Merge remote-tracking branch 'origin/main' into feat/492-delete-archived

Its only action is a permanent delete, so focus starts on Cancel
(openReviewDialog's focusCancel); the spec also pins that the copy says
the delete cannot be undone and removes the prompt's saved pairs.

.github/workflows/portability.yml

@@ -1,9 +1,9 @@
-name: Windows
+name: Windows and macOS
 
 permissions:
   contents: read
 
-# Non-blocking Windows runs (#420; macOS dropped from CI in #571): never on pull requests or in the merge queue, and no context
+# Non-blocking portability runs (#420): never on pull requests or in the merge queue, and no context
 # here is a required check. A red run is fixed at its cause before the workspace cutover (#334).
 on:
   push:
@@ -25,10 +25,10 @@ env:
 # run counts (tests/vendor/ci-workflow.test.mjs recomputes it, #493).
 # Measured 2026-10-29 on main runs 40935337099 (dd247e3), 40938407252 (dd247e3), 40941240624 (dd247e3):
 #   slowest leg: 7m24s (py3.12 windows) / 7m31s (py3.13 windows) / 7m32s (py3.14 windows) -> 15 min
-#     (windows 4m56s-7m32s)
-#   native-trash-linux (#543) has no green main runs yet: it installs the dev requirements and runs
-#     one test module, about 1 minute by the same estimate, so ceil(1.5 x 2) + 3 gives it 6 minutes.
-#     Recalibrate after three green runs.
+#     (windows 4m56s-7m32s, macos 4m39s-6m14s)
+#   native-trash (#499) has no green main runs yet: its probe, run 40949370943 (2026-10-29), took
+#     about 1 minute per macOS leg, so ceil(1.5 x 2) + 3 gives it 6 minutes (step 4). Recalibrate
+#     after three green runs.
 jobs:
   test:
     name: py${{ matrix.python-version }} on ${{ matrix.os }}
@@ -37,7 +37,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [windows-latest]
+        os: [windows-latest, macos-latest]
         python-version: ["3.12", "3.13", "3.14"]
 
     steps:
@@ -57,7 +57,7 @@ jobs:
 
       # The runner's TEMP is on C:, the OS disk, where a flush took about 6 ms
       # and a test database's create-to-delete about 111 ms; on the D: work
-      # disk the same took 0.5 ms and 23 ms. Tests write their
+      # disk the same took 0.5 ms and 23 ms (macOS: 19 ms). Tests write their
       # databases under TEMP, so it moves to a folder on D: (measured in #487,
       # run 40915866444). The runner's TEMP was an 8.3 short name
       # (C:\Users\RUNNER~1\...), so the new one is spelled by its short name too
@@ -80,12 +80,16 @@ jobs:
           PM_TEST_SLOWEST: "40"
         run: python -m tests.run_suite -v
 
-  # The same tests as the fake mount table, on a real ext4 mount used as the output root (#543). A
-  # runner can mount with sudo; the tests run as the normal user, so owner and mode checks are real.
-  native-trash-linux:
-    name: native trash on a real mount
-    runs-on: ubuntu-latest
+  # The real Trash on both macOS CPUs (#499 design §10.2). It runs apart from the suite, so a red
+  # suite never skips the native proof.
+  native-trash:
+    name: native trash on ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
     timeout-minutes: 6
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-latest, macos-15-intel]
 
     steps:
       - uses: actions/checkout@v7
@@ -94,24 +98,9 @@ jobs:
         uses: actions/setup-python@v7
         with:
           python-version: "3.12"
-          cache: pip
-          cache-dependency-path: requirements-dev.txt
-
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          pip install -r requirements-dev.txt
-
-      - name: Mount an ext4 image
-        run: |
-          truncate -s 64M "$RUNNER_TEMP/drive.img"
-          mkfs.ext4 -q "$RUNNER_TEMP/drive.img"
-          mkdir "$RUNNER_TEMP/drive"
-          sudo mount -o loop "$RUNNER_TEMP/drive.img" "$RUNNER_TEMP/drive"
-          sudo rmdir "$RUNNER_TEMP/drive/lost+found"
-          sudo chown "$(id -u):$(id -g)" "$RUNNER_TEMP/drive"
-          findmnt "$RUNNER_TEMP/drive"
 
       - name: Native trash proof
         timeout-minutes: 4
-        run: PM_TRASH_MOUNT="$RUNNER_TEMP/drive" python -m unittest tests.test_trash_mount_root -v
+        env:
+          PM_NATIVE_TRASH: macos
+        run: python -m unittest tests.test_trash_macos_native tests.test_trash_macos -v

.github/workflows/test.yml

@@ -28,7 +28,7 @@ env:
 #   py matrix, slowest py3.10 on windows-latest: 12m43s / 15m54s / 14m53s -> 27 min
 #     (ubuntu 5m27s-6m27s, macos 6m14s-8m30s, windows 11m42s-15m54s)
 #     3.10 and 3.11 left the matrix and 3.14 joined it in #356; re-measure after three green main runs.
-#     Windows moved to portability.yml (#420; macOS left CI in #571), which has its own measured limit (#493);
+#     Windows and macOS moved to portability.yml (#420), which has its own measured limit (#493);
 #     this Linux-only matrix keeps 27 minutes until it is re-measured.
 #   real ComfyUI compatibility: 13m32s / 8m55s / 11m46s -> 24 min
 #   coverage gate (85%): 7m26s / 7m22s / 7m54s -> 15 min
@@ -39,7 +39,7 @@ env:
 # Pull requests run a fast subset (#420): Python 3.12 on ubuntu-latest, coverage, lint and frontend
 # modules. The merge queue (merge_group), pushes to main and manual runs add Python 3.13 and 3.14 on
 # Linux and the real ComfyUI job. "all tests" is the required gate that holds the queue to that set.
-# Windows runs in portability.yml (push to main, nightly, on demand) and never gate a merge.
+# Windows and macOS run in portability.yml (push to main, nightly, on demand) and never gate a merge.
 jobs:
   test:
     name: py${{ matrix.python-version }} on ${{ matrix.os }}

.github/workflows/viewerjs-check.yml

@@ -41,13 +41,9 @@ concurrency:
 # 7.3m-12.2m), because --shard splits by test count and the slow concept specs sort into shard 1. The page
 # workflows now run in three shards per browser with the limits unchanged; the per-shard times are
 # re-measured after three green main runs.
-# #563: coverage shards reached their 18-minute step limit three times on 2026-10-31 with no failing
-# test (PR #560 shard 2/3: 814 passed in 17.9m; queue run 41206495451 shard 1/3: 827 passed; PR #564
-# shard 2/3 twice), against recent green shards of 11m-17m. Coverage now runs in four shards with the
-# limits unchanged; the per-shard times are re-measured after three green main runs.
 jobs:
   frontend-coverage:
-    name: frontend coverage (shard ${{ matrix.shard }}/4)
+    name: frontend coverage (shard ${{ matrix.shard }}/3)
     runs-on: ubuntu-latest
     # Layout comparisons depend on the fonts each browser falls back to, so browser jobs run in the
     # same pinned Playwright image as local runs (tag = @playwright/test in tools/vendor/package-lock.json;
@@ -63,7 +59,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        shard: [1, 2, 3, 4]
+        shard: [1, 2, 3]
     steps:
       - uses: actions/checkout@v7
       # The image's own Python 3.12 and Node 24: setup-python/setup-node install the runner's toolcache
@@ -92,13 +88,13 @@ jobs:
       - run: npm ci --prefix tools/vendor --ignore-scripts
       # Shard 1 also runs the node units and the viewer suite, so the vendor pins and the tooling tests
       # run on the lightest shard instead.
-      - if: matrix.shard == 4
+      - if: matrix.shard == 3
         run: npm run --prefix tools/vendor check
-      - if: matrix.shard == 4
+      - if: matrix.shard == 3
         run: npm run --prefix tools/vendor test
-      - name: Page workflows with coverage, shard ${{ matrix.shard }}/4
+      - name: Page workflows with coverage, shard ${{ matrix.shard }}/3
         timeout-minutes: 18
-        run: npm run --prefix tools/vendor test:coverage:shard -- ${{ matrix.shard }}/4
+        run: npm run --prefix tools/vendor test:coverage:shard -- ${{ matrix.shard }}/3
       - name: Upload raw coverage
         uses: actions/upload-artifact@v7
         with:
@@ -140,13 +136,13 @@ jobs:
         with:
           pattern: coverage-raw-*
           path: ${{ runner.temp }}/coverage-raw
-      # coverage:merge only checks that raw files exist; merging three of four shards would report
+      # coverage:merge only checks that raw files exist; merging two of three shards would report
       # partial coverage, so a missing or empty shard artifact fails here.
       - name: Verify every shard's raw coverage arrived
         shell: bash
         env:
           STAGED_RAW: ${{ runner.temp }}/coverage-raw
-          EXPECTED_SHARDS: 4
+          EXPECTED_SHARDS: 3
         run: |
           found=0
           for shard in $(seq 1 "$EXPECTED_SHARDS"); do

TESTING.md

@@ -74,14 +74,14 @@ V8 files it writes under `coverage/js/raw`:
 
 ```sh
 PM_TEST_WORKERS=8 npm run --prefix tools/vendor test:coverage            # whole run, one report
-npm run --prefix tools/vendor test:coverage:shard -- 1/4                 # node units, viewer suite, workflows 1/4
-npm run --prefix tools/vendor test:coverage:shard -- 2/4                 # workflows 2/4 (likewise 3/4, 4/4)
+npm run --prefix tools/vendor test:coverage:shard -- 1/3                 # node units, viewer suite, workflows 1/3
+npm run --prefix tools/vendor test:coverage:shard -- 2/3                 # workflows 2/3 (likewise 3/3)
 npm run --prefix tools/vendor coverage:merge                             # report and baseline check of every raw file
 npm run --prefix tools/vendor test:workflows -- --project webkit --shard 2/2
 ```
 
 `coverage:merge` refuses an empty raw directory; it does not count shards, so run
-every shard first (CI's merge job checks all four arrived). Measured on a 32-CPU
+every shard first (CI's merge job checks all three arrived). Measured on a 32-CPU
 machine in the pinned image (2026-10-21): `test:coverage` takes about 5 minutes
 with 8 workers and 24 minutes with 1; all four projects, 8 workers, each test 3
 times (6132 tests), 24 minutes. A CI-sized run (`docker run --cpus=4`,
@@ -189,14 +189,14 @@ check, so run it before pushing a new or deleted frontend file instead of
 waiting for the `frontend coverage` jobs.
 
 The `viewerjs` check runs on every PR, including backend-only changes. It is an
-aggregate job. It requires the four `frontend coverage (shard N/4)` jobs and
+aggregate job. It requires the three `frontend coverage (shard N/3)` jobs and
 `frontend coverage (merge)` to succeed on every event. The four
 `page workflows (firefox|webkit, shard N/2)` jobs run only in the merge queue,
 on `main` and on `workflow_dispatch` (see "Pull requests and the merge queue").
 `viewerjs` requires them to be skipped on a pull request and to succeed
 everywhere else. Any other failed, cancelled or skipped job fails it. Every browser job runs with `PM_TEST_WORKERS: 3` (the public
-runners have 4 vCPUs). Each coverage shard runs `test:coverage:shard -- N/4`
-(shard 1 also runs the node units and the viewer suite, shard 4 the vendor pins
+runners have 4 vCPUs). Each coverage shard runs `test:coverage:shard -- N/3`
+(shard 1 also runs the node units and the viewer suite, shard 3 the vendor pins
 and tooling tests) and uploads its raw V8 files as `coverage-raw-N` (kept 3
 days). The merge job downloads them, fails unless all three arrived with raw
 files and without clashing names, then runs `coverage:merge` (report plus
@@ -261,7 +261,7 @@ the process exits non-zero.
   job fails anyway and the dump is what matters.
 - `PM_TEST_SLOWEST=N` (off by default) lists the N slowest tests after the
   summary, each timed from its `start:` line to the next one like the hang
-  limit. The Windows jobs (`portability.yml`) set it to 40, so every
+  limit. The Windows and macOS jobs (`portability.yml`) set it to 40, so every
   run shows where its time went (#487). The list prints only when the run
   ends: a job GitHub cancels or a watchdog exit prints none, so read the
   timestamps between `start:` lines instead.
@@ -327,7 +327,7 @@ Python 3.13/3.14, real ComfyUI and Firefox/WebKit failures first show up in the
 merge queue, on the merge-group commit rather than the
 pushed one. Find that run with `gh run list --event merge_group --workflow test.yml`
 (or `viewerjs-check.yml`) and match its head branch
-(`gh-readonly-queue/main/pr-<N>-...`). Windows failures show up only
+(`gh-readonly-queue/main/pr-<N>-...`). Windows and macOS failures show up only
 after the merge, in `gh run list --workflow portability.yml`.
 
 Start fixing as soon as a failed log shows the cause, but push the fix only after
@@ -345,16 +345,11 @@ and the time left. The steps, in order:
    monitor's callbacks (Needs review recorder, preview queue, Images listing
    listener).
 2. `ImageMonitor.stop_monitoring` works against one 5 s deadline. Closing the
-   image handler joins the image worker; watchdog's `observer.stop()` and the
-   observer join get what is left, which can be 0 s. `stop()` joins watchdog's
-   emitters without a limit, so it runs on a daemon thread and is waited for
-   only until the deadline; a later stop waits for that same call (#561).
-3. `close_auto_thumbnails(final=True)` stops the preview worker (30 s),
-   kills ffmpeg and shuts the interactive image pool down.
-4. `shutdown_job_pool` (`utils/parallel.py`) cancels the long-lived job pool's
-   queued items and joins its threads (5 s; part `workers`, only when a job
-   used the pool, #523).
-5. `PromptTracker.shutdown` stops the prompt cleanup thread (2 s).
+   image handler joins the image worker; watchdog's `observer.stop()` (not
+   bounded here) and the observer join get what is left, which can be 0 s.
+3. `close_auto_thumbnails(final=True)` stops the preview worker (30 s) and
+   kills ffmpeg.
+4. `PromptTracker.shutdown` stops the prompt cleanup thread (2 s).
 
 A failing step, or a second Ctrl+C, is logged with its traceback and does not
 skip the later steps. A clean run logs one INFO line to PromptManager's log:
@@ -366,15 +361,6 @@ stored, with the parts not reached False, and the `atexit` callback is
 removed: the later steps are skipped, no summary line is logged, and a later
 call returns that result and runs nothing.
 
-The observer is started from a short-lived daemon thread, so every thread it
-creates is a daemon (a thread inherits that flag from the thread that creates
-it). watchdog 7 on Windows starts a plain `threading.Thread` per watch for its
-`ReadDirectoryChangesW` reader; created from ComfyUI's main thread it would not
-be a daemon, and the interpreter waits for every such thread before it runs any
-`atexit` callback, so the teardown would never start (#561).
-`tests/test_package_exit.py` runs a child whose observer does both (a plain
-reader thread, a `stop()` that never returns) and requires its exit.
-
 ComfyUI never runs aiohttp's `on_cleanup` hooks, because it never calls
 `runner.cleanup()`. So `atexit` is the live host's path. It runs on Ctrl+C
 (`main.py` catches `KeyboardInterrupt` and returns) and on a normal exit.
@@ -459,44 +445,12 @@ A hot SQLite read that returns many rows aggregates them into one step
 (`json_group_array`) instead of stepping once per row, so it does not wait for
 the GIL once per row while ComfyUI generates (#354, `get_image_link_matches`).
 
-A metadata read never decodes pixels (#523). Pillow's `PngImageFile.text` loads
-every pixel to reach text chunks after IDAT; the scan (`_extract_comfyui_metadata`)
-and the image monitor (`ComfyUIMetadataExtractor.extract_metadata`) read PNG text
-through `utils/png_text.py`, which runs Pillow's own chunk handlers after the
-first IDAT and seeks over pixel data. The legacy `.text` read is the floor:
-`tests/test_png_text.py` compares both readers on every image under
-`tests/fixtures`, a curated corpus (text after IDAT, zTXt, iTXt, split IDAT, bad
-checksums, truncations, oversized text, APNG) and a seeded fuzz, and asserts that
-neither reader decodes pixels by patching `ImageFile.load`. The only reads that
-differ are files whose pixel data is undecodable or cut short: legacy found
-nothing, the walk keeps the text before the pixels. Animated PNGs still use
-`.text`.
-
-Image work runs on PromptManager's own threads (#523). glibc keeps each thread's
-malloc arena at its high-water mark, so image buffers spread over the default
-executor's threads stay resident. Interactive image work (view previews behind their
-gate, workspace card facts, both inspector routes) runs on the API's fixed
-`pm-image` pool (`IMAGE_POOL_SIZE` 3, `_run_image`, `_map_image`; card facts already
-cached answer without a trip; while the gate's 3 preview writes hold every thread, a
-card or inspector read waits for one of them, by design of the merged pool; after the
-package teardown the pool is not recreated and late calls use the default executor). Jobs (scan metadata and file facts, thumbnail and
-convert jobs, the legacy gallery generation, capture previews) run through
-`map_parallel` on one long-lived `pm-worker` pool of Worker threads, reused between
-jobs; a new Worker threads value replaces it (the teardown also joins a replaced pool
-still finishing), and a call made from a job thread runs inline. After a scan, thumbnail or convert job, or the legacy gallery generation,
-`release_free_memory` (`utils/native_memory.py`) calls glibc's `malloc_trim(0)` once;
-it does nothing on Windows, macOS and musl and never raises. No allocator setting
-changes. `tests/test_image_pools.py` asserts the thread of each read and write and the
-trim; `tests/test_utils_parallel.py` the pool's reuse, resize, nesting and shutdown.
-`tools/perf/memory_drive.py` (manual, Linux, never in CI) measures RSS, heap, threads
-and arenas under the #523 load against the disposable browser test server.
-
 The `perf budget` job in `.github/workflows/test.yml` is the reference
 measurement: `ubuntu-latest`, one Python, no coverage, only the wall-clock tests.
 It runs on every push to `main` and on `workflow_dispatch`, never on pull
 requests, because shared-runner timing must not block a merge. Dispatch it on a
 branch to measure before merging.
-Shared Windows runners do not run them; the structural tests cover
+Shared Windows and macOS runners do not run them; the structural tests cover
 portability. Run it locally with
 `PROMPTMANAGER_PERF_BUDGET=1 python -m unittest tests.test_api_workspace_images.TestWorkspaceImages.test_filter_budget`
 and quote the printed p95 in the PR body.
@@ -692,10 +646,10 @@ Before changing paths, SQLite, streams, restore or cleanup:
   ordinary busy timeout; cross-thread handoffs wait on events with generous
   ceilings, never a short wall clock (#242).
 - Run native Windows CI early for these changes. Pull requests and the merge
-  queue run only Linux, so start Windows on the branch with
+  queue run only Linux, so start Windows and macOS on the branch with
   `gh workflow run portability.yml --ref <branch>`.
-  Include a Windows impact and evidence note in the PR. All three Windows
-  legs in that run, every Linux leg and every applicable
+  Include a Windows impact and evidence note in the PR. All six Windows/macOS
+  combinations in that run, every Linux leg and every applicable
   exact-head check must pass before merge. Portable `ntpath`/`PureWindowsPath`
   controls do not establish native filesystem, locking or cleanup success.
 
@@ -710,11 +664,11 @@ what runs:
 | `py3.13 on ubuntu-latest`, `py3.14 on ubuntu-latest` | not created | run |
 | `real ComfyUI compatibility` | skipped | runs |
 | `coverage gate (85%)`, `black and flake8`, `frontend modules`, `bandit (high severity)` | run | run |
-| `frontend coverage (shard N/4)`, `frontend coverage (merge)` (vendor pins and tooling tests on shard 4) | run | run |
+| `frontend coverage (shard N/3)`, `frontend coverage (merge)` (vendor pins and tooling tests on shard 3) | run | run |
 | `page workflows (firefox\|webkit, shard N/2)` | skipped | run |
 | `all tests`, `viewerjs` (gates) | run | run |
 | `perf budget` | skipped | push and dispatch only (not in the queue) |
-| `py3.12-3.14 on windows-latest` (`portability.yml`) | not run | push to `main`, nightly, `workflow_dispatch` only; never required |
+| `py3.12-3.14 on windows-latest/macos-latest` (`portability.yml`) | not run | push to `main`, nightly, `workflow_dispatch` only; never required |
 
 GitHub has one required set for pull requests and the queue. A job skipped by
 its `if:` reports Success. A dropped matrix leg never reports, so it would stay
@@ -727,9 +681,8 @@ guarantee:
 So a merge group cannot turn green unless all three Linux Python legs, real
 ComfyUI and the four browser shards passed.
 
-Windows (Python 3.12-3.14) is out of the blocking path for now
-(maintainer, 2026-10-28). macOS is not tested in CI (maintainer, 2026-10-31, #571);
-its code stays and support is best-effort. They run in `portability.yml` on every push to `main`,
+Windows and macOS (Python 3.12-3.14) are out of the blocking path for now
+(maintainer, 2026-10-28). They run in `portability.yml` on every push to `main`,
 nightly and on demand, and no context there is required. A red portability run
 is still a failure: fix it at its cause, not by rerunning, and have every one
 green before the workspace cutover (#334). `tests/vendor/ci-workflow.test.mjs` pins the
@@ -810,7 +763,7 @@ filter Images, D21), the six facts, and a footer with "Send to ComfyUI" and
 "Prompt history" only when prompt roles resolved or a link is saved; the sticky panel
 scrolls inside the window. The viewer's details (`#viewer-details`) repeat that
 content without the cover, then "File & provenance" (the honest file facts, the
-`Prompt evidence` line, Download original and, for a listed file, D38's
+`Prompt evidence` line, Download original and, for a listed file, D38's local-only
 "Show in folder" after the Path) and "Workflow & raw metadata" (raw records and their
 two downloads), then the pair send and Prompt history buttons. D22 words an empty
 positive explicitly and makes confirmed prompt text focusable.
@@ -1449,15 +1402,6 @@ seeds two seedless files (`seedless_images` on `/__test__/concept/reset`, with
 Tag) and asserts that every row reserves the tallest footer and that their own footer
 is shorter than the row it reserves.
 
-### Overview counts (#547)
-
-Each Overview card is the count of the page it names: the shell's Library, Images and Tags sidebar counts, one source,
-so a card and its badge cannot differ. `/prompt_manager/stats` is for the legacy page and counts raw rows. A visit re-reads
-the three unless a read is in flight. An unread or failed card shows a dash; Retry re-reads only the failed counts.
-System › Overview's Images metric reads the same shell count (#555), so it, the Overview card and the Images badge show
-one number; its Statistics dialog labels the legacy row counts as "Database records".
-Tests: `tests/js/workspace-state.test.js`, `tests/browser/workspace.spec.mjs`, `tests/comfyui/workspace.spec.mjs`.
-
 ### Images page controls and recorded deviations (#249 PR C)
 
 The Images page renders the concept's DOM with real data. Its controls, top to bottom:
@@ -1622,27 +1566,20 @@ Recorded deviations on this page (spec §8):
 
   | Result | Toast |
   |---|---|
-  | Success | "Opened the folder on the computer running ComfyUI." |
-  | 403 `not-same-origin` | "The folder was not opened: this page's address does not match the server's." |
-  | 501 `unavailable` | "No file manager is available on the computer running ComfyUI." |
+  | Success | "Opened the folder on this computer." |
+  | 403 `not-local` | "Show in folder works only in a browser on the computer running ComfyUI." |
+  | 501 `unavailable` | "No file manager is available on this computer." |
   | 429 `busy` | "The folder is already opening." |
   | Anything else (415, 404, 409, 500, offline) | "The folder could not be opened. Try again." |
 
-  **D176 (#533, beyond the concept):** the viewer is a modal, so `showWorkspaceToast`
-  moves `#workspace-toast` into the topmost open modal (by hit test when several are
-  open), keeping its fixed position, and back when that modal closes. A modal opened
-  after a toast covers it until the next toast. Otherwise every toast raised from a modal is
-  covered and inert while `toHaveText` still passes: assert `toBeVisible` and the
-  hit test as `full-inspector.spec.mjs` does.
-
-  The route opens the folder on the computer running ComfyUI wherever the browser is,
-  through a proxy too (maintainer decision, #533, amending the original local-only
-  rule; accepted risk: anyone who can reach the server can open file windows on it).
-  It answers 403 `not-same-origin` unless `Origin` is present and matches: its host
-  and port against `X-Forwarded-Host` when sent, else `Host`, with the scheme's default
-  port filled in; its scheme against `X-Forwarded-Proto` when sent, else the socket's
-  (an https page on an http socket passes, TLS having ended at a proxy); and, when
-  sent, `Sec-Fetch-Site: same-origin`. A body that is not
+  The route is local-only. It answers 403 `not-local` unless all of these hold: no
+  forwarding-style header (`Forwarded`, `Via`, `X-Real-IP`, `CF-Connecting-IP`,
+  `True-Client-IP`, `X-Client-IP`, `X-Cluster-Client-IP`, `Fastly-Client-IP`, and any
+  `X-Forwarded-*`, `X-Original-*` or `*-Client-IP`); a loopback `request.remote`; a
+  loopback `Host` (`localhost`, `*.localhost` or a loopback address, against DNS
+  rebinding); an `Origin` equal to the request's own scheme, host and port (absent,
+  `null`, another port or another scheme is refused; browsers send `Origin` on every
+  fetch POST); and, when sent, `Sec-Fetch-Site: same-origin`. A body that is not
   `application/json` is 415 `unsupported-media-type`, so any cross-origin request
   needs a CORS preflight. The body is strict (an int root, a 64-hex scope, a bounded
   relative path; absolute, drive and `..` paths are 400), the scope goes through
@@ -1659,9 +1596,7 @@ Recorded deviations on this page (spec §8):
   reach it), falling back to `os.startfile(folder, "explore")`. macOS runs
   `/usr/bin/open -R`; Linux asks FileManager1 `ShowItems` with `dbus-send
   --print-reply --reply-timeout=2000` (a real reply or a fallback) and else runs
-  `xdg-open` on the folder, or answers 501 without `DISPLAY` and `WAYLAND_DISPLAY`.
-  `open` and `xdg-open` get `OPENER_WAIT` (1 s): a nonzero exit is the 500 above, and
-  one still running counts as started and goes to the reaper (#533). Those openers are argv lists resolved only on a fixed
+  `xdg-open` on the folder. Those openers are argv lists resolved only on a fixed
   system PATH, with no shell, DEVNULL streams, `close_fds`, their own session, a
   minimal environment (no venv PATH, PYTHONPATH or API keys) and a daemon-thread
   reaper. `tests/test_image_reveal.py` mocks `Popen`, `sys.platform`, `shutil.which`,
@@ -1669,11 +1604,12 @@ Recorded deviations on this page (spec §8):
   (`POST`/`GET /__test__/reveal`) with no cooldown. The inspector comparison reads
   closed disclosures as hidden, so the button needs no mapping there.
 
