.arrayContaining(['modelPanel.borderTopWidth', 'modelPanel.borderTopStyle']));
+    await undo();
+    await tagDialog(page).locator('.dialog-actions .ca-primary').evaluate(node => { node.textContent = 'Save'; });
+    const relabelled = withoutChipGeometry(await inventory(page));
+    expect(diffTaggingInventory(reference, relabelled).map(item => item.path)).toEqual(['actions.buttons.1.text']);
+});
+
+// Paired captures for the PR (no screenshot baselines): every production state beside the concept's nearest one. The
+// states the concept lacks (unavailable model, saving, conflict, file changed) pair with the concept's opened dialog.
+test('paired Tag dialog captures', async ({ page, request }, testInfo) => {
+    test.setTimeout(120_000);
+    const path = await conceptPath(request);
+    await saveImageTags(request, path, CONCEPT_TAGS);
+    await page.setViewportSize({ width: 1600, height: 1100 });
+    const shot = async name => {
+        await page.evaluate(async () => { await document.fonts.ready; await Promise.all([...document.images].map(image => image.decode().catch(() => {}))); });
+        const file = testInfo.outputPath(`${name}.png`);
+        await page.screenshot({ path: file });
+        await testInfo.attach(name, { path: file, contentType: 'image/png' });
+    };
+    const both = async (name, act) => {
+        for (const side of ['concept', 'production']) {
+            await openTagDialog(page, side, 'dark');
+            await act(page, side);
+            await shot(`${side}-${name}`);
+        }
+    };
+    await both('opened', async () => {});
+    await both('generated-wd14', (page, side) => generateWith(page, side));
+    await both('generated-gguf', (page, side) => generateWith(page, side, 'gguf'));
+    await expect(await request.post('/__test__/tagging/suggestions', { data: { scored: [] } })).toBeOK();
+    await both('empty', async (page, side) => {
+        if (side === 'concept') await tagDialog(page).getByRole('spinbutton', { name: 'General confidence', exact: true }).fill('1');
+        await generateWith(page, side);
+    });
+    await expect(await request.post('/__test__/tagging/suggestions', { data: { scored: ALPINE } })).toBeOK();
+    const save = () => tagDialog(page).locator('.dialog-actions .ca-primary').click();
+    const status = () => tagDialog(page).locator('#tag-generation-status');
+
+    // Unavailable model.
+    await expect(await request.post('/__test__/tagging/models', { data: { unavailable: ['wd14-swinv2'] } })).toBeOK();
+    await openTagDialog(page, 'production', 'dark');
+    await generateWith(page, 'production').catch(() => {});
+    await expect(status()).toHaveText('WD14 SwinV2 is not downloaded. Download it from the legacy Auto-tag page.');
+    await shot('production-unavailable');
+    await expect(await request.post('/__test__/tagging/models', { data: { unavailable: [] } })).toBeOK();
+
+    // Saving: the write is held until the capture is taken.
+    let release;
+    const held = new Promise(resolve => { release = resolve; });
+    const writes = url => url.pathname === '/prompt_manager/image-annotations/tags';
+    await page.route(writes, async route => { await held; await route.continue(); });
+    await openTagDialog(page, 'production', 'dark');
+    const sent = page.waitForRequest(item => writes(new URL(item.url())));
+    await save();
+    await sent;
+    await expect(tagDialog(page).locator('.dialog-actions .ca-primary')).toHaveAttribute('aria-disabled', 'true');
+    await shot('production-saving');
+    release();
+    await expect(tagDialog(page)).toHaveCount(0);
+    await page.unroute(writes);
+
+    // Conflict: another writer saved this file's set after the dialog observed it.
+    await openTagDialog(page, 'production', 'dark');
+    await saveImageTags(request, path, ['changed_elsewhere']);
+    await save();
+    await expect(status()).not.toHaveText('');
+    await shot('production-conflict');
+    await page.keyboard.press('Escape');
+
+    // File changed: the server's own envelope for bytes replaced after the preview (B1 `file-changed`).
+    await page.route(writes, route => route.fulfill({ status: 409, contentType: 'application/json',
+        body: JSON.stringify({ success: false, code: 'file-changed', error: 'The file changed since it was previewed. Reopen the Tag dialog.' }) }));
+    await saveImageTags(request, path, CONCEPT_TAGS);
+    await openTagDialog(page, 'production', 'dark');
+    await save();
+    await expect(status()).not.toHaveText('');
+    await shot('production-file-changed');
+    await page.unroute(writes);
+    await page.keyboard.press('Escape');
+
+    // Unconfirmed save (a 504): D116's Retry leads the actions, before Cancel and the disabled primary.
+    await page.route(writes, route => route.fulfill({ status: 504, body: 'Gateway Timeout' }));
+    await openTagDialog(page, 'production', 'dark');
+    await save();
+    await expect(status()).toHaveText('The save could not be confirmed. Retry sends the same tags again.');
+    expect((await inventory(page)).actions.buttons.map(button => [button.text, button.primary, button.disabled])).toEqual(
+        [['Retry', false, false], ['Cancel', false, false], ['Save manual tags', true, true]]);
+    await shot('production-unknown-outcome');
+    await page.unroute(writes);
+    await page.keyboard.press('Escape');
+
+    // Review scope: the concept's Needs review dialog and production's review-sourced dialog.
+    await leave(page);
+    await openConcept(page, 'review', 'dark');
+    await page.locator('#main section.surface').getByRole('button', { name: 'Tag image', exact: true }).click();
+    await expect(tagDialog(page)).toBeVisible();
+    await shot('concept-review');
+    await leave(page);
+    await openProduction(page, 'images', 'dark');
+    await page.evaluate(async ({ module, path }) => {
+        const { openImageTagging } = await import(module);
+        const { createScope } = await import('/prompt_manager/js/shared/toolkit/core.js');
+        const api = window.ApiClient.createApiClient();
+        const listing = await api.get('/prompt_manager/images/output?mode=workspace&limit=40');
+        openImageTagging({ api, scope: createScope(), image: listing.images.find(item => item.path === path), source: 'review' });
+    }, { module: MODULE, path });
+    await expect(tagDialog(page).locator('.tag-scope-note')).toBeVisible();
+    await settled(page, 'production');
+    await shot('production-review');
+    await leave(page);
+});

tests/browser/vocabulary-canonical-comparison.mjs

@@ -64,12 +64,10 @@ export function pageInventoryOf(main) {
 // Recorded deviations only (plan "Mock inventory" + decisions D1-D15 + ledger rulings). Everything else must be equal.
 export function mapVocabularyConcept(reference) {
     return {...reference,
-        heading:{...reference.heading,actions:{...reference.heading.actions,
-            // D2: Auto-tag images is omitted until the image-annotation slice owns image tags.
-            buttons:reference.heading.actions.buttons.filter(item=>item.text!=='Auto-tag images')}},
         table:{...reference.table,rows:reference.table.rows.map(row=>({...row,
-            // D3: no image-tag owner yet, so the Images cell shows "—" with a visually hidden "Not available yet".
-            images:'—',imagesHidden:'Not available yet'}))},
+            // Data, not a deviation: the concept tags each sample image with its prompt's tags; the vocabulary fixture
+            // tags no image, so every Images count is 0 (#249 C2 retired #245 D3).
+            images:'0'}))},
         operations:reference.operations.map(row=>({...row,p:{...row.p,
             // Ledger ruling: "1 positive prompts" -> singular, consistent with the shared plural helper (#238/#243).
             text:row.p.text.replace(/^1 positive prompts$/,'1 positive prompt')}})),

tests/browser/workflows.spec.mjs

@@ -43,6 +43,55 @@ test('actual gallery form saves a prompt that the admin page can edit and reload
     expect((await saved.json()).prompt_id).not.toBe(Number(id));
 });
 
+// WebKit fails a fetch that a leaving page starts ("Fetch API cannot load … due to access control checks."), and
+// Playwright reports that console error as a page error. A save's follow-up reads must not start once the page hides:
+// here the statistics read after an in-place edit is held at the server while the page reloads.
+test('an in-place edit whose follow-up reads outlive the page starts no read while it leaves', async ({ page, request }) => {
+    await page.goto('/prompt_manager/admin');
+    const text = page.locator('.prompt-text').filter({ hasText: 'Cat portrait' });
+    const id = await text.getAttribute('data-id');
+    await expect(await request.post('/__test__/hold', { data: { path: '/prompt_manager/stats' } })).toBeOK();
+    await page.locator(`[data-action="edit"][data-prompt-id="${id}"]`).click();
+    const editor = page.locator(`.prompt-text[data-id="${id}"]`);
+    await editor.fill('Cat portrait at dusk');
+    await editor.press('Enter');
+    const held = async () => (await (await request.get('/__test__/hold')).json()).held['/prompt_manager/stats'];
+    await expect.poll(held).toBe(1);
+    await page.reload({ waitUntil: 'commit' });
+    await expect(await request.post('/__test__/release')).toBeOK();
+    await expect(page.locator('.prompt-text').filter({ hasText: 'Cat portrait at dusk' })).toBeVisible();
+});
+
+// A leave that never happens (a stopped navigation, or one answered with a download) must not leave the list dead.
+test('a page whose leave was called off reads its list again on the next input', async ({ page }) => {
+    await page.goto('/prompt_manager/admin');
+    await expect(page.locator('.prompt-text').first()).toBeVisible();
+    await page.evaluate(() => window.dispatchEvent(new Event('beforeunload')));
+    await page.mouse.click(1, 1);
+    const reread = page.waitForResponse(response => new URL(response.url()).pathname === '/prompt_manager/recent');
+    await page.locator('#sortBy').selectOption('created_asc');
+    expect(new URL((await reread).url()).searchParams.get('sort')).toBe('created_asc');
+    await expect(page.locator('#resultsTitle')).toHaveText('Recent Prompts');
+});
+
+// The gallery's startup thumbnail check runs a second after load. When that second ends while the page is leaving,
+// the check must start no read: WebKit fails it with "Fetch API cannot load … due to access control checks." and
+// Playwright reports a page error (seen in CI on PR #289). The page clock makes the second end after the leave began.
+for (const leave of ['beforeunload', 'pagehide']) {
+    test(`the gallery startup check starts no read after ${leave}`, async ({ page }) => {
+        await page.clock.install();
+        const statusReads = [];
+        page.on('request', req => { if (req.url().includes('/images/thumbnails/status')) statusReads.push(req.url()); });
+        await page.goto('/prompt_manager/gallery');
+        await expect(page.locator('#galleryGrid .image-item')).toHaveCount(2);
+        await page.evaluate(type => window.dispatchEvent(new Event(type)), leave);
+        await page.clock.runFor(1500);
+        // A read made after the clock ran is listed, so the listener saw every status read.
+        await page.evaluate(() => fetch('/prompt_manager/images/thumbnails/status?probe=1'));
+        expect(statusReads.map(url => new URL(url).search)).toEqual(['?probe=1']);
+    });
+}
+
 test('actual gallery review generates and persists tags for the selected root', async ({ page, request }) => {
     await page.goto('/prompt_manager/gallery');
     await expect(page.locator('#galleryGrid .image-item')).toHaveCount(2);

tests/browser/workspace-activity.spec.mjs

@@ -2,6 +2,13 @@ import { startCoverage, saveCoverage } from '../../tools/vendor/browser-coverage
 import { test, expect } from './fixtures.mjs';
 import { seedConcept, openConcept, openProduction } from './concept-inventory.mjs';
 
+// The Activity store's periodic list read (activity-store.mjs POLL_MS) and the detail view's read throttle
+// (activity-job-view.mjs DETAIL_INTERVAL_MS).
+const POLL_MS = 15_000;
+const DETAIL_INTERVAL_MS = 1_000;
+// A request is reported to the test a little after the browser sends it; that delay is not a shorter wait.
+const REPORT_SLACK_MS = 100;
+
 // Activity (#249 Activity-1): the concept's Activity page (app.js renderActivity 732–738), its top-bar button
 // (index.html 51–52) and sidebar row (app.js ~341), with the recorded D52 (counts of running jobs), D53 (the progress
 // pill) and D54 (real job items). Fake jobs come from tests/browser/workspace_activity_fixture.py.
@@ -278,6 +285,8 @@ test('reload during a scan reattaches to the running job', async ({ page, reques
 });
 
 test('lost server clears the pill and marks jobs ended', async ({ page, request }) => {
+    // A poll interval after the restart, then failed re-reads backing off for 1 + 2 + 4 s.
+    test.setTimeout(90_000);
     await page.setViewportSize({ width: 1600, height: 1100 });
     const job = await startJob(request);
     await step(request, job.id, { processed: 4000 });
@@ -294,9 +303,12 @@ test('lost server clears the pill and marks jobs ended', async ({ page, request
     await expect(items(page).first().locator('p')).toHaveText(LOST);
     await expect(items(page).first().locator('progress, .row-actions')).toHaveCount(0);
     await expect(navRow(page).locator('.nav-count')).toHaveCount(0);
-    // One re-read found the restart; there is no retry storm and no finish toast for a job that only vanished.
-    await page.waitForTimeout(2500);
-    expect(reads.length).toBeLessThanOrEqual(2);
+    // One re-read found the restart; there is no retry storm and no finish toast for a job that only vanished. The
+    // read after it is the periodic one, a whole poll interval later: any extra read lands in that gap and fails it.
+    const found = reads.length;
+    expect(found, 'reads that found the restart').toBeGreaterThanOrEqual(1);
+    await expect.poll(() => reads.length, { timeout: POLL_MS + 10_000 }).toBeGreaterThan(found);
+    expect(reads[found] - reads[found - 1], 'the next read waits for the poll').toBeGreaterThanOrEqual(POLL_MS - REPORT_SLACK_MS);
     await expect(toast(page)).toHaveText('');
 
     // A server that cannot be read at all also ends the running job, then is read again with a growing backoff.
@@ -308,9 +320,12 @@ test('lost server clears the pill and marks jobs ended', async ({ page, request
     await expect(await request.post('/__test__/jobs/restart')).toBeOK();
     await expect(pill(page)).toBeHidden();
     await expect(items(page).filter({ hasText: LOST })).toHaveCount(1);
-    await page.waitForTimeout(3500);
-    // 1 s, then 2 s: at most two re-reads in 3.5 s.
-    expect(failed.length).toBeLessThanOrEqual(2);
+    // 1 s, then 2 s, then 4 s: each failed re-read waits twice as long as the one before. The gaps between the
+    // reads themselves are the evidence, so a slow runner noticing the ended job late cannot add a read to a window.
+    await expect.poll(() => failed.length, { timeout: 20_000 }).toBeGreaterThanOrEqual(3);
+    const gaps = failed.slice(1, 3).map((at, index) => at - failed[index]);
+    expect(gaps[0]).toBeGreaterThanOrEqual(2000 - REPORT_SLACK_MS);
+    expect(gaps[1]).toBeGreaterThanOrEqual(4000 - REPORT_SLACK_MS);
     await page.unroute('**/prompt_manager/jobs**');
     expect(second.id).not.toBe(job.id);
 });
@@ -607,6 +622,8 @@ test('filter narrows the selected outcome', async ({ page, request }) => {
 
 test('job view renders 200-row cap note', async ({ page, request }) => {
     await page.setViewportSize({ width: 1600, height: 1100 });
+    // The page's timers are Playwright's, running at real speed, so the M12 check below can run a read throttle out.
+    await page.clock.install();
     const job = await startJob(request);
     await step(request, job.id, { processed: 260, bulk: { group: 'added', count: 250 }, records: [
         ...Array.from({ length: 10 }, (_, index) => ({ group: 'no_metadata', path: `misc/plain_${index}.png`, detail: 'No prompt metadata in the file' })),
@@ -646,11 +663,15 @@ test('job view renders 200-row cap note', async ({ page, request }) => {
     page.on('request', item => { if (new URL(item.url()).pathname === `/prompt_manager/jobs/${job.id}`) reads.push(Date.now()); });
     await step(request, job.id, { processed: 300, bulk: { group: 'added', count: 40 } });
     await expect(tiles(page).first().locator('dd')).toHaveText('290');
-    await page.waitForTimeout(1500);
+    // Every read the counter update could have scheduled is due within one throttle interval: run it out, so any such
+    // read is sent before the log opens. Requests reach the test in the order they were sent, so once the log's read
+    // has answered, a read sent before it would already be listed.
+    await page.clock.runFor(DETAIL_INTERVAL_MS);
     expect(reads).toEqual([]);
     await scanLog(page).locator('summary').click();
     await expect.poll(() => reads.length).toBe(1);
     await expect(scanLog(page).locator('pre')).toContainText('bulk/file_00039.png');
+    expect(reads, 'only the log\'s own read').toHaveLength(1);
 });
 
 test('cancel scan ends cancelled with partial counts', async ({ page, request }) => {
@@ -678,16 +699,44 @@ test('cancel scan ends cancelled with partial counts', async ({ page, request })
     await expect(heading(page).getByRole('button', { name: 'Cancel scan', exact: true })).not.toHaveAttribute('aria-disabled', 'true');
 });
 
+// Truth rule: a held legacy-page job (a restore from the admin page) cannot be cancelled, so neither the Activity
+// list nor the job's view offers Cancel; the cancellable scan beside it keeps its own (review I3).
+test('a held legacy job shows no Cancel in the list or its view', async ({ page, request }) => {
+    await page.setViewportSize({ width: 1600, height: 1100 });
+    const response = await request.post('/__test__/jobs/hold', { data: { kind: 'restore', title: 'Database restore (admin page)' } });
+    await expect(response).toBeOK();
+    const held = (await response.json()).job;
+    expect(held.cancellable).toBe(false);
+    await page.goto(`${workspace}#/activity`);
+    const item = items(page).filter({ has: page.getByRole('link', { name: /Database restore \(admin page\)$/ }) });
+    await expect(item.locator('.chip')).toHaveText('Running');
+    await expect(item.locator('progress')).toHaveCount(1);
+    await expect(main(page).getByRole('button', { name: 'Cancel job', exact: true })).toHaveCount(0);
+
+    await item.getByRole('link').click();
+    await expect(heading(page).locator('h1')).toHaveText('Database restore (admin page)');
+    await expect(heading(page).locator('.heading-actions > button')).toHaveText(['Download report']);
+    await expect(heading(page).getByRole('button', { name: /^Cancel/ })).toHaveCount(0);
+
+    // When the hold ends the view shows the end, still without a Cancel.
+    await finish(request, held.id);
+    await expect(heading(page).locator('p.muted')).toHaveText(/^Finished/);
+    await expect(heading(page).locator('.heading-actions > button')).toHaveText(['Download report']);
+});
+
 test('busy start names the running job', async ({ page, request }) => {
     await page.setViewportSize({ width: 1600, height: 1100 });
+    // The page's timers are Playwright's, so the toast's lifetime below is run out rather than waited for.
+    await page.clock.install();
     const running = await startJob(request, { title: 'Database maintenance', kind: 'maintenance' });
     await startFromImport(page);
     await expect(toast(page)).toHaveText('Another job is running: Database maintenance.');
     await expect(toast(page).getByRole('link', { name: 'Database maintenance', exact: true })).toHaveAttribute('href', `#/activity/${running.id}`);
     await expect(page).toHaveURL(/#\/images$/);
     expect((await listed(request)).map(item => item.id)).toEqual([running.id]);
-    // Review M14: a toast with a link outlasts the plain 6.5 s, so the link stays reachable.
-    await page.waitForTimeout(7000);
+    // Review M14: a toast with a link outlasts the plain 6.5 s, so the link stays reachable. Running the page's timers
+    // 7 s on fires a 6.5 s clear for certain, however slowly this runner reached this line.
+    await page.clock.runFor(7000);
     await expect(toast(page).getByRole('link', { name: 'Database maintenance', exact: true })).toBeVisible();
     await toast(page).getByRole('link', { name: 'Database maintenance', exact: true }).click();
     await expect(heading(page).locator('h1')).toHaveText('Database maintenance');
@@ -799,3 +848,114 @@ test('a failed report download says so and leaves the button usable', async ({ p
     await expect(toast(page)).toHaveText('The report could not be downloaded. Try again.');
     await expect(button).not.toHaveAttribute('aria-disabled', 'true');
 });
+
+// ── #249 PR D Task D3 (D89, plan D66): image tagging jobs in Activity ─────────────────────────
+
+const TAG_JOB = { kind: 'image-tags', title: 'Auto-tag images', mode: 'auto', images: 4, total: 4 };
+
+test('an image tagging job shows Tagged Unchanged Skipped Errors and opens tagged rows', async ({ page, request }) => {
+    await page.setViewportSize({ width: 1600, height: 1100 });
+    const job = await startJob(request, TAG_JOB);
+    await step(request, job.id, { processed: 3, records: [
+        { group: 'tagged', path: 'shared/same.png', root: 'output', detail: 'Added 2 tags' },
+        { group: 'unchanged', path: 'shared/same.png', root: 'input', detail: 'No new tags' },
+        { group: 'skipped', path: 'video/clip_0004.webm', root: 'output', detail: 'Video: manual tags only' },
+    ] });
+    await page.goto(`${workspace}#/images`);
+    // The pill names the kind's verb.
+    await expect(pill(page)).toHaveText('Tagging · 75% · 3 / 4');
+    await openJob(page, job.id);
+    await expect(heading(page).locator('h1')).toHaveText('Auto-tag images');
+    await expect(page).toHaveTitle('Auto-tag images · Prompt Manager');
+    // The header's scope is the number of images, and the job cancels as "Cancel tagging" (danger).
+    await expect(heading(page).locator('p.muted')).toHaveText(/^Started \d\d:\d\d · 4 images · closing this view does not cancel it$/);
+    await expect(heading(page).locator('.heading-actions > button')).toHaveText(['Download report', 'Cancel tagging']);
+    await expect(heading(page).getByRole('button', { name: 'Cancel tagging', exact: true })).toHaveClass(/danger/);
+    await expect(progressSection(page).locator('.panel-heading > span.small')).toHaveText('Processing file 3 of 4');
+    await expect(progressSection(page).locator('progress')).toHaveAttribute('aria-label', 'Auto-tag images progress');
+    // Four tiles in the scan's tones: Tagged green, Unchanged plain, Skipped warning, Errors red.
+    expect(await tileValues(page)).toEqual([
+        ['stat added', 'Tagged', '1'], ['stat', 'Unchanged', '1'], ['stat warn', 'Skipped', '1'], ['stat bad', 'Errors', '0'],
+    ]);
+    // What got tagged and what went wrong first, as the scan's list does.
+    await expect(outcomeButtons(page)).toHaveText(['Tagged1', 'Errors0', 'Skipped1', 'Unchanged1']);
+    await expect(outcomeButtons(page).first()).toHaveAttribute('aria-pressed', 'true');
+
+    // Tagged rows open the viewer on that file (D57's identity).
+    const tagged = fileRows(page).first();
+    expect(await tagged.evaluate(node => node.localName)).toBe('button');
+    await expect(tagged.locator('.path')).toHaveText('shared/same.png');
+    await expect(tagged.locator('.why')).toHaveText('Added 2 tags');
+    await expect(resultsNote(page)).toHaveText('Each row opens the image in the viewer.');
+    await tagged.click();
+    const viewer = page.locator('dialog#viewer-dialog[open]');
+    await expect(viewer.locator('#viewer-stage img').first()).toHaveAttribute('src', /[?&]root=0(&|$)/);
+    await page.keyboard.press('Escape');
+    await expect(viewer).toHaveCount(0);
+    await expect(tagged).toBeFocused();
+    // Unchanged rows open too, here the input root's file.
+    await outcomeButtons(page).filter({ hasText: 'Unchanged' }).click();
+    await fileRows(page).first().click();
+    await expect(page.locator('dialog#viewer-dialog[open] #viewer-stage img').first()).toHaveAttribute('src', /[?&]root=1(&|$)/);
+    await page.keyboard.press('Escape');
+    // Skipped rows are plain text with their reason.
+    await outcomeButtons(page).filter({ hasText: 'Skipped' }).click();
+    expect(await fileRows(page).first().evaluate(node => node.localName)).toBe('div');
+    await expect(fileRows(page).first().locator('.why')).toHaveText('Video: manual tags only');
+    await expect(resultsNote(page)).toHaveCount(0);
+    // The log is the job's own: "Tagging log", with the runner's prefixes.
+    await expect(scanLog(page).locator('summary')).toHaveText('● Tagging log — raw detail, click to show');
+    await scanLog(page).locator('summary').click();
+    await expect(scanLog(page).locator('pre')).toContainText('+ shared/same.png · Added 2 tags');
+
+    // An error, then the end: the header and the Activity item read "N tagged · M errors".
+    await step(request, job.id, { processed: 4, records: [
+        { group: 'errors', path: 'broken/truncated.png', root: 'output', detail: 'Auto-tagging failed. Check server logs for details.' },
+    ] });
+    await expect(tiles(page).last().locator('dd')).toHaveText('1');
+    await finish(request, job.id);
+    await expect(toast(page)).toHaveText('Auto-tag images finished · 1 tagged · 1 error');
+    await expect(heading(page).locator('p.muted')).toHaveText(/^Finished \d\d:\d\d · 1 tagged · 1 error$/);
+    await expect(heading(page).locator('.heading-actions > button')).toHaveText(['Download report']);
+    await expect(progressSection(page).locator('.panel-heading > span.small')).toHaveText('4 of 4 files processed');
+    await page.goto(`${workspace}#/activity`);
+    await expect(items(page).first().locator('h3')).toHaveText('✓ Auto-tag images');
+    await expect(items(page).first().locator('p')).toHaveText(/^Finished \d\d:\d\d · 1 tagged · 1 error$/);
+});
+
+test('cancel tagging stops at a file boundary', async ({ page, request }) => {
+    await page.setViewportSize({ width: 1600, height: 1100 });
+    const job = await startJob(request, { ...TAG_JOB, title: 'Add tags to images', mode: 'add', images: 1250, total: 1250 });
+    await step(request, job.id, { processed: 2, counters: { tagged: 2 } });
+    await page.goto(`${workspace}#/activity`);
+    await expect(items(page).first().locator('p')).toHaveText(/^Started \d\d:\d\d · 1,250 images · closing this view does not cancel it$/);
+    await openJob(page, job.id);
+    await heading(page).getByRole('button', { name: 'Cancel tagging', exact: true }).focus();
+    await page.keyboard.press('Enter');
+    await expect(toast(page)).toHaveText('Add tags to images cancelled · 2 tagged');
+    await expect(heading(page).locator('h1')).toBeFocused();
+    await expect(heading(page).locator('p.muted')).toHaveText(/^Cancelled \d\d:\d\d at a file boundary · 2 tagged · completed work is kept$/);
+    await expect(heading(page).getByRole('button', { name: 'Cancel tagging', exact: true })).toHaveCount(0);
+    await expect(progressSection(page).locator('.panel-heading > span.small')).toHaveText('Cancelled after 2 of 1,250 files');
+    expect((await tileValues(page)).map(([, , value]) => value)).toEqual(['2', '0', '0', '0']);
+    expect((await listed(request))[0].state).toBe('cancelled');
+});
+
+test('the report download names the kind', async ({ page, request }) => {
+    await page.setViewportSize({ width: 1600, height: 1100 });
+    const job = await startJob(request, TAG_JOB);
+    await step(request, job.id, { processed: 1, records: [
+        { group: 'tagged', path: 'sub/a.png', root: 'output', detail: 'Added 1 tag' },
+    ] });
+    await finish(request, job.id);
+    await openJob(page, job.id);
+    const button = heading(page).getByRole('button', { name: 'Download report', exact: true });
+    const [download] = await Promise.all([page.waitForEvent('download'), button.click()]);
+    expect(download.suggestedFilename()).toMatch(/^prompt-manager-image-tags-\d{8}-\d{4}\.json$/);
+    const report = JSON.parse(await (await import('node:fs/promises')).readFile(await download.path(), 'utf8'));
+    expect(report.job.kind).toBe('image-tags');
+    expect(report.job.scope).toEqual({ mode: 'auto', images: 4 });
+    expect(Object.keys(report.outcomes)).toEqual(['tagged', 'unchanged', 'skipped', 'errors']);
+    expect(report.outcomes.tagged.rows.map(row => [row.path, row.detail])).toEqual([['sub/a.png', 'Added 1 tag']]);
+    await expect(toast(page)).toHaveText('Job report downloaded.');
+});

tests/browser/workspace-history.spec.mjs

@@ -494,6 +494,23 @@ test('the inline current file names its prompts apart from the frozen run fields
     expect(await exact(dialog(page).getByRole('region',{name:'Positive prompt',exact:true}).locator('p.prompt-text'))).toBe(before);
 });
 
+// LI-4 (D117): the recorded history's current-file viewer is the shared full inspector, so it copies the legacy summary.
+test('the current file viewer copies its settings summary',async({page})=>{
+    await page.addInitScript(()=>{window.__copied=[];Object.defineProperty(navigator,'clipboard',{configurable:true,value:{writeText:async text=>{window.__copied.push(text);}}});});
+    await page.route(url=>url.pathname.endsWith('/inspection'),async route=>{const response=await route.fetch();const body=await response.json();
+        body.prompts={positive:{status:'resolved',text:'current file positive',source:'graph-inferred'},negative:{status:'resolved',text:'current file negative',source:'graph-inferred'}};
+        await route.fulfill({response,json:body});});
+    await open(page,page.fixture.detail_id);await marker(page,page.fixture.runs.shared).click();await expect(dialog(page).locator('[data-receipt]')).toHaveCount(5);
+    await dialog(page).locator('[data-receipt]').first().getByRole('button',{name:'View current file',exact:true}).click();
+    const details=page.locator('dialog#viewer-dialog #viewer-details');await expect(details.locator('.panel-heading')).toBeVisible();
+    const facts=await details.locator(':scope > div > dl.meta-grid dd').allTextContents();
+    await details.getByRole('button',{name:'Copy settings summary',exact:true}).click();
+    await expect(page.locator('#workspace-toast')).toHaveText('Settings summary copied.');
+    const [seed,steps,cfg,sampler,,model]=facts;
+    expect(await page.evaluate(()=>window.__copied)).toEqual([[`Checkpoint: ${model}`,'Positive Prompt: current file positive','Negative Prompt: current file negative',
+        `Steps: ${steps}`,`CFG Scale: ${cfg}`,`Sampler: ${sampler}`,`Seed: ${seed}`].join('\n').replace(/: (Not recorded|Unresolved|Ambiguous|Unavailable within inspection limits)(?=\n|$)/g,': Unknown')]);
+});
+
 test('the recorded run dialog with a resolved current file has no duplicate button or region names',async({page})=>{
     await page.route(url=>url.pathname.endsWith('/inspection'),async route=>{const response=await route.fetch();const body=await response.json();
         body.prompts={positive:{status:'resolved',text:'current file positive',source:'graph-inferred'},negative:{status:'resolved',text:'current file negative',source:'graph-inferred'}};
@@ -1019,7 +1036,7 @@ test('shared gallery uses concept cards, image opens the viewer, empty copy',asy
     await expect(star).toHaveAccessibleName(`Favorite ${filename}`);await expect(star).toHaveAttribute('aria-pressed',String(image.favorite));
     await expect(star).toHaveText(image.favorite?'★':'☆');
     await expect(first.locator('.media-info h3')).toHaveCount(1);
-    await expect(first.locator('.image-card-actions > button.icon-btn')).toHaveAccessibleName(`Inspect ${filename}`);
+    await expect(first.locator('.image-card-actions > button.icon-btn:first-child')).toHaveAccessibleName(`Inspect ${filename}`);
     // C3 activation: the image opens the viewer and Escape returns focus to it.
     const openButton=first.locator('.image-open');await openButton.click();
     const viewer=page.locator('dialog#viewer-dialog');await expect(viewer).toBeVisible();

tests/browser/workspace-images.spec.mjs

@@ -545,7 +545,7 @@ async function staleSourceRecovery(page, request, roots) {
     await expect(await request.post('/prompt_manager/settings', { data: { gallery_root_paths: roots } })).toBeOK();
     const selected = initial.images.at(-1), key = `${selected.root_index}:${selected.path}`;
     const stale = page.waitForResponse(response => response.url().includes('/images/inspect/') && response.status() === 409);
-    await page.locator(`article[data-image-key="${key}"] .image-card-actions button`).click();expect((await stale).status()).toBe(409);
+    await page.locator(`article[data-image-key="${key}"] .image-card-actions button:first-child`).click();expect((await stale).status()).toBe(409);
     await expect(details(page)).toContainText('The source changed. Refresh the image collection before inspecting this file.');
     await page.locator(`article[data-image-key="${key}"] .image-open`).click();
     const viewer = page.locator('dialog#viewer-dialog');await expect(viewer).toContainText('The source changed.');
@@ -787,7 +787,12 @@ test('density changes and resize preserve identity focus and selection', async (
     await page.getByRole('button',{name:'Grid',exact:true}).click();
     for (const [width,columns] of [[951,3],[950,3],[700,2],[390,2]]) {
         await page.setViewportSize({width,height:844});
-        await expect.poll(()=>cards(page).nth(columns).evaluate(node=>node.offsetLeft)).toBe(0);
+        // 700px and 390px both lay out two columns, so a card at the row start alone is also true of the previous
+        // width's cards before WebKit runs the first frame after the resize; wait for the row to fit the new grid.
+        await expect.poll(()=>page.locator('.image-grid').evaluate((grid,columns)=>{
+            const row=[...grid.querySelectorAll(':scope > article[data-image-key]')];
+            return row[columns].offsetLeft===0&&row[columns-1].getBoundingClientRect().right<=grid.getBoundingClientRect().right+1;
+        },columns)).toBe(true);
         await first.getByRole('button',{name:/^Open /}).focus();await page.keyboard.press('ArrowDown');
         await expect(cards(page).nth(columns).getByRole('button',{name:/^Open /})).toBeFocused();
         expect(await page.evaluate(()=>document.documentElement.scrollWidth-document.documentElement.clientWidth)).toBeLessThanOrEqual(1);
@@ -902,6 +907,10 @@ test('browser Back closes the open Images dialog and leaves the next page usable
 
 test('count line shows images and positive prompts', async ({ page, request }) => {
     await page.addInitScript(() => { window.IntersectionObserver = undefined; });
+    // D17's "Today" is the newest file's day: the page's clock stands at that file's mtime, so the fixture's day and
+    // the page's agree on either side of midnight.
+    const { images } = await (await request.get('/prompt_manager/images/output?mode=workspace&limit=40')).json();
+    await page.clock.setFixedTime(new Date(Math.max(...images.map(image => image.modified_time)) * 1000));
     await page.goto(workspace);
     await expect(cards(page)).toHaveCount(2);
     await expect(caption(page).locator('#result-count')).toHaveText('2 of 2 images · 2 positive prompts');
@@ -1028,8 +1037,7 @@ async function cardInventory(page, concept) {
         const walk = new Function(`return (${walkSource})()`)();
         return nodes.map(card => {
             const copy = card.cloneNode(true);
-            // D9: no tag button until image annotations. The D8 checkbox and the D7 star are compared.
-            if (concept) for (const node of copy.querySelectorAll('[aria-label^="Tag or auto-tag "]')) node.remove();
+            // Info then Tag (#249 C2 retired D9). The D8 checkbox and the D7 star are compared.
             const open = card.querySelector('.image-open'), img = open.querySelector('img');
             const star = card.querySelector('.image-overlays > button.star-button');
             const box = card.querySelector('.image-overlays > label > input');
@@ -1039,7 +1047,7 @@ async function cardInventory(page, concept) {
                 size: [img.getAttribute('width'), img.getAttribute('height')],
                 title: card.querySelector('.media-info h3').textContent, subtitle: card.querySelector('.media-info p').textContent,
                 ratio: card.style.getPropertyValue('--media-ratio').replace(/\s/g, ''),
-                inspect: card.querySelector('.image-card-actions > button').getAttribute('aria-label'),
+                actions: [...card.querySelectorAll('.image-card-actions > button')].map(button => button.getAttribute('aria-label')),
                 star: star && { text: star.textContent, pressed: star.getAttribute('aria-pressed'), label: star.getAttribute('aria-label') },
                 select: box && { type: box.type, checked: box.checked, label: box.getAttribute('aria-label') },
                 paths: walk(copy, `article.${[...card.classList].filter(value => value !== 'selected').sort().join('.')}`, []) };
@@ -1209,7 +1217,7 @@ async function zoomedGallery(page, request, { cssZoom }) {
     await page.keyboard.press('Tab');
     await expect(page.locator(`article[aria-posinset="${columns + 1}"] .image-overlays .star-button`)).toBeFocused();
     await page.keyboard.press('Tab');
-    await expect(page.locator(`article[aria-posinset="${columns + 1}"] .image-card-actions button`)).toBeFocused();
+    await expect(page.locator(`article[aria-posinset="${columns + 1}"] .image-card-actions button:first-child`)).toBeFocused();
     await page.evaluate(() => {
         const card = document.querySelector('article[aria-posinset="1"]');
         const grid = document.querySelector('.image-grid');
@@ -1703,7 +1711,8 @@ test('card checkboxes select images into the concept bar and Clear empties it',
     const selectedBefore = await cards(page).evaluateAll(nodes => nodes.map(node => node.classList.contains('selected')));
     await checkbox(first, 'same.png').check();
     await expect(bulkbar(page).locator('.bulkbar > strong')).toHaveText('1 selected');
-    await expect(barButtons(page)).toHaveText(['Set category', 'Export metadata', 'Clear']);
+    // D85: Add tags (the concept's) and Auto-tag selected lead the real actions.
+    await expect(barButtons(page)).toHaveText(['Add tags', 'Auto-tag selected', 'Set category', 'Export metadata', 'Clear']);
     // Toggling neither opens the viewer, nor inspects, nor moves focus.
     await expect(page.locator('dialog[open]')).toHaveCount(0);
     await expect(checkbox(first, 'same.png')).toBeFocused();

tests/browser/workspace-inspect.spec.mjs

@@ -0,0 +1,809 @@
+// The native "Inspect a file" page (#249 local Inspect, PR L2 Task 6): one chosen or dropped local file previews
+// inline, and the heading's one action opens the shared viewer with the full inspector on a record read entirely in
+// this browser. The concept is docs/concepts/workspace/app.js renderMetadata (740–748) and its selection (1715–1729);
+// the production differences are D60–D66 in TESTING.md.
+import { startCoverage, saveCoverage } from '../../tools/vendor/browser-coverage.mjs';
+import { test, expect } from './fixtures.mjs';
+import { parityPng, localFixture, tinyWebm, sendablePng, corruptPng, disguised, undecodableMp4, POSITIVE_LINES } from './local-inspect-files.mjs';
+
+const workspace = '/prompt_manager/workspace';
+const TOAST = 'Local preview only. No file uploaded; metadata is available above.';
+const ACTION = 'Open file metadata';
+const COPY = {
+    intro: 'Read embedded metadata in this browser. The file is not uploaded or added to your library.',
+    note: 'Your file stays in this browser. Its metadata opens with “Open file metadata”.',
+    chooser: 'Choose an image or video for a local preview',
+    multiple: 'Drop one file at a time.',
+    directory: 'Folders cannot be inspected. Choose one image or video file.',
+    unsupported: 'This file type cannot be previewed or inspected here. Choose an image or video file.',
+    previewFailed: 'The preview could not be displayed. Metadata and the original remain available in the viewer.',
+};
+
+test.use({ locale: 'en-US', timezoneId: 'UTC', reducedMotion: 'reduce' });
+
+test.beforeEach(async ({ page, request, browserName }) => {
+    await startCoverage(page, browserName);
+    await expect(await request.post('/__test__/reset')).toBeOK();
+    page.inspectErrors = [];
+    page.on('pageerror', error => page.inspectErrors.push(error.message));
+});
+
+test.afterEach(async ({ page, browserName }) => {
+    await page.unrouteAll({ behavior: 'ignoreErrors' });
+    await saveCoverage(page, browserName);
+    expect(page.inspectErrors).toEqual([]);
+});
+
+const main = page => page.locator('#workspace-main');
+const action = page => main(page).locator('.heading-actions').getByRole('button', { name: ACTION, exact: true });
+const chooser = page => page.locator('#local-file');
+const preview = page => page.locator('#local-preview');
+const status = page => preview(page).locator('p.small');
+const viewer = page => page.locator('dialog#viewer-dialog');
+const rail = page => viewer(page).locator('#viewer-details');
+
+async function openInspect(page) {
+    await page.goto(`${workspace}#/inspect`);
+    await expect(main(page).getByRole('heading', { level: 1, name: 'Inspect a file', exact: true })).toBeVisible();
+    await expect(chooser(page)).toBeAttached();
+}
+
+/** Selects through the real chooser, then waits for the page to classify the file. */
+async function choose(page, file) {
+    await chooser(page).setInputFiles(file);
+}
+
+async function openViewer(page) {
+    await expect(action(page)).toHaveAttribute('aria-disabled', 'false');
+    await action(page).click();
+    await expect(viewer(page)).toBeVisible();
+    await expect(rail(page).locator('.panel-heading')).toBeVisible();
+}
+
+/** Dispatches dragover + drop on `selector` with Files built in the page (and optional string items). */
+function drop(page, selector, { files = [], strings = [] } = {}) {
+    return page.evaluate(async ({ selector, files, strings }) => {
+        const transfer = new DataTransfer();
+        for (const file of files) transfer.items.add(new File([new Uint8Array(file.bytes)], file.name, { type: file.mimeType }));
+        for (const [type, value] of strings) transfer.items.add(value, type);
+        const target = document.querySelector(selector);
+        const over = new DragEvent('dragover', { bubbles: true, cancelable: true, dataTransfer: transfer });
+        const dropped = new DragEvent('drop', { bubbles: true, cancelable: true, dataTransfer: transfer });
+        target.dispatchEvent(over);
+        target.dispatchEvent(dropped);
+        return { over: over.defaultPrevented, drop: dropped.defaultPrevented };
+    }, { selector, files: files.map(file => ({ name: file.name, mimeType: file.mimeType, bytes: [...file.buffer] })), strings });
+}
+
+/** The rail's comparable content: prompts, the six facts, the raw records and the two downloads (D66 aside). */
+const railContent = locator => locator.evaluate(node => {
+    const raw = [...node.querySelectorAll('details')].find(item => item.querySelector('summary')?.textContent === 'Workflow & raw metadata');
+    const facts = node.querySelector(':scope .meta-grid:not(details .meta-grid)');
+    return {
+        positive: node.querySelector('.prompt-section.positive p.prompt-text')?.textContent ?? null,
+        negative: node.querySelector('.prompt-section.negative p.prompt-text')?.textContent ?? null,
+        facts: facts ? [...facts.querySelectorAll(':scope > div')].map(item => [item.querySelector('dt').textContent, item.querySelector('dd').textContent]) : null,
+        raw: raw ? [...raw.querySelectorAll('p.small, pre')].map(item => item.textContent) : null,
+        downloads: raw ? [...raw.querySelectorAll('button')].map(item => [item.textContent, item.getAttribute('aria-disabled')]) : null,
+    };
+});
+
+/** Counts storage writes and object URLs created and revoked for Files (download blobs are not the session's). */
+async function instrument(page) {
+    await page.addInitScript(() => {
+        window.__inspect = { writes: [], created: [], revoked: [], files: new Set() };
+        for (const name of ['setItem', 'removeItem', 'clear']) {
+            const original = Storage.prototype[name];
+            Storage.prototype[name] = function (...args) { window.__inspect.writes.push([name, args[0]]); return original.apply(this, args); };
+        }
+        const open = indexedDB.open.bind(indexedDB);
+        indexedDB.open = (...args) => { window.__inspect.writes.push(['indexedDB.open', args[0]]); return open(...args); };
+        const create = URL.createObjectURL, revoke = URL.revokeObjectURL;
+        URL.createObjectURL = object => {
+            const url = create(object);
+            if (object instanceof File) { window.__inspect.created.push(url); window.__inspect.files.add(url); }
+            return url;
+        };
+        URL.revokeObjectURL = url => { if (window.__inspect.files.has(url)) window.__inspect.revoked.push(url); return revoke(url); };
+    });
+}
+const urls = page => page.evaluate(() => ({ created: [...window.__inspect.created], revoked: [...window.__inspect.revoked], writes: [...window.__inspect.writes] }));
+
+test('chooser opens the shared full inspector without a second read', async ({ page, request }) => {
+    // The Images viewer's rail for the same bytes, served from the output folder.
+    await expect(await request.post('/__test__/add-local-inspect-file', { data: { name: 'f02.png' } })).toBeOK();
+    await page.goto(`${workspace}#/images`);
+    await page.locator('article[data-image-key="0:local-inspect/f02.png"] .image-open').click();
+    await expect(rail(page).locator('.prompt-section.positive p.prompt-text')).toBeVisible();
+    const served = await railContent(rail(page));
+    await page.keyboard.press('Escape');
+    await expect(viewer(page)).toHaveCount(0);
+
+    await page.locator('aside.sidebar nav').getByRole('link', { name: 'Inspect a file', exact: true }).click();
+    await expect(main(page).getByRole('heading', { level: 1, name: 'Inspect a file', exact: true })).toBeVisible();
+    await expect(main(page).locator('.heading p.muted')).toHaveText('A standalone file uses the same image viewer and prompt actions.');
+    // The concept DOM: one surface, the drop area with its icon, label, input and note, then the preview slot.
+    const surface = main(page).locator('section.surface');
+    await expect(surface).toHaveCount(1);
+    await expect(surface.locator('h2')).toHaveText('Inspect without importing');
+    await expect(surface.locator(':scope > p')).toHaveText(COPY.intro);
+    const area = surface.locator('div.file-drop.spaced-20');
+    await expect(area.locator(':scope > svg')).toHaveCount(1);
+    await expect(area.locator('label[for="local-file"]')).toHaveText(COPY.chooser);
+    await expect(chooser(page)).toHaveAttribute('type', 'file');
+    await expect(chooser(page)).toHaveAttribute('accept', 'image/png,image/jpeg,image/webp,video/*,.mp4,.mov,.m4v,.webm,.mkv,.avi,.wmv');
+    await expect(chooser(page)).not.toHaveAttribute('multiple', /.*/);
+    await expect(area.locator('span.small#local-file-note')).toHaveText(COPY.note);
+    await expect(surface.locator(':scope > #local-preview')).toBeEmpty();
+    // D60: the one heading action is described by the note until a file is chosen.
+    await expect(main(page).locator('.heading-actions button')).toHaveCount(1);
+    await expect(action(page)).toHaveClass(/\bca-primary\b/);
+    await expect(action(page)).toHaveAttribute('aria-disabled', 'true');
+    await expect(action(page)).toHaveAccessibleDescription(COPY.note);
+    await action(page).dispatchEvent('click');
+    await expect(viewer(page)).toHaveCount(0);
+
+    await choose(page, parityPng('f02.png'));
+    const image = preview(page).locator('img.local-file-preview');
+    await expect(image).toHaveAttribute('alt', 'Local file preview');
+    await expect(image).toHaveJSProperty('complete', true);
+    expect(await image.evaluate(node => node.naturalWidth)).toBe(64);
+    expect(await image.getAttribute('src')).toMatch(/^blob:/);
+    const box = await image.evaluate(node => ({ height: node.getBoundingClientRect().height, fit: getComputedStyle(node).objectFit, margin: getComputedStyle(node).marginTop }));
+    expect(box.height).toBeLessThanOrEqual(400);
+    expect(box).toMatchObject({ fit: 'contain', margin: '20px' });
+    await expect(page.locator('#workspace-toast')).toHaveText(TOAST);
+    await expect(action(page)).toHaveAttribute('aria-disabled', 'false');
+    await expect(action(page)).not.toHaveAttribute('aria-describedby', /.*/);
+
+    await openViewer(page);
+    await expect(viewer(page).locator('#viewer-title')).toHaveText('f02.png');
+    const position = viewer(page).locator('.media-position');
+    await expect(position).toHaveText('1 of 1 loaded: f02.png');
+    for (const name of ['Previous media', 'Next media', 'Play slideshow']) {
+        await expect(viewer(page).getByRole('button', { name, exact: true })).toHaveAttribute('aria-disabled', 'true');
+    }
+    await expect(viewer(page).locator('.viewer-canvas img')).toBeVisible();
+    for (const name of ['Fit image', 'Rotate image 90 degrees', 'Flip image horizontally']) {
+        await expect(viewer(page).getByRole('button', { name, exact: true })).toHaveAttribute('aria-disabled', 'false');
+    }
+    const canvas = viewer(page).locator('.viewer-canvas img');
+    await viewer(page).getByRole('button', { name: 'Rotate image 90 degrees', exact: true }).click();
+    await expect(canvas).toHaveAttribute('style', /rotate\(90deg\)/);
+    await viewer(page).getByRole('button', { name: 'Flip image horizontally', exact: true }).click();
+    await expect(canvas).toHaveAttribute('style', /scaleX\(-1\)/);
+    await viewer(page).getByRole('button', { name: 'Fit image', exact: true }).click();
+    await expect(canvas).not.toHaveAttribute('style', /rotate\(90deg\)/);
+
+    // The same rail as Images for the same bytes, except the D66 provenance.
+    const local = await railContent(rail(page));
+    expect(local).toEqual(served);
+    expect(local.positive).toBe('a red fox in snow, detailed fur');
+    expect(local.negative).toBe('blurry, lowres');
+    expect(local.facts.map(([label]) => label)).toEqual(['Seed', 'Steps', 'CFG', 'Sampler', 'Scheduler', 'Model']);
+    expect(local.downloads).toEqual([['Download metadata JSON', null], ['Download workflow JSON', null]]);
+    const provenance = rail(page).locator('details').filter({ has: page.locator('summary', { hasText: 'File & provenance' }) });
+    await expect(provenance).toContainText('Selected local file · read in this browser');
+    await expect(provenance).toContainText('Local file; no saved library association was checked.');
+    await expect(provenance.locator('dt', { hasText: /^Path$/ })).toHaveCount(0);
+    await expect(rail(page).getByRole('button', { name: 'Show in folder', exact: true })).toHaveCount(0);
+    await expect(rail(page).getByRole('button', { name: /Prompt history/ })).toHaveCount(0);
+    await expect(rail(page).locator('.chip-row button.chip')).toHaveCount(0);
+    const original = viewer(page).getByRole('link', { name: 'Download original', exact: true });
+    await expect(original).toHaveAttribute('href', /^blob:/);
+    await expect(original).toHaveAttribute('download', 'f02.png');
+
+    await page.keyboard.press('Escape');
+    await expect(viewer(page)).toHaveCount(0);
+    await expect(action(page)).toBeFocused();
+    // Opening the viewer again shows the same record without reading the File a second time.
+    await page.evaluate(() => {
+        window.__slices = 0;
+        const slice = Blob.prototype.slice;
+        Blob.prototype.slice = function (...args) { if (this.name === 'f02.png') window.__slices++; return slice.apply(this, args); };
+    });
+    await openViewer(page);
+    expect(await railContent(rail(page))).toEqual(served);
+    expect(await page.evaluate(() => window.__slices)).toBe(0);
+});
+
+// PR L3 Task 10: local roles are the server inspector's (local-resolver.mjs), so for every parity PNG the rail shows the
+// prompts, their status lines and the facts Images shows for the same bytes in the output folder.
+const PARITY_PNGS = ['f01b', 'f02', 'f03', 'f06a', 'f06b', 'f06c', 'f06d', 'f06e', 'f07a', 'f07b', 'f08', 'f09', 'f10', 'f11', 'f12',
+    'f14', 'f15', 'f16', 'f17', 'f19', 'f20', 'f21', 'f22', 'f23', 'f24'];
+const roleSections = locator => locator.evaluate(node => [...node.querySelectorAll('.prompt-section')].map(item => item.textContent));
+
+test('chooser shows the Images roles and resolution for every parity PNG', async ({ page, request }) => {
+    test.slow();
+    for (const name of PARITY_PNGS) {
+        await expect(await request.post('/__test__/add-local-inspect-file', { data: { name: `${name}.png` } })).toBeOK();
+    }
+    const served = {};
+    await page.goto(`${workspace}#/images`);
+    for (const name of PARITY_PNGS) {
+        await page.locator(`article[data-image-key="0:local-inspect/${name}.png"] .image-open`).click();
+        await expect(viewer(page).locator('#viewer-title')).toHaveText(`${name}.png`);
+        await expect(rail(page).locator('.panel-heading')).toBeVisible();
+        await expect(rail(page).locator('.prompt-section')).not.toHaveCount(0);
+        served[name] = { content: await railContent(rail(page)), roles: await roleSections(rail(page)) };
+        await page.keyboard.press('Escape');
+        await expect(viewer(page)).toHaveCount(0);
+    }
+    await openInspect(page);
+    for (const name of PARITY_PNGS) {
+        await choose(page, parityPng(`${name}.png`));
+        await openViewer(page);
+        await expect(viewer(page).locator('#viewer-title')).toHaveText(`${name}.png`);
+        await expect(rail(page).locator('.prompt-section')).not.toHaveCount(0);
+        expect({ content: await railContent(rail(page)), roles: await roleSections(rail(page)) }, name).toEqual(served[name]);
+        await page.keyboard.press('Escape');
+        await expect(viewer(page)).toHaveCount(0);
+    }
+});
+
+test('Import → Inspect a local image lands here', async ({ page }) => {
+    await page.goto(`${workspace}#/images`);
+    await page.getByRole('button', { name: 'Import', exact: true }).click();
+    const dialog = page.getByRole('dialog', { name: 'Import & inspect', exact: true });
+    await dialog.getByRole('button', { name: 'Open inspector', exact: true }).click();
+    await expect(page).toHaveURL(/#\/inspect$/);
+    await expect(main(page).getByRole('heading', { level: 1, name: 'Inspect a file', exact: true })).toBeVisible();
+    await expect(chooser(page)).toBeAttached();
+    await expect(main(page).locator('.handoff')).toHaveCount(0);
+    await expect(page.getByRole('dialog')).toHaveCount(0);
+});
+
+test('drop accepts exactly one File and never navigates', async ({ page }) => {
+    await openInspect(page);
+    // A drop that misses the area is cancelled, so the browser never opens the file in place of the page.
+    expect(await drop(page, 'body', { files: [parityPng('f02.png')] })).toEqual({ over: true, drop: true });
+    await expect(preview(page)).toBeEmpty();
+    expect(await drop(page, '.file-drop', { files: [parityPng('f02.png')] })).toEqual({ over: true, drop: true });
+    await expect(preview(page).locator('img.local-file-preview')).toBeVisible();
+    await expect(page.locator('#workspace-toast')).toHaveText(TOAST);
+    // The chooser names the dropped file, never the one it replaced and never "No file chosen".
+    expect(await chooser(page).evaluate(node => [...node.files].map(file => file.name))).toEqual(['f02.png']);
+    const first = await preview(page).locator('img').getAttribute('src');
+    // Two files, a link and markup keep the selection and say why.
+    await drop(page, '.file-drop', { files: [parityPng('f02.png'), parityPng('f03.png')] });
+    await expect(status(page)).toHaveText(COPY.multiple);
+    await expect(status(page)).toHaveAttribute('role', 'alert');
+    await expect(preview(page).locator('img')).toHaveAttribute('src', first);
+    for (const strings of [[['text/uri-list', 'https://example.invalid/a.png']], [['text/html', '<img src="https://example.invalid/a.png">']]]) {
+        await drop(page, '.file-drop', { strings });
+        await expect(status(page)).toHaveText(COPY.unsupported);
+        await expect(preview(page).locator('img')).toHaveAttribute('src', first);
+    }
+    await expect(action(page)).toHaveAttribute('aria-disabled', 'false');
+    await openViewer(page);
+    await expect(viewer(page).locator('#viewer-title')).toHaveText('f02.png');
+    await expect(page).toHaveURL(/#\/inspect$/);
+});
+
+test('cancel and same-file reselect', async ({ page }) => {
+    await instrument(page);
+    await openInspect(page);
+    await choose(page, parityPng('f02.png'));
+    await expect(preview(page).locator('img.local-file-preview')).toBeVisible();
+    const first = await preview(page).locator('img').getAttribute('src');
+    // The chooser still names the chosen file, as in the concept; a cancel (no files) keeps the page as it is.
+    expect(await chooser(page).evaluate(node => node.files[0]?.name)).toBe('f02.png');
+    await chooser(page).setInputFiles([]);
+    await expect(preview(page).locator('img')).toHaveAttribute('src', first);
+    await expect(status(page)).toHaveCount(0);
+    await expect(action(page)).toHaveAttribute('aria-disabled', 'false');
+    // Opening the picker and cancelling it keeps naming the live selection (modern engines fire `cancel`, not `change`).
+    await chooser(page).dispatchEvent('click');
+    await chooser(page).dispatchEvent('cancel');
+    expect(await chooser(page).evaluate(node => [...node.files].map(file => file.name))).toEqual(['f02.png']);
+    await expect(preview(page).locator('img')).toHaveAttribute('src', first);
+    await expect(action(page)).toHaveAttribute('aria-disabled', 'false');
+    // The same file again is a new selection with its own URL; the old one is released. Opening the picker clears
+    // the chooser, so the browser reports the same file as a change.
+    // (Read in the same task: a picker the click opens is cancelled by the harness, which names the file again.)
+    expect(await chooser(page).evaluate(node => { node.dispatchEvent(new MouseEvent('click')); return node.value; })).toBe('');
+    await choose(page, parityPng('f02.png'));
+    await expect(preview(page).locator('img')).not.toHaveAttribute('src', first);
+    await expect(preview(page).locator('img.local-file-preview')).toBeVisible();
+    const state = await urls(page);
+    expect(state.created).toHaveLength(2);
+    expect(state.revoked).toEqual([first]);
+    await openViewer(page);
+    await expect(viewer(page).locator('.media-position')).toHaveText('1 of 1 loaded: f02.png');
+});
+
+test('preview does not imply metadata support', async ({ page }) => {
+    await instrument(page);
+    await openInspect(page);
+    // JPEG and WebP preview and report no supported metadata, exactly as Images reports them.
+    for (const [file, format] of [[localFixture('tiny.jpg', 'image/jpeg'), 'JPEG'], [localFixture('tiny.webp', 'image/webp'), 'WEBP']]) {
+        await choose(page, file);
+        await expect(preview(page).locator('img.local-file-preview')).toBeVisible();
+        await openViewer(page);
+        await expect(rail(page)).toContainText('No supported embedded metadata was recorded in this file.');
+        await expect(rail(page).locator('details').first()).toContainText(format);
+        await page.keyboard.press('Escape');
+        await expect(viewer(page)).toHaveCount(0);
+    }
+    // A PNG whose text chunk fails its CRC: unreadable metadata, the original still downloads.
+    await choose(page, corruptPng());
+    await expect(action(page)).toHaveAttribute('aria-disabled', 'false');
+    await openViewer(page);
+    await expect(rail(page)).toContainText('Embedded metadata could not be read.');
+    const [download] = await Promise.all([page.waitForEvent('download'), viewer(page).getByRole('link', { name: 'Download original', exact: true }).click()]);
+    expect(download.suggestedFilename()).toBe('corrupt.png');
+    await page.keyboard.press('Escape');
+    await expect(viewer(page)).toHaveCount(0);
+    // Text, markup, SVG and a playlist under media names are unsupported and never get a URL.
+    const before = (await urls(page)).created.length;
+    for (const file of disguised()) {
+        await choose(page, file);
+        await expect(status(page)).toHaveText(COPY.unsupported);
+        await expect(status(page)).toHaveAttribute('role', 'alert');
+        await expect(preview(page).locator('img, video')).toHaveCount(0);
+        await expect(action(page)).toHaveAttribute('aria-disabled', 'true');
+    }
+    expect((await urls(page)).created).toHaveLength(before);
+});
+
+test('local video plays inline and in the viewer with real tags', async ({ page, browserName }) => {
+    await openInspect(page);
+    await choose(page, localFixture('core-tags.webm', 'video/webm'));
+    const video = preview(page).locator('video.local-file-preview');
+    await expect(video).toBeVisible();
+    expect(await video.evaluate(node => ({ controls: node.controls, playsInline: node.playsInline, preload: node.preload, muted: node.muted, autoplay: node.autoplay, paused: node.paused })))
+        .toEqual({ controls: true, playsInline: true, preload: 'metadata', muted: true, autoplay: false, paused: true });
+    // WebKit may not decode VP8: whichever state it reports, metadata is still read.
+    await expect.poll(() => video.evaluate(node => node.readyState >= 1 || !!node.error)).toBe(true);
+    await openViewer(page);
+    await expect(rail(page).locator('.prompt-section.positive p.prompt-text')).toHaveText('a red fox in snow, detailed fur');
+    await expect(rail(page).locator('.meta-grid').first().locator('dd').first()).toHaveText('7');
+    await expect(viewer(page).locator('#viewer-stage video')).toHaveCount(1);
+    await page.keyboard.press('Escape');
+    await choose(page, tinyWebm());
+    await expect(preview(page).locator('video.local-file-preview')).toBeVisible();
+    await openViewer(page);
+    await expect(rail(page)).toContainText('No supported embedded metadata was recorded in this file.');
+    if (browserName !== 'webkit') await expect.poll(() => viewer(page).locator('#viewer-stage video').evaluate(node => node.readyState >= 1)).toBe(true);
+});
+
+test('the toast and a rejected drop never contradict the status line', async ({ page }) => {
+    // A file whose bytes are gone after choosing: the status says its metadata cannot be read, so no toast says it is
+    // available.
+    await page.addInitScript(() => {
+        const slice = Blob.prototype.slice;
+        Blob.prototype.slice = function (...args) {
+            if (this.name === 'gone.png') return { arrayBuffer: () => Promise.reject(new DOMException('The file is gone', 'NotReadableError')) };
+            return slice.apply(this, args);
+        };
+    });
+    await openInspect(page);
+    await choose(page, parityPng('f02.png', 'gone.png'));
+    await expect(status(page)).toHaveText('Embedded metadata could not be read.');
+    await expect(action(page)).toHaveAttribute('aria-disabled', 'false');
+    await expect(page.locator('#workspace-toast')).toHaveText('');
+    // A rejected drop is its own alert beside the selection's status, which it never replaces, and it ends with the
+    // concept's toast interval.
+    await choose(page, undecodableMp4());
+    const failed = status(page).filter({ hasText: COPY.previewFailed });
+    await expect(failed).toHaveCount(1);
+    await drop(page, '.file-drop', { files: [parityPng('f02.png'), parityPng('f03.png')] });
+    const rejected = status(page).filter({ hasText: COPY.multiple });
+    await expect(rejected).toHaveAttribute('role', 'alert');
+    await expect(failed).toHaveCount(1);
+    await expect(rejected).toHaveCount(0, { timeout: 15000 });
+    await expect(status(page)).toHaveText([COPY.previewFailed]);
+    // The next selection attempt ends a rejection at once.
+    await drop(page, '.file-drop', { files: [parityPng('f02.png'), parityPng('f03.png')] });
+    await expect(rejected).toHaveCount(1);
+    await chooser(page).dispatchEvent('click');
+    await chooser(page).dispatchEvent('cancel');
+    await expect(status(page)).toHaveText([COPY.previewFailed]);
+});
+
+test('undecodable video keeps container metadata', async ({ page }) => {
+    await openInspect(page);
+    // A real MP4 whose sample entry names a codec no engine decodes; its container tags are intact.
+    await choose(page, undecodableMp4());
+    await expect(status(page)).toHaveText(COPY.previewFailed);
+    await expect(status(page)).toHaveAttribute('role', 'alert');
+    await expect(preview(page).locator('video')).toHaveCount(0);
+    await openViewer(page);
+    await expect(rail(page).locator('.prompt-section.positive p.prompt-text')).toHaveText('a red fox in snow, detailed fur');
+    await expect(rail(page).locator('.meta-grid').first().locator('dd').first()).toHaveText('7');
+});
+
+/** Records, for each revoked URL, how many elements (inline or in the viewer) still held it, and counts resets. */
+const trackReleases = page => page.evaluate(() => {
+    window.__released = [];
+    const revoke = URL.revokeObjectURL;
+    URL.revokeObjectURL = url => {
+        const live = [...document.querySelectorAll('img, video')].filter(node => node.getAttribute('src') === url);
+        window.__released.push({ url, live: live.length });
+        return revoke(url);
+    };
+    const load = HTMLMediaElement.prototype.load;
+    window.__loads = 0;
+    HTMLMediaElement.prototype.load = function () { if (!this.hasAttribute('src')) window.__loads++; return load.call(this); };
+});
+
+test('URLs and media end with their owning session', async ({ page }) => {
+    await instrument(page);
+    await openInspect(page);
+    // Every release pauses the media and drops its src before the URL is revoked.
+    await trackReleases(page);
+    await choose(page, localFixture('core-tags.webm', 'video/webm'));
+    await expect(preview(page).locator('video')).toBeVisible();
+    // A settled video (metadata read, or failed) is reset with load() when it is released.
+    await expect.poll(() => preview(page).locator('video').evaluate(node => node.readyState >= 1 || !!node.error)).toBe(true);
+    // Replacement.
+    await choose(page, parityPng('f02.png'));
+    await expect(preview(page).locator('img.local-file-preview')).toBeVisible();
+    let state = await urls(page);
+    expect(state.revoked).toEqual([state.created[0]]);
+    expect(await page.evaluate(() => window.__loads)).toBeGreaterThanOrEqual(1);
+    // Route change.
+    await page.locator('aside.sidebar nav').getByRole('link', { name: 'Overview', exact: true }).click();
+    await expect(main(page).getByRole('heading', { level: 1, name: 'Overview', exact: true })).toBeVisible();
+    state = await urls(page);
+    expect(state.revoked).toEqual(state.created);
+    // Five mount/unmount cycles with a selection and an opened viewer leave no live URL and no dialog.
+    for (let cycle = 0; cycle < 5; cycle++) {
+        await page.locator('aside.sidebar nav').getByRole('link', { name: 'Inspect a file', exact: true }).click();
+        await choose(page, parityPng('f02.png', `cycle-${cycle}.png`));
+        await openViewer(page);
+        // The modal viewer makes the sidebar inert, so the route changes underneath it.
+        await page.evaluate(() => { location.hash = '#/overview'; });
+        await expect(main(page).getByRole('heading', { level: 1, name: 'Overview', exact: true })).toBeVisible();
+    }
+    state = await urls(page);
+    expect(state.created).toHaveLength(7);
+    expect([...state.revoked].sort()).toEqual([...state.created].sort());
+    expect(new Set(state.revoked).size).toBe(state.revoked.length);
+    expect((await page.evaluate(() => window.__released)).every(entry => entry.live === 0)).toBe(true);
+    await expect(page.locator('dialog')).toHaveCount(0);
+    // Page leave releases the selection once.
+    await page.locator('aside.sidebar nav').getByRole('link', { name: 'Inspect a file', exact: true }).click();
+    await choose(page, parityPng('f02.png', 'leave.png'));
+    await expect(preview(page).locator('img.local-file-preview')).toBeVisible();
+    await page.evaluate(() => window.dispatchEvent(new PageTransitionEvent('pagehide', { persisted: false })));
+    state = await urls(page);
+    expect(state.created).toHaveLength(8);
+    expect(state.revoked.filter(url => url === state.created[7])).toHaveLength(1);
+    // Page leave with the viewer open, on a page loaded at Inspect (so its listeners precede the shell's): the viewer
+    // closes and releases its media before the URL is revoked, and a page restored from the back-forward cache shows
+    // an empty chooser beside the empty selection.
+    await page.reload();
+    await expect(chooser(page)).toBeAttached();
+    await trackReleases(page);
+    await choose(page, parityPng('f02.png', 'leave-open.png'));
+    await openViewer(page);
+    await expect(viewer(page).getByRole('button', { name: 'Zoom in', exact: true })).toHaveAttribute('aria-disabled', 'false');
+    await page.evaluate(() => window.dispatchEvent(new PageTransitionEvent('pagehide', { persisted: true })));
+    await expect(page.locator('dialog')).toHaveCount(0);
+    state = await urls(page);
+    expect(state.created).toHaveLength(1);
+    expect(state.revoked).toEqual(state.created);
+    expect(await page.evaluate(() => window.__released)).toEqual([{ url: state.created[0], live: 0 }]);
+    await page.evaluate(() => window.dispatchEvent(new PageTransitionEvent('pageshow', { persisted: true })));
+    await expect(chooser(page)).toBeAttached();
+    expect(await chooser(page).evaluate(node => ({ value: node.value, files: node.files.length }))).toEqual({ value: '', files: 0 });
+    await expect(preview(page).locator('img, video')).toHaveCount(0);
+    await expect(action(page)).toHaveAttribute('aria-disabled', 'true');
+});
+
+test('replacing a video that just started loading never blocks the page', async ({ context, browserName }) => {
+    test.setTimeout(120000);
+    // WebKit (GStreamer) blocked the page when a video whose pipeline was still starting was reset with load(): the
+    // next chooser selection, or the steps after it, never completed. Each fresh page replaces its first video as
+    // soon as it shows.
+    for (let attempt = 0; attempt < 15; attempt++) {
+        const page = await context.newPage();
+        try {
+            if (attempt === 0) await startCoverage(page, browserName);
+            await openInspect(page);
+            await choose(page, localFixture('core-tags.webm', 'video/webm'));
+            await expect(preview(page).locator('video.local-file-preview')).toBeVisible();
+            await chooser(page).setInputFiles(parityPng('f02.png'), { timeout: 8000 });
+            await expect(preview(page).locator('img.local-file-preview')).toBeVisible();
+            await expect(preview(page).locator('video')).toHaveCount(0);
+            if (attempt === 0) await saveCoverage(page, browserName);
+        } finally {
+            await page.close();
+        }
+    }
+});
+
+test('a video replaced while still starting is reset once it settles', async ({ context, browserName }) => {
+    test.setTimeout(180000);
+    // The video is replaced from its own `loadstart` (readyState HAVE_NOTHING), or a few milliseconds after it. On
+    // WebKit (GStreamer) a video that left the page or the viewport before its pipeline had started deadlocked the
+    // page (TESTING.md D62), so it stays in place, inert and still playing its URL, with the new preview after it.
+    // Once it reports metadata or an error it is paused, loses its src, is reset (load() with no src, which frees its
+    // decoder) and leaves the page, and only then is its URL revoked. Fresh pages share one browser process.
+    for (let attempt = 0; attempt < 15; attempt++) {
+        const page = await context.newPage();
+        try {
+            if (attempt === 0) await startCoverage(page, browserName);
+            await page.addInitScript(() => {
+                const load = HTMLMediaElement.prototype.load;
+                HTMLMediaElement.prototype.load = function () { if (!this.hasAttribute('src')) this.__resets = (this.__resets ?? 0) + 1; return load.call(this); };
+                const revoke = URL.revokeObjectURL;
+                URL.revokeObjectURL = url => {
+                    const starting = window.__starting;
+                    if (url === starting?.url) starting.revoked = { src: starting.node.hasAttribute('src'), connected: starting.node.isConnected, resets: starting.node.__resets ?? 0 };
+                    return revoke(url);
+                };
+            });
+            await openInspect(page);
+            await page.evaluate(() => {
+                const input = document.querySelector('#local-file'), slot = document.querySelector('#local-preview');
+                new MutationObserver((records, observer) => {
+                    const video = slot.querySelector('video');
+                    if (!video) return;
+                    observer.disconnect();
+                    const replace = () => {
+                        window.__starting = { node: video, url: video.getAttribute('src'), readyState: video.readyState };
+                        input.files = window.__pngFiles; input.dispatchEvent(new Event('change', { bubbles: true }));
+                        window.__starting.replaced = { connected: video.isConnected, src: video.hasAttribute('src'), inert: video.inert, resets: video.__resets ?? 0 };
+                    };
+                    video.addEventListener('loadstart', () => { if (window.__delay) setTimeout(replace, window.__delay); else replace(); }, { once: true });
+                }).observe(slot, { childList: true });
+            });
+            const png = parityPng('f02.png');
+            await page.evaluate(bytes => {
+                const transfer = new DataTransfer();
+                transfer.items.add(new File([new Uint8Array(bytes)], 'f02.png', { type: 'image/png' }));
+                window.__pngFiles = transfer.files;
+            }, [...png.buffer]);
+            await page.evaluate(delay => { window.__delay = delay; }, attempt % 5);
+            await choose(page, localFixture('core-tags.webm', 'video/webm'));
+            await expect(preview(page).locator('img.local-file-preview')).toBeVisible({ timeout: 8000 });
+            await expect(preview(page).locator('video')).toHaveCount(0);
+            // Replaced while starting (always so at `loadstart` itself): kept in place and untouched. A video that had
+            // settled is released at once. Either way it is reset once, and its URL goes last.
+            await expect.poll(() => page.evaluate(() => window.__starting.revoked ?? null)).toEqual({ src: false, connected: false, resets: 1 });
+            const { readyState, replaced } = await page.evaluate(() => ({ readyState: window.__starting.readyState, replaced: window.__starting.replaced }));
+            if (attempt % 5 === 0) expect(readyState).toBe(0);
+            expect(replaced).toEqual(readyState === 0 ? { connected: true, src: true, inert: true, resets: 0 } : { connected: false, src: false, inert: false, resets: 1 });
+            expect(await page.evaluate(() => window.__starting.node.__resets)).toBe(1);
+            // The page still answers.
+            await chooser(page).setInputFiles(parityPng('f02.png', 'after.png'), { timeout: 8000 });
+            await expect(preview(page).locator('img.local-file-preview')).toBeVisible({ timeout: 8000 });
+            if (attempt === 0) await saveCoverage(page, browserName);
+        } finally {
+            await page.close();
+        }
+    }
+});
+
+test('closing the viewer on a video that just started never blocks the page', async ({ context, browserName }) => {
+    test.setTimeout(180000);
+    // The viewer's video teardown resets its element; on WebKit a reset of a still-starting pipeline blocked the page.
+    for (let attempt = 0; attempt < 15; attempt++) {
+        const page = await context.newPage();
+        try {
+            if (attempt === 0) await startCoverage(page, browserName);
+            await openInspect(page);
+            await choose(page, localFixture('core-tags.webm', 'video/webm'));
+            await openViewer(page);
+            await page.keyboard.press('Escape');
+            await expect(viewer(page)).toHaveCount(0, { timeout: 8000 });
+            await chooser(page).setInputFiles(parityPng('f02.png'), { timeout: 8000 });
+            await expect(preview(page).locator('img.local-file-preview')).toBeVisible({ timeout: 8000 });
+            if (attempt === 0) await saveCoverage(page, browserName);
+        } finally {
+            await page.close();
+        }
+    }
+});
+
+test('replacing a file mid-read never shows or sends the old record', async ({ page, context }) => {
+    const host = await bridgeHost(context);
+    try {
+        await openInspect(page);
+        // Hold every read of held.png after its classification prefix.
+        await page.evaluate(() => {
+            let release;
+            window.__gate = new Promise(resolve => { release = resolve; });
+            window.__releaseGate = release;
+            window.__held = 0;
+            const slice = Blob.prototype.slice;
+            Blob.prototype.slice = function (...args) {
+                const part = slice.apply(this, args);
+                if (this.name !== 'held.png' || (args[0] ?? 0) === 0 && (args[1] ?? this.size) <= 32) return part;
+                const read = part.arrayBuffer.bind(part);
+                part.arrayBuffer = async () => { window.__held++; await window.__gate; return read(); };
+                return part;
+            };
+        });
+        await choose(page, parityPng('f03.png', 'held.png'));
+        await expect.poll(() => page.evaluate(() => window.__held)).toBeGreaterThan(0);
+        await choose(page, sendablePng('fresh.png'));
+        await expect(preview(page).locator('img.local-file-preview')).toBeVisible();
+        await page.evaluate(() => window.__releaseGate());
+        await openViewer(page);
+        await expect(viewer(page).locator('#viewer-title')).toHaveText('fresh.png');
+        await expect(rail(page).locator('.prompt-section.positive p.prompt-text')).toHaveText(POSITIVE_LINES);
+        await sendPair(page);
+        expect(await host.evaluate(() => window.inspectApplied)).toEqual([{ positive: POSITIVE_LINES, negative: '' }]);
+    } finally {
+        await host.evaluate(() => window.inspectHost.dispose());
+        await host.close();
+    }
+});
+
+/** A second tab acting as a ComfyUI host with one Prompt Manager pair destination. */
+async function bridgeHost(context) {
+    const host = await context.newPage();
+    await host.goto(`${workspace}#/overview`);
+    await host.evaluate(async () => {
+        const { createBridgeHost } = await import('/prompt_manager/js/shared/toolkit/prompt-bridge.js');
+        const target = { id: 'pair-1', label: 'Inspect destination', type: 'PromptManagerPair', roles: ['positive', 'negative'] };
+        window.inspectApplied = [];
+        window.inspectPreviews = [];
+        window.inspectHost = createBridgeHost({ origin: location.origin, namespace: '/', label: 'Inspect ComfyUI', adapter: {
+            listTargets: () => [target],
+            preview: (_id, roles) => {
+                window.inspectPreviews.push(roles);
+                return { preview: { target, fields: Object.entries(roles).map(([role, after]) => ({ role, before: `Previous ${role}`, after })),
+                    composition: { prepend: '', append: '', prependConnected: false, appendConnected: false, before: 'Previous positive', after: roles.positive ?? 'Previous positive' } }, snapshot: roles };
+            },
+            apply: roles => { window.inspectApplied.push(roles); return { targetId: target.id, values: roles }; },
+        } });
+    });
+    return host;
+}
+
+async function sendPair(page) {
+    await rail(page).getByRole('button', { name: /^Send prompt pair to ComfyUI: / }).click();
+    const sender = page.getByRole('dialog', { name: 'Send to ComfyUI', exact: true });
+    await sender.getByRole('combobox', { name: 'ComfyUI window', exact: true }).selectOption({ label: 'Inspect ComfyUI' });
+    await sender.getByRole('combobox', { name: 'Destination node', exact: true }).selectOption({ label: 'Inspect destination' });
+    await sender.getByRole('button', { name: 'Preview changes', exact: true }).click();
+    await sender.getByRole('button', { name: 'Apply to ComfyUI', exact: true }).click();
+    await expect(sender).toContainText('Sent to ComfyUI.');
+    await sender.getByRole('button', { name: 'Close', exact: true }).click();
+}
+
+test('local roles send exactly', async ({ page, context }) => {
+    const host = await bridgeHost(context);
+    try {
+        await openInspect(page);
+        await choose(page, sendablePng());
+        await openViewer(page);
+        await expect(rail(page).locator('.prompt-section.positive p.prompt-text')).toHaveText(POSITIVE_LINES);
+        await expect(rail(page).locator('.prompt-section.negative p.prompt-text')).toHaveText('No negative prompt (explicitly empty)');
+        await sendPair(page);
+        const applied = await host.evaluate(() => window.inspectApplied);
+        expect(applied).toEqual([{ positive: POSITIVE_LINES, negative: '' }]);
+        const payload = JSON.stringify([applied, await host.evaluate(() => window.inspectPreviews)]);
+        expect(payload).not.toContain('blob:');
+        expect(payload).not.toContain('send-me');
+        // The viewer is still open, focus came back to the send action.
+        await expect(viewer(page)).toBeVisible();
+    } finally {
+        await host.evaluate(() => window.inspectHost.dispose());
+        await host.close();
+    }
+});
+
+test('local inspection makes no content request or storage write', async ({ page }) => {
+    await instrument(page);
+    const requests = [];
+    page.on('request', request => requests.push({ url: request.url(), method: request.method(), body: request.postData() }));
+    page.on('websocket', socket => requests.push({ url: socket.url(), method: 'WS', body: null }));
+    const table = /\/prompt_manager\/js\/inspection-semantics\.json$/;
+    const tableRead = page.waitForResponse(response => table.test(response.url()));
+    await openInspect(page);
+    // The one static file Inspect reads, its node table, is fetched as the page mounts: before any selection.
+    expect((await tableRead).ok()).toBe(true);
+    // The shell's own reads (counts, Activity) settle before the baseline.
+    await expect(page.locator('aside.sidebar nav [data-route="images"] .nav-count')).toBeAttached();
+    const baseline = (await urls(page)).writes.length;
+    const before = requests.length;
+    expect(requests.filter(entry => table.test(entry.url))).toHaveLength(1);
+    for (const file of [sendablePng('private-name.png'), localFixture('core-tags.webm', 'video/webm', 'private-clip.webm')]) {
+        await choose(page, file);
+        await openViewer(page);
+        await rail(page).locator('summary', { hasText: 'Workflow & raw metadata' }).click();
+        await page.keyboard.press('Escape');
+        await expect(viewer(page)).toHaveCount(0);
+    }
+    const network = requests.slice(before).filter(entry => !entry.url.startsWith('blob:') && !entry.url.startsWith('data:'));
+    expect(requests.filter(entry => table.test(entry.url)), 'the table is read once per page').toHaveLength(1);
+    expect(network.filter(entry => /private|lighthouse|fox/.test(`${entry.url} ${entry.body ?? ''}`))).toEqual([]);
+    expect(network.filter(entry => entry.method !== 'GET')).toEqual([]);
+    expect(network.filter(entry => !/\/prompt_manager\/(activity|images\/output|library|vocabulary)/.test(entry.url))).toEqual([]);
+    expect((await urls(page)).writes.slice(baseline)).toEqual([]);
+});
+
+test('touch layout at 390 has no horizontal overflow at 200% zoom', async ({ page }) => {
+    await page.setViewportSize({ width: 390, height: 844 });
+    await openInspect(page);
+    await choose(page, parityPng('f02.png'));
+    await expect(preview(page).locator('img.local-file-preview')).toBeVisible();
+    for (const zoom of ['1', '2']) {
+        await page.evaluate(value => { document.documentElement.style.zoom = value; }, zoom);
+        await expect.poll(() => page.evaluate(() => document.documentElement.scrollWidth <= window.innerWidth)).toBe(true);
+        const area = await page.locator('.file-drop').evaluate(node => node.getBoundingClientRect().right <= document.documentElement.clientWidth + 0.5);
+        expect(area).toBe(true);
+    }
+});
+
+// LI-4 (D117): "Copy settings summary" after the six facts is the legacy metadata page's COPY ALL, in the shared full
+// inspector, so a file served in Images and the same bytes chosen here copy the same summary of what the rail shows.
+/** Records clipboard writes in the page, or (`clipboard: false`) leaves the page without a clipboard. */
+async function stubClipboard(page, { clipboard = true } = {}) {
+    await page.addInitScript(available => {
+        window.__copied = [];
+        Object.defineProperty(navigator, 'clipboard', { configurable: true,
+            value: available ? { writeText: async text => { window.__copied.push(text); } } : undefined });
+    }, clipboard);
+}
+/** The summary the rail's own prompts and facts make, in the legacy COPY ALL lines and placeholders. */
+const expectedSummary = locator => locator.evaluate(node => {
+    const facts = Object.fromEntries([...node.querySelectorAll(':scope .meta-grid:not(details .meta-grid) > div')]
+        .map(item => [item.querySelector('dt').textContent, item.querySelector('dd').textContent]));
+    // A confirmed prompt has its Copy action; an explicitly empty one takes the legacy placeholder too.
+    const prompt = role => {
+        const text = node.querySelector(`.prompt-section.${role} [data-copy-role]`) ? node.querySelector(`.prompt-section.${role} p.prompt-text`).textContent : null;
+        return text === `No ${role} prompt (explicitly empty)` ? null : text;
+    };
+    return [`Checkpoint: ${facts.Model}`, `Positive Prompt: ${prompt('positive') ?? 'No prompt found'}`,
+        `Negative Prompt: ${prompt('negative') ?? 'No negative prompt found'}`, `Steps: ${facts.Steps}`, `CFG Scale: ${facts.CFG}`,
+        `Sampler: ${facts.Sampler}`, `Seed: ${facts.Seed}`].join('\n');
+});
+async function copySummary(page) {
+    const button = rail(page).getByRole('button', { name: 'Copy settings summary', exact: true });
+    // It follows the six facts, before "File & provenance".
+    expect(await button.evaluate(node => [node.previousElementSibling?.localName, node.nextElementSibling?.localName])).toEqual(['dl', 'details']);
+    await button.click();
+}
+
+test('Copy settings summary copies the same legacy summary in Images and Inspect', async ({ page, request }) => {
+    await stubClipboard(page);
+    await expect(await request.post('/__test__/add-local-inspect-file', { data: { name: 'f02.png' } })).toBeOK();
+    await page.goto(`${workspace}#/images`);
+    await page.locator('article[data-image-key="0:local-inspect/f02.png"] .image-open').click();
+    await expect(rail(page).locator('.prompt-section.positive p.prompt-text')).toBeVisible();
+    const served = await expectedSummary(rail(page));
+    expect(served).toMatch(/^Checkpoint: .+\nPositive Prompt: [\s\S]+\nNegative Prompt: [\s\S]+\nSteps: .+\nCFG Scale: .+\nSampler: .+\nSeed: .+$/);
+    expect(served).not.toContain('Unknown');
+    await copySummary(page);
+    await expect(page.locator('#workspace-toast')).toHaveText('Settings summary copied.');
+    expect(await page.evaluate(() => window.__copied)).toEqual([served]);
+    await page.keyboard.press('Escape');
+    await expect(viewer(page)).toHaveCount(0);
+
+    await openInspect(page);
+    await choose(page, parityPng('f02.png'));
+    await openViewer(page);
+    expect(await expectedSummary(rail(page))).toBe(served);
+    await copySummary(page);
+    await expect.poll(() => page.evaluate(() => window.__copied)).toEqual([served, served]);
+    // The panel variant (the Images side panel) keeps the concept's footer: no summary action there.
+    await page.keyboard.press('Escape');
+    await page.goto(`${workspace}#/images`);
+    await expect(page.locator('#image-inspector .panel-heading')).toBeVisible();
+    await expect(page.locator('#image-inspector').getByRole('button', { name: 'Copy settings summary', exact: true })).toHaveCount(0);
+});
+
+test('Copy settings summary without a clipboard opens the select-to-copy dialog', async ({ page }) => {
+    await stubClipboard(page, { clipboard: false });
+    await openInspect(page);
+    await choose(page, sendablePng());
+    await openViewer(page);
+    const summary = await expectedSummary(rail(page));
+    expect(summary).toContain(`Positive Prompt: ${POSITIVE_LINES}`);
+    await copySummary(page);
+    const fallback = page.getByRole('dialog', { name: 'Copy settings summary', exact: true });
+    await expect(fallback).toBeVisible();
+    await expect(fallback.getByRole('textbox', { name: 'Select and copy this text', exact: true })).toHaveValue(summary);
+    await expect(fallback.getByRole('textbox', { name: 'Select and copy this text', exact: true })).toBeFocused();
+    await page.keyboard.press('Escape');
+    await expect(fallback).toHaveCount(0);
+    // Escape closes only the copy dialog; focus returns to the action in the still-open viewer.
+    await expect(viewer(page)).toBeVisible();
+    await expect(rail(page).getByRole('button', { name: 'Copy settings summary', exact: true })).toBeFocused();
+});