-  Limits of that check: a proxy that rewrites `Host` and sends no `X-Forwarded-Host` is
-  refused with that toast until it sends one. A non-browser client can forge every
-  header. The check stops a plain cross-site POST, not every other site: a DNS-rebinding
-  page has a matching `Host` and `Origin`, so it can open a folder of a listed file, at
-  most once a second. The path check confines it, one check ahead of every opener.
+  Residual risk, accepted: a reverse proxy or tunnel that adds no forwarding header
+  (a bare nginx `proxy_pass` to 127.0.0.1, `ssh -R`, `socat`) cannot be told apart
+  from a local client, and a non-browser client behind it can forge a matching
+  `Host` and `Origin`. Such a client can open a folder of a listed file on the host's
+  screen, at most once a second, and learn whether that file exists (which the
+  listing routes already tell it). Operators who expose ComfyUI that way accept this.
 - **D39** (ruled 2026-10-21: fallback): a recipe-linked image shows its recipe's own
   category when set, otherwise the linked positive prompt's, and its recipe's own tags
   when it has any, otherwise the positive's; each field falls back on its own and the
@@ -2551,30 +2487,10 @@ files to the system trash. **No code path unlinks or overwrites a media file.**
   `$RECYCLE.BIN` (any case), as none descends `thumbnails`: the workspace and legacy
   listings (`_walk_media`, `_settled_entry`), the metadata scan and duplicate find
   (`_collect_media_files`), the legacy auto-tag listing (`_collect_scan_files`) and the
-  delete review (`trash-folder`), and the image monitor, which tests the folders below the
-  watched folder holding the new file (a source named like a trash folder is still watched). Tests: `tests/test_media_folders.py`,
-  `tests/test_image_removal_gaps.py`. Media routes answer not found for a path in such a
-  folder, resolved first so a link or another spelling cannot pass (#543):
-  `_media_access_error` is the one gate (by-id, inspect, reveal, link, rescope as
-  `file-missing`, a prompt's media listing); `/images/serve` and the autotag target ask
-  `in_trash_below_roots` too, `media_target` refuses by name (annotations, collections,
-  whose capture store denies links and aliases), and previews are neither made nor served, the fallback past the preview gate's cap
-  included (`_quick_source`). A History output in one answers `missing`, checked at the
-  candidate and again at the open (a preview can be a link). The legacy duplicate delete
-  removes exactly the folder's real path plus the name (a link itself, never its target)
-  and refuses if either spelling is in a trash folder; `file_problem` refuses too. The delete
-  and Return flows never use this gate. Windows spellings (trailing dots and spaces, case,
-  8.3) run for real on the Windows job in `tests/test_trash_gate_routes.py`.
-- **An output folder that is a mount point** (#543): the mount's own `.Trash-$uid` and
-  `.Trash/$uid` are allowed only for a root that is exactly that mount, with the spec's
-  checks intact. A root above the mount, a mount nested under the root, a source that is or
-  sits in the trash folder, and a link in place of the trash folder stay refused. Tests:
-  `tests/test_trash_mount_root.py`, on a fake mount table in the suite and, with
-  `PM_TRASH_MOUNT=<real mount>`, in portability.yml's `native-trash-linux` job (loop-mounted
-  ext4). Locally, without root: `unshare -Urm` over a tmpfs.
-- **D190** (#543, beyond the concept): a trash review where nothing can move shows a primary
-  that clearly cannot act: `aria-disabled`, no danger colors (also on hover), and a press does
-  nothing. Tests: `tests/browser/workspace-images-delete.spec.mjs`.
+  delete review (`trash-folder`). The image monitor tests every folder of the new file's
+  absolute path, so it also ignores outputs written into a source that itself lies
+  inside such a folder. Tests: `tests/test_media_folders.py`,
+  `tests/test_image_removal_gaps.py`.
 - **Trash backends** (`utils/trash.py`, no dependency): Linux and BSD implement the
   freedesktop Trash specification (home trash on the same mount, else the mount's
   `.Trash/$uid` or `.Trash-$uid`), reserve the name with `O_EXCL` and move with
@@ -2598,40 +2514,12 @@ files to the system trash. **No code path unlinks or overwrites a media file.**
   ("Moving files to the Recycle Bin isn't available on Windows: files larger than the bin's
   capacity would be deleted permanently."). Library-only removal works everywhere. Tests use `tests/fake_trash.py`; the
   browser test server installs it, so no test touches a real trash. The native proof,
-  `tests/test_trash_macos_native.py`, runs only with `PM_NATIVE_TRASH=macos` on a Mac, by hand
-  (CI dropped its `native-trash` macOS job in #571; it last passed on `macos-latest` and `macos-15-intel`): the startup
+  `tests/test_trash_macos_native.py`, runs only with `PM_NATIVE_TRASH=macos` in
+  portability.yml's `native-trash` job (`macos-latest` and `macos-15-intel`): the startup
   volume, a name clash, fresh APFS and FAT32 disk images, an image used as an output root,
   a read-only image and an unwritable folder (design and probe:
   `docs/egm/499-macos-trash/`, local).
 
-- **D162** (#498, maintainer ruling Q1 of #480; the concept has no screen for removed images, so this follows D152's
-  Show archived prompts): **Show removed images (N)** in the Images heading actions, before Import, a toggle
-  (`aria-pressed`) shown only while N > 0 or the view is on. N is `removed_total`, every removed image in the selected
-  source(s) whatever the filters (D152 counts the matching ones). The view (`GET /images/output?mode=workspace&
-  removed=1`, refused with `favorites`, `collection`, `category`, `tags` or `sort=rating`; a cursor never crosses
-  views) lists only files a removal mark hides, each card with a "Removed" `.chip` and without the star or Tag action;
-  the caption reads "N removed images · files on disk, hidden from Images", the empty view "No removed images." /
-  "No removed images match.". Entering clears Category and Tags; choosing a category or tags while it is on
-  (toolbar, Refine this view) ends the view. A card's image and Info both inspect (the viewer is
-  not opened: its Collections… and Delete… would write); the panel shows Return to library in Delete…'s place and
-  no Collections… or tag-filter chips. The bar reads "N selected", Return to library, Clear. The view is never saved
-  or restored: leaving the page, Browse or a saved view ends it, and a return that leaves N = 0 ends it too.
-  - **Return to library** (no review: nothing is lost or moved, as D152's Restore) posts `{items | filter}` to
-    `POST /prompt_manager/images/removed/return` (only this route takes `filter.removed`; every other bulk route
-    refuses it). 202 `{job, returned, not_removed}` (400 `no-images` when none is hidden now, `too-many-images` over
-    500; 409 `busy` beside a scan, restore or delete, nothing changed). The job is a `scan`, "Return images to the
-    library": its first step deletes, in one transaction, the marks that still hide their file (same size and
-    `mtime_ns`; the marks generation moves again after the commit), then it scans exactly those files with the scan's
-    pipeline and groups. Toasts: "Returning N images to the library…", then "Returned N images to the library; K
-    linked to their prompts. Tags, categories, collections and favorites do not come back." When it ends, the
-    sidebar's Needs review, Library and Images counts are read again (`JOB_END_COUNTS.scan`).
-  - What comes back: the file in Images; its prompt, links, pairs and Needs review items from its embedded metadata
-    (a file without usable metadata comes back unlinked); previews on demand. Not: image tags, auto-tag marks, own
-    category, collection memberships, favorite (only a safety-backup restore has them). If the server stops between
-    the mark delete and the scan, the files are back unlinked and a "new files" scan links them.
-  Tests: `tests/test_image_return.py`, `tests/js/workspace-images-return.test.js`,
-  `tests/browser/workspace-images-removed.spec.mjs`. A Python change: ComfyUI needs a restart.
-
 ### Prompt library cards and recorded deviations (#249 PR E)
 
 The shelf uses the shared concept toolbar and caption (E1) and the concept's
@@ -2726,8 +2614,8 @@ applied), D35 (singular captions), D36 (sorted categories), D40 (the continuatio
 the grid) and D43 (sorted chips, checked against the concept with its chips sorted).
 D44 needs no mapping: the comparison runs with no Refine filter active, so the button
 reads "Filters" as the concept's does. Nothing else follows the grid: the legacy
-"Current prompt library" link is removed from the shelf; the legacy Library stays at
-`/prompt_manager/admin` by direct URL, linked only from System (#525, D165)
+"Current prompt library" link is removed from the shelf; Overview's legacy card ("Open
+existing prompt library") and the sidebar still link `/prompt_manager/admin`
 (`tests/browser/workspace.spec.mjs`). `library comparison detects
 mutations` injects `.card-footer { padding: 2px }` and removes `.card-meta .chip.red`.
 
@@ -2973,14 +2861,6 @@ with its own negative, a self-pair, each drift, validation); `tests/test_library
 copy, the server after, archive-only, reset to Archive) and `library-delete-concept.spec.mjs`. A Python
 change: ComfyUI needs a restart.
 
-### Pair node gives a new prompt its category and tags (#546)
-
-A Pair save, by a run or the node's Save pair button, writes the category and tags to the positive prompt only when that
-save creates the prompt row (maintainer ruling). An existing prompt never changes on a run: empty, cleared or set by a person, including one first seen as
-another pair's negative. The negative stays empty, the saved pair keeps its own metadata, and `save_prompt_pair` writes
-no prompt metadata unless called with `fill_new_positive`. No backfill; optional repair is #550.
-Tests: `tests/test_prompt_pair_node.py`, `tests/test_api_pairs.py`, `tests/comfyui/pair-node.spec.mjs`. A Python change: ComfyUI needs a restart.
-
 ### Delete… on the archived shelf (#492)
 
 Extends **D160** (coordinator ruling 2026-10-29, cutover item): the archived shelf's bar reads "N selected · Restore ·
@@ -3021,65 +2901,6 @@ concept's danger "Archive…" maps to "Archive variant…" followed by a "Delete
 Tests: `tests/browser/workspace-library-delete.spec.mjs` (#481 cases), and `workspace-library-editor.spec.mjs` (the
 hand-off and the comparisons) and `library-editor-visual.spec.mjs` with the renamed button. JS only: no restart.
 
-### Card tops, the Reusable tags window and System's width (#530)
-
-Found in the maintainer's test of the cutover branch; each departs from the concept, whose files are not edited. The
-comparisons add `CONCEPT_LAYOUT_DEVIATIONS` (`concept-inventory.mjs`, four rules: card margins, System limit, tag header
-background and line) to the opened concept page, so the boxes that follow from them are still compared. The new spec pins the
-real values and that the unmapped concept keeps its 18px offset.
-
-- **D182**: the second card of a `.two-col` starts level with the first. The concept's `.surface + .surface` 18px margin
-  also applies inside its grid, which put Categories and Workspace preferences 18px lower. Stacked cards are now one 18px
-  gap apart instead of 36px. A surface after a two-column row (Backup & export's Recovery policy) touched the row in the
-  concept and on main; it now sits 18px below it.
-- **D183**: Reusable tags scrolls in its own window inside the card (`max(280px, 100dvh - 500px)`), so a long vocabulary no
-  longer runs the page off screen. The column headers stick to the top of the window, with the surface background and a
-  drawn line. Load more stays below the window; the end of the list inside the window (`.vocabulary-end`, observed with
-  the window as root) appends the next page. A new search or sort returns the window to its top. Reaching Load more by
-  keyboard no longer appends on its own; Enter does. A rename or merge reloads page one, so the window returns to its top.
-- **D184**: `.settings-layout` has no 1000px limit, so every System section uses the full content width, as the section
-  nav and the other pages do.
-- **D185**: on touch and at 390px the same window stays shorter than the screen and overscroll chains to the page, so a
-  swipe outside the window, or past its top, moves the page.
-
-Measured in `workspace-layout-tags-system.spec.mjs`; the swipe case runs in the touch project.
-
-### Prompt page heading on one row (#524)
-
-**D164** (beyond the concept, which never has four heading actions beside a long title): from 951px, the concept's
-sidebar breakpoint, the prompt page's heading actions keep one row and the title takes the remaining width, clamped to
-two lines with its full text in the DOM and in `title`. Below 951px the concept's wrapping and stacked heading is
-unchanged. A short title lays out as the concept's, so the history concept comparison is unaffected. A deleted prompt's
-page has no "Prompt history · …" description: it is emptied and hidden while the gone message shows.
-
-### Delete review and prompt-page polish (#512)
-
-Found in the live test of #505/#507/#509. **D163** (beyond the concept, maintainer ruling 2026-10-29: delete was hard to
-find on a prompt's page): the prompt page heading ends with a **"⋯" More menu** button after Send to ComfyUI
-(`more-menu.mjs`: `aria-haspopup="menu"`, `aria-expanded`; Enter, Space or ArrowDown opens it on its first item, ArrowUp
-on its last; arrows, Home and End move; Escape closes it and returns focus to ⋯; Tab, an outside press or a choice
-closes it). It holds one danger item, "Delete prompt…", which opens the same review as Edit metadata's Delete prompt…
-(D161, kept) and returns focus to ⋯. The menu uses the concept's button, surface, border and toast shadow, opens
-right-aligned under ⋯, and opens rightwards where the heading wraps it to the left edge (390px). It is held with Edit
-metadata while the page's review or write runs, and disabled on a gone prompt's page.
-
-Also:
-- The Delete… review leaves out rows with nothing in them ("Delete permanently: 0 …", "Archive: 0 …"), close-only
-  reviews included.
-- A review opened from a prompt's page is titled "Delete this prompt" or "Archive this prompt" (following the choice),
-  and its close-only sentence reads "This prompt cannot be deleted or archived."
-- An archived prompt that is another prompt's negative is named so: "1 prompt used as another prompt's negative:
-  hidden, restorable" (or "N prompts in a saved pair (M used as another prompt's negative)"), with the sentence that its
-  variant stays.
-- A prompt page whose prompt no longer exists (404, after a delete or from a stale link) reads "This prompt no longer
-  exists. It may have been deleted." with "Open the Prompt library", no Retry; Edit metadata and ⋯ are disabled.
-- Item 5 of #512 does not fail on the code after #505: the archived shelf's button reads "← Prompt library", and under a
-  remembered search the heading's count equals what the archived shelf lists. A regression test pins both.
-
-Tests: `tests/js/workspace-library-delete.test.js` (#512) and `tests/browser/workspace-library-delete.spec.mjs` (#512
-cases: the menu by mouse, keyboard and at 390px, the gone page, the titles, the count under a search). JS only: no
-restart.
-
 ### No 1–5 prompt rating in the workspace (#447)
 
 **D153** (maintainer ruling 2026-10-28: the star is only for favorites; the concept keeps
@@ -3233,8 +3054,8 @@ npm run --prefix tools/vendor test:workflows -- history-concept.spec.mjs \
 ### Inspect a file page and recorded deviations (#249 local Inspect, PR L2)
 
 `#/inspect` ("Inspect a file") is a native workspace route; it no longer hands off to
-the legacy metadata page, which stays at its URL
-(`/prompt_manager/gallery.html`) linked only from System (#525, D165). The page is the concept's `#metadata`
+the legacy metadata page, which stays reachable from Overview's "Open existing metadata
+inspector" card (`/prompt_manager/gallery.html`). The page is the concept's `#metadata`
 (app.js `renderMetadata` a740–748, selection a1715–1729; style.css 709–722, 1180–1194,
 1543–1545, 1559–1564) in the concept's own classes (`.surface`, `.file-drop`,
 `.spaced-20`, `.local-file-preview`, all from the synced `concept.css`), with no
@@ -3512,20 +3333,15 @@ document title "Review" (the concept's), heading "Metadata review" with its line
 concept's sentence, then `.gallery-layout`: the queue's concept media cards
 (`image-card.mjs`, shared with Images; the image opens the shared viewer, Info selects
 the item, Tag opens the shared Tag image dialog with the review scope note) and
-`section.surface` "Resolve the association" (filename, Tag image, Link to a prompt…,
-Sampler context, the chosen path's prompt blocks, Leave for later, Leave unresolved and
-primary Apply association). The
+`section.surface` "Resolve the association" (filename, Tag image, Sampler context,
+the chosen path's prompt blocks, Leave for later and primary Apply association). The
 first item is selected on load, as the concept's first image is. Sampler context lists
 "Sampler <id> · <positive> / <negative>" per candidate (the server's label), disables
-unusable ones with the server's reason and preselects the first workable one
-(rulings R2/R3). Apply
+unusable ones, preselects the first workable one and ends with "Leave unresolved"
+(rulings R2/R3); "Leave unresolved" shows the ambiguous status in both blocks. Apply
 takes a fresh capture (`observe`) and posts the decision; Leave unresolved on a file
-under no current root posts without a capture. Each decision and Leave for later opens
-the next item and the page stays (#536 overturns ruling R7); Leave for later writes
-nothing. Link to a prompt… (#536) records a Library prompt the reviewer chose,
-`POST /prompt_manager/review/items/{id}/link`: the capture guards of Apply, the same
-one-prompt-per-file rules, and link provenance `kind: "manual-link"` with no prompt
-sides, so it never reads as file evidence. A recorded decision re-reads the row's count, as does every metadata scan that ends. A
+under no current root posts without a capture. Both actions return to Images (R7); a
+recorded decision re-reads the row's count, as does every metadata scan that ends. A
 refused decision keeps the selection and shows the server's sentence (the
 association conflict's explanation included) as `p.warning-note` in the panel; a
 restored storage or a changed queue reads the queue again; a request with no answer
@@ -3540,14 +3356,6 @@ pending count (`GET /prompt_manager/review/items?limit=1`, its `total`).
   carries the concept's **Review metadata** (app.js a738 `go-review`): in its Activity
   item after the item's line, and in its job view's heading after Download report. The
   item's chip still names its state (D54), where the concept's says "Needs attention".
-- **D179** (#536, maintainer decision 2026-10-30): "Leave unresolved" is a button beside
-  Leave for later, not the Sampler context select's last option; a disabled option names
-  the server's reason.
-- **D180** (#536): with nothing to apply, the select, the prompt blocks and Apply are
-  hidden; the panel gives the path count and each reason, and Link to a prompt… is primary.
-- **D181** (#536): the concept has no picker. Link to a prompt… opens the shared content
-  dialog: Library search, the prompt's recipes as Negative prompt (one preselected,
-  several must be chosen, always "No negative"), Cancel and Link image.
 - **D119**: the queue cards have no selection checkbox and
   no star (the page has no selection bar and the queue carries no favorite state); a
   file under no current root has an empty, `aria-disabled` image button and Tag; more
@@ -3893,8 +3701,8 @@ workspace never asks; previews are a cache the server keeps:
 - `GET /images/serve/thumbnails/<rel>_thumb<ext>` for a missing preview is refused as
   text first (traversal, a backslash, a drive or stream colon, empty or dot segments, so
   `D:/x`, `\\server\share` and a leading `/` never reach a joined path), then admitted
-  on the event loop (`_PreviewGate`): 3 previews are written at once on the API's
-  interactive `pm-image` pool (never the default executor; #523), one flight runs per file (the history
+  on the event loop (`_PreviewGate`): 3 previews are written at once on the API's own
+  `pm-preview` pool (never the default executor), one flight runs per file (the history
   route shares the flight key and the admission), and at most 64 requests wait; one
   more gets its fallback at once without listing a folder. Inside the admission the
   preview maps back to its media file under the same root (exact names, then one folder
@@ -3927,7 +3735,7 @@ workspace never asks; previews are a cache the server keeps:
   `exclusive` job runs (`_auto_thumbnail_blocker`), checked when a write starts (after
   its slot) and again just before its rename.
 - Shutdown is bounded and logged: the worker stops at a file boundary, ffmpeg is
-  killed, an idle worker leaves (the next output starts a fresh one), the image pool
+  killed, an idle worker leaves (the next output starts a fresh one), the view pool
   shuts down, and after the app's cleanup a late monitor event
   starts nothing. A package reload stops the workers the previous import left.
 - Cards and strips load previews only: Images in every layout and size, Library cards,
@@ -4055,11 +3863,7 @@ the per-section hand-off panel, was retired by S12 (#329): every section is nati
   "Save preferences" is `aria-disabled` (opacity .55, `not-allowed`) while clean or
   saving; a setting the last save could not save gets a red outline. CSS under D92.
 - **D93** (Overview): real values. The metrics are the Library's eligible positives
-  and active saved negatives and the Images count (#555, amending Q2's indexed
-  `generated_images` rows): the shell's Images sidebar count, the Images page's own
-  total, which also lists files no row links, as the concept's `images.length` is
-  both. A visit re-reads it unless a read is in flight; "–" until read or after a
-  failed read. `images.indexed` stays in the API and is not shown. "Database
+  and active saved negatives and the indexed `generated_images` rows (Q2). "Database
   integrity" is "Not checked" until a check ran this session, then "N issues" (checks
   that found issues, even beside a check that could not run), "Passed" or "Incomplete".
   The review row is "N ambiguous image links" (the Needs review queue's pending count,
@@ -4097,11 +3901,10 @@ the per-section hand-off panel, was retired by S12 (#329): every section is nati
 - **D96** (Statistics; amended by D153): "Usage statistics" without the sample note: the
   concept's "Runs by category" table without its Avg. rating column (Category / Runs)
   with the real runs of eligible parents per category ("Uncategorized"), then a second
-  table "Database records" (Total / Count: Prompt records, Tags on prompts, Image
-  records: the raw row counts of the legacy statistics, labelled as rows so they never
-  read as the Library or Images page counts, #555; no Rated images). The API still reports `average_rating` and
+  table "Library totals" (Total / Count: Prompts, Tags, Images from the legacy
+  statistics; no Rated images). The API still reports `average_rating` and
   `rated_images`; the workspace does not show them.
-  The Overview row says "Runs by category, with database record counts." because
+  The Overview row says "Runs by category, with library totals." because
   that is what the dialog shows (the concept's own dialog shows only "Runs by
   category"); per-prompt run counts, prompt tags and dated runs are recorded, but no
   table of them exists yet. A failed read toasts "Statistics could not
@@ -4126,23 +3929,6 @@ the per-section hand-off panel, was retired by S12 (#329): every section is nati
   defaults" ("Restore this browser’s display defaults, then save. Other settings are
   kept.", button "Reset"), which drafts the gallery's defaults for the browser rows only.
   The node search timeout shows the server's real value, not the sample 30. CSS under D97.
-- **D170** (#532, maintainer request 2026-10-30, beyond the concept): every viewer has
-  `button#viewer-keys.icon-btn` right before the D156 view switch (accessible name and
-  `title` "Keyboard shortcuts", a `command` outline icon, hidden at ≤700px with the
-  switch). It opens `dialog#viewer-keys-dialog`, a modal built on demand inside the
-  viewer, so a closed overlay adds nothing to the concept comparisons but the button:
-  `.dialog-header` with × and the keys grouped as Move (← → Space), Image (+ - 0 R H),
-  View (F I ? Esc) and File (D, Delete where the viewer has Delete…), one column at
-  390px. Esc or × closes only the overlay and focus returns to the button; opening it
-  stops the slideshow. ← and → navigate from anywhere in the viewer, on `document` as the
-  legacy gallery does, unless a modifier is held, text is selected, another dialog is on
-  top, or focus is in a video, form field, `pre`, `summary`, or anything in the details
-  but a button or link. The other keys share that gate but allow Shift, and each clicks
-  the toolbar's own control, so an aria-disabled, missing or hidden control does nothing
-  (Rotate on a video, I when Centered, F at ≤700px, Delete without Delete…). `?` opens
-  the overlay directly. Delete only opens the review. Space on a focused button or link
-  activates it instead, and only + and - repeat. `workspace-viewer-keys.spec.mjs` pins
-  this.
 - **D156** (#450, maintainer request 2026-10-28, beyond the concept): every viewer (the
   shared `dialog#viewer-dialog` of Images, Library, History, collections and Inspect) has
   `button#viewer-mode.icon-btn` in `.dialog-header`, right before ✕ (a direct child, so
@@ -4386,41 +4172,6 @@ the per-section hand-off panel, was retired by S12 (#329): every section is nati
   makes the page see a restore run and finish deterministically. A refused file toasts "This file can't be restored: <validator reason>.". A
   review value may wrap anywhere (`#modal-body > dl.meta-grid dd`, CSS under D105), so a
   long file name keeps the concept's two equal columns at phone width.
-- **D173** (#535, amends D106; maintainer 2026-10-30): "always asks" now means asks when
-  there is a choice. One eligible window is selected, and a selected window with exactly
-  one eligible node selects that node; two or more nodes are never selected. A node whose
-  requested field is linked is not offered (`linkedRoles` on each destination), and the
-  status line says which case applies: linked, wrong roles, no node, or no window. It
-  counts the other nodes that cannot receive, and the review names the node and window.
-- **D174** (#535): the window option shows the tab's current title, read at each discovery
-  (a getter on the host options, which the Toolkit reads per discover), without the old
-  "PromptManager —" prefix. Same-named windows get " (window 2)", numbered by host id so the
-  number is stable while the tabs stay loaded. Every node option reads "#<id> <title>", so
-  identical nodes can be told apart. Discovery waits 300 ms, as System does.
-- **D175** (#535, maintainer 2026-10-30): the concept README previews before applying;
-  production makes Preview optional. Apply is enabled once a window and node are selected
-  and requests the ticket itself, in one click. It stays closed after "Sent to ComfyUI.",
-  so a double click sends once, and after an unknown outcome until a new preview or
-  choice. The host's checks still refuse a linked field or a changed workflow, and the
-  sender also refuses if the destination's `revision` (node object plus graph version)
-  moved since discovery; it is undefined on an older tab, which skips the comparison. A host error reads as a refusal, not "may have applied".
-- **D191** (#542, beyond the concept; maintainer 2026-10-31, Q542-1 A to 5 A): a window with two or more
-  eligible nodes adds a last Destination node option "All N eligible nodes" (`ALL_NODES` in
-  `prompt-sender.mjs`), never selected for you (D173). Eligible is D173's filter; the nodes it leaves out
-  stay counted in the discovery sentence. One window only. Preview stays optional (D175): Preview changes
-  shows one `section.prompt-sender-node` per node, headed "#<id> <title>", in send order (node id,
-  numeric). Apply previews every node first and writes nothing if any refuses ("#<id> <title>: <reason>
-  Nothing was sent."). Then it sends one node after another. Only the first node of a pass taken in that
-  click keeps its ticket; every other node, and every node of a held Preview (host tickets expire after
-  30 s), takes a fresh ticket that is refused unless its Before texts and composition equal the reviewed
-  ones. That fresh preview checks the discovered revision until something has been posted, and not after,
-  since our own write may move the graph version. Refusals are best effort: "Sent to 2 of 3 nodes in
-  <window>. #12 <title>: <host's refusal>."; Apply stays available and a retry sends to every node again
-  (rewriting the same text). A lost reply stops the run, names that node as unknown and lists the nodes
-  not sent. Closing the dialog stops after the current node. The review sections are labelled by their
-  `h4` node heading. Unit tests in `tests/js/prompt-sender.test.js`, a fake three-node host in
-  `tests/browser/prompt-inspector.spec.mjs`, real Classic and Nodes 2.0 widgets in
-  `tests/comfyui/prompt-sender.spec.mjs`.
 - **D106** (Integrations, S10, Q8): the send bridge always asks for the ComfyUI window
   and node, and the nodes always follow ComfyUI's own renderer, so "Default send
   destination" offers only "Ask each time" and "Host compatibility" only "Follow host
@@ -4526,15 +4277,6 @@ the per-section hand-off panel, was retired by S12 (#329): every section is nati
   `system shell and overview match the concept` (the mapping inserts the row) and
   `library notice matches the concept notice` with its mutation check
   (system-concept.spec), and the D129 tests of workspace-system.spec.
-- **D166** (one-time upgrade notice, #527): the concept's README puts the notice in the
-  new shell, while its `app.js` draws it in System › Sources. Production does both: the
-  Sources `.notice` is kept and compared as drawn, and `#older-images-notice`, styled as
-  `#library-banner`, shows the same notice above every other page until dismissed. The
-  shell hides on Sources, so they never show together. Dismissal is the legacy key
-  `pm_update_notice_dismissed`, shared with the admin modal and across tabs. Browser
-  contexts start dismissed (`tests/browser/fixtures.mjs`, `storageState`); a spec about
-  the notice sets `test.use({ olderImagesNotice: true })`. Pinned by
-  workspace-older-images-notice.spec.
 - **D130** (Appearance, #317): the concept keeps "Thumbnail quality, size limit" in
   Appearance (README) but draws no rows for them. Appearance gains a second
   `section.surface`, "Thumbnails", after "Browsing & display", built from the concept's
@@ -5484,7 +5226,7 @@ list stay unscoped: any row's control proves them.
 | Worker threads | `admin.html:437–445` | S4 Sources | covered | `sources` · slider · "Worker threads" | worker range max is cpu_count (workspace-system-sources.spec.mjs) |
 | LoraManager badge, enable, path, trigger words, CivitAI key, clear key | `admin.html:448–490`; `admin.js:1052–1156` | S10 Integrations | covered | `integrations` · switch · "LoraManager integration" | LoRA rows show detected / enabled / cache-loaded separately (workspace-system-integrations.spec.mjs) |
 | LoRA data import with progress | `admin.html:492–498,517–541`; `admin.js:1157` | S10 Integrations | covered | `integrations` · button · "Review import" | Review import shows replacement, blocked items and network effects with the backup box; Start opens the job (D107) (workspace-system-integrations.spec.mjs) |
-| Statistics | `admin.html:159`; `admin.js:1627` | S2 Overview | covered | `overview` · button · "Explore" | statistics dialog lists runs by category and database record counts (workspace-system.spec.mjs) |
+| Statistics | `admin.html:159`; `admin.js:1627` | S2 Overview | covered | `overview` · button · "Explore" | statistics dialog lists runs by category and library totals (workspace-system.spec.mjs) |
 | Export components JSON `/export` | `admin.html:163`; `admin.js:1607`; `py/api/prompts.py:238` | S9 Backup & export | covered | `backups` · button · "Export all prompts JSON" | Export JSON downloads /library/export; secondary buttons download all prompts (/export) and /pairs/export (D103) (workspace-system-backups.spec.mjs) |
 | Saved pairs export | `py/api/pairs.py:84` | S9 Backup & export | covered | `backups` · button · "Export saved pairs JSON" | Export JSON downloads /library/export; secondary buttons download all prompts (/export) and /pairs/export (D103) (workspace-system-backups.spec.mjs) |
 | Library export | `py/api/library.py:223` | S9 Backup & export | covered | `backups` · button · "Export JSON" | Export JSON downloads /library/export; secondary buttons download all prompts (/export) and /pairs/export (D103) (workspace-system-backups.spec.mjs) |
@@ -5812,23 +5554,6 @@ npm run --prefix tools/vendor test:workflows -- workspace-system-backups.spec.mj
   --project chromium --project touch --project firefox --project webkit
 ```
 
-## Sticky chrome (#531)
-
-Beyond the concept, from the maintainer's test of #528; the concept is unchanged. `workspace-sticky-chrome.spec.mjs` holds these.
-
-- **D186:** the selection bars (Images `#bulkbar`, Library `#library-bulkbar`; there are no others) are sticky: under the
-  top bar at the top of the page, and at the top of the window once that non-sticky top bar has scrolled away (one rule
-  in workspace.css). While the bar's flow place is above the window, its appearing, resizing or leaving does not move the cards
-  (`keepingPlace`). Focused card controls and the Images panel keep clear of it (`--selection-bar-block`). At 700px and below
-  the bar is one row that scrolls sideways. After a bulk action finishes the page scrolls to the top and refreshes the
-  list; Set category, Delete… and Return to library clear the selection as before, while tagging and collections keep
-  it (D85, D138). Export metadata changes nothing, so it stays put. Single-image actions from the inspector and viewer stay put.
-- **D187:** Back to top: one shell chip past 200px of scroll, above the toast's spot; it rises only for a toast taller than two lines. It never animates, because the
-  pages' height corrections would cancel a smooth scroll, and focus moves to `#workspace-main`. D42's band grows to 140px.
-- **D188:** the Needs review panel is sticky like the Images panel, with its own scroll on a window under 720px tall, and static at 700px and below.
-- **D189:** where a panel is one column (static): Info brings the panel into view. On
-  Images the panel follows the whole list, past infinite scroll, so loading waits for the reader's next move (wheel, touch or key) rather than pushing the panel away.
-
 ## Workspace data fields for the concept pages (#249)
 
 These fields are additive. The legacy `/prompt_manager/images/output` listing (no
@@ -6868,7 +6593,7 @@ checkout or point this harness at a live ComfyUI checkout.
 
 The package-qualified config import also corrects #211: the configured database
 path is honored when PromptManager runs as a ComfyUI custom node. Follow the
-[database path compatibility and safe backup sequence](README-legacy.md#database-path-compatibility-211)
+[database path compatibility and safe backup sequence](README.md#database-path-compatibility-211)
 before restarting an existing deployment.
 
 The ledger records only new dequeued jobs and observed outcomes. Existing
@@ -7241,8 +6966,8 @@ Deploying this backend needs a ComfyUI restart (Python and route changes).
 ## Native vocabulary UI (#236)
 
 `#/tags` ("Tags & categories", page title "Tags") is a native workspace route; it no
-longer hands off to the legacy tag manager. That page stays at
-`/prompt_manager/admin#/tags` linked only from System (#525, D165); tag search and sort, the untagged
+longer hands off to the legacy tag manager. That page stays reachable from Overview's
+"Open existing tag manager" card for its own page; tag search and sort, the untagged
 entry (D149) and multi-tag OR (the Library's Tag match, D150) moved to the workspace
 (#444); bulk prompt delete stays on the legacy admin page (bulk tags: the Prompt
 library's selection bar, D151). A prompt's category is changed in the Prompt library
@@ -7364,23 +7089,3 @@ until acceptance. Not compared: hover states and the dialog focus ring (the page
 keyboard ring and link ring offsets are asserted). No coverage floor was lowered;
 `vocabulary-state.mjs`, `vocabulary.mjs` and `vocabulary-dialog.mjs` have additive
 floors in `frontend-coverage-baseline.json`.
-
-## Cutover entry points (#525)
-
-The top-bar PM button, both Web UI buttons and `/prompt_manager/web` open
-`/prompt_manager/workspace#/library` (`web/js/workspace-entry.js`; `web/index.html` keeps its
-own copy, pinned by `tests/js/workspace-entry.test.js`). Overview's cards open native hashes.
-The legacy pages (`/prompt_manager/admin`, `admin#/tags`, `gallery`, `gallery.html`) stay at
-their URLs, and admin's Metadata and Gallery buttons still open their legacy pages (maintainer
-ruling; pinned by `legacy-system-links.spec.mjs`).
-
-- **D165** (beyond the concept, maintainer ruling 2026-10-30): System's Overview section ends
-  with one small line, "Legacy pages: Dashboard · Tags · Gallery · Metadata viewer"
-  (`.legacy-pages`, new tabs), outside `.settings-layout`. The concept has no such line;
-  `mapOverviewConcept` adds it to the page tree.
-- **Load failure** (maintainer ruling 2026-10-30): `web/workspace.html` holds static
-  `#workspace-boot-failure` with the same four links, styled inline so it needs no stylesheet.
-  An inline guard shows it at `load` unless `index.mjs` set `data-workspace-booted`, so a failed
-  fetch of any module and a throw while starting are both covered; `workspace.spec.mjs` tests
-  both. Editing `workspace.html` needs a ComfyUI restart, because the server caches it. The PM button has no
-page-fixture test; it is proven on the managed host (`tests/comfyui/prompt-manager.spec.mjs`).

__init__.py

@@ -92,20 +92,10 @@ try:
     routes = config.routes
     api = PromptManagerAPI()
     api.add_routes(routes)
-
-    # The thumbnail location's startup check (#320), then the temp files of
-    # preview writes a crash interrupted (#317), off the import path: the
-    # walk may cover a large thumbnails folder.
-    # #320: the configured thumbnail location is in force before any request
-    # (no I/O); the thread below checks it.
-    api.use_preview_location()
-
-    def _preview_startup():
-        api.start_preview_location()
-        api.sweep_thumbnail_temps()
-
+    # Temp files of preview writes a crash interrupted (#317), off the
+    # import path: the walk may cover a large thumbnails folder.
     threading.Thread(
-        target=_preview_startup,
+        target=api.sweep_thumbnail_temps,
         name="PromptManagerPreviewTempSweep",
         daemon=True,
     ).start()
@@ -130,7 +120,6 @@ except Exception as e:
         logger = get_logger("prompt_manager.init")
         logger.error(f"Failed to register API routes: {e}")
     except Exception:
-        # logging failed too; a report must never stop the node loading
         pass
 
 # Shared database, set up with the monitoring system below. Stays None when that
@@ -290,11 +279,11 @@ def _teardown_logger():
 
 
 def _stop_background_work():
-    """Stop the image monitor, the preview worker, the job worker threads
-    and the prompt cleanup thread against one TEARDOWN_SECONDS deadline, once.
+    """Stop the image monitor, the preview worker and the prompt cleanup
+    thread against one TEARDOWN_SECONDS deadline, once.
 
-    Returns ``{"monitor", "thumbnails", "workers", "tracker"}`` booleans
-    (True: it stopped), leaving out parts that never started. Later calls return a
+    Returns ``{"monitor", "thumbnails", "tracker"}`` booleans (True: it
+    stopped), leaving out parts that never started. Later calls return a
     copy of the first result. A Ctrl+C inside a step is logged and the
     step is False; one between steps is re-raised after the result (parts
     not reached are False) is stored and the ``atexit`` entry removed.
@@ -308,14 +297,11 @@ def _stop_background_work():
             api,
             _global_prompt_tracker,
         )
-        from .utils import parallel
-
         # A part whose global is set has started; False until its step says
         # otherwise, so an interrupt between steps leaves an honest result.
         started = (
             ("monitor", monitor),
             ("thumbnails", thumbnails),
-            ("workers", parallel.job_pool_started() or None),
             ("tracker", tracker),
         )
         result = {name: False for name, part in started if part is not None}
@@ -358,16 +344,6 @@ def _stop_background_work():
                 result["thumbnails"] = _teardown_step(
                     "the preview worker", close_previews, logger
                 )
-            if "workers" in result:
-
-                def stop_workers():
-                    from .utils.parallel import JOB_POOL_JOIN_SECONDS
-
-                    return parallel.shutdown_job_pool(left(JOB_POOL_JOIN_SECONDS))
-
-                result["workers"] = _teardown_step(
-                    "the job worker threads", stop_workers, logger
-                )
             if tracker is not None:
 
                 def stop_tracker():
@@ -435,7 +411,6 @@ except Exception as e:
             f"Failed to register the exit signal: {e}"
         )
     except Exception:
-        # logging failed too; a report must never stop the node loading
         pass
 
 try:
@@ -453,14 +428,16 @@ except Exception as e:
             f"Failed to register the background work teardown: {e}"
         )
     except Exception:
-        # logging failed too; a report must never stop the node loading
         pass
 
 __all__ = ["NODE_CLASS_MAPPINGS", "NODE_DISPLAY_NAME_MAPPINGS", "WEB_DIRECTORY"]
 
-# One startup line. ASCII only: a Windows console using a legacy code page
-# cannot print emoji, and a UnicodeEncodeError here would abort loading the node.
-print(
-    f"\033[94m[ComfyUI-PromptManager] Version:\033[0m {get_version()}"
-    f" - {len(NODE_CLASS_MAPPINGS)} tools loaded"
-)
+# Print startup message with loaded tools
+print()
+print(f"\033[94m[ComfyUI-PromptManager] Version:\033[0m {get_version()}")
+for node_key, display_name in NODE_DISPLAY_NAME_MAPPINGS.items():
+    # ASCII only: a Windows console using a legacy code page cannot print emoji,
+    # and a UnicodeEncodeError here would abort loading the whole node.
+    print(f"  \033[94mLoaded:\033[0m {display_name}")
+print(f"\033[94mTotal: {len(NODE_CLASS_MAPPINGS)} tools loaded\033[0m")
+print()

database/image_removal.py

@@ -43,7 +43,6 @@ from .image_categories import DELETE_SQL as DELETE_CATEGORY_SQL
 from .image_removal_schema import (
     META_TABLE,
     TABLE,
-    bump_generation,
     clear_marks,
     has_marks_table,
     mark_of,
@@ -320,29 +319,4 @@ class ImageRemovalOperations:
         if not locators:
             return 0
         with self._pair_transaction() as conn:
-            removed = clear_marks(conn, locators)
-        # #498: again after the commit, so a reader that cached the marks
-        # between the in-transaction bump and the commit reloads them.
-        bump_generation()
-        return removed
-
-    def clear_hiding_marks(self, files) -> set:
-        """Delete the marks that still hide their file (#498, Return to library).
-
-        *files* are ``(locator, path)`` pairs. In one ``BEGIN IMMEDIATE``
-        transaction each mark is read again and deleted only while the file at
-        *path* still has its size and ``mtime_ns``. Returns the locators whose
-        marks went.
-        """
-        cleared = set()
-        files = list(files)
-        if not files:
-            return cleared
-        with self._pair_transaction() as conn:
-            for locator, path in files:
-                mark = mark_of(conn, locator)
-                if mark is not None and mark_hides({locator: mark}, locator, path):
-                    cleared.add(locator)
-            clear_marks(conn, sorted(cleared))
-        bump_generation()
-        return cleared
+            return clear_marks(conn, locators)

database/image_removal_schema.py

@@ -155,11 +155,6 @@ def _bump() -> None:
     _generation += 1
 
 
-def bump_generation() -> None:
-    """Move the generation after a commit (a cached read made before it reloads)."""
-    _bump()
-
-
 def has_marks_table(conn: sqlite3.Connection) -> bool:
     return (
         conn.execute(

database/library_move.py

@@ -78,10 +78,6 @@ MESSAGES = {
     ),
     "same-folder": "The new folder is the node folder itself.",
     "target-invalid": "The new folder cannot hold the library.",
-    "data-dir-served": (
-        "The new folder is inside Prompt Manager's thumbnail folder. Nothing was "
-        "moved."
-    ),
     "target-has-library": (
         "The new folder already holds a Prompt Manager library. Nothing was moved."
     ),
@@ -594,7 +590,6 @@ class _Move:
             try:
                 os.rmdir(self.plan.target_dir)
             except OSError:
-                # not empty or already gone: the undo leaves it alone
                 pass
 
 

database/managed_connection.py

@@ -35,51 +35,38 @@ from __future__ import annotations
 
 import contextlib
 import logging
-import operator
-import sys
 import threading
 import time
 import weakref
-from collections import deque
-from typing import Any, Callable, Iterable, Iterator, List, Optional
+from typing import Iterable, Iterator, List, Optional
 
 import sqlite3
 
 CLOSED_MESSAGE = "Cannot operate on a closed database."
 # Rows fetched per step when a cursor is iterated: the connection is marked
 # in use once per chunk instead of once per row (iteration costs about what
-# a plain cursor costs). Prefetched rows belong to the cursor so iteration
-# and explicit fetches always advance the same position.
+# a plain cursor costs). A loop that stops early leaves up to this many rows
+# fetched; ``fetchone``/``fetchmany`` after a partial loop skip them.
 ITER_CHUNK = 128
 
 
 class ManagedCursor(sqlite3.Cursor):
     """A cursor whose calls into SQLite count as its connection being in use."""
 
-    def __init__(self, *args: Any, **kwargs: Any) -> None:
-        super().__init__(*args, **kwargs)
-        self._pending = deque()
-        self._closed = False
-
     def execute(self, sql, parameters=(), /):
-        return self._run_statement(super().execute, sql, parameters)
-
-    def executemany(self, sql, seq_of_parameters, /):
-        return self._run_statement(super().executemany, sql, seq_of_parameters)
-
-    def _run_statement(self, operation: Callable, *args: Any) -> ManagedCursor:
         conn = self.connection
         conn._enter()
-        description = self.description
-        completed = False
         try:
-            result = operation(*args)
-            completed = True
-            return result
+            return super().execute(sql, parameters)
+        finally:
+            conn._leave()
+
+    def executemany(self, sql, seq_of_parameters, /):
+        conn = self.connection
+        conn._enter()
+        try:
+            return super().executemany(sql, seq_of_parameters)
         finally:
-            # Argument parsing can fail before SQLite replaces the old statement.
-            if completed or self.description is not description:
-                self._pending.clear()
             conn._leave()
 
     def executescript(self, sql_script, /):
@@ -94,8 +81,6 @@ class ManagedCursor(sqlite3.Cursor):
         conn = self.connection
         conn._enter()
         try:
-            if self._pending and not self._closed:
-                return self._pending.popleft()
             return super().fetchone()
         finally:
             conn._leave()
@@ -104,20 +89,7 @@ class ManagedCursor(sqlite3.Cursor):
         conn = self.connection
         conn._enter()
         try:
-            # Let SQLite validate the original arguments, including version-specific
-            # handling of zero/negative sizes, before touching prefetched rows.
-            rows = super().fetchmany(*args, **kwargs)
-            if not self._pending:
-                return rows
-            size = operator.index(
-                kwargs.get("size", args[0] if args else self.arraysize)
-            )
-            # Python 3.12 reads all rows for size=0; 3.13+ reads none.
-            if size == 0 and sys.version_info >= (3, 13):
-                return rows
-            self._pending.extend(rows)
-            count = len(self._pending) if size <= 0 else min(size, len(self._pending))
-            return [self._pending.popleft() for _ in range(count)]
+            return super().fetchmany(*args, **kwargs)
         finally:
             conn._leave()
 
@@ -125,31 +97,25 @@ class ManagedCursor(sqlite3.Cursor):
         conn = self.connection
         conn._enter()
         try:
-            rows = super().fetchall()
-            pending = list(self._pending)
-            self._pending.clear()
-            return pending + rows
+            return super().fetchall()
         finally:
             conn._leave()
 
     def __iter__(self) -> Iterator:
-        return self
+        return self._chunks()
+
+    def _chunks(self) -> Iterator:
+        while True:
+            rows = self.fetchmany(ITER_CHUNK)
+            if not rows:
+                return
+            yield from rows
 
     def __next__(self):
         conn = self.connection
-        pending = self._pending
-        # Buffered Python rows need no SQLite lock, but retirement and cursor
-        # close must still stop an iterator obtained before either operation.
-        if conn._retired or self._closed:
-            raise sqlite3.ProgrammingError(CLOSED_MESSAGE)
-        if pending:
-            return pending.popleft()
         conn._enter()
         try:
-            pending.extend(super().fetchmany(ITER_CHUNK))
-            if not pending:
-                raise StopIteration
-            return pending.popleft()
+            return super().__next__()
         finally:
             conn._leave()
 
@@ -160,10 +126,7 @@ class ManagedCursor(sqlite3.Cursor):
         except sqlite3.ProgrammingError:
             return super().close()  # the connection is closed or closing
         try:
-            result = super().close()
-            self._pending = deque()
-            self._closed = True
-            return result
+            return super().close()
         finally:
             conn._leave()
 
@@ -330,9 +293,6 @@ class ManagedConnection(sqlite3.Connection):
             cursors = list(self._cursors)
         try:
             for cursor in cursors:
-                if isinstance(cursor, ManagedCursor):
-                    cursor._pending = deque()
-                    cursor._closed = True
                 with contextlib.suppress(sqlite3.Error):
                     sqlite3.Cursor.close(cursor)
             super().close()

database/operations.py

@@ -34,7 +34,7 @@ from .history_reads import HistoryReadOperations
 from .health import HealthOperations, iter_consistency_issues
 from .duplicate_copies import DuplicateCopyOperations
 from .workflow_storage import WorkflowStorageOperations
-from .category_import import CategoryImportOperations
+from .category_import import CategoryImportOperations, EmptyReplacement  # noqa: F401
 from .image_categories import ImageCategoryOperations
 from .workflow_documents import (
     DocumentReader,

database/pairs.py

@@ -112,14 +112,8 @@ class PairOperations:
         tags: Optional[List[str]] = None,
         rating: Optional[int] = None,
         notes: Optional[str] = None,
-        fill_new_positive: bool = False,
     ) -> int:
-        """Save an ordered pair atomically; repeat saves preserve its metadata.
-
-        ``fill_new_positive`` also gives the positive prompt the category and
-        tags, only if this save inserted its row (#546). An existing prompt
-        never changes, so a cleared category stays cleared.
-        """
+        """Save an ordered pair atomically; repeat saves preserve its metadata."""
         with self._pair_transaction() as conn:
             return self._save_pair(
                 conn,
@@ -130,7 +124,6 @@ class PairOperations:
                 tags=tags,
                 rating=rating,
                 notes=notes,
-                fill_new_positive=fill_new_positive,
             )
 
     def _save_pair(
@@ -144,7 +137,6 @@ class PairOperations:
         tags: Optional[List[str]] = None,
         rating: Optional[int] = None,
         notes: Optional[str] = None,
-        fill_new_positive: bool = False,
     ) -> int:
         """Save an ordered pair atomically; repeat saves preserve its metadata."""
         if not isinstance(positive_text, str) or not positive_text.strip():
@@ -152,13 +144,8 @@ class PairOperations:
         if not isinstance(negative_text, str):
             raise ValueError("Negative prompt text must be a string; use '' for empty")
         # Validate metadata before any component insertion.
-        tags = _validate_metadata(title, category, tags, rating, notes)
-        positive, created = self._pair_component_outcome(conn, positive_text)
-        if created and fill_new_positive:
-            conn.execute(
-                "UPDATE prompts SET category = ? WHERE id = ?", (category, positive)
-            )
-            self._sync_prompt_tags(conn, positive, tags or [])
+        _validate_metadata(title, category, tags, rating, notes)
+        positive = self._pair_component(conn, positive_text)
         negative = (
             self._pair_component(conn, negative_text) if negative_text.strip() else None
         )

database/review_decisions.py

@@ -5,12 +5,8 @@ A decision is one row of ``media_review_decisions`` for one item revision.
 ingester's compatible-only rules (``_ingest_resolved_pair_in``) in the same
 ``_pair_transaction`` as the decision row, the item's new state and revision
 and the review index revision; any conflict or later failure rolls all of it
-back. ``manual`` (#536) is the same but for a Library prompt the reviewer chose:
-its link's provenance names a manual choice and carries no prompt sides, so it
-cannot pose as file evidence, and the decision's ``candidate_hash`` (the table
-requires one) is the digest of that choice. ``unresolved`` records the decision
-and links nothing. No decision counts a run, touches usage or calls an execution
-writer.
+back. ``unresolved`` records the decision and links nothing. No decision
+counts a run, touches usage or calls an execution writer.
 
 Callers verify the file first (the capture must be the item's bytes and the
 current file must still hash to them); nothing here reads the filesystem.
@@ -21,7 +17,6 @@ import sqlite3
 
 from .annotation_schema import BYTES_TABLE
 from .annotations import _new_id
-from .library import _ELIGIBLE, _FROM, SHELVED
 from .library_commands import LibraryCommandError
 from .models import utc_now_iso
 from .review import (
@@ -35,28 +30,9 @@ from .review import (
     same_name_rows,
 )
 from .review_changes import notify_review_change
-from .review_schema import (
-    DECISIONS_TABLE,
-    ITEMS_TABLE,
-    canonical_evidence,
-    evidence_digest,
-)
+from .review_schema import DECISIONS_TABLE, ITEMS_TABLE, canonical_evidence
 
 DECISION_KIND = "user-selection"
-MANUAL_KIND = "manual-link"
-_MANUAL_POSITIVE = (
-    f"SELECT p.id,p.text FROM {_FROM} "  # nosec B608
-    f"WHERE p.id=? AND {_ELIGIBLE} AND {SHELVED}"
-)
-_MANUAL_PAIR = (
-    "SELECT COALESCE(n.text,'') AS negative FROM prompt_pairs pp "
-    "LEFT JOIN prompts n ON n.id=pp.negative_prompt_id "
-    "WHERE pp.id=? AND pp.positive_prompt_id=? AND pp.archived=0"
-)
-_ARCHIVED_BARE_PAIR = (
-    "SELECT 1 FROM prompt_pairs WHERE positive_prompt_id=? "
-    "AND negative_prompt_id IS NULL AND archived=1"
-)
 _INSERT_DECISION = (
     f"INSERT INTO {DECISIONS_TABLE}(id,item_id,decision_revision,"  # nosec B608
     "created_at,outcome,candidate_hash,evidence,pair_id,image_id) "
@@ -83,8 +59,6 @@ class ReviewCommandError(LibraryCommandError):
     ``fingerprint`` the current dependency fingerprint, when known;
     ``changed`` marks an association conflict caused by links that changed
     since the reviewer read them (rather than an incompatible choice).
-    ``prompt-missing``: the Library prompt or recipe of a manual link is gone,
-    archived or not that prompt's.
     """
 
     def __init__(
@@ -119,7 +93,6 @@ class ReviewDecisionOperations:
         sha256: str,
         outcome: str,
         candidate: dict | None = None,
-        manual: dict | None = None,
         image_path: str | None = None,
         metadata: dict | None = None,
         expected_fingerprint: str | None = None,
@@ -128,9 +101,7 @@ class ReviewDecisionOperations:
     ) -> dict:
         """Record the decision; return ``{item, total, pair}``.
 
-        ``selected`` needs the evidence ``candidate`` (with its ``hash``) or
-        ``manual`` (``{positive_id, pair_id}``; a null ``pair_id`` is no
-        negative), the
+        ``selected`` needs the evidence ``candidate`` (with its ``hash``), the
         ``image_path`` the scan and the monitor link under, the captured
         ``metadata`` and the ``expected_fingerprint`` the reviewer saw.
         ``aliases`` are the other spellings legacy rows of the same physical
@@ -144,12 +115,9 @@ class ReviewDecisionOperations:
         if outcome not in ("selected", "unresolved"):
             raise ValueError("outcome must be selected or unresolved")
         if outcome == "selected" and (
-            (not isinstance(candidate, dict)) == (not isinstance(manual, dict))
-            or not image_path
+            not isinstance(candidate, dict) or not image_path
         ):
-            raise ValueError(
-                "A selected decision needs one candidate or manual choice and a file"
-            )
+            raise ValueError("A selected decision needs a candidate and a file")
         try:
             with self._pair_transaction() as conn:
                 decided = self._decide_in(
@@ -160,7 +128,6 @@ class ReviewDecisionOperations:
                     sha256=sha256,
                     outcome=outcome,
                     candidate=candidate,
-                    manual=manual,
                     image_path=image_path,
                     metadata=metadata or {},
                     expected_fingerprint=expected_fingerprint,
@@ -191,24 +158,13 @@ class ReviewDecisionOperations:
             raise _Rollback(ReviewCommandError("file-changed", epoch))
         decision_id = _new_id()
         pair = None
-        selected = command["outcome"] == "selected"
-        candidate = command["candidate"] if selected else None
-        manual = command["manual"] if selected else None
-        candidate_hash = candidate["hash"] if candidate is not None else None
+        candidate = command["candidate"] if command["outcome"] == "selected" else None
         if candidate is not None:
             pair = self._apply_candidate(
                 conn, epoch, current, decision_id, total, **command
             )
-        elif manual is not None:
-            pair = self._apply_manual(
-                conn, epoch, current, decision_id, total, **command
-            )
-            manual = {"positive_id": manual["positive_id"], "pair_id": pair["id"]}
-            candidate_hash = evidence_digest(
-                canonical_evidence({"kind": MANUAL_KIND, **manual})
-            )
         evidence = {
-            "kind": MANUAL_KIND if manual is not None else DECISION_KIND,
+            "kind": DECISION_KIND,
             "decision_id": decision_id,
             "outcome": command["outcome"],
             "reviewed_digest": command["sha256"],
@@ -218,8 +174,6 @@ class ReviewDecisionOperations:
             "dependency_fingerprint": command["expected_fingerprint"],
             "pair": pair,
         }
-        if manual is not None:
-            evidence["manual"] = manual
         now = utc_now_iso()
         self._insert_review_decision(
             conn,
@@ -229,7 +183,7 @@ class ReviewDecisionOperations:
                 current["revision"] + 1,
                 now,
                 command["outcome"],
-                candidate_hash,
+                candidate["hash"] if candidate is not None else None,
                 canonical_evidence(evidence),
                 pair["id"] if pair else None,
                 pair["image_id"] if pair else None,
@@ -250,77 +204,6 @@ class ReviewDecisionOperations:
         self, conn, epoch, current, decision_id, total, **command
     ) -> dict:
         """Link the candidate's pair, compatible-only; raise on any conflict."""
-        candidate = command["candidate"]
-        positive, negative = candidate["positive"], candidate["negative"]
-        provenance = {
-            "kind": DECISION_KIND,
-            "decision_id": decision_id,
-            "reviewed_digest": command["sha256"],
-            "candidate_hash": candidate["hash"],
-            "resolver_version": current["resolver_version"],
-            "positive": positive,
-            "negative": negative,
-        }
-        return self._link_compatible(
-            conn, epoch, current, total, positive, negative, provenance, command
-        )
-
-    def _apply_manual(self, conn, epoch, current, decision_id, total, **command):
-        """Link the chosen Library prompt, compatible-only; raise otherwise."""
-        missing = _Rollback(
-            ReviewCommandError("prompt-missing", epoch, item=current, total=total)
-        )
-        positive_id = command["manual"]["positive_id"]
-        pair_id = command["manual"]["pair_id"]
-        row = conn.execute(_MANUAL_POSITIVE, (positive_id,)).fetchone()
-        if row is None:
-            raise missing
-        positive_text, negative_text = row[1], ""
-        if pair_id is not None:
-            chosen = conn.execute(_MANUAL_PAIR, (pair_id, positive_id)).fetchone()
-            if chosen is None:
-                raise missing
-            negative_text = chosen[0]
-        elif conn.execute(_ARCHIVED_BARE_PAIR, (positive_id,)).fetchone():
-            raise missing
-        provenance = {
-            "kind": MANUAL_KIND,
-            "decision_id": decision_id,
-            "reviewed_digest": command["sha256"],
-            "resolver_version": current["resolver_version"],
-            "positive_id": positive_id,
-            "pair_id": pair_id,
-        }
-        # The sides name no provenance: only the ingester reads them.
-        pair = self._link_compatible(
-            conn,
-            epoch,
-            current,
-            total,
-            {"text": positive_text},
-            {"text": negative_text},
-            provenance,
-            command,
-        )
-        # A prompt whose stored hash is stale reaches another row: never link that.
-        reached = conn.execute(
-            "SELECT positive_prompt_id FROM prompt_pairs WHERE id=?", (pair["id"],)
-        ).fetchone()[0]
-        if reached != positive_id or pair_id not in (None, pair["id"]):
-            raise missing
-        return pair
-
-    def _link_compatible(
-        self,
-        conn,
-        epoch,
-        current,
-        total,
-        positive,
-        negative,
-        provenance,
-        command,
-    ) -> dict:
         # Imported here: pair_ingestion imports operations, which composes this.
         from .pair_ingestion import _ingest_resolved_pair_in
 
@@ -359,6 +242,17 @@ class ReviewDecisionOperations:
             # Enrich the one row of this file under the spelling it was
             # linked with, so the ingester's compatibility rules see it.
             image_path = rows[0][1]
+        candidate = command["candidate"]
+        positive, negative = candidate["positive"], candidate["negative"]
+        provenance = {
+            "kind": DECISION_KIND,
+            "decision_id": decision_id,
+            "reviewed_digest": command["sha256"],
+            "candidate_hash": candidate["hash"],
+            "resolver_version": current["resolver_version"],
+            "positive": positive,
+            "negative": negative,
+        }
         result = _ingest_resolved_pair_in(
             conn,
             self,

database/safety_backup.py

@@ -46,7 +46,6 @@ def remove_quietly(*paths):
             if path and os.path.exists(path):
                 os.remove(path)
         except OSError:
-            # cleanup after a failure must not replace that failure
             pass
 
 

database/vocabulary.py

@@ -66,6 +66,7 @@ def _tag_rows(page: str, order: str = "page.id") -> str:
     )
 
 
+_TAG_PAGE = _tag_rows("SELECT id,name FROM tags WHERE id>? ORDER BY id LIMIT ?")
 # #444 tag sorts: sort -> (key expression on tags/counted, direction). Ties and
 # "created" follow the id, so every order is total and keyset pages are exact.
 TAG_SORTS = {

docs/prompt-send-bridge.md

@@ -18,13 +18,9 @@ protocol and peer checks reject unrelated messages. Same-origin scripts are
 trusted; this transport is not authentication against other scripts on that origin.
 Unsupported messaging is reported without breaking existing ComfyUI nodes.
 
-Apply works in one click: without a preview, the sender requests the ticket itself
-and applies it. Preview remains optional, and shows the exact change first.
-
 An apply timeout or abort after posting means the outcome is unknown. It cannot
 prove the host cancelled the write. The sender must inspect a fresh destination
-preview or choose the destination again before sending again; automatic retry must
-not overwrite edits. An error the host returned is a refusal: nothing was written.
+preview before deciding to send again; automatic retry must not overwrite edits.
 
 ## PromptManager adapter
 
@@ -35,9 +31,7 @@ field. Unknown/ambiguous metadata must not become an empty string.
 
 Previews show original and requested text plus positive prepend/append composition.
 Connected composition is marked unknown rather than guessing upstream values.
-Connected destination fields reject writes. The sender compares the destination's revision
-(node object and graph version) from discovery with the one at the preview, and refuses if the workflow changed.
-Applying rechecks graph, node, widgets,
+Connected destination fields reject writes. Applying rechecks graph, node, widgets,
 values and connections. Ordinary serialization cache synchronization is accepted
 only when it preserves live values. Both requested roles are checked before writing.
 

prompt_manager_pair.py

@@ -230,8 +230,6 @@ class PromptManagerPair(PromptManagerFocused):
             negative_text,
             category=category.strip() or None,
             tags=self._parse_tags(tags),
-            # The Library shows the prompt's own category and tags, not the pair's.
-            fill_new_positive=True,
         )
         pair = self.db.get_prompt_pair(pair_id)
         prompt_id = pair["positive_prompt_id"]

py/api/__init__.py

@@ -11,7 +11,6 @@ Split into domain-specific mixins for maintainability:
 - JobRoutesMixin: the session job registry behind Activity (py/api/jobs.py)
 - ImageTagJobsMixin: bulk Add tags / Auto-tag as image-tags jobs
 - ThumbnailJobsMixin: thumbnail plan, thumbnail job and the gallery stream on it
-- ThumbnailLocationMixin: the thumbnail location check and payloads (#320)
 - ThumbnailConvertMixin: Convert outdated thumbnails (#317), a thumbnail job mode
 - AutoThumbnailMixin: previews made on first view, on capture and after a scan
 - ReviewRoutesMixin: the Needs review queue, item detail and decisions
@@ -61,7 +60,6 @@ from .settings_routes import SettingsRoutesMixin
 from .job_routes import JobRoutesMixin
 from .image_tag_jobs import ImageTagJobsMixin
 from .thumbnail_jobs import ThumbnailJobsMixin
-from .thumbnail_location import ThumbnailLocationMixin
 from .thumbnail_convert import ThumbnailConvertMixin
 from .thumbnail_auto import AutoThumbnailMixin
 from .system import SystemRoutesMixin
@@ -80,15 +78,12 @@ from .lora_integration import LoraIntegrationMixin
 from .lora_import_routes import LoraImportRoutesMixin
 from .image_categories import ImageCategoryRoutesMixin
 from .image_delete import ImageDeleteMixin
-from .image_return import ImageReturnMixin
 from .source_rescope import SourceRescopeMixin
 
 try:
     from ...database.operations import PromptDatabase
     from ...utils.file_prompt import parse_comfyui_prompt
     from ...utils.logging_config import get_logger
-    from ...utils.native_memory import release_free_memory
-    from ...utils.png_text import png_text
     from ...utils.video_metadata import is_video_path, read_video_metadata
 except ImportError:
     import sys
@@ -99,8 +94,6 @@ except ImportError:
     from database.operations import PromptDatabase
     from utils.file_prompt import parse_comfyui_prompt
     from utils.logging_config import get_logger
-    from utils.native_memory import release_free_memory
-    from utils.png_text import png_text
     from utils.video_metadata import is_video_path, read_video_metadata
 
 
@@ -340,7 +333,6 @@ class PromptManagerAPI(
     JobRoutesMixin,
     ImageTagJobsMixin,
     ThumbnailJobsMixin,
-    ThumbnailLocationMixin,
     ThumbnailConvertMixin,
     AutoThumbnailMixin,
     SystemRoutesMixin,
@@ -357,7 +349,6 @@ class PromptManagerAPI(
     LoraImportRoutesMixin,
     ImageCategoryRoutesMixin,
     ImageDeleteMixin,
-    ImageReturnMixin,
     SourceRescopeMixin,
 ):
     """REST API handler for PromptManager operations and web interface.
@@ -533,14 +524,6 @@ class PromptManagerAPI(
             return await loop.run_in_executor(None, call)
         return await loop.run_in_executor(None, func, *args)
 
-    async def _release_job_memory(self):
-        """After a scan or thumbnail job: glibc's free heap pages go back to
-        the OS once (``malloc_trim(0)``; nothing elsewhere, #523)."""
-        try:
-            await self._run_in_executor(release_free_memory)
-        except Exception:  # best effort: the job's result already stands
-            self.logger.debug("Releasing free memory failed", exc_info=True)
-
     def _root_listing(self, root) -> RootListing:
         """The shared listing record of one output root (created empty)."""
         return self._root_listings.setdefault(str(root), RootListing())
@@ -745,7 +728,6 @@ class PromptManagerAPI(
         self._register_lora_import_routes(routes)
         self._register_image_category_routes(routes)
         self._register_image_delete_routes(routes)
-        self._register_image_return_routes(routes)
         self._register_rescope_routes(routes)
 
         # Register gzip compression middleware (once)
@@ -855,11 +837,20 @@ class PromptManagerAPI(
                         f"{url_quote(rel_path.as_posix(), safe='/')}"
                     )
 
-                    # Any preview the file owns, the current format first
-                    # (#317); no store I/O here in folder mode (#320).
-                    from .images import listing_thumbnail_url
+                    # Any preview the file owns, the current format first (#317)
+                    from . import thumbnail_settings
+                    from .prompts import thumbnail_url_for
 
-                    thumbnail_url = listing_thumbnail_url(output_path, rel_path)
+                    existing = thumbnail_settings.existing_thumbnail(
+                        output_path, rel_path
+                    )
+                    thumbnail_url = None
+                    if existing is not None:
+                        thumb_rel = (
+                            thumbnail_settings.thumbnail_stem_rel(rel_path)
+                            + existing.suffix
+                        )
+                        thumbnail_url = thumbnail_url_for(thumb_rel, existing)
                     if thumbnail_url:
                         image["thumbnail_url"] = thumbnail_url
                     break  # Found matching root, stop searching
@@ -1054,8 +1045,6 @@ class PromptManagerAPI(
     def _extract_comfyui_metadata(self, image_path):
         """Embedded ComfyUI metadata of an image (PNG text chunks) or a video.
 
-        PNG text is read without decoding the pixels (``utils.png_text``, #523).
-
         Videos go through ffprobe (see utils/video_metadata). Unreadable files
         are a warning, not an error: a scan over a large output tree meets
         truncated and foreign files, and it carries on past them.
@@ -1064,7 +1053,7 @@ class PromptManagerAPI(
             return read_video_metadata(image_path)
         try:
             with Image.open(image_path) as img:
-                return png_text(img)
+                return dict(getattr(img, "text", None) or {})
         except Exception as e:
             self.logger.warning(
                 f"Unreadable image {os.path.basename(str(image_path))}: {e}"

py/api/admin.py

@@ -36,18 +36,10 @@ except ImportError:
 
 try:
     from ...utils import exit_signal
-    from ...utils.media_folders import (
-        in_trash_below_roots,
-        in_trash_folder,
-        is_skipped_folder,
-    )
+    from ...utils.media_folders import is_skipped_folder
 except ImportError:
     from utils import exit_signal
-    from utils.media_folders import (
-        in_trash_below_roots,
-        in_trash_folder,
-        is_skipped_folder,
-    )
+    from utils.media_folders import is_skipped_folder
 
 try:
     from ...database.image_removal import mark_hides
@@ -176,7 +168,7 @@ def _physical_file_key(path, stat):
     volumes on Windows) falls back to the resolved, case-folded path.
     """
     if stat.st_ino:
-        return ("inode", (stat.st_dev, stat.st_ino))
+        return ("inode", stat.st_dev, stat.st_ino)
     return ("path", os.path.normcase(os.path.realpath(str(path))))
 
 
@@ -249,12 +241,7 @@ SCAN_FINAL_STATES = {
     "error": "failed",
 }
 # The scope as the scan log's first line names it (the review dialog's words).
-SCAN_SCOPE_LOG = {
-    "new": "new and unresolved files",
-    "all": "all files",
-    "returned": "images returned to the library",
-}
-RETURN_JOB_TITLE = "Return images to the library"  # #498
+SCAN_SCOPE_LOG = {"new": "new and unresolved files", "all": "all files"}
 MIN_BATCHES_FOR_ESTIMATE = 2  # "about X min left" waits for this many batches
 # Log line prefix per outcome group (spec: + added, = known, ? review, ! error,
 # - no usable metadata).
@@ -539,7 +526,6 @@ def _diagnose_output_dirs(configured_dirs, public_path=None):
 
         candidates.append(folder_paths.get_output_directory())
     except ImportError:
-        # outside ComfyUI there is no output folder to add
         pass
 
     output_dirs = []
@@ -1098,21 +1084,13 @@ class AdminRoutesMixin:
         return result
 
     def _delete_one_duplicate(self, image_path, output_path):
-        """Delete one file and its thumbnail; return a failure reason or None.
-
-        What is removed is exactly the folder's real path plus the name: a
-        link is removed itself, never its target, and the preview removed is
-        that name's. Both the link's place and what it leads to are checked.
-        """
+        """Delete one file and its thumbnail; return a failure reason or None."""
         file_path = Path(image_path)
         if not file_path.is_absolute():
             file_path = output_path / file_path
 
         try:
-            real_root = output_path.resolve()
-            rel_path = file_path.resolve().relative_to(real_root)
-            exact = Path(os.path.realpath(file_path.parent)) / file_path.name
-            exact_rel = exact.relative_to(real_root)
+            rel_path = file_path.resolve().relative_to(output_path.resolve())
         except ValueError:
             self.logger.warning(
                 f"Attempted to delete file outside output directory: {image_path}"
@@ -1121,19 +1099,15 @@ class AdminRoutesMixin:
 
         if file_path.suffix.lower() not in DELETABLE_MEDIA_EXTENSIONS:
             return "not a media file"
-        if "thumbnails" in rel_path.parts or "thumbnails" in exact_rel.parts:
+        if "thumbnails" in rel_path.parts:
             return "thumbnails are managed by the gallery"
-        if in_trash_below_roots(file_path, [output_path]) or in_trash_folder(
-            str(exact_rel)
-        ):
-            return "it is in a trash folder"  # never unlinked from a trash (#543)
 
         if not file_path.is_file():
             return "file not found"
 
-        os.remove(exact)
+        os.remove(file_path)
         self.logger.info(f"Deleted duplicate image: {image_path}")
-        _remove_thumbnail(real_root, exact_rel, self.logger)
+        _remove_thumbnail(output_path.resolve(), rel_path, self.logger)
         return None
 
     async def get_statistics(self, request):
@@ -1407,17 +1381,13 @@ class AdminRoutesMixin:
             }
         )
 
-    def _start_scan_job(
-        self, files=DEFAULT_SCAN_SCOPE, roots=None, output_dirs=None, returned=None
-    ):
+    def _start_scan_job(self, files=DEFAULT_SCAN_SCOPE, roots=None, output_dirs=None):
         """Register the scan job synchronously; its runner starts on the loop.
 
         ``files`` is the scope (``SCAN_SCOPES``). ``roots`` selects sources by
         their index in ``output_dirs`` (the effective sources the caller
         resolved); None scans every source, resolved when the job starts.
-        Raises JobBusy while another record-changing job runs. ``returned``
-        (#498, ``[(path, locator)]``) makes it "Return images to the library":
-        those files' removal marks go first, then only they are scanned.
+        Raises JobBusy while another record-changing job runs.
         """
         if files not in SCAN_SCOPES:
             raise ValueError(f"Unknown scan scope: {files!r}")
@@ -1425,26 +1395,20 @@ class AdminRoutesMixin:
             output_dirs is None or not roots or max(roots) >= len(output_dirs)
         ):
             raise ValueError("A scoped scan needs the sources its roots index")
-        scope = {"files": files, "roots": None if roots is None else list(roots)}
-        if returned is not None:
-            scope = {"files": "returned", "roots": None, "images": len(returned)}
         job = self._jobs.start(
             SCAN_JOB_KIND,
-            SCAN_JOB_TITLE if returned is None else RETURN_JOB_TITLE,
+            SCAN_JOB_TITLE,
             record_changing=True,
-            scope=scope,
-            runner=functools.partial(
-                self._run_scan_job, output_dirs=output_dirs, returned=returned
-            ),
+            scope={"files": files, "roots": None if roots is None else list(roots)},
+            runner=functools.partial(self._run_scan_job, output_dirs=output_dirs),
             groups=SCAN_GROUP_NAMES,
         )
         self._scan_job = job
         return job
 
-    async def _run_scan_job(self, job, output_dirs=None, returned=None):
+    async def _run_scan_job(self, job, output_dirs=None):
         final = None
-        extra = {} if returned is None else {"returned": returned}
-        async for payload in self._scan_images_events(job, output_dirs, **extra):