tests/browser/workspace-library.spec.mjs

@@ -610,7 +610,9 @@ test('card matches the concept and never wraps the category mid-word',async({pag
     await expect(await request.post('/prompt_manager/bulk/category',{data:{prompt_ids:[dual.id],category:''}})).toBeOK();
     // A long saved title fills the title row, so only the chip's own min-content keeps "Uncategorized" and "asian" whole.
     const wide='A remarkably long saved positive prompt title that fills the whole card title row';
-    await patchShelf(page,item=>item.id===cat.id?{run_count:4,last_used_at:new Date().toISOString(),rating:5}:item.id===dual.id||item.id===dog.id?{title:wide,run_count:1,last_used_at:null,rating:null}:{});
+    // One "now" for the patched last use and the page's clock, so it reads "Used today" on either side of midnight.
+    const usedAt=new Date();await page.clock.setFixedTime(usedAt);
+    await patchShelf(page,item=>item.id===cat.id?{run_count:4,last_used_at:usedAt.toISOString(),rating:5}:item.id===dual.id||item.id===dog.id?{title:wide,run_count:1,last_used_at:null,rating:null}:{});
     for(const [width,height] of [[1600,1100],[390,844]]) {
         await page.setViewportSize({width,height});await page.goto(route);await expect(cards(page)).toHaveCount(3);
         const card=page.locator(`article[data-prompt-id="${cat.id}"]`);

tests/browser/workspace-tagging-bulk.spec.mjs

@@ -0,0 +1,323 @@
+// The Images selection bar's Add tags and Auto-tag selected (#249 PR D, plan Task D2, Mock inventory M3; D85, D90,
+// D91) against the real `image-tags` job route and the injected fake model (tests/browser/workspace_tagging_fixture.py).
+// No model is ever downloaded or loaded for real: the fake answers, and every test checks no download request was sent.
+import { startCoverage, saveCoverage } from '../../tools/vendor/browser-coverage.mjs';
+import { test, expect } from './fixtures.mjs';
+
+const images = '/prompt_manager/workspace#/images';
+const FIRST = 'tagging/dunes_00001.png', SECOND = 'tagging/dunes_00002.png', UNLINKED = 'loose/unlinked.png';
+const card = (page, path) => page.locator(`article[data-image-key="0:${path}"]`);
+const bar = page => page.locator('#workspace-main > #bulkbar > .bulkbar');
+const barButton = (page, name) => bar(page).getByRole('button', { name, exact: true });
+const modal = page => page.locator('dialog#modal[open]');
+const title = page => modal(page).locator('#modal-title');
+const toast = page => page.locator('#workspace-toast');
+const toasts = page => page.evaluate(() => window.__toasts);
+const chips = page => modal(page).locator('#tag-suggestions .chip.tag-suggestion');
+const actionButtons = page => modal(page).locator('.dialog-actions button');
+const panel = page => page.getByRole('complementary', { name: 'Selected image details', exact: true });
+const tagRow = page => panel(page).locator('.detail-inner > .tags').last();
+const NOT_DOWNLOADED = 'WD14 SwinV2 is not downloaded. Download it from the legacy Auto-tag page.';
+
+test.beforeEach(async ({ page, request, browserName }) => {
+    await startCoverage(page, browserName);
+    // Every toast text in order: a fast job's finish toast may replace its start toast before an assertion reads it.
+    await page.addInitScript(() => {
+        window.__toasts = [];
+        new MutationObserver(() => {
+            const text = document.getElementById('workspace-toast')?.textContent ?? '';
+            if (text && window.__toasts.at(-1) !== text) window.__toasts.push(text);
+        }).observe(document, { subtree: true, childList: true, characterData: true });
+    });
+    await expect(await request.post('/__test__/tagging/reset', { data: {} })).toBeOK();
+    page.taggingErrors = [];
+    page.on('pageerror', error => page.taggingErrors.push(error.message));
+    page.downloads = [];
+    page.on('request', item => { if (/\/autotag\/download\//.test(item.url())) page.downloads.push(item.url()); });
+});
+test.afterEach(async ({ page, browserName }) => {
+    await saveCoverage(page, browserName);
+    expect(page.taggingErrors).toEqual([]);
+    expect(page.downloads).toEqual([]);
+});
+
+/** Images with `paths` checked, in that order. */
+async function select(page, ...paths) {
+    await page.goto(images);
+    for (const path of paths) await card(page, path).getByRole('checkbox').check();
+    await expect(bar(page).locator('strong')).toHaveText(`${paths.length} selected`);
+}
+async function scopeOf(request) {
+    const listing = await (await request.get('/prompt_manager/images/output?mode=workspace&limit=40')).json();
+    return listing.images[0].root_scope;
+}
+/** The saved tags of `path` through the real observe route, then that capture's release. */
+async function savedTags(request, path) {
+    const target = { root_index: 0, root_scope: await scopeOf(request), path };
+    const observed = await (await request.post('/prompt_manager/image-annotations/observe', { data: { target } })).json();
+    expect(observed.success).toBe(true);
+    await request.delete(`/prompt_manager/image-annotations/capture/${observed.capture.token}`);
+    return observed.tags;
+}
+/** Wait until the session's job `id` has ended; returns its summary. */
+async function ended(request, id) {
+    let job;
+    await expect.poll(async () => {
+        const { jobs } = await (await request.get('/prompt_manager/jobs')).json();
+        job = jobs.find(item => item.id === id);
+        return job?.state;
+    }).toBe('finished');
+    return job;
+}
+const jobStart = page => page.waitForRequest(item => item.method() === 'POST' && new URL(item.url()).pathname === '/prompt_manager/jobs/image-tags');
+
+test('selection bar shows Add tags then Auto-tag selected before Set category', async ({ page }) => {
+    await select(page, FIRST);
+    await expect(bar(page).locator(':scope > *')).toHaveText(['1 selected', 'Add tags', 'Auto-tag selected', 'Set category', 'Export metadata', 'Clear']);
+});
+
+test('Add tags runs a job and the cards show the tags after it finishes', async ({ page, request }) => {
+    await select(page, SECOND, FIRST);
+    await expect(card(page, FIRST)).toHaveClass(/\bselected\b/);
+    await barButton(page, 'Add tags').click();
+    await expect(title(page)).toHaveText('Tag selected images');
+    const field = modal(page).getByRole('textbox', { name: 'Tags, separated by commas', exact: true });
+    await expect(field).toHaveValue('');
+    await expect(actionButtons(page)).toHaveText(['Cancel', 'Apply']);
+    let posted = 0;
+    page.on('request', item => { if (new URL(item.url()).pathname === '/prompt_manager/jobs/image-tags') posted += 1; });
+    // A field that parses to no names keeps the dialog and its text, and reports why on the field (D118).
+    await field.fill(' , ,');
+    await actionButtons(page).last().click();
+    await expect.poll(() => field.evaluate(node => node.validationMessage)).toBe('Enter at least one tag.');
+    await expect(title(page)).toHaveText('Tag selected images');
+    await expect(field).toHaveValue(' , ,');
+    await field.fill('sunset, Sunset , blue_hour,,');
+    expect(await field.evaluate(node => node.validity.valid)).toBe(true);
+    const started = jobStart(page);
+    const answer = page.waitForResponse(item => new URL(item.url()).pathname === '/prompt_manager/jobs/image-tags');
+    await actionButtons(page).last().click();
+    const scope = await scopeOf(request);
+    // Listing order (the newer FIRST before SECOND), the reveal identity, the dialog's dedupe.
+    expect((await started).postDataJSON()).toEqual({ mode: 'add', tags: ['sunset', 'blue_hour'], targets: [
+        { root_index: 0, root_scope: scope, path: FIRST }, { root_index: 0, root_scope: scope, path: SECOND }] });
+    const { job } = await (await answer).json();
+    // The refused Apply sent nothing: only the valid one was posted.
+    expect(posted).toBe(1);
+    await expect.poll(() => toasts(page)).toContain('Tagging started.');
+    expect(await toasts(page)).not.toContain('Enter at least one tag.');
+    await expect(modal(page)).toHaveCount(0);
+    await expect(bar(page).locator('strong')).toHaveText('2 selected');
+    expect((await ended(request, job.id)).counters).toEqual({ tagged: 2, unchanged: 0, skipped: 0, errors: 0 });
+    // The finished job's files are read again: the selected card's panel shows its new image tags.
+    await expect(tagRow(page).locator('button.chip')).toHaveText(['sunset', 'blue_hour']);
+    expect(await savedTags(request, SECOND)).toEqual(['sunset', 'blue_hour']);
+    expect(await savedTags(request, UNLINKED)).toEqual([]);
+});
+
+test('Auto-tag selected with Apply automatically runs a job with the chosen model, thresholds and suggestion count', async ({ page, request }) => {
+    await select(page, FIRST, UNLINKED);
+    await barButton(page, 'Auto-tag selected').click();
+    await expect(title(page)).toHaveText('Auto-tag selected images');
+    await expect(modal(page)).toHaveClass(/(^| )tagging-modal( |$)/);
+    const body = modal(page).locator('#modal-body');
+    expect(await body.evaluate(node => [...node.children].map(child => child.className))).toEqual(['tag-model-panel', 'field', 'small', 'dialog-actions']);
+    await expect(body.locator('.tag-model-panel h3')).toHaveText('Auto-tag 2 images');
+    // No preview, manual field, suggestions or Generate: only the model panel's fields.
+    await expect(body.getByRole('button', { name: 'Generate suggestions', exact: true })).toHaveCount(0);
+    await expect(body.locator('#manual-image-tags, .tag-suggestion-panel, .tag-image-preview')).toHaveCount(0);
+    const group = body.getByRole('radiogroup', { name: 'How to apply', exact: true });
+    await expect(group.getByRole('radio', { name: 'Apply automatically', exact: true })).toBeChecked();
+    await expect(group.getByRole('radio', { name: 'Review each image', exact: true })).not.toBeChecked();
+    await expect(actionButtons(page)).toHaveText(['Cancel', 'Start auto-tagging']);
+    await body.getByRole('combobox', { name: 'Tagging model', exact: true }).selectOption('wd14-vit');
+    await body.getByRole('spinbutton', { name: 'General confidence', exact: true }).fill('0.5');
+    await body.getByRole('spinbutton', { name: 'Character confidence', exact: true }).fill('0.9');
+    const limit = body.getByRole('spinbutton', { name: 'Suggestions', exact: true });
+    // An invalid count reports its validity and sends nothing.
+    await limit.fill('0');
+    let posted = 0;
+    page.on('request', item => { if (new URL(item.url()).pathname === '/prompt_manager/jobs/image-tags') posted += 1; });
+    await actionButtons(page).last().click();
+    expect(await limit.evaluate(node => node.validity.valid)).toBe(false);
+    await expect(title(page)).toHaveText('Auto-tag selected images');
+    await limit.fill('2');
+    const started = jobStart(page);
+    const answer = page.waitForResponse(item => new URL(item.url()).pathname === '/prompt_manager/jobs/image-tags');
+    await actionButtons(page).last().click();
+    const scope = await scopeOf(request);
+    expect((await started).postDataJSON()).toEqual({ mode: 'auto', model_type: 'wd14-vit',
+        options: { general_threshold: 0.5, character_threshold: 0.9, suggestion_limit: 2 },
+        targets: [{ root_index: 0, root_scope: scope, path: FIRST }, { root_index: 0, root_scope: scope, path: UNLINKED }] });
+    const { job } = await (await answer).json();
+    // The invalid press sent nothing: only this Start was posted.
+    expect(posted).toBe(1);
+    await expect.poll(() => toasts(page)).toContain('Auto-tagging started.');
+    await expect(modal(page)).toHaveCount(0);
+    await expect(bar(page).locator('strong')).toHaveText('2 selected');
+    expect((await ended(request, job.id)).counters).toEqual({ tagged: 2, unchanged: 0, skipped: 0, errors: 0 });
+    expect(await savedTags(request, FIRST)).toEqual(['sandstone', 'desert']);
+    expect(await savedTags(request, UNLINKED)).toEqual(['sandstone', 'desert']);
+    expect(await savedTags(request, SECOND)).toEqual([]);
+});
+
+test('a model that is not downloaded keeps Start disabled and says why', async ({ page, request }) => {
+    await expect(await request.post('/__test__/tagging/models', { data: { unavailable: ['wd14-swinv2'] } })).toBeOK();
+    await select(page, FIRST);
+    await barButton(page, 'Auto-tag selected').click();
+    const status = modal(page).locator('#tag-generation-status');
+    await expect(status).toHaveAttribute('role', 'status');
+    await expect(status).toHaveText(NOT_DOWNLOADED);
+    const start = actionButtons(page).last();
+    await expect(start).toHaveAttribute('aria-disabled', 'true');
+    let posted = 0;
+    page.on('request', item => { if (new URL(item.url()).pathname === '/prompt_manager/jobs/image-tags') posted += 1; });
+    // aria-disabled: a press does nothing.
+    await start.dispatchEvent('click');
+    await expect(title(page)).toHaveText('Auto-tag selected images');
+    await modal(page).getByRole('combobox', { name: 'Tagging model', exact: true }).selectOption('wd14-vit');
+    await expect(status).toHaveText('');
+    await expect(start).not.toHaveAttribute('aria-disabled', 'true');
+    await modal(page).getByRole('combobox', { name: 'Tagging model', exact: true }).selectOption('wd14-swinv2');
+    await expect(start).toHaveAttribute('aria-disabled', 'true');
+    await actionButtons(page).first().click();
+    await expect(modal(page)).toHaveCount(0);
+    await expect(barButton(page, 'Auto-tag selected')).toBeFocused();
+    expect(posted).toBe(0);
+});
+
+test('Suggestions field prefills from the setting and caps chips at the entered count', async ({ page, request }) => {
+    await expect(await request.post('/__test__/tagging/defaults', { data: { general: 0.5, character: 0.9, limit: 7 } })).toBeOK();
+    await select(page, FIRST);
+    await barButton(page, 'Auto-tag selected').click();
+    const limit = modal(page).getByRole('spinbutton', { name: 'Suggestions', exact: true });
+    await expect(limit).toHaveValue('7');
+    await expect(modal(page).getByRole('spinbutton', { name: 'General confidence', exact: true })).toHaveValue('0.5');
+    await expect(modal(page).getByRole('spinbutton', { name: 'Character confidence', exact: true })).toHaveValue('0.9');
+    await modal(page).getByRole('radio', { name: 'Review each image', exact: true }).check();
+    await expect(actionButtons(page)).toHaveText(['Cancel', 'Start review']);
+    await limit.fill('3');
+    const suggest = page.waitForRequest(item => item.url().endsWith('/image-annotations/suggest'));
+    await actionButtons(page).last().click();
+    await expect(title(page)).toHaveText('Tag image · Image 1 of 1');
+    expect((await suggest).postDataJSON().options).toEqual({ general_threshold: 0.5, character_threshold: 0.9, suggestion_limit: 3 });
+    await expect(chips(page)).toHaveCount(3);
+    await expect(modal(page).getByRole('spinbutton', { name: 'Suggestions', exact: true })).toHaveValue('3');
+    await expect(actionButtons(page)).toHaveText(['Stop reviewing', 'Skip', 'Approve and finish']);
+    await page.keyboard.press('Escape');
+    await expect(modal(page)).toHaveCount(0);
+    await expect(toast(page)).toHaveText('0 of 1 images tagged.');
+    expect(await savedTags(request, FIRST)).toEqual([]);
+});
+
+test('Review each image walks the selection one dialog at a time and only approved images gain tags', async ({ page, request }) => {
+    await select(page, FIRST, SECOND, UNLINKED);
+    // The second image's first Generate finds the model busy (a legacy batch): the dialog waits for Retry or Skip.
+    let suggests = 0;
+    await page.route('**/prompt_manager/image-annotations/suggest', async route => {
+        suggests += 1;
+        if (suggests === 2) {
+            await route.fulfill({ status: 409, json: { success: false, code: 'model-busy', error: 'The tagging model is busy. Try again when it finishes.' } });
+            return;
+        }
+        await route.continue();
+    });
+    const puts = [];
+    page.on('request', item => { if (item.method() === 'PUT' && item.url().endsWith('/image-annotations/tags')) puts.push(item.postDataJSON()); });
+    await barButton(page, 'Auto-tag selected').click();
+    await modal(page).getByRole('radio', { name: 'Review each image', exact: true }).check();
+    await modal(page).getByRole('spinbutton', { name: 'Suggestions', exact: true }).fill('2');
+    await actionButtons(page).last().click();
+    await expect(title(page)).toHaveText('Tag image · Image 1 of 3');
+    await expect(modal(page).getByRole('combobox', { name: 'Tagging model', exact: true })).toHaveValue('wd14-swinv2');
+    await expect(chips(page)).toHaveCount(2);
+    await expect(actionButtons(page)).toHaveText(['Stop reviewing', 'Skip', 'Approve and next']);
+    await expect(actionButtons(page).last()).toHaveClass(/ca-primary/);
+    // Approve saves the dialog's manual field plus its remaining chips.
+    await modal(page).getByRole('textbox', { name: 'Image tags · edit manually', exact: true }).fill('mine');
+    await modal(page).getByRole('button', { name: 'Remove desert', exact: true }).click();
+    await actionButtons(page).last().click();
+    await expect(title(page)).toHaveText('Tag image · Image 2 of 3');
+    await expect(modal(page).locator('#tag-generation-status')).toHaveText('The tagging model is busy. Try again when it finishes.');
+    // No suggestions on screen: the primary would save the manual field only (D90).
+    await expect(actionButtons(page)).toHaveText(['Retry', 'Stop reviewing', 'Skip', 'Save and next']);
+    await actionButtons(page).nth(2).click();
+    await expect(title(page)).toHaveText('Tag image · Image 3 of 3');
+    await expect(chips(page)).toHaveCount(2);
+    await expect(actionButtons(page)).toHaveText(['Stop reviewing', 'Skip', 'Approve and finish']);
+    await actionButtons(page).last().click();
+    await expect(modal(page)).toHaveCount(0);
+    await expect(toast(page)).toHaveText('2 of 3 images tagged.');
+    await expect(barButton(page, 'Auto-tag selected')).toBeFocused();
+    await expect(bar(page).locator('strong')).toHaveText('3 selected');
+    expect(puts.map(body => [body.target.path, body.tags])).toEqual([[FIRST, ['mine', 'sandstone']], [UNLINKED, ['sandstone', 'desert']]]);
+    expect(await savedTags(request, FIRST)).toEqual(['mine', 'sandstone']);
+    expect(await savedTags(request, SECOND)).toEqual([]);
+    expect(await savedTags(request, UNLINKED)).toEqual(['sandstone', 'desert']);
+    // The reviewed file's panel shows its saved tags without reselecting.
+    await expect(tagRow(page).locator('button.chip')).toHaveText(['mine', 'sandstone']);
+    await expect.poll(async () => (await (await request.get('/__test__/tagging/captures')).json()).captures).toBe(0);
+});
+
+test('Review holds Stop reviewing, Escape and × while a save is in flight, and names a manual-only save', async ({ page, request }) => {
+    await select(page, FIRST, SECOND);
+    let release;
+    const held = new Promise(resolve => { release = resolve; });
+    await page.route('**/prompt_manager/image-annotations/tags', async route => {
+        if (route.request().method() === 'PUT') await held;
+        await route.continue();
+    });
+    await barButton(page, 'Auto-tag selected').click();
+    await modal(page).getByRole('radio', { name: 'Review each image', exact: true }).check();
+    await actionButtons(page).last().click();
+    await expect(title(page)).toHaveText('Tag image · Image 1 of 2');
+    await expect(chips(page)).not.toHaveCount(0);
+    await expect(actionButtons(page)).toHaveText(['Stop reviewing', 'Skip', 'Approve and next']);
+    // D90: a model change clears the suggestions, so the primary saves the manual field only and says so.
+    await modal(page).getByRole('combobox', { name: 'Tagging model', exact: true }).selectOption('wd14-vit');
+    await expect(chips(page)).toHaveCount(0);
+    await expect(actionButtons(page)).toHaveText(['Stop reviewing', 'Skip', 'Save and next']);
+    await modal(page).getByRole('textbox', { name: 'Image tags · edit manually', exact: true }).fill('mine');
+    const put = page.waitForRequest(item => item.method() === 'PUT' && item.url().endsWith('/image-annotations/tags'));
+    await actionButtons(page).last().click();
+    await put;
+    const stop = actionButtons(page).first();
+    await expect(stop).toHaveAttribute('aria-disabled', 'true');
+    await expect(actionButtons(page).nth(1)).toHaveAttribute('aria-disabled', 'true');
+    // None of these ends the session while the save is in flight; the count then includes it.
+    await page.keyboard.press('Escape');
+    await modal(page).locator('#modal-close').click();
+    await stop.dispatchEvent('click'); // aria-disabled: Playwright's click would wait for it
+    release();
+    await expect(title(page)).toHaveText('Tag image · Image 2 of 2');
+    await expect(chips(page)).not.toHaveCount(0);
+    await expect(actionButtons(page)).toHaveText(['Stop reviewing', 'Skip', 'Approve and finish']);
+    await expect(actionButtons(page).first()).not.toHaveAttribute('aria-disabled', 'true');
+    await actionButtons(page).first().click();
+    await expect(modal(page)).toHaveCount(0);
+    await expect(toast(page)).toHaveText('1 of 2 images tagged.');
+    expect(await savedTags(request, FIRST)).toEqual(['mine']);
+    expect(await savedTags(request, SECOND)).toEqual([]);
+});
+
+test('a running scan makes the start report busy', async ({ page, request }) => {
+    const scan = await (await request.post('/__test__/jobs/start', { data: { kind: 'scan', title: 'Scan for metadata' } })).json();
+    try {
+        await select(page, FIRST, SECOND);
+        await barButton(page, 'Add tags').click();
+        await modal(page).getByRole('textbox', { name: 'Tags, separated by commas', exact: true }).fill('sunset');
+        await actionButtons(page).last().click();
+        await expect(toast(page)).toHaveText('Another job is running: Scan for metadata.');
+        await expect(toast(page).getByRole('link', { name: 'Scan for metadata', exact: true })).toHaveAttribute('href', `#/activity/${scan.job.id}`);
+        await expect(bar(page).locator('strong')).toHaveText('2 selected');
+        // Auto-tag is refused the same way.
+        await barButton(page, 'Auto-tag selected').click();
+        await expect(actionButtons(page).last()).not.toHaveAttribute('aria-disabled', 'true');
+        await actionButtons(page).last().click();
+        await expect(toast(page)).toHaveText('Another job is running: Scan for metadata.');
+        await expect(bar(page).locator('strong')).toHaveText('2 selected');
+        expect(await savedTags(request, FIRST)).toEqual([]);
+    } finally {
+        await request.post(`/__test__/jobs/${scan.job.id}/finish`, { data: { state: 'finished' } });
+    }
+});

tests/browser/workspace-tagging-lifecycle.spec.mjs

@@ -0,0 +1,71 @@
+// The Tag image dialog's capture lifetime when the page or the dialog goes away mid-flight (#249 PR C final review I4,
+// I5), run on all four projects: leaving the page with the dialog open releases the capture (a `keepalive` DELETE sent
+// on `pagehide`, which also closes the dialog), and closing the dialog while its save is in flight keeps the capture
+// until the save settles, then still reports the save. The fixture is tests/browser/workspace_tagging_fixture.py.
+import { startCoverage, saveCoverage } from '../../tools/vendor/browser-coverage.mjs';
+import { test, expect } from './fixtures.mjs';
+
+const images = '/prompt_manager/workspace#/images';
+const FIRST = 'tagging/dunes_00001.png';
+const TAGS_URL = '**/prompt_manager/image-annotations/tags';
+const dialog = page => page.getByRole('dialog', { name: 'Tag image', exact: true });
+const manual = page => dialog(page).getByRole('textbox', { name: 'Image tags · edit manually', exact: true });
+const tagButton = page => page.locator(`article[data-image-key="0:${FIRST}"]`).getByRole('button', { name: 'Tag or auto-tag dunes_00001.png', exact: true });
+const openCaptures = async request => (await (await request.get('/__test__/tagging/captures')).json()).captures;
+
+test.beforeEach(async ({ page, request, browserName }) => {
+    await startCoverage(page, browserName);
+    await expect(await request.post('/__test__/tagging/reset', { data: {} })).toBeOK();
+    page.problems = [];
+    page.on('pageerror', error => page.problems.push(`pageerror: ${error.message}`));
+    page.on('console', message => { if (message.type() === 'error') page.problems.push(`console: ${message.text()}`); });
+});
+test.afterEach(async ({ page, browserName }) => {
+    await saveCoverage(page, browserName);
+    expect(page.problems).toEqual([]);
+});
+
+async function openTag(page) {
+    await page.goto(images);
+    const observed = page.waitForResponse(item => item.url().endsWith('/image-annotations/observe'));
+    await tagButton(page).click();
+    await expect(dialog(page)).toBeVisible();
+    expect((await observed).status()).toBe(200);
+    await expect(manual(page)).toBeEditable();
+}
+
+test('leaving the page with the dialog open releases its capture without a console error (I4)', async ({ page, request }) => {
+    await openTag(page);
+    expect(await openCaptures(request)).toBe(1);
+    // Another document: the old one's pagehide closes the dialog and sends the release with keepalive.
+    await page.goto('/prompt_manager/workspace?left=1#/tags');
+    await expect(page.locator('#workspace-main h1')).toHaveText('Tags & categories');
+    await expect.poll(() => openCaptures(request)).toBe(0);
+    await expect(dialog(page)).toHaveCount(0);
+});
+
+test('closing the dialog during a save releases the capture after the save and still reports it (I5)', async ({ page, request }) => {
+    await openTag(page);
+    await manual(page).fill('saved_after_close');
+    const order = [];
+    page.on('response', item => { if (item.url().endsWith('/image-annotations/tags')) order.push(`PUT ${item.status()}`); });
+    page.on('request', item => { if (item.url().includes('/image-annotations/capture/') && item.method() === 'DELETE') order.push('DELETE'); });
+    let release;
+    const held = new Promise(resolve => { release = resolve; });
+    const sent = new Promise(resolve => {
+        page.route(TAGS_URL, async route => { resolve(); await held; await route.continue(); });
+    });
+    await dialog(page).getByRole('button', { name: 'Save manual tags', exact: true }).click();
+    await sent;
+    await page.keyboard.press('Escape');
+    await expect(dialog(page)).toHaveCount(0);
+    expect(await openCaptures(request)).toBe(1);
+    expect(order).toEqual([]);
+    release();
+    await expect(page.locator('#workspace-toast')).toHaveText('1 tags saved for dunes_00001.png.');
+    await expect.poll(() => order).toEqual(['PUT 200', 'DELETE']);
+    await expect.poll(() => openCaptures(request)).toBe(0);
+    // The page followed the late save: the selected file's details show the new image tag.
+    await expect(page.getByRole('complementary', { name: 'Selected image details', exact: true }).getByText('saved_after_close', { exact: true })).toBeVisible();
+    await page.unroute(TAGS_URL);
+});

tests/browser/workspace-tagging.spec.mjs

@@ -0,0 +1,752 @@
+// The Tag image dialog, the card Tag button and the Tags page hooks (#249 PR C, plan Task C2, Mock inventory M1, M2, M5)
+// against the real routes and the injected fake model (tests/browser/workspace_tagging_fixture.py). No model is ever
+// downloaded or loaded: the fake answers, and every test checks that no download request was sent.
+import { startCoverage, saveCoverage } from '../../tools/vendor/browser-coverage.mjs';
+import { test, expect } from './fixtures.mjs';
+import { saveImageTags } from './concept-inventory.mjs';
+import { taggingInventory } from './tagging-canonical-comparison.mjs';
+
+const images = '/prompt_manager/workspace#/images';
+const MODULE = '/prompt_manager/js/workspace/image-tagging.mjs';
+const MODEL_LABELS = ['WD14 SwinV2 · ~400 MB', 'WD14 ViT · ~400 MB', 'GGUF JoyCaption (Recommended) · ~4.5 GB', 'HuggingFace JoyCaption · ~16 GB'];
+// The concept's on-screen opening sentence (its renderTagModelOptions replaces the markup's at once, D83).
+const MODEL_CHANGED = 'Generate suggestions with the selected model before approving.';
+const CHIP_HINT = 'Remove anything you do not want to add.';
+const ALL_REMOVED = 'All suggestions removed. Generate again or enter tags manually.';
+const card = (page, path) => page.locator(`article[data-image-key="0:${path}"]`);
+const tagButton = (page, path) => card(page, path).getByRole('button', { name: `Tag or auto-tag ${path.split('/').pop()}`, exact: true });
+const dialog = page => page.getByRole('dialog', { name: 'Tag image', exact: true });
+const manual = page => dialog(page).getByRole('textbox', { name: 'Image tags · edit manually', exact: true });
+const model = page => dialog(page).getByRole('combobox', { name: 'Tagging model', exact: true });
+const generate = page => dialog(page).getByRole('button', { name: 'Generate suggestions', exact: true });
+const chips = page => dialog(page).locator('#tag-suggestions .chip.tag-suggestion');
+const status = page => dialog(page).locator('#tag-generation-status');
+const toast = page => page.locator('#workspace-toast');
+const nav = (page, label) => page.locator('aside.sidebar nav').getByRole('link', { name: new RegExp(`^${label}(?:\\s*[\\d,]+)?$`) });
+const FIRST = 'tagging/dunes_00001.png', SECOND = 'tagging/dunes_00002.png', COPY = 'copies/dunes_00001.png';
+const VIDEO = 'tagging/clip.webm', UNLINKED = 'loose/unlinked.png';
+
+let manifest;
+test.beforeEach(async ({ page, request, browserName }) => {
+    await startCoverage(page, browserName);
+    const response = await request.post('/__test__/tagging/reset', { data: {} });
+    await expect(response).toBeOK();
+    manifest = await response.json();
+    page.taggingErrors = [];
+    page.on('pageerror', error => page.taggingErrors.push(error.message));
+    page.downloads = [];
+    page.on('request', item => { if (/\/autotag\/download\//.test(item.url())) page.downloads.push(item.url()); });
+});
+test.afterEach(async ({ page, browserName }) => {
+    await saveCoverage(page, browserName);
+    expect(page.taggingErrors).toEqual([]);
+    expect(page.downloads).toEqual([]);
+});
+
+/** Images, then the Tag dialog of `path`, settled on its observation (the manual field holds the saved tags). */
+async function openTag(page, path = FIRST, { goto = true } = {}) {
+    if (goto) await page.goto(images);
+    const observed = page.waitForResponse(item => item.url().endsWith('/image-annotations/observe'));
+    await tagButton(page, path).click();
+    await expect(dialog(page)).toBeVisible();
+    expect((await observed).status()).toBe(200);
+    await expect(dialog(page).locator('img.tag-image-preview, video.tag-image-preview')).toHaveAttribute('src', /\/prompt_manager\/image-annotations\/capture\//);
+}
+async function generated(page) {
+    const answer = page.waitForResponse(item => item.url().endsWith('/image-annotations/suggest'));
+    await generate(page).click();
+    return answer;
+}
+/** Read the saved tags of `path` through the real observe route, then release that capture. */
+async function savedTags(request, path) {
+    const target = { root_index: 0, root_scope: await scopeOf(request), path };
+    const observed = await (await request.post('/prompt_manager/image-annotations/observe', { data: { target } })).json();
+    expect(observed.success).toBe(true);
+    await request.delete(`/prompt_manager/image-annotations/capture/${observed.capture.token}`);
+    return observed.tags;
+}
+async function scopeOf(request) {
+    const listing = await (await request.get('/prompt_manager/images/output?mode=workspace&limit=40')).json();
+    return listing.images[0].root_scope;
+}
+
+test('tag dialog control inventory and order match M2', async ({ page }) => {
+    await openTag(page);
+    await expect(page.locator('dialog#modal')).toHaveClass(/(^| )tagging-modal( |$)/);
+    await expect(dialog(page).locator('#modal-title')).toHaveText('Tag image');
+    const body = dialog(page).locator('#modal-body');
+    expect(await body.evaluate(node => [...node.children].map(child => child.className))).toEqual(
+        ['tag-image-heading', 'field', 'tag-model-panel', 'tag-suggestion-panel', 'dialog-actions']);
+    const heading = body.locator('.tag-image-heading');
+    await expect(heading.locator('h3')).toHaveText(manifest.title);
+    await expect(heading.locator('p.small')).toHaveText('dunes_00001.png');
+    await expect(heading.locator('span.chip')).toHaveText('96 × 64');
+    await expect(heading.locator('img.tag-image-preview')).toHaveAttribute('alt', manifest.title);
+    await expect(body.locator('.tag-scope-note')).toHaveCount(0);
+    await expect(manual(page)).toHaveAttribute('id', 'manual-image-tags');
+    await expect(manual(page)).toHaveValue('');
+    await expect(manual(page)).toHaveAccessibleDescription('Comma-separated. Generated suggestions are added only after you approve them.');
+    const panel = body.locator('.tag-model-panel');
+    await expect(panel.locator('h3')).toHaveText('Auto-tag this image');
+    await expect(model(page).locator('option')).toHaveText(MODEL_LABELS);
+    expect(await model(page).locator('option').evaluateAll(nodes => nodes.map(node => node.value))).toEqual(['wd14-swinv2', 'wd14-vit', 'gguf', 'hf']);
+    await expect(model(page)).toHaveValue('wd14-swinv2');
+    const options = panel.locator('#image-tag-model-options');
+    const general = options.getByRole('spinbutton', { name: 'General confidence', exact: true });
+    const character = options.getByRole('spinbutton', { name: 'Character confidence', exact: true });
+    const limit = options.getByRole('spinbutton', { name: 'Suggestions', exact: true });
+    await expect(options.locator('.two-col .field')).toHaveCount(2);
+    await expect(general).toHaveValue('0.35');
+    await expect(character).toHaveValue('0.85');
+    await expect(limit).toHaveValue('10');
+    for (const [input, attributes] of [[general, ['0', '1', '0.05']], [character, ['0', '1', '0.05']], [limit, ['1', '100', '1']]]) {
+        expect(await input.evaluate(node => [node.min, node.max, node.step])).toEqual(attributes);
+    }
+    await expect(generate(page)).toHaveClass(/ca-primary/);
+    await expect(generate(page).locator('svg.icon')).toHaveCount(1);
+    const suggestions = body.locator('section.tag-suggestion-panel');
+    await expect(suggestions).toHaveAttribute('aria-labelledby', 'tag-suggestions-title');
+    await expect(suggestions.locator('h3#tag-suggestions-title')).toHaveText('Review suggestions');
+    await expect(suggestions.locator('#suggestion-count')).toHaveText('Not generated');
+    await expect(suggestions.locator('#tag-suggestions > p.small')).toHaveText(MODEL_CHANGED);
+    await expect(status(page)).toHaveAttribute('role', 'status');
+    await expect(status(page)).toHaveText('');
+    await expect(body.locator('.dialog-actions button')).toHaveText(['Cancel', 'Save manual tags']);
+    await expect(body.locator('.dialog-actions button').last()).toHaveClass(/ca-primary/);
+    await model(page).selectOption('gguf');
+    await expect(options.getByRole('textbox', { name: 'Tagging instructions', exact: true })).toHaveValue('Describe the image');
+    await expect(options.getByRole('spinbutton', { name: 'Suggestions', exact: true })).toHaveValue('10');
+    await expect(options.locator('.two-col')).toHaveCount(0);
+});
+
+test('generate shows real fixture percentages for WD14 and Suggested for GGUF, at most ten chips', async ({ page }) => {
+    await openTag(page);
+    const answer = await generated(page);
+    expect(answer.request().postDataJSON()).toMatchObject({ model_type: 'wd14-swinv2', options: { general_threshold: 0.35, character_threshold: 0.85, suggestion_limit: 10 } });
+    await expect(chips(page)).toHaveCount(10);
+    // D83: ruling T4's instruction leads the chips, only while chips exist.
+    await expect(dialog(page).locator('#tag-suggestions > *')).toHaveCount(2);
+    await expect(dialog(page).locator('#tag-suggestions > p.small')).toHaveText(CHIP_HINT);
+    await expect(chips(page).first().locator(':scope > span').first()).toHaveText('sandstone');
+    await expect(chips(page).locator('.tag-confidence').first()).toHaveText('98%');
+    await expect(chips(page).nth(1).locator('.tag-confidence')).toHaveText('97%');
+    await expect(chips(page).first().getByRole('button', { name: 'Remove sandstone', exact: true })).toBeVisible();
+    await expect(dialog(page).locator('#suggestion-count')).toHaveText('10 suggestions');
+    await expect(status(page)).toHaveText('Suggestions from WD14 SwinV2 · ~400 MB. Approve tags to save.');
+    await expect(dialog(page).locator('.dialog-actions .ca-primary')).toHaveText('Approve selected tags');
+    for (const id of ['gguf', 'hf']) {
+        await model(page).selectOption(id);
+        await expect(chips(page)).toHaveCount(0);
+        await generated(page);
+        await expect(chips(page)).toHaveCount(10);
+        await expect(chips(page).locator('.tag-confidence')).toHaveText(Array(10).fill('Suggested'));
+        await expect(status(page)).toHaveText(`Suggestions from ${MODEL_LABELS[id === 'gguf' ? 2 : 3]}. Approve tags to save.`);
+    }
+    await dialog(page).getByRole('spinbutton', { name: 'Suggestions', exact: true }).fill('3');
+    const fewer = await generated(page);
+    expect(fewer.request().postDataJSON().options).toEqual({ instructions: 'Describe the image', suggestion_limit: 3 });
+    await expect(chips(page)).toHaveCount(3);
+    await expect(dialog(page).locator('#suggestion-count')).toHaveText('3 suggestions');
+});
+
+test('removing chips and editing manually then approving persists across reload', async ({ page, request }) => {
+    await openTag(page);
+    await manual(page).fill('Minimal, sky_blue');
+    await dialog(page).getByRole('spinbutton', { name: 'Suggestions', exact: true }).fill('3');
+    await generated(page);
+    await expect(chips(page)).toHaveCount(3);
+    const remove = dialog(page).getByRole('button', { name: 'Remove desert', exact: true });
+    await remove.click();
+    await expect(chips(page)).toHaveCount(2);
+    // Focus moves to the next chip's ×.
+    await expect(dialog(page).getByRole('button', { name: 'Remove arch', exact: true })).toBeFocused();
+    const saved = page.waitForResponse(item => item.url().endsWith('/image-annotations/tags') && item.request().method() === 'PUT');
+    await dialog(page).getByRole('button', { name: 'Approve selected tags', exact: true }).click();
+    expect((await saved).request().postDataJSON().tags).toEqual(['Minimal', 'sky_blue', 'sandstone', 'arch']);
+    await expect(dialog(page)).toHaveCount(0);
+    await expect(toast(page)).toHaveText('4 tags saved for dunes_00001.png.');
+    await expect(tagButton(page, FIRST)).toBeFocused();
+    expect(await savedTags(request, FIRST)).toEqual(['Minimal', 'sky_blue', 'sandstone', 'arch']);
+    await page.reload();
+    await openTag(page, FIRST, { goto: false });
+    await expect(manual(page)).toHaveValue('Minimal, sky_blue, sandstone, arch');
+    // Removing every chip shows the all-removed copy; the manual set still saves.
+    await dialog(page).getByRole('spinbutton', { name: 'Suggestions', exact: true }).fill('2');
+    await generated(page);
+    for (const name of ['sandstone', 'desert']) await dialog(page).getByRole('button', { name: `Remove ${name}`, exact: true }).click();
+    await expect(dialog(page).locator('#tag-suggestions > p.small')).toHaveText(ALL_REMOVED);
+    await expect(generate(page)).toBeFocused();
+    await dialog(page).getByRole('button', { name: 'Approve selected tags', exact: true }).click();
+    await expect(toast(page)).toHaveText('4 tags saved for dunes_00001.png.');
+});
+
+test('cancel escape and close write nothing', async ({ page, request }) => {
+    const writes = [];
+    page.on('request', item => { if (item.url().endsWith('/image-annotations/tags')) writes.push(item.method()); });
+    await page.goto(images);
+    for (const dismiss of [
+        () => dialog(page).getByRole('button', { name: 'Cancel', exact: true }).click(),
+        () => page.keyboard.press('Escape'),
+        () => dialog(page).getByRole('button', { name: 'Close dialog', exact: true }).click(),
+    ]) {
+        const released = page.waitForResponse(item => item.url().includes('/image-annotations/capture/') && item.request().method() === 'DELETE');
+        await openTag(page, FIRST, { goto: false });
+        await manual(page).fill('never_saved');
+        await dismiss();
+        await expect(dialog(page)).toHaveCount(0);
+        expect((await released).ok()).toBe(true);
+        await expect(tagButton(page, FIRST)).toBeFocused();
+        await expect(page.locator('dialog#modal.tagging-modal')).toHaveCount(0);
+    }
+    expect(writes).toEqual([]);
+    expect(await savedTags(request, FIRST)).toEqual([]);
+});
+
+test('model change discards suggestions and relabels primary', async ({ page }) => {
+    await openTag(page);
+    await manual(page).fill('kept');
+    await generated(page);
+    await expect(dialog(page).locator('.dialog-actions .ca-primary')).toHaveText('Approve selected tags');
+    await dialog(page).getByRole('spinbutton', { name: 'General confidence', exact: true }).fill('0.5');
+    await model(page).selectOption('wd14-vit');
+    await expect(chips(page)).toHaveCount(0);
+    await expect(dialog(page).locator('#tag-suggestions > p.small')).toHaveText(MODEL_CHANGED);
+    await expect(dialog(page).locator('#suggestion-count')).toHaveText('Not generated');
+    await expect(status(page)).toHaveText('');
+    await expect(dialog(page).locator('.dialog-actions .ca-primary')).toHaveText('Save manual tags');
+    await expect(manual(page)).toHaveValue('kept');
+    // Like the concept, the new model's fields start from the defaults.
+    await expect(dialog(page).getByRole('spinbutton', { name: 'General confidence', exact: true })).toHaveValue('0.35');
+});
+
+test('invalid threshold reports validity without request', async ({ page }) => {
+    const sent = [];
+    page.on('request', item => { if (item.url().endsWith('/image-annotations/suggest')) sent.push(item.url()); });
+    await openTag(page);
+    const general = dialog(page).getByRole('spinbutton', { name: 'General confidence', exact: true });
+    await general.fill('1.5');
+    await generate(page).click();
+    await expect(general).toBeFocused();
+    expect(await general.evaluate(node => node.validity.rangeOverflow)).toBe(true);
+    await general.fill('');
+    await generate(page).click();
+    await expect.poll(() => general.evaluate(node => node.validationMessage)).toBe('Enter a confidence from 0 to 1.');
+    await general.fill('0.35');
+    expect(await general.evaluate(node => node.validity.valid)).toBe(true);
+    await model(page).selectOption('gguf');
+    const instructions = dialog(page).getByRole('textbox', { name: 'Tagging instructions', exact: true });
+    await instructions.fill('   ');
+    await generate(page).click();
+    await expect.poll(() => instructions.evaluate(node => node.validationMessage)).toBe('Enter tagging instructions of at most 4000 characters.');
+    await expect(status(page)).toHaveText('');
+    expect(sent).toEqual([]);
+});
+
+test('unavailable model shows inline status and never downloads', async ({ page, request }) => {
+    await expect(await request.post('/__test__/tagging/models', { data: { unavailable: ['wd14-swinv2'] } })).toBeOK();
+    await openTag(page);
+    expect((await generated(page)).status()).toBe(409);
+    await expect(status(page)).toHaveText('WD14 SwinV2 is not downloaded. Download it from the legacy Auto-tag page.');
+    await expect(chips(page)).toHaveCount(0);
+    await expect(dialog(page).locator('#suggestion-count')).toHaveText('Not generated');
+    // D116: Retry leads the actions while the controller allows it, and generates again.
+    await expect(dialog(page).locator('.dialog-actions button')).toHaveText(['Retry', 'Cancel', 'Save manual tags']);
+    await expect(await request.post('/__test__/tagging/models', { data: { unavailable: [] } })).toBeOK();
+    const again = page.waitForResponse(item => item.url().endsWith('/image-annotations/suggest'));
+    await dialog(page).getByRole('button', { name: 'Retry', exact: true }).click();
+    expect((await again).status()).toBe(200);
+    await expect(chips(page)).toHaveCount(10);
+    await expect(dialog(page).locator('.dialog-actions button')).toHaveText(['Cancel', 'Approve selected tags']);
+    await expect(dialog(page).locator('.dialog-actions .ca-primary')).toBeFocused();
+});
+
+test('video tag is manual only', async ({ page, request }) => {
+    await openTag(page, VIDEO);
+    const preview = dialog(page).locator('video.tag-image-preview');
+    await expect(preview).toHaveAttribute('preload', 'metadata');
+    expect(await preview.evaluate(node => node.muted)).toBe(true);
+    await expect(dialog(page).locator('.tag-image-heading span.chip')).toHaveCount(0);
+    await expect(generate(page)).toHaveAttribute('aria-disabled', 'true');
+    await expect(status(page)).toHaveText('Auto-tagging is available for supported still images only.');
+    let suggested = false;
+    page.on('request', item => { if (item.url().endsWith('/image-annotations/suggest')) suggested = true; });
+    // Pressing the aria-disabled Generate sends nothing.
+    await generate(page).focus();
+    await page.keyboard.press('Enter');
+    await manual(page).fill('clip_tag');
+    await dialog(page).getByRole('button', { name: 'Save manual tags', exact: true }).click();
+    await expect(toast(page)).toHaveText('1 tags saved for clip.webm.');
+    expect(suggested).toBe(false);
+    expect(await savedTags(request, VIDEO)).toEqual(['clip_tag']);
+});
+
+test('sticky footer reachable at 390x844 while content scrolls', async ({ page }) => {
+    await page.setViewportSize({ width: 390, height: 844 });
+    await openTag(page);
+    await model(page).selectOption('gguf');
+    await generated(page);
+    await expect(chips(page)).toHaveCount(10);
+    const shell = page.locator('dialog#modal');
+    const actions = dialog(page).locator('.dialog-actions');
+    expect(await actions.evaluate(node => getComputedStyle(node).position)).toBe('sticky');
+    expect(await shell.evaluate(node => node.scrollHeight > node.clientHeight)).toBe(true);
+    for (const top of [0, 10_000]) {
+        await shell.evaluate((node, value) => { node.scrollTop = value; }, top);
+        const box = await actions.boundingBox(), frame = await shell.boundingBox();
+        expect(box.y + box.height).toBeLessThanOrEqual(frame.y + frame.height + 1);
+        expect(box.y).toBeGreaterThanOrEqual(frame.y);
+        await expect(dialog(page).getByRole('button', { name: 'Approve selected tags', exact: true })).toBeInViewport();
+    }
+    expect(await page.evaluate(() => document.documentElement.scrollWidth <= innerWidth + 1)).toBe(true);
+});
+
+test('focus starts on close and returns to the Tag trigger', async ({ page }) => {
+    await openTag(page, SECOND);
+    await expect(dialog(page).getByRole('button', { name: 'Close dialog', exact: true })).toBeFocused();
+    await page.keyboard.press('Escape');
+    await expect(dialog(page)).toHaveCount(0);
+    await expect(tagButton(page, SECOND)).toBeFocused();
+});
+
+test('every Images and Library gallery card has Info then Tag with mock labels', async ({ page }) => {
+    const expectCards = async locator => {
+        const labels = await locator.evaluateAll(nodes => nodes.map(node => {
+            const buttons = [...node.querySelectorAll('.media-info > .image-card-actions > button')];
+            return { file: node.querySelector('.image-open').getAttribute('aria-label').replace(/^Open /, ''),
+                buttons: buttons.map(button => [button.className, button.getAttribute('aria-label'), button.querySelector('svg.icon') !== null]) };
+        }));
+        expect(labels.length).toBeGreaterThan(0);
+        for (const { file, buttons } of labels) {
+            expect(buttons).toEqual([['icon-btn', `Inspect ${file}`, true], ['icon-btn', `Tag or auto-tag ${file}`, true]]);
+        }
+        return labels.map(({ file }) => file);
+    };
+    await page.goto(images);
+    await expect(page.locator('article[data-image-key]')).toHaveCount(manifest.files.length);
+    expect(await expectCards(page.locator('article[data-image-key]'))).toEqual(manifest.files.map(file => file.filename));
+    await page.goto(`/prompt_manager/workspace#/library/${manifest.positive_id}`);
+    const gallery = page.locator('.library-history .history-gallery article[data-image-key]');
+    await expect(gallery.first()).toBeVisible();
+    await expectCards(gallery);
+    const observed = page.waitForResponse(item => item.url().endsWith('/image-annotations/observe'));
+    await gallery.first().getByRole('button', { name: /^Tag or auto-tag / }).click();
+    await expect(dialog(page)).toBeVisible();
+    expect((await observed).status()).toBe(200);
+    await dialog(page).getByRole('button', { name: 'Cancel', exact: true }).click();
+    await expect(gallery.first().getByRole('button', { name: /^Tag or auto-tag / })).toBeFocused();
+});
+
+test('Tag opens the dialog without selecting the card', async ({ page }) => {
+    const panel = page.getByRole('complementary', { name: 'Selected image details', exact: true });
+    await page.goto(images);
+    await expect(card(page, FIRST)).toHaveClass(/\bselected\b/);
+    // Capture the panel once it shows the first card's details, not while it is still reading them.
+    await expect(panel.getByRole('heading', { level: 2 })).toBeVisible();
+    await expect(panel).not.toContainText('Loading file details');
+    const before = await panel.innerText();
+    await openTag(page, SECOND, { goto: false });
+    await page.keyboard.press('Escape');
+    await expect(card(page, SECOND)).not.toHaveClass(/\bselected\b/);
+    await expect(card(page, FIRST)).toHaveClass(/\bselected\b/);
+    expect(await panel.innerText()).toBe(before);
+});
+
+test('tagging one of two cards sharing a prompt leaves the other card, the prompt and the pair unchanged', async ({ page, request }) => {
+    const before = await (await request.get('/__test__/tagging/snapshot')).json();
+    expect(await savedTags(request, SECOND)).toEqual([]);
+    expect(await savedTags(request, COPY)).toEqual([]);
+    const pairBefore = await (await request.get(`/prompt_manager/library/${manifest.positive_id}`)).json();
+    await openTag(page, FIRST);
+    await manual(page).fill('only_this_file');
+    await dialog(page).getByRole('button', { name: 'Save manual tags', exact: true }).click();
+    await expect(toast(page)).toHaveText('1 tags saved for dunes_00001.png.');
+    expect(await savedTags(request, FIRST)).toEqual(['only_this_file']);
+    expect(await savedTags(request, SECOND)).toEqual([]);
+    expect(await savedTags(request, COPY)).toEqual([]);
+    expect(await (await request.get('/__test__/tagging/snapshot')).json()).toEqual(before);
+    const pairAfter = await (await request.get(`/prompt_manager/library/${manifest.positive_id}`)).json();
+    expect(pairAfter.success).toBe(true);
+    expect({ ...pairAfter, library_epoch: null }).toEqual({ ...pairBefore, library_epoch: null });
+});
+
+test('Tags page Auto-tag images opens the dialog for the selected image and is disabled without one', async ({ page }) => {
+    await page.goto('/prompt_manager/workspace#/tags');
+    const autoTag = page.locator('#workspace-main .heading-actions').getByRole('button', { name: 'Auto-tag images', exact: true });
+    await expect(page.locator('#workspace-main .heading-actions button')).toHaveText(['+ Create tag', 'Auto-tag images']);
+    await expect(autoTag).toHaveClass(/ca-primary/);
+    await expect(autoTag).toHaveAttribute('aria-disabled', 'true');
+    // An aria-disabled control still takes a press; it only explains.
+    await autoTag.focus();
+    await page.keyboard.press('Enter');
+    await expect(toast(page)).toHaveText('Select an image in Images first.');
+    await expect(dialog(page)).toHaveCount(0);
+    await nav(page, 'Images').click();
+    await card(page, SECOND).getByRole('button', { name: 'Inspect dunes_00002.png', exact: true }).click();
+    await expect(card(page, SECOND)).toHaveClass(/selected/);
+    await nav(page, 'Tags & categories').click();
+    await expect(autoTag).not.toHaveAttribute('aria-disabled', 'true');
+    const observed = page.waitForResponse(item => item.url().endsWith('/image-annotations/observe'));
+    await autoTag.click();
+    expect((await observed).request().postDataJSON().target.path).toBe(SECOND);
+    await expect(dialog(page).locator('.tag-image-heading p.small')).toHaveText('dunes_00002.png');
+    await page.keyboard.press('Escape');
+    await expect(autoTag).toBeFocused();
+});
+
+test('Images column shows image_count and updates after save', async ({ page }) => {
+    await page.goto(images);
+    await card(page, FIRST).getByRole('button', { name: 'Inspect dunes_00001.png', exact: true }).click();
+    await nav(page, 'Tags & categories').click();
+    const row = name => page.locator('#workspace-main table tbody tr').filter({ has: page.locator('td:first-child').getByText(name, { exact: true }) });
+    await expect(row('minimal').locator('td:nth-child(3)')).toHaveText('0');
+    await expect(row('editorial').locator('td:nth-child(3)')).toHaveText('0');
+    await page.locator('#workspace-main .heading-actions').getByRole('button', { name: 'Auto-tag images', exact: true }).click();
+    await expect(manual(page)).toBeVisible();
+    await expect(dialog(page).locator('img.tag-image-preview')).toHaveAttribute('src', /capture/);
+    await manual(page).fill('minimal, editorial');
+    const reread = page.waitForResponse(item => item.url().includes('/prompt_manager/vocabulary/tags'));
+    await dialog(page).getByRole('button', { name: 'Save manual tags', exact: true }).click();
+    await reread;
+    await expect(row('minimal').locator('td:nth-child(3)')).toHaveText('1');
+    await expect(row('editorial').locator('td:nth-child(3)')).toHaveText('1');
+    await expect(row('warm_light').locator('td:nth-child(3)')).toHaveText('0');
+});
+
+test('virtualized cards release listeners on unmount', async ({ page, request }) => {
+    const extra = 140;
+    await expect(await request.post('/__test__/tagging/reset', { data: { extra_images: extra } })).toBeOK();
+    const count = () => page.evaluate(async url => (await import(url)).imageTagsListenerCount(), MODULE);
+    await page.goto(images);
+    await expect(card(page, FIRST)).toBeVisible();
+    const mounted = await count();
+    // Leaving and returning to Images several times keeps one subscription per mounted page.
+    for (let round = 0; round < 3; round += 1) {
+        await nav(page, 'Tags & categories').click();
+        await expect(page.locator('#workspace-main h1')).toHaveText('Tags & categories');
+        await nav(page, 'Images').click();
+        await expect(card(page, FIRST)).toBeVisible();
+    }
+    expect(await count()).toBe(mounted);
+    // Cards scrolled out are unmounted; the delegated Tag still works on a card rendered again.
+    const continuation = page.locator('#gallery-continuation');
+    await expect(async () => {
+        await continuation.scrollIntoViewIfNeeded();
+        await expect(continuation).toContainText('You’re all caught up', { timeout: 1000 });
+    }).toPass();
+    await continuation.scrollIntoViewIfNeeded();
+    await expect(card(page, FIRST)).toHaveCount(0);
+    expect(await count()).toBe(mounted);
+    await page.evaluate(() => window.scrollTo(0, 0));
+    await expect(card(page, FIRST)).toBeVisible();
+    await openTag(page, FIRST, { goto: false });
+    await page.keyboard.press('Escape');
+    await expect(tagButton(page, FIRST)).toBeFocused();
+    expect(await count()).toBe(mounted);
+});
+
+// Task C3 (D88): the side panel and the viewer details draw the file's own current image tags first, then D21's linked
+// tags not already shown (case-insensitive). Panel image tags are Tags filter buttons; the viewer's chips are plain.
+const panel = page => page.getByRole('complementary', { name: 'Selected image details', exact: true });
+const tagRow = page => panel(page).locator('.detail-inner > .tags').last();
+const inspected = (page, path) => page.waitForResponse(item => new URL(item.url()).pathname === `/prompt_manager/images/inspect/${path}`);
+const infoButton = (page, path) => card(page, path).getByRole('button', { name: `Inspect ${path.split('/').pop()}`, exact: true });
+
+test('inspector shows saved image tags after Save without reselecting', async ({ page }) => {
+    await page.goto(images);
+    await expect(card(page, FIRST)).toHaveClass(/\bselected\b/);
+    // D21/D39: the linked recipe's own tag, plain.
+    await expect(tagRow(page).locator('.chip')).toHaveText(manifest.pair_tags);
+    await expect(tagRow(page).locator('button.chip')).toHaveCount(0);
+    await openTag(page, FIRST, { goto: false });
+    await manual(page).fill('dunes_tag, Editorial');
+    const reread = inspected(page, FIRST);
+    await dialog(page).getByRole('button', { name: 'Save manual tags', exact: true }).click();
+    expect((await (await reread).json()).image_tags).toEqual({ state: 'current', tags: ['dunes_tag', 'Editorial'] });
+    // The image tags lead as filter buttons; the recipe's "editorial" is already shown as "Editorial".
+    await expect(tagRow(page).locator('.chip')).toHaveText(['dunes_tag', 'Editorial']);
+    await expect(tagRow(page).locator('button.chip')).toHaveText(['dunes_tag', 'Editorial']);
+    await expect(card(page, FIRST)).toHaveClass(/\bselected\b/);
+    await expect(panel(page).locator('.panel-heading h2')).toHaveText(manifest.title);
+});
+
+test('clicking an image tag chip filters Images to the tagged unlinked file', async ({ page, request }) => {
+    expect(await saveImageTags(request, UNLINKED, ['loose_tag'])).toEqual(['loose_tag']);
+    await page.goto(images);
+    const read = inspected(page, UNLINKED);
+    await infoButton(page, UNLINKED).click();
+    await read;
+    await expect(panel(page).locator('.panel-heading h2')).toHaveText('unlinked.png');
+    await expect(tagRow(page).locator('.chip')).toHaveText(['loose_tag']);
+    const listing = page.waitForRequest(item => item.url().includes('/images/output?') && new URL(item.url()).searchParams.get('tags') === 'loose_tag');
+    await tagRow(page).getByRole('button', { name: 'loose_tag', exact: true }).click();
+    await listing;
+    await expect(page.locator('.gallery-body article[data-image-key]')).toHaveCount(1);
+    await expect(card(page, UNLINKED)).toBeVisible();
+    await expect(page.getByRole('button', { name: 'Filters · 1', exact: true })).toBeVisible();
+});
+
+test('viewer details show the same chips', async ({ page, request }) => {
+    await saveImageTags(request, FIRST, ['dunes_tag', 'Editorial', 'sunlit']);
+    await page.goto(images);
+    await expect(tagRow(page).locator('button.chip')).toHaveText(['dunes_tag', 'Editorial', 'sunlit']);
+    await card(page, FIRST).locator('.image-open').click();
+    const details = page.locator('#viewer-dialog[open] #viewer-details');
+    await expect(details.locator('.panel-heading h2')).toHaveText(manifest.title);
+    const row = details.locator('.tags').last();
+    await expect(row.locator('.chip')).toHaveText(['dunes_tag', 'Editorial', 'sunlit']);
+    await expect(row.locator('span.chip')).toHaveCount(3);
+    await expect(row.locator('button')).toHaveCount(0);
+    // A file without image tags: the viewer shows only D21's linked tags.
+    await page.getByRole('button', { name: 'Next media', exact: true }).click();
+    await expect(page.locator('#viewer-dialog[open] #viewer-title')).toHaveText(`${manifest.title} · dunes_00002.png`);
+    await expect(details.locator('.tags').last().locator('.chip')).toHaveText(manifest.pair_tags);
+});
+
+test('search finds an image by its image tag', async ({ page, request }) => {
+    await saveImageTags(request, UNLINKED, ['Loose_Tag']);
+    await page.goto(images);
+    await expect(page.locator('.gallery-body article[data-image-key]')).toHaveCount(manifest.files.length);
+    const listing = page.waitForRequest(item => item.url().includes('/images/output?') && new URL(item.url()).searchParams.get('q') === 'loose_t');
+    await page.getByRole('searchbox', { name: 'Search workspace', exact: true }).fill('loose_t');
+    await listing;
+    await expect(page.locator('.gallery-body article[data-image-key]')).toHaveCount(1);
+    await expect(card(page, UNLINKED)).toBeVisible();
+});
+
+// Task C4 rulings: a save re-reads the selected file's details without a loading flash, and under a Tags filter or a
+// search the loaded listing is re-read in place (scroll and selection kept while the file still matches).
+const cards = page => page.locator('.gallery-body article[data-image-key]');
+const listingOf = (page, check) => page.waitForResponse(item => item.url().includes('/images/output?') && check(new URL(item.url()).searchParams));
+
+test('the post-save re-read keeps the panel content until the new read lands', async ({ page }) => {
+    await page.goto(images);
+    await expect(card(page, FIRST)).toHaveClass(/\bselected\b/);
+    await expect(tagRow(page).locator('.chip')).toHaveText(manifest.pair_tags);
+    await page.evaluate(() => {
+        const node = document.querySelector('aside[aria-label="Selected image details"]');
+        window.__loadingSeen = false;
+        window.__loadingWatch = new MutationObserver(() => { if (node.textContent.includes('Loading file details')) window.__loadingSeen = true; });
+        window.__loadingWatch.observe(node, { childList: true, subtree: true, characterData: true });
+    });
+    let release;
+    const held = new Promise(resolve => { release = resolve; });
+    const matcher = url => url.pathname === `/prompt_manager/images/inspect/${FIRST}`;
+    await page.route(matcher, async route => { await held; await route.continue(); });
+    await openTag(page, FIRST, { goto: false });
+    await manual(page).fill('held_tag');
+    const reread = page.waitForRequest(item => new URL(item.url()).pathname === `/prompt_manager/images/inspect/${FIRST}`);
+    await dialog(page).getByRole('button', { name: 'Save manual tags', exact: true }).click();
+    await reread;
+    await expect(toast(page)).toHaveText('1 tags saved for dunes_00001.png.');
+    // While the re-read is held, the panel still shows the file's details.
+    await expect(panel(page).locator('.panel-heading h2')).toHaveText(manifest.title);
+    await expect(tagRow(page).locator('.chip')).toHaveText(manifest.pair_tags);
+    expect(await page.evaluate(() => window.__loadingSeen)).toBe(false);
+    const landed = inspected(page, FIRST);
+    release();
+    await landed;
+    await expect(tagRow(page).locator('.chip')).toHaveText(['held_tag', ...manifest.pair_tags]);
+    expect(await page.evaluate(() => { window.__loadingWatch.disconnect(); return window.__loadingSeen; })).toBe(false);
+    await page.unroute(matcher);
+});
+
+test('a save under a Tags filter re-reads the listing: the selection stays while it matches and follows when it leaves', async ({ page, request }) => {
+    await saveImageTags(request, UNLINKED, ['shared']);
+    await saveImageTags(request, SECOND, ['shared']);
+    await page.goto(images);
+    const read = inspected(page, SECOND);
+    await infoButton(page, SECOND).click();
+    await read;
+    const filtered = listingOf(page, query => query.get('tags') === 'shared');
+    await tagRow(page).getByRole('button', { name: 'shared', exact: true }).click();
+    await filtered;
+    await expect(cards(page)).toHaveCount(2);
+    // The newest match (SECOND) is selected once the filter applies.
+    await expect(card(page, SECOND)).toHaveClass(/\bselected\b/);
+    // Both matches checked: the selection bar keeps only what the refreshed result still lists (I7).
+    for (const path of [SECOND, UNLINKED]) await card(page, path).getByRole('checkbox', { name: `Select ${path.split('/').pop()}`, exact: true }).check();
+    const bulkbar = page.locator('#bulkbar .bulkbar');
+    await expect(bulkbar.locator('strong')).toHaveText('2 selected');
+    // Tagging the other match keeps both cards and SECOND selected; the listing is re-read.
+    await openTag(page, UNLINKED, { goto: false });
+    await manual(page).fill('shared, extra');
+    let reread = listingOf(page, query => query.get('tags') === 'shared' && !query.has('cursor'));
+    await dialog(page).getByRole('button', { name: 'Save manual tags', exact: true }).click();
+    await reread;
+    await expect(cards(page)).toHaveCount(2);
+    await expect(card(page, SECOND)).toHaveClass(/\bselected\b/);
+    await expect(tagButton(page, UNLINKED)).toBeFocused();
+    // SECOND loses the filter tag: it leaves the result and the panel follows the remaining match.
+    await openTag(page, SECOND, { goto: false });
+    await manual(page).fill('');
+    reread = listingOf(page, query => query.get('tags') === 'shared' && !query.has('cursor'));
+    const next = inspected(page, UNLINKED);
+    await dialog(page).getByRole('button', { name: 'Save manual tags', exact: true }).click();
+    await reread;
+    await next;
+    await expect(cards(page)).toHaveCount(1);
+    await expect(card(page, SECOND)).toHaveCount(0);
+    await expect(card(page, UNLINKED)).toHaveClass(/\bselected\b/);
+    await expect(panel(page).locator('.panel-heading h2')).toHaveText('unlinked.png');
+    await expect(page.getByText('1 of 1 image', { exact: false }).first()).toBeVisible();
+    await expect(bulkbar.locator('strong')).toHaveText('1 selected');
+    await expect(card(page, UNLINKED).getByRole('checkbox')).toBeChecked();
+    // Export metadata acts on exactly the one file the bar counts.
+    const exported = [];
+    page.on('request', item => { if (item.url().includes('/prompt_manager/images/inspect/')) exported.push(new URL(item.url()).pathname); });
+    const download = page.waitForEvent('download');
+    await bulkbar.getByRole('button', { name: 'Export metadata', exact: true }).click();
+    await download;
+    expect(exported).toEqual([`/prompt_manager/images/inspect/${UNLINKED}`]);
+});
+
+test('a save under a search keeps the scroll position and the loaded range', async ({ page, request }) => {
+    await expect(await request.post('/__test__/tagging/reset', { data: { extra_images: 140 } })).toBeOK();
+    await page.goto(images);
+    const searched = listingOf(page, query => query.get('q') === 'bulk');
+    await page.getByRole('searchbox', { name: 'Search workspace', exact: true }).fill('bulk');
+    await searched;
+    const continuation = page.locator('#gallery-continuation');
+    // Load at least two pages (the search lists 40 a page), then rest a third of the way down.
+    const loadedCount = async () => {
+        const text = await continuation.textContent();
+        return /caught up/.test(text) ? 140 : Number(/^(\d+) of 140/.exec(text)?.[1] ?? 0);
+    };
+    await expect.poll(async () => { await continuation.scrollIntoViewIfNeeded(); return loadedCount(); }).toBeGreaterThanOrEqual(80);
+    await page.evaluate(() => window.scrollTo(0, Math.round(document.documentElement.scrollHeight / 3)));
+    await expect(continuation).not.toBeInViewport();
+    const loaded = await continuation.textContent();
+    await expect.poll(() => continuation.textContent()).toBe(loaded);
+    const y = await page.evaluate(() => window.scrollY);
+    expect(y).toBeGreaterThan(0);
+    const visible = await cards(page).evaluateAll(nodes => nodes.find(node => { const box = node.getBoundingClientRect(); return box.top > 80 && box.bottom < innerHeight; })?.dataset.imageKey);
+    expect(visible).toBeTruthy();
+    const path = visible.slice(2);
+    await openTag(page, path, { goto: false });
+    await manual(page).fill('kept_in_place');
+    const reread = listingOf(page, query => query.get('q') === 'bulk' && !query.has('cursor'));
+    await dialog(page).getByRole('button', { name: 'Save manual tags', exact: true }).click();
+    await reread;
+    await expect(tagButton(page, path)).toBeFocused();
+    await expect(continuation).toHaveText(loaded);
+    expect(Math.abs(await page.evaluate(() => window.scrollY) - y)).toBeLessThanOrEqual(1);
+});
+
+// Final review round (I1, I2, I9, M5, M6).
+test('the option fields show the server defaults that Generate sends (I1)', async ({ page, request }) => {
+    await expect(await request.post('/__test__/tagging/defaults', { data: { general: 0.5, character: 0.9, limit: 7 } })).toBeOK();
+    await openTag(page);
+    const field = name => dialog(page).getByRole('spinbutton', { name, exact: true });
+    await expect(field('General confidence')).toHaveValue('0.5');
+    await expect(field('Character confidence')).toHaveValue('0.9');
+    await expect(field('Suggestions')).toHaveValue('7');
+    const answer = await generated(page);
+    expect(answer.request().postDataJSON().options).toEqual({ general_threshold: 0.5, character_threshold: 0.9, suggestion_limit: 7 });
+    await expect(chips(page)).toHaveCount(7);
+    // A model change re-renders the new model's fields from the server defaults, and keeps the count (D91).
+    await field('Suggestions').fill('4');
+    await model(page).selectOption('wd14-vit');
+    await expect(field('General confidence')).toHaveValue('0.5');
+    await expect(field('Suggestions')).toHaveValue('4');
+});
+
+test('a tag conflict shows the other writer\'s tags before Save, and a second Save keeps them (I2)', async ({ page, request }) => {
+    await openTag(page);
+    await manual(page).fill('mine');
+    // Another writer (a second tab, the legacy page) saves while the dialog is open.
+    expect(await saveImageTags(request, FIRST, ['changed_elsewhere'])).toEqual(['changed_elsewhere']);
+    const conflict = page.waitForResponse(item => item.url().endsWith('/image-annotations/tags') && item.request().method() === 'PUT');
+    await dialog(page).getByRole('button', { name: 'Save manual tags', exact: true }).click();
+    expect((await conflict).status()).toBe(409);
+    await expect(status(page)).toContainText('Saved now: changed_elsewhere.');
+    await expect(manual(page)).toHaveValue('changed_elsewhere, mine');
+    await expect(dialog(page)).toBeVisible();
+    const second = page.waitForResponse(item => item.url().endsWith('/image-annotations/tags') && item.request().method() === 'PUT');
+    await dialog(page).getByRole('button', { name: 'Save manual tags', exact: true }).click();
+    expect((await second).request().postDataJSON().tags).toEqual(['changed_elsewhere', 'mine']);
+    await expect(toast(page)).toHaveText('2 tags saved for dunes_00001.png.');
+    expect(await savedTags(request, FIRST)).toEqual(['changed_elsewhere', 'mine']);
+});
+
+test('D116: Retry leads the actions after an unconfirmed save and resends the same tags', async ({ page, request }) => {
+    await openTag(page);
+    await manual(page).fill('retried');
+    let lost = true;
+    await page.route('**/prompt_manager/image-annotations/tags', route => (lost ? (lost = false, route.fulfill({ status: 504, body: 'Gateway Timeout' })) : route.continue()));
+    await dialog(page).getByRole('button', { name: 'Save manual tags', exact: true }).click();
+    await expect(status(page)).toHaveText('The save could not be confirmed. Retry sends the same tags again.');
+    const inventory = await page.locator('dialog#modal').evaluate(taggingInventory);
+    expect(inventory.actions.buttons.map(button => [button.text, button.primary, button.disabled])).toEqual(
+        [['Retry', false, false], ['Cancel', false, false], ['Save manual tags', true, true]]);
+    expect(inventory.actions.buttons[0].minHeight).toBe(inventory.actions.buttons[1].minHeight);
+    const resent = page.waitForResponse(item => item.url().endsWith('/image-annotations/tags') && item.request().method() === 'PUT');
+    await dialog(page).getByRole('button', { name: 'Retry', exact: true }).click();
+    expect((await resent).request().postDataJSON().tags).toEqual(['retried']);
+    await expect(toast(page)).toHaveText('1 tags saved for dunes_00001.png.');
+    expect(await savedTags(request, FIRST)).toEqual(['retried']);
+    await page.unroute('**/prompt_manager/image-annotations/tags');
+});
+
+test('D116: Retry after an expired capture observes again and keeps the typed draft (M5)', async ({ page, request }) => {
+    await openTag(page);
+    await manual(page).fill('kept_draft');
+    // The store forgets every capture (as its idle sweep would), so Save answers capture-expired.
+    await expect(await request.post('/__test__/tagging/suggestions', { data: { scored: null } })).toBeOK();
+    await dialog(page).getByRole('button', { name: 'Save manual tags', exact: true }).click();
+    await expect(dialog(page).locator('.dialog-actions .ca-primary')).toHaveAttribute('aria-disabled', 'true');
+    const observed = page.waitForResponse(item => item.url().endsWith('/image-annotations/observe'));
+    await dialog(page).getByRole('button', { name: 'Retry', exact: true }).click();
+    expect((await observed).status()).toBe(200);
+    await expect(dialog(page).locator('.dialog-actions button')).toHaveText(['Cancel', 'Save manual tags']);
+    await expect(manual(page)).toHaveValue('kept_draft');
+    await dialog(page).getByRole('button', { name: 'Save manual tags', exact: true }).click();
+    await expect(toast(page)).toHaveText('1 tags saved for dunes_00001.png.');
+    expect(await savedTags(request, FIRST)).toEqual(['kept_draft']);
+});
+
+test('a tag save from Tags reloads a filtered Images visit instead of restoring it (M6)', async ({ page, request }) => {
+    await saveImageTags(request, SECOND, ['shared']);
+    await saveImageTags(request, UNLINKED, ['shared']);
+    await page.goto(images);
+    await infoButton(page, SECOND).click();
+    const filtered = listingOf(page, query => query.get('tags') === 'shared');
+    await tagRow(page).getByRole('button', { name: 'shared', exact: true }).click();
+    await filtered;
+    await expect(cards(page)).toHaveCount(2);
+    await expect(card(page, SECOND)).toHaveClass(/\bselected\b/);
+    // Tags › Auto-tag images tags the selected SECOND without the filter tag.
+    await nav(page, 'Tags & categories').click();
+    await page.locator('#workspace-main .heading-actions').getByRole('button', { name: 'Auto-tag images', exact: true }).click();
+    await expect(manual(page)).toHaveValue('shared');
+    await manual(page).fill('other');
+    await dialog(page).getByRole('button', { name: 'Save manual tags', exact: true }).click();
+    await expect(toast(page)).toHaveText('1 tags saved for dunes_00002.png.');
+    const reloaded = listingOf(page, query => query.get('tags') === 'shared' && !query.has('cursor'));
+    await nav(page, 'Images').click();
+    await reloaded;
+    await expect(cards(page)).toHaveCount(1);
+    await expect(card(page, UNLINKED)).toBeVisible();
+    await expect(page.getByRole('button', { name: 'Filters · 1', exact: true })).toBeVisible();
+});
+
+test('a failed listing re-read after a save says so and keeps the cards (M2)', async ({ page, request }) => {
+    await saveImageTags(request, SECOND, ['shared']);
+    await saveImageTags(request, UNLINKED, ['shared']);
+    await page.goto(images);
+    await infoButton(page, SECOND).click();
+    const filtered = listingOf(page, query => query.get('tags') === 'shared');
+    await tagRow(page).getByRole('button', { name: 'shared', exact: true }).click();
+    await filtered;
+    await expect(cards(page)).toHaveCount(2);
+    await openTag(page, SECOND, { goto: false });
+    await manual(page).fill('');
+    const failing = url => url.pathname === '/prompt_manager/images/output' && url.searchParams.get('tags') === 'shared';
+    await page.route(failing, route => route.fulfill({ status: 500, contentType: 'application/json', body: '{"success":false,"error":"down"}' }));
+    const reread = page.waitForResponse(item => failing(new URL(item.url())));
+    await dialog(page).getByRole('button', { name: 'Save manual tags', exact: true }).click();
+    expect((await reread).status()).toBe(500);
+    await expect(toast(page)).toHaveText('Images could not be refreshed after the tag save. Refresh image collection to retry.');
+    await expect(cards(page)).toHaveCount(2);
+    await expect(page.locator('#gallery-continuation [aria-disabled="true"]')).toHaveCount(0);
+    await page.unroute(failing);
+});

tests/browser/workspace-visual.spec.mjs

@@ -107,7 +107,7 @@ for (const [width, height] of [[1600, 1100], [390, 844]]) for (const theme of ['
         await expect(roles.getByRole('button', { name: 'Send prompt pair', exact: true })).toHaveCount(0);
         await expect(page.locator('#workspace-main > .heading button.send')).toBeEnabled();
         await expect(page.locator('.library-history .history-gallery article[data-image-key]')).toHaveCount(2);
-        await page.locator('.library-history .history-gallery .image-card-actions button').first().click();
+        await page.locator('.library-history .history-gallery .image-card-actions button:first-child').first().click();
         await expect(page.getByRole('complementary', { name: 'Selected image details', exact: true })).toContainText('canonical-alt.png');
         await page.locator('.library-history .history-gallery .media-card.selected .image-open').click();
         await expect(page.locator('dialog#viewer-dialog')).toBeVisible();await page.keyboard.press('Escape');
@@ -296,7 +296,7 @@ async function containedImageContent(page) {
         const failures = [];
         for (const card of nodes) {
             const outer = card.getBoundingClientRect();
-            for (const selector of ['.media-info', '.media-info h3', '.media-info p', '.image-card-actions button']) {
+            for (const selector of ['.media-info', '.media-info h3', '.media-info p', '.image-card-actions']) {
                 const node = card.querySelector(selector), box = node.getBoundingClientRect();
                 if (box.width <= 0 || box.height <= 0 || box.left < outer.left - 1 || box.right > outer.right + 1 ||
                     box.top < outer.top - 1 || box.bottom > outer.bottom + 1 ||
@@ -306,7 +306,7 @@ async function containedImageContent(page) {
                         content: { left: box.left, right: box.right, top: box.top, bottom: box.bottom } });
                 }
             }
-            const action = card.querySelector('.image-card-actions button').getBoundingClientRect();
+            const action = card.querySelector('.image-card-actions').getBoundingClientRect();
             const range = document.createRange(); range.selectNodeContents(card.querySelector('.media-info p'));
             for (const text of range.getClientRects()) {
                 if (Math.min(text.right, action.right) - Math.max(text.left, action.left) > .5 &&
@@ -351,7 +351,7 @@ for (const [width, height] of [[390, 844], [1600, 1100]]) for (const layout of [
             const filename = (await longCard.locator('.image-open').getAttribute('aria-label')).replace(/^Open /, '');
             expect(filename).toMatch(/layered-context-.*\.png/);
             // D19: Info selects into the panel; the image itself opens the viewer.
-            await longCard.locator('.image-card-actions button').focus(); await page.keyboard.press('Enter');
+            await longCard.locator('.image-card-actions button:first-child').focus(); await page.keyboard.press('Enter');
             await expect(page.locator('.detail-panel .panel-heading h2')).toHaveText(filename);
             // D19: the card image, not the panel, opens the viewer.
             const fullPreview = longCard.locator('.image-open');
@@ -420,7 +420,7 @@ test('supplemental extreme zoom grows real footers preserves the visible anchor
     await page.evaluate(() => { document.documentElement.style.zoom = '2'; });
     await expect.poll(() => cards.nth(1).evaluate(node => node.offsetLeft)).toBe(0);
     const selected = cards.nth(16), key = await selected.getAttribute('data-image-key');
-    await selected.locator('.image-card-actions button').click(); await selected.locator('.image-open').focus();
+    await selected.locator('.image-card-actions button:first-child').click(); await selected.locator('.image-open').focus();
     const filename = (await selected.locator('.image-open').getAttribute('aria-label')).replace(/^Open /, '');
     await selected.evaluate(node => scrollBy(0, node.getBoundingClientRect().top - 120));
     await page.evaluate(() => {
@@ -497,7 +497,7 @@ test('supplemental wrapped real footer reservation survives append without movin
     await page.setViewportSize({ width: 390, height: 844 }); await page.goto(`${workspace}#/images`);
     const cards = page.locator('article[data-image-key]'), grid = page.locator('.image-grid');
     await expect(cards).toHaveCount(40);
-    await cards.first().locator('.image-card-actions button').click();
+    await cards.first().locator('.image-card-actions button:first-child').click();
     const selectedKey = await cards.first().getAttribute('data-image-key');
     await page.evaluate(() => { document.documentElement.style.zoom = '4'; });
     await expect.poll(() => grid.evaluate(node => Number.parseFloat(node.style.getPropertyValue('--image-footer-height')))).toBeGreaterThan(54);
@@ -609,7 +609,7 @@ test('Images visual layouts retain real delayed media long filenames and loaded
         await page.setViewportSize({width,height});
         for (const theme of ['dark','light']) {
             await page.getByRole('combobox',{name:'Theme',exact:true}).selectOption(theme);
-            await page.locator('.media-card .image-card-actions button').first().click();
+            await page.locator('.media-card .image-card-actions button:first-child').first().click();
             await expect(page.locator('.detail-panel .panel-heading h2')).toHaveText('study-01.png');
             for (const layout of ['Grid','List','Masonry']) {
                 await page.getByRole('button',{name:layout,exact:true}).click();await page.evaluate(()=>scrollTo(0,0));
@@ -621,7 +621,7 @@ test('Images visual layouts retain real delayed media long filenames and loaded
             const longCard=page.locator('article[data-image-key]').filter({has:page.locator('[aria-label^="Open a-very-long-geometric-composition-"]')});
             const longName=(await longCard.locator('.image-open').getAttribute('aria-label')).replace(/^Open /,'');
             expect(longName).toMatch(/layered-context-.*\.png/);
-            await longCard.locator('.image-card-actions button').click();
+            await longCard.locator('.image-card-actions button:first-child').click();
             await expect(page.locator('.detail-panel .panel-heading h2')).toHaveText(longName);
             await orderedMedia(page);
             await attachEvidence(page,testInfo,`after-images-loaded-scroll-${width}-${theme}`,false);

tests/browser/workspace-vocabulary.spec.mjs

@@ -50,9 +50,12 @@ test('tags route renders the concept composition without a legacy handoff',async
     await expect(main(page).getByRole('heading',{level:1})).toHaveText('Tags & categories');
     await expect(main(page).locator(':scope > .heading p.muted')).toHaveText('Organize once. Reuse everywhere.');
     const actions=main(page).locator(':scope > .heading > .heading-actions button');
-    await expect(actions).toHaveText(['+ Create tag']);
+    // The concept's heading actions (#249 C2 retired #245 D2): Auto-tag images is primary; with no image selected in
+    // Images it is aria-disabled (D115).
+    await expect(actions).toHaveText(['+ Create tag','Auto-tag images']);
     await expect(actions.first()).not.toHaveClass(/ca-primary/);
-    await expect(main(page).getByRole('button',{name:'Auto-tag images'})).toHaveCount(0);
+    await expect(actions.last()).toHaveClass(/ca-primary/);
+    await expect(actions.last()).toHaveAttribute('aria-disabled','true');
     await expect(surfaces(page)).toHaveCount(2);
     await expect(surfaces(page).locator('h2')).toHaveText(['Tag vocabulary','Categories']);
     await expect(surfaces(page).locator(':scope > p:visible')).toHaveText(['Category/tag autocomplete uses this same vocabulary across nodes and dialogs.',
@@ -65,9 +68,9 @@ test('tags route renders the concept composition without a legacy handoff',async
     expect(manifest.tags).toEqual(expected.map(([name])=>name));
     await expect(rows(page).locator('td:nth-child(1)')).toHaveText(expected.map(([name])=>name));
     await expect(rows(page).locator('td:nth-child(2)')).toHaveText(expected.map(([,count])=>String(count)));
-    const images=await rows(page).locator('td:nth-child(3)').evaluateAll(cells=>cells.map(cell=>[cell.querySelector('[aria-hidden="true"]')?.textContent,cell.querySelector('.ca-visually-hidden')?.textContent]));
-    expect(images).toEqual(expected.map(()=>['—','Not available yet']));
-    await expect(rows(page).first().locator('td:nth-child(3)')).toHaveAccessibleName('Not available yet');
+    // Images counts the files carrying each tag (#249 C2 retired #245 D3); this fixture tags no image.
+    await expect(rows(page).locator('td:nth-child(3)')).toHaveText(expected.map(()=>'0'));
+    await expect(rows(page).locator('td:nth-child(3) .ca-visually-hidden')).toHaveCount(0);
     const labels=await rows(page).evaluateAll(nodes=>nodes.map(row=>[...row.querySelectorAll('td:nth-child(4) .row-actions button')].map(button=>button.textContent)));
     expect(labels).toEqual(expected.map(()=>['Browse','Rename / merge']));
     const operations=surfaces(page).nth(1).locator('.operation');

tests/browser/workspace.spec.mjs

@@ -16,7 +16,8 @@ const routes = [
     // #249 E3: the shelf no longer links the legacy Library; Overview's tool card still does.
     ['library', 'Prompt library', null],
     ['tags', 'Tags & categories', null],
-    ['inspect', 'Inspect a file', '/prompt_manager/gallery.html'],
+    // #249 local Inspect: the native Inspect a file page; Overview's tool card still links the legacy metadata page.
+    ['inspect', 'Inspect a file', null],
     ['system', 'System', '/prompt_manager/admin'],
     // #249 D51: SAVED VIEWS' Favorites, Images filtered to favorites.
     ['favorites', 'Favorites', null],
@@ -80,7 +81,8 @@ test('all shell destinations deep-link, reload and expose working existing appli
         const main = page.locator('#workspace-main');
         await expect(main.getByRole('heading', { level: 1, name: label, exact: true })).toBeVisible();
         await expect(sidebarLink(page, label)).toHaveAttribute('aria-current', 'page');
-        if (route === 'tags') await expect(main.locator('.handoff')).toHaveCount(0);
+        if (route === 'tags' || route === 'inspect') await expect(main.locator('.handoff')).toHaveCount(0);
+        if (route === 'inspect') await expect(main.locator('#local-file')).toBeAttached();
         if (legacy) {
             await expect(main.locator(`a[href="${legacy}"]`)).toBeVisible();
             await expect(await request.get(legacy.split('#')[0])).toBeOK();
@@ -93,6 +95,10 @@ test('all shell destinations deep-link, reload and expose working existing appli
     const library = page.locator('#workspace-main').getByRole('link', { name: 'Open existing prompt library', exact: true });
     await expect(library).toHaveAttribute('href', '/prompt_manager/admin');
     await expect(await request.get('/prompt_manager/admin')).toBeOK();
+    // The legacy metadata page stays reachable from Overview beside the native Inspect page.
+    const metadata = page.locator('#workspace-main').getByRole('link', { name: 'Open existing metadata inspector', exact: true });
+    await expect(metadata).toHaveAttribute('href', '/prompt_manager/gallery.html');
+    await expect(await request.get('/prompt_manager/gallery.html')).toBeOK();
     const gallery = page.locator('#workspace-main').getByRole('link', { name: 'Open existing image gallery', exact: true });
     await expect(gallery).toHaveAttribute('href', '/prompt_manager/gallery');
     await expect(await request.get('/prompt_manager/gallery')).toBeOK();

tests/browser/workspace_activity_fixture.py

@@ -4,7 +4,9 @@ A fake job is a real registry job whose runner waits for commands instead of
 reading files, so a test sets its progress and counters exactly:
 