+        async for payload in self._scan_images_events(job, output_dirs):
             job.publish(payload)
             final = payload.get("type")
         state = SCAN_FINAL_STATES.get(final, "finished")
@@ -1454,7 +1418,6 @@ class AdminRoutesMixin:
             verb = "cancelled" if state == "cancelled" else "finished"
             job.log_line(f"Scan {verb} · {_plural(job.processed, 'file')} processed")
         job.finish(state)
-        await self._release_job_memory()
         if state == "finished":
             # After the scan, so the guarded thumbnail job is admitted (#249).
             await self._hand_off_scan_thumbnails(job, output_dirs)
@@ -1483,7 +1446,7 @@ class AdminRoutesMixin:
             )
         return response
 
-    async def _scan_images_events(self, job, output_dirs=None, returned=None):
+    async def _scan_images_events(self, job, output_dirs=None):
         """Yield progress payloads while scanning the output directories.
 
         Every effective source is walked, or only those ``job.scope["roots"]``
@@ -1521,16 +1484,9 @@ class AdminRoutesMixin:
                 0, f"Scanning {len(walked)} directory(ies) for media files..."
             )
 
-            if returned is None:
-                media_files = await self._run_in_executor(
-                    self._collect_output_media_sync, walked
-                )
-            else:
-                # #498: only the files whose marks this job deleted.
-                media_files = await self._run_in_executor(
-                    self._clear_returned_marks, returned
-                )
-                job.log_line(f"Returned {_plural(len(media_files), 'image')}")
+            media_files = await self._run_in_executor(
+                self._collect_output_media_sync, walked
+            )
             counts = dict.fromkeys(SCAN_COUNT_KEYS, 0)
             job.update(
                 total=len(media_files),
@@ -1669,10 +1625,9 @@ class AdminRoutesMixin:
     def _extract_batch_metadata_sync(self, file_batch):
         """Extract metadata from a batch of files in one executor call.
 
-        Files are read on the long-lived job pool of
-        ``PromptManagerConfig.WORKER_THREADS`` threads (#523).
-        PNG text is read chunk by chunk without decoding pixels (#523); file
-        reads and ffprobe release the GIL.
+        Files are read on ``PromptManagerConfig.WORKER_THREADS`` threads:
+        Pillow decodes the whole image to reach trailing text chunks and
+        releases the GIL while doing so.
         """
         from ..config import PromptManagerConfig
 

py/api/annotation_suggest.py

@@ -13,6 +13,7 @@ import math
 from ..tagging_defaults import (  # noqa: F401 - re-exported for the route
     LLM_MODEL_TYPES as LLM_MODELS,
     MAX_INSTRUCTION_BYTES,
+    MAX_INSTRUCTION_CHARS,
     MODEL_TYPES,
     WD14_MODEL_TYPES as WD14_MODELS,
     validate_template,

py/api/autotag_routes.py

@@ -19,14 +19,14 @@ from .jobs import (
 )
 
 from .maintenance import disk_plan
-from .images import listing_thumbnail_url
-from . import preview_store
+from .prompts import thumbnail_url_for
+from . import thumbnail_settings
 from .. import model_gate
 
 try:
-    from ...utils.media_folders import in_trash_below_roots, is_skipped_folder
+    from ...utils.media_folders import is_skipped_folder
 except ImportError:
-    from utils.media_folders import in_trash_below_roots, is_skipped_folder
+    from utils.media_folders import is_skipped_folder
 
 from aiohttp import web
 
@@ -424,7 +424,6 @@ class AutotagRoutesMixin:
         title = f"Tagging model download · {label}"
         _download_titles.clear()
         _download_titles[owner] = title
-        admitted = False
         try:
             job = self._jobs.start(
                 MODEL_DOWNLOAD_JOB_KIND,
@@ -440,13 +439,13 @@ class AutotagRoutesMixin:
                     self._run_model_download, service, model_type, owner
                 ),
             )
-            admitted = True
-        except JobBusy as refused:
-            return None, busy_response(refused)
-        finally:
-            if not admitted:  # JobBusy, or anything else: give the gate back.
-                model_gate.release(owner)
-                _download_titles.pop(owner, None)
+        except BaseException as refused:
+            # JobBusy, or anything else the registry raised: give the gate back.
+            model_gate.release(owner)
+            _download_titles.pop(owner, None)
+            if isinstance(refused, JobBusy):
+                return None, busy_response(refused)
+            raise
 
         def ended(_task):
             model_gate.release(owner)
@@ -850,12 +849,9 @@ class AutotagRoutesMixin:
         """Return the real path when it is a media file inside an output directory."""
         if Path(str(raw_path)).suffix.lower() not in _MEDIA_EXTENSIONS:
             return None
-        roots = list(self._get_all_output_dirs())
-        for output_dir in roots:
+        for output_dir in self._get_all_output_dirs():
             if path_is_within(raw_path, output_dir):
                 real = os.path.realpath(raw_path)
-                if in_trash_below_roots(real, roots):
-                    return None  # thrown away, not an output (#543)
                 return real if os.path.isfile(real) else None
         return None
 
@@ -1042,12 +1038,12 @@ class AutotagRoutesMixin:
                 return self._bad_request('existing must be "skip" or "merge"')
             try:
                 options = self._single_options(data, model_type)
-            except OptionError as error:
-                return self._bad_request(str(error))
             except (ValueError, TypeError):
                 return self._bad_request(
                     "general_threshold and character_threshold must be numeric"
                 )
+            except OptionError as error:
+                return self._bad_request(str(error))
             target, error = await self._select_autotag_target(data)
             if error is not None:
                 return error
@@ -1371,21 +1367,23 @@ class AutotagRoutesMixin:
             files = await self._run_in_executor(
                 self._without_removed, output_path, files
             )
-            location = preview_store.current()
-            if location.mode == preview_store.FOLDER_MODE:
-                has_thumbnails = location.available  # no store I/O here (#320)
-            else:
-                store = preview_store.store_dir(output_path)
-                has_thumbnails = store is not None and store.is_dir()
+            has_thumbnails = (output_path / "thumbnails").is_dir()
 
             images = []
             for image_path in files:
                 rel_path = image_path.relative_to(output_path)
                 thumbnail_url = None
                 if has_thumbnails:
-                    # Any preview the file owns, the current format first
-                    # (#317); in folder mode without store I/O (#320).
-                    thumbnail_url = listing_thumbnail_url(output_path, rel_path)
+                    # Any preview the file owns, the current format first (#317)
+                    existing = thumbnail_settings.existing_thumbnail(
+                        output_path, rel_path
+                    )
+                    if existing is not None:
+                        thumb_rel = (
+                            thumbnail_settings.thumbnail_stem_rel(rel_path)
+                            + existing.suffix
+                        )
+                        thumbnail_url = thumbnail_url_for(thumb_rel, existing)
                 images.append(
                     {
                         "filename": image_path.name,

py/api/backup_restore.py

@@ -971,7 +971,6 @@ class BackupRestoreRoutesMixin:
         line = restored_line(staged.summary)
         job.log_line(line)
         job.update(progress=100, status_line=line)
-        return None
 
 
 async def _outlive_cancel(future):

py/api/duplicate_files.py

@@ -574,13 +574,12 @@ class DuplicateFilesMixin:
             return _fail_job(job, "sources-changed", SOURCES_CHANGED)
         ok, backup = await self._safety_backup_step(job, db, backup_on)
         if not ok:
-            return None
+            return
         try:
             await self._remove_duplicates(job, db, plan, backup)
         finally:
             if backup:
                 await self._prune_backup_pool(job, db)
-        return None
 
     async def _remove_duplicates(self, job, db, plan, backup):
         targets = plan.payload["targets"]

py/api/duplicate_review.py

@@ -16,11 +16,6 @@ from pathlib import Path
 from .admin import DELETABLE_MEDIA_EXTENSIONS
 from .maintenance import DUPLICATE_FILES
 
-try:
-    from ...utils.media_folders import in_trash_below_roots, is_trash_folder
-except ImportError:
-    from utils.media_folders import in_trash_below_roots, is_trash_folder
-
 # Keep entries one review takes; with paths of a few hundred characters the
 # list stays inside the preview body cap (DUPLICATE_PREVIEW_BODY_MAX, 1 MiB).
 MAX_KEEP = 2000
@@ -202,8 +197,6 @@ def file_problem(
     parts = Path(os.path.relpath(lexical, base)).parts
     if "thumbnails" in parts or ".." in parts:
         return OUTSIDE_SOURCE
-    if any(is_trash_folder(part) for part in parts[:-1]):
-        return OUTSIDE_SOURCE  # never removed from a trash folder (#543)
     if os.path.splitext(lexical)[1].lower() not in DELETABLE_MEDIA_EXTENSIONS:
         return OUTSIDE_SOURCE
     try:
@@ -219,8 +212,6 @@ def file_problem(
     try:
         if not _lexically_inside(_canonical_path(path), [_canonical_path(root)]):
             return OUTSIDE_SOURCE  # a linked folder on the way
-        if in_trash_below_roots(path, [root]):
-            return OUTSIDE_SOURCE  # a linked folder into a trash folder
         if keeper is not None:
             same = keeper_problem(path, root, info, keeper, keeper_root)
             if same:

py/api/duplicate_spellings.py

@@ -27,7 +27,7 @@ def _identity(path):
     except OSError:
         return None
     if info.st_ino:
-        return ("inode", (info.st_dev, info.st_ino))
+        return ("inode", info.st_dev, info.st_ino)
     return ("path", os.path.normcase(os.path.realpath(str(path))))
 
 

py/api/history.py

@@ -843,10 +843,7 @@ class HistoryRoutesMixin:
                 raise
 
         async def execute():
-            # An inspection reads the file's header and text: the
-            # interactive image pool (#523); media stays on the default.
-            run = self._run_image if kind == "inspection" else self._run_in_executor
-            pending = asyncio.create_task(run(project))
+            pending = asyncio.create_task(self._run_in_executor(project))
             try:
                 return await asyncio.shield(pending)
             except asyncio.CancelledError:

py/api/history_current.py

@@ -15,10 +15,9 @@ from typing import BinaryIO
 
 from aiohttp import web
 
-from . import preview_store, thumbnail_settings
+from . import thumbnail_settings
 from .images import _canonical, _public_path, SERVABLE_EXTENSIONS, VIDEO_EXTENSIONS
-from .images import in_trash_below_roots
-from .images import existing_media_thumbnail, media_preview_path
+from .images import existing_media_thumbnail, media_thumbnail_rel
 
 try:
     from ...utils.execution_outputs import (
@@ -199,9 +198,6 @@ def resolve_current_candidate(
         if namespace is None or not namespace.is_dir():
             return _unavailable("root_unavailable")
         target = _canonical(lexical)
-        if in_trash_below_roots(target, [namespace]):
-            # Every kind and the outputs listing come through here (#543).
-            return _unavailable("missing")
         if not _authorized(target, namespace, scope):
             return _unavailable("not_authorized")
         if target.suffix.lower() not in SERVABLE_EXTENSIONS:
@@ -244,36 +240,15 @@ def resolve_current_candidate(
         return _unavailable("temporary_unavailable", error=True)
 
 
-def _target_authorized(target, namespace, scope, store_root=None) -> bool:
-    """A preview in the thumbnail folder (#320, folder mode) is authorized by
-    the store of its source (``preview_store.owns``: inside the key folder,
-    no link); everything else by the output namespace and the roots."""
-    if (
-        store_root is not None
-        and preview_store.current().mode == preview_store.FOLDER_MODE
-    ):
-        return preview_store.owns(store_root, target)
-    return _authorized(target, namespace, scope)
-
-
 def _open_current_target(
-    target: Path,
-    namespace: Path,
-    scope: CurrentOutputScope,
-    preview: bool = False,
-    store_root: Path | None = None,
+    target: Path, namespace: Path, scope: CurrentOutputScope, preview: bool = False
 ) -> BinaryIO:
     """Open only the canonical target and verify authority against the actual handle.
 
-    A *preview* (a file under ``thumbnails/``) may also be JPEG XL (#317); in
-    folder mode it is authorized by the store of *store_root* (#320)."""
+    A *preview* (a file under ``thumbnails/``) may also be JPEG XL (#317)."""
     if _canonical(target) != target:
         raise CurrentLocationUnavailable("not_authorized", stale=True)
-    if in_trash_below_roots(target, [namespace]):
-        # Also at the open: the cover chooses its preview after the candidate
-        # check, and a preview can be a link into a trash folder (#543).
-        raise CurrentLocationUnavailable("missing")
-    if not _target_authorized(target, namespace, scope, store_root):
+    if not _authorized(target, namespace, scope):
         raise CurrentLocationUnavailable("not_authorized")
     suffix = target.suffix.lower()
     if suffix not in SERVABLE_EXTENSIONS and not (
@@ -306,7 +281,7 @@ def _open_current_target(
         if (
             _canonical(target) != target
             or (observed.st_dev, observed.st_ino) != (current.st_dev, current.st_ino)
-            or not _target_authorized(target, namespace, scope, store_root)
+            or not _authorized(target, namespace, scope)
         ):
             raise CurrentLocationUnavailable("not_authorized", stale=True)
         return os.fdopen(fd, "rb")
@@ -343,10 +318,12 @@ class _OpenedCurrentMedia:
 
 
 def _preview_writable(root: Path, preview: Path) -> bool:
-    """A preview may be written: the store of *root* and every link segment
-    of the preview's folder resolve inside it (the serve route's rule, #249;
-    ``preview_store.owns``)."""
-    return preview_store.owns(root, preview)
+    """A preview may be written: ``thumbnails`` and every link segment of the
+    preview's folder resolve inside *root* (the serve route's rule, #249)."""
+    folder = root / "thumbnails"
+    return _canonical(folder).is_relative_to(_canonical(root)) and _canonical(
+        preview
+    ).is_relative_to(_canonical(folder))
 
 
 def _is_jxl(path) -> bool:
@@ -396,12 +373,8 @@ def _cover_target(resolved, ensure_preview, placeholder, accepts_jxl):
         return _canonical(preview)
     if preview is not None:
         return _canonical(preview)
-    preview = media_preview_path(resolved.gallery_root, relative, create=True)
-    if (
-        ensure_preview is not None
-        and preview is not None
-        and _preview_writable(resolved.gallery_root, preview)
-    ):
+    preview = resolved.gallery_root / media_thumbnail_rel(relative)
+    if ensure_preview is not None and _preview_writable(resolved.gallery_root, preview):
         ensure_preview(target, preview, is_video)
     if is_video and placeholder is not None:
         return _placeholder_media(placeholder)
@@ -437,13 +410,7 @@ def _prepare_current_media(
             return chosen
         if chosen is not None:
             target, is_preview = chosen, True
-    handle = _open_current_target(
-        target,
-        resolved.namespace,
-        scope,
-        is_preview,
-        resolved.gallery_root if is_preview else None,
-    )
+    handle = _open_current_target(target, resolved.namespace, scope, is_preview)
     try:
         return _OpenedCurrentMedia(
             handle,

py/api/image_categories.py

@@ -232,17 +232,15 @@ class ImageCategoryRoutesMixin:
             return None, _coded(400, "too-many-images", TOO_MANY)
         return tuple(selection.targets), None
 
-    async def _category_request(self, request, fields: frozenset, data=None):
+    async def _category_request(self, request, fields: frozenset):
         """``(data, targets, roots, None)`` or ``(None, None, None, error)``.
 
         The images are ``items`` (1 to 500 targets) or ``filter`` (all images
-        an Images listing filter admits), besides *fields*. *data* is the body
-        when the caller has already read it (a body is read once).
+        an Images listing filter admits), besides *fields*.
         """
-        if data is None:
-            data, error = await _json_body_or_error(request)
-            if error is not None:
-                return None, None, None, error
+        data, error = await _json_body_or_error(request)
+        if error is not None:
+            return None, None, None, error
         names = set(data) - fields
         if set(data) & fields != fields or names not in ({"items"}, {"filter"}):
             return (

py/api/image_delete.py

@@ -330,13 +330,12 @@ class ImageDeleteMixin:
             return _fail_job(job, "sources-changed", SOURCES_CHANGED)
         ok, backup = await self._safety_backup_step(job, db, backup_on)
         if not ok:
-            return None
+            return
         try:
             await self._delete_images(job, db, targets, mode, backup)
         finally:
             if backup:
                 await self._prune_backup_pool(job, db)
-        return None
 
     async def _delete_images(self, job, db, targets, mode, backup):
         job.update(total=len(targets), status_line=TITLES[mode])

py/api/image_return.py

@@ -1,148 +0,0 @@
-"""Return removed images to the library (#498).
-
-``POST /prompt_manager/images/removed/return {items | filter}`` names files a
-removal mark hides (#480, "Remove from the library only"): ``items`` are 1 to
-500 listing identities, ``filter`` the removed view's listing query
-(``removed: "1"`` plus the view's other parameters, at most 500 images). Only
-this route takes ``removed``: every other bulk route refuses it, because an
-explicit write there would show a file again without re-reading it.
-
-The route answers 202 ``{job, returned, not_removed}`` after starting a
-``scan`` job titled "Return images to the library" (admission ``records``:
-409 ``busy`` beside a scan, restore or delete, nothing changed). The job
-first deletes the marks that still hide their file (same size and
-``mtime_ns``), in one transaction, then scans exactly those files with the
-scan's own pipeline: prompts, links, pairs and Needs review items come back
-from the files' embedded metadata. Image tags, auto-tag marks, the own
-category, collection memberships and the favorite were deleted by the remove
-and do not come back. No file is moved, written or deleted.
-"""
-
-import os
-from pathlib import Path
-
-from aiohttp import web
-
-from .image_categories import TOO_MANY, _coded
-from .images import (
-    ListingSourceChanged,
-    _favorite_relative_key,
-    _json_body_or_error,
-    parse_listing_filter,
-)
-from .image_tag_jobs import MAX_JOB_TARGETS
-from .jobs import JobBusy
-from .job_routes import busy_response
-
-try:
-    from ...database.image_removal import mark_hides
-except ImportError:
-    from database.image_removal import mark_hides
-
-NONE_REMOVED = "None of the selected images are removed from the library."
-SOURCE_CHANGED = "The image sources changed. Reload Images and try again."
-
-
-def _bad(message):
-    return web.json_response({"success": False, "error": message}, status=400)
-
-
-class ImageReturnMixin:
-    """Return to library (#498): clear the marks, then scan those files."""
-
-    def _register_image_return_routes(self, routes):
-        # A fixed path beside the dynamic /images/{image_id} routes.
-        @routes.post("/prompt_manager/images/removed/return")
-        async def return_removed_images_route(request):
-            return await self.return_removed_images(request)
-
-    async def return_removed_images(self, request):
-        data, error = await _json_body_or_error(request)
-        if error is not None:
-            return error
-        if set(data) == {"filter"}:
-            targets, roots, error = await self._removed_filter_targets(data["filter"])
-        else:
-            _data, targets, roots, error = await self._category_request(
-                request, frozenset(), data=data
-            )
-        if error is not None:
-            return error
-        files = {}
-        for index in dict.fromkeys(t[0] for t in targets):
-            files[index] = await self._get_gallery_files(roots[index])
-        returned, not_removed = await self._run_in_executor(
-            self._hidden_targets, roots, targets, files
-        )
-        if not returned:
-            return _coded(400, "no-images", NONE_REMOVED)
-        try:
-            job = self._start_scan_job(
-                files="all", output_dirs=list(roots), returned=returned
-            )
-        except JobBusy as busy:
-            return busy_response(busy)
-        return web.json_response(
-            {
-                "success": True,
-                "job": job.summary(),
-                "returned": len(returned),
-                "not_removed": not_removed,
-            },
-            status=202,
-        )
-
-    async def _removed_filter_targets(self, raw):
-        """``(targets, roots, None)`` for the removed view's filter, else an error."""
-        if not isinstance(raw, dict) or raw.get("removed") != "1":
-            return None, None, _bad('filter must hold removed: "1"')
-        rest = {key: value for key, value in raw.items() if key != "removed"}
-        try:
-            parse_listing_filter(rest)
-            selection = await self.resolve_listing_filter(
-                {**rest, "removed": "1"}, MAX_JOB_TARGETS
-            )
-        except ListingSourceChanged:
-            return None, None, _coded(409, "source-changed", SOURCE_CHANGED)
-        except ValueError as exc:
-            return None, None, _bad(str(exc))
-        if selection.truncated:
-            return None, None, _coded(400, "too-many-images", TOO_MANY)
-        if not selection.targets:
-            return None, None, _coded(400, "no-images", NONE_REMOVED)
-        return tuple(selection.targets), list(self._get_all_output_dirs()), None
-
-    def _hidden_targets(self, roots, targets, files):
-        """``([(path, locator)], not_removed)``: the targets a mark hides now.
-
-        Each target is matched to its listed spelling (the walk's). One
-        physical file named twice (nested roots) is returned once; a target
-        that is not listed or not hidden counts in ``not_removed``.
-        """
-        marks = self._removal_marks()
-        listings, seen, returned, not_removed = {}, set(), [], 0
-        for index, _scope, relative in targets:
-            root = roots[index]
-            if index not in listings:
-                listings[index] = self._favorite_listing(root, files[index])
-            spelled = listings[index].get(_favorite_relative_key(relative))
-            if spelled is None:
-                not_removed += 1
-                continue
-            path = os.path.join(str(root), *spelled.split("/"))
-            locator = os.path.normcase(os.path.realpath(path))
-            if locator in seen:
-                continue
-            if not mark_hides(marks, locator, path):
-                not_removed += 1
-                continue
-            seen.add(locator)
-            returned.append((Path(path), locator))
-        return returned, not_removed
-
-    def _clear_returned_marks(self, returned) -> list:
-        """The paths whose marks this deleted (blocking; one transaction)."""
-        cleared = self.db.clear_hiding_marks(
-            [(locator, str(path)) for path, locator in returned]
-        )
-        return [path for path, locator in returned if locator in cleared]

py/api/image_tag_jobs.py

@@ -531,7 +531,6 @@ class ImageTagJobsMixin:
         run = AutotagRun(
             model_type, existing, options, keep_in_memory, backup_on, owner
         )
-        admitted = False
         try:
             job = self._jobs.start(
                 AUTOTAG_BATCH_JOB_KIND,
@@ -542,12 +541,11 @@ class ImageTagJobsMixin:
                 groups=AUTOTAG_GROUP_NAMES,
                 runner=functools.partial(self._run_autotag_batch, run),
             )
-            admitted = True
-        except JobBusy as refused:
-            return None, _busy_refusal(refused)
-        finally:
-            if not admitted:
-                model_gate.release(owner)
+        except BaseException as refused:
+            model_gate.release(owner)
+            if isinstance(refused, JobBusy):
+                return None, _busy_refusal(refused)
+            raise
         job.task.add_done_callback(lambda _task: model_gate.release(owner))
         return job, None
 

py/api/images.py

@@ -34,14 +34,15 @@ from .gallery_listing import (
     WalkOutcome,
     walk_root,
 )
-from . import preview_store, thumbnail_settings
-from .thumbnail_location import location_refusal
+from . import thumbnail_settings
 from .thumbnail_encode import (
     PREVIEW_HELD,
     EncoderClosed,
     PreviewWriteHeld,
+    replace_unless_held,
     run_encoder,
     sweep_stray_temps,
+    temp_sibling,
     thumbnail_frame,
     writer_settings,
     write_thumbnail,
@@ -65,12 +66,7 @@ try:
     from ...database.models import normalize_image_path
     from ...database.run_attribution import recorded_output_lookup
     from ...utils.card_seed import card_seed, header_params, parsed_positive
-    from ...utils.media_folders import (
-        in_skipped_folder,
-        in_trash_below_roots,
-        in_trash_folder,
-        is_skipped_folder,
-    )
+    from ...utils.media_folders import in_skipped_folder, is_skipped_folder
     from ...utils.parallel import map_parallel
     from ...utils.json_strict import dumps_strict
     from ...utils.inspection_response import (
@@ -84,7 +80,7 @@ try:
         OpenerUnavailable,
         RevealGate,
         RevealTargetChanged,
-        is_same_origin_request,
+        is_local_request,
         reveal_executor,
         reveal_in_file_manager,
     )
@@ -96,12 +92,7 @@ except ImportError:
     from database.models import normalize_image_path
     from database.run_attribution import recorded_output_lookup
     from utils.card_seed import card_seed, header_params, parsed_positive
-    from utils.media_folders import (
-        in_skipped_folder,
-        in_trash_below_roots,
-        in_trash_folder,
-        is_skipped_folder,
-    )
+    from utils.media_folders import in_skipped_folder, is_skipped_folder
     from utils.parallel import map_parallel
     from utils.json_strict import dumps_strict
     from utils.inspection_response import (
@@ -115,7 +106,7 @@ except ImportError:
         OpenerUnavailable,
         RevealGate,
         RevealTargetChanged,
-        is_same_origin_request,
+        is_local_request,
         reveal_executor,
         reveal_in_file_manager,
     )
@@ -286,20 +277,10 @@ def _forbidden(message="Access denied"):
     return web.json_response({"success": False, "error": message}, status=403)
 
 
-def _file_not_found():
-    return web.json_response(
-        {"success": False, "error": "Image file not found"},
-        status=404,
-        headers={"Cache-Control": "no-store"},
-    )
-
-
 def _media_access_error(path, allowed_dirs):
-    """The response refusing *path*, or None when it may be read.
+    """Return a 403 response when *path* must not be served, else None.
 
-    Fails closed: an empty *allowed_dirs* denies everything (403). A file in a
-    trash folder below its root is thrown away, not an output: a 404, as if it
-    were not there (#543), also through a link or another spelling.
+    Fails closed: an empty *allowed_dirs* denies everything.
     """
     if Path(path).suffix.lower() not in SERVABLE_EXTENSIONS:
         return _forbidden("Only media files can be served")
@@ -307,8 +288,6 @@ def _media_access_error(path, allowed_dirs):
         return _forbidden("No allowed image directories configured")
     if not any(_is_within(path, root) for root in allowed_dirs):
         return _forbidden()
-    if in_trash_below_roots(path, allowed_dirs):
-        return _file_not_found()
     return None
 
 
@@ -338,6 +317,11 @@ def _thumbnail_batch_size(workers):
     return max(4, workers * 2)
 
 
+# Preview files are written by thumbnail_encode in the configured format
+# (thumbnail_settings, #317); these names stay importable from here.
+_temp_sibling = temp_sibling
+_replace_unless_held = replace_unless_held
+
 # A preview that could not be replaced (#249 S5 M6). Windows refuses to rename
 # over a file another process has open (WinError 5 or 32), such as a preview
 # the gallery is serving; the old preview stays and the file counts as an error.
@@ -390,7 +374,6 @@ def _video_placeholder_image(thumbnail_size):
             font=font,
         )
     except (OSError, AttributeError):
-        # a placeholder without its label still works
         pass
     return img
 
@@ -494,7 +477,6 @@ def _preview_names(folders, folder):
                     except OSError:
                         continue
         except OSError:
-            # an unreadable folder lists as empty; nothing there to cache
             pass
         folders[folder] = names
     return names
@@ -813,12 +795,12 @@ def _reveal_not_found():
     )
 
 
-def _not_same_origin():
+def _not_local():
     return web.json_response(
         {
             "success": False,
-            "code": "not-same-origin",
-            "error": "This page's address does not match the server's.",
+            "code": "not-local",
+            "error": "Show in folder works only on the computer running ComfyUI.",
         },
         status=403,
     )
@@ -997,8 +979,6 @@ def _settled_entry(root, relative):
         return None
     if in_skipped_folder(folders) or len(folders) > MAX_SCAN_DEPTH:
         return None
-    if in_trash_below_roots(path, [root]):
-        return None  # a linked folder on the way leads into a trash folder
     folder = os.fspath(root)
     for part in ("", *folders):
         folder = os.path.join(folder, part) if part else folder
@@ -1069,24 +1049,13 @@ def _iter_media_files(output_path, max_files):
 
 
 def media_thumbnail_rel(rel_path, settings=None):
-    """``thumbnails/<rel>_thumb<ext>`` (POSIX URL text) for the media file
-    *rel_path*: the name the preview gets when it is written now (#317),
-    images and videos alike (``writer_settings``' extension). Where it is on
-    disk is ``media_preview_path``."""
+    """``thumbnails/<rel>_thumb<ext>`` (POSIX) for the media file *rel_path*:
+    the name the preview gets when it is written now (#317), images and
+    videos alike (``writer_settings``' extension)."""
     settings = settings or writer_settings()
     return thumbnail_settings.thumbnail_rel(rel_path, settings.extension)
 
 
-def media_preview_path(output_path, rel_path, settings=None, *, create=False):
-    """Where the preview of *rel_path* is written now (``preview_store``);
-    *create* for a writer (a new source gets its key). None when nothing
-    may be written (the thumbnail folder is unavailable)."""
-    settings = settings or writer_settings()
-    return preview_store.preview_path(
-        output_path, rel_path, settings.extension, create=create
-    )
-
-
 def existing_media_thumbnail(output_path, rel_path):
     """The existing preview *rel_path* owns that a listing or cover shows
     (the format written now first, then older ones), or None. The Images