 - ``POST /__test__/jobs/start`` starts one (``kind``, ``title``, ``total``,
-  ``output_folders``) and returns its summary, or 409 while one runs;
+  ``output_folders``; for ``kind: "image-tags"`` the image tagging job's
+  groups and its ``{mode, images}`` scope instead) and returns its summary,
+  or 409 while one runs;
 - ``POST /__test__/jobs/{id}/step`` records ``records`` (``{group, path,
   root, root_index, detail}`` file outcomes, counted, listed and logged as the scan
   records them) and ``bulk`` (``{group, count, root}``: ``count`` numbered
@@ -12,6 +14,9 @@ reading files, so a test sets its progress and counters exactly:
   the progress to every subscriber;
 - ``POST /__test__/jobs/{id}/finish`` ends it as ``finished``, ``cancelled``
   or ``failed``; a cancel through the real route ends it ``cancelled``;
+- ``POST /__test__/jobs/hold`` opens a legacy-page hold (``kind``, ``title``):
+  a running, non-cancellable ``records`` job, as a legacy restore or
+  maintenance request takes, until ``finish`` ends it;
 - ``POST /__test__/jobs/restart`` acts out a ComfyUI restart: the open job
   streams drop without a final event and the registry starts empty.
 """
@@ -28,6 +33,8 @@ POLL_SECONDS = 0.02
 
 PREFIXES = {"added": "+", "known": "=", "review": "?", "errors": "!"}
 PREFIXES["no_metadata"] = "-"
+# The image tagging job's groups (#249 PR D), logged with the runner's prefixes.
+PREFIXES.update({"tagged": "+", "unchanged": "=", "skipped": "-"})
 ROOT_INDEXES = {"output": 0, "input": 1}
 
 
@@ -72,10 +79,17 @@ def outcome_records(data):
 
 
 def register_activity_commands(app, routes, api):
-    from py.api.jobs import SCAN_GROUP_NAMES, JobBusy, JobRegistry
+    from py.api.jobs import (
+        IMAGE_TAG_GROUP_NAMES,
+        IMAGE_TAG_JOB_KIND,
+        SCAN_GROUP_NAMES,
+        JobBusy,
+        JobRegistry,
+    )
 
     streams = set()
     endings = {}
+    holders = set()
 
     @web.middleware
     async def track_streams(request, handler):
@@ -123,17 +137,29 @@ def register_activity_commands(app, routes, api):
     async def start_job(request):
         data = await body(request)
         ending = asyncio.get_running_loop().create_future()
+        kind = str(data.get("kind", "scan"))
+        if kind == IMAGE_TAG_JOB_KIND:
+            title = "Add tags to images"
+            scope = {
+                "mode": str(data.get("mode", "add")),
+                "images": count(data.get("images"), 0),
+            }
+            groups = IMAGE_TAG_GROUP_NAMES
+        else:
+            title = "Scan for metadata"
+            scope = {
+                "files": str(data.get("files", "new")),
+                "output_folders": count(data.get("output_folders"), 2),
+            }
+            groups = SCAN_GROUP_NAMES
         try:
             job = api._jobs.start(
-                str(data.get("kind", "scan")),
-                str(data.get("title", "Scan for metadata")),
+                kind,
+                str(data.get("title", title)),
                 record_changing=True,
-                scope={
-                    "files": str(data.get("files", "new")),
-                    "output_folders": count(data.get("output_folders"), 2),
-                },
+                scope=scope,
                 runner=fake_runner(ending),
-                groups=SCAN_GROUP_NAMES,
+                groups=groups,
             )
         except JobBusy:
             raise web.HTTPConflict()
@@ -141,6 +167,36 @@ def register_activity_commands(app, routes, api):
         endings[job.id] = ending
         return web.json_response({"success": True, "job": job.summary()})
 
+    @routes.post("/__test__/jobs/hold")
+    async def hold_job(request):
+        data = await body(request)
+        loop = asyncio.get_running_loop()
+        ending = loop.create_future()
+        entered = loop.create_future()
+
+        async def hold():
+            async with api._jobs.hold(
+                str(data.get("kind", "restore")),
+                str(data.get("title", "Database restore (admin page)")),
+                admission="records",
+            ) as job:
+                entered.set_result(job)
+                state = await ending
+                if state != "finished":
+                    job.finish(state)
+
+        holder = asyncio.ensure_future(hold())
+        holders.add(holder)
+        holder.add_done_callback(holders.discard)
+        await asyncio.wait({entered, holder}, return_when=asyncio.FIRST_COMPLETED)
+        if not entered.done():
+            if isinstance(holder.exception(), JobBusy):
+                raise web.HTTPConflict()
+            raise holder.exception()
+        job = entered.result()
+        endings[job.id] = ending
+        return web.json_response({"success": True, "job": job.summary()})
+
     @routes.post("/__test__/jobs/{job_id}/step")
     async def step_job(request):
         job = job_or_404(request)
@@ -188,6 +244,7 @@ def register_activity_commands(app, routes, api):
         for transport in list(streams):
             transport.close()
         tasks = [job.task for job in old.list() if job.task and not job.task.done()]
+        tasks += [holder for holder in holders if not holder.done()]
         for task in tasks:
             task.cancel()
         await asyncio.gather(*tasks, return_exceptions=True)

tests/browser/workspace_concept_fixture.py

@@ -11,6 +11,7 @@ the same sidebar counts (24 images, 6 prompts, 15 tags). Nothing is mocked.
 from __future__ import annotations
 
 from dataclasses import dataclass
+import datetime
 import json
 import math
 import os
@@ -157,7 +158,12 @@ CONCEPT_MODEL = "illustrative-model.safetensors"
 MAX_EXTRA_IMAGES = 120
 # Unlinked, seedless images (D11 "W × H · PNG") newer than the concept's, for D3 checks.
 MAX_SEEDLESS_IMAGES = 2
+# A test's chosen "now" (epoch seconds) stays before the year 3000.
+MAX_EPOCH_SECONDS = 32_503_680_000
 SEEDLESS_SIZE = (1536, 1152)
+# The same 4:3 shape with a short "96 × 72 · PNG" subtitle that stays on one line at
+# 390px beside the card's Info and Tag (the D3 footer check).
+SHORT_SEEDLESS_SIZE = (96, 72)
 SESSION = "5c1f9a7e-3f0b-4a55-9d0e-2b8c4f6a7d10"
 _TABLES = (
     "execution_run_outputs",
@@ -326,9 +332,9 @@ def _record_run(
     return start.run_id
 
 
-def _write_seedless_png(path: Path) -> None:
+def _write_seedless_png(path: Path, size: tuple[int, int] = SEEDLESS_SIZE) -> None:
     """A plain PNG with no metadata: no prompt, no seed, no link."""
-    with Image.new("RGB", SEEDLESS_SIZE, "#2b3442") as image:
+    with Image.new("RGB", size, "#2b3442") as image:
         image.save(path)
 
 
@@ -339,21 +345,47 @@ def _bounded(name: str, value: int, maximum: int) -> None:
         raise ValueError(f"{name} is out of range")
 
 
+def _instant(now: float | None) -> float:
+    """The fixture's one "now": ``now`` itself, or the wall clock when omitted."""
+    if now is None:
+        return time.time()
+    if isinstance(now, bool) or not isinstance(now, (int, float)):
+        raise TypeError("now must be a number of epoch seconds")
+    if not 0 < now < MAX_EPOCH_SECONDS:
+        raise ValueError("now is out of range")
+    return float(now)
+
+
 def seed_workspace_concept(
     api: PromptManagerAPI,
     root: Path,
     *,
     extra_images: int = 0,
     seedless_images: int = 0,
+    short_seedless: bool = False,
+    now: float | None = None,
 ) -> dict:
     """Replace this server's disposable rows and files with the concept's data.
 
+    Every relative time the fixture writes (the prompts' last use, the files'
+    mtimes, the runs' observation times) is taken from one instant, ``now``
+    (epoch seconds, the wall clock when omitted), returned as ``manifest["now"]``.
+    A browser whose clock is fixed at that instant reads the concept's "Used
+    today" and caption day however close to midnight the run starts.
+
     ``extra_images`` continues the concept's rounds (same prompts, dimensions and
     seed rule) after its 24 images, for bounded-rendering and Load more checks.
-    ``seedless_images`` adds unlinked PNGs without metadata, newest of all.
+    ``seedless_images`` adds unlinked PNGs without metadata, newest of all;
+    ``short_seedless`` makes them ``SHORT_SEEDLESS_SIZE`` instead.
     """
+    if not isinstance(short_seedless, bool):
+        raise TypeError("short_seedless must be a boolean")
     _bounded("extra_images", extra_images, MAX_EXTRA_IMAGES)
     _bounded("seedless_images", seedless_images, MAX_SEEDLESS_IMAGES)
+    now = _instant(now)
+    used_at = datetime.datetime.fromtimestamp(now, datetime.timezone.utc).isoformat(
+        timespec="microseconds"
+    )
     _clear(api, root)
     db = api.db
     epoch = db.get_execution_epoch()
@@ -378,8 +410,15 @@ def seed_workspace_concept(
         db.update_prompt_pair_metadata(pair_ids[0], title=first_name)
         for name, text in prompt.negatives[1:]:
             pair_ids.append(db.save_prompt_pair(prompt.positive, text, title=name))
-        # Real queue-hook counting (D23): four runs, the last one now.
+        # Real queue-hook counting (D23): four runs, the last one now, at the
+        # fixture's own instant rather than the database's later wall clock.
         db.record_prompt_use(positive_id, times=CONCEPT_RUN_COUNT)
+        with db.model.get_connection() as conn:
+            conn.execute(
+                "UPDATE prompts SET last_used_at = ? WHERE id = ?",
+                (used_at, positive_id),
+            )
+            conn.commit()
         prompts.insert(
             0, {"id": prompt.id, "positive_id": positive_id, "pair_ids": pair_ids}
         )
@@ -393,7 +432,6 @@ def seed_workspace_concept(
     favorite_root = _favorite_root_key(list(api._get_all_output_dirs())[0])
     total = len(CONCEPT_PROMPTS) * CONCEPT_IMAGE_ROUNDS + extra_images
     rounds = math.ceil(total / len(CONCEPT_PROMPTS))
-    now = time.time()
     images, runs = [], []
     slots = [
         (round_index, prompt_index, prompt)
@@ -459,7 +497,9 @@ def seed_workspace_concept(
     for number in range(seedless_images):
         name = f"seedless_{number + 1:05}.png"
         path = folder / name
-        _write_seedless_png(path)
+        _write_seedless_png(
+            path, SHORT_SEEDLESS_SIZE if short_seedless else SEEDLESS_SIZE
+        )
         stamp = now - 10 - number * 10
         os.utime(path, (stamp, stamp))
         seedless.append({"filename": name, "path": f"concepts/{name}"})
@@ -475,6 +515,8 @@ def seed_workspace_concept(
     api.invalidate_gallery_cache()
     return {
         "epoch": epoch,
+        # The fixture's "now" (epoch seconds), for the browser's fixed clock.
+        "now": now,
         # The newest file's mtime (epoch seconds), for the D17 caption date.
         "newest_modified": now - 10 if seedless_images else now - 60,
         "seedless": seedless,

tests/browser/workspace_tagging_fixture.py

@@ -0,0 +1,313 @@
+"""Owned, deterministic files for the Tag image dialog workflows (#249 PR C).
+
+Two files share one positive prompt and one saved pair, an equal-byte copy of
+the first sits at another path, and a video and an unlinked file follow. The
+injected fake model (``tests/browser/server.py`` ``TestModel``) answers
+Generate; no model file exists and nothing is ever downloaded.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+import shutil
+import time
+from typing import TYPE_CHECKING
+
+from aiohttp import web
+from PIL import Image
+from PIL.PngImagePlugin import PngInfo
+
+if TYPE_CHECKING:
+    from py.api import PromptManagerAPI
+
+POSITIVE = (
+    "Monolithic sandstone pavilion in a vast desert, sweeping dunes, warm "
+    "terracotta, late afternoon sun, architectural photography, quiet geometry"
+)
+NEGATIVE = "plastic, harsh shadows, noise, watermark"
+TITLE = "Quiet geometry"
+PROMPT_TAGS = ["minimal", "warm_light"]
+PAIR_TAGS = ["editorial"]
+# Newest first, so the Images order (Recently added) is the manifest's.
+FILES = (
+    ("tagging/dunes_00001.png", "linked"),
+    ("tagging/dunes_00002.png", "linked"),
+    ("copies/dunes_00001.png", "copy"),
+    ("tagging/clip.webm", "video"),
+    ("loose/unlinked.png", "unlinked"),
+)
+MODELS = ("wd14-swinv2", "wd14-vit", "gguf", "hf")
+# Unlinked copies enough to virtualize the Images grid (it renders all up to 120).
+MAX_EXTRA_IMAGES = 160
+_TABLES = (
+    "saved_views",
+    "image_favorites",
+    "media_image_tags",
+    "media_annotation_bytes",
+    "media_annotation_files",
+    "image_prompt_pairs",
+    "prompt_pair_tags",
+    "prompt_pairs",
+    "generated_images",
+    "prompt_tags",
+    "tags",
+    "prompt_library_state",
+    "prompts",
+)
+# Every prompt-side owner row a Tag save could touch, for before/after
+# comparisons: tagging one image never changes a prompt, a pair or a link.
+_SNAPSHOT = {
+    "prompts": "SELECT id, text, category, tags, updated_at FROM prompts ORDER BY id",
+    "prompt_tags": "SELECT prompt_id, tag_id FROM prompt_tags ORDER BY 1, 2",
+    "prompt_pairs": "SELECT id, positive_prompt_id, negative_prompt_id, category,"
+    " archived, updated_at FROM prompt_pairs ORDER BY id",
+    "prompt_pair_tags": "SELECT pair_id, tag_id FROM prompt_pair_tags ORDER BY 1, 2",
+    "generated_images": "SELECT id, prompt_id, image_path FROM generated_images"
+    " ORDER BY id",
+    "image_prompt_pairs": "SELECT id, image_id, pair_id FROM image_prompt_pairs"
+    " ORDER BY id",
+}
+
+
+def _png(path: Path, colour: tuple[int, int, int], size=(96, 64)) -> None:
+    graph = {
+        "1": {"class_type": "CLIPTextEncode", "inputs": {"text": POSITIVE}},
+        "2": {"class_type": "CLIPTextEncode", "inputs": {"text": NEGATIVE}},
+        "3": {
+            "class_type": "KSampler",
+            "inputs": {"positive": ["1", 0], "negative": ["2", 0], "seed": 7},
+        },
+        "4": {"class_type": "SaveImage", "inputs": {"images": ["3", 0]}},
+    }
+    info = PngInfo()
+    info.add_text("prompt", json.dumps(graph))
+    path.parent.mkdir(parents=True, exist_ok=True)
+    with Image.new("RGB", size, colour) as image:
+        image.save(path, pnginfo=info)
+
+
+def seed_tagging(api: PromptManagerAPI, root: Path, extra_images: int = 0) -> dict:
+    """Replace this server's disposable rows and files with the tagging set."""
+    db = api.db
+    with db.model.get_connection() as conn:
+        for table in _TABLES:
+            conn.execute(f"DELETE FROM {table}")
+    for name in ("output", "input"):
+        shutil.rmtree(root / name)
+        (root / name).mkdir()
+    output = root / "output"
+    _png(output / FILES[0][0], (196, 140, 92))
+    _png(output / FILES[1][0], (150, 110, 80))
+    (output / FILES[2][0]).parent.mkdir(parents=True, exist_ok=True)
+    shutil.copyfile(output / FILES[0][0], output / FILES[2][0])
+    shutil.copyfile(
+        Path(__file__).resolve().parents[1] / "fixtures" / "tiny.webm",
+        output / FILES[3][0],
+    )
+    _png(output / FILES[4][0], (60, 70, 90), size=(64, 64))
+    now = time.time()
+    for index, (relative, _) in enumerate(FILES):
+        stamp = now - 60 - index * 10
+        os.utime(output / relative, (stamp, stamp))
+    for number in range(extra_images):
+        extra = output / "bulk" / f"bulk_{number:04}.png"
+        extra.parent.mkdir(exist_ok=True)
+        shutil.copyfile(output / FILES[4][0], extra)
+        stamp = now - 600 - number
+        os.utime(extra, (stamp, stamp))
+
+    receipt = db.create_library_recipe(
+        POSITIVE,
+        NEGATIVE,
+        expected_epoch=db.get_execution_epoch(),
+        parent_metadata={
+            "title": TITLE,
+            "category": "Architecture",
+            "tags": list(PROMPT_TAGS),
+        },
+    )
+    positive_id = receipt["positive"]["id"]
+    pair_id = receipt["pair"]["id"]
+    with db.model.get_connection() as conn:
+        tag_ids = []
+        for name in PAIR_TAGS:
+            conn.execute("INSERT OR IGNORE INTO tags (name) VALUES (?)", (name,))
+            tag_ids.append(
+                conn.execute("SELECT id FROM tags WHERE name=?", (name,)).fetchone()[0]
+            )
+        conn.executemany(
+            "INSERT INTO prompt_pair_tags (pair_id, tag_id) VALUES (?, ?)",
+            [(pair_id, tag_id) for tag_id in tag_ids],
+        )
+    for relative, kind in FILES:
+        if kind in {"linked", "video"}:
+            image_id = db.link_image_to_prompt(positive_id, str(output / relative))
+            if kind == "linked":
+                db.link_image_to_pair(pair_id, image_id, {"source": "fixture"})
+    api._generate_gallery_thumbnails_sync(api._get_all_output_dirs(), (150, 150))
+    api.invalidate_gallery_cache()
+    return {
+        "positive_id": positive_id,
+        "pair_id": pair_id,
+        "title": TITLE,
+        "prompt_tags": list(PROMPT_TAGS),
+        "pair_tags": list(PAIR_TAGS),
+        "files": [
+            {"path": relative, "filename": Path(relative).name, "kind": kind}
+            for relative, kind in FILES
+        ],
+    }
+
+
+def tagging_snapshot(api: PromptManagerAPI) -> dict:
+    """Plain rows of every prompt, pair and link table."""
+    with api.db.model.get_connection() as conn:
+        return {
+            name: [list(row) for row in conn.execute(query)]
+            for name, query in _SNAPSHOT.items()
+        }
+
+
+def register_tagging_commands(
+    routes: web.RouteTableDef, api: PromptManagerAPI, root: Path, model
+) -> None:
+    """Register fixed seed, snapshot and fake-model commands; no paths or SQL input."""
+
+    @routes.post("/__test__/tagging/reset")
+    async def reset(request: web.Request) -> web.Response:
+        data = await request.json() if request.can_read_body else {}
+        if request.query or not isinstance(data, dict) or set(data) - {"extra_images"}:
+            raise web.HTTPBadRequest()
+        extra = data.get("extra_images", 0)
+        if isinstance(extra, bool) or not isinstance(extra, int):
+            raise web.HTTPBadRequest()
+        if not 0 <= extra <= MAX_EXTRA_IMAGES:
+            raise web.HTTPBadRequest()
+        model.unavailable = set()
+        model.suggestions = None
+        model.loaded = None
+        _set_defaults(model, DEFAULTS)
+        # A test that ends with the dialog open leaves its capture behind; drop
+        # every capture so the next test starts below the store's limits.
+        await api._run_in_executor(api.close_annotation_captures)
+        manifest = await api._run_in_executor(seed_tagging, api, root, extra)
+        return web.json_response({"success": True, **manifest})
+
+    @routes.get("/__test__/tagging/snapshot")
+    async def snapshot(request: web.Request) -> web.Response:
+        if request.query:
+            raise web.HTTPBadRequest()
+        return web.json_response(await api._run_in_executor(tagging_snapshot, api))
+
+    @routes.post("/__test__/tagging/models")
+    async def models(request: web.Request) -> web.Response:
+        """Mark fake models as not downloaded (``{"unavailable": [...]}``)."""
+        data = await request.json() if request.can_read_body else None
+        if (
+            request.query
+            or not isinstance(data, dict)
+            or set(data) != {"unavailable"}
+            or not isinstance(data["unavailable"], list)
+            or any(name not in MODELS for name in data["unavailable"])
+        ):
+            raise web.HTTPBadRequest()
+        model.unavailable = set(data["unavailable"])
+        return web.json_response({"success": True})
+
+    @routes.post("/__test__/tagging/suggestions")
+    async def suggestions(request: web.Request) -> web.Response:
+        """Answer Generate with fixed scored names (the concept's own sample).
+
+        ``{"scored": [[name, confidence], ...]}`` (at most 100, confidence in
+        [0, 1]) or ``{"scored": null}`` for the default list. Every capture is
+        released too, so a concept comparison starts below the store's limits
+        whatever the previous test left open.
+        """
+        data = await request.json() if request.can_read_body else None
+        scored = data.get("scored") if isinstance(data, dict) else None
+        if (
+            request.query
+            or not isinstance(data, dict)
+            or set(data) != {"scored"}
+            or not (scored is None or _valid_scored(scored))
+        ):
+            raise web.HTTPBadRequest()
+        model.suggestions = (
+            None if scored is None else [(name, float(value)) for name, value in scored]
+        )
+        model.unavailable = set()
+        await api._run_in_executor(api.close_annotation_captures)
+        return web.json_response({"success": True})
+
+    @routes.post("/__test__/tagging/defaults")
+    async def defaults(request: web.Request) -> web.Response:
+        """Serve other tagging defaults from ``GET /autotag/models``.
+
+        ``{"general": g, "character": c, "limit": n}``: the WD14 thresholds
+        (in [0, 1]) and the persisted suggestion count (1..100), so a test can
+        tell the server's values from the dialog's built-in ones. Reset
+        restores the standard 0.35 / 0.85 / 10.
+        """
+        data = await request.json() if request.can_read_body else None
+        if request.query or not _valid_defaults(data):
+            raise web.HTTPBadRequest()
+        _set_defaults(model, (data["general"], data["character"], data["limit"]))
+        return web.json_response({"success": True})
+
+    @routes.get("/__test__/tagging/captures")
+    async def captures(request: web.Request) -> web.Response:
+        """How many captures the store holds (a released capture is gone)."""
+        if request.query:
+            raise web.HTTPBadRequest()
+        store = api._captures
+        count = store.stats()["captures"] if store is not None else 0
+        return web.json_response({"captures": count})
+
+
+# The standard tagging defaults: WD14 general and character thresholds, and
+# the suggestion count (``AutotagConfig``).
+DEFAULTS = (0.35, 0.85, 10)
+
+
+def _set_defaults(model, values) -> None:
+    from py.config import AutotagConfig
+
+    general, character, limit = values
+    model.wd14_general_threshold = general
+    model.wd14_character_threshold = character
+    AutotagConfig.SUGGESTION_LIMIT = limit
+
+
+def _valid_defaults(data: object) -> bool:
+    unit = (
+        lambda value: isinstance(value, (int, float))
+        and not isinstance(value, bool)
+        and 0 <= value <= 1
+    )
+    return (
+        isinstance(data, dict)
+        and set(data) == {"general", "character", "limit"}
+        and unit(data["general"])
+        and unit(data["character"])
+        and type(data["limit"]) is int
+        and 1 <= data["limit"] <= 100
+    )
+
+
+def _valid_scored(scored: object) -> bool:
+    return (
+        isinstance(scored, list)
+        and len(scored) <= 100
+        and all(
+            isinstance(row, list)
+            and len(row) == 2
+            and isinstance(row[0], str)
+            and 0 < len(row[0]) <= 50
+            and isinstance(row[1], (int, float))
+            and not isinstance(row[1], bool)
+            and 0 <= row[1] <= 1
+            for row in scored
+        )
+    )

tests/comfyui/inspect-sender.spec.mjs

@@ -0,0 +1,126 @@
+import {test,expect} from '../../tools/vendor/node_modules/@playwright/test/index.mjs';
+import {installHostHooks} from './host-fixture.mjs';
+import {sendablePng,localFixture,POSITIVE_LINES} from '../browser/local-inspect-files.mjs';
+
+// PR L2 Task 7 of the local-Inspect plan (#249): a file read entirely in the browser by the native Inspect page sends
+// its exact roles into a real Prompt Manager (+/-) node, in Classic and Nodes 2.0, switching both ways and reloading
+// the graph each time. Nothing queues or loads a workflow, and a connected destination input rejects the whole send.
+installHostHooks(test,['PromptManagerPair']);
+
+// The PNG's positive spans lines and its negative is a ConditioningZeroOut (explicitly empty); the WebM carries the
+// committed core video's per-key tags.
+const FILES=[
+    {file:()=>sendablePng('host-send.png'),positive:POSITIVE_LINES,negative:'',shown:'No negative prompt (explicitly empty)'},
+    {file:()=>localFixture('core-tags.webm','video/webm','host-send.webm'),positive:'a red fox in snow, detailed fur',negative:'blurry, lowres',shown:'blurry, lowres'},
+];
+
+async function nodeState(page,id) {
+    return page.evaluate(async id=>{
+        const {app}=await import('/scripts/app.js');const node=app.graph.getNodeById(id);const serialized=node.serialize();
+        return {inputs:(await app.graphToPrompt()).output[String(id)].inputs,widgets:Object.fromEntries(node.widgets.map(widget=>[widget.name,widget.value])),
+            serialized:Object.fromEntries(node.widgets.map((widget,index)=>[widget.name,serialized.widgets_values[index]])),effects:window.inspectEffects};
+    },id);
+}
+
+/**
+ * Counts every queue or workflow load until `restore` runs; with `reset`, first sets the destination's roles back to
+ * known values (the connected-input case sets them itself, before it links the input, as library-sender.spec does).
+ */
+async function watchHost(page,id,reset=true) {
+    await page.evaluate(async ({id,reset})=>{
+        const {app}=await import('/scripts/app.js');const node=app.graph.getNodeById(id);
+        if(reset){node.widgets.find(widget=>widget.name==='text').value='Before positive';node.widgets.find(widget=>widget.name==='negative_text').value='Before negative';}
+        window.inspectEffects={queue:0,load:0};window.inspectOriginals={};
+        for(const [method,key] of [['queuePrompt','queue'],['loadGraphData','load']]){const original=app[method];window.inspectOriginals[method]=original;app[method]=function(...args){window.inspectEffects[key]++;return original.apply(this,args);};}
+    },{id,reset});
+}
+const restore=page=>page.evaluate(async()=>{const {app}=await import('/scripts/app.js');Object.assign(app,window.inspectOriginals);});
+
+/** Chooses `file` on the Inspect page and opens the shared viewer on its local record. */
+async function inspect(workspace,{file,positive,shown}) {
+    await workspace.locator('#local-file').setInputFiles(file());
+    const open=workspace.locator('#workspace-main .heading-actions').getByRole('button',{name:'Open file metadata',exact:true});
+    await expect(open).toHaveAttribute('aria-disabled','false');await open.click();
+    const rail=workspace.locator('dialog#viewer-dialog[open] #viewer-details');
+    await expect(rail.locator('.prompt-section.positive p.prompt-text')).toHaveText(positive);
+    await expect(rail.locator('.prompt-section.negative p.prompt-text')).toHaveText(shown);
+    return rail;
+}
+
+/** The rail's pair send, through to a previewed destination; returns the sender dialog. */
+async function preview(workspace,rail) {
+    await rail.getByRole('button',{name:/^Send prompt pair to ComfyUI: /}).click();
+    const sender=workspace.getByRole('dialog',{name:'Send to ComfyUI',exact:true});
+    const hosts=sender.getByRole('combobox',{name:'ComfyUI window',exact:true});await expect(hosts.locator('option')).toHaveCount(2);await hosts.selectOption({index:1});
+    await sender.getByRole('combobox',{name:'Destination node',exact:true}).selectOption({index:1});
+    await sender.getByRole('button',{name:'Preview changes',exact:true}).click();
+    return sender;
+}
+
+async function closeViewer(workspace,sender) {
+    await sender.getByRole('button',{name:'Close',exact:true}).click();await expect(sender).toHaveCount(0);
+    await workspace.keyboard.press('Escape');await expect(workspace.locator('dialog#viewer-dialog[open]')).toHaveCount(0);
+}
+
+test('local file roles send exactly across renderer transitions',async({page,context},testInfo)=>{
+    test.setTimeout(180000);
+    const id=await page.evaluate(async()=>{
+        const {app}=await import('/scripts/app.js');const node=LiteGraph.createNode('PromptManagerPair');app.graph.add(node);
+        node.setSize([700,1000]);app.canvas.ds.scale=.8;app.canvas.centerOnNode(node);return node.id;
+    });
+    const workspace=await context.newPage();const errors=[];workspace.on('pageerror',error=>errors.push(error.message));
+    const requests=[];workspace.on('request',request=>{if(request.method()!=='GET')requests.push(`${request.method()} ${request.url()}`);});
+    const logged=[];workspace.on('console',message=>logged.push(message.text()));
+    try {
+        await workspace.goto('/prompt_manager/workspace#/inspect');
+        await expect(workspace.locator('#workspace-main h1')).toHaveText('Inspect a file');
+        const initial=testInfo.project.metadata.initialRenderer;
+        for(const renderer of [initial,!initial,initial]) {
+            // The renderer switch reloads the graph, as a workflow reload does.
+            await page.evaluate(async renderer=>{const {app}=await import('/scripts/app.js');await app.ui.settings.setSettingValue('Comfy.VueNodes.Enabled',renderer);await app.loadGraphData(app.graph.serialize());app.canvas.centerOnNode(app.graph._nodes[0]);},renderer);
+            await expect.poll(()=>page.evaluate(()=>LiteGraph.vueNodesMode)).toBe(renderer);
+            for(const entry of FILES) {
+                await watchHost(page,id);
+                try {
+                    const rail=await inspect(workspace,entry);
+                    const sender=await preview(workspace,rail);
+                    for(const text of ['Before positive','Before negative',...entry.positive.split('\n'),entry.negative||'(empty)'])await expect(sender).toContainText(text);
+                    await sender.getByRole('button',{name:'Apply to ComfyUI',exact:true}).click();await expect(sender).toContainText('Sent to ComfyUI.');
+                    const state=await nodeState(page,id);
+                    expect(state.effects).toEqual({queue:0,load:0});
+                    for(const field of ['inputs','serialized'])expect(state[field]).toMatchObject({text:entry.positive,negative_text:entry.negative});
+                    await closeViewer(workspace,sender);
+                } finally {await restore(page);}
+            }
+        }
+        // A connected destination input rejects the whole preview: neither role changes, nothing queues or loads.
+        const link=await page.evaluate(async id=>{
+            const {app}=await import('/scripts/app.js');const {convertToInput}=await import('/extensions/core/widgetInputs.js');
+            const node=app.graph.getNodeById(id);const widget=node.widgets.find(item=>item.name==='negative_text');
+            if(!node.inputs.some(input=>input.name==='negative_text'))convertToInput(node,widget);
+            node.widgets.find(item=>item.name==='text').value='Before positive';widget.value='Before negative';
+            const source=LiteGraph.createNode('PrimitiveString');app.graph.add(source);source.widgets.find(item=>item.name==='value').value='Upstream negative';
+            source.connect(0,node,node.inputs.findIndex(input=>input.name==='negative_text'));
+            return [String(source.id),0];
+        },id);
+        await watchHost(page,id,false);
+        try {
+            const before=await nodeState(page,id);
+            expect(before.widgets).toMatchObject({text:'Before positive',negative_text:'Before negative'});
+            const rail=await inspect(workspace,FILES[1]);
+            const sender=await preview(workspace,rail);
+            await expect(sender.getByRole('alert')).toContainText(/connected/i);
+            await expect(sender.getByRole('button',{name:'Apply to ComfyUI',exact:true})).toBeDisabled();
+            const rejected=await nodeState(page,id);
+            expect(rejected.effects).toEqual({queue:0,load:0});
+            expect(rejected.inputs.negative_text).toEqual(link);
+            for(const field of ['widgets','serialized'])expect(rejected[field]).toMatchObject({text:'Before positive',negative_text:'Before negative'});
+            await closeViewer(workspace,sender);
+        } finally {await restore(page);}
+        // The workspace page sent nothing to the server (the only crossing is the host bridge) and logged nothing of
+        // the files: no name and no prompt text.
+        expect(requests).toEqual([]);
+        expect(logged.filter(text=>/host-send|lighthouse|long exposure|red fox|lowres/.test(text))).toEqual([]);
+        expect(errors).toEqual([]);
+    } finally {await workspace.close();}
+});

tests/js/api-client.test.js

@@ -236,6 +236,35 @@ test("latestOnly: errors from the current call propagate, errors from superseded
     assert.equal(await first, STALE);
 });
 
+test("latestOnly with a lifetime: once it ends, no request starts and the call is STALE", async () => {
+    const fetch = fakeFetch();
+    const api = createApiClient(fetch);
+    const page = new AbortController();
+    const latest = latestOnly({ lifetime: page.signal });
+    page.abort();
+    assert.equal(await latest((signal) => api.get("/recent", { signal })), STALE);
+    assert.equal(fetch.calls.length, 0, "a leaving page starts no read");
+});
+
+test("latestOnly with a lifetime: its end aborts the request in flight, which is STALE, not an error", async () => {
+    const fetch = fakeFetch();
+    const api = createApiClient(fetch);
+    const page = new AbortController();
+    const latest = latestOnly({ lifetime: page.signal });
+    const call = latest((signal) => api.get("/recent", { signal }));
+    page.abort();
+    assert.equal(fetch.calls[0].aborted, true, "the read in flight is aborted");
+    fetch.calls[0].reject(new DOMException("The operation was aborted.", "AbortError"));
+    assert.equal(await call, STALE);
+});
+
+test("latestOnly with a lifetime: real errors still propagate while the page lives", async () => {
+    const page = new AbortController();
+    const latest = latestOnly({ lifetime: page.signal });
+    await assert.rejects(latest(async () => { throw new Error("server down"); }), /server down/);
+    assert.equal(await latest(async () => "fine"), "fine");
+});
+
 test("ApiError exposes only validated history recovery actions on all error paths", async () => {
     const permitted = [null, { action: "refresh-history" }, { action: "reload-outputs" },
         { action: "retry-read" }, { action: "smaller-limit", limit: 1 },
@@ -296,3 +325,33 @@ test("get forwards an explicit cache mode and keeps the default request otherwis
     fetch.calls[2].resolve(jsonResponse(200, { success: true }));
     await writes;
 });
+
+test("ApiError exposes only a validated current tag set from a tag-conflict body", async () => {
+    const permitted = [{ tags: [], tag_revision: 0 }, { tags: ["warm", "Dune"], tag_revision: 7 }];
+    const denied = [undefined, null, { tags: ["a"] }, { tag_revision: 1 }, { tags: "a", tag_revision: 1 },
+        { tags: [1], tag_revision: 1 }, { tags: ["a"], tag_revision: -1 }, { tags: ["a"], tag_revision: 1.5 },
+        { tags: ["a"], tag_revision: true }, { tags: Array(101).fill("a"), tag_revision: 1 }];
+    assert.equal(new ApiError(409, "old caller").current, null);
+    for (const current of permitted.concat(denied)) {
+        const api = createApiClient(async () => jsonResponse(409, {
+            success: false, error: "changed", code: "tag-conflict", ...(current || {}),
+        }));
+        await assert.rejects(api.put("/x", {}), error => {
+            assert.ok(error instanceof ApiError);
+            assert.deepEqual(error.current, permitted.includes(current) ? current : null);
+            if (permitted.includes(current)) assert.notEqual(error.current.tags, current.tags, "server arrays must be copied");
+            return true;
+        });
+    }
+});
+
+test("keepalive is forwarded only when asked, so a request can outlive its page", async () => {
+    const fetch = fakeFetch();
+    const api = createApiClient(fetch);
+    const writes = [api.del("/x", { keepalive: true }), api.put("/x", {}, { keepalive: true }), api.post("/x", {}, { keepalive: true }),
+        api.del("/x"), api.put("/x", {}), api.get("/x")];
+    assert.deepEqual(fetch.calls.map(call => call.init.keepalive), [true, true, true, undefined, undefined, undefined]);
+    assert.equal("keepalive" in fetch.calls[3].init, false);
+    for (const call of fetch.calls) call.resolve(jsonResponse(200, { success: true }));
+    await Promise.all(writes);
+});

tests/js/gallery-thumbnails.test.js

@@ -73,6 +73,28 @@ test('Not Now persists the collection state and suppresses the unchanged prompt'
     assert.equal(f.prompts.length, 1);
 });
 
+// WebKit fails a fetch a leaving page starts ("Fetch API cannot load … due to access control checks.") and logs it
+// as a page error: the delayed startup check starts no read once the page has begun to leave (as admin.js, #290).
+test('the startup check starts no read once the page is leaving', async () => {
+    const f = fixture({ success: true, total_images: 100, pending: 30, collection_id: 'a' });
+    f.manager.pageLifetime = new AbortController();
+    f.manager.pageLifetime.abort();
+    await f.check();
+    assert.equal(f.requests.length, 0);
+    assert.equal(f.prompts.length, 0);
+});
+
+test('the startup check passes the page lifetime to its read', async () => {
+    const f = fixture({ success: true, total_images: 100, pending: 30, collection_id: 'a' });
+    const signals = [];
+    f.manager.pageLifetime = new AbortController();
+    const get = f.manager.api.get;
+    f.manager.api.get = async (url, options) => { signals.push(options?.signal); return get(url); };
+    await f.check();
+    assert.deepEqual(signals, [f.manager.pageLifetime.signal]);
+    assert.equal(f.prompts.length, 1);
+});
+
 test('disabled checks do not request collection status', async () => {
     const f = fixture({}, { checkThumbnailsAtStartup: false });
     await f.check();

tests/js/helpers/mounted-dom.mjs

@@ -0,0 +1,40 @@
+// A minimal DOM for mounting the workspace viewer and inspector in Node: elements with
+// children, attributes, listeners (fire() dispatches), dialogs and media methods.
+export function mountedDom() {
+    class Node {
+        constructor(tag) {this.tagName=tag;this.children=[];this.dataset={};this.attributes={};this.listeners=new Map();this._text='';this.classList={add(){},remove(){}};}
+        get textContent(){return this._text+this.children.map(c=>c.textContent).join('');}
+        set textContent(value){this._text=String(value);this.children=[];}
+        get childNodes(){return this.children;}
+        get isConnected(){return this.root || !!this.parent?.isConnected;}
+        // As in the DOM, a string argument becomes a text node.
+        static wrap(node){if(typeof node!=='string')return node;const text=new Node('#text');text.textContent=node;return text;}
+        append(...nodes){for(const node of nodes.map(Node.wrap)){node.parent=this;this.children.push(node);}}
+        prepend(...nodes){nodes=nodes.map(Node.wrap);for(const node of nodes)node.parent=this;this.children.unshift(...nodes);}
+        replaceChildren(...nodes){for(const child of this.children)child.parent=null;this.children=[];this._text='';this.append(...nodes);}
+        remove(){if(this.parent)this.parent.children=this.parent.children.filter(c=>c!==this);this.parent=null;}
+        setAttribute(key,value){this.attributes[key]=String(value);}
+        getAttribute(key){return this.attributes[key]??null;}
+        removeAttribute(key){delete this.attributes[key];}
+        addEventListener(type,callback,options={}){const list=this.listeners.get(type)||[];list.push({callback,signal:options.signal});this.listeners.set(type,list);}
+        removeEventListener(type,callback){this.listeners.set(type,(this.listeners.get(type)||[]).filter(e=>e.callback!==callback));}
+        fire(type,event={}){for(const e of [...(this.listeners.get(type)||[])])if(!e.signal?.aborted)e.callback({target:this,preventDefault(){},...event});}
+        focus(){this.focused=true;}
+        showModal(){this.open=true;}
+        close(){this.open=false;this.fire('close');}
+        contains(node){return node===this||this.children.some(c=>c.contains(node));}
+        closest(selector){if(selector==='section'&&this.tagName==='section')return this;if(selector==='[data-send-role]'&&this.dataset.sendRole)return this;if(selector==='[data-copy-role]'&&this.dataset.copyRole)return this;return this.parent?.closest(selector)||null;}
+        querySelector(selector){return walk(this,n=>n.tagName===selector)[0]||null;}
+        pause(){this.paused=true;}
+        load(){this.loaded=true;}
+        play(){this.played=true;return Promise.resolve();}
+    }
+    const walk=(node,predicate)=>[...(predicate(node)?[node]:[]),...node.children.flatMap(child=>walk(child,predicate))];
+    const oldDocument=globalThis.document,oldWindow=globalThis.window;
+    const container=new Node('main');container.root=true;
+    const doc=new Node('document');doc.createElement=tag=>new Node(tag);doc.createElementNS=(_,tag)=>new Node(tag);
+    doc.querySelectorAll=()=>walk(container,n=>n.tagName==='dialog'&&n.open);doc.activeElement=new Node('button');doc.activeElement.root=true;
+    const win=new Node('window');win.location={href:'http://localhost/prompt_manager/workspace'};win.getSelection=()=>({isCollapsed:true});
+    globalThis.document=doc;globalThis.window=win;
+    return {container,doc,win,walk,Node,restore(){globalThis.document=oldDocument;globalThis.window=oldWindow;}};
+}

tests/js/legacy-refusals.test.js

@@ -0,0 +1,150 @@
+// The legacy admin and gallery pages show a server refusal's reason (#220, PR #289 review I1 and M8): a job that
+// runs in the workspace refuses their record-changing requests, and a corrupt config.json refuses a settings save.
+// Each page must name the reason, not report a lost connection, a bare HTTP status or a success.
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const vm = require('node:vm');
+
+function elements() {
+    const nodes = {};
+    return {
+        nodes,
+        getElementById: id => nodes[id] ||= { id, textContent: '', innerHTML: '', disabled: false, style: {},
+            value: '', checked: false, addEventListener() {}, querySelectorAll: () => [] },
+    };
+}
+
+function jsonResponse(status, body) {
+    return { ok: status >= 200 && status < 300, status, statusText: status === 409 ? 'Conflict' : 'OK',
+        json: async () => body };
+}
+
+function sseResponse(frames) {
+    const bytes = new TextEncoder().encode(frames.map(frame => `data: ${JSON.stringify(frame)}\n\n`).join(''));
+    let sent = false;
+    return { ok: true, status: 200, body: { getReader: () => ({
+        read: async () => (sent ? { done: true } : (sent = true, { done: false, value: bytes })),
+    }) } };
+}
+
+function load(file, className, fetchUrl, extra = {}, dom = elements()) {
+    const timers = [];
+    const notifications = [];
+    const storage = new Map([['pm_cached', '1'], ['userData', 'keep']]);
+    const localStorage = {
+        getItem: key => storage.get(key) ?? null,
+        setItem: (key, value) => storage.set(key, String(value)),
+        removeItem: key => storage.delete(key),
+    };
+    const context = vm.createContext({
+        document: { readyState: 'loading', addEventListener() {}, getElementById: dom.getElementById,
+            querySelectorAll: () => [] },
+        window: {}, console: { error() {}, warn() {}, debug() {} },
+        setTimeout: callback => timers.push(callback),
+        confirm: () => true,
+        localStorage,
+        Object: { ...Object, keys: target => (target === localStorage ? [...storage.keys()] : Object.keys(target)) },
+        TextDecoder, TextEncoder, JSON,
+        ApiClient: { fetchUrl },
+        ...extra,
+    });
+    const source = fs.readFileSync(path.join(__dirname, `../../web/js/${file}`), 'utf8');
+    const Page = vm.runInContext(`${source}\n${className};`, context, { filename: path.join(__dirname, `../../web/js/${file}`) });
+    const page = Object.create(Page.prototype);
+    page.showNotification = (message, type) => notifications.push([type, message]);
+    page.showModal = id => notifications.push(['show', id]);
+    page.hideModal = id => notifications.push(['hide', id]);
+    return { page, dom, timers, notifications, storage };
+}
+
+const BUSY = 'Scan for metadata already running';
+
+test('gallery cache clear reports a refused server clear and never claims success', async () => {
+    const calls = [];
+    const { page, dom, notifications, storage } = load('gallery.js', 'GalleryManager', async url => {
+        calls.push(url);
+        return jsonResponse(409, { success: false, error: BUSY });
+    });
+    page.getSettings = () => ({ thumbnailsGenerated: true });
+    dom.getElementById('thumbnailStatus').textContent = 'Generated';
+
+    await page.clearCache();
+
+    assert.deepEqual(calls, ['/prompt_manager/images/clear-thumbnails']);
+    assert.deepEqual(notifications, [['error', `Thumbnails were not cleared: ${BUSY}`]]);
+    assert.equal(dom.nodes.thumbnailStatus.textContent, 'Generated');
+    assert.equal(storage.get('gallerySettings'), undefined); // thumbnailsGenerated is not reset
+});
+
+test('gallery cache clear still says so when the server clears', async () => {
+    const { page, dom, notifications, storage } = load('gallery.js', 'GalleryManager',
+        async () => jsonResponse(200, { success: true, cleared_count: 3 }));
+    page.getSettings = () => ({ thumbnailsGenerated: true });
+
+    await page.clearCache();
+
+    assert.deepEqual(notifications, [['success', 'PromptManager cache cleared successfully! Original images untouched.']]);
+    assert.equal(dom.nodes.thumbnailStatus.textContent, 'Not generated');
+    assert.equal(JSON.parse(storage.get('gallerySettings')).thumbnailsGenerated, false);
+    assert.equal(storage.get('userData'), 'keep');
+    assert.equal(storage.has('pm_cached'), false);
+});
+
+test('admin LoRA import shows a refusal frame and closes its modal', async () => {
+    const { page, dom, timers, notifications } = load('admin.js', 'PromptAdmin',
+        async () => sseResponse([{ type: 'error', status: BUSY, progress: 0, message: BUSY }]));
+    page.saveLoraSettings = async () => true;
+    page.loadStatistics = () => assert.fail('a refused import must not reload statistics');
+
+    await page.runLoraImport();
+
+    assert.equal(dom.nodes.loraImportStatus.textContent, `Error: ${BUSY}`);
+    assert.deepEqual(notifications.filter(([type]) => type === 'error'), [['error', `LoRA import failed: ${BUSY}`]]);
+    assert.equal(timers.length, 1);
+    timers[0]();
+    assert.deepEqual(notifications.at(-1), ['hide', 'loraImportModal']);
+});
+
+test('admin settings save shows why config.json refused it', async () => {
+    const message = 'config.json cannot be read, so nothing was saved. Fix or remove the file, then save again.';
+    const { page, notifications } = load('admin.js', 'PromptAdmin',
+        async () => jsonResponse(409, { success: false, persisted: false, code: 'config-unreadable', error: message }));
+    page.settings = {};
+    page._collectScanPaths = () => [];
+    page.saveLoraSettings = async () => assert.fail('nothing else is saved after a refusal');
+
+    await page.saveSettings();
+
+    assert.deepEqual(notifications, [['error', `Failed to save settings: ${message}`]]);
+});
+
+test('admin settings save keeps its plain message when the reply has no reason', async () => {
+    const { page, notifications } = load('admin.js', 'PromptAdmin', async () => ({ ok: false, status: 500,
+        json: async () => { throw new SyntaxError('not json'); } }));
+    page.settings = {};
+    page._collectScanPaths = () => [];
+
+    await page.saveSettings();
+
+    assert.deepEqual(notifications, [['error', 'Failed to save settings']]);
+});
+
+test('admin maintenance names the job that refused it', async () => {
+    const { page, dom, notifications } = load('admin.js', 'PromptAdmin',
+        async () => jsonResponse(409, { success: false, error: BUSY }), {
+            escapeHtml: text => String(text),
+            document: { readyState: 'loading', addEventListener() {}, getElementById: id => dom.getElementById(id),
+                querySelectorAll: selector => (selector === '.maintenance-option:checked' ? [{ id: 'vacuum' }] : []) },
+        });
+
+    await page.runMaintenance();
+
+    const results = dom.nodes.maintenanceResults.innerHTML;
+    assert.match(results, /Maintenance Failed/);
+    assert.match(results, new RegExp(BUSY));
+    assert.doesNotMatch(results, /HTTP 409/);
+    assert.deepEqual(notifications, [['error', '❌ Maintenance failed']]);
+    assert.equal(dom.nodes.runMaintenanceBtn.disabled, false);
+});

tests/js/support/local-inspect-oracle.mjs

@@ -14,6 +14,11 @@
 //         the carrier rule alone, as the server selects from ffprobe's tag map.
 //         A {records} entry (records null = an unreadable file) answers
 //         {classified: null, result: null, metadata} for the projection alone.
+// A {mode: 'resolve'} entry (PR L3) answers {evidence}: resolveLocalEvidence of its {records} texts
+// with the repository semantics table. With a {path} it reads the file locally and also answers
+// {facts} (and {unreadable: true} with the server's unreadable evidence when nothing could be read):
+// extractGenerationFacts on the local payload through projectInspectionPayload, exactly as
+// tests/js/support/inspection-parity-facts.mjs reads the server's response for vectors.json.
 import fs from 'node:fs';
 import path from 'node:path';
 import { createRequire } from 'node:module';
@@ -28,6 +33,22 @@ const web = path.join(here, '..', '..', '..', 'web', 'js', 'workspace');
 const { selectVideoCarrier } = await import(moduleUrl(path.join(web, 'local-video.mjs')));
 const { projectMetadata } = await import(moduleUrl(path.join(web, 'local-projection.mjs')));
 const { readLocalFile, toInspectionRead } = await import(moduleUrl(path.join(web, 'local-inspection.mjs')));
+const { resolveLocalEvidence, compileSemantics, unreadableEvidence } = await import(moduleUrl(path.join(web, 'local-resolver.mjs')));
+const { buildLocalPayload } = await import(moduleUrl(path.join(web, 'local-inspection.mjs')));
+const { projectInspectionPayload } = await import(moduleUrl(path.join(web, 'inspection-state.mjs')));
+const semantics = compileSemantics(JSON.parse(fs.readFileSync(path.join(here, '..', '..', '..', 'web', 'js', 'inspection-semantics.json'), 'utf8')));
+const { extractGenerationFacts } = require(path.join(here, '..', '..', '..', 'web', 'js', 'comfy-metadata.js'));
+
+/** The local evidence for one set of record texts. */
+const resolved = records => ({ evidence: resolveLocalEvidence(records, semantics) });
+
+/** The local wire's evidence and six facts for one read (no legacy fill, as in the vectors' own harness). */
+function localPayload(read, file, classification) {
+    const payload = buildLocalPayload({ read, file, classification, semantics });
+    const record = projectInspectionPayload(payload, { kind: 'local-file', key: 'local:1', path: file.name }, null, extractGenerationFacts);
+    const facts = Object.fromEntries(Object.entries(record.generation).map(([field, fact]) => [field, { status: fact.status, value: fact.value }]));
+    return { evidence: { prompts: payload.prompts, resolution: payload.resolution }, facts };
+}
 
 const selectionRead = (selection) => selection.status === 'complete' ?
     { records: selection.records, record_formats: selection.record_formats, carrierText: selection.carrierText, limited: selection.limited } : null;
@@ -37,6 +58,19 @@ for await (const chunk of process.stdin) chunks.push(chunk);
 const output = {};
 for (const entry of JSON.parse(Buffer.concat(chunks).toString('utf8'))) {
     const { name } = entry;
+    if (entry.mode === 'resolve') {
+        if (entry.records !== undefined) { output[name] = resolved(entry.records); continue; }
+        const blob = await fs.openAsBlob(entry.path);
+        const { classification, result } = await readLocalFile(blob, { pngMetadata });
+        const read = classification === null ? null : toInspectionRead(classification, result).read;
+        if (classification === null) { output[name] = { unreadable: true }; continue; }
+        // The evidence is the local wire's own (buildLocalPayload), and it equals resolveLocalEvidence of the records.
+        const local = localPayload(result, { name: path.basename(entry.path), size: blob.size }, classification);
+        const direct = read === null ? unreadableEvidence() : resolved(read.records).evidence;
+        if (JSON.stringify(direct) !== JSON.stringify(local.evidence)) throw new Error(`${name}: the wire's roles are not the resolver's`);
+        output[name] = read === null ? { unreadable: true, ...local } : local;
+        continue;
+    }
     if (entry.records !== undefined) {
         const read = entry.records === null ? null : {
             records: entry.records,

tests/js/workspace-activity-store.test.js

@@ -261,8 +261,13 @@ test('summaries are validated and the copy follows the spec', async () => {
     const loose = parseJob({ id: ID_A, state: 'running', progress: 140.4, processed: -1, total: 1.5, counters: { added: 'x', errors: 2 },
         title: '  ', started_at: 'x', scope: [] });
     assert.deepEqual(loose, { id: ID_A, kind: '', title: 'Background job', state: 'running', started_at: null, finished_at: null,
-        progress: 100, status_line: '', processed: 0, total: 0, counters: { added: 0, errors: 2 }, scope: {}, listed: {}, log_length: 0 });
+        progress: 100, status_line: '', processed: 0, total: 0, counters: { added: 0, errors: 2 }, scope: {}, listed: {}, log_length: 0,
+        cancellable: true });
     assert.equal(parseJob(summary({ progress: -3 })).progress, 0);
+    // A held legacy job cannot be cancelled; an older server sends no key, which keeps Cancel.
+    assert.equal(parseJob(summary({ cancellable: false })).cancellable, false);
+    assert.equal(parseJob(summary({ cancellable: true })).cancellable, true);
+    assert.equal(parseJob(summary()).cancellable, true);
 
     const scan = parseJob(summary({ progress: 42, processed: 8240, total: 19622, counters: { added: 1, errors: 1 } }));
     assert.deepEqual(pillParts(scan), { label: 'Scanning · 42%', files: ' · 8,240 / 19,622', text: 'Scanning · 42% · 8,240 / 19,622' });
@@ -283,6 +288,48 @@ test('summaries are validated and the copy follows the spec', async () => {
     assert.deepEqual([-1, 0, 1, 4, 5, 6, 1e9, 0.5].map(backoffDelay), [1000, 1000, 2000, 16000, 30000, 30000, 30000, 1000]);
 });
 
+// D89 (plan D66): an image tagging job's view has its own tiles, outcomes, openable rows, log and cancel labels.
+test('image-tags jobs get their own tiles outcomes and pill verb', async () => {
+    const { parseJob, jobView, pillParts, outcomeLine, startToast } = await source;
+    assert.equal(typeof jobView, 'function');
+    const job = parseJob(summary({ kind: 'image-tags', title: 'Auto-tag images', progress: 40, processed: 2, total: 5,
+        counters: { tagged: 1420, unchanged: 3, skipped: 2, errors: 1 }, scope: { mode: 'auto', images: 5, model_type: 'wd14-vit' } }));
+    const view = jobView(job.kind);
+    assert.deepEqual(view.tiles, [['tagged', 'Tagged', 'added'], ['unchanged', 'Unchanged', ''], ['skipped', 'Skipped', 'warn'],
+        ['errors', 'Errors', 'bad']]);
+    assert.deepEqual(view.outcomes, [['tagged', 'Tagged'], ['errors', 'Errors'], ['skipped', 'Skipped'], ['unchanged', 'Unchanged']]);
+    assert.deepEqual([...view.openable].sort(), ['tagged', 'unchanged']);
+    assert.equal(view.log, 'Tagging log');
+    assert.equal(view.cancel, 'Cancel tagging');
+    assert.deepEqual(pillParts(job), { label: 'Tagging · 40%', files: ' · 2 / 5', text: 'Tagging · 40% · 2 / 5' });
+    assert.equal(outcomeLine(job), '1,420 tagged · 1 error');
+    assert.equal(outcomeLine({ ...job, counters: {} }), '0 tagged · 0 errors');
+    assert.equal(startToast(job), 'Auto-tagging started.');
+    // The design's toast pattern, as the scan's: "<Job> finished · N tagged · M errors".
+    const { finishToast } = await source;
+    assert.equal(finishToast({ ...job, state: 'finished' }), 'Auto-tag images finished · 1,420 tagged · 1 error');
+    assert.equal(finishToast({ ...job, state: 'cancelled' }), 'Auto-tag images cancelled · 1,420 tagged');
+    assert.equal(finishToast({ ...job, state: 'failed' }), 'Auto-tag images failed · 1,420 tagged · 1 error');
+    assert.equal(finishToast({ ...job, title: 'Add tags to images', counters: {}, state: 'finished' }),
+        'Add tags to images finished · 0 tagged · 0 errors');
+});
+
+test('unknown kinds keep the generic view', async () => {
+    const { jobView } = await source;
+    const scan = jobView('scan');
+    assert.deepEqual(scan.tiles, [['added', 'Added to Library', 'added'], ['known', 'Already known', ''],
+        ['review', 'Needs review', 'warn'], ['no_metadata', 'No usable metadata', ''], ['errors', 'Errors', 'bad']]);
+    assert.deepEqual(scan.outcomes, [['added', 'Added to Library'], ['review', 'Needs review'], ['errors', 'Errors'],
+        ['no_metadata', 'No usable metadata'], ['known', 'Already known']]);
+    assert.deepEqual([...scan.openable].sort(), ['added', 'known']);
+    assert.deepEqual([scan.log, scan.cancel], ['Scan log', 'Cancel scan']);
+    for (const kind of ['maintenance', '', 'constructor', '__proto__']) {
+        const view = jobView(kind);
+        assert.deepEqual([view.tiles, view.outcomes, [...view.openable]], [scan.tiles, scan.outcomes, [...scan.openable]]);
+        assert.deepEqual([view.log, view.cancel], ['Job log', 'Cancel job']);
+    }
+});
+
 test('pagehide stops polling, closes streams and aborts the in-flight read; pageshow resumes', async () => {
     const { createActivityStore } = await source;
     const { world, api, ...deps } = harness();

tests/js/workspace-file-inspector.test.js

@@ -86,3 +86,280 @@ test('Show in folder outcomes use the D38 toasts',async()=>{
     for(const error of [{status:403,code:null},{status:409,code:'source-changed'},{status:415,code:'unsupported-media-type'},{status:429,code:null},{status:500},new TypeError('offline')])
         assert.equal(revealOutcome(error),'The folder could not be opened. Try again.');
 });
+
+// PR L2 Task 4(c): a record read in this browser renders the D66 local rail.
+const {mountedDom} = await import('./helpers/mounted-dom.mjs');
+const {createScope} = await import('../../web/js/shared/toolkit/core.js');
+const {createRequire} = await import('node:module');
+const fs = await import('node:fs');
+const require = createRequire(import.meta.url);
+const PngMetadata = require('../../web/js/png-metadata.js'), ComfyMetadata = require('../../web/js/comfy-metadata.js');
+const {raw:pngRaw, ihdr, idat, iend, tEXt} = await import('./helpers/png-bytes.mjs');
+const LOCAL_PROMPT = '{"3":{"class_type":"KSampler","inputs":{"seed":7,"steps":20,"cfg":8.0,"sampler_name":"euler","scheduler":"normal","denoise":1.0,"model":["4",0],"positive":["6",0],"negative":["7",0],"latent_image":["5",0]}},"4":{"class_type":"CheckpointLoaderSimple","inputs":{"ckpt_name":"synthetic-v1.safetensors"}},"5":{"class_type":"EmptyLatentImage","inputs":{"width":512,"height":512,"batch_size":1}},"6":{"class_type":"CLIPTextEncode","inputs":{"text":"a red fox in snow, detailed fur","clip":["4",1]}},"7":{"class_type":"CLIPTextEncode","inputs":{"text":"blurry, lowres","clip":["4",1]}}}';
+const LOCAL_URL = 'blob:http://localhost/11111111-2222-3333-4444-555555555555';
+const PARITY = new URL('../fixtures/inspection_parity/', import.meta.url);
+
+async function localRecord(file) {
+    const local = await import('../../web/js/workspace/local-inspection.mjs');
+    const previous = {png:globalThis.PngMetadata, comfy:globalThis.ComfyMetadata};
+    globalThis.PngMetadata = PngMetadata; globalThis.ComfyMetadata = ComfyMetadata;
+    try {
+        const classification = PngMetadata.classifyPrefix(new Uint8Array(await file.slice(0, 32).arrayBuffer()));
+        const handle = local.createLocalFileHandle({file, url:LOCAL_URL, classification});
+        return local.localFileAdapter.toRecord(await local.localFileAdapter.read(handle), handle, ComfyMetadata.extractGenerationFacts);
+    } finally {
+        if (previous.png === undefined) delete globalThis.PngMetadata; else globalThis.PngMetadata = previous.png;
+        if (previous.comfy === undefined) delete globalThis.ComfyMetadata; else globalThis.ComfyMetadata = previous.comfy;
+    }
+}
+const localPng = name => new File([pngRaw(ihdr(640, 480), idat(), tEXt('prompt', LOCAL_PROMPT), iend())], name, {type:'image/png', lastModified:1_700_000_000_000});
+function renderFull(record) {
+    const f = mountedDom(), scope = createScope();
+    const forbidden = new Proxy({}, {get(_, key) {assert.fail(`api.${String(key)} touched by a local record`);}});
+    const view = mountFileInspector(f.container, {api:forbidden, sender:{open() {}}, parentScope:scope, variant:'full'});
+    view.setState({loading:false, error:false, record});
+    const texts = predicate => f.walk(f.container, predicate).map(node => node.textContent);
+    return {f, texts, done() {view.dispose(); scope.dispose(); f.restore();}};
+}
+const {mountFileInspector} = await load();
+
+test('local record renders local provenance', async () => {
+    const record = await localRecord(localPng('Fox Render.png'));
+    const {f, texts, done} = renderFull(record);
+    try {
+        const section = f.walk(f.container, n => n.tagName === 'details' && n.children[0]?.textContent === 'File & provenance')[0];
+        assert.ok(section, 'the full variant has File & provenance');
+        const lines = f.walk(section, n => n.tagName === 'p').map(n => n.textContent);
+        assert.equal(lines[0], 'Selected local file · read in this browser');
+        assert.ok(lines.includes('Local file; no saved library association was checked.'));
+        assert.ok(!lines.some(line => /historical bytes|saved positive prompt|Saved association/.test(line)));
+        assert.deepEqual(f.walk(section, n => n.tagName === 'dt').map(n => n.textContent), ['Source', 'Size', 'Dimensions', 'Format', 'Media type', 'Modified']);
+        const values = Object.fromEntries(f.walk(section, n => n.tagName === 'dl')[0].children.map(row => [row.children[0].textContent, row.children[1].textContent]));
+        assert.equal(values.Source, 'Selected local file');
+        assert.equal(values.Dimensions, '640 × 480');
+        assert.equal(values.Format, 'PNG');
+        assert.equal(values['Media type'], 'image');
+        assert.equal(texts(n => n.tagName === 'button' && /Show .* in folder|Show in folder/.test(n.textContent)).length, 0);
+        assert.equal(f.walk(f.container, n => n.tagName === 'button' && n.textContent.includes('Prompt history')).length, 0);
+        const original = f.walk(section, n => n.tagName === 'a' && n.textContent === 'Download original')[0];
+        assert.ok(original, 'Download original is present');
+        assert.equal(original.href, LOCAL_URL);
+        assert.equal(original.download, 'Fox Render.png');
+        // The heading names the file itself; no library title replaces it.
+        assert.equal(f.walk(f.container, n => n.tagName === 'h2')[0].textContent, 'Fox Render.png');
+    } finally { done(); }
+});
+
+test('local record shows no image-tag chips', async () => {
+    const record = await localRecord(localPng('a.png'));
+    assert.equal(record.library.status, 'unavailable');
+    // A local payload carries no image_tags facet (#281), so the record has none and only linked chips could show.
+    assert.equal(record.imageTags, null);
+    const {inspectorTagChips} = await load();
+    assert.deepEqual(inspectorTagChips(record, {filterable:true}), []);
+    const {f, done} = renderFull(record);
+    try {
+        // Only the format chip and the D21 evidence badge: no category, saved tag or image-tag chips.
+        const chips = f.walk(f.container, n => /(^| )chip( |$)/.test(n.className ?? '')).map(n => n.textContent);
+        assert.deepEqual(chips, ['PNG', 'Workflow inferred']);
+        assert.equal(f.walk(f.container, n => n.tagName === 'button' && /^Tag/.test(n.textContent)).length, 0);
+    } finally { done(); }
+});
+
+test('legacy fill applies to local records', async () => {
+    // f09: the server's inspection is ambiguous; the local record shows the legacy parse, labelled as inferred.
+    const ambiguous = await localRecord(new File([fs.readFileSync(new URL('f09.png', PARITY))], 'f09.png'));
+    const graphs = {prompt:ambiguous.metadata.prompt_graph.value, workflow:ambiguous.metadata.workflow_graph.status === 'parsed' ? ambiguous.metadata.workflow_graph.value : null};
+    const legacy = ComfyMetadata.extractGenerationParams(graphs);
+    assert.deepEqual(ambiguous.prompts.positive, {status:'resolved', text:legacy.positivePrompt, source:'graph-inferred'});
+    assert.deepEqual(ambiguous.prompts.negative, {status:'resolved', text:legacy.negativePrompt, source:'graph-inferred'});
+    assert.equal(ambiguous.prompts.positive.text, 'a red fox in snow, detailed fur');
+    const view = renderFull(ambiguous);
+    try {
+        assert.deepEqual(view.texts(n => n.className === 'chip blue'), ['Workflow inferred']);
+        assert.ok(view.texts(n => n.tagName === 'p').includes('Prompt evidence: workflow inferred'));
+    } finally { view.done(); }
+    // f01b: the legacy parse would read the positive text through ConditioningZeroOut; the guard shows the zeroed negative.
+    const zeroed = await localRecord(new File([fs.readFileSync(new URL('f01b.png', PARITY))], 'f01b.png'));
+    assert.deepEqual(zeroed.prompts.negative, {status:'resolved', text:'', source:'zeroed-conditioning'});
+    assert.notEqual(zeroed.prompts.positive.text, '');
+});
+
+// #249 PR C Task C3 (D88): one chip row, the file's current image tags first, then D21's linked tags not already shown.
+function tagged(imageTags, library = {status:'linked', tags:['Minimal', 'warm_light', 'editorial'], tags_scope:'positive'}) {
+    return {...record(), imageTags, library};
+}
+test('renders current image tags before linked tags without duplicates', async () => {
+    const {inspectorTagChips} = await load();
+    assert.equal(typeof inspectorTagChips, 'function', 'inspectorTagChips is exported');
+    assert.deepEqual(inspectorTagChips(tagged({state:'current', tags:['dunes', 'minimal']}), {filterable:true}),
+        [{name:'dunes', filter:true}, {name:'minimal', filter:true}, {name:'warm_light', filter:true}, {name:'editorial', filter:true}]);
+    // D21's rule still decides the linked chips: a recipe's own tags stay plain, an image tag stays a filter.
+    assert.deepEqual(inspectorTagChips(tagged({state:'current', tags:['Editorial']}, {status:'linked', tags:['editorial', 'cover'], tags_scope:'pair'}), {filterable:true}),
+        [{name:'Editorial', filter:true}, {name:'cover', filter:false}]);
+    // An unlinked file shows only its own tags; a facet-less record (history, local) only the linked ones.
+    assert.deepEqual(inspectorTagChips(tagged({state:'current', tags:['loose']}, {status:'none', tags:[], tags_scope:null}), {filterable:true}), [{name:'loose', filter:true}]);
+    assert.deepEqual(inspectorTagChips(tagged(null), {filterable:true}).map(chip => chip.name), ['Minimal', 'warm_light', 'editorial']);
+    assert.deepEqual(inspectorTagChips(tagged({state:'current', tags:[]}, {status:'ambiguous', tags:['x'], tags_scope:'positive'}), {filterable:true}), []);
+});
+test('image tag chips filter in the panel and are plain in the viewer', async () => {
+    const {inspectorTagChips} = await load();
+    const source = tagged({state:'current', tags:['dunes']});
+    assert.deepEqual(inspectorTagChips(source, {filterable:true}).map(chip => chip.filter), [true, true, true, true]);
+    assert.deepEqual(inspectorTagChips(source, {filterable:false}).map(chip => chip.filter), [false, false, false, false]);
+});
+test('none and unavailable render no image chips', async () => {
+    const {inspectorTagChips} = await load();
+    for (const state of ['none', 'unavailable']) {
+        assert.deepEqual(inspectorTagChips(tagged({state, tags:[]}), {filterable:true}).map(chip => chip.name), ['Minimal', 'warm_light', 'editorial']);
+        assert.deepEqual(inspectorTagChips(tagged({state, tags:[]}, {status:'none', tags:[], tags_scope:null}), {filterable:true}), []);
+    }
+});
+
+// LI-4 (D117): "Copy settings summary" after the six facts of the full inspector consolidates the legacy metadata
+// page's COPY ALL (web/metadata.html copyAllData). The legacy template is read from that page itself and run on the
+// legacy parse, so the summary's text is the legacy page's, line for line, wherever the two agree on the values.
+const METADATA_PAGE = fs.readFileSync(new URL('../../web/metadata.html', import.meta.url), 'utf8');
+function legacyCopyAll(params) {
+    const template = METADATA_PAGE.match(/const allData = `([\s\S]*?)`;/)[1];
+    return new Function('currentWorkflowData', `return \`${template}\`;`)(params);
+}
+const legacyParams = record => ComfyMetadata.extractGenerationParams({prompt:record.metadata.prompt_graph.status === 'parsed' ? record.metadata.prompt_graph.value : null,
+    workflow:record.metadata.workflow_graph.status === 'parsed' ? record.metadata.workflow_graph.value : null});
+
+/**
+ * Each summary line against the legacy page's, allowing only the recorded differences (D117): a number keeps the
+ * inspector's (the server's) spelling ("8.0" where the legacy page wrote 8); a fact the legacy parse left "Unknown" may
+ * be known; and a negative the #249 ZeroOut guard zeroed reads "No negative prompt found" where the legacy parse read
+ * the positive's text through the zero-out.
+ */
+function assertLegacySummary(summary, legacy, record) {
+    const lines = summary.split('\n'), expected = legacy.split('\n');
+    assert.deepEqual(lines.map(line => line.split(':')[0]), expected.map(line => line.split(':')[0]), 'the legacy labels, in order');
+    lines.forEach((line, index) => {
+        if (line === expected[index]) return;
+        const [label, value] = [line.slice(0, line.indexOf(': ')), line.slice(line.indexOf(': ') + 2)];
+        const old = expected[index].slice(label.length + 2);
+        if (label === 'Negative Prompt' && record.prompts.negative?.source === 'zeroed-conditioning' && value === 'No negative prompt found') return;
+        if (old === 'Unknown' && !/Prompt$/.test(label)) return;
+        assert.ok(value.trim() !== '' && Number(value) === Number(old), `${label}: "${value}" differs from the legacy "${old}"`);
+    });
+}
+
+test('settings summary is the legacy COPY ALL text for a local file', async () => {
+    const {settingsSummary} = await load();
+    assert.equal(typeof settingsSummary, 'function', 'settingsSummary is exported');
+    const record = await localRecord(localPng('fox.png'));
+    assertLegacySummary(settingsSummary(record), legacyCopyAll(legacyParams(record)), record);
+    assert.equal(settingsSummary(record), ['Checkpoint: synthetic-v1.safetensors', 'Positive Prompt: a red fox in snow, detailed fur',
+        'Negative Prompt: blurry, lowres', 'Steps: 20', 'CFG Scale: 8.0', 'Sampler: euler', 'Seed: 7'].join('\n'));
+    // Every parity PNG read in this browser: the legacy page's text but for the recorded differences, and exactly the
+    // legacy text for most of them (f09 among them: the server is ambiguous, so the record shows the legacy fill).
+    const exact = [];
+    for (const name of fs.readdirSync(PARITY).filter(item => item.endsWith('.png')).sort()) {
+        const parity = await localRecord(new File([fs.readFileSync(new URL(name, PARITY))], name));
+        const summary = settingsSummary(parity), legacy = legacyCopyAll(legacyParams(parity));
+        assertLegacySummary(summary, legacy, parity);
+        if (summary === legacy) exact.push(name);
+    }
+    assert.ok(exact.includes('f09.png'));
+    assert.deepEqual(fs.readdirSync(PARITY).filter(item => item.endsWith('.png') && !exact.includes(item)).sort(), ['f01b.png', 'f17.png', 'f23.png']);
+});
+
+test('settings summary uses the legacy placeholders for what the record does not know', async () => {
+    const {settingsSummary} = await load();
+    const unknown = {...record(), prompts:{positive:{status:'unresolved'}, negative:{status:'ambiguous'}}, generation:{}};
+    assert.equal(settingsSummary(unknown), legacyCopyAll({}).replace('Positive Prompt: undefined', 'Positive Prompt: No prompt found')
+        .replace('Negative Prompt: undefined', 'Negative Prompt: No negative prompt found'));
+    assert.equal(settingsSummary(unknown), ['Checkpoint: Unknown', 'Positive Prompt: No prompt found', 'Negative Prompt: No negative prompt found',
+        'Steps: Unknown', 'CFG Scale: Unknown', 'Sampler: Unknown', 'Seed: Unknown'].join('\n'));
+    // A server answer is shown as the inspector shows it: known facts verbatim, every other state the legacy "Unknown".
+    const server = {...record(), prompts:{positive:{status:'resolved', text:'a\n猫'}, negative:{status:'resolved', text:''}}, generation:{
+        model:{status:'known', value:'m.safetensors'}, steps:{status:'not-recorded', value:null}, cfg:{status:'known', value:'6.50'},
+        sampler:{status:'ambiguous', value:null}, seed:{status:'known', value:'9007199254740993'}, scheduler:{status:'known', value:'karras'}}};
+    assert.equal(settingsSummary(server), ['Checkpoint: m.safetensors', 'Positive Prompt: a\n猫', 'Negative Prompt: No negative prompt found',
+        'Steps: Unknown', 'CFG Scale: 6.50', 'Sampler: Unknown', 'Seed: 9007199254740993'].join('\n'));
+});
+
+/** The full inspector with a toast node and `clipboard` as `navigator.clipboard`; returns the summary button. */
+function renderSummary(record, {variant = 'full', clipboard} = {}) {
+    const f = mountedDom(), scope = createScope(), fallbacks = [], toast = new f.Node('div');
+    f.doc.getElementById = id => id === 'workspace-toast' ? toast : null;
+    const previous = Object.getOwnPropertyDescriptor(globalThis, 'navigator');
+    Object.defineProperty(globalThis, 'navigator', {configurable:true, value:clipboard === undefined ? {} : {clipboard}});
+    const view = mountFileInspector(f.container, {sender:{open() {}}, parentScope:scope, variant, copyFallback:(text, options) => fallbacks.push({text, ...options})});
+    view.setState({loading:false, error:false, record});
+    const button = f.walk(f.container, n => n.tagName === 'button' && n.textContent === 'Copy settings summary')[0] ?? null;
+    return {f, button, toast, fallbacks, scope, done() {
+        view.dispose(); scope.dispose(); f.restore();
+        if (previous) Object.defineProperty(globalThis, 'navigator', previous); else delete globalThis.navigator;
+    }};
+}
+
+test('Copy settings summary follows the facts in the full inspector only', async () => {
+    const full = renderSummary(record());
+    try {
+        assert.ok(full.button, 'the full inspector offers Copy settings summary');
+        const inner = full.button.parent, index = inner.children.indexOf(full.button);
+        assert.equal(inner.children[index - 1].tagName, 'dl', 'it follows the six facts');
+        assert.equal(inner.children[index + 1].tagName, 'details', 'File & provenance follows it');
+        // M7: the D117 wrap rule targets this button by its class, never any button of a details block.
+        assert.equal(full.button.className, 'settings-summary');
+    } finally { full.done(); }
+    const panel = renderSummary(record(), {variant:'panel'});
+    try { assert.equal(panel.button, null, 'the Images side panel keeps the concept footer'); } finally { panel.done(); }
+});
+
+test('Copy settings summary copies the summary and shows the shared toast', async () => {
+    const {settingsSummary} = await load(), copied = [];
+    const view = renderSummary(record(), {clipboard:{writeText:async text => {copied.push(text);}}});
+    try {
+        await view.button.listeners.get('click')[0].callback({target:view.button});
+        assert.deepEqual(copied, [settingsSummary(record())]);
+        assert.equal(view.toast.textContent, 'Settings summary copied.');
+        assert.equal(view.fallbacks.length, 0);
+    } finally { view.done(); }
+});
+
+test('Copy settings summary without a clipboard opens the select-to-copy fallback', async () => {
+    const {settingsSummary} = await load();
+    for (const clipboard of [undefined, {writeText:async () => {throw new Error('Denied');}}]) {
+        const view = renderSummary(record(), {clipboard});
+        try {
+            await view.button.listeners.get('click')[0].callback({target:view.button});
+            assert.equal(view.fallbacks.length, 1);
+            assert.equal(view.fallbacks[0].text, settingsSummary(record()));
+            assert.equal(view.fallbacks[0].title, 'Copy settings summary');
+            assert.equal(view.fallbacks[0].trigger, view.button);
+            assert.notEqual(view.toast.textContent, 'Settings summary copied.');
+        } finally { view.done(); }
+    }
+});
+
+test('the inspector is busy while a read is loading, then not', async () => {
+    const f = mountedDom(), scope = createScope();
+    const view = mountFileInspector(f.container, {sender:{open() {}}, parentScope:scope, variant:'full'});
+    try {
+        view.setState({loading:true, error:false, record:null});
+        assert.equal(f.container.getAttribute('aria-busy'), 'true');
+        assert.ok(f.walk(f.container, n => n.textContent === 'Loading file details…').length);
+        view.setState({loading:false, error:false, record:record()});
+        assert.equal(f.container.getAttribute('aria-busy'), null);
+        view.setState({loading:true, error:false, record:null});
+        view.setState({loading:false, error:true, record:null});
+        assert.equal(f.container.getAttribute('aria-busy'), null);
+        view.setState({loading:true, error:false, record:null});
+    } finally {
+        view.dispose();
+        assert.equal(f.container.getAttribute('aria-busy'), null, 'dispose clears the busy state');
+        scope.dispose(); f.restore();
+    }
+});
+
+test('the D117 wrap rule targets only the settings summary button', async () => {
+    const fs = await import('node:fs');
+    const css = fs.readFileSync(new URL('../../web/js/workspace/workspace.css', import.meta.url), 'utf8');
+    const rules = css.split('\n').filter(line => line.includes('D117'));
+    assert.deepEqual(rules.map(line => line.trim()), ['.ca-tools #viewer-details .settings-summary { white-space: normal; /* D117 */ }']);
+    assert.doesNotMatch(css, /#viewer-details > div > button/);
+});

tests/js/workspace-image-layout.test.js

@@ -149,3 +149,15 @@ test('a narrow gallery caps the concept columns at the smallest readable card',
     }
     assert.equal(layoutImages([{}], 990, 'list', {columns:3}).columns, 1);
 });
+
+test('the card info stacks below the narrowest bounded card, a list row beside its art too (D31)', async () => {
+    const {stacksCardInfo} = await source;
+    assert.equal(typeof stacksCardInfo, 'function', 'stacksCardInfo is not implemented');
+    assert.equal(stacksCardInfo(119, 'grid'), true);
+    assert.equal(stacksCardInfo(120, 'grid'), false);
+    assert.equal(stacksCardInfo(119, 'masonry'), true);
+    // A list row's info is what its art (160px, at most 45%) leaves: 195px at 200% zoom on a phone leaves 107px.
+    assert.equal(stacksCardInfo(195, 'list'), true);
+    assert.equal(stacksCardInfo(280, 'list'), false);
+    assert.equal(stacksCardInfo(358, 'list'), false);
+});

tests/js/workspace-image-tagging-state.test.js

@@ -0,0 +1,769 @@
+// Run with: node --test tests/js/workspace-image-tagging-state.test.js
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const { createApiClient } = require('../../web/js/api-client.js');
+
+// Only an absent module is tolerated, so RED is an assertion failure, not a crash.
+const source = import('../../web/js/workspace/image-tagging-state.mjs').catch(error => {
+    if (error.code !== 'ERR_MODULE_NOT_FOUND') throw error;
+    return {};
+});
+async function load() {
+    const module = await source;
+    assert.equal(typeof module.createImageTaggingController, 'function', 'image-tagging-state.mjs is not implemented');
+    return module;
+}
+
+const EPOCH = '11111111-1111-4111-8111-111111111111';
+const SCOPE = 'c'.repeat(64);
+const SHA = 'd'.repeat(64);
+const TOKEN = 'capture-token_1';
+const TOKEN2 = 'capture-token_2';
+const TARGET = Object.freeze({ root_index: 0, root_scope: SCOPE, path: 'dunes/dunes_00001.png' });
+const OBSERVE = '/prompt_manager/image-annotations/observe';
+const SUGGEST = '/prompt_manager/image-annotations/suggest';
+const TAGS = '/prompt_manager/image-annotations/tags';
+const MODELS = '/prompt_manager/autotag/models';
+const CAPTURE = '/prompt_manager/image-annotations/capture/';
+const DEFAULT_PROMPT = 'Generate only comma-separated Danbooru tags (lowercase_underscores, no spaces).';
+
+const flush = () => new Promise(resolve => setImmediate(resolve));
+async function settle(times = 8) { for (let i = 0; i < times; i++) await flush(); }
+function deferred() {
+    let resolve, reject;
+    const promise = new Promise((yes, no) => { resolve = yes; reject = no; });
+    return { promise, resolve, reject };
+}
+function response(status, body) {
+    return { ok: status >= 200 && status < 300, status, statusText: `Status ${status}`, json: async () => body };
+}
+const fail = (status, code, error = `failure ${code}`, extra = {}) => response(status, { success: false, code, error, ...extra });
+
+function captureInfo(overrides = {}) {
+    return {
+        token: TOKEN, expires_at: '2026-10-22T12:00:00+00:00', preview_url: CAPTURE + (overrides.token || TOKEN),
+        sha256: SHA, size: 1234, width: 832, height: 1216, media_type: 'image',
+        generate: { supported: true, reason: null }, ...overrides,
+    };
+}
+function observed(overrides = {}, capture = {}) {
+    return {
+        success: true, library_epoch: EPOCH, target: { ...TARGET }, capture: captureInfo(capture),
+        title: 'Desert pavilion', filename: 'dunes_00001.png', tags: ['Minimal', 'warm_light'], tag_revision: 3,
+        ...overrides,
+    };
+}
+const models = (overrides = {}) => ({
+    success: true, models: { 'wd14-swinv2': { downloaded: true } }, default_prompt: DEFAULT_PROMPT,
+    wd14_general_threshold: 0.35, wd14_character_threshold: 0.85, suggestion_limit: 10, ...overrides,
+});
+const SANDSTONE = [
+    { name: 'minimal', confidence: 0.99 }, { name: 'editorial', confidence: 0.97 },
+    { name: 'sandstone', confidence: 0.981 }, { name: 'Editorial', confidence: 0.5 },
+];
+const suggested = (rows = SANDSTONE, overrides = {}) => ({ success: true, model_type: 'wd14-swinv2', options: {}, suggestions: rows, ...overrides });
+const receipt = (tags, overrides = {}) => ({ success: true, library_epoch: EPOCH, sha256: SHA, tags, tag_revision: 4, replayed: false, ...overrides });
+
+/** Real createApiClient over a fetch whose answers come from routes[METHOD URL](call). */
+function harness(routes = {}) {
+    const calls = [];
+    const fetch = (url, init = {}) => {
+        const call = { url, method: init.method, init, body: init.body === undefined ? undefined : JSON.parse(init.body), aborted: false, signal: init.signal };
+        calls.push(call);
+        return new Promise((resolve, reject) => {
+            init.signal?.addEventListener('abort', () => {
+                call.aborted = true;
+                reject(new DOMException('The operation was aborted.', 'AbortError'));
+            });
+            const key = `${call.method} ${url.startsWith(CAPTURE) ? CAPTURE : url}`;
+            const route = routes[key];
+            Promise.resolve().then(() => {
+                if (!route) return response(200, { success: true });
+                return route(call);
+            }).then(resolve, reject);
+        });
+    };
+    return {
+        api: createApiClient(fetch), calls,
+        of: (method, url) => calls.filter(call => call.method === method && (url === CAPTURE ? call.url.startsWith(CAPTURE) : call.url === url)),
+    };
+}
+function defaultRoutes(extra = {}) {
+    return {
+        [`POST ${OBSERVE}`]: () => response(200, observed()),
+        [`GET ${MODELS}`]: () => response(200, models()),
+        [`POST ${SUGGEST}`]: () => response(200, suggested()),
+        [`PUT ${TAGS}`]: call => response(200, receipt(call.body.tags)),
+        ...extra,
+    };
+}
+async function opened(routes, options = {}) {
+    const { createImageTaggingController } = await load();
+    const h = harness(defaultRoutes(routes));
+    const c = createImageTaggingController({ api: h.api, target: TARGET, source: 'images', ...options });
+    await c.open();
+    await settle();
+    return { c, h };
+}
+
+test('MODEL_OPTIONS lists legacy engines in mock order with D84 labels', async () => {
+    const { MODEL_OPTIONS } = await load();
+    assert.deepEqual(MODEL_OPTIONS.map(option => [option.id, option.label]), [
+        ['wd14-swinv2', 'WD14 SwinV2 · ~400 MB'],
+        ['wd14-vit', 'WD14 ViT · ~400 MB'],
+        ['gguf', 'GGUF JoyCaption (Recommended) · ~4.5 GB'],
+        ['hf', 'HuggingFace JoyCaption · ~16 GB'],
+    ]);
+    assert.ok(Object.isFrozen(MODEL_OPTIONS) && Object.isFrozen(MODEL_OPTIONS[0]));
+});
+
+test('dedupeTags trims, drops blanks and keeps the first spelling case-insensitively', async () => {
+    const { dedupeTags, parseManualTags } = await load();
+    const input = [' Minimal ', 'minimal', '', 'warm_light', 'WARM_LIGHT', 7, 'dune'];
+    assert.deepEqual(dedupeTags(input), ['Minimal', 'warm_light', 'dune']);
+    assert.deepEqual(input[0], ' Minimal ', 'input is not mutated');
+    assert.deepEqual(dedupeTags(undefined), []);
+    assert.deepEqual(parseManualTags(' a, ,B , b,c '), ['a', 'B', 'c']);
+    assert.deepEqual(parseManualTags(null), []);
+});
+
+test('the controller rejects a malformed target, source or api', async () => {
+    const { createImageTaggingController } = await load();
+    const { api } = harness();
+    assert.throws(() => createImageTaggingController({ api, target: { ...TARGET, root_index: true } }), TypeError);
+    assert.throws(() => createImageTaggingController({ api, target: { ...TARGET, root_scope: 'x' } }), TypeError);
+    assert.throws(() => createImageTaggingController({ api, target: { ...TARGET, path: '' } }), TypeError);
+    assert.throws(() => createImageTaggingController({ api, target: TARGET, source: 'elsewhere' }), TypeError);
+    assert.throws(() => createImageTaggingController({ api: {}, target: TARGET }), TypeError);
+    assert.throws(() => createImageTaggingController(), TypeError);
+});
+
+test('opens with saved tags joined by comma-space', async () => {
+    const { createImageTaggingController } = await load();
+    const h = harness(defaultRoutes());
+    const c = createImageTaggingController({ api: h.api, target: TARGET, source: 'images' });
+    const seen = [];
+    const unsubscribe = c.subscribe(state => seen.push(state.phase));
+    assert.equal(c.state.phase, 'observing');
+    const pending = c.open();
+    assert.equal(c.state.phase, 'observing');
+    await pending;
+    await settle();
+    assert.equal(c.state.phase, 'ready');
+    assert.equal(c.state.manual, 'Minimal, warm_light');
+    assert.deepEqual(c.state.savedTags, ['Minimal', 'warm_light']);
+    assert.equal(c.state.image.filename, 'dunes_00001.png');
+    assert.equal(c.state.image.title, 'Desert pavilion');
+    assert.equal(c.state.image.dimensions, '832 × 1216');
+    assert.equal(c.state.image.previewUrl, CAPTURE + TOKEN);
+    assert.equal(c.state.model, 'wd14-swinv2');
+    assert.equal(c.state.countText, 'Not generated');
+    assert.equal(c.state.primaryLabel, 'Save manual tags');
+    assert.equal(c.state.suggestionsText, 'Generate suggestions with the selected model before approving.');
+    assert.equal(c.state.showScopeNote, false);
+    assert.equal(c.state.canSave, true);
+    assert.equal(c.state.canGenerate, true);
+    assert.ok(Object.isFrozen(c.state));
+    assert.deepEqual(h.of('POST', OBSERVE)[0].body, { target: { ...TARGET } });
+    assert.ok(seen.includes('ready'));
+    unsubscribe();
+    c.setManual('x');
+    assert.equal(seen.at(-1), 'ready', 'an unsubscribed listener is not called');
+    assert.throws(() => c.subscribe('nope'), TypeError);
+});
+
+test('an image without known dimensions shows none and an unseen file starts empty', async () => {
+    const { c } = await opened({
+        [`POST ${OBSERVE}`]: () => response(200, observed({ tags: [], tag_revision: 0, title: null }, { width: null, height: null })),
+    });
+    assert.equal(c.state.image.dimensions, null);
+    assert.equal(c.state.manual, '');
+    assert.equal(c.state.image.title, null);
+});
+
+test('instructions default to the server prompt', async () => {
+    const { c } = await opened({
+        [`GET ${MODELS}`]: () => response(200, models({ suggestion_limit: 7, wd14_general_threshold: 0.5 })),
+    });
+    assert.equal(c.state.options.instructions, DEFAULT_PROMPT);
+    assert.equal(c.state.options.suggestion_limit, 7);
+    assert.equal(c.state.options.general_threshold, 0.5);
+    assert.equal(c.state.options.character_threshold, 0.85);
+    c.setModel('gguf');
+    assert.equal(c.state.options.instructions, DEFAULT_PROMPT);
+    c.setOption('instructions', 'only colours');
+    c.setModel('hf');
+    assert.equal(c.state.options.instructions, DEFAULT_PROMPT, 'a model change re-renders the defaults like the mock');
+    assert.equal(c.state.options.suggestion_limit, 7, 'the suggestion count survives a model change');
+});
+
+test('an unreadable or malformed models read falls back to the documented defaults', async () => {
+    for (const route of [() => fail(500, null), () => response(200, models({ default_prompt: 4, suggestion_limit: 0, wd14_general_threshold: 2, wd14_character_threshold: 'x' }))]) {
+        const { c } = await opened({ [`GET ${MODELS}`]: route });
+        assert.equal(c.state.phase, 'ready');
+        assert.deepEqual({ ...c.state.options }, { general_threshold: 0.35, character_threshold: 0.85, instructions: '', suggestion_limit: 10 });
+    }
+});
+
+test('observe failures and malformed answers end in observe-error and retry observes again', async () => {
+    const { createImageTaggingController } = await load();
+    let answer = () => fail(409, 'source-changed', 'The source changed. Refresh the image collection before tagging this file.');
+    const h = harness(defaultRoutes({ [`POST ${OBSERVE}`]: () => answer() }));
+    const c = createImageTaggingController({ api: h.api, target: TARGET });
+    await c.open();
+    assert.equal(c.state.phase, 'observe-error');
+    assert.equal(c.state.statusText, 'The source changed. Refresh the image collection before tagging this file.');
+    assert.equal(c.state.canSave, false);
+    assert.equal(c.state.canGenerate, false);
+    assert.equal(c.state.canRetry, true);
+    answer = () => response(200, observed({ tag_revision: -1 }));
+    await c.retry();
+    assert.equal(c.state.phase, 'observe-error');
+    assert.equal(c.state.statusText, 'The image could not be opened for tagging.');
+    assert.equal(h.of('DELETE', CAPTURE).length, 1, 'a malformed answer still releases its capture');
+    answer = () => Promise.reject(new TypeError('Failed to fetch'));
+    await c.retry();
+    assert.equal(c.state.statusText, 'The image could not be opened for tagging.');
+    answer = () => response(200, observed());
+    await c.retry();
+    await settle();
+    assert.equal(c.state.phase, 'ready');
+    assert.equal(h.of('POST', OBSERVE).length, 4);
+});
+
+test('model change clears suggestions count and status but keeps manual', async () => {
+    const { c } = await opened();
+    c.setManual('Minimal, dune');
+    await c.generate();
+    assert.equal(c.state.countText, '3 suggestions');
+    c.setModel('wd14-vit');
+    assert.deepEqual(c.state.suggestions, []);
+    assert.equal(c.state.countText, 'Not generated');
+    assert.equal(c.state.statusText, '');
+    assert.equal(c.state.suggestionsText, 'Generate suggestions with the selected model before approving.');
+    assert.equal(c.state.manual, 'Minimal, dune');
+    assert.equal(c.state.model, 'wd14-vit');
+    c.setModel('wd14-vit');
+    assert.equal(c.state.model, 'wd14-vit');
+    assert.throws(() => c.setModel('ollama'), TypeError);
+    assert.throws(() => c.setOption('model', 1), TypeError);
+});
+
+test('generate sends the model options and stages scored chips', async () => {
+    const { c, h } = await opened();
+    c.setOption('general_threshold', '0.4');
+    c.setOption('suggestion_limit', '3');
+    assert.equal(await c.generate(), true);
+    const sent = h.of('POST', SUGGEST)[0].body;
+    assert.deepEqual(sent, {
+        target: { ...TARGET }, capture_token: TOKEN, expected_epoch: EPOCH, model_type: 'wd14-swinv2',
+        options: { general_threshold: 0.4, character_threshold: 0.85, suggestion_limit: 3 },
+    });
+    assert.deepEqual(c.state.suggestions.map(row => [row.name, row.label]), [['minimal', '99%'], ['editorial', '97%'], ['sandstone', '98%']]);
+    assert.equal(c.state.statusText, 'Suggestions from WD14 SwinV2 · ~400 MB. Approve tags to save.');
+    assert.equal(c.state.suggestionsText, '');
+    c.setModel('gguf');
+    await c.generate();
+    assert.deepEqual(h.of('POST', SUGGEST)[1].body.options, { instructions: DEFAULT_PROMPT, suggestion_limit: 3 });
+});
+
+test('language models label chips Suggested and the count is capped at the requested limit', async () => {
+    const rows = Array.from({ length: 12 }, (_, i) => ({ name: `tag${i}`, confidence: null }));
+    const { c } = await opened({ [`POST ${SUGGEST}`]: () => response(200, suggested(rows, { model_type: 'gguf' })) });
+    c.setModel('gguf');
+    await c.generate();
+    assert.equal(c.state.suggestions.length, 10);
+    assert.ok(c.state.suggestions.every(row => row.label === 'Suggested' && row.confidence === null));
+    assert.equal(c.state.countText, '10 suggestions');
+});
+
+test('an empty result shows the threshold copy and a malformed one is a generate error', async () => {
+    let answer = () => response(200, suggested([]));
+    const { c } = await opened({ [`POST ${SUGGEST}`]: () => answer() });
+    await c.generate();
+    assert.equal(c.state.suggestionsText, 'No suggestions met this threshold. Adjust it or enter tags manually.');
+    assert.equal(c.state.countText, '0 suggestions');
+    assert.equal(c.state.primaryLabel, 'Approve selected tags');
+    answer = () => response(200, suggested([{ name: 4, confidence: 2 }]));
+    await c.generate();
+    assert.equal(c.state.phase, 'generate-error');
+    assert.equal(c.state.statusText, 'Auto-tagging failed. Check server logs for details.');
+    answer = () => response(200, suggested([{ name: 'one', confidence: 1 }]));
+    assert.equal(await c.retry(), true, 'retry after a generate error generates again');
+    assert.equal(c.state.countText, '1 suggestion');
+    assert.equal(c.state.suggestions[0].label, '100%');
+});
+
+test('invalid options send nothing', async () => {
+    const { c, h } = await opened();
+    const { optionError } = await load();
+    for (const [key, value] of [['general_threshold', '1.5'], ['general_threshold', ''], ['character_threshold', 'abc'], ['suggestion_limit', '0'], ['suggestion_limit', '2.5'], ['suggestion_limit', '101']]) {
+        c.setOption('general_threshold', 0.35);
+        c.setOption('character_threshold', 0.85);
+        c.setOption('suggestion_limit', 10);
+        c.setOption(key, value);
+        assert.equal(await c.generate(), false, `${key}=${value}`);
+        assert.equal(optionError(c.state.model, c.state.options).field, key);
+    }
+    c.setModel('gguf');
+    c.setOption('instructions', '   ');
+    assert.equal(await c.generate(), false);
+    c.setOption('instructions', 'x'.repeat(4001));
+    assert.equal(await c.generate(), false);
+    assert.equal(optionError('gguf', c.state.options).field, 'instructions');
+    assert.equal(h.of('POST', SUGGEST).length, 0);
+    assert.equal(optionError('wd14-vit', { general_threshold: 0, character_threshold: 1, suggestion_limit: 100 }), null);
+});
+
+test('late generation for an old serial, closed or expired dialog is ignored', async () => {
+    const pending = [];
+    const { c, h } = await opened({ [`POST ${SUGGEST}`]: () => { const d = deferred(); pending.push(d); return d.promise; } });
+    const first = c.generate();
+    assert.equal(c.state.phase, 'generating');
+    assert.equal(c.state.statusText, 'Generating suggestions…');
+    assert.equal(c.state.canSave, false);
+    c.setModel('wd14-vit');
+    assert.equal(c.state.phase, 'ready');
+    assert.equal(h.of('POST', SUGGEST)[0].aborted, true);
+    await settle();
+    pending[0].resolve(response(200, suggested()));
+    assert.equal(await first, false);
+    assert.equal(c.state.phase, 'ready', 'the superseded request neither stages chips nor reports its abort');
+    assert.equal(c.state.statusText, '');
+    assert.deepEqual(c.state.suggestions, []);
+    assert.equal(c.state.countText, 'Not generated');
+
+    const second = c.generate();
+    c.cancel();
+    await settle();
+    pending[1].resolve(response(200, suggested()));
+    assert.equal(await second, false);
+    assert.deepEqual(c.state.suggestions, []);
+    assert.equal(c.state.closed, true);
+    assert.equal(await c.generate(), false, 'a closed dialog never generates');
+
+    const expired = await opened({ [`POST ${SUGGEST}`]: () => fail(409, 'capture-expired', 'The preview expired. Open the Tag dialog again.') });
+    await expired.c.generate();
+    assert.equal(expired.c.state.phase, 'capture-expired');
+    assert.equal(expired.c.state.canSave, false);
+    assert.equal(expired.c.state.canGenerate, false);
+});
+
+test('a reopen while observing ignores the older observation and releases its capture', async () => {
+    const { createImageTaggingController } = await load();
+    const answers = [deferred(), deferred()];
+    let n = 0;
+    const h = harness(defaultRoutes({ [`POST ${OBSERVE}`]: () => answers[n++].promise }));
+    const c = createImageTaggingController({ api: h.api, target: TARGET });
+    const one = c.open();
+    const two = c.open();
+    answers[1].resolve(response(200, observed({}, { token: TOKEN2 })));
+    await two;
+    answers[0].resolve(response(200, observed()));
+    await one;
+    await settle();
+    assert.equal(c.state.image.previewUrl, CAPTURE + TOKEN2);
+    assert.deepEqual(h.of('DELETE', CAPTURE).map(call => call.url), [CAPTURE + TOKEN]);
+    c.dispose();
+    assert.deepEqual(h.of('DELETE', CAPTURE).map(call => call.url), [CAPTURE + TOKEN, CAPTURE + TOKEN2]);
+});
+
+test('primary label toggles Save manual tags / Approve selected tags', async () => {
+    const { c } = await opened();
+    assert.equal(c.state.primaryLabel, 'Save manual tags');
+    await c.generate();
+    assert.equal(c.state.primaryLabel, 'Approve selected tags'); c.setModel('wd14-vit'); assert.equal(c.state.primaryLabel, 'Save manual tags');
+    assert.equal(c.state.countText, 'Not generated');
+});
+
+test('remove drops one chip and the last removal shows the all-removed copy', async () => {
+    const { c } = await opened();
+    await c.generate();
+    c.remove('editorial');
+    assert.deepEqual(c.state.suggestions.map(row => row.name), ['minimal', 'sandstone']);
+    assert.equal(c.state.countText, '2 suggestions');
+    c.remove('missing');
+    assert.equal(c.state.suggestions.length, 2);
+    c.remove('minimal');
+    c.remove('sandstone');
+    assert.deepEqual(c.state.suggestions, []);
+    assert.equal(c.state.suggestionsText, 'All suggestions removed. Generate again or enter tags manually.');
+    assert.equal(c.state.primaryLabel, 'Approve selected tags');
+});
+
+test('save sends manual then remaining chips deduplicated case-insensitively keeping the manual spelling', async () => {
+    const { createImageTaggingController } = await load();
+    const h = harness(defaultRoutes({
+        [`POST ${SUGGEST}`]: () => response(200, suggested([
+            { name: 'minimal', confidence: 0.99 }, { name: 'editorial', confidence: 0.97 },
+            { name: 'sandstone', confidence: 0.96 }, { name: 'desert', confidence: 0.9 },
+        ])),
+    }));
+    const c = createImageTaggingController({ api: h.api, target: TARGET, source: 'review' });
+    await c.open();
+    await settle();
+    assert.equal(c.state.showScopeNote, true);
+    await c.generate();
+    c.remove('desert');
+    assert.equal(c.state.primaryLabel, 'Approve selected tags');
+    assert.equal(await c.save(), true);
+    const sent = h.of('PUT', TAGS)[0].body;
+    assert.deepEqual(sent.tags, ['Minimal', 'warm_light', 'editorial', 'sandstone']); // manual "Minimal", chip "minimal" dropped
+    assert.deepEqual(sent, {
+        target: { ...TARGET }, capture_token: TOKEN, sha256: SHA, expected_epoch: EPOCH,
+        expected_tag_revision: 3, tags: sent.tags,
+    });
+    assert.equal(c.state.phase, 'saved');
+    assert.deepEqual(c.state.savedTags, sent.tags);
+    assert.equal(c.state.tagRevision, 4);
+    assert.equal(c.state.toast, '4 tags saved for dunes_00001.png. Prompt association still awaits review.');
+    assert.equal(c.state.canSave, false);
+    assert.equal(await c.save(), false, 'a saved dialog does not save twice');
+});
+
+test('toast matches the mock with the review suffix', async () => {
+    const { c } = await opened({ [`PUT ${TAGS}`]: () => response(200, receipt(['one'])) });
+    c.setManual('one');
+    await c.save();
+    assert.equal(c.state.toast, '1 tags saved for dunes_00001.png.', 'the mock always says "tags"');
+    const many = await opened({}, { source: 'library' });
+    await many.c.save();
+    assert.equal(many.c.state.toast, '2 tags saved for dunes_00001.png.');
+});
+
+test('empty manual and no chips sends the acknowledged empty set', async () => {
+    const { c, h } = await opened({ [`PUT ${TAGS}`]: () => response(200, receipt([])) });
+    c.setManual('  ,  ');
+    await c.save();
+    assert.deepEqual(h.of('PUT', TAGS)[0].body.tags, []);
+    assert.equal(c.state.toast, '0 tags saved for dunes_00001.png.');
+});
+
+test('conflict keeps draft and exposes current saved tags', async () => {
+    let answer = () => fail(409, 'tag-conflict', 'The tags of this image changed since the dialog opened; review them first.',
+        { tags: ['night', 'rain'], tag_revision: 5 });
+    const { c, h } = await opened({ [`PUT ${TAGS}`]: call => answer(call) });
+    await c.generate();
+    c.setManual('Minimal, dune');
+    await c.save();
+    assert.equal(c.state.phase, 'conflict');
+    assert.deepEqual(c.state.currentTags, ['night', 'rain']);
+    assert.equal(c.state.manual, 'night, rain, Minimal, dune');
+    assert.equal(c.state.suggestions.length, 3);
+    assert.equal(c.state.statusText, 'The tags of this image changed since the dialog opened; review them first. Saved now: night, rain.');
+    assert.equal(c.state.canSave, true);
+    answer = call => response(200, receipt(call.body.tags, { tag_revision: 6 }));
+    await c.save();
+    assert.equal(h.of('PUT', TAGS)[1].body.expected_tag_revision, 5, 'the second save is against the revision the user has seen');
+    assert.equal(c.state.phase, 'saved');
+    assert.equal(c.state.currentTags, null);
+});
+
+test('lost response keeps draft and retry resends the identical body once', async () => {
+    const answers = [() => Promise.reject(new TypeError('Failed to fetch')), () => fail(504, null, 'Gateway Timeout'),
+        () => response(200, { success: true, tags: 'broken' })];
+    for (const lost of answers) {
+        let answer = lost;
+        const { c, h } = await opened({ [`PUT ${TAGS}`]: call => answer(call) });
+        c.setManual('Minimal, dune');
+        await c.save();
+        assert.equal(c.state.phase, 'unknown-outcome');
+        assert.equal(c.state.statusText, 'The save could not be confirmed. Retry sends the same tags again.');
+        assert.equal(c.state.canRetry, true);
+        assert.equal(c.state.canSave, false);
+        assert.equal(c.state.manual, 'Minimal, dune');
+        c.setManual('changed meanwhile');
+        const gate = deferred();
+        answer = call => gate.promise.then(() => response(200, receipt(call.body.tags, { replayed: true })));
+        const retried = c.retry();
+        assert.equal(await c.retry(), false, 'a retry in flight is not sent twice');
+        gate.resolve();
+        assert.equal(await retried, true);
+        const puts = h.of('PUT', TAGS);
+        assert.equal(puts.length, 2);
+        assert.deepEqual(puts[1].body, puts[0].body);
+        assert.equal(c.state.phase, 'saved');
+        assert.equal(await c.retry(), false);
+    }
+});
+
+test('write errors keep the draft and allow another save', async () => {
+    const { c } = await opened({ [`PUT ${TAGS}`]: () => fail(400, 'tag-limit', 'An image can carry at most 100 tags.') });
+    await c.save();
+    assert.equal(c.state.phase, 'write-error');
+    assert.equal(c.state.statusText, 'An image can carry at most 100 tags.');
+    assert.equal(c.state.canSave, true);
+    assert.equal(c.state.canRetry, false);
+    const generic = await opened({ [`PUT ${TAGS}`]: () => fail(500, 'save-failed', '') });
+    await generic.c.save();
+    assert.equal(generic.c.state.phase, 'write-error');
+    assert.equal(generic.c.state.statusText, 'The tags could not be saved.');
+});
+
+test('storage-changed and file-changed disable save until reopen', async () => {
+    for (const [code, phase] of [['storage-changed', 'storage-changed'], ['file-changed', 'file-changed'], ['source-changed', 'file-changed'], ['capture-expired', 'capture-expired']]) {
+        const message = `server says ${code}`;
+        let answer = () => fail(409, code, message);
+        const { c, h } = await opened({ [`PUT ${TAGS}`]: () => answer() });
+        c.setManual('kept draft');
+        await c.save();
+        assert.equal(c.state.phase, phase);
+        assert.equal(c.state.statusText, message);
+        assert.equal(c.state.canSave, false);
+        assert.equal(c.state.canGenerate, false);
+        assert.equal(await c.save(), false);
+        assert.equal(h.of('PUT', TAGS).length, 1);
+        await c.open();
+        await settle();
+        assert.equal(c.state.phase, 'ready', 'reopen observes again');
+        assert.equal(c.state.manual, 'Minimal, warm_light');
+        assert.equal(h.of('DELETE', CAPTURE).length, 1, 'reopen releases the old capture');
+    }
+});
+
+test('video disables generate with the still-image message', async () => {
+    const reason = 'Auto-tagging is available for supported still images only.';
+    const { c, h } = await opened({
+        [`POST ${OBSERVE}`]: () => response(200, observed({ filename: 'clip.mp4' }, { media_type: 'video', generate: { supported: false, reason } })),
+    });
+    assert.equal(c.state.image.mediaType, 'video');
+    assert.equal(c.state.canGenerate, false);
+    assert.equal(c.state.canSave, true);
+    assert.equal(c.state.statusText, reason);
+    c.setModel('gguf');
+    assert.equal(c.state.statusText, reason, 'the reason survives a model change');
+    assert.equal(await c.generate(), false);
+    assert.equal(h.of('POST', SUGGEST).length, 0);
+});
+
+test('model-unavailable and model-busy set the status line only', async () => {
+    let answer = () => response(200, suggested());
+    const { c } = await opened({ [`POST ${SUGGEST}`]: () => answer() });
+    await c.generate();
+    const before = c.state;
+    for (const [code, message] of [
+        ['model-unavailable', 'WD14 SwinV2 is not downloaded. Download it from the legacy Auto-tag page.'],
+        ['model-busy', 'A tagging model is busy with another operation. Try again when it finishes.'],
+        ['unsupported-media', 'Images larger than 4096 px per side or 16,777,216 px are not supported.'],
+    ]) {
+        answer = () => fail(409, code, message);
+        assert.equal(await c.generate(), false);
+        assert.equal(c.state.statusText, message);
+        assert.deepEqual(c.state.suggestions, before.suggestions);
+        assert.equal(c.state.countText, before.countText);
+        assert.equal(c.state.primaryLabel, before.primaryLabel);
+        assert.equal(c.state.manual, before.manual);
+        assert.equal(c.state.canSave, true);
+        assert.equal(c.state.canGenerate, true);
+    }
+    answer = () => Promise.reject(new TypeError('Failed to fetch'));
+    await c.generate();
+    assert.equal(c.state.statusText, 'Auto-tagging failed. Check server logs for details.');
+    c.setModel('wd14-vit');
+    assert.equal(c.state.phase, 'ready');
+});
+
+test('a storage restore during generate requires a reopen', async () => {
+    const { c } = await opened({ [`POST ${SUGGEST}`]: () => fail(409, 'storage-changed', 'Prompt storage was restored; reopen the Tag dialog.') });
+    c.setManual('kept');
+    await c.generate();
+    assert.equal(c.state.phase, 'storage-changed');
+    assert.equal(c.state.canSave, false);
+    assert.equal(c.state.canGenerate, false);
+    await c.retry();
+    await settle();
+    assert.equal(c.state.phase, 'ready', 'Retry observes again (D116)');
+    assert.equal(c.state.manual, 'kept');
+});
+
+test('dispose aborts requests and releases the capture once', async () => {
+    const pending = deferred();
+    const { c, h } = await opened({ [`POST ${SUGGEST}`]: () => pending.promise });
+    const token = TOKEN;
+    const releases = [];
+    const generating = c.generate();
+    let notified = 0;
+    c.subscribe(() => { notified += 1; });
+    c.dispose();
+    c.dispose();
+    c.cancel();
+    for (const call of h.of('DELETE', CAPTURE)) releases.push(decodeURIComponent(call.url.slice(CAPTURE.length)));
+    assert.deepEqual(releases, [token]);
+    assert.equal(h.of('POST', SUGGEST)[0].aborted, true);
+    pending.resolve(response(200, suggested()));
+    assert.equal(await generating, false);
+    assert.equal(notified, 0, 'a disposed controller never notifies');
+    c.setManual('ignored');
+    c.remove('x');
+    assert.notEqual(c.state.manual, 'ignored');
+    assert.equal(await c.save(), false);
+    assert.equal(await c.open(), undefined);
+    assert.equal(h.of('POST', OBSERVE).length, 1);
+});
+
+test('dispose while observing aborts the models read and releases a late capture', async () => {
+    const { createImageTaggingController } = await load();
+    const late = deferred();
+    const h = harness(defaultRoutes({ [`POST ${OBSERVE}`]: () => late.promise, [`GET ${MODELS}`]: () => new Promise(() => {}) }));
+    const c = createImageTaggingController({ api: h.api, target: TARGET });
+    const opening = c.open();
+    c.dispose();
+    assert.equal(h.of('GET', MODELS)[0].aborted, true);
+    late.resolve(response(200, observed()));
+    await opening;
+    await settle();
+    assert.deepEqual(h.of('DELETE', CAPTURE).map(call => call.url), [CAPTURE + TOKEN]);
+    assert.equal(c.state.phase, 'observing');
+});
+
+test('a failing capture release is not reported as a dialog error', async () => {
+    const { c, h } = await opened({ [`DELETE ${CAPTURE}`]: () => Promise.reject(new TypeError('offline')) });
+    c.dispose();
+    await settle();
+    assert.equal(h.of('DELETE', CAPTURE).length, 1);
+    assert.equal(c.state.phase, 'ready');
+});
+
+test('the opening sentence is the concept on-screen copy and the chip hint shows only with chips (D83)', async () => {
+    const { createImageTaggingController } = await load();
+    const h = harness(defaultRoutes());
+    const c = createImageTaggingController({ api: h.api, target: TARGET });
+    assert.equal(c.state.suggestionsText, 'Generate suggestions with the selected model before approving.');
+    assert.equal(c.state.chipHint, '');
+    await c.open();
+    await settle();
+    assert.equal(c.state.suggestionsText, 'Generate suggestions with the selected model before approving.');
+    assert.equal(c.state.chipHint, '');
+    await c.generate();
+    assert.equal(c.state.chipHint, 'Remove anything you do not want to add.');
+    for (const row of [...c.state.suggestions]) c.remove(row.name);
+    assert.equal(c.state.chipHint, '');
+});
+
+test('the option fields follow the server defaults: open and a model change bump the revision, typing does not', async () => {
+    const { c, h } = await opened({
+        [`GET ${MODELS}`]: () => response(200, models({ suggestion_limit: 7, wd14_general_threshold: 0.5, wd14_character_threshold: 0.9 })),
+    });
+    const opening = c.state.optionsRevision;
+    assert.ok(opening > 0, 'the observation that applies the server defaults bumps the revision');
+    assert.deepEqual({ ...c.state.options }, { general_threshold: 0.5, character_threshold: 0.9, instructions: DEFAULT_PROMPT, suggestion_limit: 7 });
+    c.setOption('general_threshold', '0.6');
+    assert.equal(c.state.optionsRevision, opening, 'typing never re-renders the fields');
+    c.setModel('wd14-vit');
+    assert.equal(c.state.optionsRevision, opening + 1);
+    assert.equal(c.state.options.general_threshold, 0.5);
+    await c.generate();
+    assert.deepEqual(h.of('POST', SUGGEST)[0].body.options, { general_threshold: 0.5, character_threshold: 0.9, suggestion_limit: 7 });
+});
+
+test('a conflict shows the current set and merges it ahead of the draft, so a second Save never drops it unseen', async () => {
+    let answer = () => fail(409, 'tag-conflict', 'The tags of this image changed since the dialog opened; review them first.',
+        { tags: ['changed_elsewhere', 'Minimal'], tag_revision: 5 });
+    const { c, h } = await opened({ [`PUT ${TAGS}`]: call => answer(call) });
+    const draft = c.state.draftRevision;
+    c.setManual('minimal, dune');
+    await c.save();
+    assert.equal(c.state.phase, 'conflict');
+    assert.equal(c.state.statusText,
+        'The tags of this image changed since the dialog opened; review them first. Saved now: changed_elsewhere, Minimal.');
+    assert.equal(c.state.manual, 'changed_elsewhere, Minimal, dune', 'the current set leads, the draft follows, repeats dropped');
+    assert.equal(c.state.draftRevision, draft + 1, 'the dialog rewrites its field');
+    answer = call => response(200, receipt(call.body.tags, { tag_revision: 6 }));
+    await c.save();
+    const second = h.of('PUT', TAGS)[1].body;
+    assert.deepEqual(second.tags, ['changed_elsewhere', 'Minimal', 'dune']);
+    assert.equal(second.expected_tag_revision, 5);
+    const empty = await opened({ [`PUT ${TAGS}`]: () => fail(409, 'tag-conflict', 'Changed.', { tags: [], tag_revision: 9 }) });
+    empty.c.setManual('a');
+    await empty.c.save();
+    assert.equal(empty.c.state.statusText, 'Changed. Saved now: no tags.');
+    assert.equal(empty.c.state.manual, 'a');
+});
+
+test('the capture release and the save survive leaving the page (keepalive)', async () => {
+    const { c, h } = await opened();
+    await c.save();
+    assert.equal(h.of('PUT', TAGS)[0].init.keepalive, true);
+    const other = await opened();
+    other.c.dispose();
+    const [release] = other.h.of('DELETE', CAPTURE);
+    assert.equal(release.init.keepalive, true);
+    assert.equal(h.of('POST', OBSERVE)[0].init.keepalive, undefined, 'reads are not kept alive');
+});
+
+test('closing during a save releases the capture only after the PUT settles and reports the outcome', async () => {
+    const outcomes = [];
+    const gate = deferred();
+    const { c, h } = await opened({ [`PUT ${TAGS}`]: call => gate.promise.then(() => response(200, receipt(call.body.tags))) },
+        { onLateSave: outcome => outcomes.push(outcome) });
+    c.setManual('dune');
+    const saving = c.save();
+    c.dispose();
+    await settle();
+    assert.equal(h.of('DELETE', CAPTURE).length, 0, 'the capture stays while its save is in flight');
+    gate.resolve();
+    assert.equal(await saving, true);
+    await settle();
+    const order = h.calls.filter(call => call.method !== 'GET').map(call => call.method);
+    assert.deepEqual(order, ['POST', 'PUT', 'DELETE']);
+    assert.deepEqual(outcomes, [{ saved: true, filename: 'dunes_00001.png', tags: ['dune'], toast: '1 tags saved for dunes_00001.png.' }]);
+    assert.equal(c.state.closed, true);
+
+    for (const [route, message] of [
+        [() => fail(409, 'tag-conflict', 'Changed elsewhere.', { tags: ['x'], tag_revision: 5 }), 'Changed elsewhere.'],
+        [() => fail(400, 'tag-limit', 'Too many.'), 'Too many.'],
+        [() => Promise.reject(new TypeError('Failed to fetch')), 'The tag save could not be confirmed. Open Tag image again to check the saved tags.'],
+    ]) {
+        const late = [];
+        const held = deferred();
+        const run = await opened({ [`PUT ${TAGS}`]: () => held.promise.then(route) }, { onLateSave: outcome => late.push(outcome) });
+        const pending = run.c.save();
+        run.c.cancel();
+        held.resolve();
+        assert.equal(await pending, false);
+        await settle();
+        assert.deepEqual(late, [{ saved: false, message }]);
+        assert.equal(run.h.of('DELETE', CAPTURE).length, 1);
+    }
+    const quiet = await opened();
+    quiet.c.dispose();
+    assert.equal(quiet.h.of('DELETE', CAPTURE).length, 1, 'with no save in flight the capture is released at once');
+    const { createImageTaggingController } = await load();
+    assert.throws(() => createImageTaggingController({ api: h.api, target: TARGET, onLateSave: 'x' }), TypeError);
+});
+
+test('retry after a changed storage, file or expired capture observes again and keeps the draft', async () => {
+    for (const code of ['storage-changed', 'file-changed', 'capture-expired']) {
+        let revision = 3;
+        const { c, h } = await opened({
+            [`PUT ${TAGS}`]: () => fail(409, code, `server says ${code}`),
+            [`POST ${OBSERVE}`]: () => response(200, observed({ tag_revision: revision, tags: revision === 3 ? ['Minimal', 'warm_light'] : ['night'] })),
+        });
+        c.setManual('kept draft');
+        await c.save();
+        assert.equal(c.state.canRetry, true);
+        const draft = c.state.draftRevision;
+        await c.retry();
+        await settle();
+        assert.equal(c.state.phase, 'ready');
+        assert.equal(c.state.manual, 'kept draft', 'an unchanged tag set keeps the draft as typed');
+        assert.equal(c.state.draftRevision, draft + 1);
+        assert.equal(h.of('POST', OBSERVE).length, 2);
+        revision = 4;
+        await c.save();
+        await c.retry();
+        await settle();
+        assert.equal(c.state.manual, 'night, kept draft', 'a set changed meanwhile is shown ahead of the draft');
+        assert.equal(c.state.statusText, 'The tags of this image changed since the dialog opened. Saved now: night.');
+        assert.equal(c.state.tagRevision, 4);
+    }
+    // A first observation that failed has no draft to keep: its retry fills the saved tags.
+    const { createImageTaggingController } = await load();
+    let first = true;
+    const h = harness(defaultRoutes({ [`POST ${OBSERVE}`]: () => (first ? (first = false, fail(500, 'observe-failed')) : response(200, observed())) }));
+    const c = createImageTaggingController({ api: h.api, target: TARGET });
+    await c.open();
+    await c.retry();
+    await settle();
+    assert.equal(c.state.manual, 'Minimal, warm_light');
+});

tests/js/workspace-image-tagging.test.js

@@ -0,0 +1,28 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+
+// Guarded: before the dialog module exists every test fails on an assertion, not on the import.
+const loaded = await import('../../web/js/workspace/image-tagging.mjs').catch(() => null);
+const module = () => { assert.ok(loaded, 'image-tagging.mjs is not implemented'); return loaded; };
+const SCOPE = 'a'.repeat(64);
+
+test('a listed file gives its tagging target, anything else none', () => {
+    const { imageTarget } = module();
+    assert.deepEqual(imageTarget({ root_index: 1, root_scope: SCOPE, path: 'a/b.png', filename: 'b.png' }),
+        { root_index: 1, root_scope: SCOPE, path: 'a/b.png' });
+    for (const image of [null, {}, { root_index: -1, root_scope: SCOPE, path: 'a.png' }, { root_index: 0, path: 'a.png' },
+        { root_index: 0, root_scope: 'A'.repeat(64), path: 'a.png' }, { root_index: 0, root_scope: SCOPE, path: '' },
+        { root_index: 1.5, root_scope: SCOPE, path: 'a.png' }]) {
+        assert.equal(imageTarget(image), null);
+    }
+});
+
+test('tag save listeners subscribe and unsubscribe once', () => {
+    const { onImageTagsSaved, imageTagsListenerCount } = module();
+    const before = imageTagsListenerCount();
+    const off = onImageTagsSaved(() => {});
+    assert.equal(imageTagsListenerCount(), before + 1);
+    off(); off();
+    assert.equal(imageTagsListenerCount(), before);
+    assert.throws(() => onImageTagsSaved('nope'), TypeError);
+});

tests/js/workspace-images-lifecycle.test.js

@@ -21,3 +21,12 @@ test('Images mounted after its parent is aborted creates no DOM, requests or obs
         for(const [key,descriptor] of originals) {if(descriptor) Object.defineProperty(globalThis,key,descriptor);else delete globalThis[key];}
     }
 });
+
+test('Images mounted after its parent is aborted follows no tag saves', async () => {
+    const tagging = await import('../../web/js/workspace/image-tagging.mjs').catch(() => null);
+    assert.ok(tagging, 'image-tagging.mjs is not implemented');
+    const before = tagging.imageTagsListenerCount();
+    const parent = createScope(); parent.dispose();
+    mountImages({}, {get() { assert.fail('Request started after parent disposal'); }}, parent, {embedded: true, fetchPage() {}}).dispose();
+    assert.equal(tagging.imageTagsListenerCount(), before);
+});

tests/js/workspace-images-state.test.js

@@ -352,3 +352,129 @@ test('selectionLabel counts the selected images as the concept bar does', async
     assert.equal(selectionLabel(2), '2 selected');
     assert.equal(selectionLabel(1234), '1,234 selected');
 });
+
+test('refresh re-reads the loaded range in place and publishes once, replacing the items', async () => {
+    const {createImageStream,imageKey}=await source;const requests=[];const states=[];
+    const stream=createImageStream({api:{get:(url,{signal})=>{const d=deferred();requests.push({...d,url,signal});return d.promise;}},onChange:(s,hint)=>states.push([s,hint]),batchSize:2});
+    assert.equal(typeof stream.refresh,'function','refresh is part of the stream');
+    const first=stream.reset({q:'tag'});requests[0].resolve(page([image('a'),image('b')],5,'c1'));await first;
+    const second=stream.loadMore();requests[1].resolve(page([image('c'),image('d')],5,'c2'));await second;
+    const before=stream.state;const published=states.length;
+    const refresh=stream.refresh();
+    // The current collection stays shown while the re-read runs; Load more waits for it.
+    assert.equal(stream.state,before);assert.equal(states.length,published);
+    assert.equal(await stream.loadMore(),0);assert.equal(requests.length,3);
+    const query=new URL(requests[2].url,'http://local').searchParams;
+    // The loaded range is re-read in pages as large as it (at most 200), not in the listing's batches (M2).
+    assert.equal(query.get('q'),'tag');assert.equal(query.has('cursor'),false);assert.equal(query.get('limit'),'4');
+    requests[2].resolve(page([image('a'),image('new'),image('c')],6,'n1'));
+    await new Promise(resolve=>setImmediate(resolve));
+    const next=new URL(requests[3].url,'http://local').searchParams;
+    assert.equal(next.get('cursor'),'n1');assert.equal(next.get('limit'),'2','the rest, at least one batch');
+    assert.equal(stream.state,before);
+    requests[3].resolve(page([image('d')],6,'n2'));
+    assert.equal(await refresh,4);
+    assert.deepEqual(stream.state.items.map(imageKey),['0:a','0:new','0:c','0:d']);
+    assert.deepEqual([stream.state.total,stream.state.cursor,stream.state.hasMore,stream.state.loaded,stream.state.loading],[6,'n2',true,4,false]);
+    assert.equal(states.length,published+1);assert.deepEqual(states.at(-1)[1],{replaced:true});
+    // Load more continues from the refreshed cursor.
+    const more=stream.loadMore();assert.equal(new URL(requests[4].url,'http://local').searchParams.get('cursor'),'n2');
+    requests[4].resolve(page([image('e')],6));await more;
+    assert.deepEqual(stream.state.items.map(imageKey),['0:a','0:new','0:c','0:d','0:e']);
+});
+
+test('refresh stops early when the result shrank, and a reset or failure leaves the collection as it was', async () => {
+    const {createImageStream,imageKey}=await source;const requests=[];
+    const stream=createImageStream({api:{get:(url,{signal})=>{const d=deferred();requests.push({...d,url,signal});return d.promise;}},batchSize:2});
+    assert.equal(typeof stream.refresh,'function','refresh is part of the stream');
+    const first=stream.reset({tags:['x']});requests[0].resolve(page([image('a'),image('b')],4,'c1'));await first;
+    const shrink=stream.refresh();requests[1].resolve(page([image('b')],1));
+    assert.equal(await shrink,1);assert.deepEqual(stream.state.items.map(imageKey),['0:b']);assert.equal(stream.state.hasMore,false);
+    const before=stream.state;
+    const failing=stream.refresh();requests[2].reject(new Error('offline'));
+    await assert.rejects(failing,/offline/,'a failed re-read is reported to the page');assert.equal(stream.state,before);
+    const stale=stream.refresh();const fresh=stream.reset({tags:['y']});
+    assert.equal(requests[3].signal.aborted,true);
+    requests[4].resolve(page([image('y')]));await fresh;
+    requests[3].resolve(page([image('stale')]));assert.equal(await stale,0);
+    assert.deepEqual(stream.state.items.map(imageKey),['0:y']);
+    stream.dispose();assert.equal(await stream.refresh(),0);
+});
+
+test('a refresh asked while a page loads runs once that page settles (I6)', async () => {
+    const {createImageStream,imageKey}=await source;const requests=[];const states=[];
+    const stream=createImageStream({api:{get:(url,{signal})=>{const d=deferred();requests.push({...d,url,signal});return d.promise;}},onChange:(s,hint)=>states.push(hint),batchSize:2});
+    const first=stream.reset({tags:['x']});requests[0].resolve(page([image('a'),image('b')],4,'c1'));await first;
+    for (const settle of ['resolve','reject']) {
+        const more=stream.loadMore();const sent=requests.length;
+        assert.equal(await stream.refresh(),0,'nothing is read beside the page in flight');
+        assert.equal(await stream.refresh(),0);
+        assert.equal(requests.length,sent);
+        if (settle==='resolve') requests[sent-1].resolve(page([image('c'),image('d')],4,'c2'));
+        else requests[sent-1].reject(new Error('offline'));
+        await more;
+        await new Promise(resolve=>setImmediate(resolve));
+        assert.equal(requests.length,sent+1,'exactly one pending refresh follows');
+        assert.equal(new URL(requests[sent].url,'http://local').searchParams.has('cursor'),false);
+        requests[sent].resolve(page([image('a'),image('b'),image('c'),image('d')],6,'r1'));
+        await new Promise(resolve=>setImmediate(resolve));
+        assert.deepEqual(states.at(-1),{replaced:true});
+        assert.equal(states.filter(hint=>hint?.replaced).length,settle==='resolve'?1:2);
+    }
+    // A reset drops a pending refresh.
+    const more=stream.loadMore();const sent=requests.length;
+    assert.equal(await stream.refresh(),0);
+    const fresh=stream.reset({tags:['y']});
+    requests[sent].resolve(page([image('y')]));await fresh;
+    requests[sent-1].resolve(page([image('late')],1));await more;
+    await new Promise(resolve=>setImmediate(resolve));
+    assert.equal(requests.length,sent+1);assert.deepEqual(stream.state.items.map(imageKey),['0:y']);
+    assert.equal(stream.refreshing,false);
+});
+
+test('refresh reads a long loaded range in at most 200-file pages and exposes refreshing (M2, M3)', async () => {
+    const {createImageStream}=await source;const requests=[];
+    const stream=createImageStream({api:{get:(url,{signal})=>{const d=deferred();requests.push({...d,url,signal});return d.promise;}},batchSize:150});
+    const many=(prefix,n)=>Array.from({length:n},(_,i)=>image(`${prefix}${i}`));
+    const first=stream.reset({q:'x'});requests[0].resolve(page(many('a',150),1000,'c1'));await first;
+    const second=stream.loadMore();requests[1].resolve(page(many('b',150),1000,'c2'));await second;
+    const refresh=stream.refresh();
+    assert.equal(stream.refreshing,true);
+    assert.equal(new URL(requests[2].url,'http://local').searchParams.get('limit'),'200');
+    requests[2].resolve(page(many('r',200),1000,'n1'));
+    await new Promise(resolve=>setImmediate(resolve));
+    assert.equal(new URL(requests[3].url,'http://local').searchParams.get('limit'),'150');
+    requests[3].resolve(page(many('s',150),1000,'n2'));
+    assert.equal(await refresh,350);assert.equal(requests.length,4);
+    assert.equal(stream.refreshing,false);
+});
+
+test('a second refresh supersedes the first, repeats in a re-read are dropped, and dispose abandons one in flight', async () => {
+    const {createImageStream,imageKey}=await source;const requests=[];const states=[];
+    const stream=createImageStream({api:{get:(url,{signal})=>{const d=deferred();requests.push({...d,url,signal});return d.promise;}},onChange:(s,hint)=>states.push(hint),batchSize:2});
+    const first=stream.reset({q:'x'});requests[0].resolve(page([image('a'),image('b')],2));await first;
+    const older=stream.refresh();const newer=stream.refresh();
+    assert.equal(requests[1].signal.aborted,true,'the older re-read is aborted');
+    requests[2].resolve(page([image('b'),image('b'),image('a')],2));
+    assert.equal(await newer,2);
+    requests[1].resolve(page([image('old')],1));assert.equal(await older,0);
+    assert.deepEqual(stream.state.items.map(imageKey),['0:b','0:a']);
+    assert.equal(states.filter(hint=>hint?.replaced).length,1);
+    const pending=stream.refresh();
+    stream.dispose();
+    assert.equal(requests[3].signal.aborted,true);
+    requests[3].resolve(page([image('late')],1));
+    assert.equal(await pending,0);assert.deepEqual(stream.state.items.map(imageKey),['0:b','0:a']);
+});
+
+test('a refresh deferred behind a page load is dropped when the stream is disposed meanwhile', async () => {
+    const {createImageStream}=await source;const requests=[];
+    const stream=createImageStream({api:{get:(url,{signal})=>{const d=deferred();requests.push({...d,url,signal});return d.promise;}},batchSize:2});
+    const first=stream.reset({q:'x'});requests[0].resolve(page([image('a'),image('b')],4,'c1'));await first;
+    const more=stream.loadMore();
+    assert.equal(await stream.refresh(),0);
+    stream.dispose();
+    requests[1].resolve(page([image('c')],4,'c2'));await more;
+    await new Promise(resolve=>setImmediate(resolve));
+    assert.equal(requests.length,2,'no refresh runs after dispose');
+});

tests/js/workspace-images-tagging-bulk.test.js

@@ -0,0 +1,198 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+
+// Guarded: before the module exists every test fails on an assertion, not on the import.
+const loaded = await import('../../web/js/workspace/images-tagging-bulk.mjs').catch(() => null);
+const module = () => { assert.ok(loaded, 'images-tagging-bulk.mjs is not implemented'); return loaded; };
+const state = await import('../../web/js/workspace/image-tagging-state.mjs');
+const { startToast, parseJob } = await import('../../web/js/workspace/activity-store.mjs');
+const SCOPE = 'b'.repeat(64);
+const JOB_ID = 'c'.repeat(32);
+const image = (path, extra = {}) => ({ root_index: 0, root_scope: SCOPE, path, filename: path.split('/').pop(), ...extra });
+const pageScope = () => {
+    const controller = new AbortController();
+    const cleanups = [];
+    return { signal: controller.signal, cleanup: fn => cleanups.push(fn), abort: () => controller.abort(), cleanups };
+};
+
+test('targets keep listing order and identity', () => {
+    const { bulkTargets } = module();
+    const listing = [image('b/2.png', { width: 9 }), image('a/1.png'), { ...image('x.png'), root_scope: 'nope' }, image('c/3.webm')];
+    assert.deepEqual(bulkTargets(listing), [
+        { root_index: 0, root_scope: SCOPE, path: 'b/2.png' },
+        { root_index: 0, root_scope: SCOPE, path: 'a/1.png' },
+        { root_index: 0, root_scope: SCOPE, path: 'c/3.webm' },
+    ]);
+    assert.deepEqual(bulkTargets([]), []);
+});
+
+test('over 500 selected refuses with the toast', () => {
+    const { bulkTargets, openAddTags, openAutoTag, MAX_BULK_IMAGES, TOO_MANY } = module();
+    assert.equal(MAX_BULK_IMAGES, 500);
+    assert.equal(TOO_MANY, 'Select at most 500 images.');
+    const many = Array.from({ length: 501 }, (_, index) => image(`bulk/${index}.png`));
+    assert.equal(bulkTargets(many), null);
+    assert.equal(bulkTargets(many.slice(0, 500)).length, 500);
+    const toasts = [];
+    const store = { start: () => assert.fail('no job starts') };
+    // Refused before any dialog opens (no DOM here).
+    openAddTags({ scope: pageScope(), store, images: many, notify: text => toasts.push(text) });
+    openAutoTag({ api: {}, scope: pageScope(), store, images: many, notify: text => toasts.push(text) });
+    assert.deepEqual(toasts, [TOO_MANY, TOO_MANY]);
+});
+
+test('add parses comma tags with the same dedupe as the dialog', () => {
+    const { parseBulkTags, ADD_DIALOG } = module();
+    assert.deepEqual(ADD_DIALOG, { title: 'Tag selected images', label: 'Tags, separated by commas', action: 'Apply' });
+    assert.deepEqual(parseBulkTags(' Sunset, sunset ,, blue_hour,SUNSET, Blue_Hour '), ['Sunset', 'blue_hour']);
+    assert.deepEqual(parseBulkTags(' , ,'), []);
+    assert.equal(parseBulkTags, state.parseManualTags);
+});
+
+test('Add tags keeps its dialog and the typed text when the field parses to no names', async () => {
+    const { openAddTags, NO_TAGS } = module();
+    const toasts = [];
+    const posted = [];
+    const store = { start: async (kind, body) => { posted.push(body); return { job: { id: JOB_ID, state: 'running' } }; },
+        find: () => null, subscribe: () => () => {} };
+    let dialog = null;
+    openAddTags({ scope: pageScope(), store, images: [image('a.png')], trigger: null, notify: text => toasts.push(text),
+        openInput: args => { dialog = args; } });
+    assert.equal(typeof dialog?.validate, 'function');
+    // The dialog reports the message on its field and stays open: nothing toasts, nothing is sent.
+    assert.equal(dialog.validate(' , ,'), NO_TAGS);
+    assert.equal(dialog.validate('sunset'), null);
+    assert.deepEqual(toasts, []);
+    await dialog.onApply('sunset, Sunset');
+    assert.deepEqual(posted.map(body => body.tags), [['sunset']]);
+});
+
+test('busy start keeps the selection and names the running job', async () => {
+    const { startTagJob } = module();
+    const toasts = [];
+    const posted = [];
+    const running = { id: JOB_ID, title: 'Scan for metadata' };
+    const store = { start: async (kind, body) => { posted.push([kind, body]); return { busy: running, message: 'busy' }; } };
+    const body = { mode: 'add', targets: [{ root_index: 0, root_scope: SCOPE, path: 'a.png' }], tags: ['x'] };
+    assert.equal(await startTagJob({ store, scope: pageScope(), body, notify: text => toasts.push(text) }), null);
+    assert.deepEqual(posted, [['image-tags', body]]);
+    assert.deepEqual(toasts, [['Another job is running: ', { text: 'Scan for metadata', href: `#/activity/${JOB_ID}` }, '.']]);
+});
+
+test('a started job is returned without a toast of its own; refusals toast their sentence', async () => {
+    const { startTagJob } = module();
+    const toasts = [];
+    const notify = text => toasts.push(text);
+    const job = { id: JOB_ID, kind: 'image-tags' };
+    assert.equal(await startTagJob({ store: { start: async () => ({ job }) }, scope: pageScope(), body: { mode: 'add' }, notify }), job);
+    const refused = Object.assign(new Error('The tagging model is busy. Try again when it finishes.'), { name: 'ApiError', status: 409, code: 'model-busy' });
+    assert.equal(await startTagJob({ store: { start: async () => { throw refused; } }, scope: pageScope(), body: { mode: 'auto' }, notify }), null);
+    assert.equal(await startTagJob({ store: { start: async () => { throw new TypeError('down'); } }, scope: pageScope(), body: { mode: 'auto' }, notify }), null);
+    assert.equal(await startTagJob({ store: { start: async () => { throw new TypeError('down'); } }, scope: pageScope(), body: { mode: 'add' }, notify }), null);
+    assert.deepEqual(toasts, ['The tagging model is busy. Try again when it finishes.', 'Auto-tagging could not start. Try again.',
+        'Tagging could not start. Try again.']);
+    // A page left meanwhile says nothing.
+    const left = pageScope();
+    left.abort();
+    assert.equal(await startTagJob({ store: { start: async () => { throw refused; } }, scope: left, body: { mode: 'auto' }, notify }), null);
+    assert.equal(toasts.length, 3);
+});
+
+test('the start toast names the tagging mode', () => {
+    const job = mode => parseJob({ id: JOB_ID, state: 'running', kind: 'image-tags', title: 'Add tags to images', scope: { mode, images: 2 } });
+    assert.equal(startToast(job('add')), 'Tagging started.');
+    assert.equal(startToast(job('auto')), 'Auto-tagging started.');
+    assert.equal(startToast(job('other')), 'Add tags to images started.');
+    assert.equal(startToast(parseJob({ id: JOB_ID, state: 'running', kind: 'scan', title: 'Scan for metadata' })), 'Scan started.');
+});
+
+test('a followed job reports its end once', () => {
+    const { followJobEnd } = module();
+    let jobs = [{ id: JOB_ID, state: 'running', counters: {} }];
+    const listeners = new Set();
+    const store = { find: id => jobs.find(job => job.id === id), subscribe: fn => { listeners.add(fn); return () => listeners.delete(fn); } };
+    const ended = [];
+    const scope = pageScope();
+    followJobEnd({ store, scope, id: JOB_ID, onEnd: job => ended.push(job.state) });
+    assert.equal(listeners.size, 1);
+    for (const fn of [...listeners]) fn(store);
+    assert.deepEqual(ended, []);
+    jobs = [{ id: JOB_ID, state: 'finished', counters: { tagged: 1 } }];
+    for (const fn of [...listeners]) fn(store);
+    for (const fn of [...listeners]) fn(store);
+    assert.deepEqual(ended, ['finished']);
+    assert.equal(listeners.size, 0);
+    assert.equal(scope.cleanups.length, 1);
+});
+
+test('a model that is not downloaded is named with the server sentence', () => {
+    const { modelUnavailable } = state;
+    assert.equal(modelUnavailable(null, 'wd14-vit'), '');
+    assert.equal(modelUnavailable({ 'wd14-vit': { downloaded: true } }, 'wd14-vit'), '');
+    assert.equal(modelUnavailable({ 'wd14-vit': { downloaded: false } }, 'wd14-vit'), 'WD14 ViT is not downloaded. Download it from the legacy Auto-tag page.');
+    assert.equal(modelUnavailable({ gguf: { downloaded: false, name: 'GGUF (Recommended)' } }, 'gguf'),
+        'GGUF (Recommended) is not downloaded. Download it from the legacy Auto-tag page.');
+    assert.throws(() => modelUnavailable({}, 'nope'), TypeError);
+});
+
+test('the bulk options start from the server defaults and wait for them before Start', async () => {
+    const { createTaggingOptionsController } = state;
+    let answer;
+    const api = { get: () => new Promise(resolve => { answer = resolve; }) };
+    const options = createTaggingOptionsController({ api });
+    const seen = [];
+    options.subscribe(value => seen.push(value.optionsRevision));
+    assert.equal(options.state.canStart, false);
+    assert.equal(options.state.canGenerate, false);
+    const opening = options.open();
+    answer({ wd14_general_threshold: 0.5, wd14_character_threshold: 0.9, default_prompt: 'Say it', suggestion_limit: 7,
+        models: { 'wd14-swinv2': { downloaded: true }, 'wd14-vit': { downloaded: false }, gguf: { downloaded: true } } });
+    await opening;
+    assert.equal(options.state.canStart, true);
+    assert.deepEqual(options.request(), { model_type: 'wd14-swinv2', options: { general_threshold: 0.5, character_threshold: 0.9, suggestion_limit: 7 } });
+    options.setOption('suggestion_limit', '3');
+    options.setModel('wd14-vit');
+    assert.equal(options.state.canStart, false);
+    assert.match(options.state.unavailable, /^WD14 ViT is not downloaded\./);
+    options.setModel('gguf');
+    assert.deepEqual(options.request(), { model_type: 'gguf', options: { instructions: 'Say it', suggestion_limit: 3 } });
+    options.setOption('instructions', '  ');
+    assert.equal(options.request(), null);
+    assert.deepEqual(seen, [1, 1, 2, 3, 3]);
+    assert.throws(() => options.setModel('nope'), TypeError);
+    assert.throws(() => options.setOption('nope', 1), TypeError);
+    options.dispose();
+    options.setOption('suggestion_limit', '4');
+    assert.equal(options.state.options.suggestion_limit, '3');
+});
+
+test('the bulk options keep the documented defaults when the read fails', async () => {
+    const { createTaggingOptionsController } = state;
+    const options = createTaggingOptionsController({ api: { get: async () => { throw new Error('offline'); } } });
+    await options.open();
+    await options.open();
+    assert.equal(options.state.canStart, true);
+    assert.equal(options.state.unavailable, '');
+    assert.deepEqual(options.request(), { model_type: 'wd14-swinv2', options: { general_threshold: 0.35, character_threshold: 0.85, suggestion_limit: 10 } });
+    assert.throws(() => createTaggingOptionsController({}), TypeError);
+});
+
+test('a preset starts the Tag image dialog on the chosen model and options', async () => {
+    const { createImageTaggingController } = state;
+    const target = { root_index: 0, root_scope: SCOPE, path: 'a.png' };
+    const api = {
+        get: async () => ({ wd14_general_threshold: 0.35, wd14_character_threshold: 0.85, default_prompt: 'Describe', suggestion_limit: 10 }),
+        post: async () => ({ success: true, library_epoch: '12345678-1234-1234-1234-123456789abc', filename: 'a.png', title: null, tags: [], tag_revision: 0,
+            capture: { token: 'tok', sha256: 'd'.repeat(64), preview_url: '/prompt_manager/image-annotations/capture/tok', width: 4, height: 4,
+                media_type: 'image', generate: { supported: true, reason: null } } }),
+        put: async () => ({}), del: async () => ({}),
+    };
+    const controller = createImageTaggingController({ api, target, source: 'bulk', preset: { model: 'gguf', options: { instructions: 'Name it', suggestion_limit: 3 } } });
+    assert.equal(controller.state.model, 'gguf');
+    await controller.open();
+    assert.deepEqual([controller.state.model, controller.state.options.instructions, controller.state.options.suggestion_limit], ['gguf', 'Name it', 3]);
+    controller.dispose();
+    assert.throws(() => createImageTaggingController({ api, target, preset: { model: 'nope', options: {} } }), TypeError);
+    assert.throws(() => createImageTaggingController({ api, target, preset: { model: 'gguf', options: { instructions: '' } } }), TypeError);
+    assert.throws(() => createImageTaggingController({ api, target, preset: { model: 'gguf', options: { nope: 1 } } }), TypeError);
+});

tests/js/workspace-images-tagging-review.test.js

@@ -0,0 +1,110 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+
+// Guarded: before the module exists every test fails on an assertion, not on the import.
+const loaded = await import('../../web/js/workspace/images-tagging-review.mjs').catch(() => null);
+const module = () => { assert.ok(loaded, 'images-tagging-review.mjs is not implemented'); return loaded; };
+const SCOPE = 'e'.repeat(64);
+const images = ['a.png', 'b.png', 'c.png'].map(path => ({ root_index: 0, root_scope: SCOPE, path, filename: path }));
+const OPTIONS = { general_threshold: 0.4, character_threshold: 0.8, suggestion_limit: 3 };
+
+/** A session over fake dialogs: `dialogs` holds every open call's arguments and whether it was closed. */
+function session(extra = {}) {
+    const dialogs = [];
+    const toasts = [];
+    let closes = 0;
+    const saved = [];
+    const handle = module().startReviewSession({
+        api: {}, scope: {}, images, model_type: 'wd14-vit', options: OPTIONS, trigger: 'auto-tag',
+        onSaved: event => saved.push(event.filename),
+        open: args => {
+            const dialog = { args, closed: 0 };
+            dialogs.push(dialog);
+            return { close: () => { dialog.closed += 1; args.onStop(); } };
+        },
+        close: () => { closes += 1; },
+        notify: text => toasts.push(text),
+        ...extra,
+    });
+    return { handle, dialogs, toasts, saved, closes: () => closes };
+}
+const approve = (dialog, tags = ['x']) => dialog.args.onSaved({ filename: dialog.args.image.filename, tags, target: {} });
+
+test('the first image opens at once with the session model, options and its position', () => {
+    const { dialogs } = session();
+    assert.equal(dialogs.length, 1);
+    const { args } = dialogs[0];
+    assert.equal(args.image, images[0]);
+    assert.deepEqual(args.position, { index: 1, total: 3 });
+    assert.deepEqual(args.preset, { model: 'wd14-vit', options: OPTIONS });
+    assert.equal(args.autoGenerate, true);
+    assert.equal(args.actions, 'review');
+    assert.equal(args.source, 'bulk');
+    assert.equal(args.trigger, 'auto-tag');
+    assert.throws(() => module().startReviewSession({ images: [] }), TypeError);
+});
+
+test('advances only on approve or skip and writes nothing on skip or stop', () => {
+    const { dialogs, toasts, saved } = session();
+    // Nothing from the dialog (a Generate in progress, a model-busy answer): the session waits on that image.
+    assert.equal(dialogs.length, 1);
+    dialogs[0].args.onSkip();
+    assert.equal(dialogs.length, 2);
+    assert.deepEqual(dialogs[1].args.position, { index: 2, total: 3 });
+    // A second report from a dialog already left changes nothing.
+    dialogs[0].args.onSkip();
+    dialogs[0].args.onStop();
+    assert.equal(dialogs.length, 2);
+    approve(dialogs[1]);
+    assert.equal(dialogs.length, 3);
+    dialogs[2].args.onStop();
+    assert.deepEqual(saved, ['b.png']);
+    assert.deepEqual(toasts, ['1 of 3 images tagged.']);
+    assert.equal(dialogs.length, 3);
+});
+
+test('approve saves exactly the dialog\'s manual-plus-chips set', () => {
+    // The session never writes itself: each approve is the dialog's own Save (its event carries the saved set).
+    const forwarded = [];
+    const { dialogs } = session({ onSaved: event => forwarded.push(event.tags) });
+    approve(dialogs[0], ['manual', 'chip']);
+    assert.deepEqual(forwarded, [['manual', 'chip']]);
+    assert.deepEqual(dialogs[1].args.preset, { model: 'wd14-vit', options: OPTIONS });
+});
+
+test('last image offers Approve and finish', () => {
+    const { dialogs, toasts, closes } = session();
+    approve(dialogs[0]);
+    dialogs[1].args.onSkip();
+    assert.deepEqual(dialogs[2].args.position, { index: 3, total: 3 });
+    approve(dialogs[2]);
+    // The last approve ends the session: the dialog closes and the count is toasted once.
+    assert.equal(closes(), 1);
+    assert.deepEqual(toasts, ['2 of 3 images tagged.']);
+    dialogs[2].args.onStop();
+    assert.deepEqual(toasts, ['2 of 3 images tagged.']);
+});
+
+test('model-busy on one image waits for retry or skip', () => {
+    const { dialogs, toasts } = session();
+    // The dialog shows the refusal with Retry; a Retry that succeeds then approves, all on the same image.
+    assert.equal(dialogs.length, 1);
+    approve(dialogs[0]);
+    assert.equal(dialogs.length, 2);
+    assert.deepEqual(toasts, []);
+});
+
+test('stop releases listeners and in-flight requests', () => {
+    const { handle, dialogs, toasts, saved } = session();
+    handle.stop();
+    assert.equal(dialogs[0].closed, 1);
+    assert.deepEqual(toasts, ['0 of 3 images tagged.']);
+    // A save that settles after the stop still counts as written, but nothing opens or toasts again.
+    approve(dialogs[0]);
+    dialogs[0].args.onSkip();
+    handle.stop();
+    assert.equal(dialogs.length, 1);
+    assert.deepEqual(saved, ['a.png']);
+    assert.deepEqual(toasts, ['0 of 3 images tagged.']);
+    assert.equal(module().reviewOutcome(1, 1), '1 of 1 images tagged.');
+});

tests/js/workspace-inspection-state.test.js

@@ -702,3 +702,126 @@ test('a workflow the legacy parser throws on keeps the server result instead of
     assert.deepEqual(record.prompts.positive, { status: 'resolved', text: 'exact\npositive', source: 'execution' });
     assert.equal(record.prompts.negative.status, 'ambiguous');
 });
+
+// PR L2 Task 4(a): an adapter that reads by itself (the local file adapter) never reaches the API.
+test('controller prefers adapter.read and never touches api', async () => {
+    const createController = contract('createInspectionController');
+    const forbidden = new Proxy({}, { get(_, key) { assert.fail(`api.${String(key)} touched`); } });
+    const reads = [], records = [];
+    const adapter = {
+        validate(item) { if (!item?.key) throw new TypeError('bad'); }, key: item => item.key, scope: () => 'own', inspectionPath: item => `own:${item.key}`,
+        read(item, options) { const pending = {}; reads.push({ item, options, pending }); return new Promise((resolve, reject) => Object.assign(pending, { resolve, reject })); },
+        toRecord(result, item) { records.push([result, item.key]); return { identity: { kind: 'own', key: item.key }, prompts: result.prompts }; },
+    };
+    for (const api of [forbidden, null]) {
+        reads.length = 0; records.length = 0;
+        const controller = createController({ api, adapter, extractFacts: extractGenerationFacts });
+        const first = controller.select({ key: 'a' });
+        assert.equal(reads.length, 1);
+        assert.equal(reads[0].item.key, 'a');
+        assert.ok(reads[0].options.signal instanceof AbortSignal);
+        assert.equal(controller.state.loading, true);
+        const second = controller.select({ key: 'b' });
+        assert.equal(reads[0].options.signal.aborted, true, 'a new selection aborts the previous read');
+        reads[0].pending.resolve({ prompts: { positive: { status: 'resolved', text: 'late' } } });
+        await first;
+        assert.equal(controller.state.record, null, 'a superseded read never publishes');
+        reads[1].pending.resolve({ prompts: { positive: { status: 'resolved', text: 'current' } } });
+        await second;
+        assert.deepEqual(records.map(([, key]) => key), ['b']);
+        assert.equal(controller.state.record.prompts.positive.text, 'current');
+        const retry = controller.retry();
+        reads[2].pending.reject(new Error('read failed'));
+        await retry;
+        assert.equal(controller.state.error, true);
+        assert.equal(controller.state.message, 'Could not read details from this file.');
+        controller.dispose();
+    }
+});
+
+test('rooted and history adapters are unchanged', async () => {
+    const createController = contract('createInspectionController');
+    const { reportedLocationAdapter } = await import('../../web/js/workspace/history-media.mjs');
+    for (const adapter of [module.rootedFileAdapter, reportedLocationAdapter]) {
+        assert.equal(adapter.read, undefined, 'server adapters read through the API');
+        assert.equal(adapter.mediaUrl, undefined, 'server adapters keep the cache-busted original');
+    }
+    const { api, requests } = pendingApi();
+    const rooted = createController({ api, extractFacts: extractGenerationFacts });
+    rooted.select(image());
+    assert.deepEqual(requests.map(request => request.url), [`/prompt_manager/images/inspect/folder/a%20%23%25.png?root=0&root_scope=${scopeA}`]);
+    rooted.dispose();
+    const run = '22222222-2222-2222-2222-222222222222', epoch = '11111111-1111-1111-1111-111111111111';
+    const query = new URLSearchParams({ node: '1', ordinal: '1', epoch, current_scope: scopeA }), base = `/prompt_manager/history/runs/${run}/output/current`;
+    const target = { kind: 'reported-location', location_key: 'c'.repeat(64), history_epoch: epoch, current_scope: scopeA, occurrence: { run_id: run, output_node_id: '1', image_ordinal: 1 },
+        reference: { folder_type: 'output', subfolder: '', filename: 'a.png', path_style: 'posix', root_key: scopeB }, filename: 'a.png', is_video: false,
+        url: `${base}/media?${query}`, thumbnail_url: `${base}/thumbnail?${query}`, inspection_url: `${base}/inspection?${query}` };
+    const history = pendingApi(), recorded = createController({ api: history.api, adapter: reportedLocationAdapter, extractFacts: extractGenerationFacts });
+    recorded.select(target);
+    assert.deepEqual(history.requests.map(request => request.url), [target.inspection_url]);
+    recorded.dispose();
+});
+
+test('fileFor rejects selected-local-file for rooted identity', () => {
+    const entry = image(), data = envelope(entry);
+    data.file = { ...data.file, observation: 'selected-local-file', source_label: 'Selected local file' };
+    assert.throws(() => contract('toInspectionRecord')(data, entry, extractGenerationFacts), /Invalid inspection file/);
+    const project = contract('projectInspectionPayload');
+    assert.throws(() => project(data, { kind: 'rooted-file', key: 'k', path: 'a.png' }, null, extractGenerationFacts), /Invalid inspection file/);
+    assert.throws(() => project(envelope(entry), { kind: 'local-file', key: 'local:1', path: 'a.png' }, null, extractGenerationFacts), /Invalid inspection file/);
+    assert.equal(project(data, { kind: 'local-file', key: 'local:1', path: 'a.png' }, null, extractGenerationFacts).file.observation, 'selected-local-file');
+});
+
+// #249 PR C Task C3: the B3 envelope's `image_tags` facet, the file's own current tags (S1).
+test('image_tags facet is kept exactly and absent stays null', () => {
+    const entry = image(), project = contract('toInspectionRecord');
+    assert.equal(project(envelope(entry), entry, extractGenerationFacts).imageTags, null);
+    for (const facet of [{ state: 'current', tags: ['dunes', 'warm_light'] }, { state: 'current', tags: [] }, { state: 'none', tags: [] }, { state: 'unavailable', tags: [] }]) {
+        const data = { ...envelope(entry), image_tags: facet };
+        const record = project(data, entry, extractGenerationFacts);
+        assert.deepEqual(record.imageTags, facet);
+        assert.notEqual(record.imageTags.tags, facet.tags);
+    }
+    const hundred = Array.from({ length: 100 }, (_, index) => `tag_${index}`);
+    assert.deepEqual(project({ ...envelope(entry), image_tags: { state: 'current', tags: hundred } }, entry, extractGenerationFacts).imageTags.tags, hundred);
+});
+
+test('rejects a malformed image_tags facet', () => {
+    const entry = image();
+    for (const facet of [null, [], 'current', { state: 'current' }, { tags: [] }, { state: 'current', tags: ['a'], extra: 1 },
+        { state: 'stale', tags: [] }, { state: 'none', tags: ['a'] }, { state: 'unavailable', tags: ['a'] }, { state: 'current', tags: 'a' },
+        { state: 'current', tags: [1] }, { state: 'current', tags: [''] }, { state: 'current', tags: [' a'] }, { state: 'current', tags: ['a,b'] },
+        { state: 'current', tags: ['a\nb'] }, { state: 'current', tags: ['x'.repeat(51)] },
+        { state: 'current', tags: Array.from({ length: 101 }, (_, index) => `tag_${index}`) }]) {
+        assert.throws(() => module.toInspectionRecord({ ...envelope(entry), image_tags: facet }, entry, extractGenerationFacts), TypeError, JSON.stringify(facet));
+    }
+    assert.equal(module.toInspectionRecord({ ...envelope(entry), image_tags: { state: 'current', tags: ['é'.repeat(50)] } }, entry, extractGenerationFacts).imageTags.tags[0].length, 50);
+});
+
+test('refresh re-reads the selected file and keeps the shown record until the new read lands', async () => {
+    const { api, requests } = pendingApi(), updates = [];
+    const controller = contract('createInspectionController')({ api, extractFacts: extractGenerationFacts });
+    assert.equal(typeof controller.refresh, 'function', 'refresh is part of the controller');
+    controller.subscribe(state => updates.push(state));
+    const load = controller.select(image()); requests[0].resolve(envelope()); await load;
+    const shown = controller.state, count = updates.length;
+    const refresh = controller.refresh();
+    assert.equal(requests.length, 2);
+    // No loading state is published: the panel keeps its content.
+    assert.equal(controller.state, shown); assert.equal(updates.length, count);
+    requests[1].resolve({ ...envelope(), image_tags: { state: 'current', tags: ['fresh'] } }); await refresh;
+    assert.deepEqual(controller.state.record.imageTags, { state: 'current', tags: ['fresh'] });
+    assert.equal(controller.state.loading, false); assert.equal(updates.length, count + 1);
+    // A failed quiet re-read reports the failure as a read would.
+    const failing = controller.refresh(); requests[2].reject(new Error('offline')); await failing;
+    assert.equal(controller.state.error, true);
+    // Without a shown record a refresh is an ordinary retry (loading published).
+    const again = controller.refresh(); assert.equal(controller.state.loading, true);
+    requests[3].resolve(envelope()); await again; assert.equal(controller.state.error, false);
+    // A newer selection supersedes a refresh in flight.
+    const stale = controller.refresh(); const other = controller.select({ ...image(), path: 'folder/b.png', filename: 'b.png', url: image().url.replace('a%20%23%25', 'b') });
+    requests[5].resolve(envelope({ ...image(), path: 'folder/b.png', filename: 'b.png', url: image().url.replace('a%20%23%25', 'b') })); await other;
+    requests[4].resolve(envelope()); await stale;
+    assert.equal(controller.state.record.identity.path, 'folder/b.png');
+    controller.dispose(); assert.equal(await controller.refresh(), undefined);
+});

tests/js/workspace-local-inspection.test.js

@@ -20,6 +20,16 @@ const { extractGenerationFacts } = ComfyMetadata;
 // The page loads both as scripts; the legacy fill and the PNG reader find them on the global.
 globalThis.PngMetadata = PngMetadata;
 globalThis.ComfyMetadata = ComfyMetadata;
+// The page's API client and the node table it serves (local-semantics.mjs fetches it once).
+const SEMANTICS = fs.readFileSync(path.join(here, "..", "..", "web", "js", "inspection-semantics.json"), "utf8");
+globalThis.window = { ApiClient: { resolveUrl: (value) => value } };
+// A test can hold the table request (`tableGate`) to stand for a slow or stalled proxy.
+let tableGate = null;
+globalThis.fetch = async (url) => {
+    if (url !== "/prompt_manager/js/inspection-semantics.json") throw new Error(`unexpected request ${url}`);
+    if (tableGate) await tableGate;
+    return new Response(SEMANTICS, { status: 200 });
+};
 const m = await import("../../web/js/workspace/local-inspection.mjs").catch((error) => {
     if (error.code !== "ERR_MODULE_NOT_FOUND") throw error;
     return {};
@@ -59,6 +69,37 @@ test("contract", () => {
     assert.ok(Object.isFrozen(m.localFileAdapter));
 });
 