@@ -1096,27 +1065,6 @@ def existing_media_thumbnail(output_path, rel_path):
     )
 
 
-def listing_thumbnail_url(output_path, rel_path):
-    """The thumbnail URL of an older listing (``_enrich_images``, the
-    auto-tag scan), or None. These run on the event loop: in folder mode
-    (#320) the store is never touched there, so the URL names the preview
-    as it is written now and the serve route finds or makes it off the loop
-    (None while the thumbnail folder is unavailable)."""
-    from .prompts import thumbnail_url_for
-
-    location = preview_store.current()
-    if location.mode == preview_store.FOLDER_MODE:
-        if not location.available:
-            return None
-        quoted = urllib.parse.quote(media_thumbnail_rel(rel_path), safe="/")
-        return f"/prompt_manager/images/serve/{quoted}"
-    existing = thumbnail_settings.existing_thumbnail(output_path, rel_path)
-    if existing is None:
-        return None
-    thumb_rel = thumbnail_settings.thumbnail_stem_rel(rel_path) + existing.suffix
-    return thumbnail_url_for(thumb_rel, existing)
-
-
 def media_thumbnail(output_path, rel_path, root_index, *, root_scope=None):
     """``(thumbnail_url, ready)`` for *rel_path* under *output_path* (a few
     blocking stats). The Images listing, the Needs review queue cards and the
@@ -1212,10 +1160,7 @@ def _workspace_filters(query: Mapping) -> dict:
     the linked positive, and ``favorites=1`` keeps only favorites (the
     Favorites page, #249 D51). ``collection=<id>`` (1 to 9 digits) keeps only
     that collection's members (#331); it wins over ``favorites`` (a page never
-    sets both). ``removed=1`` lists only the files a removal mark hides (#498,
-    Show removed images); such a file has no records, so it never combines
-    with ``favorites``, ``collection``, ``category``, ``tags`` or the rating
-    sort. Raises ValueError for any unknown or oversized value.
+    sets both). Raises ValueError for any unknown or oversized value.
     """
     text = query.get("q", "").strip()
     folded = text.casefold()
@@ -1230,12 +1175,6 @@ def _workspace_filters(query: Mapping) -> dict:
     )
     favorites = query.get("favorites", "0")
     collection = query.get("collection", "")
-    removed = query.get("removed", "0")
-    if removed not in ("0", "1") or (
-        removed == "1"
-        and (favorites == "1" or collection or category or tags or order == "rating")
-    ):
-        raise ValueError("Invalid gallery filters")
     if (
         favorites not in ("0", "1")
         or (collection != "" and _COLLECTION_ID.fullmatch(collection) is None)
@@ -1263,7 +1202,6 @@ def _workspace_filters(query: Mapping) -> dict:
         "tags": tags,
         "favorites": favorites == "1" and not collection,
         "collection": int(collection) if collection else None,
-        "removed": removed == "1",
     }
 
 
@@ -1566,7 +1504,7 @@ class ImageRoutesMixin:
         async def clear_image_favorite_route(request):
             return await self.update_image_favorite(request, favorite=False)
 
-        # POST, same-origin: opens the server computer's file manager (D38).
+        # POST, local-only: opens this computer's file manager (D38).
         @routes.post("/prompt_manager/images/reveal")
         async def reveal_image_route(request):
             return await self.reveal_image(request)
@@ -2135,7 +2073,6 @@ class ImageRoutesMixin:
                         filters["tags"],
                         filters["favorites"],
                         filters["collection"],
-                        filters["removed"],
                     ]
                 ).encode()
             ).hexdigest()
@@ -2165,11 +2102,6 @@ class ImageRoutesMixin:
                     self._select_workspace_page, listings, filters, after, limit, scope
                 )
             )
-            # #498: Show removed images (N), every removed file in the selected
-            # source(s) whatever the filters (the hidden set is cached work).
-            removed_total = len(
-                await self._run_in_executor(self._hidden_entries, listings)
-            )
         except CollectionMissing:
             return collection_not_found()
         except Exception:
@@ -2196,7 +2128,6 @@ class ImageRoutesMixin:
             "limit": limit,
             "has_more": has_more,
             "next_cursor": next_cursor,
-            "removed_total": removed_total,
         }
         if positive_count is _COUNT_OMITTED:
             del result["positive_count"]
@@ -2520,12 +2451,9 @@ class ImageRoutesMixin:
             def key(entry):
                 return _workspace_key(entry, order)
 
-        # #480: files removed from the library stay on disk, hidden here; the
-        # removed view (#498) lists only them.
+        # #480: files removed from the library stay on disk, hidden here.
         hidden = self._hidden_entries(listings)
-        if filters.get("removed"):
-            entries = [entry for entry in entries if entry.normalized in hidden]
-        elif hidden:
+        if hidden:
             entries = [entry for entry in entries if entry.normalized not in hidden]
         return (
             entries,
@@ -2813,9 +2741,6 @@ class ImageRoutesMixin:
             if _has_traversal(filepath):
                 return _forbidden()
             suffix = Path(filepath).suffix.lower()
-            if in_trash_folder(filepath):
-                # Before any file access, so no preview is made for it (#543).
-                return _file_not_found()
             if suffix not in SERVABLE_EXTENSIONS and not (
                 # A JPEG XL preview is served from thumbnails/ only (#317).
                 suffix in thumbnail_settings.THUMBNAIL_EXTENSIONS
@@ -2831,59 +2756,14 @@ class ImageRoutesMixin:
                     output_dirs[0], filepath, int(root_param), len(outputs)
                 )
 
-            # Preview text is mapped by the resolver (#320); any other text,
-            # ``Thumbnails/...`` media on a case-sensitive disk included,
-            # keeps the plain join.
-            preview_parts = (
-                tuple(filepath.split("/"))
-                if preview_store.is_preview_text(filepath)
-                else None
-            )
-            location = preview_store.current()
-            if location.mode == preview_store.FOLDER_MODE:
-                if preview_parts is None and await self._run_image(
-                    self._in_source_thumbnails, output_dirs, filepath
-                ):
-                    # Previews live in the thumbnail folder: anything else
-                    # under a source's thumbnails/ is a leftover (#320), in
-                    # any case on a case-insensitive disk.
-                    return _forbidden()
-                if preview_parts is not None:
-                    # Store I/O never runs on the event loop (a share may
-                    # stall): the lookup runs on the image pool.
-                    found = await self._run_image(
-                        self._find_preview, output_dirs, preview_parts, location
-                    )
-                    if found == "forbidden":
-                        return _forbidden()
-                    if found is not None:
-                        return self._file_response(found)
             for output_path in output_dirs:
-                if (
-                    preview_parts is not None
-                    and location.mode == preview_store.FOLDER_MODE
-                ):
-                    break  # looked up above
-                if preview_parts is None:
-                    image_path = output_path / filepath
-                else:
-                    image_path = preview_store.request_path(output_path, preview_parts)
-                    if image_path is None:
-                        continue
+                image_path = output_path / filepath
                 if not image_path.exists():
                     continue
-                # A symlink that points outside the root (a preview: outside
-                # the folder holding its store) is a hard deny, not a
-                # fall-through to the next root.
-                container = (
-                    output_path
-                    if preview_parts is None
-                    else preview_store.store_container(output_path)
-                )
-                if not _is_within(image_path, container):
+                # A symlink that points outside the root is a hard deny, not
+                # a fall-through to the next root.
+                if not _is_within(image_path, output_path):
                     return _forbidden()
-                if in_trash_below_roots(image_path, output_dirs):
-                    return _file_not_found()
                 if image_path.is_file():
                     return self._file_response(image_path)
 
@@ -2906,48 +2786,6 @@ class ImageRoutesMixin:
                 {"success": False, "error": _safe_error(e)}, status=500
             )
 
-    @staticmethod
-    def _in_source_thumbnails(output_dirs, filepath):
-        """Whether *filepath* lies in a source's ``thumbnails`` folder: its
-        first part is ``thumbnails`` exactly, or another case of it that is
-        the same folder (a case-insensitive disk). ``Thumbnails/`` media on
-        a case-sensitive disk is another folder and stays served."""
-        first = filepath.split("/", 1)[0]
-        if first == "thumbnails":
-            return True
-        if first.casefold() != "thumbnails":
-            return False
-        for output_path in output_dirs:
-            spelled = output_path / first
-            cache = preview_store.source_folder(output_path)
-            try:
-                if spelled.is_dir() and cache.is_dir() and spelled.samefile(cache):
-                    return True
-            except OSError:
-                continue
-        return False
-
-    @staticmethod
-    def _find_preview(output_dirs, parts, location):
-        """The preview file *parts* names in folder mode, ``"forbidden"``
-        (it resolves out of its store or through a link) or None (blocking;
-        the first root whose store holds it, in ``_select_root`` order)."""
-        for output_path in output_dirs:
-            image_path = preview_store.request_path(output_path, parts, location)
-            if image_path is None:
-                continue
-            try:
-                with preview_store.store_io():
-                    if not os.path.lexists(image_path):
-                        continue
-                    if not preview_store.owns(output_path, image_path, location):
-                        return "forbidden"
-                    if image_path.is_file():
-                        return image_path
-            except OSError:
-                return None
-        return None
-
     def _is_recorded_media(self, path) -> bool:
         """Whether the database records ``path`` as a linked image.
 
@@ -2977,9 +2815,8 @@ class ImageRoutesMixin:
         if _is_thumbnail_cache_path(filepath):
             return _forbidden()
         image_path = root / filepath
-        denied = _media_access_error(image_path, [root])
-        if denied is not None:
-            return denied
+        if not _is_within(image_path, root):
+            return _forbidden()
         if not image_path.is_file():
             return web.json_response(
                 {"success": False, "error": "Image file not found"}, status=404
@@ -3074,9 +2911,6 @@ class ImageRoutesMixin:
         data, error = await _json_body_or_error(request)
         if error is not None:
             return error
-        refused = location_refusal()
-        if refused is not None:
-            return refused
         return await self._run_held(
             THUMBNAILS_JOB_KIND,
             THUMBNAIL_GENERATION_TITLE,
@@ -3096,7 +2930,6 @@ class ImageRoutesMixin:
             result = await self._run_in_executor(
                 self._generate_gallery_thumbnails_sync, output_dirs
             )
-            await self._release_job_memory()
             return web.json_response(result)
 
         except Exception as e:
@@ -3109,7 +2942,6 @@ class ImageRoutesMixin:
         """Blocking thumbnail generation loop (run in executor)."""
         settings = writer_settings(settings)
         start = _time.monotonic()
-        thumbnails_dir = preview_store.given_store(output_path, thumbnails_dir)
         plan = self._plan_thumbnails(output_path, thumbnails_dir, settings=settings)
         payload = self._execute_thumbnail_plan(plan, settings, start)
         payload["thumbnails_path"] = _public_path(thumbnails_dir)
@@ -3122,8 +2954,7 @@ class ImageRoutesMixin:
         start = _time.monotonic()
         plan = self._plan_gallery_thumbnails(output_dirs, settings=settings)
         payload = self._execute_thumbnail_plan(plan, settings, start)
-        store = preview_store.store_dir(output_dirs[0])
-        payload["thumbnails_path"] = None if store is None else _public_path(store)
+        payload["thumbnails_path"] = _public_path(output_dirs[0] / "thumbnails")
         return payload
 
     def _execute_thumbnail_plan(self, plan: dict, settings, start: float) -> dict:
@@ -3166,12 +2997,9 @@ class ImageRoutesMixin:
             if stop is not None and stop():
                 break
             root = Path(root)
-            store = preview_store.ensure_store(root)
-            if store is None:
-                continue  # the thumbnail folder is unavailable
             plan = self._plan_thumbnails(
                 root,
-                store,
+                root / "thumbnails",
                 mode=mode,
                 stop=stop,
                 settings=settings,
@@ -3210,8 +3038,6 @@ class ImageRoutesMixin:
                     "format": writer_settings().format,
                     # Files whose automatic preview failed this session (#249).
                     "failed": self._auto_thumbnail_failures(),
-                    # #320: where previews live (no path here, D6A).
-                    "location": self._thumbnail_location_payload(with_path=False),
                     "collection_id": hashlib.sha256(collection.encode()).hexdigest()[
                         :16
                     ],
@@ -3257,11 +3083,9 @@ class ImageRoutesMixin:
         """
         settings = writer_settings(settings)
         output_path = Path(output_path)
-        thumbnails_dir = preview_store.given_store(output_path, thumbnails_dir)
+        thumbnails_dir = Path(thumbnails_dir)
         plan = {key: 0 for key in _PLAN_COUNTS}
         plan.update(targets=[], fresh_files=[])
-        if thumbnails_dir is None:
-            return plan  # the thumbnail folder is unavailable
         folders = {}
         removed = self._removal_check_under(output_path)
         for src in _iter_media_files(output_path, MAX_GALLERY_FILES):
@@ -3351,9 +3175,6 @@ class ImageRoutesMixin:
             "dir": src.parent.name,
             "type": "video" if is_video else "image",
         }
-        # Taken when the write starts: a thumbnail location switched since
-        # then drops the write at its rename (#320).
-        guard = preview_store.write_guard(guard)
         dst = Path(dst)
         if dst.suffix != settings.extension:
             dst = dst.with_suffix(settings.extension)
@@ -3364,7 +3185,7 @@ class ImageRoutesMixin:
                 return {**result, "action": "error", "error": "File no longer exists"}
             if not rebuild and _thumbnail_is_fresh(src, dst):
                 return {**result, "action": "skipped", "path": str(dst)}
-            preview_store.make_parent(dst)
+            dst.parent.mkdir(parents=True, exist_ok=True)
             if is_video:
                 made = self._generate_video_thumbnail(
                     src,
@@ -3569,12 +3390,8 @@ class ImageRoutesMixin:
 
         Invalid thumbnail directories return 400; unavailable gallery roots
         return 404, and unexpected filesystem failures return 500. Holds the
-        registry as guarded work, like generation. Refused (409) while the
-        thumbnail folder is unavailable (#320).
+        registry as guarded work, like generation.
         """
-        refused = location_refusal()
-        if refused is not None:
-            return refused
         return await self._run_held(
             THUMBNAILS_JOB_KIND,
             THUMBNAIL_CLEAR_TITLE,
@@ -3638,12 +3455,8 @@ class ImageRoutesMixin:
             self.logger.debug(f"No roots to sweep for preview temp files: {exc}")
             return 0
         for output_path in output_dirs:
-            folder = preview_store.store_dir(output_path)
-            if (
-                folder is None
-                or preview_store.store_is_link(folder)
-                or not folder.is_dir()
-            ):
+            folder = Path(output_path) / "thumbnails"
+            if folder.is_symlink() or not folder.is_dir():
                 continue
             removed += sweep_stray_temps(folder)[0]
         if removed:
@@ -3661,16 +3474,13 @@ class ImageRoutesMixin:
         directories = []
         for output_path in output_dirs:
             output_path = Path(output_path)
-            thumbnails_dir = preview_store.store_dir(output_path)
-            if thumbnails_dir is None:
-                continue
+            thumbnails_dir = output_path / "thumbnails"
             if not thumbnails_dir.exists() and not thumbnails_dir.is_symlink():
                 continue
-            container = preview_store.store_container(output_path)
             if (
-                preview_store.store_is_link(thumbnails_dir)
-                or not _is_within(thumbnails_dir, container)
-                or _canonical(thumbnails_dir) == _canonical(container)
+                thumbnails_dir.is_symlink()
+                or not _is_within(thumbnails_dir, output_path)
+                or _canonical(thumbnails_dir) == _canonical(output_path)
             ):
                 raise ValueError(
                     "Safety check failed: invalid thumbnails directory path"
@@ -3685,15 +3495,7 @@ class ImageRoutesMixin:
             temps, temp_bytes = sweep_stray_temps(thumbnails_dir, min_age=0)
             cleared_count += temps
             cleared_size += temp_bytes
-            folder_mode = preview_store.current().mode == preview_store.FOLDER_MODE
-            for root, dirs, files in os.walk(thumbnails_dir):
-                if folder_mode:
-                    # Never into a junction or reparse point (#320).
-                    dirs[:] = [
-                        d
-                        for d in dirs
-                        if not preview_store.store_is_link(Path(root) / d)
-                    ]
+            for root, _dirs, files in os.walk(thumbnails_dir):
                 for name in files:
                     path = Path(root) / name
                     if (
@@ -3701,7 +3503,6 @@ class ImageRoutesMixin:
                         or path.suffix.lower()
                         not in thumbnail_settings.THUMBNAIL_EXTENSIONS
                         or path.is_symlink()
-                        or not preview_store.may_write(path)
                     ):
                         continue
                     try:
@@ -3861,12 +3662,12 @@ class ImageRoutesMixin:
     async def reveal_image(self, request):
         """POST ``{root_index, root_scope, path}``: show the file in its folder.
 
-        Same-origin and JSON-only, directly or through a proxy: the folder
-        opens on the computer running ComfyUI, wherever the browser is
-        (maintainer decision, #533). One reveal at a time (429 busy).
+        Local-only (a same-origin browser request from a loopback client, no
+        forwarding header) and JSON-only: the browser must run on the
+        computer whose file manager opens. One reveal at a time (429 busy).
         """
-        if not is_same_origin_request(request.headers, request.scheme):
-            return _not_same_origin()
+        if not is_local_request(request.remote, request.headers, request.scheme):
+            return _not_local()
         if request.content_type != "application/json":
             # A non-JSON POST is a CORS "simple" request with no preflight.
             return web.json_response(
@@ -3944,9 +3745,7 @@ class ImageRoutesMixin:
                 {
                     "success": False,
                     "code": "unavailable",
-                    "error": (
-                        "No file manager is available on the computer running ComfyUI."
-                    ),
+                    "error": "No file manager is available on this computer.",
                 },
                 status=501,
             )
@@ -4151,8 +3950,7 @@ class ImageRoutesMixin:
                     **observed,
                 )
 
-            # Header and text reads: the interactive image pool (#523).
-            body = await self._run_image(inspect)
+            body = await self._run_in_executor(inspect)
             if body is None:
                 return web.json_response(
                     {
@@ -4365,22 +4163,6 @@ class ImageRoutesMixin:
         # (which Windows refuses on open files) is not held up by it.
         return _CardFacts(width, height, *self._card_parse(path, records))
 
-    def _cached_card_facts(self, entry: tuple) -> _CardFacts | None:
-        path, mtime, root, index = entry[:4]
-        return self._workspace_card_cache.get((index, str(root)), {}).get((path, mtime))
-
-    def _card_facts_of(self, entries: list, *, parse: bool) -> list[_CardFacts]:
-        """Card facts of *entries*, in order; files not cached yet are read on
-        the interactive image pool (#523), cached ones answer here."""
-        found = [self._cached_card_facts(entry) for entry in entries]
-        missing = [i for i, facts in enumerate(found) if facts is None]
-        read = self._map_image(
-            lambda i: self._card_facts(entries[i], parse=parse), missing
-        )
-        for i, facts in zip(missing, read):
-            found[i] = facts
-        return found
-
     def _card_facts(self, entry: tuple, *, parse: bool) -> _CardFacts:
         """One listed image's card facts, read once per ``(path, mtime)``.
 
@@ -4389,11 +4171,11 @@ class ImageRoutesMixin:
         and drops the rest, and a roots change drops them all. Only files of
         the current scan are stored, so the cache is bounded by the listing.
         """
-        cached = self._cached_card_facts(entry)
-        if cached is not None:
-            return cached
         path, mtime, root, index = entry[:4]
         root_key, key = (index, str(root)), (path, mtime)
+        cached = self._workspace_card_cache.get(root_key, {}).get(key)
+        if cached is not None:
+            return cached
         facts = self._read_card_facts(path, parse=parse)
         if facts is None:
             # Not stored: a locked or half-written file may read next time.
@@ -4419,17 +4201,15 @@ class ImageRoutesMixin:
             if linked
             else {}
         )
-        # Videos: the card reads no video metadata. Library previews show
-        # no card facts, so they skip the parse (``parse=linked``).
-        stills = [image for image in images if not image["is_video"]]
-        read = self._card_facts_of(
-            [entries[(image["root_index"], image["path"])] for image in stills],
-            parse=linked,
-        )
-        facts_of = {id(image): facts for image, facts in zip(stills, read)}
         for image in images:
             entry = entries[(image["root_index"], image["path"])]
-            facts = facts_of.get(id(image), _NO_CARD_FACTS)
+            # Videos: the card reads no video metadata. Library previews show
+            # no card facts, so they skip the parse (``parse=linked``).
+            facts = (
+                _NO_CARD_FACTS
+                if image["is_video"]
+                else self._card_facts(entry, parse=linked)
+            )
             image["width"], image["height"] = facts.width, facts.height
             if not linked:
                 continue

py/api/job_routes.py

@@ -250,7 +250,7 @@ class JobRoutesMixin:
         try:
             await response.write(_summary_event(job))
             async with contextlib.aclosing(job.events()) as events:
-                async for _ in events:
+                async for _payload in events:
                     await response.write(_summary_event(job))
             # The last event is published before the job takes its final state.
             await response.write(_summary_event(job))

py/api/library_location.py

@@ -50,7 +50,6 @@ _REFUSAL_STATUS = {
     "not-movable": 400,
     "same-folder": 400,
     "target-invalid": 400,
-    "data-dir-served": 400,
     "target-has-library": 409,
     "target-conflict": 409,
     "insufficient-space": 507,
@@ -75,16 +74,6 @@ def _failure(message, status, code):
     )
 
 
-def _inside_thumbnail_folder(path):
-    """Whether *path* lies in the thumbnail folder in use (#320)."""
-    from . import preview_store
-
-    setting = preview_store.setting()
-    if setting.mode != preview_store.FOLDER_MODE or not setting.path:
-        return False
-    return ll._inside_any(path, [setting.path])
-
-
 def _plural(count, one, many=None):
     return f"{count:,} {one if count == 1 else (many or one + 's')}"
 
@@ -218,7 +207,6 @@ class LibraryLocationRoutesMixin:
         try:
             size = os.path.getsize(location.db_path)
         except OSError:
-            # no library file yet: report size 0
             pass
         return {
             "path": self._library_public_path(location.db_path),
@@ -283,8 +271,6 @@ class LibraryLocationRoutesMixin:
     def _plan_library_move(self):
         """The checked plan (blocking); raises MoveFailed."""
         plan = lm.plan_move(self._live_location())
-        if _inside_thumbnail_folder(plan.target_dir):
-            raise lm.MoveFailed("data-dir-served")
         if lm.space_problem(plan) is not None:
             raise lm.MoveFailed("insufficient-space")
         return plan
@@ -387,7 +373,6 @@ class LibraryLocationRoutesMixin:
         line += ". Logs move at the next restart."
         job.log_line(line)
         job.update(progress=100, status_line=line)
-        return None
 
     @staticmethod
     def _fail_library_move(job, code, message):

py/api/log_cleanup.py

@@ -205,4 +205,3 @@ class LogCleanupMixin:
             line += f", {failed} could not be deleted"
         job.log_line(line)
         job.update(processed=len(files), progress=100, status_line=line)
-        return None

py/api/lora_import_routes.py

@@ -436,7 +436,7 @@ class LoraImportRoutesMixin:
             job.log_line(f"{CANCELLED} {CACHE_NOTE}")
             job.update(status_line=CANCELLED)
             job.finish("cancelled")
-            return None
+            return
         except Exception:
             self.logger.exception("LoRA import staging failed")
             return _fail_job(job, "import-failed", f"{FAILED} {CACHE_NOTE}")
@@ -455,10 +455,10 @@ class LoraImportRoutesMixin:
             job.log_line(f"{CANCELLED} {CACHE_NOTE}")
             job.update(status_line=CANCELLED)
             job.finish("cancelled")
-            return None
+            return
         ok, _backup = await self._safety_backup_step(job, db, backup_on)
         if not ok:
-            return None
+            return
         # I1: the files are listed and fingerprinted again right before the
         # replace, so a file changed, removed or added while the downloads ran
         # (LoraManager refreshing its CivitAI info) aborts with nothing deleted.
@@ -466,7 +466,6 @@ class LoraImportRoutesMixin:
             return _fail_job(job, "plan-changed", f"{SOURCE_CHANGED} {CACHE_NOTE}")
         job.update(status_line="Replacing the LoRA collection", progress=95)
         await self._replace_in_job(job, db, plan, staged)
-        return None
 
     def _count_downloads(self, job, staged):
         downloaded = staged.stats.get("downloaded", 0)
@@ -519,4 +518,3 @@ class LoraImportRoutesMixin:
             staged.stats.get("download_errors", 0),
         )
         job.update(progress=100, processed=job.total, status_line=line)
-        return None

py/api/lora_integration.py

@@ -44,7 +44,6 @@ _FILES_CHANGED = (
     "The LoRA metadata files changed during the scan; the previous imports "
     "were kept. Run the scan again."
 )
-_LORA_SCAN_FAILED = "The LoRA import failed. Check the server log for details."
 _IMPORTS_CHANGED = (
     "The imported LoRA prompts changed during the scan; the previous imports "
     "were kept. Run the scan again."
@@ -408,21 +407,10 @@ class LoraIntegrationMixin:
             return
         if isinstance(error, PlanChanged):
             message = _IMPORTS_CHANGED
-        elif isinstance(
-            error,
-            (
-                LoraFilesChanged,
-                LoraSettingsUnusable,
-                EmptyReplacement,
-                PairDependencyError,
-            ),
-        ):
+        elif isinstance(error, (LoraFilesChanged, LoraSettingsUnusable)):
             message = str(error)
-        elif isinstance(error, OSError):
-            # Reduced to its reason and the file's basename.
-            message = self._public_error(error)
         else:
-            message = _LORA_SCAN_FAILED
+            message = self._public_error(error)
         if isinstance(
             error,
             (
@@ -548,7 +536,6 @@ class LoraIntegrationMixin:
                 except asyncio.CancelledError:
                     interrupted = True
                 except Exception:
-                    # the await after this loop raises it for the caller
                     pass
             if interrupted:
                 raise asyncio.CancelledError

py/api/maintenance.py

@@ -673,7 +673,6 @@ class MaintenanceRoutesMixin:
         line = _changed_line(plan.operation, result["changed"], result.get("marks", 0))
         job.log_line(line)
         job.update(progress=100, status_line=f"{line} · {backup_note(backup)}")
-        return None
 
     def _maintenance_rows(self, operation, described):
         """Outcome rows for the changed records (root-relative paths only)."""

py/api/media_target.py

@@ -9,15 +9,13 @@ by the caller.
 import os
 import re
 
-from .images import _file_not_found, _forbidden, _has_traversal
+from .images import _forbidden, _has_traversal
 from .prompts import bad_request
 
 try:
     from ...utils.media_capture import CAPTURE_EXTENSIONS
-    from ...utils.media_folders import in_trash_folder
 except ImportError:
     from utils.media_capture import CAPTURE_EXTENSIONS
-    from utils.media_folders import in_trash_folder
 
 MAX_TARGET_PATH = 1024
 TARGET_FIELDS = frozenset({"root_index", "root_scope", "path"})
@@ -31,9 +29,7 @@ def media_target(data: object, *, media_message: str = TAGGING_MEDIA_MESSAGE):
     Only the listing identity is accepted: an int root index, the root's
     64-hex scope and a bounded root-relative POSIX media path, never an
     absolute, drive-qualified, backslash or ``..`` path (a 400 for a malformed
-    shape, a 403 for an unsafe or non-media path, carrying *media_message*, a
-    404 for a path in a trash folder, #543). A link or a short-name spelling
-    is refused later by the capture store's alias check.
+    shape, a 403 for an unsafe or non-media path, carrying *media_message*).
     """
     if not isinstance(data, dict) or set(data) != TARGET_FIELDS:
         return None, bad_request("target must name root_index, root_scope and path")
@@ -55,6 +51,4 @@ def media_target(data: object, *, media_message: str = TAGGING_MEDIA_MESSAGE):
         return None, _forbidden()
     if os.path.splitext(parts[-1])[1].lower() not in CAPTURE_EXTENSIONS:
         return None, _forbidden(media_message)
-    if in_trash_folder(relative):
-        return None, _file_not_found()
     return (index, scope, relative), None

py/api/pairs.py