+// M3: the first read waits for the page's one table request; an aborted, replaced or cleared selection must not.
+test("a read waiting for the node table ends with its selection", async () => {
+    let release;
+    tableGate = new Promise((resolve) => { release = resolve; });
+    try {
+        const file = pngFile("slow.png", [tEXt("prompt", PROMPT)]);
+        const aborted = new AbortController();
+        const reading = m.localFileAdapter.read(await handleFor(file), { signal: aborted.signal });
+        const settled = (promise) => Promise.race([promise.then(() => "resolved", (error) => error.name), new Promise((resolve) => setTimeout(() => resolve("pending"), 200))]);
+        await new Promise((resolve) => setTimeout(resolve, 20));
+        aborted.abort();
+        assert.equal(await settled(reading), "AbortError");
+        // Through the controller: clearing the selection ends its read; nothing is published for it.
+        const controller = createInspectionController({ api: null, adapter: m.localFileAdapter, extractFacts: extractGenerationFacts });
+        const states = [];
+        controller.subscribe((state) => states.push(state));
+        const selected = controller.select(await handleFor(file));
+        await new Promise((resolve) => setTimeout(resolve, 20));
+        controller.clear();
+        assert.equal(await settled(selected), "resolved");
+        assert.ok(states.every((state) => state.record === null && state.error === false), "no record or error for a cleared selection");
+        controller.dispose();
+    } finally {
+        tableGate = null;
+        release();
+    }
+    // The shared request still lands for the next selection.
+    const { wire } = await recordFor(pngFile("next.png", [tEXt("prompt", PROMPT)]));
+    assert.equal(wire.resolution.state, "resolved");
+});
+
 test("a PNG File becomes the server-shaped wire with local provenance", async () => {
     const file = pngFile("Fox Render.PNG", [tEXt("prompt", PROMPT), tEXt("workflow", WORKFLOW)]);
     const { wire, record, handle } = await recordFor(file);
@@ -66,8 +107,12 @@ test("a PNG File becomes the server-shaped wire with local provenance", async ()
         size: file.size, width: 640, height: 480, modified_time: 1_700_000_000.123 });
     assert.equal(wire.success, true);
     assert.equal(wire.inspection_version, 1);
-    assert.deepEqual(wire.prompts, { positive: { status: "unresolved" }, negative: { status: "unresolved" } });
-    assert.deepEqual(wire.resolution, { state: "unresolved", sampler_id: null, reason: "Resolved in this browser from the workflow.", reason_code: null, node: null });
+    // The roles the server's inspector resolves for the same records (local-resolver.mjs).
+    assert.deepEqual(wire.prompts, {
+        positive: { status: "resolved", text: "a red fox in snow, detailed fur", source: "graph-inferred" },
+        negative: { status: "resolved", text: "blurry, lowres", source: "graph-inferred" },
+    });
+    assert.deepEqual(wire.resolution, { state: "resolved", sampler_id: "3", reason: "", reason_code: null, node: null });
     assert.deepEqual(wire.library, { status: "unavailable", scope: "saved-library", tags: [], category_scope: null, tags_scope: null });
     assert.equal(wire.metadata.status, "available");
     assert.deepEqual(wire.metadata.raw, { prompt: PROMPT, workflow: WORKFLOW });
@@ -96,6 +141,33 @@ test("a PNG File becomes the server-shaped wire with local provenance", async ()
     assert.equal(exported.file.source_label, "Selected local file");
 });
 
+test("roles answer as the server's inspector: unreadable, unavailable table, ambiguous", async () => {
+    const png = { media: "image", kind: "png" };
+    const unreadable = m.buildLocalPayload({ read: null, file: { name: "a.png" }, classification: png });
+    assert.deepEqual(unreadable.resolution, { state: "unresolved", sampler_id: null, reason: "Media metadata could not be read", reason_code: null, node: null });
+    assert.equal(unreadable.prompts.positive.message, "Metadata in this file could not be read.");
+    const records = { prompt: PROMPT };
+    const read = { status: "complete", records, limited: [], width: 2, height: 3 };
+    // Without a table (it could not be fetched) the roles stay open, with the server's own line.
+    const missing = m.buildLocalPayload({ read, file: { name: "a.png" }, classification: png });
+    assert.equal(missing.resolution.reason, "Inspection node semantics are unavailable");
+    assert.equal(missing.prompts.positive.message, "The inspector's node table is unavailable.");
+    const semantics = await (await import("../../web/js/workspace/local-semantics.mjs")).loadInspectionSemantics();
+    const graph = JSON.parse(PROMPT);
+    graph["9"] = { ...graph["3"], inputs: { ...graph["3"].inputs, positive: ["8", 0] } };
+    graph["8"] = { class_type: "CLIPTextEncode", inputs: { text: "a cat", clip: ["4", 1] } };
+    const several = m.buildLocalPayload({ read: { ...read, records: { prompt: JSON.stringify(graph) } }, file: { name: "a.png" }, classification: png, semantics });
+    assert.equal(several.resolution.reason, "Multiple sampler branches");
+    assert.deepEqual(several.prompts.positive, { status: "ambiguous", text: null, source: null });
+    // The legacy fill then applies exactly as it does to the server's answer for the same bytes in Images.
+    const handle = await handleFor(pngFile("grid.png", [tEXt("prompt", JSON.stringify(graph))]));
+    const local = m.localFileAdapter.toRecord(several, handle, extractGenerationFacts);
+    const asServed = { ...several, file: { ...several.file, observation: "current-file", source_label: "output" } };
+    const served = projectInspectionPayload(asServed, { kind: "rooted-file", key: "0:grid.png", root_index: 0, path: "grid.png", root_scope: null }, null, extractGenerationFacts);
+    assert.deepEqual(local.prompts, served.prompts);
+    assert.deepEqual(local.generation, served.generation);
+});
+
 test("file facts follow the server: extension like Path.suffix, null when unknown", async () => {
     const cases = [["a.b.PnG", ".png"], [".hidden", ""], ["noext", ""], ["dot.", ""], ["x.tar.gz", ".gz"]];
     for (const [name, extension] of cases) {
@@ -267,9 +339,10 @@ test("select reuses the same local key", async () => {
     assert.equal(m.localFileAdapter.inspectionPath(first), `local-file:${first.key}`);
     assert.equal(m.localFileAdapter.key(first), first.key);
     const reads = [];
-    // Until the loader seam lands (PR L2 Task 4) the controller reaches the adapter through api.get.
-    const api = { get: (sentinel) => { reads.push(sentinel); return m.localFileAdapter.read(reads.length === 1 || sentinel === `local-file:${first.key}` ? first : second); } };
-    const controller = createInspectionController({ api, extractFacts: extractGenerationFacts, adapter: m.localFileAdapter });
+    // The controller calls adapter.read itself (PR L2 Task 4); the API is never reached.
+    const api = new Proxy({}, { get: (_, key) => assert.fail(`api.${String(key)} touched`) });
+    const adapter = { ...m.localFileAdapter, read: (handle, options) => { reads.push(m.localFileAdapter.inspectionPath(handle)); return m.localFileAdapter.read(handle, options); } };
+    const controller = createInspectionController({ api, extractFacts: extractGenerationFacts, adapter });
     const pending = controller.select(first);
     assert.equal(controller.select(first), pending, "the same handle returns the pending read");
     await pending;
@@ -306,3 +379,89 @@ test("the parity corpus PNGs read into renderable records", async () => {
         assert.ok(["parsed", "limited", "malformed"].includes(wire.metadata.prompt_graph.status));
     }
 });
+
+// M4: resolution runs on the page's main thread, so a read yields between its bounded steps (the busy state paints
+// and input is handled) and no step may exceed a budget on the largest record the readers keep (2 MiB of roles).
+const ROLE_BYTES = 2 * 1024 * 1024;
+// Generous for a shared CI runner: a desktop resolves these in 130-455 ms.
+const STEP_BUDGET_MS = 2500;
+const ENCODE = (text) => ({ class_type: "CLIPTextEncode", inputs: { text, clip: ["4", 1] } });
+const KSAMPLER = (positive, negative, latent) => ({ class_type: "KSampler", inputs: { seed: 1, steps: 20, cfg: 8.0, sampler_name: "euler", scheduler: "normal",
+    denoise: 1.0, model: ["4", 0], positive, negative, latent_image: latent } });
+const LOADERS = { "4": { class_type: "CheckpointLoaderSimple", inputs: { ckpt_name: "m.safetensors" } }, "5": { class_type: "EmptyLatentImage", inputs: { width: 64, height: 64, batch_size: 1 } } };
+/** The largest graph of this shape whose JSON fits the role budget. */
+function maximal(build, high) {
+    let low = 1;
+    while (low < high) {
+        const middle = (low + high + 1) >> 1;
+        if (Buffer.byteLength(JSON.stringify(build(middle)), "utf8") <= ROLE_BYTES) low = middle;
+        else high = middle - 1;
+    }
+    return JSON.stringify(build(low));
+}
+const MAXIMAL_GRAPHS = {
+    // Many candidates: every sampler is a final stage with its own pair.
+    independent: maximal((count) => {
+        const graph = { ...LOADERS };
+        for (let index = 0; index < count; index++) {
+            graph[`s${index}`] = KSAMPLER([`p${index}`, 0], [`n${index}`, 0], ["5", 0]);
+            graph[`p${index}`] = ENCODE(`fox ${index}`);
+            graph[`n${index}`] = ENCODE(`blur ${index}`);
+        }
+        return graph;
+    }, 6666),
+    // One long stage chain through the latent: the deepest stage walk.
+    chain: maximal((count) => {
+        const graph = { ...LOADERS, "6": ENCODE("fox"), "7": ENCODE("blur") };
+        for (let index = 0; index < count; index++) graph[`s${index}`] = KSAMPLER(["6", 0], ["7", 0], index ? [`s${index - 1}`, 0] : ["5", 0]);
+        return graph;
+    }, 19996),
+};
+
+test("resolution of a maximal 2 MiB graph stays within the step budget", async () => {
+    const { resolveLocalEvidence } = await import("../../web/js/workspace/local-resolver.mjs");
+    const semantics = await (await import("../../web/js/workspace/local-semantics.mjs")).loadInspectionSemantics();
+    for (const [name, prompt] of Object.entries(MAXIMAL_GRAPHS)) {
+        assert.ok(Buffer.byteLength(prompt, "utf8") > ROLE_BYTES - 1024, `${name} fills the role budget`);
+        const started = performance.now();
+        const evidence = resolveLocalEvidence({ prompt }, semantics);
+        const elapsed = performance.now() - started;
+        assert.ok(elapsed < STEP_BUDGET_MS, `${name}: ${Math.round(elapsed)} ms`);
+        assert.notEqual(evidence.resolution.reason_code, "malformed", name);
+    }
+});
+
+test("a read yields between bounded steps and answers byte for byte as one synchronous build", async () => {
+    const semantics = await (await import("../../web/js/workspace/local-semantics.mjs")).loadInspectionSemantics();
+    const file = pngFile("maximal.png", [tEXt("prompt", MAXIMAL_GRAPHS.independent)]);
+    const handle = await handleFor(file);
+    const marks = [];
+    const yieldControl = async (signal) => {
+        signal?.throwIfAborted();
+        marks.push(performance.now());
+        await new Promise((resolve) => setTimeout(resolve, 0));
+    };
+    const started = performance.now();
+    const wire = await m.localFileAdapter.read(handle, { signal: new AbortController().signal, yieldControl });
+    marks.push(performance.now());
+    // Resolution and the projection each run in a turn of their own after the table is in.
+    assert.ok(marks.length >= 3, `yields: ${marks.length - 1}`);
+    const gaps = marks.map((mark, index) => mark - (index ? marks[index - 1] : started));
+    assert.ok(Math.max(...gaps) < STEP_BUDGET_MS, `longest step ${Math.round(Math.max(...gaps))} ms`);
+    const { result } = await m.readLocalFile(file, { classification: handle.classification });
+    const direct = await m.fitLocalPayload(m.buildLocalPayload({ read: result, file: { name: handle.filename, size: file.size, lastModified: file.lastModified },
+        classification: handle.classification, semantics }));
+    assert.equal(JSON.stringify(wire), JSON.stringify(direct));
+    assert.equal(wire.resolution.state, "ambiguous");
+    // An abort at any yield ends the read there.
+    for (let stop = 0; stop < marks.length - 1; stop++) {
+        const controller = new AbortController();
+        let seen = 0;
+        const stopping = async (signal) => {
+            if (seen++ === stop) controller.abort();
+            signal.throwIfAborted();
+            await new Promise((resolve) => setTimeout(resolve, 0));
+        };
+        await assert.rejects(m.localFileAdapter.read(handle, { signal: controller.signal, yieldControl: stopping }), { name: "AbortError" }, `yield ${stop}`);
+    }
+});

tests/js/workspace-local-resolver.test.js

@@ -0,0 +1,161 @@
+// PR L3 Tasks 8-9: the server's inspection resolver in this browser. The values below are what CPython answers
+// (json.loads, len, str.strip, repr, utils/prompt_inspector.inspect_prompt_evidence); the full comparison with the
+// server runs in tests/test_local_inspect_parity.py through tests/js/support/local-inspect-oracle.mjs.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+
+const py = await import('../../web/js/workspace/py-json.mjs');
+const resolver = await import('../../web/js/workspace/local-resolver.mjs');
+const semantics = resolver.compileSemantics(JSON.parse(fs.readFileSync(new URL('../../web/js/inspection-semantics.json', import.meta.url), 'utf8')));
+
+test('json.loads keeps Python value kinds and dict order', () => {
+    const value = py.pyJsonLoads('{"9": 1, "10": 1.0, "a": NaN, "9": [true, -0, 9007199254740993, -Infinity]}');
+    assert.ok(value instanceof Map);
+    // A repeated key keeps its first position and takes its last value; integer-like keys keep text order.
+    assert.deepEqual([...value.keys()], ['9', '10', 'a']);
+    const [flag, zero, big, negative] = value.get('9');
+    assert.equal(flag, true); assert.equal(zero, 0); assert.equal(big, 9007199254740993n);
+    assert.ok(negative instanceof py.PyFloat); assert.equal(negative.value, -Infinity);
+    assert.ok(value.get('10') instanceof py.PyFloat, '1.0 is a float, not an int');
+    assert.ok(Number.isNaN(value.get('a').value));
+    assert.equal(py.isInt(value.get('10')), false);
+    assert.equal(py.pyJsonLoads('"\\ud83d\\ude00\\ud800"'), '\u{1f600}\ud800');
+    for (const bad of ['{}', '{"a":1,}', '[01]', '{"a" 1}', '"\u0001"', '"\\x"', '1 2', '-', `${'9'.repeat(4301)}`, '"\\ud800\\uzzzz"']) {
+        assert.throws(() => py.pyJsonLoads(bad), py.PyValueError, bad);
+    }
+    assert.equal(py.pyJsonLoads(` ${'9'.repeat(4300)}\n`), BigInt('9'.repeat(4300)));
+});
+
+// One depth cap for both browser CPython-JSON parsers (py-json.mjs here, local-video.mjs for video envelopes): every
+// array or object counts, an empty one too, as CPython's scanner enters recursion for each; past the cap it refuses.
+test('json.loads refuses nesting past the shared depth cap, counting every container', () => {
+    const video = import('../../web/js/workspace/local-video.mjs');
+    assert.equal(py.JSON_MAX_DEPTH, 1000);
+    const nest = (depth, inner = '') => '['.repeat(depth) + inner + ']'.repeat(depth);
+    const objects = (depth, inner) => '{"a":'.repeat(depth) + inner + '}'.repeat(depth);
+    for (const text of [nest(1000), nest(1000, '1'), nest(999, '{}'), objects(1000, '1'), objects(999, '[]')]) assert.doesNotThrow(() => py.pyJsonLoads(text));
+    for (const text of [nest(1001), nest(1001, '1'), nest(1000, '{}'), objects(1001, '1'), objects(1000, '[]')]) {
+        assert.throws(() => py.pyJsonLoads(text), py.PyValueError);
+    }
+    return video.then(({ pythonJsonLoads, PythonJsonError }) => {
+        for (const text of [nest(1000), nest(1000, '1'), objects(999, '[]')]) assert.doesNotThrow(() => pythonJsonLoads(text));
+        for (const text of [nest(1001), nest(1001, '1'), objects(1000, '[]')]) {
+            assert.throws(() => pythonJsonLoads(text), error => error instanceof PythonJsonError && error.recursion === true);
+        }
+    });
+});
+
+test('str helpers measure, slice and strip as CPython', () => {
+    assert.equal(py.pyLen('a\u{1f600}\ud800'), 3);
+    assert.equal(py.pySlice('\u{1f600}\u{1f600}x', 2), '\u{1f600}\u{1f600}');
+    // str.isspace() includes \x1c-\x1f and \x85 and excludes , unlike String.prototype.trim.
+    assert.equal(py.pyStrip('\x1c\x85 a b　\x1f'), 'a b');
+    assert.equal(py.pyStrip('a'), 'a');
+    assert.deepEqual([1.0, 0.0001, 1e-5, 1e16, 123456789012345.6, -2.5, 1e22].map(py.pyFloatRepr),
+        ['1.0', '0.0001', '1e-05', '1e+16', '123456789012345.6', '-2.5', '1e+22']);
+    assert.deepEqual([null, true, 0, 1n, new py.PyFloat(2), '', [], new Map()].map(py.pyTruthy), [false, true, false, true, true, false, false, false]);
+    assert.deepEqual([1, 1n, true, new py.PyFloat(1), '1', 2].map(py.pyEqualsOne), [true, true, true, true, false, false]);
+});
+
+const encode = text => ({class_type: 'CLIPTextEncode', inputs: {text, clip: ['4', 1]}});
+const sampler = (extra = {}) => ({class_type: 'KSampler', inputs: {seed: 1, positive: ['6', 0], negative: ['7', 0], latent_image: ['5', 0], model: ['4', 0], ...extra}});
+const base = (nodes = {}) => ({'3': sampler(), '4': {class_type: 'CheckpointLoaderSimple', inputs: {ckpt_name: 'm.safetensors'}},
+    '5': {class_type: 'EmptyLatentImage', inputs: {width: 64, height: 64, batch_size: 1}}, '6': encode('a fox'), '7': encode('blurry'), ...nodes});
+
+test('a single chain resolves both roles with their sources', () => {
+    const evidence = resolver.resolveLocalEvidence({prompt: JSON.stringify(base())}, semantics);
+    assert.deepEqual(evidence, {
+        prompts: {positive: {status: 'resolved', text: 'a fox', source: 'graph-inferred'}, negative: {status: 'resolved', text: 'blurry', source: 'graph-inferred'}},
+        resolution: {state: 'resolved', sampler_id: '3', reason: '', reason_code: null, node: null},
+    });
+});
+
+test('records without roles, malformed text and a missing sampler answer as the server', () => {
+    assert.deepEqual(resolver.resolveLocalEvidence({workflow: '{}'}, semantics).resolution,
+        {state: 'absent', sampler_id: null, reason: 'No parsed prompt metadata', reason_code: null, node: null});
+    const malformed = resolver.resolveLocalEvidence({prompt: '{broken'}, semantics);
+    assert.equal(malformed.resolution.reason, 'Prompt evidence is malformed');
+    assert.equal(malformed.prompts.positive.message, 'Prompt metadata in this file is malformed.');
+    const none = resolver.resolveLocalEvidence({prompt: JSON.stringify({'1': encode('x'), '2': {class_type: 'MySampler', inputs: {positive: ['1', 0]}}})}, semantics);
+    assert.deepEqual(none.resolution, {state: 'unresolved', sampler_id: null, reason: 'No supported sampler pair found (saw MySampler)', reason_code: 'no-sampler', node: null});
+    assert.equal(none.prompts.negative.message, 'No supported sampler was found.');
+    assert.equal(resolver.resolveLocalEvidence({prompt: JSON.stringify(base()), parameters: 'x'}, null).resolution.reason, 'Inspection node semantics are unavailable');
+});
+
+test('a float output slot is not a link, and a runtime node is named', () => {
+    const floatSlot = resolver.resolveLocalEvidence({prompt: JSON.stringify(base()).replace('"positive":["6",0]', '"positive":["6",0.0]')}, semantics);
+    assert.deepEqual(floatSlot.resolution, {state: 'unresolved', sampler_id: '3', reason: 'Expected a typed graph link or text input', reason_code: 'malformed', node: null});
+    const runtime = resolver.resolveLocalEvidence({prompt: JSON.stringify(base({'6': {class_type: 'PromptSearchList', inputs: {}}}))}, semantics);
+    assert.deepEqual(runtime.resolution.node, {id: '6', class_type: 'PromptSearchList'});
+    assert.equal(runtime.prompts.positive.message, 'Prompt is chosen at run time (PromptSearchList).');
+});
+
+test('execution evidence replaces a PromptManagerPair text when it matches the node inputs', () => {
+    const pair = {class_type: 'PromptManagerPair', inputs: {text: 'fox', negative_text: 'blur', prepend_text: '', append_text: ''}};
+    const record = {text: 'fox', negative_text: 'blur', positive_text: 'fox, executed', negative_effective_text: 'blur', prepend_text: '', append_text: ''};
+    const graph = base({'3': sampler({positive: ['8', 0], negative: ['8', 1]}), '8': pair});
+    const evidence = resolver.resolveLocalEvidence({prompt: JSON.stringify(graph), comfyassets_prompt_pairs: JSON.stringify({version: 1, nodes: {'8': {records: [record]}}})}, semantics);
+    assert.deepEqual(evidence.prompts.positive, {status: 'resolved', text: 'fox, executed', source: 'execution'});
+    const stale = resolver.resolveLocalEvidence({prompt: JSON.stringify(graph), comfyassets_prompt_pairs: JSON.stringify({version: 1, nodes: {'8': {records: [{...record, text: 'other'}]}}})}, semantics);
+    assert.equal(stale.resolution.reason, 'Execution evidence does not match recorded node inputs');
+});
+
+test('identical sampler branches resolve to their shared pair, differing ones stay ambiguous (#270)', () => {
+    const shared = resolver.resolveLocalEvidence({prompt: JSON.stringify(base({'9': sampler()}))}, semantics);
+    assert.deepEqual(shared.resolution, {state: 'resolved', sampler_id: null, reason: 'Every sampler branch uses the same prompt pair', reason_code: null, node: null});
+    assert.equal(shared.prompts.positive.text, 'a fox');
+    const differ = resolver.resolveLocalEvidence({prompt: JSON.stringify(base({'9': sampler({positive: ['8', 0]}), '8': encode('a cat')}))}, semantics);
+    assert.deepEqual(differ.resolution, {state: 'ambiguous', sampler_id: null, reason: 'Multiple sampler branches', reason_code: null, node: null});
+    assert.equal(differ.prompts.positive.status, 'ambiguous');
+});
+
+test('a detailer stage is compared with the sampler in its image ancestry', () => {
+    const graph = base({'10': {class_type: 'VAEDecode', inputs: {samples: ['3', 0]}}, '8': encode('a cat'), '12': {class_type: 'SaveImage', inputs: {images: ['11', 0]}},
+        '11': {class_type: 'FaceDetailer', inputs: {image: ['10', 0], model: ['4', 0], positive: ['8', 0], negative: ['7', 0]}}});
+    const evidence = resolver.resolveLocalEvidence({prompt: JSON.stringify(graph)}, semantics);
+    assert.deepEqual(evidence.resolution, {state: 'ambiguous', sampler_id: '11', reason: 'Sampler stages have different prompts', reason_code: 'multistage-differs', node: null});
+    assert.equal(evidence.prompts.positive.message, undefined);
+});
+
+test('A1111 parameters split on the unique settings footer as Python does', () => {
+    const read = text => resolver.resolveLocalEvidence({parameters: text}, semantics);
+    assert.deepEqual(read('a fox\nNegative prompt: blur\nSteps: 20, Sampler: euler').prompts, {
+        positive: {status: 'resolved', text: 'a fox', source: 'embedded-parameters'}, negative: {status: 'resolved', text: 'blur', source: 'embedded-parameters'},
+    });
+    // Python's multiline ^ and $ break only at \n: a U+2028 or a lone \r never starts the footer line.
+    for (const text of ['a fox\u2028Steps: 20, x', 'a fox\rSteps: 20, x']) assert.equal(read(text).resolution.reason, 'A1111 settings footer is not unique');
+    // \d is any Unicode decimal digit and \s spans line breaks, as in Python's re.
+    assert.equal(read('a fox\nSteps: \u0662\u0660, x').resolution.reason, 'Negative prompt delimiter is absent');
+    assert.equal(read('a fox\nSteps:\n 20 \n, x').resolution.state, 'absent');
+    assert.equal(read('a fox\nSteps: 1, x\nNegative Template: n\nTemplate: t').resolution.reason_code, 'malformed');
+    assert.equal(read('\u{1f600}'.repeat(60000) + '\nSteps: 1, x').resolution.state, 'absent', 'the length limit counts code points');
+});
+
+test('an unusable semantics table is refused', () => {
+    for (const doc of [null, {schema: 2}, {schema: 1, samplers: []}]) assert.throws(() => resolver.compileSemantics(doc), resolver.SemanticsError);
+});
+
+// The committed server answers (tests/fixtures/local-inspect/resolver-vectors.json, written by
+// `python3 -m tests.local_resolver_cases --write` and checked current by the Python suite).
+test('committed server answers equal the local evidence', () => {
+    const {vectors} = JSON.parse(fs.readFileSync(new URL('../fixtures/local-inspect/resolver-vectors.json', import.meta.url), 'utf8'));
+    const canonical = value => Array.isArray(value) ? value.map(canonical) :
+        value !== null && typeof value === 'object' ? Object.fromEntries(Object.keys(value).sort().map(key => [key, canonical(value[key])])) : value;
+    let compared = 0;
+    for (const {name, records, evidence} of vectors) {
+        assert.deepEqual(canonical(resolver.resolveLocalEvidence(records, semantics)), canonical(evidence), name);
+        compared++;
+    }
+    assert.ok(compared > 280, `compared ${compared}`);
+});
+
+test('a list or object workflow node type is skipped, as on the server (#286)', () => {
+    const graph = base({'6': {class_type: 'PromptManager', inputs: {text: 'a fox', clip: ['4', 1]}}});
+    for (const type of [['PromptManager'], {name: 'PromptManager'}]) {
+        const evidence = resolver.resolveLocalEvidence({prompt: JSON.stringify(graph), workflow: JSON.stringify({nodes: [{id: 6, type, widgets_values: ['x']}]})}, semantics);
+        assert.equal(evidence.resolution.state, 'resolved');
+        assert.equal(evidence.prompts.positive.status, 'resolved');
+        assert.equal(evidence.prompts.positive.text, 'a fox');
+    }
+});

tests/js/workspace-local-semantics.test.js

@@ -0,0 +1,43 @@
+// web/js/workspace/local-semantics.mjs (#249 local Inspect, PR L3 Task 10): the node table local Inspect resolves
+// with is the server's own web/js/inspection-semantics.json, fetched once through the API client before a file is
+// chosen. A table that cannot be fetched or used answers as the server does when its table is unusable.
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+
+const TABLE = fs.readFileSync(new URL("../../web/js/inspection-semantics.json", import.meta.url), "utf8");
+let instance = 0;
+/** A fresh module instance (its cache is per page) with `fetch` and the API client stubbed. */
+async function load(respond) {
+    const calls = [];
+    globalThis.window = { ApiClient: { resolveUrl: (path) => `/proxy${path}` } };
+    globalThis.fetch = async (url, init) => { calls.push([url, init]); return respond(); };
+    const module = await import(`../../web/js/workspace/local-semantics.mjs?instance=${++instance}`);
+    return { module, calls };
+}
+test.after(() => { delete globalThis.window; delete globalThis.fetch; });
+
+test("the table is fetched once through the API client and compiled", async () => {
+    const { module, calls } = await load(() => new Response(TABLE, { status: 200 }));
+    const [first, second] = await Promise.all([module.loadInspectionSemantics(), module.loadInspectionSemantics()]);
+    assert.equal(first, second);
+    assert.ok(first.samplers.has("KSampler"));
+    assert.equal(await module.loadInspectionSemantics(), first);
+    assert.deepEqual(calls, [["/proxy/prompt_manager/js/inspection-semantics.json", { credentials: "same-origin" }]]);
+});
+
+test("a failed or unusable table is null, and a later selection asks again", async () => {
+    for (const respond of [() => new Response("nope", { status: 404 }), () => new Response("{\"schema\": 2}", { status: 200 }), () => { throw new TypeError("offline"); }]) {
+        const { module, calls } = await load(respond);
+        assert.equal(await module.loadInspectionSemantics(), null);
+        assert.equal(await module.loadInspectionSemantics(), null);
+        assert.equal(calls.length, 2);
+    }
+});
+
+test("without the API client nothing is fetched", async () => {
+    const { module, calls } = await load(() => new Response(TABLE));
+    delete globalThis.window;
+    assert.equal(await module.loadInspectionSemantics(), null);
+    assert.deepEqual(calls, []);
+});

tests/js/workspace-local-session.test.js

@@ -0,0 +1,408 @@
+// web/js/workspace/local-session.mjs owns one local selection at a time: it
+// classifies the chosen File by its bytes, creates the blob: URL only for a
+// classified file, hands an owned handle to a real inspection controller, and
+// releases the URL, the handle and the record on replacement, dispose, parent
+// abort and page leave.
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+import { createRequire } from "node:module";
+import { fileURLToPath } from "node:url";
+import { raw, ihdr, idat, iend, tEXt } from "./helpers/png-bytes.mjs";
+import { createScope } from "../../web/js/shared/toolkit/core.js";
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const require = createRequire(import.meta.url);
+const PngMetadata = require("../../web/js/png-metadata.js");
+const ComfyMetadata = require("../../web/js/comfy-metadata.js");
+globalThis.PngMetadata = PngMetadata;
+globalThis.ComfyMetadata = ComfyMetadata;
+const m = await import("../../web/js/workspace/local-session.mjs").catch((error) => {
+    if (error.code !== "ERR_MODULE_NOT_FOUND") throw error;
+    return {};
+});
+const { localFileAdapter } = await import("../../web/js/workspace/local-inspection.mjs");
+
+const FIXTURES = path.join(here, "..", "fixtures", "local-inspect");
+const promptFor = (text) => JSON.stringify({ 3: { class_type: "KSampler", inputs: { seed: 7, steps: 20, cfg: 8, sampler_name: "euler", scheduler: "normal", model: ["4", 0], positive: ["6", 0], negative: ["7", 0] } },
+    4: { class_type: "CheckpointLoaderSimple", inputs: { ckpt_name: "m.safetensors" } }, 6: { class_type: "CLIPTextEncode", inputs: { text, clip: ["4", 1] } }, 7: { class_type: "CLIPTextEncode", inputs: { text: "blurry", clip: ["4", 1] } } });
+const MODIFIED = 1_700_000_000_000;
+
+/** A File that records each slice and lets a test hold slice reads (`gate(index)` returns a promise). */
+class RecordingFile extends File {
+    constructor(parts, name, { gate, ...options } = {}) {
+        super(parts, name, { lastModified: MODIFIED, ...options });
+        this.ranges = [];
+        this.gate = gate;
+    }
+    slice(start, end) {
+        const index = this.ranges.push([start, end]) - 1;
+        const part = super.slice(start, end), gate = this.gate;
+        return { size: part.size, arrayBuffer: async () => { if (gate) await gate(index); return part.arrayBuffer(); } };
+    }
+}
+const pngFile = (name, text = "a red fox", options) => new RecordingFile([raw(ihdr(64, 48), idat(), tEXt("prompt", promptFor(text)), iend())], name, { type: "image/png", ...options });
+const fixture = (name, as = name) => new RecordingFile([fs.readFileSync(path.join(FIXTURES, name))], as);
+function deferred() {
+    let resolve, reject;
+    const promise = new Promise((ok, fail) => { resolve = ok; reject = fail; });
+    return { promise, resolve, reject };
+}
+const settle = async () => { for (let i = 0; i < 30; i++) await new Promise((resolve) => setImmediate(resolve)); };
+
+function urls({ fail = false } = {}) {
+    const created = [], revoked = [];
+    return {
+        created, revoked,
+        createObjectURL(file) { if (fail) throw new Error("no object URLs"); const url = `blob:http://localhost/${created.length + 1}`; created.push({ url, file }); return url; },
+        revokeObjectURL(url) { revoked.push(url); },
+    };
+}
+function pageTarget() {
+    const listeners = new Map();
+    return {
+        listeners,
+        addEventListener(type, callback) { listeners.set(type, callback); },
+        removeEventListener(type, callback) { if (listeners.get(type) === callback) listeners.delete(type); },
+        fire(type) { listeners.get(type)?.({ type }); },
+    };
+}
+function session(options = {}) {
+    const parentScope = options.parentScope ?? createScope(), spies = options.urls ?? urls(), page = options.page ?? pageTarget();
+    const value = m.createLocalSession({ parentScope, createObjectURL: spies.createObjectURL, revokeObjectURL: spies.revokeObjectURL,
+        schedulerYield: () => Promise.resolve(), pageTarget: page, extractFacts: ComfyMetadata.extractGenerationFacts, ...options.overrides });
+    return { session: value, parentScope, urls: spies, page };
+}
+/** Resolves with the first controller state `predicate` accepts. */
+function until(controller, predicate) {
+    return new Promise((resolve) => {
+        let stop = null, done = false;
+        stop = controller.subscribe((state) => { if (!done && predicate(state)) { done = true; resolve(state); stop?.(); } });
+        if (done) stop();
+    });
+}
+const recorded = (controller) => until(controller, (state) => state.record !== null || state.error);
+
+test("contract", () => {
+    assert.equal(typeof m.createLocalSession, "function", "createLocalSession is exported");
+    assert.equal(typeof m.createYield, "function", "createYield is exported");
+    assert.deepEqual(Object.keys(m.LOCAL_SESSION_MESSAGES).sort(), ["containerOnly", "directory", "multiple", "previewFailed", "unreadable", "unsupported"]);
+    const { session: value } = session();
+    for (const name of ["select", "retry", "subscribe", "dispose"]) assert.equal(typeof value[name], "function", name);
+    assert.equal(value.state.phase, "empty");
+    assert.equal(value.state.preview, null);
+    assert.equal(value.entry, null);
+    assert.equal(typeof value.controller.select, "function");
+    value.dispose();
+});
+
+test("replacement synchronously clears old capabilities", async () => {
+    const { session: value, urls: spies } = session();
+    const states = [];
+    value.subscribe((state) => states.push({ ...state, revokedAtPublish: spies.revoked.length }));
+    // Two different Files with the same name, size and time are two selections.
+    const a = pngFile("same.png", "first fox"), b = pngFile("same.png", "other fox");
+    assert.equal(a.size, b.size);
+    assert.equal(value.select([a]), "accepted");
+    assert.equal(value.state.phase, "classifying");
+    const first = await recorded(value.controller);
+    assert.equal(first.record.prompts.positive.text, "first fox");
+    const entryA = value.entry, urlA = spies.created[0].url;
+    assert.deepEqual([entryA.filename, entryA.is_video], ["same.png", false]);
+    assert.deepEqual(value.state.preview, { url: urlA, media: "image" });
+    assert.equal(localFileAdapter.originalDownload(entryA).url, urlA);
+
+    const before = states.length;
+    assert.equal(value.select([b]), "accepted");
+    // Synchronously: no record, no entry, no preview, the old URL revoked once and the old handle foreign.
+    assert.equal(value.controller.state.record, null);
+    assert.equal(value.entry, null);
+    assert.equal(value.state.preview, null);
+    assert.deepEqual(spies.revoked, [urlA]);
+    for (const method of ["originalDownload", "mediaUrl", "key"]) assert.throws(() => localFileAdapter[method](entryA), TypeError, method);
+    assert.throws(() => localFileAdapter.originalDownload({ ...entryA }), TypeError, "a copy of a released handle is foreign too");
+    // The preview left the published state before its URL was revoked.
+    assert.deepEqual([states[before].phase, states[before].preview, states[before].revokedAtPublish], ["classifying", null, 0]);
+    const second = await recorded(value.controller);
+    assert.equal(second.record.prompts.positive.text, "other fox");
+    assert.notEqual(value.entry.key, entryA.key);
+    assert.equal(spies.revoked.length, 1);
+
+    // A read still in flight when the next file arrives never publishes.
+    const held = deferred(), published = [];
+    value.controller.subscribe((state) => { if (state.record) published.push(state.record.identity.key); });
+    const slow = pngFile("slow.png", "late fox", { gate: (index) => (index < 2 ? Promise.resolve() : held.promise) });
+    value.select([slow]);
+    await until(value.controller, (state) => state.loading);
+    const slowKey = value.entry.key;
+    assert.equal(value.select([pngFile("next.png", "current fox")]), "accepted");
+    held.resolve();
+    const current = await recorded(value.controller);
+    await settle();
+    assert.equal(current.record.prompts.positive.text, "current fox");
+    assert.ok(!published.includes(slowKey), "the replaced read never published");
+    assert.equal(value.controller.state.record.prompts.positive.text, "current fox");
+    value.dispose();
+    assert.equal(new Set(spies.revoked).size, spies.revoked.length, "each URL revoked once");
+    assert.deepEqual(spies.revoked.sort(), spies.created.map((item) => item.url).sort());
+});
+
+test("cancel and invalid drops keep the previous selection", async () => {
+    const { session: value, urls: spies } = session();
+    value.select([pngFile("kept.png", "kept fox")]);
+    await recorded(value.controller);
+    const entry = value.entry, state = value.state;
+    const directory = new File([], "folder");
+    const drops = [
+        [[], "rejected-empty"], [{ files: [], items: [] }, "rejected-empty"], [null, "ignored"], [undefined, "ignored"],
+        [[pngFile("one.png"), pngFile("two.png")], "rejected-multiple"],
+        [{ files: [pngFile("one.png"), pngFile("two.png")], items: [{ kind: "file" }, { kind: "file" }] }, "rejected-multiple"],
+        [{ files: [directory], items: [{ kind: "file", webkitGetAsEntry: () => ({ isDirectory: true, isFile: false }) }] }, "rejected-directory"],
+        [{ files: [], items: [{ kind: "string" }] }, "rejected-empty"],
+    ];
+    for (const [input, outcome] of drops) {
+        assert.equal(value.select(input), outcome, JSON.stringify(input));
+        assert.equal(value.entry, entry);
+        assert.equal(value.state, state);
+        assert.equal(value.controller.state.record.prompts.positive.text, "kept fox");
+    }
+    assert.equal(spies.created.length, 1);
+    assert.deepEqual(spies.revoked, []);
+    // One File in a DataTransfer whose entry is a file is accepted.
+    assert.equal(value.select({ files: [pngFile("dropped.png", "dropped fox")], items: [{ kind: "file", webkitGetAsEntry: () => ({ isDirectory: false, isFile: true }) }] }), "accepted");
+    assert.equal((await recorded(value.controller)).record.prompts.positive.text, "dropped fox");
+    value.dispose();
+});
+
+test("unclassified input creates no object URL", async () => {
+    const { session: value, urls: spies } = session();
+    const text = (body, name) => new RecordingFile([body], name);
+    for (const file of [text("plain text", "a.png"), text("<!doctype html><p>hi", "a.mp4"), text('<svg xmlns="http://www.w3.org/2000/svg"/>', "a.png"),
+        text("#EXTM3U\n#EXT-X-VERSION:3\n", "a.mp4"), new RecordingFile([], "empty.png")]) {
+        assert.equal(value.select([file]), "accepted");
+        await settle();
+        assert.equal(value.state.phase, "unsupported", file.name);
+        assert.equal(value.state.message, m.LOCAL_SESSION_MESSAGES.unsupported);
+        assert.equal(value.state.preview, null);
+        assert.equal(value.entry, null);
+        assert.equal(value.controller.state.record, null);
+        assert.ok(file.ranges.every(([start, end]) => start === 0 && end <= 32), "only the prefix is read");
+    }
+    // A file that cannot be read after choosing (removed or denied) is not an unsupported type: when the browser
+    // declares a supported type it opens the inspector's unreadable state, with no preview and no URL (ledger ruling).
+    const gone = pngFile("gone.png", "fox", { gate: () => Promise.reject(new DOMException("The file was removed", "NotReadableError")) });
+    assert.equal(value.select([gone]), "accepted");
+    // The read yields between its steps (local-inspection.mjs): wait for the answer, not a fixed number of turns.
+    const unreadable = await recorded(value.controller);
+    assert.ok(unreadable.record, "the unreadable record is published");
+    assert.deepEqual([value.state.phase, value.state.message, value.state.preview], ["ready", m.LOCAL_SESSION_MESSAGES.unreadable, null]);
+    assert.equal(m.LOCAL_SESSION_MESSAGES.unreadable, "Embedded metadata could not be read.");
+    assert.equal(value.entry.filename, "gone.png");
+    assert.equal(unreadable.record.metadata.status, "unreadable");
+    assert.equal(unreadable.record.download, null);
+    assert.equal(spies.created.length, 0);
+    // A prefix read that fails for another reason than the browser's read failure is not claimed as unreadable.
+    const broken = pngFile("broken.png", "fox", { gate: () => Promise.reject(new TypeError("not a read failure")) });
+    assert.equal(value.select([broken]), "accepted");
+    await settle();
+    assert.deepEqual([value.state.phase, value.state.message, value.entry], ["unsupported", m.LOCAL_SESSION_MESSAGES.unsupported, null]);
+    // A read failure for a selection already replaced publishes nothing for it.
+    const slow = deferred();
+    const replaced = pngFile("replaced.png", "fox", { gate: () => slow.promise });
+    value.select([replaced]);
+    await settle();
+    value.select([new RecordingFile([new Uint8Array(4)], "next.txt")]);
+    slow.reject(new DOMException("The file was removed", "NotReadableError"));
+    await settle();
+    assert.deepEqual([value.state.phase, value.entry], ["unsupported", null]);
+    // An unreadable file the browser declares no supported type for stays unsupported.
+    const unknown = new RecordingFile([new Uint8Array(8)], "gone.bin", { gate: () => Promise.reject(new DOMException("The file was removed", "NotReadableError")) });
+    assert.equal(value.select([unknown]), "accepted");
+    await settle();
+    assert.deepEqual([value.state.phase, value.state.message, value.entry], ["unsupported", m.LOCAL_SESSION_MESSAGES.unsupported, null]);
+    assert.equal(spies.created.length, 0);
+    // A real MP4 named .png is a video by its bytes.
+    value.select([fixture("core-faststart.mp4", "clip.png")]);
+    await settle();
+    assert.equal(value.state.phase, "ready");
+    assert.equal(value.state.preview.media, "video");
+    assert.equal(value.entry.is_video, true);
+    assert.equal(spies.created.length, 1);
+    value.dispose();
+});
+
+test("video record publishes even if preview fails", async () => {
+    const { session: value } = session({ urls: urls({ fail: true }) });
+    value.select([fixture("core-tags.webm")]);
+    const state = await recorded(value.controller);
+    assert.equal(value.state.phase, "ready");
+    assert.equal(value.state.preview, null);
+    assert.equal(value.state.message, m.LOCAL_SESSION_MESSAGES.previewFailed);
+    assert.equal(value.entry.is_video, true);
+    assert.equal(state.error, false);
+    assert.equal(state.record.file.media_type, "video");
+    assert.equal(state.record.metadata.status, "available");
+    assert.equal(state.record.generation.seed.value, "7");
+    assert.equal(state.record.download, null, "no original without an object URL");
+    value.dispose();
+    // AVI keeps its preview and says its metadata is not read.
+    const avi = session();
+    avi.session.select([new RecordingFile([Buffer.from("RIFF"), new Uint8Array(4), Buffer.from("AVI LIST"), new Uint8Array(64)], "clip.avi")]);
+    await recorded(avi.session.controller);
+    assert.equal(avi.session.state.message, m.LOCAL_SESSION_MESSAGES.containerOnly);
+    assert.equal(avi.session.state.preview.media, "video");
+    avi.session.dispose();
+});
+
+test("disposal settles a pending fallback yield", async () => {
+    const timers = new Map(), cleared = [];
+    let serial = 0;
+    const setTimer = (callback, delay) => { assert.equal(delay, 0); timers.set(++serial, callback); return serial; };
+    const clearTimer = (token) => { cleared.push(token); timers.delete(token); };
+    // The yield itself: a timer that rejects with AbortError on abort and removes its listener.
+    const yieldControl = m.createYield({ schedulerYield: null, setTimer, clearTimer });
+    const controller = new AbortController();
+    const pending = yieldControl(controller.signal);
+    assert.equal(timers.size, 1);
+    controller.abort();
+    await assert.rejects(pending, { name: "AbortError" });
+    assert.deepEqual(cleared, [1], "the timer is cleared on abort (the once listener is gone with it)");
+    // A turn that completes removes its abort listener, so a long-lived signal does not collect them.
+    const kept = new AbortController(), removed = [];
+    const remove = kept.signal.removeEventListener.bind(kept.signal);
+    kept.signal.removeEventListener = (type, callback) => { removed.push(type); remove(type, callback); };
+    const ok = yieldControl(kept.signal);
+    timers.get(2)();
+    await ok;
+    assert.deepEqual(removed, ["abort"]);
+    await assert.rejects(yieldControl(AbortSignal.abort()), { name: "AbortError" });
+    // The session: a selection waiting on the fallback yield is settled by dispose and does no work.
+    timers.clear(); cleared.length = 0;
+    const { session: value, urls: spies } = session({ overrides: { schedulerYield: null, setTimer, clearTimer } });
+    const file = pngFile("a.png");
+    value.select([file]);
+    assert.equal(timers.size, 1);
+    const [token] = timers.keys();
+    value.dispose();
+    assert.deepEqual(cleared, [token]);
+    await settle();
+    assert.deepEqual(file.ranges, []);
+    assert.equal(spies.created.length, 0);
+});
+
+test("old scheduler.yield continuation is fenced", async () => {
+    const turns = [];
+    const { session: value, urls: spies } = session({ overrides: { schedulerYield: () => { const turn = deferred(); turns.push(turn); return turn.promise; } } });
+    const a = pngFile("a.png", "old fox"), b = pngFile("b.png", "new fox");
+    value.select([a]);
+    value.select([b]);
+    assert.equal(turns.length, 2);
+    turns[0].resolve();
+    await settle();
+    assert.deepEqual(a.ranges, [], "the replaced selection never reads");
+    assert.equal(spies.created.length, 0);
+    assert.equal(value.state.phase, "classifying");
+    turns[1].resolve();
+    const state = await recorded(value.controller);
+    assert.equal(state.record.prompts.positive.text, "new fox");
+    assert.deepEqual(spies.created.map((item) => item.file), [b]);
+    // A continuation that resumes after dispose is fenced too.
+    value.select([pngFile("c.png")]);
+    const late = turns.at(-1);
+    value.dispose();
+    late.resolve();
+    await settle();
+    assert.equal(spies.created.length, 1);
+});
+
+test("retry rereads identically", async () => {
+    const { session: value } = session();
+    const file = pngFile("a.png", "retry fox");
+    value.select([file]);
+    const first = await recorded(value.controller);
+    const classified = 1, reads = file.ranges.slice(classified);
+    assert.ok(reads.length > 1);
+    const key = value.entry.key;
+    await value.retry();
+    const again = value.controller.state;
+    assert.deepEqual(file.ranges.slice(classified + reads.length), reads, "the same slice ranges");
+    assert.equal(again.record.identity.key, key);
+    assert.equal(again.record.identity.key, first.record.identity.key);
+    assert.equal(again.record.prompts.positive.text, "retry fox");
+    value.dispose();
+    assert.equal(value.retry(), undefined, "a disposed session never reads");
+    assert.equal(file.ranges.length, classified + 2 * reads.length);
+});
+
+test("already disposed parent does zero work", () => {
+    const parentScope = createScope();
+    parentScope.dispose();
+    const fail = (name) => () => assert.fail(`${name} called`);
+    const page = { addEventListener: fail("addEventListener"), removeEventListener: fail("removeEventListener") };
+    const value = m.createLocalSession({ parentScope, createObjectURL: fail("createObjectURL"), revokeObjectURL: fail("revokeObjectURL"),
+        schedulerYield: fail("schedulerYield"), setTimer: fail("setTimer"), clearTimer: fail("clearTimer"), pageTarget: page });
+    const file = pngFile("a.png");
+    assert.equal(value.select([file]), "ignored");
+    assert.equal(value.retry(), undefined);
+    assert.equal(value.entry, null);
+    assert.equal(value.state.phase, "empty");
+    const unsubscribe = value.subscribe(fail("listener"));
+    unsubscribe();
+    value.dispose(); value.dispose();
+    assert.deepEqual(file.ranges, []);
+});
+
+test("dispose, parent abort and page leave each release the URL once", async () => {
+    // dispose: the preview is cleared for subscribers before its URL is revoked.
+    const first = session(), seen = [];
+    first.session.select([pngFile("a.png")]);
+    await recorded(first.session.controller);
+    first.session.subscribe((state) => seen.push([state.phase, state.preview, first.urls.revoked.length]));
+    first.session.dispose(); first.session.dispose();
+    assert.deepEqual(seen.at(-1), ["empty", null, 0]);
+    assert.deepEqual(first.urls.revoked, [first.urls.created[0].url]);
+    assert.equal(first.session.select([pngFile("b.png")]), "ignored");
+    assert.equal(first.page.listeners.size, 0, "the page listener is removed");
+    // Parent abort disposes.
+    const second = session();
+    second.session.select([pngFile("a.png")]);
+    await recorded(second.session.controller);
+    second.parentScope.dispose();
+    assert.deepEqual(second.urls.revoked, [second.urls.created[0].url]);
+    assert.equal(second.session.controller.state.record, null);
+    assert.equal(second.page.listeners.size, 0);
+    // pagehide releases the selection; a page restored from the back/forward cache can choose again.
+    const third = session();
+    third.session.select([pngFile("a.png")]);
+    await recorded(third.session.controller);
+    const entry = third.session.entry;
+    third.page.fire("pagehide");
+    assert.deepEqual(third.urls.revoked, [third.urls.created[0].url]);
+    assert.equal(third.session.entry, null);
+    assert.equal(third.session.state.phase, "empty");
+    assert.equal(third.session.controller.state.record, null);
+    assert.throws(() => localFileAdapter.originalDownload(entry), TypeError);
+    third.page.fire("pagehide");
+    assert.equal(third.urls.revoked.length, 1);
+    assert.equal(third.session.select([pngFile("b.png", "after return")]), "accepted");
+    assert.equal((await recorded(third.session.controller)).record.prompts.positive.text, "after return");
+    third.session.dispose();
+    assert.equal(third.urls.revoked.length, 2);
+    // A page that owns page leave passes no pageTarget and ends the selection with clear(), as pagehide would.
+    const owned = session({ overrides: { pageTarget: null } });
+    owned.session.select([pngFile("a.png")]);
+    await recorded(owned.session.controller);
+    assert.equal(owned.page.listeners.size, 0, "no pagehide listener of its own");
+    owned.session.clear();
+    assert.deepEqual(owned.urls.revoked, [owned.urls.created[0].url]);
+    assert.equal(owned.session.entry, null);
+    assert.equal(owned.session.state.phase, "empty");
+    owned.session.clear();
+    assert.equal(owned.urls.revoked.length, 1, "clear is idempotent");
+    assert.equal(owned.session.select([pngFile("b.png")]), "accepted");
+    await recorded(owned.session.controller);
+    owned.session.dispose();
+    owned.session.clear();
+    assert.equal(owned.urls.revoked.length, 2);
+});

tests/js/workspace-media-viewer.test.js

@@ -2,6 +2,7 @@ import test from 'node:test';
 import assert from 'node:assert/strict';
 import {createScope} from '../../web/js/shared/toolkit/core.js';
 import gallerySettings from '../../web/js/gallery-settings.js';
+import {mountedDom} from './helpers/mounted-dom.mjs';
 
 const module = await import('../../web/js/workspace/media-viewer.mjs').catch(error => {
     if (error.code !== 'ERR_MODULE_NOT_FOUND') throw error;
@@ -15,7 +16,7 @@ test('disposed media viewer touches no DOM observers or requests', () => {
         const view = module.createMediaViewer({container:forbidden,parentScope,inspectionController:forbidden,sender:forbidden,
             onSelect:() => assert.fail('Disposed viewer selected an entry'),onRefresh:() => assert.fail('Disposed viewer refreshed')});
         if (!aborted) view.dispose();
-        view.open(forbidden); view.stopSlideshow?.(); view.dispose(); view.dispose(); parentScope.dispose();
+        view.open(forbidden); view.stopSlideshow?.(); view.close(); view.dispose(); view.dispose(); parentScope.dispose();
     }
 });
 
@@ -33,44 +34,6 @@ test('preferences handle denied malformed storage without mutation', () => {
     assert.deepEqual(module.readViewerPreferences(()=>storage,normalize),defaults);
 });
 
-function mountedDom() {
-    class Node {
-        constructor(tag) {this.tagName=tag;this.children=[];this.dataset={};this.attributes={};this.listeners=new Map();this._text='';this.classList={add(){},remove(){}};}
-        get textContent(){return this._text+this.children.map(c=>c.textContent).join('');}
-        set textContent(value){this._text=String(value);this.children=[];}
-        get childNodes(){return this.children;}
-        get isConnected(){return this.root || !!this.parent?.isConnected;}
-        // As in the DOM, a string argument becomes a text node.
-        static wrap(node){if(typeof node!=='string')return node;const text=new Node('#text');text.textContent=node;return text;}
-        append(...nodes){for(const node of nodes.map(Node.wrap)){node.parent=this;this.children.push(node);}}
-        prepend(...nodes){nodes=nodes.map(Node.wrap);for(const node of nodes)node.parent=this;this.children.unshift(...nodes);}
-        replaceChildren(...nodes){for(const child of this.children)child.parent=null;this.children=[];this._text='';this.append(...nodes);}
-        remove(){if(this.parent)this.parent.children=this.parent.children.filter(c=>c!==this);this.parent=null;}
-        setAttribute(key,value){this.attributes[key]=String(value);}
-        getAttribute(key){return this.attributes[key]??null;}
-        removeAttribute(key){delete this.attributes[key];}
-        addEventListener(type,callback,options={}){const list=this.listeners.get(type)||[];list.push({callback,signal:options.signal});this.listeners.set(type,list);}
-        removeEventListener(type,callback){this.listeners.set(type,(this.listeners.get(type)||[]).filter(e=>e.callback!==callback));}
-        fire(type,event={}){for(const e of [...(this.listeners.get(type)||[])])if(!e.signal?.aborted)e.callback({target:this,preventDefault(){},...event});}
-        focus(){this.focused=true;}
-        showModal(){this.open=true;}
-        close(){this.open=false;this.fire('close');}
-        contains(node){return node===this||this.children.some(c=>c.contains(node));}
-        closest(selector){if(selector==='section'&&this.tagName==='section')return this;if(selector==='[data-send-role]'&&this.dataset.sendRole)return this;if(selector==='[data-copy-role]'&&this.dataset.copyRole)return this;return this.parent?.closest(selector)||null;}
-        querySelector(selector){return walk(this,n=>n.tagName===selector)[0]||null;}
-        pause(){this.paused=true;}
-        load(){this.loaded=true;}
-        play(){this.played=true;return Promise.resolve();}
-    }
-    const walk=(node,predicate)=>[...(predicate(node)?[node]:[]),...node.children.flatMap(child=>walk(child,predicate))];
-    const oldDocument=globalThis.document,oldWindow=globalThis.window;
-    const container=new Node('main');container.root=true;
-    const doc=new Node('document');doc.createElement=tag=>new Node(tag);doc.createElementNS=(_,tag)=>new Node(tag);
-    doc.querySelectorAll=()=>walk(container,n=>n.tagName==='dialog'&&n.open);doc.activeElement=new Node('button');doc.activeElement.root=true;
-    const win=new Node('window');win.location={href:'http://localhost/prompt_manager/workspace'};win.getSelection=()=>({isCollapsed:true});
-    globalThis.document=doc;globalThis.window=win;
-    return {container,doc,win,walk,Node,restore(){globalThis.document=oldDocument;globalThis.window=oldWindow;}};
-}
 function occurrenceMedia(node,ordinal,key) {
     const run='22222222-2222-2222-2222-222222222222',epoch='11111111-1111-1111-1111-111111111111',scope='a'.repeat(64);
     const query=new URLSearchParams({node,ordinal:String(ordinal),epoch,current_scope:scope}),base=`/prompt_manager/history/runs/${run}/output/current`;
@@ -247,3 +210,84 @@ test('viewer titles a linked card "<title> · <filename>" before any inspection
         assert.equal(g.walk(g.container,n=>n.id==='viewer-title')[0].textContent,unlinked.filename);
     } finally { other.dispose(); scope.dispose(); g.restore(); }
 });
+
+// PR L2 Task 4(d): an adapter's own media URL (a session-owned blob:) is used exactly, never cache-busted.
+async function localHandles() {
+    const {createLocalFileHandle} = await import('../../web/js/workspace/local-inspection.mjs');
+    const image = createLocalFileHandle({file:new File([new Uint8Array(8)], 'a.png'), url:'blob:http://localhost/aaaaaaaa-0000-0000-0000-000000000001', classification:{media:'image', kind:'png'}});
+    const video = createLocalFileHandle({file:new File([new Uint8Array(8)], 'b.mp4'), url:'blob:http://localhost/aaaaaaaa-0000-0000-0000-000000000002', classification:{media:'video', kind:'iso-bmff'}});
+    return {image, video};
+}
+function withViewerGlobals(f) {
+    const globals = {ResizeObserver:globalThis.ResizeObserver, requestAnimationFrame:globalThis.requestAnimationFrame, cancelAnimationFrame:globalThis.cancelAnimationFrame, GallerySettings:globalThis.GallerySettings};
+    Object.assign(globalThis, {ResizeObserver:class { observe() {} disconnect() {} }, requestAnimationFrame:() => 1, cancelAnimationFrame() {}, GallerySettings:gallerySettings});
+    f.win.localStorage = {getItem:() => null, setItem:() => assert.fail('read-only preferences')};
+    return () => Object.assign(globalThis, globals);
+}
+
+test('viewer uses adapter.mediaUrl for image and video', async () => {
+    const {localFileAdapter:adapter} = await import('../../web/js/workspace/local-inspection.mjs');
+    const {image, video} = await localHandles();
+    const f = mountedDom(), restoreGlobals = withViewerGlobals(f), parentScope = createScope(), instances = [];
+    f.win.Viewer = class { constructor(node) { this.node = node; instances.push(this); } destroy() {} resize() {} };
+    const view = module.createMediaViewer({container:f.container,parentScope,inspectionController:borrowedController(),adapter,sender:{open(){}}});
+    try {
+        view.open({items:[image, video],selectedKey:image.key});
+        const img = f.walk(f.container,n => n.tagName === 'img')[0];
+        assert.equal(img.src, image.url, 'the blob URL is used exactly');
+        assert.doesNotMatch(img.src, /\?/);
+        assert.equal(instances[0].node, img, 'Viewer.js shows the blob image');
+        const download = f.walk(f.container,n => n.attributes['aria-label'] === 'Download original')[0];
+        assert.equal(download.href, image.url);assert.equal(download.download, 'a.png');
+        f.walk(f.container,n => n.attributes['aria-label'] === 'Next media')[0].fire('click');
+        const node = f.walk(f.container,n => n.tagName === 'video')[0];
+        assert.equal(node.src, video.url);assert.doesNotMatch(node.src, /\?/);
+        assert.equal(f.walk(f.container,n => n.tagName === 'img').length, 0);
+        view.dispose();
+        assert.equal(node.attributes.src, undefined);assert.equal(node.loaded, true, 'closing releases the video source');
+    } finally { view.dispose(); parentScope.dispose(); restoreGlobals(); f.restore(); }
+});
+
+test('retry media keeps the blob URL exact', async () => {
+    const {localFileAdapter:adapter} = await import('../../web/js/workspace/local-inspection.mjs');
+    const {image} = await localHandles();
+    const f = mountedDom(), restoreGlobals = withViewerGlobals(f), parentScope = createScope();
+    const view = module.createMediaViewer({container:f.container,parentScope,inspectionController:borrowedController(),adapter,sender:{open(){}}});
+    try {
+        view.open({items:[image],selectedKey:image.key});
+        const first = f.walk(f.container,n => n.tagName === 'img')[0];
+        assert.equal(first.src, image.url);
+        first.fire('error');
+        const failure = f.walk(f.container,n => n.className === 'media-failure')[0];
+        assert.ok(!failure.hidden, 'the media failure shows');
+        f.walk(f.container,n => n.tagName === 'button' && n.textContent === 'Retry media')[0].fire('click');
+        const second = f.walk(f.container,n => n.tagName === 'img')[0];
+        assert.notEqual(second, first, 'retry rebuilds the media element');
+        assert.equal(second.src, image.url, 'retry reuses the exact blob URL');
+    } finally { view.dispose(); parentScope.dispose(); restoreGlobals(); f.restore(); }
+});
+
+test('server adapters still cache-bust the original on open and retry', async () => {
+    const {rootedFileAdapter, createInspectionController} = await import('../../web/js/workspace/inspection-state.mjs');
+    const {reportedLocationAdapter} = await import('../../web/js/workspace/history-media.mjs');
+    const scope = 'a'.repeat(64);
+    const rooted = {root_index:0,path:'folder/a.png',filename:'a.png',root_scope:scope,is_video:false,url:`/prompt_manager/images/serve/folder/a.png?root=0&root_scope=${scope}`};
+    for (const [adapter, item, key, path] of [[rootedFileAdapter, rooted, '0:folder/a.png', `/prompt_manager/images/inspect/folder/a.png?root=0&root_scope=${scope}`],
+        [reportedLocationAdapter, occurrenceMedia('1',1,'c'), 'c'.repeat(64), occurrenceMedia('1',1,'c').inspection_url]]) {
+        const f = mountedDom(), restoreGlobals = withViewerGlobals(f), parentScope = createScope(), paths = [];
+        const controller = createInspectionController({adapter,api:{get(url) {paths.push(url);return new Promise(() => {});}}});
+        const view = module.createMediaViewer({container:f.container,parentScope,inspectionController:controller,adapter,onSelect:entry => controller.select(entry),sender:{open(){}}});
+        try {
+            view.open({items:[item],selectedKey:key});
+            assert.deepEqual(paths, [path], 'the same api.get path');
+            const first = f.walk(f.container,n => n.tagName === 'img')[0];
+            assert.match(first.src, /_pm_viewer=/);
+            const url = new URL(first.src);url.searchParams.delete('_pm_viewer');
+            assert.equal(`${url.pathname}${url.search}`, item.url);
+            first.fire('error');
+            f.walk(f.container,n => n.tagName === 'button' && n.textContent === 'Retry media')[0].fire('click');
+            const second = f.walk(f.container,n => n.tagName === 'img')[0];
+            assert.match(second.src, /_pm_viewer=/);assert.notEqual(second.src, first.src, 'retry busts the cache again');
+        } finally { view.dispose(); controller.dispose(); parentScope.dispose(); restoreGlobals(); f.restore(); }
+    }
+});

tests/js/workspace-state.test.js

@@ -23,8 +23,21 @@ test('tags is a native route titled Tags; only unbuilt routes hand off to legacy
         assert.equal(routeTitle(route), route.label);
     }
     assert.equal(routeTitle(resolveRoute('#/library/7')), 'Prompt library');
-    for (const id of ['images', 'library', 'tags', 'overview', 'activity']) assert.equal(isHandoff(resolveRoute(`#/${id}`)), false, id);
-    for (const id of ['inspect', 'system']) assert.equal(isHandoff(resolveRoute(`#/${id}`)), true, id);
+    for (const id of ['images', 'library', 'tags', 'inspect', 'overview', 'activity']) assert.equal(isHandoff(resolveRoute(`#/${id}`)), false, id);
+    for (const id of ['system']) assert.equal(isHandoff(resolveRoute(`#/${id}`)), true, id);
+});
+
+test('inspect is the native Inspect a file page with the concept description', async () => {
+    const { resolveRoute, routeTitle, isHandoff } = await source;
+    const inspect = resolveRoute('#/inspect');
+    assert.equal(inspect.label, 'Inspect a file');
+    assert.equal(routeTitle(inspect), 'Inspect a file');
+    // The concept's heading description (app.js renderMetadata 743).
+    assert.equal(inspect.description, 'A standalone file uses the same image viewer and prompt actions.');
+    assert.equal(isHandoff(inspect), false);
+    // Overview keeps its card for the legacy metadata page, which stays working.
+    assert.equal(inspect.href, '/prompt_manager/gallery.html');
+    assert.equal(inspect.action, 'Open existing metadata inspector');
 });
 
 test('a job of the Activity page is its own deep link', async () => {

tests/js/workspace-toolbar.test.js

@@ -521,6 +521,10 @@ test('copy fallback selects the text', async () => {
         assert.equal(note.className, 'small');
         assert.equal(note.textContent, 'Automatic clipboard access requires a secure browser context.');
         assert.throws(() => openCopyFallback(42, { scope }), TypeError);
+        // LI-4 (D117): the settings summary names its own dialog; the select-to-copy body is the same.
+        openCopyFallback('Seed: 7', { scope, title: 'Copy settings summary' });
+        assert.equal(byId(dom, 'modal-title').textContent, 'Copy settings summary');
+        assert.equal(byId(dom, 'copy-text').value, 'Seed: 7');
     } finally {
         closeWorkspaceDialog();
         scope.dispose();

tests/local_resolver_selection_cases.py

@@ -0,0 +1,574 @@
+"""Candidate-selection record sets for the local resolver parity test (PR L3 Task 9).
+
+``local_resolver_cases`` covers one sampler's tracing. These cases reach the
+rest of ``_resolve``: several sampler candidates and the identical-branch rule
+(#270), stages that only reach previews, detailer stages and their upstream
+samplers (multistage), and A1111 ``parameters`` with every footer shape. The
+server's ``inspect_prompt_evidence`` is the oracle; nothing here states an
+expected answer. All content is synthetic.
+"""
+
+import json
+import random
+
+try:
+    from tests.local_resolver_cases import EXECUTION_KEY, SPACES, WORDS, _Builder
+except ImportError:  # pragma: no cover - discover -s tests puts tests/ first
+    from local_resolver_cases import EXECUTION_KEY, SPACES, WORDS, _Builder
+
+
+def _encode(text):
+    return {"class_type": "CLIPTextEncode", "inputs": {"text": text, "clip": ["4", 1]}}
+
+
+def _sampler(positive, negative, latent=None, name="KSampler"):
+    inputs = {"seed": 1, "model": ["4", 0], "positive": positive}
+    if negative is not None:
+        inputs["negative"] = negative
+    inputs["latent_image"] = latent or ["5", 0]
+    return {"class_type": name, "inputs": inputs}
+
+
+def _decode(sampler_id):
+    return {"class_type": "VAEDecode", "inputs": {"samples": [sampler_id, 0]}}
+
+
+def _save(image, name="SaveImage"):
+    return {"class_type": name, "inputs": {"images": image}}
+
+
+def _detailer(image, positive, negative, name="FaceDetailer", **extra):
+    inputs = {"image": image, "model": ["4", 0], "positive": positive}
+    inputs["negative"] = negative
+    inputs.update(extra)
+    return {"class_type": name, "inputs": inputs}
+
+
+def _base(**nodes):
+    graph = {
+        "4": {"class_type": "CheckpointLoaderSimple", "inputs": {"ckpt_name": "m"}},
+        "5": {"class_type": "EmptyLatentImage", "inputs": {"width": 64}},
+        "6": _encode("a fox"),
+        "7": _encode("blurry"),
+        "8": _encode("a cat"),
+    }
+    graph.update(nodes)
+    return graph
+
+
+def _samplers():
+    """Several unanchored samplers: identical, differing and mixed branches."""
+    same = _sampler(["6", 0], ["7", 0])
+    cases = {
+        "two-identical": _base(**{"3": same, "9": same}),
+        "two-differ": _base(**{"3": same, "9": _sampler(["8", 0], ["7", 0])}),
+        "two-negative-differs": _base(**{"3": same, "9": _sampler(["6", 0], ["8", 0])}),
+        "identical-without-negative": _base(
+            **{"3": _sampler(["6", 0], None), "9": _sampler(["6", 0], None)}
+        ),
+        "one-unresolved": _base(**{"3": same, "9": _sampler(["missing", 0], ["7", 0])}),
+        "both-unresolved": _base(
+            **{"3": _sampler(["x", 0], ["7", 0]), "9": _sampler(["y", 0], ["7", 0])}
+        ),
+        "three-identical-one-advanced": _base(
+            **{
+                "3": same,
+                "9": same,
+                "10": _sampler(["6", 0], ["7", 0], name="KSamplerAdvanced"),
+            }
+        ),
+        # Equal texts, different recipes: a PromptManager pair against an encoder.
+        "same-text-other-recipe": _base(
+            **{
+                "3": same,
+                "9": _sampler(["11", 0], ["7", 0]),
+                "11": {
+                    "class_type": "PromptManager",
+                    "inputs": {
+                        "text": "fox",
+                        "prepend_text": "a",
+                        "append_text": "",
+                        "clip": ["4", 1],
+                    },
+                },
+            }
+        ),
+        "multistage-latent": _base(
+            **{"3": same, "9": _sampler(["6", 0], ["7", 0], latent=["3", 0])}
+        ),
+    }
+    selector = {
+        "class_type": "easy ifElse",
+        "inputs": {"boolean": ["4", 0], "on_true": ["6", 0], "on_false": ["8", 0]},
+    }
+    cases["selector-and-plain"] = _base(
+        **{"3": same, "9": _sampler(["12", 0], ["7", 0]), "12": selector}
+    )
+    return cases
+
+
+def _previews():
+    """Stages whose outputs reach only previews are not the saved file's."""
+    same, other = _sampler(["6", 0], ["7", 0]), _sampler(["8", 0], ["7", 0])
+    return {
+        "preview-dropped": _base(
+            **{
+                "3": same,
+                "9": other,
+                "13": _decode("3"),
+                "14": _decode("9"),
+                "15": _save(["13", 0]),
+                "16": _save(["14", 0], "PreviewImage"),
+            }
+        ),
+        "all-previews-kept": _base(
+            **{
+                "3": same,
+                "9": other,
+                "13": _decode("3"),
+                "14": _decode("9"),
+                "15": _save(["13", 0], "PreviewImage"),
+                "16": _save(["14", 0], "Image Comparer (rgthree)"),
+            }
+        ),
+        "preview-and-file": _base(
+            **{
+                "3": same,
+                "9": other,
+                "13": _decode("3"),
+                "14": _decode("9"),
+                "15": _save(["13", 0]),
+                "16": _save(["14", 0], "PreviewImage"),
+                "17": _save(["14", 0]),
+            }
+        ),
+        "unconsumed-stage-kept": _base(
+            **{
+                "3": same,
+                "9": other,
+                "14": _decode("9"),
+                "16": _save(["14", 0], "PreviewImage"),
+            }
+        ),
+        # A list or object class_type is never a preview class (#286).
+        "preview-unhashable-class": _base(
+            **{
+                "3": same,
+                "9": other,
+                "14": _decode("9"),
+                "16": {"class_type": ["PreviewImage"], "inputs": {"images": ["14", 0]}},
+                "17": {"class_type": {"a": 1}, "inputs": {"images": ["3", 0]}},
+            }
+        ),
+        "preview-through-bad-node": _base(
+            **{
+                "3": same,
+                "9": other,
+                "13": _decode("3"),
+                "15": _save(["13", 0]),
+                "16": _save(["9", 0], "PreviewImage"),
+                "18": "not a node",
+                "19": {"class_type": "Note", "inputs": {"x": ["18", 0]}},
+            }
+        ),
+    }
+
+
+def _detailers():
+    """Detailer stages judged with the samplers in their image ancestry."""
+    same = _sampler(["6", 0], ["7", 0])
+    cases = {
+        "detailer-same-prompt": _base(
+            **{
+                "3": same,
+                "10": _decode("3"),
+                "11": _detailer(["10", 0], ["6", 0], ["7", 0]),
+                "12": _save(["11", 0]),
+            }
+        ),
+        "detailer-differs": _base(
+            **{
+                "3": same,
+                "10": _decode("3"),
+                "11": _detailer(["10", 0], ["8", 0], ["7", 0]),
+                "12": _save(["11", 0]),
+            }
+        ),
+        "detailer-and-own-output": _base(
+            **{
+                "3": same,
+                "10": _decode("3"),
+                "11": _detailer(["10", 0], ["8", 0], ["7", 0]),
+                "12": _save(["11", 0]),
+                "13": _save(["10", 0]),
+            }
+        ),
+        "detailer-image-literal": _base(
+            **{
+                "11": _detailer("not a link", ["6", 0], ["7", 0]),
+                "12": _save(["11", 0]),
+            }
+        ),
+        "detailer-cycle": _base(
+            **{
+                "11": _detailer(["10", 0], ["6", 0], ["7", 0]),
+                "10": {"class_type": "ImageScale", "inputs": {"image": ["11", 0]}},
+                "12": _save(["11", 0]),
+            }
+        ),
+        "detailer-chain": _base(
+            **{
+                "3": same,
+                "10": _decode("3"),
+                "11": _detailer(["10", 0], ["6", 0], ["7", 0]),
+                "21": _detailer(
+                    ["11", 0], ["8", 0], ["7", 0], name="UltimateSDUpscale"
+                ),
+                "12": _save(["21", 0]),
+            }
+        ),
+        "detailer-chain-same": _base(
+            **{
+                "3": same,
+                "10": _decode("3"),
+                "11": _detailer(["10", 0], ["6", 0], ["7", 0]),
+                "21": _detailer(["11", 0], ["6", 0], ["7", 0], name="DetailerForEach"),
+                "12": _save(["21", 0]),
+            }
+        ),
+        "detailer-two-upstream": _base(
+            **{
+                "3": same,
+                "9": _sampler(["8", 0], ["7", 0]),
+                "10": {
+                    "class_type": "ImageBlend",
+                    "inputs": {"image1": ["13", 0], "image2": ["14", 0]},
+                },
+                "13": _decode("3"),
+                "14": _decode("9"),
+                "11": _detailer(["10", 0], ["6", 0], ["7", 0]),
+                "12": _save(["11", 0]),
+            }
+        ),
+        "detailer-unsupported-stage": _base(
+            **{
+                "10": {
+                    "class_type": "MysterySampler",
+                    "inputs": {"positive": ["6", 0], "model": ["4", 0]},
+                },
+                "11": _detailer(["10", 0], ["6", 0], ["7", 0]),
+                "12": _save(["11", 0]),
+            }
+        ),
+        "detailer-upstream-unresolved": _base(
+            **{
+                "3": _sampler(["gone", 0], ["7", 0]),
+                "10": _decode("3"),
+                "11": _detailer(["10", 0], ["6", 0], ["7", 0]),
+                "12": _save(["11", 0]),
+            }
+        ),
+        "detailer-upstream-selector": _base(
+            **{
+                "3": _sampler(["15", 0], ["7", 0]),
+                "15": {
+                    "class_type": "easy ifElse",
+                    "inputs": {
+                        "boolean": ["4", 0],
+                        "on_true": ["6", 0],
+                        "on_false": ["8", 0],
+                    },
+                },
+                "10": _decode("3"),
+                "11": _detailer(["10", 0], ["6", 0], ["7", 0]),
+                "12": _save(["11", 0]),
+            }
+        ),
+        "detailer-wildcard": _base(
+            **{
+                "3": same,
+                "10": _decode("3"),
+                "11": _detailer(["10", 0], ["6", 0], ["7", 0], wildcard="[x|y]"),
+                "12": _save(["11", 0]),
+            }
+        ),
+        "detailer-no-upscaled-image": _base(
+            **{
+                "3": same,
+                "10": _decode("3"),
+                "11": _detailer(
+                    ["10", 0], ["6", 0], ["7", 0], name="UltimateSDUpscaleNoUpscale"
+                ),
+                "12": _save(["11", 0]),
+            }
+        ),
+        "detailer-no-sampler-upstream": _base(
+            **{
+                "10": {"class_type": "LoadImage", "inputs": {"image": "a.png"}},
+                "11": _detailer(["10", 0], ["6", 0], ["7", 0]),
+                "12": _save(["11", 0]),
+            }
+        ),
+    }
+    deep = {"3": _sampler(["6", 0], ["7", 0]), "d0": _decode("3")}
+    for index in range(1, 70):
+        deep[f"d{index}"] = {
+            "class_type": "ImageScale",
+            "inputs": {"image": [f"d{index - 1}", 0]},
+        }
+    deep["11"] = _detailer(["d69", 0], ["6", 0], ["7", 0])
+    deep["12"] = _save(["11", 0])
+    cases["detailer-deep-ancestry"] = _base(**deep)
+    # More nested detailer stages than the depth bound.
+    stacked = {"3": _sampler(["6", 0], ["7", 0]), "s0": _decode("3")}
+    previous = "s0"
+    for index in range(1, 67):
+        stacked[f"s{index}"] = _detailer([previous, 0], ["6", 0], ["7", 0])
+        previous = f"s{index}"
+    stacked["12"] = _save([previous, 0])
+    cases["detailer-stacked-past-depth"] = _base(**stacked)
+    # Each detailer walks a wide shared image ancestry: the total visit budget
+    # runs out across stages before any candidate is read.
+    wide = {
+        f"l{index}": {"class_type": "LoadImage", "inputs": {}} for index in range(1500)
+    }
+    wide["hub"] = {
+        "class_type": "ImageBatchMany",
+        "inputs": {f"i{index}": [f"l{index}", 0] for index in range(1500)},
+    }
+    for index in range(15):
+        wide[f"w{index}"] = _detailer(["hub", 0], ["6", 0], ["7", 0])
+        wide[f"o{index}"] = _save([f"w{index}", 0])
+    cases["detailers-exhaust-total-visits"] = _base(**wide)
+    cases["detailer-mutual-cycle"] = _base(
+        **{
+            "11": _detailer(["21", 0], ["6", 0], ["7", 0]),
+            "21": _detailer(["11", 0], ["6", 0], ["7", 0]),
+            "12": _save(["21", 0]),
+        }
+    )
+    # The sampler's output reaches a preview through more nodes than one
+    # detailer's allowance: the walk runs out, so the sampler is not absorbed.
+    long = {"3": _sampler(["6", 0], ["7", 0]), "10": _decode("3")}
+    previous = "10"
+    for index in range(2100):
+        long[f"c{index}"] = {
+            "class_type": "ImageScale",
+            "inputs": {"image": [previous, 0]},
+        }
+        previous = f"c{index}"
+    long["p"] = _save([previous, 0], "PreviewImage")
+    long["11"] = _detailer(["10", 0], ["6", 0], ["7", 0])
+    long["12"] = _save(["11", 0])
+    cases["detailer-output-walk-exhausted"] = _base(**long)
+    # Every detailer's ancestry walk has its own allowance: the first one is
+    # wide, and the second still absorbs the first.
+    chained = {"3": _sampler(["6", 0], ["7", 0]), "10": _decode("3")}
+    chained["h1"] = {
+        "class_type": "ImageBatchMany",
+        "inputs": {
+            "i": ["10", 0],
+            **{f"i{index}": [f"a{index}", 0] for index in range(1500)},
+        },
+    }
+    chained["h2"] = {
+        "class_type": "ImageBatchMany",
+        "inputs": {
+            "i": ["11", 0],
+            **{f"i{index}": [f"b{index}", 0] for index in range(600)},
+        },
+    }
+    for index in range(1500):
+        chained[f"a{index}"] = {"class_type": "LoadImage", "inputs": {}}
+    for index in range(600):
+        chained[f"b{index}"] = {"class_type": "LoadImage", "inputs": {}}
+    chained["11"] = _detailer(["h1", 0], ["6", 0], ["7", 0])
+    chained["21"] = _detailer(["h2", 0], ["6", 0], ["7", 0])
+    chained["12"] = _save(["21", 0])
+    cases["detailers-each-reset"] = _base(**chained)
+    return cases
+
+
+_FOOTER = "Steps: 20, Sampler: euler, CFG scale: 7"
+
+
+def _parameters():
+    """A1111 ``parameters`` texts: every footer shape and delimiter rule."""
+    texts = {
+        "basic": f"a fox\nNegative prompt: blur\n{_FOOTER}",
+        "no-negative": f"a fox\n{_FOOTER}",
+        "two-delimiters": f"a\nNegative prompt: b\nNegative prompt: c\n{_FOOTER}",
+        "leading-delimiter": f"Negative prompt: blur\n{_FOOTER}",
+        "blank-positive": f" \x85\nNegative prompt: blur\n{_FOOTER}",
+        "footer-not-last": f"a fox\n{_FOOTER}\nmore text",
+        "two-footers": f"a\n{_FOOTER}\n{_FOOTER}",
+        "bare-footer": "a fox\nNegative prompt: blur\nSteps: 20",
+        "bare-and-full": f"a fox\nSteps: 5\n{_FOOTER}",
+        "two-bare": "a\nSteps: 1\nSteps: 2",
+        "template": f"a fox\n{_FOOTER}\nTemplate: {{a|b}}",
+        "both-templates": f"a\n{_FOOTER}\nTemplate: x\nNegative Template: y",
+        "templates-reversed": f"a\n{_FOOTER}\nNegative Template: y\nTemplate: x",
+        "two-templates": f"a\n{_FOOTER}\nTemplate: x\nTemplate: y",
+        "template-multiline": f"a\n{_FOOTER}\nTemplate: x\nmore",
+        "crlf": f"a fox\r\nNegative prompt: blur\r\n{_FOOTER}\r\n",
+        "cr-only": f"a fox\rNegative prompt: blur\r{_FOOTER}",
+        "cr-template": f"a\n{_FOOTER}\rTemplate: x",
+        "line-separator": f"a fox
{_FOOTER}",
+        "next-line": f"a fox\x85{_FOOTER}",
+        "spaced-steps": "a fox\nSteps:\n 20 \n, x",
+        "steps-newline-bare": "a fox\nSteps:\n20\n",
+        "arabic-digits": "a fox\nSteps: ٢٠, Sampler: euler",
+        "fullwidth-digits": "a fox\nSteps: ２, x",
+        "no-digits": "a fox\nSteps: , x",
+        "trailing-spaces": f"a fox  \nNegative prompt:   blur  \n{_FOOTER}   \n  \n",
+        "empty-negative": f"a fox\nNegative prompt:\n{_FOOTER}",
+        "astral-within-limit": "\U0001f600" * 60_000 + f"\n{_FOOTER}",
+        "over-limit": "x" * 100_001,
+        "at-limit": "x" * (100_000 - len(_FOOTER) - 1) + "\n" + _FOOTER,
+        "empty": "",
+        "only-footer": _FOOTER,
+        "lone-surrogate": f"\ud800 fox\nNegative prompt: \udfff\n{_FOOTER}",
+    }
+    cases = {f"parameters-{name}": {"parameters": text} for name, text in texts.items()}
+    cases["parameters-with-execution"] = {
+        "parameters": texts["basic"],
+        EXECUTION_KEY: json.dumps({"version": 1, "nodes": {}}),
+    }
+    return cases
+
+
+def selection_cases():
+    """Named record sets for every Task 9 path, each a ``read_inspection_file`` dict."""
+    cases = {}
+    for group in (_samplers(), _previews(), _detailers()):
+        for name, graph in group.items():
+            cases[f"select-{name}"] = {"prompt": json.dumps(graph, ensure_ascii=False)}
+    cases.update(_parameters())
+    return cases
+
+
+class _Selection(_Builder):
+    """Random graphs with several samplers, outputs, previews and detailers."""
+
+    def sampler(self):
+        rng = self.rng
+        positive = self.conditioning(0)
+        negative = self.conditioning(0) if rng.random() < 0.85 else None
+        name = rng.choice(["KSampler", "KSampler", "KSamplerAdvanced", "SamplerCustom"])
+        node_id = self.new_id()
+        self.nodes[node_id] = _sampler(positive, negative, name=name)
+        return node_id
+
+    def shared(self, ids):
+        """A copy of an earlier sampler: an identical branch."""
+        node_id = self.new_id()
+        self.nodes[node_id] = json.loads(json.dumps(self.nodes[self.rng.choice(ids)]))
+        return node_id
+
+    def output(self, image):
+        rng = self.rng
+        choice = rng.randrange(5)
+        if choice == 4:
+            return
+        name = ["SaveImage", "SaveImage", "PreviewImage", "PreviewAny"][choice]
+        self.nodes[self.new_id()] = _save(image, name)
+
+    def detailer(self, image):
+        rng = self.rng
+        node_id = self.new_id()
+        positive = self.conditioning(1) if rng.random() < 0.5 else None
+        name = rng.choice(list(_DETAILER_NAMES))
+        node = _detailer(image, positive, self.conditioning(1), name=name)
+        if positive is None:
+            node["inputs"]["positive"] = self.reuse_positive()
+        if name == "UltimateSDUpscaleNoUpscale":
+            node["inputs"]["upscaled_image"] = node["inputs"].pop("image")
+        if name in ("FaceDetailer", "DetailerForEach") and rng.random() < 0.15:
+            node["inputs"]["wildcard"] = rng.choice(["", "x", ["4", 0]])
+        self.nodes[node_id] = node
+        return node_id
+
+    def reuse_positive(self):
+        samplers = [
+            node
+            for node in self.nodes.values()
+            if node.get("class_type")
+            in ("KSampler", "KSamplerAdvanced", "SamplerCustom")
+        ]
+        if samplers:
+            return self.rng.choice(samplers)["inputs"]["positive"]
+        return self.conditioning(1)
+
+    def build(self):
+        rng = self.rng
+        ids = [self.sampler()]
+        for _ in range(rng.randrange(3)):
+            ids.append(self.shared(ids) if rng.random() < 0.4 else self.sampler())
+        for sampler_id in list(ids):
+            decoded = self.new_id()
+            self.nodes[decoded] = _decode(sampler_id)
+            image = [decoded, 0]
+            for _ in range(rng.randrange(3)):
+                if rng.random() < 0.5:
+                    image = [self.detailer(image), 0]
+                else:
+                    self.output(image)
+            self.output(image)
+            if rng.random() < 0.1:
+                self.nodes[sampler_id]["inputs"]["latent_image"] = [rng.choice(ids), 0]
+        graph = {
+            "4": {"class_type": "CheckpointLoaderSimple", "inputs": {"ckpt_name": "m"}},
+            "5": {"class_type": "EmptyLatentImage", "inputs": {"width": 64}},
+        }
+        graph.update(self.nodes)
+        return graph
+
+
+_DETAILER_NAMES = (
+    "FaceDetailer",
+    "DetailerForEach",
+    "UltimateSDUpscale",
+    "UltimateSDUpscaleNoUpscale",
+)
+_PARAMETER_LINES = [
+    "Negative prompt:",
+    "Negative prompt: blur",
+    "Steps: 20, Sampler: euler",
+    "Steps: 7",
+    "Steps: x",
+    "Template: t",
+    "Negative Template: n",
+    "Steps:٣, a",
+]
+
+
+def _parameter_text(rng):
+    parts = []
+    for _ in range(rng.randint(1, 5)):
+        if rng.random() < 0.5:
+            parts.append(rng.choice(_PARAMETER_LINES))
+        else:
+            parts.append(rng.choice(SPACES) + rng.choice(WORDS) + rng.choice(SPACES))
+    joints = ["\n", "\n", "\r\n", "\r", "
", " "]
+    return "".join(part + rng.choice(joints) for part in parts).rstrip(
+        rng.choice(["", "\n", " "])
+    )
+
+
+def selection_fuzz_cases(seed, count):
+    """Seeded several-sampler graphs (sometimes corrupted) and parameters texts."""
+    rng = random.Random(seed)
+    cases = {}
+    for index in range(count):
+        if rng.random() < 0.2:
+            cases[f"select-fuzz-{seed}-{index}"] = {"parameters": _parameter_text(rng)}
+            continue
+        builder = _Selection(rng)
+        graph = builder.build()
+        if rng.random() < 0.2:
+            builder.nodes = graph
+            builder.corrupt()
+        records = {"prompt": json.dumps(graph, ensure_ascii=rng.random() < 0.5)}
+        records.update(builder.records)
+        cases[f"select-fuzz-{seed}-{index}"] = records
+    return cases

tests/lock_probe.py

@@ -0,0 +1,35 @@
+"""A lock stand-in that reports when a second caller has to wait for it.
+
+Concurrency tests patch it over a module's lock so they can wait until the
+second caller is really blocked on the lock, instead of hoping a thread
+start or one event-loop tick got it there.
+"""
+
+import threading
+
+
+class ProbeLock:
+    """A re-entrant lock whose ``contended`` event is set when a caller blocks."""
+
+    def __init__(self):
+        self._lock = threading.RLock()
+        self.contended = threading.Event()
+
+    def acquire(self, blocking=True, timeout=-1):
+        if self._lock.acquire(blocking=False):
+            return True
+        self.contended.set()
+        if not blocking:
+            return False
+        return self._lock.acquire(timeout=timeout)
+
+    def release(self):
+        self._lock.release()
+
+    def __enter__(self):
+        self.acquire()
+        return self
+
+    def __exit__(self, *exc):
+        self.release()
+        return False

tests/test_api_admin.py

@@ -5,6 +5,7 @@ database and a stub ``folder_paths`` module, so the tests run without ComfyUI.
 """
 
 import asyncio
+import hashlib
 import json
 import os
 import shutil
@@ -734,9 +735,9 @@ class TestSettingsReadMonitorThroughModule(AdminAPITestCase):
     def test_no_sys_modules_scan(self):
         import inspect
 