@@ -102,12 +102,7 @@ class PairRoutesMixin:
             validate_prompt_text(negative)
         fields = metadata_fields(data)
         pair_id = await self._run_in_executor(
-            self.db.save_prompt_pair,
-            positive,
-            negative,
-            # The node's Save pair button: as a run, a new prompt gets the metadata.
-            fill_new_positive=True,
-            **fields,
+            self.db.save_prompt_pair, positive, negative, **fields
         )
         pair = await self._run_in_executor(self.db.get_prompt_pair, pair_id)
         return web.json_response({"success": True, "pair": pair})

py/api/preview_location.py

@@ -1,643 +0,0 @@
-"""The thumbnail location setting (#320): parsing, validation, source keys
-and the thumbnail folder's marker.
-
-``preview_store`` holds the runtime state and maps paths; this module holds
-the rules it applies. Nothing here keeps state.
-
-Schema (config.json ``thumbnails.location``)::
-
-    {"mode": "folder", "path": "D:\\\\Thumbs", "id": "<uuid4>",
-     "install": "<uuid4>", "cleanup": []}
-
-The default (and a missing key) is ``{"mode": "source"}``: previews inside
-each source. An invalid value never falls back to the sources: it parses as
-a folder location with problem ``invalid``, so nothing is written anywhere.
-
-Layout in folder mode: ``<folder>/<source key>/<rel dir>/<stem>_thumb<ext>``.
-A source key is a readable slug plus a short hash of the source's identity
-(``output-3f9a2c1b``), assigned once and stored in the marker
-``.promptmanager-thumbnails.json`` with the identity it belongs to.
-"""
-
-import errno
-import hashlib
-import json
-import logging
-import ntpath
-import os
-import posixpath
-import re
-import stat as stat_module
-import threading
-import unicodedata
-import uuid
-from dataclasses import dataclass, field
-
-try:
-    from ...utils import library_location
-except ImportError:  # tests import the package top-level
-    from utils import library_location
-
-logger = logging.getLogger("prompt_manager.thumbnails")
-
-SOURCE_MODE = "source"
-FOLDER_MODE = "folder"
-MARKER_NAME = ".promptmanager-thumbnails.json"
-MARKER_VERSION = 1
-# A source key: one folder name, a slug and a 8-16 hex hash (``source_key``).
-KEY_PATTERN = re.compile(r"^[a-z0-9_-]{1,24}-[0-9a-f]{8,16}$")
-# A marker is a few keys; anything larger is not ours.
-MAX_MARKER_BYTES = 4 * 2**20
-# OS metadata files a folder may hold and still count as empty.
-OS_METADATA = frozenset({"thumbs.db", "desktop.ini", ".ds_store"})
-KEY_HASH_LENGTHS = (8, 12, 16)
-SLUG_LENGTH = 24
-# Folder + the longest key (24 + 1 + 16) + this margin must fit (Windows).
-WINDOWS_FOLDER_LIMIT = 247
-LONGEST_KEY = SLUG_LENGTH + 1 + KEY_HASH_LENGTHS[-1]
-PATH_MARGIN = 40
-# A validation stat on a share that does not answer in time is unavailable.
-VALIDATION_TIMEOUT = 5.0
-FILE_ATTRIBUTE_REPARSE_POINT = 0x400
-
-_RESERVED = re.compile(r"^(con|prn|aux|nul|com[1-9]|lpt[1-9])(\..*)?$", re.IGNORECASE)
-_BAD_CHARS = re.compile(r'[<>:"|?*\x00-\x1f]')
-
-# Problem codes, their HTTP status and the text the UI shows (no path).
-MESSAGES = {
-    "location-not-absolute": (
-        400,
-        "Enter a full folder path, such as D:\\Thumbnails or /mnt/fast/thumbnails.",
-    ),
-    "location-device-path": (
-        400,
-        "Enter the folder as a drive letter or \\\\server\\share path, "
-        "without \\\\?\\.",
-    ),
-    "location-invalid-name": (
-        400,
-        "This folder name can't be used on Windows. Choose another name.",
-    ),
-    "location-too-broad": (
-        400,
-        "Choose a folder inside a drive or share, not the drive itself.",
-    ),
-    "location-served": (
-        400,
-        "Choose a folder outside your image sources and ComfyUI's output, input "
-        "and temp folders.",
-    ),
-    "location-node-folder": (
-        400,
-        "Choose a folder outside the Prompt Manager node folder.",
-    ),
-    "location-contains-source": (
-        400,
-        "This folder contains an image source. Choose a folder beside it instead.",
-    ),
-    "location-same": (400, "Thumbnails are already stored here."),
-    "location-parent-missing": (
-        400,
-        "The folder that would hold it doesn't exist. Check the path and that its "
-        "drive is connected.",
-    ),
-    "location-unavailable": (
-        409,
-        "This folder can't be reached right now. Check that its drive or share is "
-        "connected.",
-    ),
-    "location-not-empty": (
-        409,
-        "This folder already holds other files. Choose an empty folder or one "
-        "Prompt Manager used before.",
-    ),
-    "location-not-writable": (
-        409,
-        "Prompt Manager can't write to this folder. Check its permissions.",
-    ),
-    "location-path-too-long": (
-        400,
-        "This path is too long for Windows. Choose a shorter folder path.",
-    ),
-    "location-needs-move": (
-        409,
-        "Use Move thumbnails in System › Sources & scans.",
-    ),
-}
-HOLDS_THUMBNAILS_REASON = "This folder holds Prompt Manager's thumbnails."
-
-
-def message(code):
-    """``(status, text)`` of a problem code."""
-    return MESSAGES[code]
-
-
-# ── parsing ──────────────────────────────────────────────────────────
-
-
-@dataclass(frozen=True)
-class ParsedLocation:
-    """A ``thumbnails.location`` value, checked as data (no filesystem)."""
-
-    mode: str = SOURCE_MODE
-    path: str | None = None
-    id: str | None = None
-    install: str | None = None
-    cleanup: tuple = field(default_factory=tuple)
-    problem: str | None = None
-
-    def to_config(self):
-        """The config.json form (``invalid`` values are never written)."""
-        if self.mode == SOURCE_MODE:
-            value = {"mode": SOURCE_MODE}
-        else:
-            value = {"mode": FOLDER_MODE, "path": self.path, "id": self.id}
-        if self.install:
-            value["install"] = self.install
-        value["cleanup"] = list(self.cleanup)
-        return value
-
-
-def _cleanup(value):
-    if not isinstance(value, list):
-        return ()
-    return tuple(item for item in value if isinstance(item, dict))
-
-
-def parse_location(value, *, flavor=os.path):
-    """The location a ``thumbnails.location`` value names.
-
-    Missing: inside each source. Anything else that is not a well-formed
-    location (an unknown mode, a relative path, a missing id) becomes a
-    folder location with problem ``invalid``: never a silent fall-back.
-    """
-    if value is None:
-        return ParsedLocation()
-    if not isinstance(value, dict):
-        return ParsedLocation(mode=FOLDER_MODE, problem="invalid")
-    mode = value.get("mode", SOURCE_MODE)
-    install = value.get("install") if isinstance(value.get("install"), str) else None
-    cleanup = _cleanup(value.get("cleanup"))
-    if mode == SOURCE_MODE:
-        return ParsedLocation(install=install, cleanup=cleanup)
-    if mode != FOLDER_MODE:
-        return ParsedLocation(mode=FOLDER_MODE, problem="invalid", cleanup=cleanup)
-    path, marker_id = value.get("path"), value.get("id")
-    if (
-        not isinstance(path, str)
-        or form_problem(path, flavor=flavor) is not None
-        or not isinstance(marker_id, str)
-        or not marker_id.strip()
-    ):
-        return ParsedLocation(
-            mode=FOLDER_MODE,
-            path=path if isinstance(path, str) else None,
-            problem="invalid",
-            cleanup=cleanup,
-        )
-    return ParsedLocation(
-        mode=FOLDER_MODE,
-        path=flavor.abspath(path),
-        id=marker_id,
-        install=install,
-        cleanup=cleanup,
-    )
-
-
-# ── form (text only) ─────────────────────────────────────────────────
-
-
-def _is_windows(flavor):
-    return flavor is ntpath or getattr(flavor, "__name__", "") == "ntpath"
-
-
-def form_problem(path, *, flavor=os.path):
-    """The text-only problem of *path*, or None (no filesystem access).
-
-    ``\\\\?\\`` and ``\\\\.\\`` prefixes, relative, drive-relative (``C:x``)
-    and root-relative (``\\x``) spellings, and names Windows cannot hold
-    (checked on every OS: the folder may be moved to Windows).
-    """
-    if not isinstance(path, str) or not path.strip() or path != path.lstrip():
-        return "location-not-absolute"
-    if path.replace("/", "\\").startswith(("\\\\?\\", "\\\\.\\")):
-        return "location-device-path"
-    if _is_windows(flavor):
-        drive, rest = ntpath.splitdrive(path)
-        if not drive or not rest.startswith(("\\", "/")):
-            return "location-not-absolute"
-    elif not posixpath.isabs(path):
-        return "location-not-absolute"
-    drive, rest = flavor.splitdrive(path)
-    for part in re.split(r"[\\/]+", rest):
-        if not part:
-            continue
-        if (
-            _RESERVED.match(part)
-            or part.endswith((".", " "))
-            or _BAD_CHARS.search(part)
-        ):
-            return "location-invalid-name"
-    return None
-
-
-def is_too_broad(path, *, home=None, flavor=os.path):
-    """A filesystem or share root, or the home folder itself."""
-    normalized = flavor.normpath(path)
-    drive, rest = flavor.splitdrive(normalized)
-    if rest in ("", "\\", "/"):
-        return True
-    home = home if home is not None else os.path.expanduser("~")
-    return bool(home) and flavor.normcase(normalized) == flavor.normcase(
-        flavor.normpath(home)
-    )
-
-
-def too_long_for_windows(path, long_paths=None):
-    """Folder + the longest key + a margin over the folder limit (Windows
-    without long paths; *long_paths* injects the registry answer)."""
-    if long_paths is None:
-        long_paths = long_paths_enabled()
-    if long_paths:
-        return False
-    return len(path) + 1 + LONGEST_KEY + PATH_MARGIN > WINDOWS_FOLDER_LIMIT
-
-
-def long_paths_enabled():
-    """``LongPathsEnabled`` on Windows (True on other systems)."""
-    if os.name != "nt":
-        return True
-    try:
-        import winreg
-
-        with winreg.OpenKey(
-            winreg.HKEY_LOCAL_MACHINE,
-            r"SYSTEM\CurrentControlSet\Control\FileSystem",
-        ) as key:
-            return winreg.QueryValueEx(key, "LongPathsEnabled")[0] == 1
-    except OSError:
-        return False
-
-
-# ── links ────────────────────────────────────────────────────────────
-
-
-def is_link_like(path):
-    """A symlink, a junction or any reparse point (one lstat), or missing.
-
-    Raises OSError other than "not found" (an unreachable share).
-    """
-    try:
-        info = os.lstat(path)
-    except FileNotFoundError:
-        return False
-    if stat_module.S_ISLNK(info.st_mode):
-        return True
-    attributes = getattr(info, "st_file_attributes", 0)
-    if attributes & FILE_ATTRIBUTE_REPARSE_POINT:
-        return True
-    is_junction = getattr(os.path, "isjunction", None)
-    return bool(is_junction and is_junction(path))
-
-
-# ── source keys ──────────────────────────────────────────────────────
-
-
-def slug(name):
-    """``NFKD`` to ASCII, lower case, runs outside ``[a-z0-9_]`` as ``-``,
-    trimmed and cut to 24 characters; empty becomes ``source``."""
-    text = unicodedata.normalize("NFKD", str(name))
-    text = text.encode("ascii", "ignore").decode("ascii").lower()
-    text = re.sub(r"[^a-z0-9_]+", "-", text).strip("-")
-    text = text[:SLUG_LENGTH].strip("-")
-    return text or "source"
-
-
-def source_key(spelling, identity, taken):
-    """The key of a source: ``slug(basename) + "-" + sha256(identity)[:n]``.
-
-    *taken* maps existing keys to their identity; a key taken by another
-    identity grows its hash to 12, then 16 characters.
-    """
-    base = slug(ntpath.basename(str(spelling).rstrip("\\/")))
-    digest = hashlib.sha256(str(identity).encode("utf-8")).hexdigest()
-    for length in KEY_HASH_LENGTHS:
-        key = f"{base}-{digest[:length]}"
-        owner = taken.get(key)
-        if owner is None or owner == identity:
-            return key
-    raise ValueError("no free source key")
-
-
-def file_identity(path):
-    """``[st_dev, st_ino]`` of an existing folder, or None (no file ids)."""
-    try:
-        info = os.stat(path)
-    except (OSError, ValueError):
-        return None
-    if not info.st_ino:
-        return None
-    return [info.st_dev, info.st_ino]
-
-
-def find_key(keys, spelling, identity, dev_ino):
-    """The marker key of a source: the same configured spelling, then the
-    same identity text, then the same file id; or None."""
-    keys = {k: v for k, v in keys.items() if valid_key(k) and isinstance(v, dict)}
-    for key, entry in keys.items():
-        if entry.get("path") == spelling:
-            return key
-    for key, entry in keys.items():
-        if entry.get("identity") == identity:
-            return key
-    if dev_ino:
-        for key, entry in keys.items():
-            if entry.get("dev_ino") == list(dev_ino):
-                return key
-    return None
-
-
-# ── the marker ───────────────────────────────────────────────────────
-
-
-def marker_path(folder):
-    return os.path.join(folder, MARKER_NAME)
-
-
-def read_marker(folder):
-    """The marker in *folder* as a dict, or None (absent or unreadable as
-    ours). OSError other than "not found" propagates (an unreachable share)."""
-    try:
-        with open(marker_path(folder), "r", encoding="utf-8") as handle:
-            text = handle.read(MAX_MARKER_BYTES + 1)
-    except FileNotFoundError:
-        return None
-    except (ValueError, UnicodeDecodeError):
-        return None
-    if len(text) > MAX_MARKER_BYTES:
-        return None
-    try:
-        data = json.loads(text)
-    except ValueError:
-        return None
-    if not isinstance(data, dict) or not isinstance(data.get("id"), str):
-        return None
-    data["keys"] = valid_keys(data.get("keys"))
-    return data
-
-
-def valid_key(key):
-    """Whether *key* can name a source's folder: one folder name of the
-    ``source_key`` form, never a separator, ``..`` or a drive."""
-    return isinstance(key, str) and KEY_PATTERN.fullmatch(key) is not None
-
-
-def valid_keys(keys):
-    """The marker's keys that are safe to join onto the folder; a hand-edited
-    or foreign entry that is not is dropped (and logged), never followed."""
-    if not isinstance(keys, dict):
-        return {}
-    kept = {}
-    for key, entry in keys.items():
-        if valid_key(key) and isinstance(entry, dict):
-            kept[key] = entry
-        else:
-            logger.warning(
-                "Ignoring a thumbnail folder marker entry that is not a source " "key"
-            )
-    return kept
-
-
-def write_marker(folder, mutate):
-    """Re-read the marker, apply ``mutate(marker)`` and write it atomically
-    (a temp sibling renamed over it). Callers hold ``preview_store.write_lock``.
-    Returns the marker written."""
-    current = read_marker(folder) or {}
-    marker = {
-        "version": MARKER_VERSION,
-        "id": current.get("id"),
-        "created_by_pm": bool(current.get("created_by_pm", False)),
-        "keys": dict(current.get("keys") or {}),
-    }
-    mutate(marker)
-    if not marker.get("id"):
-        raise ValueError("a marker needs an id")
-    target = marker_path(folder)
-    temp = os.path.join(
-        folder, f".{MARKER_NAME}.{os.getpid()}-{threading.get_ident()}.tmp"
-    )
-    try:
-        with open(temp, "w", encoding="utf-8") as handle:
-            json.dump(marker, handle, indent=2, sort_keys=True)
-            handle.flush()
-            os.fsync(handle.fileno())
-        os.replace(temp, target)
-    finally:
-        try:
-            os.unlink(temp)
-        except OSError:
-            pass  # gone with the rename; a leftover is swept with the temps
-    return marker
-
-
-def new_id():
-    return str(uuid.uuid4())
-
-
-def init_folder(folder, *, created_by_pm=False):
-    """The marker id of *folder*: an existing marker is adopted; a folder
-    without one gets a new marker (new id, no keys)."""
-    existing = read_marker(folder)
-    if existing is not None:
-        return existing["id"]
-
-    def create(marker):
-        if not marker.get("id"):
-            marker["id"] = new_id()
-            marker["created_by_pm"] = created_by_pm
-
-    return write_marker(folder, create)["id"]
-
-
-def folder_state(path, expected_id):
-    """``(available, problem, marker)`` of a configured thumbnail folder.
-
-    Available: the folder exists, is a directory and not a link, junction or
-    reparse point, and holds our marker with *expected_id*. Raises OSError
-    when the folder cannot be reached (an I/O error other than not found).
-    """
-    try:
-        info = os.lstat(path)
-    except FileNotFoundError:
-        return False, "missing", None
-    except OSError as error:
-        if error.errno in (errno.ENOENT, errno.ENOTDIR):
-            return False, "missing", None
-        raise
-    if is_link_like(path):
-        return False, "invalid", None
-    if not stat_module.S_ISDIR(info.st_mode):
-        return False, "invalid", None
-    marker = read_marker(path)
-    if marker is None:
-        return False, "missing", None
-    if marker["id"] != expected_id:
-        return False, "marker-mismatch", marker
-    return True, None, marker
-
-
-def holds_only_metadata(path):
-    """Whether an existing folder is empty but for OS metadata files."""
-    with os.scandir(path) as entries:
-        for entry in entries:
-            name = entry.name.lower()
-            if name in OS_METADATA or name.startswith("._"):
-                continue
-            return False
-    return True
-
-
-# ── validation ───────────────────────────────────────────────────────
-
-
-@dataclass(frozen=True)
-class Context:
-    """What a location is checked against (gathered by the caller)."""
-
-    roots: tuple = ()  # every image source of every root list
-    contained: tuple = ()  # ComfyUI output/input/temp and the library folder
-    node_folder: str | None = None
-    default_path: str | None = None
-    current_path: str | None = None  # the folder in use (folder mode)
-    home: str | None = None
-    flavor: object = os.path
-    long_paths: bool | None = None
-    environ: object = None
-    # ComfyUI's folder_paths module (None: none; unset: imported).
-    folder_paths: object = library_location._UNSET
-
-
-def _timed(func, timeout):
-    """``func()`` on a daemon thread; raises TimeoutError past *timeout*.
-    A stuck call is left to finish on its own thread."""
-    result = {}
-    done = threading.Event()
-
-    def run():
-        try:
-            result["value"] = func()
-        except BaseException as error:  # handed to the caller
-            result["error"] = error
-        finally:
-            done.set()
-
-    threading.Thread(target=run, name="pm-preview-stat", daemon=True).start()
-    if not done.wait(timeout):
-        raise TimeoutError("the folder did not answer in time")
-    if "error" in result:
-        raise result["error"]
-    return result.get("value")
-
-
-def _inside(path, folders):
-    return library_location._inside_any(path, folders)
-
-
-def _same(first, second):
-    return library_location.same_folder(first, second) or os.path.normcase(
-        os.path.realpath(first)
-    ) == os.path.normcase(os.path.realpath(second))
-
-
-def _served(path, context):
-    environ = os.environ if context.environ is None else context.environ
-    return (
-        library_location.data_dir_problem(
-            path,
-            folder_paths=context.folder_paths,
-            environ=environ,
-            gallery_roots=list(context.roots),
-        )
-        == "data-dir-served"
-    )
-
-
-def _probe_write(path):
-    """Create and delete a probe file in *path*; False when refused."""
-    probe = os.path.join(path, f".pm-probe-{uuid.uuid4().hex[:8]}.tmp")
-    try:
-        with open(probe, "wb") as handle:
-            handle.write(b"")
-    except OSError:
-        return False
-    try:
-        os.unlink(probe)
-    except OSError:
-        return False
-    return True
-
-
-def location_problem(path, *, purpose, context, timeout=VALIDATION_TIMEOUT):
-    """Why *path* cannot be the thumbnail folder, as a code, or None.
-
-    *purpose*: ``move`` (every rule), ``startup`` (no ``same``, ``empty``,
-    ``writable`` or parent rules: availability covers them) or ``recreate``
-    (the folder is missing and is made again).
-    """
-    flavor = context.flavor
-    code = form_problem(path, flavor=flavor)
-    if code is not None:
-        return code
-    path = flavor.abspath(path)
-    default = bool(context.default_path) and flavor.normcase(path) == flavor.normcase(
-        flavor.abspath(context.default_path)
-    )
-    if is_too_broad(path, home=context.home, flavor=flavor):
-        return "location-too-broad"
-    try:
-        return _timed(
-            lambda: _filesystem_problem(path, purpose, context, default), timeout
-        )
-    except (TimeoutError, OSError):
-        return "location-unavailable"
-
-
-def _filesystem_problem(path, purpose, context, default):
-    if _served(path, context):
-        return "location-served"
-    if context.node_folder and not default and _inside(path, [context.node_folder]):
-        return "location-node-folder"
-    inner = list(context.roots) + list(context.contained)
-    if any(folder and _inside(folder, [path]) for folder in inner):
-        if not default:
-            return "location-contains-source"
-    if (
-        purpose == "move"
-        and context.current_path
-        and (
-            os.path.normcase(path) == os.path.normcase(context.current_path)
-            or (os.path.isdir(path) and _same(path, context.current_path))
-        )
-    ):
-        return "location-same"
-    # Windows, or a test injecting its limit (``long_paths=False``).
-    if os.name == "nt" or context.long_paths is False:
-        if too_long_for_windows(path, context.long_paths):
-            return "location-path-too-long"
-    if purpose == "startup":
-        return None
-    if is_link_like(path):
-        # Never through a link: the folder itself must be a real folder.
-        return "location-not-empty"
-    exists = os.path.isdir(path)
-    if not exists:
-        if os.path.lexists(path):
-            return "location-not-empty"
-        if not default and not os.path.isdir(os.path.dirname(path)):
-            return "location-parent-missing"
-        return None
-    if read_marker(path) is None and not holds_only_metadata(path):
-        return "location-not-empty"
-    if not _probe_write(path):
-        return "location-not-writable"
-    return None

py/api/preview_store.py

@@ -1,671 +0,0 @@
-"""Where previews live on disk (#320): the one resolver.
-
-Every mapping between an image source (a "root"), one of its media files and
-that file's preview on disk goes through this module. URL text stays in
-``thumbnail_settings`` (``thumbnail_rel``: ``thumbnails/<rel>_thumb<ext>``,
-the shape the serve route, ``inspection-state.mjs`` and ``admin.js`` share);
-this module answers where such a preview is on disk.
-
-The store of a source is where its previews live. With the default location
-(mode ``source``, "Inside each source") it is ``<source>/thumbnails``, exactly
-the folder every caller joined by hand before, so nothing moves.
-
-Writes and the switch: every preview writer takes ``write_guard`` when it
-starts (it records the location's ``generation``); the final rename runs
-under ``write_lock`` and only when the generation is unchanged and no hold
-applies (``thumbnail_encode.replace_unless_held``). Changing the location
-bumps the generation under the same lock, so no write that began before can
-land in the old store afterwards. Nothing reads or commits config while
-``write_lock`` is held. The hold check runs under it too, so hold checks take
-no lock (the job registry's ``running()`` is a lock-free snapshot) and
-``bump_generation`` is never called with a registry or config lock held.
-
-All functions are blocking: call them off the event loop.
-"""
-
-import errno
-import logging
-import os
-import threading
-import time
-from contextlib import contextmanager
-from dataclasses import dataclass, replace
-from pathlib import Path
-
-from . import preview_location, thumbnail_settings
-
-try:
-    from ...utils.media_folders import PREVIEW_FOLDER
-except ImportError:  # tests import the package top-level
-    from utils.media_folders import PREVIEW_FOLDER
-
-logger = logging.getLogger("prompt_manager.thumbnails")
-
-SOURCE_MODE = preview_location.SOURCE_MODE
-FOLDER_MODE = preview_location.FOLDER_MODE
-# The probe checks the folder this often, and a check (or a store call)
-# taking longer than the budget marks it unreachable.
-PROBE_INTERVAL = 5.0
-IO_BUDGET = 2.0
-PROBE_THREAD = "pm-preview-probe"
-
-
-@dataclass(frozen=True)
-class Location:
-    """One snapshot of the thumbnail location (take one per request or job)."""
-
-    mode: str = SOURCE_MODE
-    path: str | None = None
-    available: bool = True
-    problem: str | None = None
-    generation: int = 0
-
-
-write_lock = threading.Lock()
-_generation = 0
-# The runtime location: the parsed setting, availability and the marker keys
-# last read. Swapped as a whole; readers take one snapshot.
-_state_lock = threading.Lock()
-_parsed = preview_location.ParsedLocation()
-_available = True
-_problem = None
-_keys = {}
-_key_cache = {}
-_clock = time.monotonic
-
-
-def current():
-    """The thumbnail location now."""
-    with _state_lock:
-        parsed, available, problem, generation_now = (
-            _parsed,
-            _available,
-            _problem,
-            _generation,
-        )
-    if parsed.mode == SOURCE_MODE:
-        return Location(generation=generation_now)
-    return Location(FOLDER_MODE, parsed.path, available, problem, generation_now)
-
-
-def setting():
-    """The parsed setting in use (``preview_location.ParsedLocation``)."""
-    return _parsed
-
-
-def generation():
-    return _generation
-
-
-def bump_generation():
-    """Invalidate every write that started before (under ``write_lock``)."""
-    global _generation
-    with write_lock:
-        _generation += 1
-        return _generation
-
-
-def _canonical(path):
-    """Resolved and case-folded, so paths compare on every OS."""
-    return Path(os.path.normcase(os.path.realpath(str(path))))
-
-
-def _within(path, folder):
-    return _canonical(path).is_relative_to(_canonical(folder))
-
-
-# ── the setting and availability ─────────────────────────────────────
-
-
-def configure(value, *, context=None, check=True):
-    """Use the ``thumbnails.location`` *value* (config.json) from now on.
-
-    A folder location is validated against *context* (``startup`` rules: a
-    problem other than an unreachable folder makes it ``invalid``), then
-    checked once; the probe keeps checking it. Swapped under ``write_lock``
-    with a generation bump, so no write that started before lands.
-    """
-    global _parsed, _available, _problem, _generation
-    parsed = preview_location.parse_location(value)
-    problem = parsed.problem
-    if parsed.mode == FOLDER_MODE and problem is None and context is not None:
-        code = preview_location.location_problem(
-            parsed.path, purpose="startup", context=context
-        )
-        if code == "location-unavailable":
-            problem = "unreachable"
-        elif code is not None:
-            problem = "invalid"
-            parsed = preview_location.ParsedLocation(
-                mode=FOLDER_MODE,
-                path=parsed.path,
-                id=parsed.id,
-                install=parsed.install,
-                cleanup=parsed.cleanup,
-                problem="invalid",
-            )
-    with write_lock:
-        with _state_lock:
-            _parsed = parsed
-            _available = parsed.mode == SOURCE_MODE
-            _problem = problem if parsed.mode == FOLDER_MODE else None
-            _keys.clear()
-            _key_cache.clear()
-        _generation += 1
-    if parsed.mode == FOLDER_MODE:
-        if check and parsed.problem is None:
-            refresh()
-        _probe.start()
-    else:
-        _probe.stop()
-    return current()
-
-
-def refresh():
-    """Check the folder now (bounded by IO_BUDGET); returns availability."""
-    parsed = _parsed
-    if parsed.mode != FOLDER_MODE or parsed.problem is not None:
-        return parsed.mode == SOURCE_MODE
-    try:
-        available, problem, marker = _probe.check(parsed.path, parsed.id)
-    except (OSError, TimeoutError, RuntimeError):
-        available, problem, marker = False, "unreachable", None
-    _set_state(parsed, available, problem, marker)
-    return available
-
-
-def _set_keys(parsed, marker):
-    """Take the keys of a marker just written (availability unchanged)."""
-    with _state_lock:
-        if _parsed is not parsed:
-            return
-        keys = dict((marker or {}).get("keys") or {})
-        if keys != _keys:
-            _keys.clear()
-            _keys.update(keys)
-            _key_cache.clear()
-
-
-def mark_invalid():
-    """The setting cannot be used (a startup check that failed): folder
-    mode stays in force, unavailable, so nothing is written anywhere."""
-    global _parsed, _available, _problem
-    with _state_lock:
-        if _parsed.mode != FOLDER_MODE:
-            _parsed = preview_location.ParsedLocation(
-                mode=FOLDER_MODE, problem="invalid"
-            )
-        else:
-            _parsed = replace(_parsed, problem="invalid")
-        _available, _problem = False, "invalid"
-
-
-def _set_state(parsed, available, problem, marker):
-    global _available, _problem
-    with _state_lock:
-        if _parsed is not parsed:
-            return  # the setting changed meanwhile
-        _available, _problem = available, problem
-        keys = dict((marker or {}).get("keys") or {})
-        if keys != _keys:
-            _keys.clear()
-            _keys.update(keys)
-            _key_cache.clear()
-
-
-def note_failure():
-    """A store call failed or stalled: unreachable until the probe finds the
-    folder again (requests do no store I/O meanwhile)."""
-    global _available, _problem
-    if _parsed.mode != FOLDER_MODE:
-        return
-    with _state_lock:
-        _available, _problem = False, "unreachable"
-    _probe.wake()
-
-
-@contextmanager
-def store_io():
-    """Around a store call in folder mode: an I/O error (other than a file
-    that is not there) or a call over IO_BUDGET marks the folder
-    unreachable."""
-    if _parsed.mode != FOLDER_MODE:
-        yield
-        return
-    started = _clock()
-    try:
-        yield
-    except OSError as error:
-        if not isinstance(error, (FileNotFoundError, NotADirectoryError)):
-            note_failure()
-        raise
-    finally:
-        if _clock() - started > IO_BUDGET:
-            note_failure()
-
-
-class _Probe:
-    """The background check of the thumbnail folder (one thread, one check
-    at a time; a stuck check is left to finish on its own thread)."""
-
-    def __init__(self):
-        self._lock = threading.Lock()
-        self._wake = threading.Event()
-        self._stop = threading.Event()
-        self._thread = None
-        self._checking = None
-
-    def check(self, path, expected_id):
-        """``folder_state`` within IO_BUDGET; raises TimeoutError. A check
-        already running (the probe's, or a stuck one) is joined, never run
-        twice at once."""
-        with self._lock:
-            pending = self._checking
-            if pending is None or pending[0] != (path, expected_id):
-                pending = self._start_check(path, expected_id)
-        key, done, result = pending
-        if not done.wait(IO_BUDGET):
-            raise TimeoutError("the thumbnail folder did not answer in time")
-        with self._lock:
-            if self._checking is pending:
-                self._checking = None