-        from py.api.admin import AdminRoutesMixin
+        from py.api.settings_routes import SettingsRoutesMixin
 
-        source = inspect.getsource(AdminRoutesMixin.get_settings)
+        source = inspect.getsource(SettingsRoutesMixin.get_settings)
         self.assertNotIn("sys.modules", source)
 
     async def test_reports_directories_of_running_monitor(self):
@@ -1059,14 +1060,29 @@ class TestSettingsMisc(AdminAPITestCase):
             saved["gallery"]["monitoring"]["directories"], [self._root(self.output_dir)]
         )
 
-    async def test_save_replaces_a_corrupt_config_file(self):
-        with open(self.config_path, "w") as f:
-            f.write("{not json")
+    async def test_save_refuses_a_corrupt_config_file(self):
+        # #220: a config.json that cannot be parsed is the user's file, never
+        # silently replaced; the save is refused and nothing is published.
+        Path(self.config_path).write_bytes(b"{not json")
+        before_timeout = PromptManagerConfig.RESULT_TIMEOUT
         resp = await self.client.request(
             "POST", "/prompt_manager/settings", json={"result_timeout": 4}
         )
-        self.assertEqual(resp.status, 200)
-        self.assertEqual(self._read_config()["web_ui"]["result_timeout"], 4)
+        body = await resp.json()
+        self.assertEqual((resp.status, body["code"]), (409, "config-unreadable"))
+        self.assertIs(body["success"], False)
+        self.assertIs(body["persisted"], False)
+        self.assertEqual(PromptManagerConfig.RESULT_TIMEOUT, before_timeout)
+        self.assertEqual(Path(self.config_path).read_bytes(), b"{not json")
+
+    async def test_get_settings_reports_an_unreadable_config(self):
+        Path(self.config_path).write_bytes(b"{not json")
+        resp = await self.client.request("GET", "/prompt_manager/settings")
+        body = await resp.json()
+        self.assertEqual(resp.status, 200)  # the legacy page still loads
+        self.assertIsNone(body["revision"])
+        self.assertEqual(body["config_error"], "config-unreadable")
+        self.assertIn("result_timeout", body["settings"])
 
     async def test_saved_config_file_is_private_to_the_user(self):
         import stat
@@ -1107,12 +1123,156 @@ class TestSettingsMisc(AdminAPITestCase):
         self.assertEqual(resp.status, 200)
         self.assertFalse(data["restart_required"])
 
-    async def test_unwritable_config_path_still_succeeds(self):
-        os.environ[CONFIG_PATH_ENV] = os.path.join(self.tmpdir, "missing", "c.json")
+    async def test_unwritable_config_path_reports_failure_without_runtime_change(self):
+        # #220: the parent is a file, so config.json cannot be written. The
+        # save reports the failure and publishes nothing.
+        blocker = Path(self.tmpdir) / "not-a-dir"
+        blocker.write_text("x")
+        os.environ[CONFIG_PATH_ENV] = str(blocker / "c.json")
+        GalleryConfig.MONITORING_DIRECTORIES = []
+        before_timeout = PromptManagerConfig.RESULT_TIMEOUT
+        with self.assertLogs("prompt_manager.api", level="ERROR"):
+            resp = await self.client.request(
+                "POST",
+                "/prompt_manager/settings",
+                json={
+                    "result_timeout": before_timeout + 1,
+                    "gallery_root_paths": [self._root(self.output_dir)],
+                },
+            )
+        body = await resp.json()
+        self.assertEqual(
+            (resp.status, body["code"], body["persisted"]),
+            (500, "config-write-failed", False),
+        )
+        self.assertIs(body["success"], False)
+        self.assertIs(body["runtime_applied"], False)
+        self.assertEqual(PromptManagerConfig.RESULT_TIMEOUT, before_timeout)
+        self.assertEqual(GalleryConfig.MONITORING_DIRECTORIES, [])
+        self.assertEqual(blocker.read_text(), "x")
+
+    async def test_save_reports_the_commit(self):
         resp = await self.client.request(
             "POST", "/prompt_manager/settings", json={"result_timeout": 3}
         )
+        body = await resp.json()
         self.assertEqual(resp.status, 200)
+        self.assertEqual(body["message"], "Settings saved successfully")
+        self.assertIs(body["persisted"], True)
+        self.assertIs(body["runtime_applied"], True)
+        self.assertIs(body["restart_required"], False)
+        self.assertEqual(body["restart_required_fields"], [])
+        digest = hashlib.sha256(Path(self.config_path).read_bytes()).hexdigest()
+        self.assertEqual(body["revision"], "sha256:" + digest)
+
+    async def test_changed_roots_name_the_restart_field(self):
+        resp = await self.client.request(
+            "POST",
+            "/prompt_manager/settings",
+            json={"gallery_root_paths": [self._root(self.output_dir)]},
+        )
+        body = await resp.json()
+        self.assertEqual(resp.status, 200)
+        self.assertIs(body["restart_required"], True)
+        self.assertEqual(body["restart_required_fields"], ["gallery_root_paths"])
+
+    async def test_runtime_publication_failure_after_commit_is_reported(self):
+        # The values are durable; the response must not claim they are live.
+        self.api.reset_gallery_roots_cache = _raise
+        with self.assertLogs("prompt_manager.api", level="ERROR"):
+            resp = await self.client.request(
+                "POST",
+                "/prompt_manager/settings",
+                json={"gallery_root_paths": [self._root(self.output_dir)]},
+            )
+        body = await resp.json()
+        self.assertEqual(resp.status, 200)
+        self.assertIs(body["persisted"], True)
+        self.assertIs(body["runtime_applied"], False)
+        self.assertIs(body["restart_required"], True)
+        self.assertEqual(body["restart_required_fields"], ["gallery_root_paths"])
+        self.assertEqual(
+            self._read_config()["gallery"]["monitoring"]["directories"],
+            [self._root(self.output_dir)],
+        )
+
+    async def test_get_settings_reports_revision(self):
+        resp = await self.client.request("GET", "/prompt_manager/settings")
+        body = await resp.json()
+        self.assertEqual(body["revision"], "absent")
+        self.assertNotIn("config_error", body)
+
+        self._write_config({"web_ui": {"result_timeout": 2}})
+        body = await (
+            await self.client.request("GET", "/prompt_manager/settings")
+        ).json()
+        digest = hashlib.sha256(Path(self.config_path).read_bytes()).hexdigest()
+        self.assertEqual(body["revision"], "sha256:" + digest)
+
+    async def test_native_save_with_stale_revision_is_409(self):
+        self._write_config({"web_ui": {"result_timeout": 2}})
+        body = await (
+            await self.client.request("GET", "/prompt_manager/settings")
+        ).json()
+        seen = body["revision"]
+        self._write_config({"web_ui": {"result_timeout": 6}})  # another writer
+        before = Path(self.config_path).read_bytes()
+        before_timeout = PromptManagerConfig.RESULT_TIMEOUT
+
+        resp = await self.client.request(
+            "POST",
+            "/prompt_manager/settings",
+            json={"result_timeout": 9, "expected_revision": seen},
+        )
+        body = await resp.json()
+        self.assertEqual((resp.status, body["code"]), (409, "settings-changed"))
+        self.assertIs(body["persisted"], False)
+        digest = hashlib.sha256(before).hexdigest()
+        self.assertEqual(body["revision"], "sha256:" + digest)
+        self.assertEqual(Path(self.config_path).read_bytes(), before)
+        self.assertEqual(PromptManagerConfig.RESULT_TIMEOUT, before_timeout)
+
+    async def test_native_save_with_current_revision_commits(self):
+        body = await (
+            await self.client.request("GET", "/prompt_manager/settings")
+        ).json()
+        resp = await self.client.request(
+            "POST",
+            "/prompt_manager/settings",
+            json={"result_timeout": 9, "expected_revision": body["revision"]},
+        )
+        self.assertEqual(resp.status, 200)
+        self.assertEqual(self._read_config()["web_ui"]["result_timeout"], 9)
+
+    async def test_expected_revision_must_be_a_string(self):
+        resp = await self.client.request(
+            "POST",
+            "/prompt_manager/settings",
+            json={"result_timeout": 9, "expected_revision": 5},
+        )
+        self.assertEqual(resp.status, 400)
+        self.assertFalse(os.path.exists(self.config_path))
+
+    async def test_legacy_partial_update_without_revision_still_merges(self):
+        self._write_config(
+            {
+                "integrations": {"lora_manager": {"civitai_api_key": "secret"}},
+                "web_ui": {"result_timeout": 1, "webui_display_mode": "popup"},
+                "custom_section": {"keep": True},
+            }
+        )
+        resp = await self.client.request(
+            "POST", "/prompt_manager/settings", json={"result_timeout": 8}
+        )
+        self.assertEqual(resp.status, 200)
+        self.assertNotIn("secret", await resp.text())
+        saved = self._read_config()
+        self.assertEqual(
+            saved["integrations"]["lora_manager"]["civitai_api_key"], "secret"
+        )
+        self.assertEqual(saved["custom_section"], {"keep": True})
+        self.assertEqual(saved["web_ui"]["result_timeout"], 8)
+        self.assertEqual(saved["web_ui"]["webui_display_mode"], "popup")  # not sent
 
     async def test_save_unexpected_error_is_500(self):
         self.api._parse_gallery_roots = _raise

tests/test_api_backup_restore.py

@@ -5,12 +5,16 @@ stream the upload to disk, reject anything that is not a healthy prompts
 database and leave the live database untouched when it does.
 """
 
+import asyncio
 import glob
+import hashlib
 import os
 import sqlite3
 import sys
 import tempfile
+import threading
 import unittest
+from pathlib import Path
 from unittest.mock import MagicMock, patch
 
 _mock_server = MagicMock()
@@ -142,6 +146,85 @@ class TestBackupRoute(BackupRestoreTestCase):
         self.assertIn("backup", data["error"].lower())
 
 
+class TestRestoreHoldsTheRegistry(BackupRestoreTestCase):
+    """A legacy restore and a workspace job refuse each other (#269 gap)."""
+
+    def _digest(self):
+        return {
+            suffix: hashlib.sha256(Path(self.db_path + suffix).read_bytes()).hexdigest()
+            for suffix in ("", "-wal")
+            if os.path.exists(self.db_path + suffix)
+        }
+
+    async def test_legacy_restore_refused_while_scan_job_runs(self):
+        self._save("keep me")
+        upload = self._make_db_file(["restored"])
+        gate = asyncio.Event()
+
+        async def runner(job):
+            await gate.wait()
+
+        scan = self.api._jobs.start(
+            "scan", "Scan for metadata", record_changing=True, scope={}, runner=runner
+        )
+        before = self._digest()
+        try:
+            resp = await self._restore(upload)
+            self.assertEqual(resp.status, 409)
+            self.assertEqual(
+                await resp.json(),
+                {"success": False, "error": "Scan for metadata already running"},
+            )
+            self.assertEqual(self._digest(), before)
+            self.assertEqual(
+                [p["text"] for p in self.api.db.search_prompts()], ["keep me"]
+            )
+            self.assertEqual(glob.glob(self.db_path + ".backup_*"), [])
+        finally:
+            gate.set()
+            await asyncio.wait_for(scan.task, 5)
+
+    async def test_scan_refused_while_legacy_restore_holds(self):
+        upload = self._make_db_file(["restored"])
+        entered = threading.Event()
+        release = threading.Event()
+        model = self.api.db.model
+        real_verify = model.verify_database_file
+
+        def gated(path, **kwargs):
+            entered.set()
+            release.wait(10)
+            return real_verify(path, **kwargs)
+
+        loop = asyncio.get_running_loop()
+        with patch.object(model, "verify_database_file", gated):
+            restore = asyncio.ensure_future(self._restore(upload))
+            self.assertTrue(await loop.run_in_executor(None, entered.wait, 10))
+            resp = await self.client.post("/prompt_manager/jobs/scan")
+            body = await resp.json()
+            listed = (await (await self.client.get("/prompt_manager/jobs")).json())[
+                "jobs"
+            ]
+            release.set()
+            restored = await restore
+
+        self.assertEqual((resp.status, body["code"]), (409, "busy"))
+        self.assertEqual(body["running"]["title"], "Database restore (admin page)")
+        self.assertEqual(
+            [(j["kind"], j["state"], j["cancellable"]) for j in listed],
+            [("restore", "running", False)],
+        )
+        self.assertEqual(restored.status, 200)
+        self.assertEqual(self.api._jobs.list()[0].state, "finished")
+        self.assertIsNone(self.api._jobs.active("restore"))
+
+    async def test_rejected_upload_ends_its_hold_failed(self):
+        resp = await self._restore(self._write("notes.txt", b"not a database"))
+        self.assertEqual(resp.status, 400)
+        job = self.api._jobs.list()[0]
+        self.assertEqual((job.kind, job.state), ("restore", "failed"))
+
+
 class TestRestoreRoute(BackupRestoreTestCase):
     async def test_restore_replaces_database_and_reports_backup(self):
         self._save("old prompt")

tests/test_api_core.py

@@ -462,6 +462,15 @@ class TestUiRoutes(CoreRoutesTestCase):
         ):
             self.assertIn(entry, table)
 
+    async def test_image_tag_job_route_is_registered_beside_the_scan_job(self):
+        table = {
+            (route.method, route.resource.canonical)
+            for route in self.app.router.routes()
+            if route.resource is not None
+        }
+        self.assertIn(("POST", "/prompt_manager/jobs/scan"), table)
+        self.assertIn(("POST", "/prompt_manager/jobs/image-tags"), table)
+
 
 class TestStaticRoutes(CoreRoutesTestCase):
 
@@ -477,6 +486,30 @@ class TestStaticRoutes(CoreRoutesTestCase):
         self.assertEqual(resp.status, 200)
         self.assertIn("application/javascript", resp.headers["Content-Type"])
 
+    async def test_inspection_semantics_table_is_the_one_json_served(self):
+        """Local Inspect reads the node table the server resolves with (#249 PR L3).
+
+        Only that exact file is served; every other JSON stays forbidden.
+        """
+        resp = await self.client.request(
+            "GET", "/prompt_manager/js/inspection-semantics.json"
+        )
+        self.assertEqual(resp.status, 200)
+        self.assertIn("application/json", resp.headers["Content-Type"])
+        table = Path(__file__).resolve().parents[1] / "web" / "js"
+        self.assertEqual(
+            await resp.read(), (table / "inspection-semantics.json").read_bytes()
+        )
+        for path in (
+            "js/shared/toolkit/provenance.json",
+            "lib/viewerjs/provenance.json",
+            "lib/inspection-semantics.json",
+            "js/workspace/..%2Finspection-semantics.json",
+            "js/INSPECTION-SEMANTICS.json",
+        ):
+            resp = await self.client.request("GET", f"/prompt_manager/{path}")
+            self.assertEqual(resp.status, 403, path)
+
     async def test_lib_served(self):
         web_dir = self._fake_root()
         (web_dir / "lib" / "x.css").write_text("body{}")
@@ -569,6 +602,28 @@ class TestStaticRoutes(CoreRoutesTestCase):
         resp = await self.client.request("GET", "/prompt_manager/lib/link.js")
         self.assertEqual(resp.status, 403)
 
+    async def test_inspection_semantics_symlink_escaping_web_dir_is_403(self):
+        """The exact-path JSON gets the same realpath containment as any file."""
+        web_dir = self._fake_root()
+        secret = Path(self.tmpdir) / "secret.json"
+        secret.write_text('{"secret": true}')
+        try:
+            os.symlink(secret, web_dir / "js" / "inspection-semantics.json")
+        except (OSError, NotImplementedError):
+            self.skipTest("symlinks not available")
+        resp = await self.client.request(
+            "GET", "/prompt_manager/js/inspection-semantics.json"
+        )
+        self.assertEqual(resp.status, 403)
+        self.assertNotIn("secret", await resp.text())
+
+    async def test_inspection_semantics_missing_is_404(self):
+        self._fake_root()
+        resp = await self.client.request(
+            "GET", "/prompt_manager/js/inspection-semantics.json"
+        )
+        self.assertEqual(resp.status, 404)
+
     async def test_empty_path_is_not_served(self):
         for prefix in ("lib", "js"):
             resp = await self.client.request("GET", f"/prompt_manager/{prefix}/")

tests/test_api_images.py

@@ -5,11 +5,13 @@ Uses aiohttp's test client against a real PromptManagerAPI wired to a
 temporary SQLite database and a temporary output directory.
 """
 
+import asyncio
 import json
 import os
 import pathlib
 import sys
 import tempfile
+import threading
 import unittest
 from contextlib import ExitStack
 from pathlib import Path
@@ -638,6 +640,93 @@ class TestGenerateThumbnailsPost(ThumbnailTestCase):
         self.assertEqual(data["total_images"], 0)
 
 
+class TestThumbnailRoutesHoldTheRegistry(ThumbnailTestCase):
+    """Thumbnail work is ``guarded``: never beside a record-changing job."""
+
+    def _run_scan(self):
+        gate = asyncio.Event()
+
+        async def runner(job):
+            await gate.wait()
+
+        job = self.api._jobs.start(
+            "scan", "Scan for metadata", admission="records", scope={}, runner=runner
+        )
+
+        async def release():
+            gate.set()
+            await asyncio.wait_for(job.task, 5)
+
+        self.addAsyncCleanup(release)
+        return job
+
+    async def test_thumbnail_generate_refused_while_scan_runs(self):
+        make_png(self.output_dir / "a.png")
+        self._run_scan()
+
+        resp = await self.client.request(
+            "POST", "/prompt_manager/images/generate-thumbnails", json={}
+        )
+        self.assertEqual(resp.status, 409)
+        self.assertEqual(
+            await resp.json(),
+            {"success": False, "error": "Scan for metadata already running"},
+        )
+
+        resp = await self.client.request("POST", self.PROGRESS_URL)
+        text = await resp.text()
+        self.assertEqual(resp.status, 200)  # the gallery reads an SSE stream
+        self.assertEqual(
+            text,
+            "event: error\ndata: "
+            + json.dumps(
+                {
+                    "error": "Scan for metadata already running",
+                    "message": "Scan for metadata already running",
+                }
+            )
+            + "\n\n",
+        )
+
+        thumbs = self.output_dir / "thumbnails"
+        make_png(thumbs / "b_thumb.png")
+        resp = await self.client.request(
+            "POST", "/prompt_manager/images/clear-thumbnails"
+        )
+        self.assertEqual(resp.status, 409)
+        self.assertFalse(self._thumb_path("a").exists())
+        self.assertTrue((thumbs / "b_thumb.png").exists())
+
+    async def test_scan_refused_while_thumbnails_generate(self):
+        make_png(self.output_dir / "a.png")
+        entered = threading.Event()
+        release = threading.Event()
+        real = self.api._generate_gallery_thumbnails_sync
+
+        def gated(*args):
+            entered.set()
+            release.wait(10)
+            return real(*args)
+
+        self.api._generate_gallery_thumbnails_sync = gated
+        loop = asyncio.get_running_loop()
+        generate = asyncio.ensure_future(
+            self.client.request(
+                "POST", "/prompt_manager/images/generate-thumbnails", json={}
+            )
+        )
+        self.assertTrue(await loop.run_in_executor(None, entered.wait, 10))
+        resp = await self.client.request("POST", "/prompt_manager/jobs/scan")
+        body = await resp.json()
+        self.assertEqual((resp.status, body["code"]), (409, "busy"))
+        self.assertEqual(
+            body["running"]["title"], "Thumbnail generation (gallery page)"
+        )
+        release.set()
+        self.assertEqual((await generate).status, 200)
+        self.assertTrue(self._thumb_path("a").exists())
+
+
 class TestRecentImagesCaps(ImageAPITestCase):
     """Every path through /images/recent hands the DB a bounded window."""
 

tests/test_api_lora.py

@@ -4,11 +4,13 @@ Filesystem detection and network downloads are patched out so the tests run
 anywhere without a LoraManager install or a CivitAI connection.
 """
 
+import asyncio
 import json
 import os
 import shutil
 import sys
 import tempfile
+import threading
 import types
 import unittest
 from pathlib import Path
@@ -34,11 +36,20 @@ from aiohttp.test_utils import AioHTTPTestCase
 
 from database.operations import PromptDatabase
 from py.api import PromptManagerAPI
-from py import lora_utils
+from py import config_store, lora_utils
 from py.config import IntegrationConfig, PromptManagerConfig
+from py.api import settings_routes as settings_module
+from py.api import lora_integration as lora_module
 from py.lora_utils import get_trigger_cache
 from utils.hashing import generate_prompt_hash
 
+try:
+    from tests.lock_probe import ProbeLock
+    from tests.open_handles import assert_closed
+except ImportError:  # discovered with tests/ as the top-level directory
+    from lock_probe import ProbeLock
+    from open_handles import assert_closed
+
 SECRET_KEY = "sk-civitai-super-secret-0123456789"
 
 
@@ -56,7 +67,13 @@ class LoraAPITestCase(AioHTTPTestCase):
             return_value=[self.custom_nodes],
         )
         self._custom_nodes_patch.start()
-        self._real_save = PromptManagerConfig.save_to_file
+        # Never the repository's config.json (live user data): every save in
+        # these tests goes to a file in this test's temp directory.
+        self.config_file = self.tmp_root / "config.json"
+        self._env_patch = patch.dict(
+            os.environ, {"PROMPT_MANAGER_CONFIG_PATH": str(self.config_file)}
+        )
+        self._env_patch.start()
 
         self._config_patch = patch.multiple(
             IntegrationConfig,
@@ -70,8 +87,6 @@ class LoraAPITestCase(AioHTTPTestCase):
             "py.lora_utils.detect_lora_manager", return_value=None
         )
         self.detect_mock = self._detect_patch.start()
-        self._save_patch = patch.object(PromptManagerConfig, "save_to_file")
-        self.save_mock = self._save_patch.start()
         get_trigger_cache().clear()
 
         app = web.Application()
@@ -83,7 +98,7 @@ class LoraAPITestCase(AioHTTPTestCase):
 
     async def tearDownAsync(self):
         await super().tearDownAsync()  # closes the aiohttp test client
-        self._save_patch.stop()
+        self._env_patch.stop()
         self._detect_patch.stop()
         self._config_patch.stop()
         self._custom_nodes_patch.stop()
@@ -96,8 +111,19 @@ class LoraAPITestCase(AioHTTPTestCase):
         ):
             if os.path.exists(path):
                 os.unlink(path)
+        assert_closed(self, self.tmp_root)
         shutil.rmtree(self.tmp_root, ignore_errors=True)
 
+    def _saved(self):
+        return json.loads(self.config_file.read_text())
+
+    def _make_unwritable(self):
+        """Point the config path under a regular file, so no write can succeed."""
+        blocker = self.tmp_root / "not-a-dir"
+        blocker.write_text("x")
+        self.config_file = blocker / "config.json"
+        os.environ["PROMPT_MANAGER_CONFIG_PATH"] = str(self.config_file)
+
     async def _post_json(self, url, body):
         return await self.client.request(
             "POST",
@@ -250,7 +276,7 @@ class TestLoraEnableRoute(LoraAPITestCase):
         )
         self.assertEqual(resp.status, 400)
         self.assertFalse(IntegrationConfig.LORA_MANAGER_ENABLED)
-        self.save_mock.assert_not_called()
+        self.assertFalse(self.config_file.exists())
 
     async def test_enable_persists_and_loads_trigger_cache(self):
         lm = _make_lora_manager(self.custom_nodes)
@@ -285,7 +311,15 @@ class TestLoraEnableRoute(LoraAPITestCase):
             os.path.normcase(os.path.realpath(str(lm))),
         )
         self.assertEqual(IntegrationConfig.CIVITAI_API_KEY, SECRET_KEY)
-        self.save_mock.assert_called_once_with()
+        saved = self._saved()["integrations"]["lora_manager"]
+        self.assertEqual(saved["civitai_api_key"], SECRET_KEY)
+        self.assertEqual(saved["path"], IntegrationConfig.LORA_MANAGER_PATH)
+        self.assertIs(saved["enabled"], True)
+        self.assertIs(saved["trigger_words_enabled"], True)
+        self.assertEqual(
+            (data["persisted"], data["runtime_applied"], data["cache_loaded"]),
+            (True, True, True),
+        )
         self.assertTrue(get_trigger_cache().is_loaded)
         self.assertEqual(get_trigger_cache().get_trigger_words("neon"), ["glow"])
 
@@ -319,7 +353,7 @@ class TestLoraEnableRoute(LoraAPITestCase):
         self.assertFalse(json.loads(body)["success"])
         self.assertNotIn(str(self.tmp_root), body)
         self.assertFalse(IntegrationConfig.LORA_MANAGER_ENABLED)
-        self.save_mock.assert_not_called()
+        self.assertFalse(self.config_file.exists())
 
     async def test_enable_with_custom_node_lacking_lora_in_its_name_is_400(self):
         lm = _make_lora_manager(self.custom_nodes).parent / "ComfyUI-Other"
@@ -344,7 +378,6 @@ class TestLoraEnableRoute(LoraAPITestCase):
 
     async def test_enable_writes_the_configured_config_file(self):
         config_file = self.tmp_root / "cfg" / "config.json"
-        self.save_mock.side_effect = self._real_save
 
         with patch.dict(os.environ, {"PROMPT_MANAGER_CONFIG_PATH": str(config_file)}):
             resp = await self._post_json(
@@ -353,7 +386,6 @@ class TestLoraEnableRoute(LoraAPITestCase):
             )
 
         self.assertEqual(resp.status, 200)
-        self.save_mock.assert_called_once_with()
         self.assertTrue(config_file.is_file())
         saved = json.loads(config_file.read_text())["integrations"]["lora_manager"]
         self.assertFalse(saved["enabled"])
@@ -414,9 +446,299 @@ class TestLoraEnableRoute(LoraAPITestCase):
         self.assertEqual(resp.status, 400)
 
     async def test_persist_failure_is_500(self):
-        self.save_mock.side_effect = OSError("read-only")
-        resp = await self._post_json("/prompt_manager/lora/enable", {"enabled": False})
+        self._make_unwritable()
+        with self.assertLogs("prompt_manager.api", level="ERROR"):
+            resp = await self._post_json(
+                "/prompt_manager/lora/enable", {"enabled": False}
+            )
         self.assertEqual(resp.status, 500)
+        self.assertEqual((await resp.json())["code"], "config-write-failed")
+
+    async def test_enable_write_failure_reports_and_keeps_runtime(self):
+        # #220: a save that cannot be written publishes nothing and says so.
+        lm = _make_lora_manager(self.custom_nodes)
+        self.detect_mock.return_value = str(lm)
+        IntegrationConfig.CIVITAI_API_KEY = SECRET_KEY
+        self._make_unwritable()
+
+        with self.assertLogs("prompt_manager.api", level="ERROR"):
+            resp = await self._post_json(
+                "/prompt_manager/lora/enable",
+                {
+                    "enabled": True,
+                    "path": str(lm),
+                    "trigger_words_enabled": True,
+                    "clear_civitai_api_key": True,
+                },
+            )
+
+        text = await resp.text()
+        body = json.loads(text)
+        self.assertEqual(resp.status, 500)
+        self.assertEqual(body["code"], "config-write-failed")
+        self.assertEqual((body["persisted"], body["runtime_applied"]), (False, False))
+        self.assertFalse(IntegrationConfig.LORA_MANAGER_ENABLED)
+        self.assertEqual(IntegrationConfig.LORA_MANAGER_PATH, "")
+        self.assertFalse(IntegrationConfig.LORA_TRIGGER_WORDS_ENABLED)
+        self.assertEqual(IntegrationConfig.CIVITAI_API_KEY, SECRET_KEY)
+        self.assertFalse(get_trigger_cache().is_loaded)
+        self.assertNotIn(SECRET_KEY, text)
+        self.assertNotIn(str(self.tmp_root), text)
+
+    async def test_enable_preserves_unknown_sections(self):
+        stored = "stored-value"  # a plain marker: what is on disk must stay
+        self.config_file.write_text(
+            json.dumps(
+                {
+                    "custom_section": {"keep": True},
+                    "web_ui": {"result_timeout": 11},
+                    "integrations": {
+                        "lora_manager": {"civitai_api_key": stored, "extra": 1},
+                        "other_tool": {"on": True},
+                    },
+                }
+            )
+        )
+        IntegrationConfig.CIVITAI_API_KEY = stored
+
+        resp = await self._post_json(
+            "/prompt_manager/lora/enable",
+            {"enabled": False, "trigger_words_enabled": True},
+        )
+
+        self.assertEqual(resp.status, 200)
+        saved = self._saved()
+        self.assertEqual(saved["custom_section"], {"keep": True})
+        self.assertEqual(saved["web_ui"], {"result_timeout": 11})
+        self.assertEqual(saved["integrations"]["other_tool"], {"on": True})
+        lora = saved["integrations"]["lora_manager"]
+        self.assertEqual(lora["extra"], 1)
+        self.assertEqual(lora["civitai_api_key"], stored)
+        self.assertIs(lora["trigger_words_enabled"], True)
+        self.assertNotIn("database", saved)  # no runtime defaults written
+
+    async def test_enable_refuses_a_corrupt_config_file(self):
+        self.config_file.write_bytes(b"{not json")
+        resp = await self._post_json(
+            "/prompt_manager/lora/enable",
+            {"enabled": False, "trigger_words_enabled": True},
+        )
+        body = await resp.json()
+        self.assertEqual((resp.status, body["code"]), (409, "config-unreadable"))
+        self.assertEqual(self.config_file.read_bytes(), b"{not json")
+        self.assertFalse(IntegrationConfig.LORA_TRIGGER_WORDS_ENABLED)
+
+    async def test_enable_requires_boolean_flags_and_body_cap(self):
+        for body in (
+            {"enabled": "yes"},
+            {"enabled": False, "trigger_words_enabled": 1},
+            {"enabled": False, "clear_civitai_api_key": "true"},
+        ):
+            with self.subTest(body=body):
+                resp = await self._post_json("/prompt_manager/lora/enable", body)
+                self.assertEqual(resp.status, 400)
+        resp = await self._post_json("/prompt_manager/lora/enable", [True])
+        self.assertEqual(resp.status, 400)
+        resp = await self._post_json(
+            "/prompt_manager/lora/enable",
+            {"enabled": False, "civitai_api_key": "k" * (2 * 1024 * 1024)},
+        )
+        self.assertEqual(resp.status, 413)
+        self.assertFalse(self.config_file.exists())
+        self.assertFalse(IntegrationConfig.LORA_MANAGER_ENABLED)
+
+    async def test_blank_key_unchanged_and_explicit_clear(self):
+        self.config_file.write_text(
+            json.dumps({"integrations": {"lora_manager": {"civitai_api_key": "old"}}})
+        )
+        IntegrationConfig.CIVITAI_API_KEY = "old"
+
+        resp = await self._post_json(
+            "/prompt_manager/lora/enable", {"enabled": False, "civitai_api_key": "  "}
+        )
+        self.assertEqual(resp.status, 200)
+        self.assertEqual(
+            self._saved()["integrations"]["lora_manager"]["civitai_api_key"], "old"
+        )
+        self.assertEqual(IntegrationConfig.CIVITAI_API_KEY, "old")
+
+        resp = await self._post_json(
+            "/prompt_manager/lora/enable",
+            {"enabled": False, "clear_civitai_api_key": True},
+        )
+        self.assertEqual(resp.status, 200)
+        self.assertEqual(
+            self._saved()["integrations"]["lora_manager"]["civitai_api_key"], ""
+        )
+        self.assertEqual(IntegrationConfig.CIVITAI_API_KEY, "")
+
+    async def test_cache_load_failure_reports_persisted_but_unloaded(self):
+        lm = _make_lora_manager(self.custom_nodes)
+        self.detect_mock.return_value = str(lm)
+
+        with (
+            patch.object(
+                type(get_trigger_cache()), "load", side_effect=OSError("unreadable")
+            ),
+            self.assertLogs("prompt_manager.api", level="WARNING"),
+        ):
+            resp = await self._post_json(
+                "/prompt_manager/lora/enable",
+                {"enabled": True, "path": str(lm), "trigger_words_enabled": True},
+            )
+
+        text = await resp.text()
+        body = json.loads(text)
+        self.assertEqual(resp.status, 200)
+        self.assertIs(body["success"], True)
+        self.assertEqual((body["persisted"], body["cache_loaded"]), (True, False))
+        self.assertTrue(IntegrationConfig.LORA_MANAGER_ENABLED)
+        self.assertIs(self._saved()["integrations"]["lora_manager"]["enabled"], True)
+        self.assertNotIn("unreadable", text)
+
+
+class TestConfigWritersShareOneStore(LoraAPITestCase):
+
+    async def asyncSetUp(self):
+        await super().asyncSetUp()
+        self._orig_timeout = PromptManagerConfig.RESULT_TIMEOUT
+
+    async def asyncTearDown(self):
+        PromptManagerConfig.RESULT_TIMEOUT = self._orig_timeout
+        await super().asyncTearDown()
+
+    async def test_settings_and_lora_saves_do_not_overwrite_each_other(self):
+        # #220: the LoRA save is sent while the settings save is inside its
+        # commit (lock held, file already read). The LoRA commit re-reads the
+        # file under the same lock, so both edits survive and nothing else
+        # is lost (before, the LoRA save rewrote the whole runtime config).
+        self.config_file.write_text(json.dumps({"custom_section": {"keep": True}}))
+        inside = threading.Event()
+        release = threading.Event()
+        real_mutation = settings_module._settings_mutation
+
+        def gated_mutation(updates, new_roots):
+            mutate = real_mutation(updates, new_roots)
+
+            def gated(config):
+                inside.set()
+                release.wait(10)
+                return mutate(config)
+
+            return gated
+
+        lora_calls = []
+        real_lora_mutation = lora_module._lora_settings_mutation
+
+        def recorded_lora_mutation(values):
+            mutate = real_lora_mutation(values)
+
+            def recorded(config):
+                lora_calls.append(dict(config))
+                return mutate(config)
+
+            return recorded
+
+        probe = ProbeLock()
+        loop = asyncio.get_running_loop()
+        with (
+            patch.object(settings_module, "_settings_mutation", gated_mutation),
+            patch.object(
+                lora_module, "_lora_settings_mutation", recorded_lora_mutation
+            ),
+            patch.object(config_store, "_COMMIT_LOCK", probe),
+        ):
+            settings = asyncio.ensure_future(
+                self._post_json("/prompt_manager/settings", {"result_timeout": 13})
+            )
+            self.assertTrue(await loop.run_in_executor(None, inside.wait, 10))
+            lora = asyncio.ensure_future(
+                self._post_json(
+                    "/prompt_manager/lora/enable",
+                    {"enabled": False, "trigger_words_enabled": True},
+                )
+            )
+            # Wait until the LoRA commit is blocked on the lock the settings
+            # commit holds; its mutation must not have run yet.
+            self.assertTrue(await loop.run_in_executor(None, probe.contended.wait, 10))
+            self.assertEqual(lora_calls, [])
+            release.set()
+            settings_resp, lora_resp = await asyncio.gather(settings, lora)
+        self.assertEqual(len(lora_calls), 1)
+        self.assertEqual(lora_calls[0]["web_ui"]["result_timeout"], 13)
+
+        self.assertEqual((settings_resp.status, lora_resp.status), (200, 200))
+        saved = self._saved()
+        self.assertEqual(saved["custom_section"], {"keep": True})
+        self.assertEqual(saved["web_ui"]["result_timeout"], 13)
+        self.assertIs(
+            saved["integrations"]["lora_manager"]["trigger_words_enabled"], True
+        )
+        settings_body = await settings_resp.json()
+        lora_body = await lora_resp.json()
+        self.assertNotEqual(settings_body["revision"], lora_body["revision"])
+
+    def _delay_first_commit_result(self):
+        """Hold back the first config commit's result from its handler.
+
+        The commit itself has run (the file is written); only the handler's
+        continuation waits until the returned event is set. Before #220's fix
+        round the handler published after this point, so a later save could
+        publish first and the earlier one overwrite it at runtime.
+        """
+        original = self.api._run_in_executor
+        written = asyncio.Event()
+        resume = asyncio.Event()
+        delayed = []
+
+        async def run(func, *args, **kwargs):
+            result = await original(func, *args, **kwargs)
+            if getattr(func, "__func__", None) is config_store.ConfigStore.commit:
+                if not delayed:
+                    delayed.append(func)
+                    written.set()
+                    await resume.wait()
+            return result
+
+        patcher = patch.object(self.api, "_run_in_executor", run)
+        patcher.start()
+        self.addCleanup(patcher.stop)
+        return written, resume
+
+    async def test_concurrent_settings_saves_end_on_the_last_written(self):
+        written, resume = self._delay_first_commit_result()
+        first = asyncio.ensure_future(
+            self._post_json("/prompt_manager/settings", {"result_timeout": 11})
+        )
+        await asyncio.wait_for(written.wait(), 10)
+        second = await self._post_json(
+            "/prompt_manager/settings", {"result_timeout": 22}
+        )
+        resume.set()
+        first = await first
+        self.assertEqual((first.status, second.status), (200, 200))
+        self.assertEqual(self._saved()["web_ui"]["result_timeout"], 22)
+        self.assertEqual(PromptManagerConfig.RESULT_TIMEOUT, 22)
+
+    async def test_concurrent_lora_saves_end_on_the_last_written(self):
+        written, resume = self._delay_first_commit_result()
+        first = asyncio.ensure_future(
+            self._post_json(
+                "/prompt_manager/lora/enable",
+                {"enabled": False, "trigger_words_enabled": True},
+            )
+        )
+        await asyncio.wait_for(written.wait(), 10)
+        second = await self._post_json(
+            "/prompt_manager/lora/enable",
+            {"enabled": False, "trigger_words_enabled": False},
+        )
+        resume.set()
+        first = await first
+        self.assertEqual((first.status, second.status), (200, 200))
+        lora = self._saved()["integrations"]["lora_manager"]
+        self.assertIs(lora["trigger_words_enabled"], False)
+        self.assertIs(IntegrationConfig.LORA_TRIGGER_WORDS_ENABLED, False)
 
 
 class TestLoraScanRoute(LoraAPITestCase):
@@ -445,6 +767,12 @@ class TestLoraScanRoute(LoraAPITestCase):
         body = await resp.text()
         self.assertNotIn(str(self.tmp_root), body)
         self.assertIn("x.db", body)
+        # The admin page's modal shows the failure as its status and closes.
+        error = self._sse_events(body)[-1]
+        self.assertEqual(
+            (error["type"], error["status"], error["progress"]),
+            ("error", error["message"], 0),
+        )
 
     @staticmethod
     def _sse_events(text):

tests/test_api_prompt_inspector.py

@@ -1643,6 +1643,62 @@ class TestPromptInspector(ImageAPITestCase):
                         str(path), False, report_ambiguity=True
                     )
 
+    async def test_unhashable_workflow_node_type_is_skipped(self):
+        """A UI workflow node whose ``type`` is a list or dict is skipped (#286).
+
+        The R1 check looks each node's ``type`` up among subgraph IDs; an
+        unhashable ``type`` used to raise there and the route answered 500.
+        Such a node can be neither a subgraph instance nor a PromptManager
+        node, so the walk skips it and a prompt that resolves still resolves.
+        """
+        source = graph()
+        source["1"]["class_type"] = "PromptManager"
+        for kind in (["PromptManager"], {"name": "PromptManager"}):
+            with self.subTest(kind=type(kind).__name__):
+                workflow = json.dumps(
+                    {"nodes": [{"id": 1, "type": kind, "widgets_values": ["x"]}]}
+                )
+                png(
+                    self.output_dir / "image.png",
+                    prompt=json.dumps(source),
+                    workflow=workflow,
+                )
+                response, result = await self.inspect()
+                self.assertEqual(response.status, 200)
+                self.assertEqual(result["resolution"]["state"], "resolved")
+                self.assertEqual(result["resolution"]["sampler_id"], "3")
+                self.assertEqual(result["prompts"]["positive"]["status"], "resolved")
+                self.assertEqual(result["prompts"]["positive"]["text"], "portrait")
+                self.assertEqual(result["prompts"]["negative"]["text"], "blurry")
+                self.assertNotIn("unhashable", json.dumps(result))
+
+    async def test_unhashable_graph_class_type_is_not_a_preview_output(self):
+        """A list or object ``class_type`` never names a preview output (#286).
+
+        With several samplers the inspector first drops stages that reach only
+        previews; looking such a ``class_type`` up among the preview classes
+        used to raise, and the route answered 500.
+        """
+        for kind in (["PreviewImage"], {"name": "PreviewImage"}):
+            with self.subTest(kind=type(kind).__name__):
+                source = graph()
+                source["9"] = {
+                    "class_type": "KSampler",
+                    "inputs": {"positive": ["8", 0], "negative": ["2", 0]},
+                }
+                source["8"] = {
+                    "class_type": "CLIPTextEncode",
+                    "inputs": {"text": "cat"},
+                }
+                source["10"] = {"class_type": kind, "inputs": {"images": ["9", 0]}}
+                png(self.output_dir / "image.png", prompt=json.dumps(source))
+                response, result = await self.inspect()
+                self.assertEqual(response.status, 200)
+                self.assertEqual(
+                    result["resolution"]["reason"], "Multiple sampler branches"
+                )
+                self.assertEqual(result["resolution"]["state"], "ambiguous")
+
 
 class TestInspectorImageTags(ImageAPITestCase):
     """B3: the inspector envelope's ``image_tags`` facet (spec amendment S1)."""

tests/test_config_store.py

@@ -0,0 +1,419 @@
+"""Tests for the serialized config store (py/config_store.py, #220).
+
+Every test works on a config.json inside its own temporary directory; the
+repository's config.json (live user data) is never read or written.
+"""
+
+import hashlib
+import json
+import os
+import shutil
+import sys
+import tempfile
+import threading
+import unittest
+from pathlib import Path
+from unittest.mock import MagicMock, patch
+
+_mock_server = MagicMock()
+_mock_server.PromptServer.instance.routes = MagicMock()
+sys.modules.setdefault("server", _mock_server)
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+from py import config_store  # noqa: E402
+from py.config_store import (  # noqa: E402
+    ABSENT_REVISION,
+    ConfigStore,
+    ConfigUnreadable,
+    RevisionConflict,
+    get_config_store,
+    revision_of,
+)
+
+try:
+    from tests.lock_probe import ProbeLock  # noqa: E402
+    from tests.open_handles import assert_closed  # noqa: E402
+except ImportError:  # discovered with tests/ as the top-level directory
+    from lock_probe import ProbeLock  # noqa: E402
+    from open_handles import assert_closed  # noqa: E402
+
+
+class ConfigStoreTests(unittest.TestCase):
+    def setUp(self):
+        self.tmpdir = os.path.realpath(tempfile.mkdtemp())
+        self.path = os.path.join(self.tmpdir, "config.json")
+        self.store = ConfigStore(lambda: self.path)
+
+    def tearDown(self):
+        try:
+            assert_closed(self, self.tmpdir)
+        finally:
+            shutil.rmtree(self.tmpdir, ignore_errors=True)
+
+    def _write(self, data):
+        Path(self.path).write_text(json.dumps(data), encoding="utf-8")
+
+    def _bytes(self):
+        return Path(self.path).read_bytes()
+
+    def _leftovers(self):
+        return sorted(name for name in os.listdir(self.tmpdir) if name != "config.json")
+
+    # ── read ──────────────────────────────────────────────────────────
+
+    def test_read_of_a_missing_file_is_empty_and_absent(self):
+        self.assertEqual(self.store.read(), ({}, ABSENT_REVISION))
+
+    def test_read_reports_the_sha256_of_the_file_bytes(self):
+        self._write({"web_ui": {"result_timeout": 3}})
+        data, revision = self.store.read()
+        self.assertEqual(data, {"web_ui": {"result_timeout": 3}})
+        expected = "sha256:" + hashlib.sha256(self._bytes()).hexdigest()
+        self.assertEqual(revision, expected)
+        self.assertEqual(revision_of(self._bytes()), expected)
+
+    def test_non_object_config_is_unreadable(self):
+        self._write([1, 2])
+        with self.assertRaises(ConfigUnreadable):
+            self.store.read()
+
+    def test_unreadable_path_is_unreadable(self):
+        os.mkdir(self.path)  # a directory where the file should be
+        with self.assertRaises(ConfigUnreadable):
+            self.store.read()
+
+    # ── commit ────────────────────────────────────────────────────────
+
+    def test_commit_preserves_unknown_sections_and_secret(self):
+        self._write(
+            {
+                "custom_section": {"keep": True},
+                "integrations": {"lora_manager": {"civitai_api_key": "secret"}},
+                "web_ui": {"result_timeout": 1, "show_test_button": True},
+            }
+        )
+
+        def mutate(config):
+            config.setdefault("web_ui", {})["result_timeout"] = 7
+            return config
+
+        saved, revision = self.store.commit(mutate, expected_revision=None)
+
+        on_disk = json.loads(self._bytes())
+        self.assertEqual(saved, on_disk)
+        self.assertEqual(on_disk["custom_section"], {"keep": True})
+        self.assertEqual(
+            on_disk["integrations"]["lora_manager"]["civitai_api_key"], "secret"
+        )
+        self.assertEqual(
+            on_disk["web_ui"], {"result_timeout": 7, "show_test_button": True}
+        )
+        self.assertEqual(revision, revision_of(self._bytes()))
+        self.assertEqual(self.store.read(), (on_disk, revision))
+
+    def test_commit_creates_a_missing_file_and_its_parent(self):
+        self.path = os.path.join(self.tmpdir, "nested", "config.json")
+        saved, revision = self.store.commit(
+            lambda config: {**config, "a": 1}, expected_revision=ABSENT_REVISION
+        )
+        self.assertEqual(saved, {"a": 1})
+        self.assertEqual(json.loads(Path(self.path).read_text()), {"a": 1})
+        self.assertNotEqual(revision, ABSENT_REVISION)
+
+    def test_mutate_works_on_a_copy(self):
+        self._write({"web_ui": {"result_timeout": 1}})
+        seen = {}
+
+        def mutate(config):
+            seen["config"] = config
+            config["web_ui"]["result_timeout"] = 2
+            raise RuntimeError("validation failed late")
+
+        before = self._bytes()
+        with self.assertRaises(RuntimeError):
+            self.store.commit(mutate, expected_revision=None)
+        self.assertEqual(self._bytes(), before)
+        self.assertEqual(self.store.read()[0], {"web_ui": {"result_timeout": 1}})
+
+    def test_mutate_must_return_an_object(self):
+        self._write({"a": 1})
+        before = self._bytes()
+        with self.assertRaises(TypeError):
+            self.store.commit(lambda config: None, expected_revision=None)
+        self.assertEqual(self._bytes(), before)
+
+    def test_malformed_existing_config_is_refused_and_untouched(self):
+        Path(self.path).write_bytes(b"{not json")
+        calls = []
+        with self.assertRaises(ConfigUnreadable):
+            self.store.commit(
+                lambda config: calls.append(config) or config, expected_revision=None
+            )
+        self.assertEqual(calls, [])
+        self.assertEqual(self._bytes(), b"{not json")
+        self.assertEqual(self._leftovers(), [])
+
+    def test_write_failure_leaves_bytes_and_raises(self):
+        self._write({"a": 1})
+        before = self._bytes()
+        with patch.object(config_store.os, "fsync", side_effect=OSError("disk full")):
+            with self.assertRaises(OSError):
+                self.store.commit(lambda c: {**c, "b": 2}, expected_revision=None)
+        self.assertEqual(self._bytes(), before)
+        self.assertEqual(self._leftovers(), [])
+
+    def test_unwritable_directory_raises_oserror(self):
+        blocker = os.path.join(self.tmpdir, "afile")
+        Path(blocker).write_text("x")
+        self.path = os.path.join(blocker, "config.json")  # parent is a file
+        with self.assertRaises(OSError):
+            self.store.commit(lambda c: {"a": 1}, expected_revision=None)
+
+    def test_stale_revision_conflicts_without_write(self):
+        self._write({"a": 1})
+        _data, revision = self.store.read()
+        self._write({"a": 2})  # another writer got there first
+        before = self._bytes()
+        calls = []
+        with self.assertRaises(RevisionConflict) as caught:
+            self.store.commit(
+                lambda c: calls.append(c) or c, expected_revision=revision
+            )
+        self.assertEqual(caught.exception.current, revision_of(before))
+        self.assertEqual(calls, [])
+        self.assertEqual(self._bytes(), before)
+
+    def test_matching_revision_commits(self):
+        self._write({"a": 1})
+        _data, revision = self.store.read()
+        saved, _ = self.store.commit(
+            lambda c: {**c, "b": 2}, expected_revision=revision
+        )
+        self.assertEqual(saved, {"a": 1, "b": 2})
+
+    def test_temp_file_removed_after_replace_failure(self):
+        self._write({"a": 1})
+        before = self._bytes()
+        with patch.object(
+            config_store.os, "replace", side_effect=PermissionError("locked")
+        ):
+            with self.assertRaises(OSError):
+                self.store.commit(lambda c: {**c, "b": 2}, expected_revision=None)
+        self.assertEqual(self._bytes(), before)
+        self.assertEqual(self._leftovers(), [])
+
+    @unittest.skipUnless(os.name == "posix", "POSIX file modes")
+    def test_committed_file_is_private_to_the_user(self):
+        import stat
+
+        self._write({"a": 1})
+        os.chmod(self.path, 0o644)
+        self.store.commit(lambda c: c, expected_revision=None)
+        self.assertEqual(stat.S_IMODE(os.stat(self.path).st_mode), 0o600)
+
+    def _probe_lock(self):
+        probe = ProbeLock()
+        patcher = patch.object(config_store, "_COMMIT_LOCK", probe)
+        patcher.start()
+        self.addCleanup(patcher.stop)
+        return probe
+
+    def _hold_lock_in_a_commit(self, value="first"):
+        """Start a commit that holds the lock until the returned event is set."""
+        inside = threading.Event()
+        release = threading.Event()
+        errors = []
+
+        def slow(config):
+            inside.set()
+            release.wait(10)
+            config[value] = 1
+            return config
+
+        def run():
+            try:
+                self.store.commit(slow, expected_revision=None)
+            except Exception as exc:  # pragma: no cover - reported by the test
+                errors.append(exc)
+
+        thread = threading.Thread(target=run)
+        thread.start()
+        self.assertTrue(inside.wait(10))
+        return thread, release, errors
+
+    def test_concurrent_commits_serialize(self):
+        # The second commit is observed blocked on the lock before the first
+        # one may finish, so this fails whenever commit stops taking the lock.
+        self._write({"keep": True})
+        probe = self._probe_lock()
+        first, release, errors = self._hold_lock_in_a_commit()
+        calls = []
+
+        def fast(config):
+            calls.append(dict(config))
+            config["second"] = 2
+            return config
+
+        second = threading.Thread(
+            target=lambda: self.store.commit(fast, expected_revision=None)
+        )
+        second.start()
+        self.assertTrue(probe.contended.wait(10), "second commit never waited")
+        self.assertEqual(calls, [])  # not called while the first holds the lock
+        release.set()
+        first.join(10)
+        second.join(10)
+
+        self.assertEqual(errors, [])
+        self.assertEqual(calls, [{"keep": True, "first": 1}])  # re-read inside
+        self.assertEqual(
+            json.loads(self._bytes()), {"keep": True, "first": 1, "second": 2}
+        )
+
+    def test_read_waits_for_a_running_commit(self):
+        # Windows cannot replace a file another handle has open, so a read
+        # runs under the commit lock and never overlaps a replace.
+        self._write({"keep": True})
+        probe = self._probe_lock()
+        first, release, errors = self._hold_lock_in_a_commit()
+        seen = []
+        reader = threading.Thread(target=lambda: seen.append(self.store.read()))
+        reader.start()
+        self.assertTrue(probe.contended.wait(10), "read did not take the lock")
+        self.assertEqual(seen, [])
+        release.set()
+        first.join(10)
+        reader.join(10)
+        self.assertEqual(errors, [])
+        self.assertEqual(seen[0][0], {"keep": True, "first": 1})
+        self.assertEqual(seen[0][1], revision_of(self._bytes()))
+
+    def test_replace_is_retried_after_a_transient_permission_error(self):
+        # Windows: an antivirus or indexer handle makes os.replace fail with
+        # PermissionError for a moment; the commit retries before failing.
+        self._write({"a": 1})
+        real_replace = os.replace
+        attempts = []
+
+        def flaky(src, dst):
+            attempts.append(dst)
+            if len(attempts) == 1:
+                raise PermissionError("in use by another process")
+            return real_replace(src, dst)
+
+        with (
+            patch.object(config_store, "_REPLACE_ATTEMPTS", 5),
+            patch.object(config_store.os, "replace", side_effect=flaky),
+            patch.object(config_store.time, "sleep") as sleep,
+        ):
+            saved, _ = self.store.commit(
+                lambda c: {**c, "b": 2}, expected_revision=None
+            )
+        self.assertEqual(saved, {"a": 1, "b": 2})
+        self.assertEqual(json.loads(self._bytes()), {"a": 1, "b": 2})
+        self.assertEqual(len(attempts), 2)
+        sleep.assert_called_once_with(config_store._REPLACE_BACKOFF_SECONDS)
+        self.assertEqual(self._leftovers(), [])
+
+    def test_replace_gives_up_after_the_last_attempt(self):
+        self._write({"a": 1})
+        before = self._bytes()
+        with (
+            patch.object(config_store, "_REPLACE_ATTEMPTS", 3),
+            patch.object(
+                config_store.os, "replace", side_effect=PermissionError("locked")
+            ) as replace,
+            patch.object(config_store.time, "sleep") as sleep,
+        ):
+            with self.assertRaises(PermissionError):
+                self.store.commit(lambda c: {**c, "b": 2}, expected_revision=None)
+        self.assertEqual((replace.call_count, sleep.call_count), (3, 2))
+        self.assertEqual(self._bytes(), before)
+        self.assertEqual(self._leftovers(), [])
+
+    def test_replace_is_tried_once_outside_windows(self):
+        expected = 5 if os.name == "nt" else 1
+        self.assertEqual(config_store._REPLACE_ATTEMPTS, expected)
+
+    @unittest.skipUnless(hasattr(os, "symlink"), "needs symlinks")
+    def test_symlinked_config_is_written_through_the_link(self):
+        # A config.json that is a symlink (or a single-file bind mount) is
+        # written beside its real target, so the link stays a link.
+        real_dir = os.path.join(self.tmpdir, "real")
+        os.mkdir(real_dir)
+        target = os.path.join(real_dir, "settings.json")
+        Path(target).write_text(json.dumps({"a": 1}), encoding="utf-8")
+        try:
+            os.symlink(target, self.path)
+        except (OSError, NotImplementedError):  # pragma: no cover - Windows
+            self.skipTest("symlinks are not permitted here")
+
+        saved, revision = self.store.commit(
+            lambda c: {**c, "b": 2}, expected_revision=None
+        )
+
+        self.assertTrue(os.path.islink(self.path))
+        self.assertEqual(json.loads(Path(target).read_text()), {"a": 1, "b": 2})
+        self.assertEqual(self.store.read(), (saved, revision))
+        self.assertEqual(os.listdir(real_dir), ["settings.json"])
+
+    def test_publish_runs_under_the_lock_after_the_write(self):
+        # Runtimes publish inside the commit, so two saves publish in the
+        # order they were written and the runtime ends on the last one.
+        self._write({"a": 1})
+        seen = []
+
+        # The lock is re-entrant, so another thread probes whether it is held.
+        def probe_publish(config):
+            result = []
+            thread = threading.Thread(
+                target=lambda: result.append(
+                    config_store._COMMIT_LOCK.acquire(blocking=False)
+                )
+            )
+            thread.start()
+            thread.join(10)
+            seen.append((config, json.loads(self._bytes()), result[0]))
+
+        saved, _ = self.store.commit(
+            lambda c: {**c, "b": 2}, expected_revision=None, publish=probe_publish
+        )
+        self.assertEqual(seen, [(saved, {"a": 1, "b": 2}, False)])
+
+    def test_publish_is_skipped_when_the_write_fails(self):
+        self._write({"a": 1})
+        published = []
+        with patch.object(config_store.os, "fsync", side_effect=OSError("disk full")):
+            with self.assertRaises(OSError):
+                self.store.commit(
+                    lambda c: {**c, "b": 2},
+                    expected_revision=None,
+                    publish=published.append,
+                )
+        self.assertEqual(published, [])
+
+    def test_handles_closed_after_commit(self):
+        self._write({"a": 1})
+        self.store.read()
+        self.store.commit(lambda c: {**c, "b": 2}, expected_revision=None)
+        assert_closed(self, self.tmpdir)
+        os.unlink(self.path)  # Windows refuses this while a handle is open
+        self.assertEqual(self._leftovers(), [])
+
+
+class SingletonTests(unittest.TestCase):
+    def test_get_config_store_is_one_process_store_on_the_configured_path(self):
+        store = get_config_store()
+        self.assertIs(store, get_config_store())
+        tmpdir = tempfile.mkdtemp()
+        try:
+            custom = os.path.join(tmpdir, "c.json")
+            with patch.dict(os.environ, {"PROMPT_MANAGER_CONFIG_PATH": custom}):
+                self.assertEqual(store.path, custom)
+        finally:
+            shutil.rmtree(tmpdir, ignore_errors=True)
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_execution_output_writer.py

@@ -299,45 +299,126 @@ class OutputWriterTests(fixtures.unittest.TestCase):
         )
         self.assertEqual(writer.context_budget.charged_bytes, 0)
 
+    def isolated_writer(self) -> HistoryWriter:
+        """A ready writer whose budget no other writer or test can charge."""
+        writer = HistoryWriter(
+            lambda: self.db, clock=self.clock, context_budget=ContextBudget()
+        )
+        self.writers.append(writer)
+        writer.start()
+        self.wait_for(lambda: writer.status().accepting)
+        return writer
+
+    def rotate_between_transactions(self, writer, start, after, restore, hold=None):
+        """Wrap ``after`` so a restore or invalidation lands right after it.
+
+        Returns the patch and an event set once that rotation has returned on
+        the worker. A restore is a full verify/migrate/backup/replace cycle, so
+        the handoff waits on this event with the generous ``BLOCK_SECONDS``
+        ceiling instead of the short worker-behavior deadline (TESTING.md,
+        Windows portability preflight).
+        """
+        backup = os.path.join(self.directory.name, f"restore-{start.run_id}.db")
+        self.assertTrue(self.db.model.backup_database(backup))
+        original = getattr(self.db, after)
+        rotated = threading.Event()
+
+        def write(*args, **kwargs):
+            result = original(*args, **kwargs)
+            try:
+                if hold is not None:
+                    entered, release = hold
+                    entered.set()
+                    release.wait(BLOCK_SECONDS)
+                if restore:
+                    self.db.model.restore_from_file(backup)
+                else:
+                    writer.invalidate()
+            finally:
+                rotated.set()
+            return result
+
+        return patch.object(self.db, after, write), rotated
+
     def test_restore_or_generation_rotation_between_transactions_discards_evidence(
         self,
     ):
         for after in ("write_execution_finish", "write_execution_contexts_for_finish"):
             for restore in (False, True):
                 with self.subTest(after=after, restore=restore):
-                    writer = self.writer()
-                    start = self.start_command(len(self.writers))
-                    self.db.write_execution_start(start)
-                    backup = os.path.join(self.directory.name, "restore.db")
-                    self.assertTrue(self.db.model.backup_database(backup))
-                    original = getattr(self.db, after)
+                    # Each subtest owns its writer and budget and retires them
+                    # before the next starts, so one slow restore cannot leave
+                    # in-flight charges or an epoch rotation for the next.
+                    writer = self.isolated_writer()
+                    try:
+                        start = self.start_command(len(self.writers))
+                        self.db.write_execution_start(start)
+                        rotation, rotated = self.rotate_between_transactions(
+                            writer, start, after, restore
+                        )
+                        with rotation:
+                            self.finalization(writer, start)
+                            self.assertTrue(rotated.wait(BLOCK_SECONDS))
+                            self.wait_for(lambda: writer.status().pending == 0)
+                        self.assertEqual(
+                            self.db.get_execution_outputs(start.run_id)["state"],
+                            "not_captured",
+                        )
+                        self.assertEqual(
+                            self.db.get_execution_contexts(start.run_id)["state"],
+                            (
+                                "complete"
+                                if after == "write_execution_contexts_for_finish"
+                                and not restore
+                                else "not_captured"
+                            ),
+                        )
+                        self.assertEqual(writer.context_budget.charged_bytes, 0)
+                    finally:
+                        self.assertTrue(writer.close(BLOCK_SECONDS))
 
-                    def write(*args, **kwargs):
-                        result = original(*args, **kwargs)
-                        if restore:
-                            self.db.model.restore_from_file(backup)
-                        else:
-                            writer.invalidate()
-                        return result
-
-                    with patch.object(self.db, after, write):
-                        self.finalization(writer, start)
-                        self.wait_for(lambda: writer.status().pending == 0)
-                    self.assertEqual(
-                        self.db.get_execution_outputs(start.run_id)["state"],
-                        "not_captured",
-                    )
-                    self.assertEqual(
-                        self.db.get_execution_contexts(start.run_id)["state"],
-                        (
-                            "complete"
-                            if after == "write_execution_contexts_for_finish"
-                            and not restore
-                            else "not_captured"
-                        ),
-                    )
-                    self.assertEqual(writer.context_budget.charged_bytes, 0)
-                    self.assertTrue(writer.close())
+    def test_slow_restore_between_transactions_holds_charge_only_while_in_flight(
+        self,
+    ):
+        writer = self.isolated_writer()
+        start = self.start_command()
+        self.db.write_execution_start(start)
+        entered, release = self.block()
+        rotation, rotated = self.rotate_between_transactions(
+            writer, start, "write_execution_finish", True, (entered, release)
+        )
+        with rotation:
+            context = self.sealed(writer)
+            outputs = self.outputs(writer, context.lease.byte_count)
+            charge = writer.context_budget.charged_bytes
+            self.assertGreater(charge, 0)
+            self.assertTrue(
+                writer.submit_finalization(self.finish_command(start), context, outputs)
+            )
+            self.assertTrue(entered.wait(BLOCK_SECONDS))
+            # The worker is between transactions: the payload is owned, not leaked.
+            self.assertEqual(writer.status().pending, 1)
+            self.assertEqual(writer.context_budget.charged_bytes, charge)
+            release.set()
+            self.assertTrue(rotated.wait(BLOCK_SECONDS))
+            self.wait_for(lambda: writer.status().pending == 0)
+        self.assertEqual(writer.context_budget.charged_bytes, 0)
+        self.assertFalse(writer.status().accepting)
+        self.assertEqual(
+            self.db.get_execution_outputs(start.run_id)["state"], "not_captured"
+        )
+        # The restored epoch is probed again and new evidence is accepted.
+        self.clock.advance(5)
+        self.wait_for(lambda: writer.status().accepting)
+        restored = self.start_command(2)
+        self.db.write_execution_start(restored)
+        self.finalization(writer, restored)
+        self.wait_for(lambda: writer.status().pending == 0)
+        self.assertEqual(
+            self.db.get_execution_outputs(restored.run_id)["state"], "complete"
+        )
+        self.assertEqual(writer.context_budget.charged_bytes, 0)
+        self.assertTrue(writer.close(BLOCK_SECONDS))
 
     def test_invalidation_during_output_preparation_rechecks_actual_commit(self):
         import database.execution_outputs as outputs_db

tests/test_image_tag_jobs.py

@@ -0,0 +1,804 @@
+"""Bulk image tagging as an Activity job: Add tags and Auto-tag (#249 D1).
+
+``POST /prompt_manager/jobs/image-tags`` starts one record-changing
+``image-tags`` job over 1..500 listed images. Add tags unions a fixed set
+into each file's byte record; Auto-tag runs one legacy engine on a private
+capture of each still image (under the shared model gate, never
+downloading) and unions its top N suggestions. No real model is loaded: the
+engine is B2's fake service.
+"""
+
+import asyncio
+import hashlib
+import json
+import sqlite3
+import threading
+import unittest
+from unittest.mock import patch
+
+try:
+    from test_api_annotation_suggest import SCORED, WD14, FakeTagger, SuggestTestCase
+    from test_api_images import make_png
+except ImportError:
+    from tests.test_api_annotation_suggest import (
+        SCORED,
+        WD14,
+        FakeTagger,
+        SuggestTestCase,
+    )
+    from tests.test_api_images import make_png
+
+from database.execution_history_schema import rotate_history_epoch
+from py import model_gate
+from py.api import jobs as jobs_module
+from py.config import AutotagConfig
+from utils.media_capture import CaptureCapacity
+
+START = "/prompt_manager/jobs/image-tags"
+WAIT = 30.0
+KIND = getattr(jobs_module, "IMAGE_TAG_JOB_KIND", "image-tags")
+GROUPS = ("tagged", "unchanged", "skipped", "errors")
+
+
+class HookedTagger(FakeTagger):
+    """The B2 fake plus a hook that runs inside each inference."""
+
+    def __init__(self):
+        super().__init__()
+        self.on_generate = None
+
+    def generate_tag_suggestions(self, image_path, **kwargs):
+        result = super().generate_tag_suggestions(image_path, **kwargs)
+        if self.on_generate is not None:
+            self.on_generate(image_path)
+        return result
+
+
+class ImageTagJobTestCase(SuggestTestCase):
+    async def get_application(self):
+        app = await super().get_application()
+        self.tagger = HookedTagger()
+        patcher = patch("py.autotag.get_autotag_service", return_value=self.tagger)
+        patcher.start()
+        self.addCleanup(patcher.stop)
+        return app
+
+    async def tearDownAsync(self):
+        # Every job of the test has ended before the app goes away.
+        for job in self.api._jobs.list():
+            if job.task is not None and not job.task.done():
+                job.task.cancel()
+                await asyncio.gather(job.task, return_exceptions=True)
+        await super().tearDownAsync()
+
+    # -- helpers ---------------------------------------------------------
+
+    def png(self, path, size=(8, 6), color=(200, 120, 40)):
+        make_png(self.output_dir / path, size=size, color=color)
+        return self.output_dir / path
+
+    def digest(self, path):
+        return hashlib.sha256((self.output_dir / path).read_bytes()).hexdigest()
+
+    def stored(self, path):
+        return self.api.db.read_image_tags(self.locator(path), self.digest(path))
+
+    def add_body(self, paths, tags, **changes):
+        return {
+            "mode": "add",
+            "targets": [self.target(p) for p in paths],
+            "tags": list(tags),
+            **changes,
+        }
+
+    def auto_body(self, paths, model_type="wd14-vit", options=None, **changes):
+        return {
+            "mode": "auto",
+            "targets": [self.target(p) for p in paths],
+            "model_type": model_type,
+            "options": dict(WD14) if options is None else options,
+            **changes,
+        }
+
+    async def start(self, body):
+        response = await self.client.post(START, json=body)
+        return response.status, await self.json_of(response)
+
+    async def start_ok(self, body):
+        status, data = await self.start(body)
+        self.assertEqual(status, 202, data)
+        return self.api._jobs.get(data["job"]["id"])
+
+    async def run_job(self, body):
+        job = await self.start_ok(body)
+        await asyncio.wait_for(asyncio.shield(job.task), WAIT)
+        return job
+
+    def rows(self, job, group):
+        return [(row["path"], row["detail"]) for row in job.outcomes[group]]
+
+    async def wait_for(self, event):
+        ok = await asyncio.get_running_loop().run_in_executor(None, event.wait, WAIT)
+        self.assertTrue(ok, "the fake engine was never entered")
+
+
+class TestAddTags(ImageTagJobTestCase):
+    async def test_add_job_unions_tags_on_each_target_and_records_outcomes(self):
+        for name in ("a.png", "b.png", "c.png"):
+            self.png(name, color=(len(name), ord(name[0]), 9))
+        self.saved_set("a.png", (self.output_dir / "a.png").read_bytes(), ["keep_me"])
+        self.saved_set(
+            "c.png", (self.output_dir / "c.png").read_bytes(), ["Sandstone", "desert"]
+        )
+
+        job = await self.run_job(
+            self.add_body(
+                ["a.png", "b.png", "c.png", "gone.png"], ["sandstone", "desert"]
+            )
+        )
+
+        self.assertEqual(job.kind, KIND)
+        self.assertEqual(job.title, "Add tags to images")
+        self.assertEqual(job.state, "finished")
+        self.assertTrue(job.record_changing)
+        self.assertEqual(job.scope, {"mode": "add", "images": 4})
+        self.assertEqual(
+            job.counters, {"tagged": 2, "unchanged": 1, "skipped": 1, "errors": 0}
+        )
+        self.assertEqual(
+            self.stored("a.png")["tags"], ["keep_me", "sandstone", "desert"]
+        )
+        self.assertEqual(self.stored("b.png")["tags"], ["sandstone", "desert"])
+        # The stored spelling wins; nothing new means no write.
+        self.assertEqual(self.stored("c.png")["tags"], ["Sandstone", "desert"])
+        self.assertEqual(self.stored("c.png")["tag_revision"], 1)
+        self.assertEqual(
+            self.rows(job, "tagged"),
+            [("a.png", "Added 2 tags"), ("b.png", "Added 2 tags")],
+        )
+        self.assertEqual(self.rows(job, "unchanged"), [("c.png", "No new tags")])
+        self.assertEqual(self.rows(job, "skipped"), [("gone.png", "File not found")])
+        self.assertEqual(job.outcomes["tagged"][0]["root_index"], 0)
+        self.assertEqual((job.processed, job.total, job.progress), (4, 4, 100))
+        self.assertTrue(any("+ " in line and "a.png" in line for line in job.log))
+        self.assertTrue(job.log[-1].endswith("Add tags finished · 4 files processed"))
+        # Add tags never needs the model.
+        self.assertEqual(self.tagger.load_calls, [])
+        self.assertIsNone(model_gate.holder())
+
+    async def test_add_tags_vocabulary_names_become_global_tags(self):
+        self.png("a.png")
+
+        await self.run_job(self.add_body(["a.png"], ["brand_new_tag"]))
+
+        names = set(self.api.db.get_all_tags())
+        self.assertIn("brand_new_tag", names)
+
+    async def test_add_over_the_tag_cap_is_an_error_row_with_zero_writes(self):
+        self.png("a.png")
+        full = [f"t{i:03d}" for i in range(100)]
+        self.saved_set("a.png", (self.output_dir / "a.png").read_bytes(), full)
+
+        job = await self.run_job(self.add_body(["a.png"], ["one_more"]))
+
+        self.assertEqual(job.counters["errors"], 1)
+        self.assertEqual(
+            self.rows(job, "errors"),
+            [("a.png", "An image can carry at most 100 tags.")],
+        )
+        self.assertEqual(self.stored("a.png")["tags"], full)
+
+    async def test_video_skipped_in_auto_and_tagged_in_add(self):
+        (self.output_dir / "clip.mp4").write_bytes(b"\x00\x00\x00\x18ftypmp42" * 8)
+
+        added = await self.run_job(self.add_body(["clip.mp4"], ["motion"]))
+        self.assertEqual(self.rows(added, "tagged"), [("clip.mp4", "Added 1 tag")])
+        self.assertEqual(self.stored("clip.mp4")["tags"], ["motion"])
+
+        auto = await self.run_job(self.auto_body(["clip.mp4"]))
+        self.assertEqual(
+            self.rows(auto, "skipped"), [("clip.mp4", "Video: manual tags only")]
+        )
+        self.assertEqual(self.tagger.calls, [])
+        self.assertEqual(self.stored("clip.mp4")["tags"], ["motion"])
+
+    async def test_not_a_still_image_and_too_large_are_skipped(self):
+        (self.output_dir / "broken.png").write_bytes(b"not an image")
+        self.png("big.png")
+        self.api._capture_store().max_file = 16
+
+        auto = await self.run_job(self.auto_body(["big.png"]))
+        self.assertEqual(
+            self.rows(auto, "skipped"), [("big.png", "Too large to verify")]
+        )
+
+        self.api._capture_store().max_file = 2**20
+        auto = await self.run_job(self.auto_body(["broken.png"]))
+        self.assertEqual(
+            self.rows(auto, "skipped"), [("broken.png", "Not a supported still image")]
+        )
+
+        self.api._capture_store().max_file = 16
+        added = await self.run_job(self.add_body(["big.png"], ["x"]))
+        self.assertEqual(
+            self.rows(added, "skipped"), [("big.png", "Too large to verify")]
+        )
+        self.assertEqual(self.tagger.calls, [])
+
+
+class TestAutoTag(ImageTagJobTestCase):
+    async def test_auto_job_applies_the_requested_count_per_file_without_removing_existing(  # noqa: E501
+        self,
+    ):
+        self.png("a.png")
+        self.png("b.png", color=(1, 2, 3))
+        self.saved_set("a.png", (self.output_dir / "a.png").read_bytes(), ["keep_me"])
+        options = {**WD14, "suggestion_limit": 2}
+
+        job = await self.run_job(self.auto_body(["a.png", "b.png"], options=options))
+
+        self.assertEqual(job.title, "Auto-tag images")
+        self.assertEqual(
+            job.scope, {"mode": "auto", "images": 2, "model_type": "wd14-vit"}
+        )
+        self.assertEqual(job.state, "finished")
+        self.assertEqual(
+            self.api.db.read_image_tags(self.locator("a.png"), self.digest("a.png"))[
+                "tags"
+            ],
+            ["keep_me", "sandstone", "desert"],
+        )
+        self.assertEqual(self.stored("b.png")["tags"], ["sandstone", "desert"])
+        self.assertEqual(
+            job.counters, {"tagged": 2, "unchanged": 0, "skipped": 0, "errors": 0}
+        )
+        # Inference read the private captures only, never the current files.
+        for path in self.tagger.read_paths:
+            self.assertNotIn(str(self.output_dir), path)
+        self.assertEqual([call["limit"] for call in self.tagger.calls], [2, 2])
+
+        # limit 3: at most three names are added to a file.
+        self.png("c.png", color=(9, 9, 9))
+        options = {**WD14, "suggestion_limit": 3}
+        job = await self.run_job(self.auto_body(["c.png"], options=options))
+        self.assertEqual(self.stored("c.png")["tags"], [name for name, _ in SCORED[:3]])
+        self.assertEqual(self.rows(job, "tagged"), [("c.png", "Added 3 tags")])
+
+        # Omitted: the configured default.
+        AutotagConfig.SUGGESTION_LIMIT = 4
+        self.png("d.png", color=(7, 7, 7))
+        await self.run_job(self.auto_body(["d.png"]))
+        self.assertEqual(self.tagger.calls[-1]["limit"], 4)
+        self.assertEqual(len(self.stored("d.png")["tags"]), 4)
+
+        # Suggestions the file already carries add nothing.
+        job = await self.run_job(self.auto_body(["d.png"]))
+        self.assertEqual(self.rows(job, "unchanged"), [("d.png", "No new tags")])
+
+    async def test_auto_job_holds_gate_and_never_downloads(self):
+        self.png("a.png")
+        self.png("b.png", color=(1, 2, 3))
+        entered, proceed = threading.Event(), threading.Event()
+        self.tagger.block = (entered, proceed)
+
+        job = await self.start_ok(self.auto_body(["a.png", "b.png"]))
+        await self.wait_for(entered)
+        holder = model_gate.holder()
+        self.assertIsNotNone(holder)
+        self.assertTrue(holder.startswith("image-tag-job:"), holder)
+        # A legacy route cannot swap the model under the running job.
+        response = await self.client.post("/prompt_manager/autotag/unload")
+        self.assertEqual(response.status, 409)
+        self.assertEqual((await response.json())["code"], "model-busy")
+        proceed.set()
+        await asyncio.wait_for(asyncio.shield(job.task), WAIT)
+
+        self.assertEqual(job.counters["tagged"], 2)
+        self.assertEqual(self.tagger.load_calls, [("wd14-vit", True)])
+        self.tagger.download_model.assert_not_called()
+        self.assertIsNone(model_gate.holder())
+
+    async def test_model_unavailable_fails_the_job_before_the_first_file(self):
+        self.png("a.png")
+        self.tagger.downloaded["wd14-vit"] = False
+
+        job = await self.run_job(self.auto_body(["a.png"]))
+
+        self.assertEqual(job.state, "failed")
+        self.assertEqual(job.processed, 0)
+        self.assertEqual(job.counters, dict.fromkeys(GROUPS, 0))
+        self.assertTrue(
+            any(
+                line.endswith(
+                    "is not downloaded. Download it from the legacy Auto-tag page."
+                )
+                for line in job.log
+            ),
+            job.log,
+        )
+        self.assertEqual(self.tagger.load_calls, [])
+        self.tagger.download_model.assert_not_called()
+        self.assertIsNone(model_gate.holder())
+        self.assertEqual(self.api._capture_store().stats()["captures"], 0)
+
+    async def test_model_load_failure_fails_the_job_and_frees_the_gate(self):
+        self.png("a.png")
+        self.tagger.load_error = RuntimeError("/secret/models/wd14 exploded")
+
+        job = await self.run_job(self.auto_body(["a.png"]))
+
+        self.assertEqual(job.state, "failed")
+        self.assertEqual(job.processed, 0)
+        self.assertNotIn("/secret", json.dumps(job.detail()))
+        self.assertIsNone(model_gate.holder())
+
+    async def test_inference_failure_is_an_error_row_and_the_job_goes_on(self):
+        self.png("a.png")
+        self.png("b.png", color=(1, 2, 3))
+        failing = {"first": True}
+
+        def explode(_path):
+            if failing.pop("first", False):
+                raise RuntimeError("/secret/path boom")
+
+        self.tagger.on_generate = explode
+
+        job = await self.run_job(self.auto_body(["a.png", "b.png"]))
+
+        self.assertEqual(job.counters["errors"], 1)
+        self.assertEqual(job.counters["tagged"], 1)
+        self.assertEqual(
+            self.rows(job, "errors"),
+            [("a.png", "Auto-tagging failed. Check server logs for details.")],
+        )
+        self.assertNotIn("/secret", json.dumps(job.report()))
+        self.assertIsNone(model_gate.holder())
+
+    async def test_changed_file_is_skipped_not_tagged(self):
+        self.png("a.png")
+        before = self.digest("a.png")
+
+        def rewrite(_capture_path):
+            make_png(self.output_dir / "a.png", size=(8, 6), color=(1, 1, 1))
+
+        self.tagger.on_generate = rewrite
+
+        job = await self.run_job(self.auto_body(["a.png"]))
+
+        self.assertEqual(self.rows(job, "skipped"), [("a.png", "File changed")])
+        self.assertEqual(job.counters["tagged"], 0)
+        locator = self.locator("a.png")
+        self.assertEqual(self.api.db.read_image_tags(locator, before)["tags"], [])
+        self.assertEqual(self.stored("a.png")["tags"], [])
+
+    async def test_captures_released_and_handles_closed(self):
+        try:
+            from open_handles import assert_closed
+        except ImportError:
+            from tests.open_handles import assert_closed
+        for index in range(3):
+            self.png(f"f{index}.png", color=(index, 0, 0))
+
+        await self.run_job(self.auto_body([f"f{index}.png" for index in range(3)]))
+
+        store = self.api._capture_store()
+        self.assertEqual(store.stats()["captures"], 0)
+        assert_closed(self, store.directory)
+        assert_closed(self, str(self.output_dir))
+
+
+class TestStartAndExclusion(ImageTagJobTestCase):
+    async def test_start_returns_model_busy_or_job_busy(self):
+        self.png("a.png")
+        other = model_gate.new_owner("legacy-batch")
+        self.assertTrue(model_gate.try_acquire(other))
+        try:
+            status, body = await self.start(self.auto_body(["a.png"]))
+            self.assertEqual((status, body["code"]), (409, "model-busy"))
+            self.assertEqual(self.api._jobs.list(), [])
+            # Add tags needs no model: it starts while the gate is held.
+            job = await self.run_job(self.add_body(["a.png"], ["x"]))
+            self.assertEqual(job.state, "finished")
+        finally:
+            model_gate.release(other)
+
+        entered, proceed = threading.Event(), threading.Event()
+        self.tagger.block = (entered, proceed)
+        job = await self.start_ok(self.auto_body(["a.png"]))
+        await self.wait_for(entered)
+        try:
+            for body in (self.add_body(["a.png"], ["y"]), self.auto_body(["a.png"])):
+                resp = await self.client.post(START, json=body)
+                body = await resp.json()
+                self.assertEqual((resp.status, body["code"]), (409, "busy"))
+                self.assertEqual(
+                    body["running"], {"id": job.id, "title": "Auto-tag images"}
+                )
+        finally:
+            proceed.set()
+            await asyncio.wait_for(asyncio.shield(job.task), WAIT)
+        # A refused start never leaves the gate taken.
+        self.assertIsNone(model_gate.holder())
+
+    async def test_image_tag_job_refused_while_legacy_restore_holds(self):
+        self.png("a.png")
+        async with self.api._jobs.hold(
+            "restore", "Database restore (admin page)", admission="records"
+        ):
+            status, body = await self.start(self.add_body(["a.png"], ["x"]))
+            self.assertEqual((status, body["code"]), (409, "busy"))
+            self.assertEqual(body["running"]["title"], "Database restore (admin page)")
+            status, body = await self.start(self.auto_body(["a.png"]))
+            self.assertEqual((status, body["code"]), (409, "busy"))
+            self.assertIsNone(model_gate.holder())
+        async with self.api._jobs.hold(
+            "thumbnails", "Thumbnail generation (gallery page)", admission="guarded"
+        ):
+            status, body = await self.start(self.add_body(["a.png"], ["x"]))
+            self.assertEqual((status, body["code"]), (409, "busy"))
+
+    async def test_record_changing_excludes_running_scan(self):
+        self.png("a.png")
+        gate = asyncio.Event()
+
+        async def scan_runner(job):
+            await gate.wait()
+
+        scan = self.api._jobs.start(
+            "scan",
+            "Scan for metadata",
+            record_changing=True,
+            scope={"files": "new"},
+            runner=scan_runner,
+        )
+        try:
+            status, body = await self.start(self.add_body(["a.png"], ["x"]))
+            self.assertEqual((status, body["code"]), (409, "busy"))
+            self.assertEqual(body["running"]["title"], "Scan for metadata")
+            status, body = await self.start(self.auto_body(["a.png"]))
+            self.assertEqual((status, body["code"]), (409, "busy"))
+            self.assertIsNone(model_gate.holder())
+        finally:
+            gate.set()
+            await scan.task
+
+        # The other way round: a running tagging job keeps the scan out.
+        entered, proceed = threading.Event(), threading.Event()
+        self.tagger.block = (entered, proceed)
+        job = await self.start_ok(self.auto_body(["a.png"]))
+        await self.wait_for(entered)
+        try:
+            resp = await self.client.post("/prompt_manager/jobs/scan", json={})
+            self.assertEqual(resp.status, 409)
+            self.assertEqual((await resp.json())["running"]["id"], job.id)
+        finally:
+            proceed.set()
+            await asyncio.wait_for(asyncio.shield(job.task), WAIT)
+
+    async def test_a_start_that_loses_the_slot_race_frees_the_gate(self):
+        self.png("a.png")
+        gate = asyncio.Event()
+
+        async def scan_runner(job):
+            await gate.wait()
+
+        scan = self.api._jobs.start(
+            "scan",
+            "Scan for metadata",
+            record_changing=True,
+            scope={},
+            runner=scan_runner,
+        )
+        try:
+            # The pre-check saw a free slot; registry.start still refuses.
+            with patch.object(self.api._jobs, "blocker", side_effect=[None, scan]):
+                status, body = await self.start(self.auto_body(["a.png"]))
+            self.assertEqual((status, body["code"]), (409, "busy"))
+            self.assertIsNone(model_gate.holder())
+        finally:
+            gate.set()
+            await scan.task
+
+    async def test_cancel_stops_at_file_boundary_and_keeps_written_files(self):
+        for index in range(3):
+            self.png(f"f{index}.png", color=(index, 5, 5))
+        entered, proceed = threading.Event(), threading.Event()
+        self.tagger.block = (entered, proceed)
+
+        job = await self.start_ok(self.auto_body([f"f{i}.png" for i in range(3)]))
+        await self.wait_for(entered)
+        response = await self.client.post(f"/prompt_manager/jobs/{job.id}/cancel")
+        self.assertTrue((await response.json())["cancellation_requested"])
+        proceed.set()
+        await asyncio.wait_for(asyncio.shield(job.task), WAIT)
+
+        self.assertEqual(job.state, "cancelled")
+        self.assertEqual(job.counters["tagged"], 1)
+        self.assertEqual(job.processed, 1)
+        self.assertEqual(len(self.stored("f0.png")["tags"]), 10)
+        self.assertEqual(self.stored("f1.png")["tags"], [])
+        self.assertEqual(len(self.tagger.calls), 1)
+        self.assertTrue(job.log[-1].endswith("Auto-tag cancelled · 1 file processed"))
+        self.assertIsNone(model_gate.holder())
+        self.assertEqual(self.api._capture_store().stats()["captures"], 0)
+
+    async def test_stale_root_scope_refuses_the_start(self):
+        self.png("a.png")
+        body = self.add_body(["a.png"], ["x"])
+        body["targets"][0]["root_scope"] = "0" * 64
+
+        status, data = await self.start(body)
+
+        self.assertEqual((status, data["code"]), (409, "source-changed"))
+        self.assertEqual(self.api._jobs.list(), [])
+
+    async def test_restore_during_the_job_stops_it_without_writes(self):
+        self.png("a.png")
+        self.png("b.png", color=(1, 2, 3))
+
+        def rotate(_path):
+            conn = sqlite3.connect(self._temp_db.name)
+            try:
+                rotate_history_epoch(conn)
+            finally:
+                conn.close()
+
+        self.tagger.on_generate = rotate
+
+        job = await self.run_job(self.auto_body(["a.png", "b.png"]))
+
+        self.assertEqual(job.state, "failed")
+        self.assertEqual(job.counters["tagged"], 0)
+        self.assertEqual(
+            self.rows(job, "errors"),
+            [("a.png", "Prompt storage was restored; start the job again.")],
+        )
+        self.assertEqual(self.stored("a.png")["tags"], [])
+        self.assertEqual(len(self.tagger.calls), 1)
+        self.assertIsNone(model_gate.holder())
+
+    async def test_invalid_bodies_rejected(self):
+        self.png("a.png")
+        target = self.target("a.png")
+        bad_bodies = [
+            {"mode": "add", "targets": [], "tags": ["x"]},
+            {"mode": "add", "targets": [target] * 501, "tags": ["x"]},
+            {"mode": "add", "targets": "a.png", "tags": ["x"]},
+            {"mode": "add", "targets": [{**target, "path": "../a.png"}], "tags": ["x"]},
+            {"mode": "add", "targets": [{**target, "root_index": True}], "tags": ["x"]},
+            {"mode": "add", "targets": [{**target, "extra": 1}], "tags": ["x"]},
+            {"mode": "add", "targets": [{**target, "path": "a.txt"}], "tags": ["x"]},
+            {"mode": "add", "targets": [target], "tags": []},
+            {"mode": "add", "targets": [target], "tags": "x"},
+            {"mode": "add", "targets": [target], "tags": ["bad\nname"]},
+            {"mode": "add", "targets": [target]},
+            {"mode": "add", "targets": [target], "tags": ["x"], "extra": 1},
+            {"mode": "add", "targets": [target], "tags": ["x"], "model_type": "hf"},
+            {"mode": "remove", "targets": [target], "tags": ["x"]},
+            {"targets": [target], "tags": ["x"]},
+            {"mode": "auto", "targets": [target], "model_type": "wd14-vit"},
+            {"mode": "auto", "targets": [target], "model_type": "x", "options": {}},
+            {
+                "mode": "auto",
+                "targets": [target],
+                "model_type": "wd14-vit",
+                "options": {},
+            },
+            {
+                "mode": "auto",
+                "targets": [target],
+                "model_type": "wd14-vit",
+                "options": {**WD14, "general_threshold": 2},
+            },
+            {
+                "mode": "auto",
+                "targets": [target],
+                "model_type": "wd14-vit",
+                "options": {**WD14, "suggestion_limit": 0},
+            },
+            {
+                "mode": "auto",
+                "targets": [target],
+                "model_type": "gguf",
+                "options": dict(WD14),
+            },
+            {
+                "mode": "auto",
+                "targets": [target],
+                "model_type": "wd14-vit",
+                "options": dict(WD14),
+                "tags": ["x"],
+            },
+        ]
+        for body in bad_bodies:
+            with self.subTest(body=json.dumps(body)[:120]):
+                status, data = await self.start(body)
+                self.assertIn(status, (400, 403), data)
+                self.assertFalse(data["success"])
+        too_many = {
+            "mode": "add",
+            "targets": [target],
+            "tags": [f"t{i}" for i in range(101)],
+        }
+        status, data = await self.start(too_many)
+        self.assertEqual((status, data["code"]), (400, "tag-limit"))
+        response = await self.client.post(START, data="not json")
+        self.assertEqual(response.status, 400)
+        self.assertEqual(self.api._jobs.list(), [])
+        self.assertIsNone(model_gate.holder())
+
+    async def test_duplicate_targets_are_tagged_once(self):
+        self.png("a.png")
+
+        job = await self.run_job(self.add_body(["a.png", "a.png"], ["x"]))
+
+        self.assertEqual(job.scope["images"], 1)
+        self.assertEqual(job.counters["tagged"], 1)
+
+    async def test_rows_and_report_carry_no_absolute_paths(self):
+        self.png("sub/a.png")
+        self.png("sub/b.png", color=(3, 3, 3))
+        job = await self.run_job(
+            self.auto_body(["sub/a.png", "sub/b.png", "sub/missing.png"])
+        )
+
+        for url in (
+            START.rsplit("/", 1)[0],
+            f"/prompt_manager/jobs/{job.id}",
+            f"/prompt_manager/jobs/{job.id}/report",
+        ):
+            response = await self.client.get(url)
+            self.assertEqual(response.status, 200)
+            body = json.loads(await response.text())
+            self.assert_no_paths(body)
+        detail = job.detail()
+        self.assertEqual(
+            [row["path"] for row in detail["outcomes"]["tagged"]],
+            ["sub/a.png", "sub/b.png"],
+        )
+        self.assertTrue(
+            all(row["root"] == "output" for row in detail["outcomes"]["tagged"])
+        )
+        self.assertTrue(any("output/sub/a.png" in line for line in detail["log"]))
+
+
+class TestFixRound(ImageTagJobTestCase):
+    """The final review's fixes: estimate, body bound, busy captures, roots."""
+
+    async def test_status_line_estimates_minutes_left_after_the_minimum(self):
+        for index in range(3):
+            self.png(f"f{index}.png", color=(index, 7, 7))
+        clock = iter([0.0, 0.0, 120.0, 240.0])
+        lines = []
+        self.tagger.on_generate = lambda _path: lines.append(
+            self.api._jobs.list()[0].status_line
+        )
+
+        with patch(
+            "py.api.image_tag_jobs._monotonic", side_effect=lambda: next(clock, 240.0)
+        ):
+            await self.run_job(self.auto_body([f"f{i}.png" for i in range(3)]))
+
+        # Two files make the minimum (the scan's MIN_BATCHES_FOR_ESTIMATE); then
+        # 120 s per file leaves about 2 min for the third.
+        self.assertEqual(
+            lines,
+            [
+                "Processing file 1 of 3",
+                "Processing file 2 of 3",
+                "Processing file 3 of 3 · about 2 min left",
+            ],
+        )
+
+    def maximal_target(self, number):
+        """A distinct target whose path is 1024 non-ASCII code points long."""
+        head = f"{number:03d}/" + ("界" * 200 + "/") * 5
+        path = head + "界" * (1024 - len(head) - 4) + ".png"
+        self.assertEqual(len(path), 1024)
+        return self.target(path)
+
+    async def test_start_body_bounds(self):
+        from py.api import image_tag_jobs
+
+        body = {
+            "mode": "add",
+            "targets": [self.maximal_target(n) for n in range(500)],
+            "tags": ["x"],
+        }
+        # Escaped as \uXXXX (6 bytes a code point), far over the old 1 MiB.
+        payload = json.dumps(body).encode("utf-8")
+        self.assertGreater(len(payload), 3 * 1000 * 1000)
+        response = await self.client.post(
+            START, data=payload, headers={"Content-Type": "application/json"}
+        )
+        data = await self.json_of(response)
+        self.assertEqual(response.status, 202, data)
+        self.assertEqual(data["job"]["scope"]["images"], 500)
+        job = self.api._jobs.get(data["job"]["id"])
+        await self.client.post(f"/prompt_manager/jobs/{job.id}/cancel")
+        await asyncio.wait_for(asyncio.shield(job.task), WAIT)
+
+        cap = image_tag_jobs.MAX_JOB_BODY_BYTES
+        self.assertGreaterEqual(cap, len(payload))
+        over = b'{"mode":"add","targets":[],"tags":["x"]'
+        over += b" " * (cap + 1 - len(over) - 1) + b"}"
+        self.assertEqual(len(over), cap + 1)
+        response = await self.client.post(
+            START, data=over, headers={"Content-Type": "application/json"}
+        )
+        self.assertEqual(response.status, 413)
+
+    def saturate(self, store):
+        with store._lock:
+            store._workers += store.max_workers
+        self.addCleanup(self.unsaturate, store)
+
+    def unsaturate(self, store):
+        with store._lock:
+            if store._workers >= store.max_workers:
+                store._workers -= store.max_workers
+
+    async def test_busy_capture_workers_are_retried_then_left_for_a_rerun(self):
+        self.png("a.png")
+        self.png("b.png", color=(1, 2, 3))
+        store = self.api._capture_store()
+        self.saturate(store)
+
+        with patch("py.api.image_tag_jobs.CAPACITY_BACKOFF", (0.001, 0.001)):
+            added = await self.run_job(self.add_body(["a.png"], ["x"]))
+            auto = await self.run_job(self.auto_body(["b.png"]))
+
+        retry = "The file could not be read now. Run the job again for it."
+        for job, path in ((added, "a.png"), (auto, "b.png")):
+            self.assertEqual(job.state, "finished")
+            self.assertEqual(self.rows(job, "skipped"), [(path, retry)])
+            self.assertEqual(job.counters["errors"], 0)
+            self.assertNotIn("Tag dialog", json.dumps(job.detail()))
+        self.assertEqual(self.tagger.calls, [])
+        self.assertEqual(self.stored("a.png")["tags"], [])
+
+    async def test_a_busy_capture_worker_that_frees_up_is_tagged(self):
+        self.png("a.png")
+        store = self.api._capture_store()
+        real = store.verify
+        tries = []
+
+        def verify(root, relative):
+            tries.append(relative)
+            if len(tries) < 3:
+                raise CaptureCapacity("Too many captures are in progress")
+            return real(root, relative)
+
+        with (
+            patch.object(store, "verify", side_effect=verify),
+            patch("py.api.image_tag_jobs.CAPACITY_BACKOFF", (0.001, 0.001, 0.001)),
+        ):
+            job = await self.run_job(self.add_body(["a.png"], ["x"]))
+
+        self.assertEqual(len(tries), 3)
+        self.assertEqual(self.rows(job, "tagged"), [("a.png", "Added 1 tag")])
+        self.assertEqual(self.stored("a.png")["tags"], ["x"])
+
+    async def test_output_roots_are_read_once_per_job_off_the_event_loop(self):
+        for index in range(3):
+            self.png(f"f{index}.png", color=(index, 1, 1))
+        body = self.add_body([f"f{i}.png" for i in range(3)], ["x"])
+        original = self.api._get_all_output_dirs
+        threads = []
+
+        def lookup():
+            threads.append(threading.current_thread())
+            return original()
+
+        with patch.object(self.api, "_get_all_output_dirs", side_effect=lookup):
+            job = await self.run_job(body)
+
+        self.assertEqual(job.counters["tagged"], 3)
+        # One read when the start checks the scopes, one for the whole run.
+        self.assertEqual(len(threads), 2)
+        self.assertNotIn(threading.main_thread(), threads)
+        self.assertEqual(job.outcomes["tagged"][0]["root"], "output")
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_init_package.py

@@ -12,6 +12,7 @@ import json
 import os
 import sys
 import tempfile
+import threading
 import types
 import unittest
 import unittest.mock as mock
@@ -368,10 +369,29 @@ class TestConsoleBanner(unittest.TestCase):
         self.assertIn("Loaded:", banner)
 
 
+class PriorFileHandler(logging.FileHandler):
+    """A caller-owned sink that stays closed once its owner closes it.
+
+    ``FileHandler.emit`` reopens the file when ``stream`` is None, so a record
+    that selected this handler before ``close()`` would reopen prior.log after
+    it, and Windows then refuses the temp directory cleanup (WinError 32).
+    ``Handler.handle`` and ``FileHandler.close`` hold the same handler lock, so
+    checking ``_closed`` in ``emit`` is race free (as in the product's
+    ``_OwnedRotatingFileHandler``).
+    """
+
+    def emit(self, record):
+        if not self._closed:
+            super().emit(record)
+
+
 class TestPackageLoggerIsolation(unittest.TestCase):
     def setUp(self):
         self.tmp = tempfile.TemporaryDirectory()
         self.addCleanup(self.tmp.cleanup)
+        # Runs after restore_logging, before the cleanup Windows refuses while
+        # prior.log is open; /proc makes Linux fail the same way.
+        self.addCleanup(self.assert_tmp_has_no_open_handles)
         self.logger = logging.getLogger("prompt_manager")
         self.previous = (
             self.logger.handlers[:],
@@ -381,7 +401,7 @@ class TestPackageLoggerIsolation(unittest.TestCase):
         )
         self.addCleanup(self.restore_logging)
         self.path = os.path.join(self.tmp.name, "prior.log")
-        self.handler = logging.FileHandler(self.path)
+        self.handler = PriorFileHandler(self.path)
         self.logger.handlers = [self.handler]
         self.logger.setLevel(logging.DEBUG)
         self.logger.propagate = True
@@ -398,16 +418,20 @@ class TestPackageLoggerIsolation(unittest.TestCase):
         self.server.PromptServer.instance.prompt_queue.task_done = lambda *a, **k: None
 
     def restore_logging(self):
-        for handler in self.logger.handlers:
-            if handler not in self.previous[0]:
-                handler.close()
-        self.handler.close()
+        # Detach before closing, so new records stop selecting these handlers.
+        retired = [h for h in self.logger.handlers if h not in self.previous[0]]
         (
             self.logger.handlers,
             self.logger.level,
             self.logger.propagate,
             self.logger.disabled,
         ) = self.previous
+        for handler in retired:
+            handler.close()
+        self.handler.close()
+
+    def assert_tmp_has_no_open_handles(self):
+        self.assertEqual(open_handles_under(self.tmp.name), [])
 
     def assert_logging_restored(self, handlers, registration):
         for key, module in self.saved_modules.items():
@@ -456,6 +480,49 @@ class TestPackageLoggerIsolation(unittest.TestCase):
         self.assertEqual(open_at_disposal, [True])
         self.assert_logging_restored(handlers, registration)
 
+    def test_record_in_flight_at_restore_cannot_reopen_prior_log(self):
+        """A record that selected prior.log before restore never reopens it.
+
+        Leaked daemon threads of other tests (image workers, watchdog) log
+        under ``prompt_manager.*``. One that reaches the prior handler while
+        restore_logging closes it would, with a plain FileHandler, reopen the
+        file on emit and keep it open through TemporaryDirectory.cleanup().
+        """
+        message = "record selected before restore_logging"
+        selected = threading.Event()
+        resume = threading.Event()
+        errors = []
+
+        def pause_before_handler_lock(record):
+            if record.getMessage() == message:
+                selected.set()
+                if not resume.wait(5):
+                    raise RuntimeError("logging thread was not released")
+            return True
+
+        def log_from_background_thread():
+            try:
+                logging.getLogger("prompt_manager.late_emitter").warning(message)
+            except BaseException as error:
+                errors.append(error)
+
+        self.handler.addFilter(pause_before_handler_lock)
+        worker = threading.Thread(target=log_from_background_thread, daemon=True)
+        worker.start()
+        try:
+            self.assertTrue(selected.wait(5), "record did not select prior.log")
+            self.restore_logging()
+            self.assertIsNone(self.handler.stream)
+        finally:
+            resume.set()
+            worker.join(5)
+        self.assertFalse(worker.is_alive(), "logging thread did not finish")
+        self.assertEqual(errors, [])
+        self.assertIsNone(self.handler.stream)
+        self.assert_tmp_has_no_open_handles()
+        with open(self.path, encoding="utf-8") as log:
+            self.assertNotIn(message, log.read())
+
     def test_failed_package_import_closes_handlers_and_restores_logging(self):
         name = "prompt_manager_pkg_logger_failure"
         captured = {}

tests/test_job_admission.py

@@ -0,0 +1,552 @@
+"""Registry admission classes and the legacy routes that hold the registry.
+
+Record-changing work never runs together (Activity design): a ``records``
+job is refused while any ``records`` or ``guarded`` job runs, a ``guarded``
+job (thumbnails) while a ``records`` job runs, and ``read`` jobs only share
+the one-per-kind rule. The legacy admin and gallery routes that change
+records or files take a registry hold for their duration, so a workspace job
+and a legacy-page operation refuse each other, naming the one that runs.
+
+Fake runners and gated executor calls only; ordering is driven by events.
+"""
+
+import asyncio
+import hashlib
+import json
+import os
+import sys
+import threading
+import unittest
+from pathlib import Path
+from unittest.mock import MagicMock, patch
+
+_mock_server = MagicMock()
+_mock_server.PromptServer.instance.routes = MagicMock()
+sys.modules.setdefault("server", _mock_server)
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+from py.api.jobs import (  # noqa: E402
+    ADMISSIONS,
+    Job,
+    JobBusy,
+    JobRegistry,
+)
+
+try:
+    from tests.test_api_admin import AdminAPITestCase  # noqa: E402
+except ImportError:  # discovered with tests/ as the top-level directory
+    from test_api_admin import AdminAPITestCase  # noqa: E402
+
+
+def _gated(gate):
+    async def runner(job):
+        await gate.wait()
+
+    return runner
+
+
+async def _noop(job):
+    return None
+
+
+class TestAdmissionClasses(unittest.IsolatedAsyncioTestCase):
+
+    def _start(self, registry, kind, admission, gate=None, **kwargs):
+        return registry.start(
+            kind,
+            kind.title(),
+            admission=admission,
+            scope={},
+            runner=_gated(gate) if gate is not None else _noop,
+            **kwargs,
+        )
+
+    async def test_admission_names_and_explicit_read(self):
+        self.assertEqual(ADMISSIONS, ("read", "guarded", "records"))
+        registry = JobRegistry()
+        job = registry.start(
+            "report", "Report", admission="read", scope={}, runner=_noop
+        )
+        await asyncio.wait_for(job.task, 2)
+        self.assertEqual(job.admission, "read")
+        self.assertFalse(job.record_changing)
+        with self.assertRaises(ValueError):
+            registry.start("x", "X", admission="exclusive", scope={}, runner=_noop)
+        with self.assertRaises(ValueError):
+            registry.start(
+                "x",
+                "X",
+                admission="read",
+                record_changing=True,
+                scope={},
+                runner=_noop,
+            )
+
+    async def test_start_requires_an_admission_class(self):
+        # A job that forgets its class must not silently run as "read" beside
+        # a scan or restore: every start call decides.
+        registry = JobRegistry()
+        with self.assertRaises(TypeError) as raised:
+            registry.start("review", "Review", scope={}, runner=_noop)
+        self.assertIn("admission", str(raised.exception))
+        self.assertEqual(registry.list(), [])
+        job = registry.start(
+            "review", "Review", record_changing=False, scope={}, runner=_noop
+        )
+        await asyncio.wait_for(job.task, 2)
+        self.assertEqual(job.admission, "read")
+
+    async def test_record_changing_is_an_alias_for_records(self):
+        registry = JobRegistry()
+        gate = asyncio.Event()
+        job = registry.start(
+            "scan", "Scan", record_changing=True, scope={}, runner=_gated(gate)
+        )
+        self.assertEqual(job.admission, "records")
+        self.assertTrue(job.record_changing)
+        self.assertEqual(job.summary()["admission"], "records")
+        self.assertIs(
+            registry.blocker("image-tags", record_changing=True), job
+        )  # the existing call shape keeps working
+        gate.set()
+        await asyncio.wait_for(job.task, 2)
+
+    async def test_records_job_refused_while_guarded_runs(self):
+        registry = JobRegistry()
+        gate = asyncio.Event()
+        thumbs = self._start(registry, "thumbnails", "guarded", gate)
+        with self.assertRaises(JobBusy) as raised:
+            self._start(registry, "scan", "records")
+        self.assertIs(raised.exception.running, thumbs)
+        self.assertIs(registry.blocker("restore", admission="records"), thumbs)
+        gate.set()
+        await asyncio.wait_for(thumbs.task, 2)
+        scan = self._start(registry, "scan", "records")
+        await asyncio.wait_for(scan.task, 2)
+        self.assertEqual(scan.state, "finished")
+
+    async def test_guarded_refused_while_records_runs(self):
+        registry = JobRegistry()
+        gate = asyncio.Event()
+        scan = self._start(registry, "scan", "records", gate)
+        with self.assertRaises(JobBusy) as raised:
+            self._start(registry, "thumbnails", "guarded")
+        self.assertIs(raised.exception.running, scan)
+        # A second guarded kind may run beside a guarded one, not beside records.
+        gate.set()
+        await asyncio.wait_for(scan.task, 2)
+        hold = asyncio.Event()
+        thumbs = self._start(registry, "thumbnails", "guarded", hold)
+        backup = self._start(registry, "backup", "guarded")
+        await asyncio.wait_for(backup.task, 2)
+        self.assertEqual(backup.state, "finished")
+        hold.set()
+        await asyncio.wait_for(thumbs.task, 2)
+
+    async def test_read_jobs_run_in_parallel(self):
+        registry = JobRegistry()
+        gate = asyncio.Event()
+        scan = self._start(registry, "scan", "records", gate)
+        health = self._start(registry, "health", "read", gate)
+        duplicates = self._start(registry, "duplicates", "read", gate)
+        self.assertTrue(all(j.running for j in (scan, health, duplicates)))
+        with self.assertRaises(JobBusy) as raised:  # one job of a kind
+            self._start(registry, "health", "read")
+        self.assertIs(raised.exception.running, health)
+        gate.set()
+        await asyncio.wait_for(
+            asyncio.gather(scan.task, health.task, duplicates.task), 2
+        )
+
+    async def test_non_cancellable_job_ignores_cancel(self):
+        registry = JobRegistry()
+        gate = asyncio.Event()
+        job = self._start(registry, "restore", "records", gate, cancellable=False)
+        self.assertIs(job.summary()["cancellable"], False)
+        self.assertFalse(registry.cancel(job.id))
+        self.assertFalse(job.cancelled)
+        gate.set()
+        await asyncio.wait_for(job.task, 2)
+        self.assertEqual(job.state, "finished")
+
+    async def test_hold_registers_a_running_non_cancellable_job(self):
+        registry = JobRegistry()
+        held = registry.hold(
+            "restore", "Database restore (admin page)", admission="records"
+        )
+        async with held as job:
+            self.assertIs(registry.active("restore"), job)
+            self.assertEqual(job.state, "running")
+            self.assertEqual(
+                (job.summary()["cancellable"], job.summary()["admission"]),
+                (False, "records"),
+            )
+            self.assertFalse(registry.cancel(job.id))
+            with self.assertRaises(JobBusy) as raised:
+                self._start(registry, "scan", "records")
+            self.assertIn("Database restore (admin page)", str(raised.exception))
+        self.assertEqual(job.state, "finished")
+        self.assertIsNone(registry.active("restore"))
+        self.assertIs(registry.list()[0], job)
+
+    async def test_hold_refused_without_waiting(self):
+        registry = JobRegistry()
+        gate = asyncio.Event()
+        scan = self._start(registry, "scan", "records", gate)
+        with self.assertRaises(JobBusy) as raised:
+            async with registry.hold("maintenance", "Maintenance", admission="records"):
+                self.fail("a refused hold must not run its body")
+        self.assertIs(raised.exception.running, scan)
+        self.assertEqual([j.kind for j in registry.list()], ["scan"])
+        gate.set()
+        await asyncio.wait_for(scan.task, 2)
+
+    async def test_hold_released_on_exception(self):
+        registry = JobRegistry()
+        with self.assertRaises(RuntimeError):
+            async with registry.hold(
+                "maintenance", "Maintenance", admission="records"
+            ) as job:
+                raise RuntimeError("boom")
+        self.assertEqual(job.state, "failed")
+        again = registry.hold("maintenance", "Maintenance", admission="records")
+        async with again as second:
+            second.finish("failed")  # the body may end it itself
+        self.assertEqual(second.state, "failed")
+
+    async def test_hold_admits_on_entry_not_at_the_call(self):
+        # A hold created but never entered (an await or an exception between
+        # the call and ``async with``) must not leave a running records job
+        # behind that blocks all record work until a restart.
+        registry = JobRegistry()
+        held = registry.hold("restore", "Restore", admission="records")
+        self.assertEqual(registry.list(), [])
+        self.assertIsNone(registry.blocker("scan", admission="records"))
+        del held
+        async with registry.hold("restore", "Restore", admission="records") as job:
+            self.assertIs(registry.active("restore"), job)
+        self.assertEqual(job.state, "finished")
+
+    def test_job_defaults_stay_read_and_cancellable(self):
+        job = Job("duplicates", "Duplicate scan")
+        self.assertEqual((job.admission, job.cancellable), ("read", True))
+
+
+class _LegacyHoldCase(AdminAPITestCase):
+    """The admin test app plus a running workspace job on demand."""
+
+    def _run_job(self, kind="scan", title="Scan for metadata", admission="records"):
+        gate = asyncio.Event()
+        job = self.api._jobs.start(
+            kind, title, admission=admission, scope={}, runner=_gated(gate)
+        )
+        self.addAsyncCleanup(self._release, gate, job)
+        return gate, job
+
+    @staticmethod
+    async def _release(gate, job):
+        gate.set()
+        await asyncio.wait_for(job.task, 5)
+
+    def _db_digest(self):
+        path = Path(self.api.db.model.db_path)
+        return {
+            suffix: hashlib.sha256(Path(f"{path}{suffix}").read_bytes()).hexdigest()
+            for suffix in ("", "-wal")
+            if Path(f"{path}{suffix}").exists()
+        }
+
+    async def _busy(self, resp, title="Scan for metadata"):
+        body = await resp.json()
+        self.assertEqual(resp.status, 409)
+        self.assertEqual(body, {"success": False, "error": f"{title} already running"})
+
+
+class TestLegacyRoutesHoldTheRegistry(_LegacyHoldCase):
+
+    async def test_hold_is_listed_as_running_job(self):
+        held = self.api._jobs.hold(
+            "restore", "Database restore (admin page)", admission="records"
+        )
+        async with held:
+            resp = await self.client.request("GET", "/prompt_manager/jobs")
+            jobs = (await resp.json())["jobs"]
+        self.assertEqual(len(jobs), 1)
+        job = jobs[0]
+        self.assertEqual(
+            (job["kind"], job["title"], job["state"]),
+            ("restore", "Database restore (admin page)", "running"),
+        )
+        self.assertIs(job["cancellable"], False)
+        self.assertEqual(job["admission"], "records")
+
+    async def test_legacy_maintenance_and_cleanup_refused_while_scan_runs(self):
+        self.api.db.save_prompt(text="keep me", prompt_hash="h1")
+        before = self._db_digest()
+        self._run_job()
+        resp = await self.client.request(
+            "POST",
+            "/prompt_manager/maintenance",
+            json={"operations": ["cleanup_duplicates", "vacuum"]},
+        )
+        await self._busy(resp)
+        resp = await self.client.request("POST", "/prompt_manager/cleanup")
+        await self._busy(resp)
+        self.assertEqual(self._db_digest(), before)
+
+    async def test_read_only_maintenance_runs_during_scan(self):
+        # The legacy statistics and consistency checks only read: they hold
+        # the registry as "read", so a long scan does not block them.
+        self.api.db.save_prompt(text="keep me", prompt_hash="h1")
+        _gate, scan = self._run_job()
+        listed = []
+        real = self.api._run_maintenance_operations
+
+        def observed(operations):
+            listed.extend(
+                (job.kind, job.admission, job.state) for job in self.api._jobs.list()
+            )
+            return real(operations)
+
+        self.api._run_maintenance_operations = observed
+        resp = await self.client.request(
+            "POST",
+            "/prompt_manager/maintenance",
+            json={
+                "operations": [
+                    "statistics",
+                    "check_consistency",
+                    "check_hash_duplicates",
+                ]
+            },
+        )
+        body = await resp.json()
+        self.assertEqual(resp.status, 200)
+        self.assertIs(body["success"], True)
+        self.assertEqual(
+            set(body["results"]),
+            {"statistics", "check_consistency", "check_hash_duplicates"},
+        )
+        self.assertIn(("maintenance", "read", "running"), listed)
+        self.assertEqual(scan.state, "running")
+        maintenance = self.api._jobs.list()[-1]
+        self.assertEqual(
+            (maintenance.kind, maintenance.admission, maintenance.state),
+            ("maintenance", "read", "finished"),
+        )
+
+    async def test_mixed_maintenance_selection_is_refused_during_scan(self):
+        # One write operation among read-only ones makes the run "records".
+        self.api.db.save_prompt(text="keep me", prompt_hash="h1")
+        before = self._db_digest()
+        self._run_job()
+        resp = await self.client.request(
+            "POST",
+            "/prompt_manager/maintenance",
+            json={"operations": ["statistics", "vacuum"]},
+        )
+        await self._busy(resp)
+        self.assertEqual(self._db_digest(), before)
+
+    async def test_default_maintenance_selection_is_refused_during_scan(self):
+        # No "operations" key means the default list, which vacuums.
+        self.api.db.save_prompt(text="keep me", prompt_hash="h1")
+        before = self._db_digest()
+        self._run_job()
+        resp = await self.client.request("POST", "/prompt_manager/maintenance", json={})
+        await self._busy(resp)
+        self.assertEqual(self._db_digest(), before)
+        self.assertEqual([j.kind for j in self.api._jobs.list()], ["scan"])
+
+    async def test_legacy_maintenance_refused_while_image_tags_runs(self):
+        self._run_job("image-tags", "Add tags to 3 images")
+        resp = await self.client.request("POST", "/prompt_manager/maintenance")
+        await self._busy(resp, "Add tags to 3 images")
+
+    async def test_scan_refused_while_legacy_maintenance_holds(self):
+        entered = threading.Event()
+        release = threading.Event()
+        real = self.api._run_maintenance_operations
+
+        def gated(operations):
+            entered.set()
+            release.wait(10)
+            return real(operations)
+
+        self.api._run_maintenance_operations = gated
+        loop = asyncio.get_running_loop()
+        maintenance = asyncio.ensure_future(
+            self.client.request(
+                "POST", "/prompt_manager/maintenance", json={"operations": ["vacuum"]}
+            )
+        )
+        self.assertTrue(await loop.run_in_executor(None, entered.wait, 10))
+        resp = await self.client.request("POST", "/prompt_manager/jobs/scan")
+        body = await resp.json()
+        self.assertEqual((resp.status, body["code"]), (409, "busy"))
+        self.assertEqual(body["running"]["title"], "Maintenance (admin page)")
+        release.set()
+        self.assertEqual((await maintenance).status, 200)
+        listed = (
+            await (await self.client.request("GET", "/prompt_manager/jobs")).json()
+        )["jobs"]
+        self.assertEqual(
+            [(j["kind"], j["state"]) for j in listed], [("maintenance", "finished")]
+        )
+
+    async def test_legacy_duplicate_delete_refused_while_scan_runs(self):
+        victim = self.output_dir / "dup.png"
+        victim.write_bytes(b"x")
+        self._run_job()
+        resp = await self.client.request(
+            "POST",
+            "/prompt_manager/delete_duplicate_images",
+            json={"image_paths": [str(victim)]},
+        )
+        await self._busy(resp)
+        self.assertTrue(victim.exists())
+        # The duplicate family lock was not taken by the refused request.
+        self.assertIsNotNone(self.api._acquire_long_job(self.api.LONG_JOB_DUPLICATES))
+
+    async def test_lora_scan_refused_while_scan_runs(self):
+        from py.config import IntegrationConfig
+
+        lm = Path(self.tmpdir) / "custom_nodes" / "ComfyUI-Lora-Manager"
+        (lm / "py").mkdir(parents=True)
+        self._run_job()
+        imported = []
+        with (
+            patch.multiple(
+                IntegrationConfig, LORA_MANAGER_ENABLED=True, LORA_MANAGER_PATH=str(lm)
+            ),
+            patch("py.lora_utils.resolve_lora_manager_path", return_value=str(lm)),
+            patch.object(
+                self.api, "_lora_scan_stream", side_effect=lambda *a: imported.append(a)
+            ),
+        ):
+            resp = await self.client.request("POST", "/prompt_manager/lora/scan")
+            text = await resp.text()
+        self.assertEqual(resp.status, 200)  # the legacy page reads a stream
+        events = [json.loads(line[6:]) for line in text.split("\n\n") if line]
+        # The admin page's modal shows ``status`` and closes on ``type: error``.
+        message = "Scan for metadata already running"
+        self.assertEqual(
+            events,
+            [{"type": "error", "status": message, "progress": 0, "message": message}],
+        )
+        self.assertEqual(imported, [])
+
+    async def test_legacy_autotag_refused_while_scan_runs(self):
+        # Both pages read this route as a stream (a 409 reads as a lost
+        # connection there), so a refusal by another job is one error frame:
+        # the admin page keys on ``type``, the gallery on ``status``.
+        self._run_job()
+        resp = await self.client.request(
+            "POST", "/prompt_manager/autotag/start", json={}
+        )
+        text = await resp.text()
+        self.assertEqual(resp.status, 200)
+        self.assertEqual(resp.headers["Content-Type"], "text/event-stream")
+        events = [json.loads(line[6:]) for line in text.split("\n\n") if line]
+        message = "Scan for metadata already running"
+        self.assertEqual(
+            events, [{"type": "error", "status": "error", "message": message}]
+        )
+        self.assertEqual(
+            [j.kind for j in self.api._jobs.list() if j.kind == "autotag"], []
+        )
+
+    async def test_second_legacy_autotag_batch_keeps_its_json_409(self):
+        from py.api.autotag_routes import _BUSY_ERROR
+
+        self._run_job("autotag", "Auto-tag images (legacy page)")
+        resp = await self.client.request(
+            "POST", "/prompt_manager/autotag/start", json={}
+        )
+        self.assertEqual(resp.status, 409)
+        self.assertEqual(await resp.json(), {"success": False, "error": _BUSY_ERROR})
+
+    async def test_legacy_payloads_unchanged_when_idle(self):
+        resp = await self.client.request(
+            "POST", "/prompt_manager/maintenance", json={"operations": ["vacuum"]}
+        )
+        body = await resp.json()
+        self.assertEqual(resp.status, 200)
+        self.assertEqual(
+            set(body),
+            {"success", "operations_completed", "all_successful", "results", "message"},
+        )
+        resp = await self.client.request("POST", "/prompt_manager/cleanup")
+        body = await resp.json()
+        self.assertEqual(resp.status, 200)
+        self.assertEqual(set(body), {"success", "message", "duplicates_removed"})
+        resp = await self.client.request(
+            "POST", "/prompt_manager/delete_duplicate_images", json={"image_paths": []}
+        )
+        self.assertEqual(
+            (resp.status, await resp.json()),
+            (400, {"success": False, "error": "No image paths provided"}),
+        )
+        # Each hold ended with the request; refused input never took one.
+        listed = await self._listed()
+        self.assertEqual(
+            [(j["kind"], j["state"]) for j in listed],
+            [("maintenance", "finished"), ("maintenance", "finished")],
+        )
+        self.assertEqual(
+            [j["title"] for j in listed],
+            ["Prompt cleanup (admin page)", "Maintenance (admin page)"],
+        )
+
+    async def _listed(self):
+        resp = await self.client.request("GET", "/prompt_manager/jobs")
+        return (await resp.json())["jobs"]
+
+
+class TestHeldJobStates(_LegacyHoldCase):
+    """Activity lists what a held legacy operation really did (Minor 7)."""
+
+    async def _listed(self):
+        resp = await self.client.request("GET", "/prompt_manager/jobs")
+        return [(j["kind"], j["state"]) for j in (await resp.json())["jobs"]]
+
+    async def test_refused_input_takes_no_hold(self):
+        resp = await self.client.request(
+            "POST", "/prompt_manager/delete_duplicate_images", json={}
+        )
+        self.assertEqual(resp.status, 400)
+        resp = await self.client.request(
+            "POST",
+            "/prompt_manager/images/generate-thumbnails",
+            data=b"{not json",
+            headers={"Content-Type": "application/json"},
+        )
+        self.assertEqual(resp.status, 400)
+        self.assertEqual(await self._listed(), [])
+
+    async def test_thumbnail_stream_that_ends_in_error_is_failed(self):
+        with patch.object(self.api, "_get_all_output_dirs", return_value=[]):
+            resp = await self.client.request(
+                "POST", "/prompt_manager/images/generate-thumbnails/progress"
+            )
+            text = await resp.text()
+        self.assertEqual(resp.status, 200)
+        self.assertIn("event: error", text)
+        self.assertEqual(await self._listed(), [("thumbnails", "failed")])
+
+    async def test_legacy_autotag_that_ends_in_error_is_failed(self):
+        service = MagicMock()
+        service.get_models_status.return_value = {}  # model not downloaded
+        with patch("py.autotag.get_autotag_service", return_value=service):
+            resp = await self.client.request(
+                "POST", "/prompt_manager/autotag/start", json={}
+            )
+            text = await resp.text()
+        self.assertEqual(resp.status, 200)
+        self.assertIn('"type": "error"', text)
+        self.assertEqual(await self._listed(), [("autotag", "failed")])
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_jobs.py

@@ -12,6 +12,7 @@ import unittest
 
 sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
 
+from py.api import jobs as jobs_module  # noqa: E402
 from py.api.jobs import (  # noqa: E402
     DEFAULT_SCAN_SCOPE,
     LOG_CAP_LINE,
@@ -181,8 +182,13 @@ class TestJobRegistry(unittest.IsolatedAsyncioTestCase):
                 "scope",
                 "listed",
                 "log_length",
+                "cancellable",
+                "admission",
             },
         )
+        self.assertEqual(
+            (summary["cancellable"], summary["admission"]), (True, "records")
+        )
         self.assertEqual(summary["scope"], {"files": "new", "output_folders": 2})
         # What the detail would list, so a view reads it only when that changed.
         self.assertEqual((summary["listed"], summary["log_length"]), ({}, 0))
@@ -415,6 +421,14 @@ class TestJobOutcomesAndLog(unittest.TestCase):
             SCAN_GROUP_NAMES, ("added", "known", "review", "no_metadata", "errors")
         )
 
+    def test_image_tag_job_kind_and_groups(self):
+        # #249 D1: bulk Add tags / Auto-tag, counter-tile order.
+        self.assertEqual(getattr(jobs_module, "IMAGE_TAG_JOB_KIND", None), "image-tags")
+        self.assertEqual(
+            getattr(jobs_module, "IMAGE_TAG_GROUP_NAMES", None),
+            ("tagged", "unchanged", "skipped", "errors"),
+        )
+
 
 if __name__ == "__main__":
     unittest.main()

tests/test_local_inspect_parity.py

@@ -51,12 +51,19 @@ from utils.prompt_inspector import (
     read_inspection_file,
 )
 
+from utils.prompt_inspector import inspect_prompt_evidence, unreadable_evidence
+from utils.prompt_pair_resolver import INSPECTION_PROFILE
+
 try:
     from tests import inspection_parity as parity
+    from tests import local_resolver_cases as resolver_cases
+    from tests import local_resolver_selection_cases as selection_cases
     from tests.open_handles import assert_closed
     from tests.test_utils_video_metadata import HAVE_FFMPEG, write_video
 except ImportError:  # pragma: no cover - discover -s tests puts tests/ first
     import inspection_parity as parity
+    import local_resolver_cases as resolver_cases
+    import local_resolver_selection_cases as selection_cases
     from open_handles import assert_closed
     from test_utils_video_metadata import HAVE_FFMPEG, write_video
 
@@ -1111,5 +1118,306 @@ class LocalProjectionParityTests(unittest.TestCase):
         self.assertTrue({"parsed", "malformed", "limited"} <= seen)
 
 
+def _server_evidence(records):
+    return inspect_prompt_evidence(records, None, profile=INSPECTION_PROFILE)
+
+
+class LocalResolverParityTests(unittest.TestCase):
+    """``resolveLocalEvidence`` answers as ``inspect_prompt_evidence`` (L3 Tasks 8-9).
+
+    Python is the oracle: every expected value is the server's own answer on the
+    same record texts. Task 8 ported one sampler's tracing; Task 9 ports
+    candidate selection (several samplers, the identical-branch rule of #270,
+    preview-only stages, detailer stages) and A1111 ``parameters``, so no
+    record set is left to the server any more.
+    """
+
+    def setUp(self):
+        temporary = tempfile.TemporaryDirectory()
+        self.addCleanup(temporary.cleanup)
+        self.addCleanup(assert_closed, self, temporary.name)
+        self.directory = Path(temporary.name)
+
+    def _compare(self, cases):
+        """Assert each record set's local evidence equal; return the server answers."""
+        observed = _run_oracle(
+            self,
+            [
+                {"name": name, "mode": "resolve", "records": records}
+                for name, records in cases.items()
+            ],
+        )
+        answers = {}
+        for name, records in cases.items():
+            with self.subTest(case=name):
+                local = observed[name]
+                server = _server_evidence(records)
+                answers[name] = server
+                self.assertEqual(
+                    _canonical_bytes(local["evidence"]), _canonical_bytes(server)
+                )
+        return answers
+
+    def test_local_roles_match_execution_and_single_chain_vectors(self):
+        files = {}
+        for name in parity.COMMITTED:
+            files[name] = parity.fixture_path(name)
+        for name in parity.TEST_TIME:
+            path = parity.fixture_path(name, self.directory)
+            parity.write_png(path, parity.build(name))
+            files[name] = path
+        observed = _run_oracle(
+            self,
+            [
+                {"name": name, "mode": "resolve", "path": str(path)}
+                for name, path in files.items()
+            ],
+        )
+        vectors = {
+            vector["fixture"]: vector
+            for vector in json.loads(parity.VECTORS_PATH.read_text(encoding="utf-8"))
+            if vector["profile"] == "inspection"
+        }
+        compared = 0
+        for name, path in files.items():
+            with self.subTest(fixture=name):
+                local = observed[name]
+                try:
+                    records = read_inspection_file(path).metadata
+                except MetadataReadError:
+                    self.assertTrue(local["unreadable"])
+                    continue
+                # The single-chain subset (Task 8); the rest is Task 9's test below.
+                if not resolver_cases.single_chain(records):
+                    continue
+                server = _server_evidence(records)
+                self.assertEqual(
+                    _canonical_bytes(local["evidence"]), _canonical_bytes(server)
+                )
+                # The committed vector agrees with the server read here.
+                expect = vectors[name]["expect"]
+                self.assertEqual(server["resolution"]["state"], expect["state"])
+                self.assertEqual(
+                    server["resolution"]["reason_code"], expect["reason_code"]
+                )
+                compared += 1
+        self.assertGreaterEqual(compared, 20)
+
+    def test_local_roles_match_inspection_vectors(self):
+        """Every inspection vector: local prompts, resolution and facts equal Images'.
+
+        The facts are ``extractGenerationFacts`` (with the legacy fill) on the
+        local payload, against the facts the committed vectors pin for the
+        server's response on the same file.
+        """
+        vectors = [
+            vector
+            for vector in json.loads(parity.VECTORS_PATH.read_text(encoding="utf-8"))
+            if vector["profile"] == "inspection"
+        ]
+        files = {}
+        for vector in vectors:
+            name = vector["fixture"]
+            if name in parity.TEST_TIME:
+                path = parity.fixture_path(name, self.directory)
+                parity.write_png(path, parity.build(name))
+            else:
+                path = parity.fixture_path(name)
+            files[name] = path
+        observed = _run_oracle(
+            self,
+            [
+                {"name": name, "mode": "resolve", "path": str(path)}
+                for name, path in files.items()
+            ],
+        )
+        for vector in vectors:
+            name = vector["fixture"]
+            with self.subTest(fixture=name):
+                local, expect = observed[name], vector["expect"]
+                try:
+                    server = _server_evidence(
+                        read_inspection_file(files[name]).metadata
+                    )
+                except MetadataReadError:
+                    server = unreadable_evidence()
+                    self.assertTrue(local["unreadable"])
+                self.assertEqual(
+                    _canonical_bytes(local["evidence"]), _canonical_bytes(server)
+                )
+                resolution, prompts = (
+                    local["evidence"]["resolution"],
+                    local["evidence"]["prompts"],
+                )
+                self.assertEqual(
+                    (
+                        resolution["state"],
+                        resolution["reason"],
+                        resolution["reason_code"],
+                    ),
+                    (expect["state"], expect["reason"], expect["reason_code"]),
+                )
+                self.assertEqual(
+                    [
+                        parity._role_text(
+                            prompts[role]["status"], prompts[role]["text"]
+                        )
+                        for role in ("positive", "negative")
+                    ],
+                    [expect["positive"], expect["negative"]],
+                )
+                self.assertEqual(local["facts"], expect["facts"])
+        self.assertEqual(len(vectors), 28)
+
+    def test_local_roles_match_selection_record_sets(self):
+        answers = self._compare(selection_cases.selection_cases())
+        reasons = {answer["resolution"]["reason"] for answer in answers.values()}
+        self.assertTrue(
+            {
+                "Every sampler branch uses the same prompt pair",
+                "Multiple sampler branches",
+                "Sampler stages have different prompts",
+                "Cyclic sampler stage ancestry",
+                "Expected an image link",
+                "Unsupported sampler stage ancestry",
+                "Resolution depth limit reached",
+                "A1111 settings footer is not unique",
+                "Multiple negative prompt delimiters",
+                "Negative prompt delimiter is absent",
+                "Parameters exceed the length limit",
+                "No A1111 parameters",
+            }
+            <= reasons
+        )
+        # A stage reaching only previews is dropped: one sampler is named.
+        self.assertEqual(
+            answers["select-preview-dropped"]["resolution"]["sampler_id"], "3"
+        )
+
+    def test_local_roles_match_fuzzed_selection_sets(self):
+        cases = {}
+        for seed in range(4):
+            cases.update(selection_cases.selection_fuzz_cases(seed, 150))
+        answers = self._compare(cases)
+        reasons = [answer["resolution"]["reason"] for answer in answers.values()]
+        self.assertGreater(reasons.count("Multiple sampler branches"), 20)
+        self.assertGreater(reasons.count("Sampler stages have different prompts"), 0)
+        self.assertGreater(
+            reasons.count("Every sampler branch uses the same prompt pair"), 0
+        )
+        self.assertGreater(reasons.count("A1111 settings footer is not unique"), 0)
+
+    def test_local_roles_match_golden_record_sets(self):
+        answers = self._compare(resolver_cases.golden_cases())
+        codes = {answer["resolution"]["reason_code"] for answer in answers.values()}
+        self.assertTrue(
+            {
+                "malformed",
+                "unsupported-node",
+                "runtime-value",
+                "composite",
+                "work-limit",
+                "depth-limit",
+                "text-limit",
+                "graph-ceiling",
+                "no-sampler",
+                None,
+            }
+            <= codes
+        )
+        sources = {
+            side["source"]
+            for answer in answers.values()
+            for side in answer["prompts"].values()
+        }
+        self.assertTrue(
+            {"execution", "graph-inferred", "zeroed-conditioning"} <= sources
+        )
+
+    def test_committed_resolver_vectors_are_current(self):
+        """The Node unit test's committed answers are still the server's."""
+        committed = json.loads(resolver_cases.VECTORS_PATH.read_text(encoding="utf-8"))
+        self.assertEqual(
+            committed,
+            json.loads(json.dumps(resolver_cases.committed_vectors())),
+            "regenerate with: python3 -m tests.local_resolver_cases --write",
+        )
+
+    def test_local_roles_match_at_every_work_bound(self):
+        answers = self._compare(resolver_cases.boundary_cases())
+        for name in ("visits", "depth", "scanned"):
+            self.assertEqual(answers[f"{name}-edge"]["resolution"]["state"], "resolved")
+            self.assertIn(
+                answers[f"{name}-over"]["resolution"]["reason_code"],
+                ("work-limit", "depth-limit"),
+            )
+        self.assertEqual(
+            answers["named-astral"]["resolution"]["node"]["class_type"],
+            "\U0001f600" * 64,
+        )
+
+    def test_local_json_depth_cap_at_its_boundary(self):
+        """Both kinds of deep record at the browser's JSON depth cap (1,000).
+
+        Locally a record nested past the cap is invalid JSON: a prompt is
+        malformed and a workflow is ignored, as the server answers when
+        ``json.loads`` raises RecursionError. The server's own limit depends on
+        the Python (TESTING.md, "Deep JSON"): about 990 on 3.10 and 3.11, so it
+        agrees past the cap there; about 10,000 on 3.12 and 3.13 and over
+        50,000 on 3.14, so it agrees up to the cap there and reads deeper.
+        """
+        cases = resolver_cases.depth_cases()
+        observed = _run_oracle(
+            self,
+            [
+                {"name": name, "mode": "resolve", "records": records}
+                for name, _kind, _depth, records in cases
+            ],
+        )
+        newer = sys.version_info >= (3, 12)
+        compared = 0
+        for name, kind, depth, records in cases:
+            with self.subTest(case=name):
+                local = observed[name]["evidence"]["resolution"]
+                within = depth <= resolver_cases.JSON_MAX_DEPTH
+                if kind == "prompt":
+                    expected = (
+                        ("resolved", None) if within else ("unresolved", "malformed")
+                    )
+                else:
+                    # A workflow that is read finds the overwritten pair (R1).
+                    expected = (
+                        ("unresolved", "malformed") if within else ("resolved", None)
+                    )
+                self.assertEqual((local["state"], local["reason_code"]), expected)
+                server = _server_evidence(records)
+                if server["resolution"]["state"] == local["state"]:
+                    self.assertEqual(
+                        _canonical_bytes(observed[name]["evidence"]),
+                        _canonical_bytes(server),
+                    )
+                    compared += 1
+                else:
+                    # The documented divergence only: an older server refuses
+                    # a little below the cap, a newer one reads past it.
+                    self.assertEqual(within, not newer)
+        self.assertGreaterEqual(compared, 2)
+
+    def test_local_roles_match_fuzzed_record_sets(self):
+        cases = {}
+        for seed in range(4):
+            cases.update(resolver_cases.fuzz_cases(seed, 150))
+        answers = self._compare(cases)
+        states = [answer["resolution"]["state"] for answer in answers.values()]
+        # Coherent graphs reach real results, not only early refusals.
+        self.assertGreater(states.count("resolved"), len(states) // 5)
+        self.assertGreater(states.count("ambiguous"), 0)
+        self.assertGreater(states.count("unresolved"), len(states) // 10)
+        self.assertGreaterEqual(
+            len({answer["resolution"]["reason_code"] for answer in answers.values()}),
+            5,
+        )
+
+
 if __name__ == "__main__":
     unittest.main()

tests/test_workspace_concept_fixture.py

@@ -1,7 +1,9 @@
 """The concept fixture files carry the concept inspector facts (app.js:400-414)."""
 
 import json
+import math
 import tempfile
+import time
 import unittest
 from pathlib import Path
 
@@ -15,6 +17,8 @@ except ImportError:  # discovered with tests/ as the top-level directory
 from tests.browser.workspace_concept_fixture import (
     CONCEPT_MODEL,
     CONCEPT_PROMPTS,
+    MAX_EPOCH_SECONDS,
+    _instant,
     write_concept_png,
 )
 from utils.prompt_inspector import inspect_prompt_evidence, read_inspection_file
@@ -80,5 +84,29 @@ class TestWorkspaceConceptFixture(unittest.TestCase):
             self.assertEqual((image["width"], image["height"]), size)
 
 
+class TestConceptFixtureInstant(unittest.TestCase):
+    """One "now" for every relative time the fixture writes (PR #284's midnight)."""
+
+    def test_a_chosen_instant_is_kept(self):
+        self.assertEqual(_instant(1_792_713_598), 1_792_713_598.0)
+        self.assertEqual(_instant(1_792_713_598.25), 1_792_713_598.25)
+
+    def test_the_wall_clock_when_omitted(self):
+        before = time.time()
+        now = _instant(None)
+        self.assertLessEqual(before, now)
+        self.assertLessEqual(now, time.time())
+
+    def test_a_non_number_is_refused(self):
+        for value in (True, "1792713598", [1]):
+            with self.subTest(value=value), self.assertRaises(TypeError):
+                _instant(value)
+
+    def test_an_instant_out_of_range_is_refused(self):
+        for value in (0, -1, MAX_EPOCH_SECONDS, math.inf, math.nan):
+            with self.subTest(value=value), self.assertRaises(ValueError):
+                _instant(value)
+
+
 if __name__ == "__main__":
     unittest.main()

tests/vendor/comfyui-config.test.mjs

@@ -22,7 +22,7 @@ test('execution script discovers only the new matrix and preserves all 78 origin
         'test', '--config', config, '--list'], { cwd: root, encoding: 'utf8',
         env: { ...process.env, PM_COMFY_ROOT: '/unused-pinned-checkout' } });
     const stock = list('tools/vendor/comfyui.config.mjs');
-    assert.match(stock, /Total: 80 tests in 7 files/);
+    assert.match(stock, /Total: 82 tests in 8 files/);  // + local Inspect host case (inspect-sender.spec.mjs, 2 projects)
     assert.doesNotMatch(stock, /execution-history/);
     assert.doesNotMatch(stock, /execution-outputs/);
     const executions = list('tools/vendor/playwright.execution.config.mjs');

tools/vendor/frontend-coverage-baseline.json

@@ -1,9 +1,9 @@
 {
   "admin.js": {
-    "lines": 28,
+    "lines": 31,
     "branches": 58,
-    "functions": 23,
-    "statements": 28
+    "functions": 26,
+    "statements": 31
   },
   "api-client.js": {
     "lines": 98,
@@ -42,10 +42,10 @@
     "statements": 98
   },
   "gallery.js": {
-    "lines": 39,
+    "lines": 40,
     "branches": 63,
-    "functions": 43,
-    "statements": 39
+    "functions": 44,
+    "statements": 40
   },
   "html-escape.js": {
     "lines": 98,
@@ -157,31 +157,31 @@
   },
   "workspace/activity-job-view.mjs": {
     "lines": 97,
-    "branches": 83,
+    "branches": 86,
     "functions": 98,
     "statements": 97
   },
   "workspace/activity-scan.mjs": {
-    "lines": 95,
-    "branches": 64,
+    "lines": 96,
+    "branches": 73,
     "functions": 98,
-    "statements": 95
+    "statements": 96
   },
   "workspace/activity-store.mjs": {
     "lines": 98,
-    "branches": 95,
+    "branches": 96,
     "functions": 98,
     "statements": 98
   },
   "workspace/activity.mjs": {
-    "lines": 95,
+    "lines": 96,
     "branches": 87,
     "functions": 98,
-    "statements": 95
+    "statements": 96
   },
   "workspace/file-inspector.mjs": {
     "lines": 96,
-    "branches": 92,
+    "branches": 93,
     "functions": 92,
     "statements": 96
   },
@@ -221,6 +221,18 @@
     "functions": 98,
     "statements": 98
   },
+  "workspace/image-tagging-state.mjs": {
+    "lines": 98,
+    "branches": 94,
+    "functions": 98,
+    "statements": 98
+  },
+  "workspace/image-tagging.mjs": {
+    "lines": 97,
+    "branches": 90,
+    "functions": 88,
+    "statements": 97
+  },
   "workspace/images-category.mjs": {
     "lines": 98,
     "branches": 98,
@@ -233,9 +245,15 @@
     "functions": 98,
     "statements": 98
   },
+  "workspace/images-favorites.mjs": {
+    "lines": 98,
+    "branches": 94,
+    "functions": 85,
+    "statements": 98
+  },
   "workspace/images-selection.mjs": {
     "lines": 98,
-    "branches": 92,
+    "branches": 93,
     "functions": 98,
     "statements": 98
   },
@@ -245,6 +263,24 @@
     "functions": 98,
     "statements": 98
   },
+  "workspace/images-tagging-bulk.mjs": {
+    "lines": 98,
+    "branches": 93,
+    "functions": 86,
+    "statements": 98
+  },
+  "workspace/images-tagging-review.mjs": {
+    "lines": 98,
+    "branches": 93,
+    "functions": 98,
+    "statements": 98
+  },
+  "workspace/images-tagging.mjs": {
+    "lines": 98,
+    "branches": 98,
+    "functions": 98,
+    "statements": 98
+  },
   "workspace/images.mjs": {
     "lines": 97,
     "branches": 89,
@@ -257,9 +293,15 @@
     "functions": 98,
     "statements": 98
   },
+  "workspace/inspect.mjs": {
+    "lines": 98,
+    "branches": 92,
+    "functions": 93,
+    "statements": 98
+  },
   "workspace/inspection-state.mjs": {
     "lines": 98,
-    "branches": 93,
+    "branches": 94,
     "functions": 98,
     "statements": 98
   },
@@ -295,7 +337,13 @@
   },
   "workspace/local-inspection.mjs": {
     "lines": 98,
-    "branches": 89,
+    "branches": 91,
+    "functions": 98,
+    "statements": 98
+  },
+  "workspace/local-parameters.mjs": {
+    "lines": 98,
+    "branches": 94,
     "functions": 98,
     "statements": 98
   },
@@ -305,6 +353,36 @@
     "functions": 98,
     "statements": 97
   },
+  "workspace/local-resolver-stages.mjs": {
+    "lines": 94,
+    "branches": 93,
+    "functions": 98,
+    "statements": 94
+  },
+  "workspace/local-resolver-support.mjs": {
+    "lines": 96,
+    "branches": 80,
+    "functions": 98,
+    "statements": 96
+  },
+  "workspace/local-resolver.mjs": {
+    "lines": 96,
+    "branches": 86,
+    "functions": 98,
+    "statements": 96
+  },
+  "workspace/local-semantics.mjs": {
+    "lines": 98,
+    "branches": 98,
+    "functions": 98,
+    "statements": 98
+  },
+  "workspace/local-session.mjs": {
+    "lines": 98,
+    "branches": 92,
+    "functions": 98,
+    "statements": 98
+  },
   "workspace/local-video.mjs": {
     "lines": 98,
     "branches": 94,
@@ -341,6 +419,12 @@
     "functions": 98,
     "statements": 98
   },
+  "workspace/py-json.mjs": {
+    "lines": 97,
+    "branches": 92,
+    "functions": 98,
+    "statements": 97
+  },
   "workspace/recorded-run.mjs": {
     "lines": 95,
     "branches": 83,

utils/prompt_inspector.py

@@ -20,6 +20,7 @@ from .prompt_pair_resolver import (
     _FOOTER,
     EMPTY_POSITIVE_REASON,
     INSPECTION_PROFILE,
+    MALFORMED_EVIDENCE_REASON,
     ResolverProfile,
     resolve_prompt_pair,
 )
@@ -548,7 +549,7 @@ def inspect_prompt_evidence(
     resolution = {
         "state": "unresolved",
         "sampler_id": None,
-        "reason": "Prompt evidence is malformed",
+        "reason": MALFORMED_EVIDENCE_REASON,
         "reason_code": "malformed",
         "node": None,
     }

utils/prompt_pair_resolver.py

@@ -1237,10 +1237,13 @@ class _GraphResolver:
 
     def non_file_outputs(self) -> set:
         names = self.semantics.non_file_outputs
+        # Only a string names a class: a list or object is never looked up (#286).
         return {
             node_id
             for node_id, node in self.graph.items()
-            if isinstance(node, dict) and node.get("class_type") in names
+            if isinstance(node, dict)
+            and isinstance(node.get("class_type"), str)
+            and node["class_type"] in names
         }
 
     def producers_of(self, starts: list, previews: set) -> set:
@@ -1832,6 +1835,8 @@ def _shared_pair(candidates: list) -> Optional[Dict[str, Any]]:
 
 # Bounds for walking a UI workflow's subgraph instances (R1 only).
 _MAX_SUBGRAPH_DEPTH = 8
+# The inspector's own line for evidence it cannot read (``inspect_prompt_evidence``).
+MALFORMED_EVIDENCE_REASON = "Prompt evidence is malformed"
 _MAX_WORKFLOW_NODES = 100_000
 
 
@@ -1862,7 +1867,9 @@ def _prompt_manager_widgets(workflow: Any) -> Dict[str, str]:
 
     Nodes inside a subgraph run as ``"<instance>:<inner>"`` API IDs (nested
     instances chain their IDs); a definition without an instance runs nothing.
-    The walk is bounded in depth and in nodes visited.
+    The walk is bounded in depth and in nodes visited. A node whose ``type`` is
+    a list or an object is skipped: it is neither a subgraph instance nor a
+    PromptManager node (#286).
     """
     nodes = workflow.get("nodes") if isinstance(workflow, dict) else None
     if not isinstance(nodes, list):
@@ -1882,6 +1889,9 @@ def _prompt_manager_widgets(workflow: Any) -> Dict[str, str]:
             if not isinstance(node_id, (str, int)) or isinstance(node_id, bool):
                 continue
             api_id = f"{prefix}{node_id}"
+            if isinstance(kind, (list, dict)):
+                # JSON's unhashable values are never a node type (#286).
+                continue
             if kind in subgraphs and depth < _MAX_SUBGRAPH_DEPTH:
                 stack.append((subgraphs[kind], api_id + ":", depth + 1))
                 continue

web/js/admin.js

@@ -25,8 +25,10 @@
                 this.tagsPage = null;
 
                 this.api = ApiClient.createApiClient();
-                // Search and page loads share one guard: whichever list request is newest wins
-                this.listRequest = ApiClient.latestOnly();
+                // The page's lifetime ends when it starts to leave. WebKit cancels the page's reads
+                // between beforeunload and pagehide; a save's follow-up read started then fails and is
+                // logged as a page error ("Fetch API cannot load … due to access control checks.").
+                this.startPageLifetime();
                 this.infiniteScroll = false; // session value; seeded from settings, toggled in the header
                 this.infiniteScrollChosen = false;
                 this.loadingMore = false;
@@ -150,7 +152,18 @@
                 // Output scan: a server-side job that survives modal dismissal and reloads
                 this.scanState = ScanProgress.initialState();
                 this.scanSource = null;
-                window.addEventListener("beforeunload", (e) => this.warnIfScanRunning(e));
+                window.addEventListener("beforeunload", (e) => {
+                    this.warnIfScanRunning(e);
+                    // A page that asks to stay (a running scan) keeps its reads until it really goes.
+                    if (!e.defaultPrevented) this.pageLifetime.abort();
+                });
+                window.addEventListener("pagehide", () => this.pageLifetime.abort());
+                // A page restored from the back/forward cache lives again, and so does one whose
+                // navigation never left (stopped, or answered with a download): its next input revives it.
+                window.addEventListener("pageshow", (e) => { if (e.persisted) this.revivePageLifetime(); });
+                for (const type of ["pointerdown", "keydown"]) {
+                    window.addEventListener(type, () => this.revivePageLifetime(), true);
+                }
 
                 this.bindModalEvents();
 
@@ -319,9 +332,24 @@
                 }
             }
 
+            /** A new lifetime once the old one has ended; a living page keeps its list guard. */
+            revivePageLifetime() {
+                if (this.pageLifetime.signal.aborted) this.startPageLifetime();
+            }
+
+            /** A fresh page lifetime, and the list guard bound to it. */
+            startPageLifetime() {
+                this.pageLifetime = new AbortController();
+                // Search and page loads share one guard: whichever list request is newest wins
+                this.listRequest = ApiClient.latestOnly({ lifetime: this.pageLifetime.signal });
+            }
+
             async loadStatistics() {
+                // A leaving page starts no read; one in flight is aborted with the page and not reported.
+                const { signal } = this.pageLifetime;
+                if (signal.aborted) return;
                 try {
-                    const response = await ApiClient.fetchUrl("/prompt_manager/stats");
+                    const response = await ApiClient.fetchUrl("/prompt_manager/stats", { signal });
                     if (response.ok) {
                         const data = await response.json();
                         
@@ -340,6 +368,7 @@
                         console.error("Stats API HTTP error:", response.status, response.statusText);
                     }
                 } catch (error) {
+                    if (signal.aborted) return;
                     console.error("Stats error:", error);
                     // Set some default values if API fails
                     document.getElementById("totalPrompts").textContent = this.prompts.length || 0;
@@ -1151,6 +1180,11 @@
                                         `Done — ${data.imported} imported, ${data.skipped} skipped`;
                                     this.loadStatistics();
                                     setTimeout(() => this.hideModal("loraImportModal"), 2000);
+                                } else if (data.type === "error") {
+                                    // A refusal (another job runs) or a failed import: name it and close the modal.
+                                    document.getElementById("loraImportStatus").textContent = `Error: ${data.message}`;
+                                    this.showNotification(`LoRA import failed: ${data.message}`, "error");
+                                    setTimeout(() => this.hideModal("loraImportModal"), 3000);
                                 }
                             } catch (e) { /* skip malformed SSE */ }
                         }
@@ -1202,10 +1236,13 @@
                         }
                         this.hideModal("settingsModal");
                     } else {
-                        throw new Error("Failed to save settings");
+                        // A refusal names its reason (a corrupt config.json, a changed file): show it.
+                        const data = await response.json().catch(() => ({}));
+                        throw new Error(data.error ? `Failed to save settings: ${data.error}` : "Failed to save settings");
                     }
                 } catch (error) {
-                    this.showNotification("Failed to save settings", "error");
+                    const reason = error.message.startsWith("Failed to save settings:") ? error.message : "Failed to save settings";
+                    this.showNotification(reason, "error");
                 }
             }
 
@@ -1819,7 +1856,9 @@
                             throw new Error(data.error || 'Maintenance failed');
                         }
                     } else {
-                        throw new Error(`HTTP ${response.status}: ${response.statusText}`);
+                        // A refusal names the job that runs ("Scan for metadata already running").
+                        const data = await response.json().catch(() => ({}));
+                        throw new Error(data.error || `HTTP ${response.status}: ${response.statusText}`);
                     }
                 } catch (error) {
                     console.error('Maintenance error:', error);

web/js/api-client.js

@@ -15,7 +15,7 @@
     "use strict";
 
     class ApiError extends Error {
-        constructor(status, message, code = null, recovery = null) {
+        constructor(status, message, code = null, recovery = null, current = null) {
             super(message);
             this.name = "ApiError";
             this.status = status;
@@ -32,6 +32,14 @@
                     this.recovery = { action: "smaller-limit", limit: recovery.limit };
                 }
             }
+            // A tag-conflict answer carries the image's current tag set; only a
+            // well-formed one is kept, copied, so the dialog can show it.
+            this.current = null;
+            if (current && Array.isArray(current.tags) && current.tags.length <= 100 &&
+                current.tags.every(tag => typeof tag === "string") &&
+                Number.isSafeInteger(current.tag_revision) && current.tag_revision >= 0) {
+                this.current = { tags: current.tags.slice(), tag_revision: current.tag_revision };
+            }
         }
     }
 
@@ -56,9 +64,11 @@
     function createApiClient(fetchImpl) {
         const doFetch = fetchImpl || ((...args) => globalThis.fetch(...args));
 
-        async function request(method, url, { body, signal, cache } = {}) {
+        async function request(method, url, { body, signal, cache, keepalive } = {}) {
             const init = { method, headers: {} };
             if (cache !== undefined) init.cache = cache;
+            // keepalive lets a write or a release finish while its page unloads (pagehide).
+            if (keepalive) init.keepalive = true;
             if (body !== undefined) {
                 init.headers["Content-Type"] = "application/json";
                 init.body = JSON.stringify(body);
@@ -76,11 +86,11 @@
 
             const serverMessage = data && typeof data === "object" ? data.error || data.message : undefined;
             if (!response.ok) {
-                throw new ApiError(response.status, serverMessage || response.statusText || `HTTP ${response.status}`, data?.code, data?.recovery);
+                throw new ApiError(response.status, serverMessage || response.statusText || `HTTP ${response.status}`, data?.code, data?.recovery, data);
             }
             if (!parsed) throw new ApiError(response.status, "Invalid JSON response");
             if (data && typeof data === "object" && data.success === false) {
-                throw new ApiError(response.status, serverMessage || "Request failed", data.code, data.recovery);
+                throw new ApiError(response.status, serverMessage || "Request failed", data.code, data.recovery, data);
             }
             return data;
         }
@@ -88,29 +98,37 @@
         return {
             // cache is a fetch RequestCache mode such as "no-store"; omitted keeps the default.
             get: (url, { signal, cache } = {}) => request("GET", url, { signal, cache }),
-            post: (url, body, { signal } = {}) => request("POST", url, { body, signal }),
-            put: (url, body, { signal } = {}) => request("PUT", url, { body, signal }),
+            post: (url, body, { signal, keepalive } = {}) => request("POST", url, { body, signal, keepalive }),
+            put: (url, body, { signal, keepalive } = {}) => request("PUT", url, { body, signal, keepalive }),
             patch: (url, body, { signal } = {}) => request("PATCH", url, { body, signal }),
             // A DELETE body is optional; the favorites store names its file in one.
-            del: (url, { signal, body } = {}) => request("DELETE", url, { body, signal }),
+            del: (url, { signal, body, keepalive } = {}) => request("DELETE", url, { body, signal, keepalive }),
         };
     }
 
     /**
+     * @param {{lifetime?: AbortSignal}} [options] - `lifetime` ends with the page (its pagehide):
+     *   then no call starts a request, the one in flight is aborted, and both resolve to STALE.
+     *   WebKit fails a fetch that a leaving page starts and logs it as a page error.
      * @returns {(run: (signal: AbortSignal) => Promise<*>) => Promise<*>} wrapper that
      *   aborts the previous call's signal and resolves superseded calls to STALE
      */
-    function latestOnly() {
+    function latestOnly({ lifetime } = {}) {
         let current = null;
+        lifetime?.addEventListener("abort", () => current?.abort(), { once: true });
         return async function (run) {
             if (current) current.abort();
+            if (lifetime?.aborted) {
+                current = null;
+                return STALE;
+            }
             const controller = new AbortController();
             current = controller;
             try {
                 const result = await run(controller.signal);
-                return controller === current ? result : STALE;
+                return controller === current && !lifetime?.aborted ? result : STALE;
             } catch (error) {
-                if (controller !== current) return STALE;
+                if (controller !== current || lifetime?.aborted) return STALE;
                 throw error;
             }
         };

web/js/gallery.js

@@ -17,6 +17,14 @@
                 this.dupResults = null;
 
                 this.api = ApiClient.createApiClient();
+                // The page's lifetime ends when it starts to leave: WebKit fails a fetch a leaving page starts
+                // ("Fetch API cannot load … due to access control checks.") and logs it as a page error.
+                this.pageLifetime = new AbortController();
+                window.addEventListener("beforeunload", () => this.pageLifetime.abort());
+                window.addEventListener("pagehide", () => this.pageLifetime.abort());
+                window.addEventListener("pageshow", (e) => {
+                    if (e.persisted && this.pageLifetime.signal.aborted) this.pageLifetime = new AbortController();
+                });
                 // Only the newest page request may update the grid
                 this.imagesRequest = ApiClient.latestOnly();
 
@@ -2129,8 +2137,11 @@ Seed: ${this.currentMetadata.seed || 'Unknown'}`;
                                 headers: { 'Content-Type': 'application/json' }
                             });
                             
-                            if (response.ok) {
-                                const data = await response.json();
+                            if (!response.ok) {
+                                // Refused (a running job holds the thumbnails): say why and claim nothing.
+                                const data = await response.json().catch(() => ({}));
+                                this.showNotification(`Thumbnails were not cleared: ${data.error || `HTTP ${response.status}`}`, 'error');
+                                return;
                             }
                         } catch (e) {
                             console.warn('Could not clear server thumbnails:', e);
@@ -2531,8 +2542,11 @@ Seed: ${this.currentMetadata.seed || 'Unknown'}`;
                         return;
                     }
                     
+                    // A leaving page starts no read, and one it aborts is not reported.
+                    const signal = this.pageLifetime?.signal;
+                    if (signal?.aborted) return;
                     try {
-                        const data = await this.api.get('/prompt_manager/images/thumbnails/status');
+                        const data = await this.api.get('/prompt_manager/images/thumbnails/status', { signal });
                         const total = data.total_images;
                         const pending = data.pending;
                         if (!data.success || !Number.isSafeInteger(total) ||

web/js/workspace/activity-job-view.mjs

@@ -11,6 +11,9 @@
  *   filter, and the selected outcome's listed rows (at most 200 per outcome, so "Showing N of M"). Rows under Added and
  *   Already known open the file in the existing viewer through its listing identity (D57); the others are plain text.
  * - Log: `details.term` "Scan log", collapsed, holding the raw timestamped lines in `pre[tabindex=0]`.
+ * - D89: the tiles, the outcome list, the openable rows and the log and cancel labels are the job kind's (`jobView`):
+ *   an image tagging job shows Tagged, Unchanged, Skipped and Errors, opens Tagged and Unchanged rows, and reads
+ *   "Tagging log" and "Cancel tagging"; another kind keeps the scan's tiles as "Job log" and "Cancel job".
  *
  * The summary follows the Activity store (one SSE stream per running job); the listed rows and the log are read from
  * `GET /prompt_manager/jobs/<id>` at most once a second while the job runs, and once more when it ends.
@@ -19,7 +22,7 @@ import { createButton } from '../shared/toolkit/core.js';
 import { pageHeading } from './heading.mjs';
 import { showWorkspaceToast } from './toast.mjs';
 import { noun } from './plural.mjs';
-import { parseJob, JOBS_URL, LOST_DETAIL } from './activity-store.mjs';
+import { parseJob, jobView, JOB_VIEWS, JOBS_URL, LOST_DETAIL } from './activity-store.mjs';
 import { jobDetail, CANCEL_FAILED_TOAST } from './activity.mjs';
 import { downloadJobReport } from './activity-scan.mjs';
 import { createMediaViewer } from './media-viewer.mjs';
@@ -36,18 +39,6 @@ export const FILE_GONE = 'This file is no longer in Images. Rescan from Import a
 export const OPEN_FAILED = 'The file could not be opened. Try again.';
 const LISTING_LIMIT = 5;
 
-/** The counter tiles, in the spec's order and the mockup's tones. */
-export const TILES = Object.freeze([
-    ['added', 'Added to Library', 'added'], ['known', 'Already known', ''], ['review', 'Needs review', 'warn'],
-    ['no_metadata', 'No usable metadata', ''], ['errors', 'Errors', 'bad'],
-]);
-/** The outcome list, in the mockup's order: what got added and what went wrong first. */
-export const OUTCOMES = Object.freeze([
-    ['added', 'Added to Library'], ['review', 'Needs review'], ['errors', 'Errors'],
-    ['no_metadata', 'No usable metadata'], ['known', 'Already known'],
-]);
-const OPENABLE = new Set(['added', 'known']);
-
 function element(tag, text, className) {
     const node = document.createElement(tag);
     if (text !== undefined) node.textContent = text;
@@ -103,9 +94,9 @@ export function filterRows(rows, filter) {
     return rows.filter(row => `${row.root}/${row.path}`.toLocaleLowerCase().includes(wanted));
 }
 
-/** The first outcome with files, so a view opens on what happened; Added when nothing has yet. */
-export function defaultOutcome(counters) {
-    return OUTCOMES.find(([group]) => (counters[group] ?? 0) > 0)?.[0] ?? 'added';
+/** The first outcome with files, so a view opens on what happened; the first outcome when nothing has yet. */
+export function defaultOutcome(counters, outcomes = JOB_VIEWS.scan.outcomes) {
+    return (outcomes.find(([group]) => (counters[group] ?? 0) > 0) ?? outcomes[0])[0];
 }
 
 function section(title, id) {
@@ -132,13 +123,6 @@ export function mountActivityJobView(main, { store, scope, api, jobId }) {
     bar.max = 100;
     const stats = element('dl', undefined, 'stat-row');
     const tileValues = new Map();
-    for (const [group, label, tone] of TILES) {
-        const tile = element('div', undefined, tone ? `stat ${tone}` : 'stat');
-        const value = element('dd', '0');
-        tile.append(element('dt', label), value);
-        tileValues.set(group, value);
-        stats.append(tile);
-    }
     progressPart.node.append(bar, stats);
 
     const resultsPart = section('Results', 'job-results-title');
@@ -155,15 +139,6 @@ export function mountActivityJobView(main, { store, scope, api, jobId }) {
     list.setAttribute('aria-label', 'Outcomes');
     const files = element('div', undefined, 'outcome-files');
     const buttons = new Map();
-    for (const [group, label] of OUTCOMES) {
-        const button = createButton('');
-        const count = element('span', '0');
-        button.append(element('span', label), count);
-        button.setAttribute('aria-pressed', 'false');
-        button.count = count;
-        buttons.set(group, button);
-        list.append(button);
-    }
     outcomes.append(list, files);
     resultsPart.node.append(outcomes);
 
@@ -181,6 +156,8 @@ export function mountActivityJobView(main, { store, scope, api, jobId }) {
     missing.append(element('p', NOT_FOUND, 'empty-state'), back);
 
     let detail = null;
+    // The job's kind decides its tiles, outcomes and labels (D89); it is known once the job is.
+    let view = null;
     let selected = null;
     let mounted = false;
     let lastRead = 0;
@@ -200,13 +177,35 @@ export function mountActivityJobView(main, { store, scope, api, jobId }) {
     const viewer = createMediaViewer({ api, container: main, parentScope: scope, inspectionController: inspection,
         sender: createPromptSender({ scope }), onSelect: image => inspection.select(image) });
 
+    /** The tiles and the outcome list of the job's kind, built once. */
+    function layout(kind) {
+        view = jobView(kind); // D89
+        for (const [group, label, tone] of view.tiles) {
+            const tile = element('div', undefined, tone ? `stat ${tone}` : 'stat');
+            const value = element('dd', '0');
+            tile.append(element('dt', label), value);
+            tileValues.set(group, value);
+            stats.append(tile);
+        }
+        for (const [group, label] of view.outcomes) {
+            const button = createButton('');
+            const count = element('span', '0');
+            button.append(element('span', label), count);
+            button.setAttribute('aria-pressed', 'false');
+            button.count = count;
+            buttons.set(group, button);
+            list.append(button);
+        }
+    }
+
     function showBody(job) {
         if (mounted) return;
         mounted = true;
+        if (!view) layout(job.kind);
         missing.remove();
         parts.actions.append(download, cancel);
         main.append(progressPart.node, resultsPart.node, log);
-        selected ??= defaultOutcome(job.counters);
+        selected ??= defaultOutcome(job.counters, view.outcomes);
     }
 
     /** The job is not (or no longer) in this session: say so instead of an empty view. */
@@ -242,7 +241,7 @@ export function mountActivityJobView(main, { store, scope, api, jobId }) {
 
     function renderRows(job) {
         const rows = detail?.outcomes[selected] ?? [];
-        const openable = OPENABLE.has(selected);
+        const openable = view.openable.has(selected);
         const wanted = filterRows(rows.map((row, index) => ({ ...row, index })), input.value);
         const kept = new Map(wanted.map(row => rowNode(row, row.index, openable)));
         rowNodes = kept;
@@ -270,12 +269,13 @@ export function mountActivityJobView(main, { store, scope, api, jobId }) {
         parts.h1.textContent = job.title;
         document.title = `${job.title} · Prompt Manager`;
         parts.description.textContent = jobDetail(job);
-        cancel.textContent = scan ? 'Cancel scan' : 'Cancel job';
+        cancel.textContent = view.cancel;
         // A job lost with the server has no report there (review M9).
         const lost = job.state === 'lost';
         if (lost && document.activeElement === download) parts.h1.focus();
         download.disabled = lost;
-        if (job.state === 'running') {
+        // Truth rule: a job that cannot be cancelled (a held legacy-page job) shows no Cancel.
+        if (job.state === 'running' && job.cancellable) {
             if (!cancel.isConnected) parts.actions.append(cancel);
         } else if (cancel.isConnected) {
             // A focused Cancel that goes away hands its focus to the job's heading, never to the page body.
@@ -291,7 +291,7 @@ export function mountActivityJobView(main, { store, scope, api, jobId }) {
             button.count.textContent = number(job.counters[group] ?? 0);
             button.setAttribute('aria-pressed', String(group === selected));
         }
-        logLabel.textContent = `● ${scan ? 'Scan' : 'Job'} log`;
+        logLabel.textContent = `● ${view.log}`;
         const text = detail?.log.length ? detail.log.join('\n') : 'No log lines yet.';
         if (pre.textContent !== text) {
             // Replacing the text clamps the scroll position, so keep it: pinned readers follow the end, others stay.

web/js/workspace/activity-store.mjs

@@ -23,10 +23,52 @@ export const LOST_DETAIL = 'This job ended when ComfyUI restarted.';
 const SERVER_STATES = new Set(['running', 'finished', 'cancelled', 'failed']);
 const FINAL_STATES = new Set(['finished', 'cancelled', 'failed']);
 const JOB_ID = /^[0-9a-f]{32}$/;
-// The pill's verb for each job kind; a kind without one shows its title.
-const PILL_VERBS = Object.freeze({ scan: 'Scanning' });
+// The pill's verb for each job kind; a kind without one shows its title (D89: image tagging jobs read "Tagging").
+const PILL_VERBS = Object.freeze({ scan: 'Scanning', 'image-tags': 'Tagging' });
 const START_TOASTS = Object.freeze({ scan: 'Scan started.' });
 
+/** The scan's job view (D56): its counter tiles `[group, label, tone]` and outcome list in the mockup's orders. */
+const SCAN_VIEW = Object.freeze({
+    tiles: Object.freeze([
+        ['added', 'Added to Library', 'added'], ['known', 'Already known', ''], ['review', 'Needs review', 'warn'],
+        ['no_metadata', 'No usable metadata', ''], ['errors', 'Errors', 'bad'],
+    ].map(Object.freeze)),
+    // What got added and what went wrong first.
+    outcomes: Object.freeze([
+        ['added', 'Added to Library'], ['review', 'Needs review'], ['errors', 'Errors'],
+        ['no_metadata', 'No usable metadata'], ['known', 'Already known'],
+    ].map(Object.freeze)),
+    // Rows that open the file in the viewer (D57); the others are plain text.
+    openable: Object.freeze(new Set(['added', 'known'])),
+    log: 'Scan log',
+    cancel: 'Cancel scan',
+});
+
+/**
+ * Each job kind's view: its tiles, outcome list, openable rows, log label and cancel label. D89: an image tagging job
+ * (`image-tags`) counts Tagged (green), Unchanged, Skipped (warning) and Errors (red), lists what got tagged and what
+ * went wrong first, and opens Tagged and Unchanged rows in the viewer like the scan's (D57).
+ */
+export const JOB_VIEWS = Object.freeze({
+    scan: SCAN_VIEW,
+    'image-tags': Object.freeze({
+        tiles: Object.freeze([['tagged', 'Tagged', 'added'], ['unchanged', 'Unchanged', ''], ['skipped', 'Skipped', 'warn'],
+            ['errors', 'Errors', 'bad']].map(Object.freeze)),
+        outcomes: Object.freeze([['tagged', 'Tagged'], ['errors', 'Errors'], ['skipped', 'Skipped'],
+            ['unchanged', 'Unchanged']].map(Object.freeze)),
+        openable: Object.freeze(new Set(['tagged', 'unchanged'])),
+        log: 'Tagging log',
+        cancel: 'Cancel tagging',
+    }),
+});
+// Another kind keeps the scan's tiles and outcomes under the generic labels.
+const GENERIC_VIEW = Object.freeze({ ...SCAN_VIEW, log: 'Job log', cancel: 'Cancel job' });
+
+/** The view of a job `kind`; an unknown kind gets the generic one. */
+export function jobView(kind) {
+    return Object.hasOwn(JOB_VIEWS, kind) ? JOB_VIEWS[kind] : GENERIC_VIEW;
+}
+
 /** The wait before the `attempt`-th re-read (0-based): 1 s, 2 s, 4 s … never more than 30 s. */
 export function backoffDelay(attempt) {
     const step = Number.isSafeInteger(attempt) && attempt > 0 ? Math.min(attempt, 16) : 0;
@@ -61,6 +103,8 @@ export function parseJob(raw) {
         scope: plainObject(raw.scope) ? { ...raw.scope } : {},
         listed,
         log_length: count(raw.log_length),
+        // A held legacy-page job cannot be cancelled; an older server sends no key (cancellable then).
+        cancellable: raw.cancellable !== false,
     };
 }
 
@@ -70,20 +114,31 @@ const errorsOf = job => `${number(job.counters.errors ?? 0)} ${noun(job.counters
 /** "1,420 added". */
 export const addedOf = job => `${number(job.counters.added ?? 0)} added`;
 
-/** The toast when a job ends: "Scan finished · N added · M errors", "Scan cancelled · N added". */
+/**
+ * The toast when a job ends: "Scan finished · N added · M errors", "Scan cancelled · N added"; an image tagging job
+ * the same way with its own title and count (D89): "Auto-tag images finished · N tagged · M errors".
+ */
 export function finishToast(job) {
     if (job.kind === 'scan') {
         if (job.state === 'cancelled') return `Scan cancelled · ${addedOf(job)}`;
         if (job.state === 'failed') return `Scan failed · ${addedOf(job)} · ${errorsOf(job)}`;
         return `Scan finished · ${addedOf(job)} · ${errorsOf(job)}`;
     }
+    if (job.kind === 'image-tags') {
+        if (job.state === 'cancelled') return `${job.title} cancelled · ${taggedOf(job)}`;
+        return `${job.title} ${job.state === 'failed' ? 'failed' : 'finished'} · ${outcomeLine(job)}`;
+    }
     if (job.state === 'cancelled') return `${job.title} was cancelled.`;
     if (job.state === 'failed') return `${job.title} failed.`;
     return `${job.title} finished.`;
 }
 
+// D85: an image tagging job says which of its two modes started.
+const IMAGE_TAG_START_TOASTS = Object.freeze({ add: 'Tagging started.', auto: 'Auto-tagging started.' });
+
 /** The toast after this tab starts a job. */
 export function startToast(job) {
+    if (job.kind === 'image-tags' && IMAGE_TAG_START_TOASTS[job.scope.mode]) return IMAGE_TAG_START_TOASTS[job.scope.mode];
     return START_TOASTS[job.kind] ?? `${job.title} started.`;
 }
 
@@ -94,9 +149,14 @@ export function pillParts(job) {
     return { label, files, text: label + files };
 }
 
-/** The scan's counters as one line: "N added · M errors"; other kinds have none yet. */
+/** "12 tagged" (D89). */
+export const taggedOf = job => `${number(job.counters.tagged ?? 0)} tagged`;
+
+/** The counters as one line: "N added · M errors" for a scan, "N tagged · M errors" for image tagging (D89). */
 export function outcomeLine(job) {
-    return job.kind === 'scan' ? `${addedOf(job)} · ${errorsOf(job)}` : '';
+    if (job.kind === 'scan') return `${addedOf(job)} · ${errorsOf(job)}`;
+    if (job.kind === 'image-tags') return `${taggedOf(job)} · ${errorsOf(job)}`;
+    return '';
 }
 
 function defaultConnect(url) {

web/js/workspace/activity.mjs

@@ -11,13 +11,14 @@
  * - D54: each `.activity-item` is a real job. Its chip names the state (green "Completed", or blue "Running",
  *   "Cancelled", "Failed", "Ended"), its line says when and what, and a running job shows its `<progress>` and
  *   "Cancel job" (no "Simulate completion").
+ * - D89: an image tagging job's line names its images and, once ended, "N tagged · M errors".
  */
 import { createButton } from '../shared/toolkit/core.js';
 import { navigateTo } from './state.mjs';
 import { pageHeading } from './heading.mjs';
 import { showWorkspaceToast } from './toast.mjs';
-import { countOf } from './plural.mjs';
-import { pillParts, outcomeLine, addedOf, LOST_DETAIL } from './activity-store.mjs';
+import { countOf, noun } from './plural.mjs';
+import { pillParts, outcomeLine, addedOf, taggedOf, LOST_DETAIL } from './activity-store.mjs';
 
 export const ACTIVITY_DESCRIPTION = 'Scans, tagging, downloads and maintenance share one history.';
 export const EMPTY_ACTIVITY = 'No jobs have run since ComfyUI started. Scans and other long operations appear here.';
@@ -44,12 +45,21 @@ export function clockTime(seconds) {
 
 const join = parts => parts.filter(Boolean).join(' · ');
 
-/** What a job covers: "2 output folders" for a scan. */
+const whole = value => Number.isSafeInteger(value) && value >= 0;
+
+/** What a job covers: "2 output folders" for a scan, "4 images" for image tagging (D89). */
 function scopeLine(job) {
+    // D89: grouped as the server writes its lines ("19,622 images").
+    const images = job.scope?.images;
+    if (job.kind === 'image-tags') return whole(images) ? `${images.toLocaleString('en-US')} ${noun(images, 'image')}` : '';
     const folders = job.scope?.output_folders;
-    return Number.isSafeInteger(folders) && folders >= 0 ? countOf(folders, 'output folder') : '';
+    return whole(folders) ? countOf(folders, 'output folder') : '';
 }
 
+/** What a cancelled job kept: "N added" for a scan, "N tagged" for image tagging (D89). */
+const KEPT = Object.freeze({ __proto__: null, scan: addedOf, 'image-tags': taggedOf }); // D89
+const keptOf = job => KEPT[job.kind]?.(job) ?? '';
+
 /** The item's line under its title, by state. */
 export function jobDetail(job) {
     const at = clockTime(job.finished_at);
@@ -58,8 +68,7 @@ export function jobDetail(job) {
     }
     if (job.state === 'lost') return LOST_DETAIL;
     if (job.state === 'cancelled') {
-        return join([`Cancelled ${at} at a file boundary`, job.kind === 'scan' ? addedOf(job) : '',
-            'completed work is kept']);
+        return join([`Cancelled ${at} at a file boundary`, keptOf(job), 'completed work is kept']);
     }
     if (job.state === 'failed') return join([`Stopped on an error at ${at}`, outcomeLine(job)]);
     return join([`Finished ${at}`, outcomeLine(job)]);
@@ -144,11 +153,15 @@ function itemFor(job, scope) {
             progress.textContent = `${next.progress}%`;
             progress.setAttribute('aria-label', `${next.title} progress`);
             if (!progress.isConnected) item.insertBefore(progress, actions.isConnected ? actions : null);
-            if (!actions.isConnected) item.append(actions);
         } else {
+            progress.remove();
+        }
+        // Truth rule: a job that cannot be cancelled (a held legacy-page job) shows no Cancel job.
+        if (running && next.cancellable) {
+            if (!actions.isConnected) item.append(actions);
+        } else if (actions.isConnected) {
             // A focused Cancel job that goes away hands its focus to the item's title link, never to the page body.
             if (actions.contains(document.activeElement)) link.focus();
-            progress.remove();
             actions.remove();
         }
     };

web/js/workspace/file-inspector.mjs

@@ -5,6 +5,7 @@ import { createSendButton } from './prompt-sender.mjs';
 import { createWorkspaceIcon } from './icons.mjs';
 import { navigateTo } from './state.mjs';
 import { showWorkspaceToast } from './toast.mjs';
+import { openCopyFallback } from './workspace-dialogs.mjs';
 
 const RAW_KEYS = ['prompt', 'workflow', 'parameters', 'comfyassets_prompt_pairs'];
 const RAW_LIMIT = 'Raw metadata exceeds the response limit. Download the original file to inspect it externally.';
@@ -26,6 +27,26 @@ const REVEAL_BUSY = 'The folder is already opening.';
 const REVEAL_FAILED = 'The folder could not be opened. Try again.';
 const FACTS = [['seed', 'Seed'], ['steps', 'Steps'], ['cfg', 'CFG'], ['sampler', 'Sampler'], ['scheduler', 'Scheduler'], ['model', 'Model']];
 
+// D117 (LI-4): the legacy metadata page's COPY ALL (web/metadata.html copyAllData), its lines and placeholders.
+const SUMMARY_LINES = [['Checkpoint', 'model'], ['Positive Prompt', 'positive'], ['Negative Prompt', 'negative'], ['Steps', 'steps'],
+    ['CFG Scale', 'cfg'], ['Sampler', 'sampler'], ['Seed', 'seed']];
+const SUMMARY_MISSING = {positive:'No prompt found', negative:'No negative prompt found'};
+
+/**
+ * The one-click settings summary (D117): the legacy COPY ALL text for what this inspector shows. A confirmed prompt
+ * and a known fact are copied verbatim; anything else, an explicitly empty prompt included, takes the legacy page's
+ * placeholder, as its parse does (`hasValue` treats '' as absent).
+ */
+export function settingsSummary(record) {
+    const roles = promptRoles(record?.prompts);
+    const value = key => {
+        if (Object.hasOwn(SUMMARY_MISSING, key)) return roles[key] ? roles[key] : SUMMARY_MISSING[key];
+        const fact = record?.generation?.[key];
+        return fact?.status === 'known' && typeof fact.value === 'string' && fact.value !== '' ? fact.value : 'Unknown';
+    };
+    return SUMMARY_LINES.map(([label, key]) => `${label}: ${value(key)}`).join('\n');
+}
+
 function safeFilename(value) {
     return String(value || 'file').replace(/[\\/\x00-\x1f\x7f<>:"|?*]/g, '_').replace(/^\.+|[. ]+$/g, '') || 'file';
 }
@@ -143,6 +164,25 @@ function evidenceBadge(prompts) {
 function extensionOf(record) {
     return (record.file?.extension || record.identity.path.split('.').at(-1)).replace(/^\./, '').toUpperCase();
 }
+/**
+ * The chip row after the prompt blocks (D88): the file's current image tags first, then D21's linked tags not already
+ * shown (case-insensitive). With `filterable` (a Tags filter exists, as in the Images panel) every image tag sets it, and
+ * a linked tag only when it is the positive's own (D21); otherwise, as in the viewer, every chip is plain.
+ */
+export function inspectorTagChips(record, {filterable}) {
+    const shown = new Set(), chips = [];
+    const add = (names, filter) => {
+        for (const name of names) {
+            const key = name.toLowerCase();
+            if (shown.has(key)) continue;
+            shown.add(key); chips.push({name, filter});
+        }
+    };
+    if (record.imageTags?.state === 'current') add(record.imageTags.tags, filterable);
+    const {library} = record;
+    if (library?.status === 'linked') add(library.tags, filterable && library.tags_scope === 'positive');
+    return chips;
+}
 /** A concept chip whose visible text carries a visually hidden prefix naming what it is. */
 function prefixedChip(prefix, text) {
     const chip = el('span', undefined, 'chip');
@@ -156,7 +196,7 @@ function prefixedChip(prefix, text) {
  * `variant: 'full'` (the viewer's `#viewer-details`, imageDetails(i, true)) leaves out the cover and adds "File &
  * provenance" and "Workflow & raw metadata" with the downloads. `inline: true` means `panel`; neither means `full`.
  */
-export function mountFileInspector(container, {api, sender, parentScope, variant, inline = false, promptContext = '', onTagFilter, onRetry, onRefresh, onInteraction = () => {}}) {
+export function mountFileInspector(container, {api, sender, parentScope, variant, inline = false, promptContext = '', onTagFilter, onRetry, onRefresh, onInteraction = () => {}, copyFallback = openCopyFallback}) {
     if (parentScope.signal.aborted) return {setState() {}, dispose() {}};
     const scope = childScope(parentScope);
     let contentScope;
@@ -165,7 +205,7 @@ export function mountFileInspector(container, {api, sender, parentScope, variant
     scope.listen(container, 'keydown', onInteraction);
     scope.listen(container, 'click', onInteraction);
     scope.listen(container, 'wheel', onInteraction, {passive:true});
-    scope.cleanup(() => {contentScope?.dispose(); container.replaceChildren(); container.classList.remove('file-inspector');});
+    scope.cleanup(() => {contentScope?.dispose(); container.replaceChildren(); container.classList.remove('file-inspector'); container.removeAttribute('aria-busy');});
 
     const full = (variant ?? (inline ? 'panel' : 'full')) === 'full';
     function statusView(state, parent) {
@@ -184,6 +224,8 @@ export function mountFileInspector(container, {api, sender, parentScope, variant
         if (scope.signal.aborted) return;
         contentScope?.dispose(); contentScope = childScope(scope);
         container.replaceChildren();
+        // A local read resolves on this thread in bounded steps; the busy state stays until its answer lands.
+        if (state.loading) container.setAttribute('aria-busy', 'true'); else container.removeAttribute('aria-busy');
         render(state);
     }
     /**
@@ -211,20 +253,21 @@ export function mountFileInspector(container, {api, sender, parentScope, variant
         const prompts = el('div'); inner.append(prompts);
         const blocks = mountPromptBlocks(prompts, {sender, parentScope:contentScope, includePairAction:false, contextLabel:promptContext, title});
         blocks.setState({prompts:record.prompts}); contentScope.cleanup(blocks.dispose);
-        if (linked && library.tags.length) {
-            // D21: a chip sets the Images Tags filter, which matches the linked positive's tags; a recipe's own tags are
-            // not what it matches, so they (and chips where no Tags filter exists, as in the viewer) stay plain. With the
-            // D39 fallback a recipe without tags shows its positive's, which are filter buttons again.
-            const filterable = onTagFilter && library.tags_scope === 'positive';
+        // D21: a chip sets the Images Tags filter, which matches the linked positive's tags; a recipe's own tags are
+        // not what it matches, so they (and chips where no Tags filter exists, as in the viewer) stay plain. With the
+        // D39 fallback a recipe without tags shows its positive's, which are filter buttons again. D88: the file's own
+        // image tags lead the row and, where a Tags filter exists, always set it (it matches them too).
+        const chips = inspectorTagChips(record, {filterable:!!onTagFilter});
+        if (chips.length) {
             const tags = el('div', undefined, 'tags');
-            for (const tag of library.tags) {
-                if (!filterable) {tags.append(el('span', tag, 'chip')); continue;}
-                const chip = createButton(tag, 'chip'); contentScope.listen(chip, 'click', () => onTagFilter(tag)); tags.append(chip);
+            for (const {name, filter} of chips) {
+                if (!filter) {tags.append(el('span', name, 'chip')); continue;}
+                const chip = createButton(name, 'chip'); contentScope.listen(chip, 'click', () => onTagFilter(name)); tags.append(chip);
             }
             inner.append(tags);
         }
         inner.append(...generationFacts(record, 'meta-grid', 'small'));
-        if (full) inner.append(provenance(record, badge), rawMetadata(record));
+        if (full) inner.append(summaryButton(record), provenance(record, badge), rawMetadata(record));
         const footer = full ? container : el('div', undefined, 'detail-footer'), roles = promptRoles(record.prompts);
         if (Object.hasOwn(roles, 'positive') && Object.hasOwn(roles, 'negative')) {
             const pair = createButton('', 'send');
@@ -244,6 +287,23 @@ export function mountFileInspector(container, {api, sender, parentScope, variant
         }
         if (!full && footer.childNodes.length) container.append(footer);
     }
+    /**
+     * D117 (LI-4): "Copy settings summary" after the six facts, the legacy COPY ALL. It copies as the concept's prompt
+     * copy does: the shared toast, or the select-to-copy dialog where the clipboard is unavailable or refused.
+     */
+    function summaryButton(record) {
+        const button = createButton('Copy settings summary', 'settings-summary'), text = settingsSummary(record);
+        contentScope.listen(button, 'click', async () => {
+            try {
+                if (!navigator.clipboard) throw new Error('Clipboard requires a secure context');
+                await navigator.clipboard.writeText(text);
+                if (!contentScope.signal.aborted) showWorkspaceToast('Settings summary copied.');
+            } catch {
+                if (!contentScope.signal.aborted) copyFallback(text, {scope:contentScope, trigger:button, title:'Copy settings summary'});
+            }
+        });
+        return button;
+    }
     /** The concept's plain cover; the card image opens the viewer (D19). Video keeps its own element. */
     function cover(record) {
         const {file} = record, video = file?.media_type === 'video';
@@ -258,14 +318,16 @@ export function mountFileInspector(container, {api, sender, parentScope, variant
         }
         return node;
     }
-    /** "File & provenance": the current-file facts, the D21 prompt evidence, the occurrence and the saved association. */
+    /** "File & provenance": the file facts, the D21 prompt evidence, the occurrence and the saved association (D66 for a local file). */
     function provenance(record, badge) {
         const {file, library} = record, section = disclosure('File & provenance');
-        const reported = record.identity.kind === 'reported-location';
-        section.append(el('p', reported ? 'Current file at the reported location · identity unverified' : 'Current file at this source; historical bytes are not verified.', 'small'));
+        const reported = record.identity.kind === 'reported-location', local = record.identity.kind === 'local-file';
+        // D66: a file chosen in this browser has no server path, no folder to show and no saved association.
+        section.append(el('p', reported ? 'Current file at the reported location · identity unverified' : local ? 'Selected local file · read in this browser' :
+            'Current file at this source; historical bytes are not verified.', 'small'));
         const path = el('dd', record.identity.path ?? 'Not available');
         const facts = file && definitionList([
-            ['Source', file.source_label], ['Path', path], ['Size', formatBytes(file.size)],
+            ['Source', file.source_label], ...(local ? [] : [['Path', path]]), ['Size', formatBytes(file.size)],
             ['Dimensions', file.width && file.height ? `${file.width} × ${file.height}` : null],
             ['Format', file.format || `${extensionOf(record)} extension`], ['Media type', file.media_type],
             ['Modified', file.modified_time !== null ? new Date(file.modified_time * 1000).toLocaleString() : null],
@@ -284,7 +346,7 @@ export function mountFileInspector(container, {api, sender, parentScope, variant
                 ['Recorded run', occurrence.run_id], ['Output node', occurrence.output_node_id], ['Image ordinal', String(occurrence.image_ordinal)],
             ], 'meta-grid'));
         }
-        section.append(el('p', record.historyTarget ? 'Saved association; not verified against current file' : library?.status === 'ambiguous' ? 'Saved association is ambiguous; no unique saved positive prompt is available.' : 'No unique saved positive prompt association is available.', 'small'));
+        section.append(el('p', local ? 'Local file; no saved library association was checked.' : record.historyTarget ? 'Saved association; not verified against current file' : library?.status === 'ambiguous' ? 'Saved association is ambiguous; no unique saved positive prompt is available.' : 'No unique saved positive prompt association is available.', 'small'));
         if (record.download) {
             const original = el('a', 'Download original'); original.href = record.download.url;
             original.download = safeFilename(record.download.filename); section.append(original);

web/js/workspace/image-layout.mjs

@@ -4,6 +4,17 @@ const MEDIA_RATIO = 1.33, BORDER = 2, FOOTER_HEIGHT = 54, LIST_HEIGHT = 97;
 // Bounded rendering keeps a card readable when zoom shrinks the grid below the concept's columns (D3, D31).
 export const MINIMUM_CARD_WIDTH = 120;
 const AUTOMATIC_CARD_WIDTH = 240;
+// A list row's art: the concept's 160px, yielding to 45% of the row at extreme zoom (the overlay's D31).
+const LIST_ART_WIDTH = 160, LIST_ART_SHARE = 0.45;
+
+/**
+ * Whether a card's info row stacks its text above Info and Tag (D31): the row would be narrower than the narrowest
+ * bounded card, which only extreme zoom reaches. A list row's info is what its art leaves of the row.
+ */
+export function stacksCardInfo(width, mode) {
+    const info = mode === 'list' ? width - Math.min(LIST_ART_WIDTH, width * LIST_ART_SHARE) : width;
+    return info < MINIMUM_CARD_WIDTH;
+}
 
 /** The concept grid's own columns and gap, read from its computed style as the concept's mountMasonry does (D3). */
 export function gridMetrics(grid) {

web/js/workspace/image-tagging-state.mjs

@@ -0,0 +1,586 @@
+/**
+ * Tag image dialog state: observe, staged suggestions and byte-exact saves (#249 C1).
+ *
+ * UI-agnostic. A dialog renders `controller.state` (a frozen snapshot replaced
+ * on every change) and calls its methods. open() captures the file and reads its
+ * saved tags; generate() stages the top suggestions as removable chips, written
+ * only by save(). Every read is guarded by a serial: a model change, a reopen,
+ * cancel() or dispose() supersedes older requests, so a late answer can never
+ * stage chips or supply a token. Writes are sent once, without an abort signal
+ * (aborting cannot undo a write); a lost answer is resent only by retry(), with
+ * the identical body (the server answers a duplicate as `replayed`). A save in
+ * flight when the dialog closes still settles: the capture is released after it,
+ * and `onLateSave(outcome)` reports what happened. Writes and the capture release
+ * are sent with `keepalive`, so they finish while the page unloads.
+ */
+import {noun} from './plural.mjs';
+
+export const MODEL_OPTIONS = Object.freeze([
+    Object.freeze({id: 'wd14-swinv2', label: 'WD14 SwinV2 · ~400 MB', classifier: true}),
+    Object.freeze({id: 'wd14-vit', label: 'WD14 ViT · ~400 MB', classifier: true}),
+    Object.freeze({id: 'gguf', label: 'GGUF JoyCaption (Recommended) · ~4.5 GB', classifier: false}),
+    Object.freeze({id: 'hf', label: 'HuggingFace JoyCaption · ~16 GB', classifier: false}),
+]);
+
+const OBSERVE_URL = '/prompt_manager/image-annotations/observe';
+const SUGGEST_URL = '/prompt_manager/image-annotations/suggest';
+const TAGS_URL = '/prompt_manager/image-annotations/tags';
+const CAPTURE_URL = '/prompt_manager/image-annotations/capture/';
+const MODELS_URL = '/prompt_manager/autotag/models';
+const SOURCES = new Set(['images', 'library', 'review', 'tags', 'bulk']);
+const OPTION_KEYS = new Set(['general_threshold', 'character_threshold', 'instructions', 'suggestion_limit']);
+const DEFAULTS = Object.freeze({general_threshold: 0.35, character_threshold: 0.85, instructions: '', suggestion_limit: 10});
+const MAX_SUGGESTIONS = 100;
+const MAX_INSTRUCTION_CHARS = 4000;
+const EDITABLE = new Set(['ready', 'generate-error', 'write-error', 'conflict']);
+// Answers after which only a fresh observation can save (the capture or epoch is gone); Retry observes again (D116).
+const REOPEN = {'storage-changed': 'storage-changed', 'file-changed': 'file-changed', 'source-changed': 'file-changed', 'capture-expired': 'capture-expired'};
+const REOBSERVE = new Set(Object.values(REOPEN));
+const RETRYABLE = new Set(['observe-error', 'generate-error', 'unknown-outcome', ...REOBSERVE]);
+// Generic failure envelopes whose fixed sentence the dialog words itself.
+const GENERIC_CODES = new Set(['observe-failed', 'suggest-failed', 'save-failed', 'capture-error']);
+// A proxy timeout or bad gateway cannot tell whether the server committed the write.
+const UNCONFIRMED_STATUS = new Set([502, 503, 504]);
+
+const COPY = Object.freeze({
+    // The concept's on-screen opening sentence (renderTagModelOptions a1062 replaces its markup's at once).
+    modelChanged: 'Generate suggestions with the selected model before approving.',
+    chipHint: 'Remove anything you do not want to add.', // D83
+    changedElsewhere: 'The tags of this image changed since the dialog opened.',
+    allRemoved: 'All suggestions removed. Generate again or enter tags manually.', // D83
+    empty: 'No suggestions met this threshold. Adjust it or enter tags manually.',
+    generating: 'Generating suggestions…',
+    observeFailed: 'The image could not be opened for tagging.',
+    generateFailed: 'Auto-tagging failed. Check server logs for details.',
+    saveFailed: 'The tags could not be saved.',
+    unknown: 'The save could not be confirmed. Retry sends the same tags again.',
+    unknownClosed: 'The tag save could not be confirmed. Open Tag image again to check the saved tags.',
+    reviewSuffix: ' Prompt association still awaits review.',
+});
+
+const object = value => value !== null && typeof value === 'object' && !Array.isArray(value);
+const uuid = value => typeof value === 'string' && /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/.test(value);
+const hex64 = value => typeof value === 'string' && /^[0-9a-f]{64}$/.test(value);
+const captureToken = value => typeof value === 'string' && /^[A-Za-z0-9_-]{1,128}$/.test(value);
+const count = value => Number.isSafeInteger(value) && value >= 0;
+const dimension = value => value === null || (Number.isSafeInteger(value) && value > 0);
+const strings = value => Array.isArray(value) && value.every(item => typeof item === 'string');
+const unit = value => typeof value === 'number' && Number.isFinite(value) && value >= 0 && value <= 1;
+const limit = value => Number.isInteger(value) && value >= 1 && value <= MAX_SUGGESTIONS;
+
+function requireValue(valid, message) {if (!valid) throw new TypeError(message);}
+function freeze(value) {
+    if (value && typeof value === 'object' && !Object.isFrozen(value)) {Object.values(value).forEach(freeze); Object.freeze(value);}
+    return value;
+}
+// Duck-typed by name: this ES module cannot import the UMD api-client.js.
+function isApiError(error) {return error instanceof Error && error.name === 'ApiError' && Number.isInteger(error.status);}
+function messageOf(error, fallback) {
+    return isApiError(error) && error.code && !GENERIC_CODES.has(error.code) && error.message ? error.message : fallback;
+}
+const modelOf = id => MODEL_OPTIONS.find(option => option.id === id);
+// An input's value arrives as text; blank text is not zero.
+const numberOf = value => (typeof value === 'string' ? (value.trim() === '' ? NaN : Number(value)) : value);
+
+/** Trimmed, non-blank names with case-insensitive repeats dropped; the first spelling and position win. */
+export function dedupeTags(names) {
+    const seen = new Set();
+    const result = [];
+    for (const value of Array.isArray(names) ? names : []) {
+        if (typeof value !== 'string') continue;
+        const name = value.trim();
+        const key = name.toLowerCase();
+        if (!name || seen.has(key)) continue;
+        seen.add(key);
+        result.push(name);
+    }
+    return result;
+}
+
+/** The manual field's comma-separated names. */
+export function parseManualTags(text) {
+    return dedupeTags(typeof text === 'string' ? text.split(',') : []);
+}
+
+/** The server's current set ahead of the user's draft: what the dialog shows after another writer saved. */
+function mergeCurrent(current, draft) {
+    return dedupeTags([...current, ...parseManualTags(draft)]).join(', ');
+}
+const savedNow = tags => `Saved now: ${tags.length ? tags.join(', ') : 'no tags'}.`;
+
+/** `null` when *options* are valid for *model*, else `{field, message}` (nothing is sent). */
+export function optionError(model, options) {
+    const option = modelOf(model);
+    requireValue(option, 'Unknown tagging model');
+    if (option.classifier) {
+        for (const field of ['general_threshold', 'character_threshold']) {
+            if (!unit(numberOf(options[field]))) return {field, message: 'Enter a confidence from 0 to 1.'};
+        }
+    } else {
+        const text = options.instructions;
+        if (typeof text !== 'string' || !text.trim() || text.length > MAX_INSTRUCTION_CHARS) {
+            return {field: 'instructions', message: `Enter tagging instructions of at most ${MAX_INSTRUCTION_CHARS} characters.`};
+        }
+    }
+    if (!limit(numberOf(options.suggestion_limit))) {
+        return {field: 'suggestion_limit', message: `Enter a whole number of suggestions from 1 to ${MAX_SUGGESTIONS}.`};
+    }
+    return null;
+}
+
+/** The options a request sends for `model`: numbers parsed, only the model's own keys. */
+export function requestOptions(model, options) {
+    const body = {suggestion_limit: numberOf(options.suggestion_limit)};
+    if (modelOf(model).classifier) {
+        return {general_threshold: numberOf(options.general_threshold), character_threshold: numberOf(options.character_threshold), ...body};
+    }
+    return {instructions: options.instructions, ...body};
+}
+
+function validateTarget(target) {
+    requireValue(object(target) && Number.isSafeInteger(target.root_index) && target.root_index >= 0 &&
+        hex64(target.root_scope) && typeof target.path === 'string' && target.path.length > 0 && target.path.length <= 1024,
+    'Invalid image target');
+    return Object.freeze({root_index: target.root_index, root_scope: target.root_scope, path: target.path});
+}
+
+function validateObserved(value) {
+    requireValue(object(value) && value.success === true && uuid(value.library_epoch) && object(value.capture), 'Invalid observation');
+    const capture = value.capture;
+    requireValue(captureToken(capture.token) && hex64(capture.sha256) && typeof capture.preview_url === 'string' &&
+        capture.preview_url.startsWith(CAPTURE_URL) && dimension(capture.width) && dimension(capture.height) &&
+        ['image', 'video'].includes(capture.media_type) && object(capture.generate) &&
+        typeof capture.generate.supported === 'boolean' &&
+        (capture.generate.reason === null || typeof capture.generate.reason === 'string'), 'Invalid capture');
+    requireValue(typeof value.filename === 'string' && (value.title === null || typeof value.title === 'string') &&
+        strings(value.tags) && count(value.tag_revision), 'Invalid observation');
+    return value;
+}
+
+function validateSuggestions(value, cap) {
+    requireValue(object(value) && value.success === true && Array.isArray(value.suggestions), 'Invalid suggestions');
+    const seen = new Set();
+    const rows = [];
+    for (const row of value.suggestions) {
+        requireValue(object(row) && typeof row.name === 'string' && (row.confidence === null || unit(row.confidence)), 'Invalid suggestion');
+        const name = row.name.trim();
+        const key = name.toLowerCase();
+        if (!name || seen.has(key)) continue;
+        seen.add(key);
+        const label = row.confidence === null ? 'Suggested' : `${Math.round(row.confidence * 100)}%`;
+        rows.push({name, confidence: row.confidence, label});
+    }
+    return rows.slice(0, cap);
+}
+
+function validateReceipt(value) {
+    requireValue(object(value) && value.success === true && strings(value.tags) && count(value.tag_revision), 'Invalid tag receipt');
+    return value;
+}
+
+/**
+ * Thresholds, instructions and suggestion count from the server, else the documented defaults, and the models'
+ * download status (`models`, null when unknown).
+ */
+async function readDefaults(api, signal) {
+    try {
+        const value = await api.get(MODELS_URL, {signal, cache: 'no-store'});
+        if (!object(value)) return {defaults: DEFAULTS, models: null};
+        return {
+            defaults: {
+                general_threshold: unit(value.wd14_general_threshold) ? value.wd14_general_threshold : DEFAULTS.general_threshold,
+                character_threshold: unit(value.wd14_character_threshold) ? value.wd14_character_threshold : DEFAULTS.character_threshold,
+                instructions: typeof value.default_prompt === 'string' ? value.default_prompt : DEFAULTS.instructions,
+                suggestion_limit: limit(value.suggestion_limit) ? value.suggestion_limit : DEFAULTS.suggestion_limit,
+            },
+            models: object(value.models) ? value.models : null,
+        };
+    } catch {
+        // The defaults keep the dialog usable; Generate reports a real failure itself.
+        return {defaults: DEFAULTS, models: null};
+    }
+}
+
+const UNAVAILABLE_HINT = 'Download it from the legacy Auto-tag page.';
+/**
+ * Why `model` cannot run, from the `/autotag/models` status (the server's own `model-unavailable` sentence), else ''
+ * (downloaded, or the status is unknown: the job then reports a missing model itself).
+ */
+export function modelUnavailable(models, model) {
+    const option = modelOf(model);
+    requireValue(option, 'Unknown tagging model');
+    const status = object(models) && object(models[model]) ? models[model] : null;
+    if (!status || status.downloaded !== false) return '';
+    const name = typeof status.name === 'string' && status.name.trim() ? status.name : option.label.split(' · ')[0];
+    return `${name} is not downloaded. ${UNAVAILABLE_HINT}`;
+}
+
+function initialState(source, preset) {
+    return {
+        phase: 'observing', closed: false, source, showScopeNote: source === 'review',
+        image: null, savedTags: [], tagRevision: 0, currentTags: null, manual: '',
+        model: preset?.model ?? MODEL_OPTIONS[0].id, options: {...DEFAULTS, ...preset?.options}, generated: false, suggestions: [],
+        suggestionsText: COPY.modelChanged, statusText: '', generateSupported: false, generateReason: null, toast: null,
+        // Bumped whenever the controller itself rewrites the option fields or the manual draft, never while typing.
+        optionsRevision: 0, draftRevision: 0,
+    };
+}
+
+/** Derived labels and permissions; never stored independently of the fields they follow. */
+function derive(state) {
+    const editable = EDITABLE.has(state.phase);
+    return {
+        ...state,
+        primaryLabel: state.generated ? 'Approve selected tags' : 'Save manual tags',
+        countText: state.generated ? `${state.suggestions.length} ${noun(state.suggestions.length, 'suggestion')}` : 'Not generated',
+        chipHint: state.suggestions.length ? COPY.chipHint : '',
+        canSave: editable,
+        canGenerate: editable && state.generateSupported,
+        canRetry: RETRYABLE.has(state.phase),
+    };
+}
+
+/** A `{model, options}` preset (the bulk review's choice) when valid, else a TypeError. */
+function validatePreset(preset) {
+    if (preset === null || preset === undefined) return null;
+    requireValue(object(preset) && modelOf(preset.model) && object(preset.options), 'Invalid tagging preset');
+    const options = {};
+    for (const [key, value] of Object.entries(preset.options)) {
+        requireValue(OPTION_KEYS.has(key), 'Unknown tagging option');
+        options[key] = value;
+    }
+    requireValue(!optionError(preset.model, {...DEFAULTS, ...options}), 'Invalid tagging preset');
+    return Object.freeze({model: preset.model, options: Object.freeze(options)});
+}
+
+/**
+ * `preset` ({model, options}, D90's review session) starts the dialog on that model, and every observation applies
+ * those options over the server's defaults.
+ */
+export function createImageTaggingController({api, target, source = 'images', onLateSave = () => {}, preset = null} = {}) {
+    requireValue(object(api) && ['get', 'post', 'put', 'del'].every(name => typeof api[name] === 'function'), 'An api client is required');
+    const imageTarget = validateTarget(target);
+    requireValue(SOURCES.has(source), 'Unknown tagging source');
+    requireValue(typeof onLateSave === 'function', 'onLateSave must be a function');
+    const chosen = validatePreset(preset);
+
+    let state = freeze(derive(initialState(source, chosen)));
+    const listeners = new Set();
+    let closed = false;
+    let capture = null;
+    let epoch = null;
+    let defaults = DEFAULTS;
+    let openSerial = 0;
+    let generateSerial = 0;
+    let saveSerial = 0;
+    let readAbort = null;
+    let generateAbort = null;
+    let lastBody = null;
+    // A save in flight: closing hands the capture release to its completion.
+    let saving = false;
+    let observedOnce = false;
+
+    function set(patch) {
+        if (closed) return;
+        state = freeze(derive({...state, ...patch}));
+        for (const listener of [...listeners]) listener(state);
+    }
+
+    function releaseToken(token) {
+        // Best effort: an unreleased capture expires on the server's idle timeout.
+        api.del(CAPTURE_URL + encodeURIComponent(token), {keepalive: true}).catch(() => {});
+    }
+    function releaseCapture() {
+        if (capture) releaseToken(capture.token);
+        capture = null;
+    }
+    function stopGenerating() {
+        generateSerial += 1;
+        generateAbort?.abort();
+        generateAbort = null;
+    }
+    function reasonText() {
+        return state.generateSupported ? '' : (state.generateReason || '');
+    }
+
+    /** Observe the file; `keepDraft` (a Retry after a changed file, storage or capture) keeps the typed draft. */
+    async function open({keepDraft = false} = {}) {
+        if (closed) return;
+        const serial = ++openSerial;
+        const draft = keepDraft ? state.manual : null;
+        const seenRevision = state.tagRevision;
+        stopGenerating();
+        releaseCapture();
+        readAbort?.abort();
+        readAbort = new AbortController();
+        const defaultsRead = readDefaults(api, readAbort.signal);
+        lastBody = null;
+        set({phase: 'observing', statusText: '', toast: null, currentTags: null, generated: false, suggestions: [], suggestionsText: COPY.modelChanged});
+        let value;
+        try {
+            const answer = await api.post(OBSERVE_URL, {target: {...imageTarget}});
+            if (closed || serial !== openSerial) {
+                if (captureToken(answer?.capture?.token)) releaseToken(answer.capture.token);
+                return;
+            }
+            try {
+                value = validateObserved(answer);
+            } catch (error) {
+                if (captureToken(answer?.capture?.token)) releaseToken(answer.capture.token);
+                throw error;
+            }
+        } catch (error) {
+            if (closed || serial !== openSerial) return;
+            set({phase: 'observe-error', statusText: messageOf(error, COPY.observeFailed)});
+            return;
+        }
+        capture = {token: value.capture.token, sha256: value.capture.sha256};
+        epoch = value.library_epoch;
+        ({defaults} = await defaultsRead);
+        if (closed || serial !== openSerial) return;
+        observedOnce = true;
+        const {width, height, media_type: mediaType, preview_url: previewUrl, generate} = value.capture;
+        // A kept draft stays as typed unless another writer changed the set meanwhile: then the set leads it (I2).
+        const changed = draft !== null && value.tag_revision !== seenRevision;
+        const reason = generate.supported ? '' : (generate.reason || '');
+        set({
+            phase: 'ready',
+            image: {filename: value.filename, title: value.title, width, height, mediaType, previewUrl,
+                dimensions: width && height ? `${width} × ${height}` : null},
+            savedTags: value.tags.slice(), tagRevision: value.tag_revision,
+            manual: draft === null ? value.tags.join(', ') : changed ? mergeCurrent(value.tags, draft) : draft,
+            draftRevision: state.draftRevision + 1,
+            options: {...defaults, ...chosen?.options}, optionsRevision: state.optionsRevision + 1,
+            generateSupported: generate.supported, generateReason: generate.reason,
+            statusText: changed ? `${COPY.changedElsewhere} ${savedNow(value.tags)}${reason ? ` ${reason}` : ''}` : reason,
+        });
+    }
+
+    function setManual(text) {
+        set({manual: typeof text === 'string' ? text : ''});
+    }
+
+    function setModel(id) {
+        requireValue(modelOf(id), 'Unknown tagging model');
+        if (closed || id === state.model) return;
+        stopGenerating();
+        const phase = state.phase === 'generating' || state.phase === 'generate-error' ? 'ready' : state.phase;
+        set({
+            phase, model: id, generated: false, suggestions: [], suggestionsText: COPY.modelChanged, statusText: reasonText(),
+            optionsRevision: state.optionsRevision + 1,
+            // Like the mock, a model change re-renders its fields with the defaults; the count is kept (D91).
+            options: {...state.options, general_threshold: defaults.general_threshold,
+                character_threshold: defaults.character_threshold, instructions: defaults.instructions},
+        });
+    }
+
+    function setOption(key, value) {
+        requireValue(OPTION_KEYS.has(key), 'Unknown tagging option');
+        set({options: {...state.options, [key]: value}});
+    }
+
+    async function generate() {
+        if (closed || !state.canGenerate || optionError(state.model, state.options)) return false;
+        stopGenerating();
+        const serial = generateSerial;
+        const controller = new AbortController();
+        generateAbort = controller;
+        const model = state.model;
+        const options = requestOptions(model, state.options);
+        const stale = () => closed || serial !== generateSerial;
+        set({phase: 'generating', statusText: COPY.generating});
+        let rows;
+        try {
+            const value = await api.post(SUGGEST_URL, {
+                target: {...imageTarget}, capture_token: capture.token, expected_epoch: epoch, model_type: model, options,
+            }, {signal: controller.signal});
+            if (stale()) return false;
+            rows = validateSuggestions(value, options.suggestion_limit);
+        } catch (error) {
+            if (stale()) return false;
+            const phase = isApiError(error) && REOPEN[error.code];
+            set(phase ? {phase, statusText: error.message} : {phase: 'generate-error', statusText: messageOf(error, COPY.generateFailed)});
+            return false;
+        }
+        generateAbort = null;
+        set({
+            phase: 'ready', generated: true, suggestions: rows, suggestionsText: rows.length ? '' : COPY.empty,
+            statusText: `Suggestions from ${modelOf(model).label}. Approve tags to save.`,
+        });
+        return true;
+    }
+
+    function remove(name) {
+        const suggestions = state.suggestions.filter(row => row.name !== name);
+        if (closed || suggestions.length === state.suggestions.length) return;
+        set({suggestions, suggestionsText: suggestions.length ? '' : COPY.allRemoved});
+    }
+
+    async function send(body) {
+        const serial = ++saveSerial;
+        lastBody = body;
+        saving = true;
+        set({phase: 'saving', statusText: ''});
+        let value = null, failure = null;
+        try {
+            value = validateReceipt(await api.put(TAGS_URL, body, {keepalive: true}));
+        } catch (error) {
+            failure = error;
+        } finally {
+            saving = false;
+        }
+        if (serial !== saveSerial) return false;
+        if (closed) return settleClosed(value, failure);
+        if (failure) {
+            set(failedSave(failure));
+            return false;
+        }
+        lastBody = null;
+        set({phase: 'saved', savedTags: value.tags.slice(), tagRevision: value.tag_revision, currentTags: null, statusText: '',
+            toast: toastOf(value)});
+        return true;
+    }
+    // The mock's toast verbatim (app.js:1545, without the demo's "in this tab"): "tags" even for one.
+    function toastOf(value) {
+        return `${value.tags.length} tags saved for ${state.image.filename}.${source === 'review' ? COPY.reviewSuffix : ''}`;
+    }
+    /** The dialog closed while its save was in flight: release the capture now, then report the outcome. */
+    function settleClosed(value, failure) {
+        releaseCapture();
+        if (!failure) {
+            onLateSave({saved: true, filename: state.image.filename, tags: value.tags.slice(), toast: toastOf(value)});
+            return true;
+        }
+        const {phase, statusText} = failedSave(failure);
+        // A conflict's own sentence, not its merged "Saved now" view: the dialog that would show it is gone.
+        const message = phase === 'unknown-outcome' ? COPY.unknownClosed : phase === 'conflict' ? failure.message : statusText;
+        onLateSave({saved: false, message});
+        return false;
+    }
+
+    /** The state patch of a failed save. */
+    function failedSave(error) {
+        if (!isApiError(error) || error.status < 400 || UNCONFIRMED_STATUS.has(error.status)) {
+            return {phase: 'unknown-outcome', statusText: COPY.unknown};
+        }
+        lastBody = null;
+        if (error.code === 'tag-conflict') {
+            // The current set is shown (status and field) ahead of the draft; a second Save is against its revision.
+            const current = error.current;
+            if (!current) return {phase: 'conflict', statusText: error.message, currentTags: null};
+            return {phase: 'conflict', currentTags: current.tags.slice(), tagRevision: current.tag_revision,
+                statusText: `${error.message} ${savedNow(current.tags)}`,
+                manual: mergeCurrent(current.tags, state.manual), draftRevision: state.draftRevision + 1};
+        }
+        if (REOPEN[error.code]) return {phase: REOPEN[error.code], statusText: error.message};
+        return {phase: 'write-error', statusText: messageOf(error, COPY.saveFailed)};
+    }
+
+    async function save() {
+        if (closed || !state.canSave) return false;
+        const tags = dedupeTags([...parseManualTags(state.manual), ...state.suggestions.map(row => row.name)]);
+        return send({
+            target: {...imageTarget}, capture_token: capture.token, sha256: capture.sha256,
+            expected_epoch: epoch, expected_tag_revision: state.tagRevision, tags,
+        });
+    }
+
+    async function retry() {
+        if (closed || !state.canRetry) return false;
+        if (state.phase === 'observe-error') return open({keepDraft: observedOnce});
+        if (REOBSERVE.has(state.phase)) return open({keepDraft: true});
+        if (state.phase === 'generate-error') return generate();
+        return send(lastBody);
+    }
+
+    function cancel() {
+        if (closed) return;
+        set({closed: true});
+        closed = true;
+        openSerial += 1;
+        stopGenerating();
+        readAbort?.abort();
+        readAbort = null;
+        // A save in flight keeps its capture until it settles (send releases it); aborting cannot undo the write.
+        if (!saving) releaseCapture();
+    }
+
+    function dispose() {
+        listeners.clear();
+        cancel();
+    }
+
+    function subscribe(listener) {
+        requireValue(typeof listener === 'function', 'A listener function is required');
+        listeners.add(listener);
+        return () => listeners.delete(listener);
+    }
+
+    return {
+        get state() {return state;},
+        subscribe, open, setManual, setModel, setOption, generate, remove, save, retry, cancel, dispose,
+    };
+}
+
+/**
+ * The model and options of the bulk "Auto-tag selected images" dialog (D85): the same fields as the Tag image dialog's
+ * model panel, without an image. open() reads the server's defaults and the models' download status once; until it
+ * lands Start waits (`canStart` false). `unavailable` is why the chosen model cannot run ('' when it can), so the
+ * dialog refuses to start a job that would fail at once.
+ */
+export function createTaggingOptionsController({api} = {}) {
+    requireValue(object(api) && typeof api.get === 'function', 'An api client is required');
+    const listeners = new Set();
+    let closed = false;
+    let defaults = DEFAULTS;
+    let models = null;
+    let abort = null;
+    const deriveOptions = value => ({...value, canGenerate: false, unavailable: modelUnavailable(models, value.model),
+        canStart: value.phase === 'ready' && !modelUnavailable(models, value.model)});
+    let state = freeze(deriveOptions({phase: 'loading', model: MODEL_OPTIONS[0].id, options: {...DEFAULTS}, optionsRevision: 0}));
+
+    function set(patch) {
+        if (closed) return;
+        state = freeze(deriveOptions({...state, ...patch}));
+        for (const listener of [...listeners]) listener(state);
+    }
+    async function open() {
+        if (closed || abort) return;
+        abort = new AbortController();
+        const read = await readDefaults(api, abort.signal);
+        if (closed) return;
+        ({defaults, models} = read);
+        set({phase: 'ready', options: {...defaults}, optionsRevision: state.optionsRevision + 1});
+    }
+    function setModel(id) {
+        requireValue(modelOf(id), 'Unknown tagging model');
+        if (closed || id === state.model) return;
+        // As in the Tag image dialog: the model's fields start from the defaults again; the count is kept (D91).
+        set({model: id, optionsRevision: state.optionsRevision + 1,
+            options: {...state.options, general_threshold: defaults.general_threshold,
+                character_threshold: defaults.character_threshold, instructions: defaults.instructions}});
+    }
+    function setOption(key, value) {
+        requireValue(OPTION_KEYS.has(key), 'Unknown tagging option');
+        set({options: {...state.options, [key]: value}});
+    }
+    /** `{model_type, options}` for a job or a review session, or null while the options are invalid. */
+    function request() {
+        if (optionError(state.model, state.options)) return null;
+        return {model_type: state.model, options: requestOptions(state.model, state.options)};
+    }
+    function dispose() {
+        closed = true;
+        listeners.clear();
+        abort?.abort();
+    }
+    function subscribe(listener) {
+        requireValue(typeof listener === 'function', 'A listener function is required');
+        listeners.add(listener);
+        return () => listeners.delete(listener);
+    }
+    return {
+        get state() {return state;},
+        subscribe, open, setModel, setOption, request, dispose,
+    };
+}

web/js/workspace/image-tagging.mjs

@@ -0,0 +1,400 @@
+/**
+ * The concept's "Tag image" dialog (docs/concepts/workspace/app.js `tagReview` a1037–1061, `renderTagModelOptions`
+ * a1062–1076, `generateTags` a1077–1135, `apply-tags` a1517–1547; style.css s1598–1694) over the tagging controller
+ * (image-tagging-state.mjs), in the shared modal shell (workspace-dialogs.mjs) with the concept's `tagging-modal`
+ * class, whose sticky `.dialog-actions` stay reachable while the content scrolls.
+ *
+ * Recorded deviations: D83 (#249 plan D60) the suggestions are removable chips, every one preselected, at most the
+ * requested count, with "Remove anything you do not want to add." while chips exist and the all-removed copy; D84
+ * (plan D61) the legacy engines' labels and sizes, GGUF in the concept's Ollama slot, instructions prefilled with the
+ * server's default; D91 (plan D68) a Suggestions count field for every model. States the concept lacks (busy,
+ * conflict, changed storage or file, lost answers, unavailable model, video) are only text in
+ * `#tag-generation-status`; D116 (ruling T5) Retry leads the actions wherever the controller allows it, as the other
+ * workspace dialogs place theirs.
+ *
+ * The capture is released when the dialog closes (×, Escape, Cancel, Save), when the route changes (the shell
+ * closes its dialog) and on `pagehide` (which closes the dialog; the release is sent with `keepalive`). A save in
+ * flight at close keeps its capture until it settles, and its outcome is still toasted and announced.
+ */
+import { createButton, createScope } from '../shared/toolkit/core.js';
+import { createImageTaggingController, MODEL_OPTIONS, optionError } from './image-tagging-state.mjs';
+import { closeWorkspaceDialog, field, openContentDialog } from './workspace-dialogs.mjs';
+import { createWorkspaceIcon } from './icons.mjs';
+import { showWorkspaceToast } from './toast.mjs';
+import { cardTitle } from './images-state.mjs';
+
+const MANUAL_HELP = 'Comma-separated. Generated suggestions are added only after you approve them.';
+const SCOPE_NOTE = 'Tags belong to this image. Resolve its prompt association separately in Needs review.';
+// The option inputs per controller key; the classifier keys only exist for WD14 models.
+const OPTION_IDS = Object.freeze({
+    general_threshold: 'image-general-threshold',
+    character_threshold: 'image-character-threshold',
+    instructions: 'image-tag-instructions',
+    suggestion_limit: 'image-suggestion-limit',
+});
+
+function el(tag, text, className) {
+    const node = document.createElement(tag);
+    if (text !== undefined) node.textContent = text;
+    if (className) node.className = className;
+    return node;
+}
+function setText(node, text) {
+    if (node.textContent !== text) node.textContent = text;
+}
+function setDisabled(button, disabled) {
+    if (disabled) button.setAttribute('aria-disabled', 'true');
+    else button.removeAttribute('aria-disabled');
+}
+const disabled = button => button.getAttribute('aria-disabled') === 'true';
+
+const savedListeners = new Set();
+/** Run `listener({target, filename, tags})` after every confirmed tag save; returns the unsubscribe. */
+export function onImageTagsSaved(listener) {
+    if (typeof listener !== 'function') throw new TypeError('A listener function is required');
+    savedListeners.add(listener);
+    return () => savedListeners.delete(listener);
+}
+/** How many pages follow tag saves (a mounted page's subscription ends with its scope). */
+export function imageTagsListenerCount() {
+    return savedListeners.size;
+}
+function announceSaved(event) {
+    for (const listener of [...savedListeners]) {
+        try {
+            listener(event);
+        } catch (error) {
+            // One page's refresh failure never stops the others.
+            console.error('Image tag listener failed', error);
+        }
+    }
+}
+
+const tagButtons = new WeakSet();
+/** The concept card's Tag beside Info (app.js mediaCard a398), for Images and every Library-embedded gallery. */
+export function createTagButton(image) {
+    const button = createButton('', 'icon-btn');
+    button.append(createWorkspaceIcon('tagImage'));
+    button.setAttribute('aria-label', `Tag or auto-tag ${image.filename}`);
+    tagButtons.add(button);
+    return button;
+}
+/** Whether `node` is a card's Tag button. */
+export function isTagButton(node) {
+    return tagButtons.has(node);
+}
+
+/** A listed file's tagging identity (`root_index`, `root_scope`, `path`), else null. */
+export function imageTarget(image) {
+    const {root_index: index, root_scope: scope, path} = image ?? {};
+    if (!Number.isSafeInteger(index) || index < 0 || typeof scope !== 'string' || !/^[0-9a-f]{64}$/.test(scope) ||
+        typeof path !== 'string' || !path) return null;
+    return {root_index: index, root_scope: scope, path};
+}
+
+function numberInput(value, {min, max, step}) {
+    const input = el('input');
+    Object.assign(input, {type: 'number', min, max, step});
+    input.value = String(value);
+    return input;
+}
+
+/**
+ * The concept's `.tag-model-panel` (a1049): `heading`, the Tagging model select, the model's options and Generate.
+ * It follows `controller` until `scope` is disposed (reused by the bulk Auto-tag dialog, D85, without Generate:
+ * `generate: false`). Returns the `element`, `validate()` (the fields' native validity, then what the controller would
+ * refuse; true when valid, else the first invalid field reports) and `requestGenerate()`, Generate's own path (field
+ * validity first), for a Retry after a failed Generate.
+ */
+export function renderModelPanel({scope, controller, heading = 'Auto-tag this image', generate: withGenerate = true}) {
+    const panel = el('div', undefined, 'tag-model-panel');
+    const select = el('select');
+    for (const option of MODEL_OPTIONS) {
+        const node = el('option', option.label); // D84
+        node.value = option.id;
+        select.append(node);
+    }
+    const options = el('div');
+    options.id = 'image-tag-model-options';
+    const generate = createButton('', 'ca-primary');
+    generate.append(createWorkspaceIcon('tagImage'), ' Generate suggestions');
+    panel.append(el('h3', heading), field('Tagging model', select, 'image-tag-model'), options);
+    if (withGenerate) panel.append(generate);
+    const inputs = new Map();
+    let shownModel = null, shownOptions = null;
+
+    function renderOptions(state) {
+        inputs.clear();
+        const classifier = MODEL_OPTIONS.find(option => option.id === state.model).classifier;
+        const rows = [];
+        if (classifier) {
+            const pair = el('div', undefined, 'two-col');
+            for (const [key, label] of [['general_threshold', 'General confidence'], ['character_threshold', 'Character confidence']]) {
+                const input = numberInput(state.options[key], {min: '0', max: '1', step: '0.05'});
+                inputs.set(key, input);
+                pair.append(field(label, input, OPTION_IDS[key]));
+            }
+            rows.push(pair);
+        } else {
+            const area = el('textarea');
+            area.value = state.options.instructions;
+            inputs.set('instructions', area);
+            rows.push(field('Tagging instructions', area, OPTION_IDS.instructions));
+        }
+        // D91: the number of suggestions, for every model.
+        const count = numberInput(state.options.suggestion_limit, {min: '1', max: '100', step: '1'});
+        inputs.set('suggestion_limit', count);
+        rows.push(field('Suggestions', count, OPTION_IDS.suggestion_limit));
+        options.replaceChildren(...rows);
+        for (const [key, input] of inputs) {
+            input.addEventListener('input', () => {
+                input.setCustomValidity('');
+                controller.setOption(key, input.value);
+            });
+        }
+    }
+    function update(state) {
+        // A model change or the observation's server defaults rewrite the fields; typing never does (I1).
+        if (state.model !== shownModel || state.optionsRevision !== shownOptions) {
+            shownModel = state.model;
+            shownOptions = state.optionsRevision;
+            select.value = state.model;
+            renderOptions(state);
+        }
+        setDisabled(generate, !state.canGenerate);
+    }
+    select.addEventListener('change', () => controller.setModel(select.value));
+    function validate() {
+        const {state} = controller;
+        // The concept's native validity first (a1104–1114), then what the controller would refuse (a blank field).
+        for (const input of inputs.values()) input.setCustomValidity('');
+        const invalid = [...inputs.values()].find(input => !input.checkValidity());
+        if (invalid) { invalid.reportValidity(); return false; }
+        const error = optionError(state.model, state.options);
+        if (error) {
+            const input = inputs.get(error.field);
+            input.setCustomValidity(error.message);
+            input.reportValidity();
+            return false;
+        }
+        return true;
+    }
+    function requestGenerate() {
+        if (controller.state.canGenerate && validate()) controller.generate();
+    }
+    generate.addEventListener('click', () => { if (!disabled(generate)) requestGenerate(); });
+    scope.cleanup(controller.subscribe(update));
+    update(controller.state);
+    return {element: panel, requestGenerate, validate};
+}
+
+function previewOf(image, state) {
+    const video = state?.image ? state.image.mediaType === 'video' : image?.is_video === true;
+    const node = el(video ? 'video' : 'img', undefined, 'tag-image-preview');
+    if (video) { node.muted = true; node.preload = 'metadata'; node.playsInline = true; }
+    return node;
+}
+
+/**
+ * Open "Tag image" for one listed `image` (its tagging target). `source` is the page (`images`, `library`, `review`,
+ * `tags`, `bulk`); `onSaved(event)` runs after a confirmed save, as every `onImageTagsSaved` listener does.
+ *
+ * D90 (the bulk review session, `images-tagging-review.mjs`): `actions: 'review'` with `position: {index, total}`
+ * titles the dialog "Tag image · Image <index> of <total>" and makes its actions Stop reviewing, Skip and Approve and
+ * next (Approve and finish on the last image). `preset` ({model, options}) applies the session's model and options,
+ * and `autoGenerate` runs Generate as soon as the file is observed. Approve saves as Save does, without the per-image
+ * toast (the session toasts its count), and calls `onSaved`; Skip writes nothing and calls `onSkip`; Stop reviewing,
+ * Escape and × write nothing and call `onStop` once. Swapping the next image's dialog in is not a stop.
+ */
+export function openImageTagging({api, scope, image, source = 'images', trigger = null, onSaved = null, preset = null,
+    autoGenerate = false, actions: mode = 'tag', position = null, onSkip = null, onStop = null}) {
+    const target = imageTarget(image);
+    if (!target) throw new TypeError('The image has no tagging target');
+    const review = mode === 'review';
+    if (review && !(Number.isSafeInteger(position?.index) && Number.isSafeInteger(position?.total) &&
+        position.index >= 1 && position.index <= position.total)) throw new TypeError('A review needs its position');
+    // Set once this dialog hands over to the session (Approve, Skip): its close is then not a Stop.
+    let advancing = false;
+    const saved = ({filename: name, tags, toast}) => {
+        const event = {target, filename: name, tags, source};
+        announceSaved(event);
+        if (toast) showWorkspaceToast(toast);
+        onSaved?.(event);
+    };
+    // A save that settles after the dialog closed is still reported: its toast, and the pages' refresh (I5).
+    const onLateSave = outcome => (outcome.saved ? saved(outcome) : showWorkspaceToast(outcome.message));
+    const controller = createImageTaggingController({api, target, source, onLateSave, preset});
+    const local = createScope();
+    let open = true;
+    let completed = false;
+    const {resolveUrl} = window.ApiClient;
+
+    // 2. The heading: preview, title, filename and size; the listing's values until the capture answers.
+    const heading = el('div', undefined, 'tag-image-heading');
+    let preview = previewOf(image, null);
+    const copy = el('div');
+    const title = el('h3', cardTitle(image));
+    const filename = el('p', image.filename, 'small');
+    const size = el('span', undefined, 'chip');
+    copy.append(title, filename, size);
+    heading.append(preview, copy);
+    const hasSize = (width, height) => [width, height].every(value => Number.isFinite(value) && value > 0);
+    if (hasSize(image.width, image.height)) size.textContent = `${image.width} × ${image.height}`;
+    else size.remove();
+
+    // 4. The manual field.
+    const manual = el('input');
+    manual.setAttribute('aria-describedby', 'manual-tags-help');
+    const help = el('p', MANUAL_HELP, 'small');
+    help.id = 'manual-tags-help';
+    const manualField = field('Image tags · edit manually', manual, 'manual-image-tags');
+    manualField.append(help);
+    manual.addEventListener('input', () => controller.setManual(manual.value));
+
+    // 5. The model panel; 6. the suggestions.
+    const {element: panel, requestGenerate} = renderModelPanel({scope: local, controller});
+    const suggestions = el('section', undefined, 'tag-suggestion-panel');
+    suggestions.setAttribute('aria-labelledby', 'tag-suggestions-title');
+    const panelHeading = el('div', undefined, 'panel-heading');
+    const suggestionsTitle = el('h3', 'Review suggestions');
+    suggestionsTitle.id = 'tag-suggestions-title';
+    const count = el('span', 'Not generated', 'small');
+    count.id = 'suggestion-count';
+    panelHeading.append(suggestionsTitle, count);
+    const list = el('div');
+    list.id = 'tag-suggestions';
+    const status = el('div', undefined, 'small');
+    status.id = 'tag-generation-status';
+    status.setAttribute('role', 'status');
+    suggestions.append(panelHeading, list, status);
+
+    // 7. The actions; Retry leads them only while the controller allows it.
+    const actions = el('div', undefined, 'dialog-actions');
+    const retry = createButton('Retry');
+    const cancel = createButton(review ? 'Stop reviewing' : 'Cancel'); // D90
+    const skip = createButton('Skip');
+    const primary = createButton('Save manual tags', 'ca-primary');
+    const last = review && position.index === position.total;
+    // D90: Approve with suggestions on screen; after a model change cleared them (M2) Save keeps only the manual field.
+    const reviewLabel = state => (state.generated ? (last ? 'Approve and finish' : 'Approve and next')
+        : (last ? 'Save and finish' : 'Save and next'));
+    if (review) actions.append(cancel, skip, primary);
+    else actions.append(cancel, primary);
+
+    const nodes = [heading];
+    if (controller.state.showScopeNote) nodes.push(el('p', SCOPE_NOTE, 'tag-scope-note small'));
+    nodes.push(manualField, panel, suggestions, actions);
+
+    let shownImage = null, shownRows = null, shownText = null, shownDraft = 0;
+    function renderImage(info) {
+        shownImage = info;
+        const next = previewOf(null, {image: info});
+        if (next.tagName !== preview.tagName) { preview.replaceWith(next); preview = next; }
+        title.textContent = info.title || info.filename;
+        filename.textContent = info.filename;
+        preview.alt = title.textContent;
+        if (info.width && info.height) { preview.width = info.width; preview.height = info.height; }
+        preview.src = resolveUrl(info.previewUrl);
+        if (info.dimensions) { size.textContent = info.dimensions; if (!size.isConnected) copy.append(size); }
+        else size.remove();
+    }
+    function renderSuggestions(state) {
+        // A removed chip's focus moves to its neighbour's ×, else to Generate.
+        const focused = list.contains(document.activeElement) ? [...list.querySelectorAll('button')].indexOf(document.activeElement) : -1;
+        shownRows = state.suggestions;
+        shownText = state.suggestionsText;
+        if (!state.suggestions.length) {
+            list.replaceChildren(el('p', state.suggestionsText, 'small'));
+        } else {
+            // D83: removable chips instead of the concept's checkbox rows, under ruling T4's instruction.
+            const chips = el('div', undefined, 'tags');
+            for (const row of state.suggestions) {
+                const chip = el('span', undefined, 'chip tag-suggestion');
+                const remove = createButton('×');
+                remove.setAttribute('aria-label', `Remove ${row.name}`);
+                remove.addEventListener('click', () => controller.remove(row.name));
+                chip.append(el('span', row.name), el('span', row.label, 'tag-confidence'), remove);
+                chips.append(chip);
+            }
+            list.replaceChildren(el('p', state.chipHint, 'small'), chips);
+        }
+        if (focused >= 0) {
+            const buttons = [...list.querySelectorAll('button')];
+            (buttons[Math.min(focused, buttons.length - 1)] ?? panel.querySelector('.ca-primary')).focus();
+        }
+    }
+    function complete(state) {
+        completed = true;
+        if (review) {
+            // D90: the session swaps the next image in (or ends), so this dialog is not closed here.
+            advancing = true;
+            saved({filename: state.image.filename, tags: state.savedTags.slice(), toast: null});
+            return;
+        }
+        closeWorkspaceDialog();
+        saved({filename: state.image.filename, tags: state.savedTags.slice(), toast: state.toast});
+    }
+    function render(state) {
+        if (!open || completed) return;
+        if (state.image && state.image !== shownImage) renderImage(state.image);
+        // The observation's saved tags, a kept draft, or a conflict's current set ahead of the draft (I2).
+        if (state.draftRevision !== shownDraft) {
+            shownDraft = state.draftRevision;
+            if (manual.value !== state.manual) manual.value = state.manual;
+        }
+        if (state.suggestions !== shownRows || state.suggestionsText !== shownText) renderSuggestions(state);
+        setText(count, state.countText);
+        setText(status, state.statusText);
+        setText(primary, review ? reviewLabel(state) : state.primaryLabel);
+        setDisabled(primary, !state.canSave);
+        // D90: while Approve's save is in flight the session cannot be left, so its count includes that save.
+        if (review) for (const button of [skip, cancel]) setDisabled(button, state.phase === 'saving');
+        if (state.canRetry !== retry.isConnected) {
+            if (state.canRetry) actions.prepend(retry); // D116
+            else {
+                if (document.activeElement === retry) primary.focus();
+                retry.remove();
+            }
+        }
+        if (state.phase === 'saved') complete(state);
+    }
+
+    cancel.addEventListener('click', () => { if (!disabled(cancel)) closeWorkspaceDialog(); });
+    skip.addEventListener('click', () => {
+        if (!open || advancing || disabled(skip)) return;
+        advancing = true;
+        onSkip?.();
+    });
+    // Retry after a failed Generate takes Generate's own path, so an invalid field reports its validity (M4).
+    retry.addEventListener('click', () => (controller.state.phase === 'generate-error' ? requestGenerate() : controller.retry()));
+    primary.addEventListener('click', () => {
+        if (disabled(primary) || !controller.state.canSave) return;
+        controller.save();
+    });
+    // Leaving the page closes the dialog, so a page restored from the back/forward cache shows no dead dialog (I4).
+    const pagehide = () => { if (open) closeWorkspaceDialog(); };
+    window.addEventListener('pagehide', pagehide);
+
+    function release() {
+        if (!open) return;
+        open = false;
+        window.removeEventListener('pagehide', pagehide);
+        document.getElementById('modal')?.classList.remove('tagging-modal');
+        local.dispose();
+        controller.dispose();
+        if (review && !advancing) onStop?.();
+    }
+    const dialogTitle = review ? `Tag image · Image ${position.index} of ${position.total}` : 'Tag image'; // D90
+    openContentDialog({scope, title: dialogTitle, nodes, trigger, onClose: release,
+        canClose: review ? () => controller.state.phase !== 'saving' : null});
+    document.getElementById('modal')?.classList.add('tagging-modal');
+    local.cleanup(controller.subscribe(render));
+    render(controller.state);
+    controller.open().then(() => {
+        if (open && autoGenerate && controller.state.canGenerate) controller.generate();
+    });
+    return {
+        close() { if (open) closeWorkspaceDialog(); },
+        get controller() { return controller; },
+    };
+}

web/js/workspace/images-favorites.mjs

@@ -0,0 +1,81 @@
+/**
+ * The media card's star (#249 D7 = A: the concept's `actions.favorite` against the favorites store), for the Images
+ * page and every Library-embedded gallery (PR E). Its toasts are the concept's without the demo's "in this tab"; the
+ * concept has no failure copy, so a failure follows the workspace "could not be …" pattern.
+ *
+ * One favorite request per file at a time (TESTING.md): the requests outlive the page that sent them, so the keys in
+ * flight and the pages that receive each answer live here. Extracted from images.mjs unchanged.
+ */
+import { imageKey } from './images-state.mjs';
+import { showWorkspaceToast } from './toast.mjs';
+
+const FAVORITE_URL = '/prompt_manager/images/favorite';
+const FAVORITE_DONE = Object.freeze({true:'Added to favorites.', false:'Removed from favorites.'});
+const FAVORITE_FAILED = Object.freeze({true:'Favorite could not be added. Try again.', false:'Favorite could not be removed. Try again.'});
+
+const favoritePending = new Set();
+let pageTarget = null;
+// Library-embedded galleries showing media cards; keyed like the Images page, so each repaints its own copy.
+const embeddedTargets = new Set();
+let visitTarget = () => {};
+// Told after every confirmed favorite change, wherever it was made (the shell's Favorites count, #249 D51).
+const favoriteListeners = new Set();
+
+/** Run `listener()` after each confirmed favorite change; returns the unsubscribe. */
+export function onFavoriteChange(listener) {
+    favoriteListeners.add(listener);
+    return () => favoriteListeners.delete(listener);
+}
+/** Whether the favorite request of the file `key` is still in flight. */
+export function favoriteBusy(key) {
+    return favoritePending.has(key);
+}
+/** `target(key, favorite)` patches the saved Images visit while no Images page is mounted. */
+export function setFavoriteVisitTarget(target) {
+    visitTarget = target;
+}
+/** Receive favorite states with `setFavorite(key, favorite)` until `scope` ends: the Images page or an embedded gallery. */
+export function receiveFavorites({scope, embedded, setFavorite}) {
+    if (!embedded) {
+        pageTarget = setFavorite;
+        scope.cleanup(() => { if (pageTarget === setFavorite) pageTarget = null; });
+    } else {
+        embeddedTargets.add(setFavorite);
+        scope.cleanup(() => embeddedTargets.delete(setFavorite));
+    }
+}
+/** Give a favorite state to the mounted Images page, else the saved visit, and to every embedded gallery. */
+function deliver(key, favorite) {
+    if (pageTarget) pageTarget(key, favorite);
+    else visitTarget(key, favorite);
+    for (const target of embeddedTargets) target(key, favorite);
+}
+
+/** A star whose request is still in flight is marked busy: pressing it again does nothing until the answer. */
+export function paintStar(button, favorite, pending) {
+    button.textContent = favorite ? '★' : '☆';
+    button.setAttribute('aria-pressed', String(favorite));
+    if (pending) button.setAttribute('aria-disabled', 'true'); else button.removeAttribute('aria-disabled');
+}
+
+/** Optimistic toggle: the star changes at once and returns to its previous state if the store refuses. */
+export async function toggleFavorite(api, image) {
+    const key = imageKey(image);
+    if (favoritePending.has(key)) return;
+    const favorite = !image.favorite;
+    favoritePending.add(key);
+    deliver(key, favorite);
+    const body = {root_index: image.root_index, path: image.path};
+    let saved = false;
+    try {
+        await (favorite ? api.put(FAVORITE_URL, body) : api.del(FAVORITE_URL, {body}));
+        saved = true;
+    } catch {
+        // Announced below; the star returns to its previous state.
+    }
+    favoritePending.delete(key);
+    deliver(key, saved ? favorite : !favorite);
+    showWorkspaceToast(saved ? FAVORITE_DONE[favorite] : FAVORITE_FAILED[favorite]);
+    // On Favorites an unstarred card stays (with ☆) until the next load, so the star can be undone in place (D51).
+    if (saved) for (const listener of favoriteListeners) listener();
+}

web/js/workspace/images-selection.mjs

@@ -4,6 +4,7 @@ import { inspectPath, toInspectionRecord } from './inspection-state.mjs';
 import { BUNDLE_FILENAME, metadataBundle, collectImagesMetadata, exportOutcome } from './images-export.mjs';
 import { CATEGORY_DIALOG, CATEGORY_FAILED, CATEGORY_MAX_LENGTH, CATEGORY_NONE_LINKED, categoryOutcome, categoryTargets, updatedCount } from './images-category.mjs';
 import { openInputDialog } from './workspace-dialogs.mjs';
+import { openAddTags, openAutoTag } from './images-tagging-bulk.mjs';
 import { showWorkspaceToast } from './toast.mjs';
 
 const CHECKBOX = '.image-overlays input[type="checkbox"]';
@@ -25,8 +26,12 @@ function el(tag, text, className) {
  * - `getItems()` is the listing in its order; `checked` restores a saved visit's selection.
  * - `onCategorySet()` reloads the categories and the listing after a successful Set category (the reload clears the
  *   selection through `clear`); focus then moves to `focusFallback` if it was on the hidden action.
+ * - `retain(kept)` drops the checked files a refreshed listing no longer holds (a tag save under a filter, I7).
+ * - With the Activity store `activity`, Add tags and Auto-tag selected (D85) follow the count, as the concept's Add tags
+ *   leads its actions; `onTagged(keys)` re-reads the files a finished tagging job tagged. The selection stays.
  */
-export function mountSelectionBar({ scope, api, grid, getItems, focusFallback, onCategorySet, checked: initial = Object.freeze(new Set()) }) {
+export function mountSelectionBar({ scope, api, grid, getItems, focusFallback, onCategorySet, activity = null, onTagged,
+    checked: initial = Object.freeze(new Set()) }) {
     let checked = initial;
     let exporting = false, categorizing = false;
     const element = el('div');
@@ -39,7 +44,15 @@ export function mountSelectionBar({ scope, api, grid, getItems, focusFallback, o
     const clearButton = createButton('Clear');
     // Clear hides the bar it sits in, so focus moves to the page heading instead of falling to the page.
     scope.listen(clearButton, 'click', () => { clear(); focusFallback.focus({ preventScroll: true }); });
-    bulk.append(count, setCategory, exportMetadata, clearButton);
+    bulk.append(count);
+    if (activity) {
+        const addTags = createButton('Add tags');
+        scope.listen(addTags, 'click', () => openAddTags({ scope, store: activity, images: checkedImages(), trigger: addTags, onTagged }));
+        const autoTag = createButton('Auto-tag selected'); // D85
+        scope.listen(autoTag, 'click', () => openAutoTag({ api, scope, store: activity, images: checkedImages(), trigger: autoTag, onTagged }));
+        bulk.append(addTags, autoTag);
+    }
+    bulk.append(setCategory, exportMetadata, clearButton);
 
     /** The count updates in place: the same bar and `strong`, its text written only when it changes. */
     function render() {
@@ -54,6 +67,13 @@ export function mountSelectionBar({ scope, api, grid, getItems, focusFallback, o
         for (const box of grid.querySelectorAll(CHECKBOX)) box.checked = false;
         render();
     }
+    /** Keep only the checked files `kept(key)` still lists (a refreshed result), so the count is what the actions apply to. */
+    function retain(kept) {
+        const next = [...checked].filter(kept);
+        if (next.length === checked.size) return;
+        checked = Object.freeze(new Set(next));
+        render();
+    }
     function checkedImages() {
         return getItems().filter(image => checked.has(imageKey(image)));
     }
@@ -142,6 +162,7 @@ export function mountSelectionBar({ scope, api, grid, getItems, focusFallback, o
         isChecked: key => checked.has(key),
         checked: () => checked,
         clear,
+        retain,
         /** Whether a Set category write is still in flight. */
         writing: () => categorizing,
     };

web/js/workspace/images-state.mjs

@@ -9,6 +9,8 @@ export function imageKey(image) {
 export const IMAGE_SORTS = Object.freeze(['newest', 'oldest', 'name', 'name-desc', 'rating']);
 
 const isCount = value => Number.isSafeInteger(value) && value >= 0;
+// The largest page a refresh asks for (the listing clamps at 500).
+const REFRESH_PAGE_LIMIT = 200;
 
 function queryFor(filters, batchSize) {
     const query = new URLSearchParams({ mode: 'workspace', limit: String(batchSize) });
@@ -110,8 +112,13 @@ export function createImageStream({ api, onChange = () => {}, batchSize = 40, re
         onChange(state);
     }
 
+    // A refresh in flight (its abort controller): Load more waits for it, a reset or dispose cancels it. A refresh
+    // asked while a page loads is pending and runs once that page settles (I6).
+    let refreshing = null;
+    let refreshPending = false;
+
     async function loadMore() {
-        if (disposed || state.loading || !state.hasMore) return 0;
+        if (disposed || state.loading || !state.hasMore || refreshing) return 0;
         const request = new AbortController();
         controller = request;
         const cursor = state.cursor;
@@ -145,14 +152,73 @@ export function createImageStream({ api, onChange = () => {}, batchSize = 40, re
                 publish({ loading: false, error });
             }
             return 0;
+        } finally {
+            runPendingRefresh(request);
         }
     }
+    function runPendingRefresh(request) {
+        // Only the page this load owned: a reset or dispose already dropped the pending refresh.
+        if (disposed || !refreshPending || state.loading || request.signal.aborted) return;
+        refreshPending = false;
+        // A failure is the page's to report on the refresh it asked for; here it has no caller left.
+        refresh().catch(() => {});
+    }
+
+    /**
+     * Re-read the loaded range of the same query (a write may have changed which files match) and publish the new
+     * collection once, with the hint `{replaced: true}`; the current items stay shown until then. Pages are as large
+     * as the rest of the range (at most REFRESH_PAGE_LIMIT, at least one batch), read one after another (each page's
+     * cursor comes from the one before). A read failure rejects and leaves the collection as it was; a reset or a
+     * dispose abandons it. Resolves to the number of items now loaded (0 when abandoned, or deferred behind a page
+     * load in flight, which runs it once settled).
+     */
+    async function refresh() {
+        if (disposed) return 0;
+        if (state.loading) { refreshPending = true; return 0; }
+        refreshing?.abort();
+        const request = refreshing = new AbortController();
+        const target = Math.max(state.loaded, 1);
+        const items = [], keys = new Set();
+        let cursor = null, total = 0, hasMore = true, positiveCount = null;
+        try {
+            while (items.length < target && hasMore) {
+                const parameters = new URLSearchParams(query);
+                parameters.set('limit', String(Math.min(REFRESH_PAGE_LIMIT, Math.max(target - items.length, batchSize))));
+                if (cursor !== null) parameters.set('cursor', cursor);
+                const page = await readPage({parameters, signal:request.signal});
+                if (disposed || request !== refreshing) return 0;
+                validatePage(page, cursor);
+                for (const item of page.images) {
+                    const key = imageKey(item);
+                    if (keys.has(key)) continue;
+                    keys.add(key);
+                    items.push(Object.freeze({ ...item }));
+                }
+                if (cursor === null) positiveCount = isCount(page.positive_count) ? page.positive_count : null;
+                ({total, next_cursor: cursor, has_more: hasMore} = page);
+            }
+        } catch (error) {
+            // A newer refresh, a reset or a dispose replaced this one (and aborted it): nothing to report.
+            if (request !== refreshing) return 0;
+            refreshing = null;
+            throw error;
+        }
+        refreshing = null;
+        seen = keys;
+        state = Object.freeze({ ...state, items: Object.freeze(items), total, cursor, hasMore, loading: false, error: null,
+            loaded: items.length, positiveCount });
+        onChange(state, {replaced: true});
+        return items.length;
+    }
 
     async function reset(filters = {}, {load = true} = {}) {
         if (disposed) return 0;
         const nextQuery = queryFor(filters, batchSize);
         controller?.abort();
         controller = null;
+        refreshing?.abort();
+        refreshing = null;
+        refreshPending = false;
         query = nextQuery;
         seen = new Set();
         publish({ items: Object.freeze([]), total: 0, cursor: null, hasMore: true,
@@ -164,6 +230,9 @@ export function createImageStream({ api, onChange = () => {}, batchSize = 40, re
         get state() { return state; },
         reset,
         loadMore,
+        refresh,
+        /** Whether a refresh is re-reading the loaded range (Load more waits for it). */
+        get refreshing() { return refreshing !== null; },
         /** Patch one loaded item (a favorite toggle); false when it is not loaded or the stream is gone. */
         updateItem(key, patch) {
             const next = withItem(state, key, patch);
@@ -176,8 +245,11 @@ export function createImageStream({ api, onChange = () => {}, batchSize = 40, re
         dispose() {
             if (disposed) return;
             disposed = true;
+            refreshPending = false;
             controller?.abort();
             controller = null;
+            refreshing?.abort();
+            refreshing = null;
         },
     };
 }