-        if "error" in result:
-            raise result["error"]
-        return result["value"]
-
-    def _start_check(self, path, expected_id):
-        """Start one check on its own thread (lock held)."""
-        result = {}
-        done = threading.Event()
-
-        def run():
-            try:
-                result["value"] = preview_location.folder_state(path, expected_id)
-            except BaseException as error:  # handed to the caller
-                result["error"] = error
-            finally:
-                done.set()
-
-        pending = ((path, expected_id), done, result)
-        self._checking = pending
-        threading.Thread(target=run, name=PROBE_THREAD + "-check", daemon=True).start()
-        return pending
-
-    def start(self):
-        with self._lock:
-            if self._thread is not None and self._thread.is_alive():
-                return
-            # Each thread has its own stop: a stopped one never resumes.
-            stop = self._stop = threading.Event()
-            thread = threading.Thread(
-                target=self._run, args=(stop,), name=PROBE_THREAD, daemon=True
-            )
-            try:
-                thread.start()
-            except RuntimeError:
-                return  # refused at interpreter exit: no probe
-            self._thread = thread
-
-    def _run(self, stop):
-        while not stop.is_set():
-            self._wake.wait(PROBE_INTERVAL)
-            self._wake.clear()
-            if stop.is_set():
-                return
-            try:
-                refresh()
-            except Exception:  # one failed check never stops the probe
-                logger.debug("Thumbnail folder check failed", exc_info=True)
-
-    def wake(self):
-        self._wake.set()
-
-    def stop(self, timeout=2.0):
-        """Stop the probe; True when its thread ended."""
-        with self._lock:
-            thread, self._thread = self._thread, None
-        self._stop.set()
-        self._wake.set()
-        if thread is None or thread is threading.current_thread():
-            return True
-        thread.join(timeout)
-        return not thread.is_alive()
-
-
-_probe = _Probe()
-
-
-def stop_probe(timeout=2.0):
-    """Stop the folder probe (the package teardown, tests)."""
-    return _probe.stop(timeout)
-
-
-# ── stores ───────────────────────────────────────────────────────────
-
-
-def source_folder(root):
-    """``<source>/thumbnails``: the store in source mode, a leftover in
-    folder mode."""
-    return Path(root) / PREVIEW_FOLDER
-
-
-def store_container(root, location=None):
-    """The folder a store of *root* must stay inside: the source itself, or
-    the thumbnail folder in folder mode."""
-    location = location or current()
-    if location.mode == FOLDER_MODE:
-        return Path(location.path) if location.path else None
-    return Path(root)
-
-
-def _identity(root):
-    return os.path.normcase(os.path.realpath(str(root)))
-
-
-def _lookup_key(root):
-    spelling = str(root)
-    with _state_lock:
-        if spelling in _key_cache:
-            return _key_cache[spelling]
-        keys = dict(_keys)
-    key = preview_location.find_key(
-        keys,
-        spelling,
-        _identity(root),
-        preview_location.file_identity(root),
-    )
-    if key is not None:
-        with _state_lock:
-            _key_cache[spelling] = key
-    return key
-
-
-def store_dir(root, location=None):
-    """The store of *root*: ``<source>/thumbnails``, or in folder mode
-    ``<folder>/<key>`` (None while the folder is unavailable or before the
-    source has a key: a reader then finds no preview)."""
-    location = location or current()
-    if location.mode == SOURCE_MODE:
-        return Path(root) / PREVIEW_FOLDER
-    if not location.available or not location.path:
-        return None
-    key = _lookup_key(root)
-    return None if key is None else _key_folder(location.path, key)
-
-
-def _key_folder(folder, key):
-    """``<folder>/<key>``, only for a key that is one folder name directly
-    below the thumbnail folder (a marker is data, never a path)."""
-    if not preview_location.valid_key(key):
-        return None
-    store = Path(folder) / key
-    if store.parent != Path(folder) or store.name != key:
-        return None
-    return store
-
-
-def ensure_store(root, location=None, *, create=False):
-    """``store_dir`` for a writer: in folder mode a source without a key gets
-    one (recorded in the marker); with *create* its key folder is made (never
-    the thumbnail folder itself). None while the folder is unavailable."""
-    location = location or current()
-    store = store_dir(root, location)
-    if location.mode == SOURCE_MODE or (store is None and not location.available):
-        return store
-    if store is None:
-        store = _assign_key(root, location)
-        if store is None:
-            return None
-    if create:
-        try:
-            with store_io():
-                os.mkdir(store)
-        except FileExistsError:
-            pass
-        except OSError:
-            return None
-    return store
-
-
-def _assign_key(root, location):
-    parsed = _parsed
-    if location.path != parsed.path:
-        return None
-    spelling = str(root)
-    identity = _identity(root)
-    dev_ino = preview_location.file_identity(root)
-    assigned = {}
-
-    def add(marker):
-        if marker.get("id") != parsed.id:
-            raise ValueError("another folder's marker")  # marker-mismatch
-        keys = marker["keys"]
-        key = preview_location.find_key(keys, spelling, identity, dev_ino)
-        if key is None:
-            taken = {k: v.get("identity") for k, v in keys.items()}
-            key = preview_location.source_key(spelling, identity, taken)
-            keys[key] = {
-                "path": spelling,
-                "identity": identity,
-                "dev_ino": dev_ino,
-                "install": parsed.install,
-            }
-        assigned["key"] = key
-
-    try:
-        with write_lock, store_io():
-            marker = preview_location.write_marker(location.path, add)
-    except (OSError, ValueError):
-        return None
-    _set_keys(parsed, marker)
-    return _key_folder(location.path, assigned["key"])
-
-
-def may_write(path, location=None):
-    """The one ownership check every preview write and delete passes.
-
-    Source mode: True (the callers' own root rules apply, as before). Folder
-    mode: *path* lies below a source key folder of the thumbnail folder,
-    lexically and resolved, and no link, junction or reparse point sits
-    anywhere from the key folder down to it (the file itself included).
-    """
-    location = location or current()
-    if location.mode == SOURCE_MODE:
-        return True
-    if not location.path:
-        return False
-    folder = Path(os.path.abspath(location.path))
-    path = Path(os.path.abspath(path))
-    try:
-        relative = path.relative_to(folder)
-    except ValueError:
-        return False
-    if len(relative.parts) < 2 or ".." in relative.parts:
-        return False
-    store = _key_folder(folder, relative.parts[0])
-    if store is None or not _within(path, folder):
-        return False
-    try:
-        return _no_link_below(store, path)
-    except OSError:
-        note_failure()
-        return False
-
-
-def make_parent(dst, location=None):
-    """Make the folders a preview *dst* is written into. In folder mode only
-    folders below the thumbnail folder are made, never the folder itself,
-    and only while it holds this install's marker (an unplugged drive or an
-    unmounted mount point raises FileNotFoundError); a *dst* that does not
-    pass ``may_write`` raises PermissionError."""
-    location = location or current()
-    dst = Path(dst)
-    if location.mode == SOURCE_MODE or not location.path:
-        if location.mode != SOURCE_MODE:
-            raise FileNotFoundError(errno.ENOENT, "thumbnail folder unavailable")
-        dst.parent.mkdir(parents=True, exist_ok=True)
-        return
-    folder = Path(os.path.abspath(location.path))
-    with store_io():
-        if not location.available or not folder.is_dir():
-            raise FileNotFoundError(errno.ENOENT, "thumbnail folder unavailable")
-        marker = preview_location.read_marker(str(folder))
-        if marker is None or marker.get("id") != _parsed.id:
-            note_failure()
-            raise FileNotFoundError(errno.ENOENT, "thumbnail folder unavailable")
-        if not may_write(dst, location):
-            raise PermissionError(errno.EACCES, "outside the thumbnail folder")
-        current_folder = folder
-        for part in Path(os.path.abspath(dst.parent)).relative_to(folder).parts:
-            current_folder = current_folder / part
-            try:
-                os.mkdir(current_folder)
-            except FileExistsError:
-                pass
-            if preview_location.is_link_like(current_folder):
-                raise PermissionError(errno.EACCES, "a link in the thumbnail folder")
-
-
-def store_is_link(store, location=None):
-    """Whether a store folder is a link (a junction or reparse point too in
-    folder mode): it is skipped by sweeps and refused by clears."""
-    location = location or current()
-    if location.mode == SOURCE_MODE:
-        return Path(store).is_symlink()
-    return preview_location.is_link_like(store)
-
-
-def given_store(root, store):
-    """A caller's explicit store argument: the default spelling
-    (``<root>/thumbnails``) means the resolver's store; another folder (only
-    tests pass one) is used as given."""
-    store = Path(store)
-    if store == Path(root) / PREVIEW_FOLDER:
-        return store_dir(root)
-    return store
-
-
-def preview_path(root, media_rel, ext=None, location=None, *, create=False):
-    """Where the preview of *media_rel* (relative to *root*) is, or is to be
-    written (*create*: a writer, which gives a new source its key), in *ext*
-    (the extension written now when None)."""
-    if create:
-        store = ensure_store(root, location)
-    else:
-        store = store_dir(root, location)
-    if store is None:
-        return None
-    if ext is None:
-        from .thumbnail_encode import writer_settings
-
-        ext = writer_settings().extension
-    return store / (thumbnail_settings.preview_stem(media_rel) + ext)
-
-
-def request_path(root, parts, location=None):
-    """The disk path of the URL parts ``("thumbnails", ...)``, or None when
-    *parts* is not under an exact ``thumbnails`` first part or the store has
-    no place for it. The text is checked before (``is_preview_text``)."""
-    parts = tuple(parts)
-    if len(parts) < 2 or parts[0] != PREVIEW_FOLDER:
-        return None
-    store = store_dir(root, location)
-    if store is None:
-        return None
-    return store.joinpath(*parts[1:])
-
-
-def _no_link_below(store, path):
-    """No folder from *store* down to *path* (and *store* itself) is a link,
-    junction or reparse point (lexical walk, one lstat each)."""
-    store = Path(os.path.abspath(store))
-    path = Path(os.path.abspath(path))
-    try:
-        relative = path.relative_to(store)
-    except ValueError:
-        return False
-    current = store
-    for part in ("",) + relative.parts:
-        current = current / part if part else current
-        if preview_location.is_link_like(current):
-            return False
-    return True
-
-
-def owns(root, path, location=None):
-    """Whether *path* lies inside the store of *root*, resolved: the store
-    stays inside its container and no link takes *path* out of the store.
-    In folder mode no link, junction or reparse point may sit anywhere from
-    the store down to *path*."""
-    location = location or current()
-    store = store_dir(root, location)
-    if store is None:
-        return False
-    container = store_container(root, location)
-    if not (_within(store, container) and _within(path, store)):
-        return False
-    if location.mode == SOURCE_MODE:
-        return True
-    return may_write(path, location)
-
-
-# ── preview text ─────────────────────────────────────────────────────
-
-
-def is_preview_text(filepath):
-    """URL text naming a preview: ``thumbnails/<...>/<name>_thumb<ext>``.
-
-    Text only, before any join: no backslash, drive or stream colon, and no
-    empty, ``.`` or ``..`` segment; ``thumbnails`` exactly as the first part
-    and nowhere else among the folders; the extension, in any case, one a
-    preview may carry (``X_thumb.JPG`` of an older release included).
-    """
-    if not filepath or "\\" in filepath or ":" in filepath:
-        return False
-    parts = filepath.split("/")
-    if len(parts) < 2 or parts[0] != PREVIEW_FOLDER:
-        return False
-    if any(part in ("", ".", "..") for part in parts):
-        return False
-    if PREVIEW_FOLDER in parts[1:-1]:
-        return False
-    stem, extension = os.path.splitext(parts[-1])
-    return (
-        stem.endswith(thumbnail_settings.THUMB_SUFFIX)
-        and len(stem) > len(thumbnail_settings.THUMB_SUFFIX)
-        and extension.lower() in thumbnail_settings.THUMBNAIL_EXTENSIONS
-    )
-
-
-# ── writes ───────────────────────────────────────────────────────────
-
-
-class _WriteGuard:
-    """``guard()`` for one preview write: true while the location has not
-    changed since the write started and *hold* (if any) allows it."""
-
-    __slots__ = ("generation", "_hold")
-
-    def __init__(self, hold=None):
-        self.generation = _generation
-        self._hold = hold
-
-    def __call__(self):
-        if self.generation != _generation:
-            return False
-        return self._hold is None or bool(self._hold())
-
-
-def write_guard(hold=None):
-    """Take when a preview write starts; hand to its final rename."""
-    if isinstance(hold, _WriteGuard):
-        return hold
-    return _WriteGuard(hold)
-
-
-@contextmanager
-def committed(guard=None):
-    """Around a preview's final rename: holds ``write_lock`` and yields
-    whether the write may land (``guard()``, re-checked under the lock)."""
-    with write_lock:
-        yield guard is None or bool(guard())

py/api/review.py

@@ -9,10 +9,7 @@ candidates and the dependency fingerprint. ``POST .../items/{id}/decision``
 records one explicit decision: Apply links the chosen sampler's pair only
 when the capture is the item's bytes, the current file still hashes to them,
 the evidence they yield is unchanged and the ingester's compatible-only rules
-allow it; Leave unresolved links nothing. ``POST .../items/{id}/link`` (#536)
-links a Library prompt the reviewer chose, under the same capture and
-compatibility guards; it is their choice, so what the bytes resolve to is not
-asked.
+allow it; Leave unresolved links nothing.
 
 Targets are formatted from the recorded spelling against the current roots
 (no file access beyond the roots' real paths); a file under no current root
@@ -31,13 +28,12 @@ import urllib.parse
 
 from aiohttp import web
 
-from .annotations import _capture_error, _error
+from .annotations import _HEX64, _TOKEN, _UUID, _capture_error, _error
 from .images import media_thumbnail_url
 from .inspection_service import VIDEO_EXTENSIONS
 from .job_routes import busy_response
 from .jobs import JobBusy
 from .prompts import bad_request
-from .review_guards import UNRESOLVED, _decision_guards, _link_guards
 
 try:
     from ...database.library import display_title
@@ -63,6 +59,17 @@ MAX_CURSOR = 4096
 MAX_BODY_BYTES = 64 * 1024
 # The serialized detail stays under this; past it the detail is ``limited``.
 MAX_DETAIL_BYTES = 8 * 1024 * 1024
+UNRESOLVED = "unresolved"
+_DECISION_FIELDS = frozenset(
+    {
+        "expected_epoch",
+        "expected_revision",
+        "capture_token",
+        "sha256",
+        "dependency_fingerprint",
+        "choice",
+    }
+)
 _CURSOR_SECRET = os.urandom(32)
 # The real path of a spelling; module-level so a test can fake a junction.
 _realpath = os.path.realpath
@@ -77,7 +84,6 @@ _STATUS = {
     "storage-changed": 409,
     "source-changed": 409,
     "capture-expired": 409,
-    "prompt-missing": 409,
 }
 _MESSAGES = {
     "review-missing": "This review item no longer exists. Reload the queue.",
@@ -89,9 +95,6 @@ _MESSAGES = {
         "sampler path cannot be attached safely. The existing links were "
         "preserved."
     ),
-    "prompt-missing": (
-        "That prompt or recipe is no longer in the Library. Search again."
-    ),
     "dependencies-changed": (
         "The image's saved links changed since this item was opened. Reopen it "
         "to see the current association."
@@ -248,7 +251,6 @@ class ReviewRoutesMixin:
         routes.get(ITEMS_URL)(self.list_review_items)
         routes.get(ITEMS_URL + "/{item_id}")(self.get_review_item)
         routes.post(ITEMS_URL + "/{item_id}/decision")(self.decide_review_item)
-        routes.post(ITEMS_URL + "/{item_id}/link")(self.link_review_item)
 
     # -- shared ----------------------------------------------------------------
 
@@ -462,43 +464,6 @@ class ReviewRoutesMixin:
         except JobBusy as busy:
             return busy_response(busy)
 
-    async def link_review_item(self, request: web.Request) -> web.Response:
-        """POST the Library prompt the reviewer chose for one pending item.
-
-        Under the same lease as a decision. The capture must be the item's
-        current bytes; the choice and the file's links are checked in the
-        decision's transaction.
-        """
-        try:
-            async with self._jobs.lease(REVIEW_DECISION_LEASE):
-                return await self._link_review_item(request)
-        except JobBusy as busy:
-            return busy_response(busy)
-
-    async def _link_review_item(self, request: web.Request) -> web.Response:
-        data, error = await self._read_json_body(request, max_bytes=MAX_BODY_BYTES)
-        if error is not None:
-            return error
-        guards, error = _link_guards(data)
-        if error is not None:
-            return error
-        try:
-            item = await self._run_in_executor(
-                self.db.review_item, request.match_info["item_id"]
-            )
-        except Exception:
-            self.logger.exception("Review item read failed")
-            return _failed()
-        if item is None:
-            return _coded("review-missing")
-        verified, error = await self._verified_review_capture(
-            item, guards, need_metadata=True
-        )
-        if error is not None:
-            return error
-        manual = {"positive_id": guards["positive_id"], "pair_id": guards["pair_id"]}
-        return await self._record_decision(item, guards, None, verified, manual)
-
     async def _decide_review_item(self, request: web.Request) -> web.Response:
         data, error = await self._read_json_body(request, max_bytes=MAX_BODY_BYTES)
         if error is not None:
@@ -584,25 +549,22 @@ class ReviewRoutesMixin:
             return None, _coded("file-changed")
         metadata = None
         if need_metadata:
-            # A manual link has no ``choice``: it rests on the bytes alone.
-            if captured is None or (
-                "choice" in guards
-                and not _candidate_still_offered(captured[1], guards["choice"])
+            if captured is None or not _candidate_still_offered(
+                captured[1], guards["choice"]
             ):
                 return None, _coded("review-conflict", "evidence-changed")
             metadata = captured[0]
         image_path = os.path.join(str(root), *relative.split("/"))
         return (capture, facts, image_path, metadata), None
 
-    def _decide_sync(self, item, guards, candidate, verified, manual=None):
+    def _decide_sync(self, item, guards, candidate, verified):
         """Worker thread: resolve the file's spellings, decide, build the view.
 
         Returns ``(result, view)``; a refusal raises with ``exc.view`` set.
         """
         _capture, facts, image_path, metadata = verified or (None, None, None, None)
         aliases, known = (), None
-        selected = candidate is not None or manual is not None
-        if selected:
+        if candidate is not None:
             aliases, known = physical_spellings(self.db, image_path, item["locator"])
         try:
             result = self.db.decide_review_item(
@@ -611,9 +573,8 @@ class ReviewRoutesMixin:
                 expected_revision=guards["expected_revision"],
                 # The bytes the re-hash proved, or the body's for Leave unresolved.
                 sha256=facts.sha256 if facts is not None else guards["sha256"],
-                outcome="selected" if selected else UNRESOLVED,
+                outcome="selected" if candidate is not None else UNRESOLVED,
                 candidate=candidate,
-                manual=manual,
                 image_path=image_path,
                 metadata=metadata,
                 expected_fingerprint=guards["dependency_fingerprint"],
@@ -628,11 +589,11 @@ class ReviewRoutesMixin:
         roots, real_roots = self._review_roots()
         return result, self._review_view(result["item"], roots, real_roots)
 
-    async def _record_decision(self, item, guards, candidate, verified, manual=None):
+    async def _record_decision(self, item, guards, candidate, verified):
         capture = verified[0] if verified else None
         try:
             result, view = await self._run_in_executor(
-                self._decide_sync, item, guards, candidate, verified, manual
+                self._decide_sync, item, guards, candidate, verified
             )
         except ReviewCommandError as exc:
             return self._decision_refused(exc)
@@ -668,6 +629,36 @@ class ReviewRoutesMixin:
         return _coded(exc.code, message, **extra)
 
 
+def _decision_guards(data: dict):
+    """The validated decision fields, or ``(None, error)``."""
+    if set(data) != _DECISION_FIELDS:
+        return None, bad_request(
+            "Request must contain exactly " + ", ".join(sorted(_DECISION_FIELDS))
+        )
+    epoch, revision = data["expected_epoch"], data["expected_revision"]
+    if not isinstance(epoch, str) or _UUID.fullmatch(epoch) is None:
+        return None, bad_request("expected_epoch must be a canonical UUID")
+    if type(revision) is not int or revision < 0:
+        return None, bad_request("expected_revision must be a non-negative integer")
+    token = data["capture_token"]
+    if token is not None and (
+        not isinstance(token, str) or _TOKEN.fullmatch(token) is None
+    ):
+        return None, bad_request("Invalid capture token")
+    for name in ("sha256", "dependency_fingerprint"):
+        value = data[name]
+        if not isinstance(value, str) or _HEX64.fullmatch(value) is None:
+            return None, bad_request(
+                f"{name} must be 64 lowercase hexadecimal characters"
+            )
+    choice = data["choice"]
+    if not isinstance(choice, str) or (
+        choice != UNRESOLVED and _HEX64.fullmatch(choice) is None
+    ):
+        return None, bad_request("choice must be a candidate hash or unresolved")
+    return {**data}, None
+
+
 def _verify_and_read(store, capture, item, root, need_metadata: bool):
     """Worker thread: ``(relative, facts, captured)``, or None off the root.
 

py/api/review_guards.py

@@ -1,66 +0,0 @@
-"""Body validation of Needs review decisions and manual links (#249 E3, #536)."""
-
-from .annotations import _HEX64, _TOKEN, _UUID
-from .prompts import bad_request
-
-UNRESOLVED = "unresolved"
-_GUARD_FIELDS = frozenset(
-    {
-        "expected_epoch",
-        "expected_revision",
-        "capture_token",
-        "sha256",
-        "dependency_fingerprint",
-    }
-)
-_DECISION_FIELDS = _GUARD_FIELDS | {"choice"}
-_LINK_FIELDS = _GUARD_FIELDS | {"positive_id", "pair_id"}
-
-
-def _guard_error(data: dict, fields: frozenset):
-    """The first problem with a decision's shared fields, as a response."""
-    if set(data) != fields:
-        return bad_request("Request must contain exactly " + ", ".join(sorted(fields)))
-    epoch, revision = data["expected_epoch"], data["expected_revision"]
-    if not isinstance(epoch, str) or _UUID.fullmatch(epoch) is None:
-        return bad_request("expected_epoch must be a canonical UUID")
-    if type(revision) is not int or revision < 0:
-        return bad_request("expected_revision must be a non-negative integer")
-    token = data["capture_token"]
-    if token is not None and (
-        not isinstance(token, str) or _TOKEN.fullmatch(token) is None
-    ):
-        return bad_request("Invalid capture token")
-    for name in ("sha256", "dependency_fingerprint"):
-        value = data[name]
-        if not isinstance(value, str) or _HEX64.fullmatch(value) is None:
-            return bad_request(f"{name} must be 64 lowercase hexadecimal characters")
-    return None
-
-
-def _decision_guards(data: dict):
-    """The validated decision fields, or ``(None, error)``."""
-    error = _guard_error(data, _DECISION_FIELDS)
-    if error is not None:
-        return None, error
-    choice = data["choice"]
-    if not isinstance(choice, str) or (
-        choice != UNRESOLVED and _HEX64.fullmatch(choice) is None
-    ):
-        return None, bad_request("choice must be a candidate hash or unresolved")
-    return {**data}, None
-
-
-def _link_guards(data: dict):
-    """The validated manual link fields, or ``(None, error)``."""
-    error = _guard_error(data, _LINK_FIELDS)
-    if error is not None:
-        return None, error
-    if data["capture_token"] is None:
-        return None, bad_request("A link needs a capture of the file")
-    positive, pair = data["positive_id"], data["pair_id"]
-    if type(positive) is not int or positive < 1:
-        return None, bad_request("positive_id must be a positive integer")
-    if pair is not None and (type(pair) is not int or pair < 1):
-        return None, bad_request("pair_id must be a positive integer or null")
-    return {**data}, None

py/api/settings_routes.py

@@ -30,7 +30,6 @@ from . import thumbnail_settings
 from .admin import _current_image_monitor
 from .job_routes import busy_response
 from .jobs import THUMBNAILS_JOB_KIND, JobBusy
-from .thumbnail_location import needs_move_response
 
 try:
     from ...utils.validators import validate_result_timeout, validate_worker_threads
@@ -265,12 +264,6 @@ class SettingsRoutesMixin:
                     "sources": source_status,
                     "monitor": monitor,
                     "thumbnail_encoders": encoders,
-                    # #320: the full path only here (D6A).
-                    "thumbnail_location": await self._run_in_executor(
-                        functools.partial(
-                            self._thumbnail_location_payload, with_path=True
-                        )
-                    ),
                     "settings": {
                         "monitoring_enabled": GalleryConfig.MONITORING_ENABLED,
                         "save_foreign_runs": GalleryConfig.SAVE_FOREIGN_RUNS,
@@ -384,9 +377,6 @@ class SettingsRoutesMixin:
             if error_response is not None:
                 return error_response
 
-            if "thumbnail_location" in data:
-                # #320: only the Move thumbnails job changes the location.
-                return needs_move_response()
             expected_revision = data.get("expected_revision")
             if expected_revision is not None and not isinstance(expected_revision, str):
                 return web.json_response(

py/api/source_rescope.py

@@ -41,13 +41,6 @@ def _coded(status: int, code: str, message: str) -> web.Response:
     )
 
 
-def _missing_if_not_found(response: web.Response) -> web.Response:
-    """A file in a trash folder answers as a missing file does (#543)."""
-    if response.status == 404:
-        return _coded(404, "file-missing", "Image file not found")
-    return response
-
-
 def _no_store(response: web.Response) -> web.Response:
     response.headers["Cache-Control"] = "no-store"
     return response
@@ -78,7 +71,7 @@ class SourceRescopeMixin:
         path = root / relative
         denied = _media_access_error(path, [root])
         if denied is not None:
-            return _missing_if_not_found(denied)
+            return denied
         try:
             mtime = path.stat().st_mtime if path.is_file() else None
         except OSError:
@@ -96,7 +89,7 @@ class SourceRescopeMixin:
             return bad_request("Send exactly one target")
         target, error = media_target(data["target"])
         if error is not None:
-            return _missing_if_not_found(error)
+            return error
         old_index, scope, relative = target
         if old_index > MAX_ROOT_INDEX:
             return bad_request("Invalid gallery root")

py/api/sources.py

@@ -30,8 +30,6 @@ import ntpath
 import os
 import re
 
-from .preview_location import HOLDS_THUMBNAILS_REASON
-
 logger = logging.getLogger("prompt_manager.api")
 
 MAX_SOURCE_PATH = 4096  # characters
@@ -116,26 +114,7 @@ def source_problem(text):
     code = source_form_error(text)
     if code is not None:
         return code, FORM_REASONS[code]
-    code, reason = GalleryConfig.gallery_root_problem(text)
-    if code is None and _holds_thumbnails(GalleryConfig.resolve_gallery_root(text)):
-        return "holds-thumbnails", HOLDS_THUMBNAILS_REASON
-    return code, reason
-
-
-def _holds_thumbnails(path):
-    """Whether *path* is inside or around the thumbnail folder in use (#320):
-    a source there would list Prompt Manager's own previews."""
-    from . import preview_store
-
-    try:
-        from ...utils.library_location import _inside_any
-    except ImportError:  # tests import the package top-level
-        from utils.library_location import _inside_any
-
-    setting = preview_store.setting()
-    if setting.mode != preview_store.FOLDER_MODE or not setting.path:
-        return False
-    return _inside_any(path, [setting.path]) or _inside_any(setting.path, [path])
+    return GalleryConfig.gallery_root_problem(text)
 
 
 def public_spelling(text):

py/api/thumbnail_auto.py

@@ -8,8 +8,7 @@ previews behind those URLs are made here, in three ways:
 - **On first view.** ``GET /prompt_manager/images/serve/thumbnails/<rel>_thumb
   <ext>`` for a preview that does not exist yet is admitted on the event loop
   (``_PreviewGate``): at most ``ON_DEMAND_LIMIT`` previews are written at once,
-  on this API's interactive image pool (``IMAGE_POOL_SIZE`` threads, shared
-  with card facts and inspector reads; never the default executor), one flight runs
+  on this API's own small pool (never the default executor), one flight runs
   per file, and the requests waiting are capped (``MAX_WAITING``); past the
   cap a request gets its fallback at once. Inside the admission the preview is
   mapped back to its media file under the same root (the request text is
@@ -25,8 +24,7 @@ previews behind those URLs are made here, in three ways:
 - **On capture.** The image monitor hands every new output it settles to
   ``queue_capture_thumbnail``, which queues its preview for one background
   worker thread (``AutoThumbnailer``). Each wake takes at most Worker threads
-  (``WORKER_THREADS``) files and writes them on the long-lived job pool
-  (``utils.parallel``, shared with scans and thumbnail jobs); enqueuing
+  (``WORKER_THREADS``) files and writes them on that many threads; enqueuing
   is O(1), so the monitor and ComfyUI's queue never wait. A file already
   queued is not queued again, the queue is bounded (``MAX_QUEUED``) and a
   preview left out is made on its first view instead.
@@ -51,7 +49,7 @@ write starts (after its slot) and again just before its rename.
 
 Shutdown: ``close_auto_thumbnails`` stops the worker at a file boundary,
 kills a running ffmpeg, waits a bounded time (and logs when the wait ran
-out) and shuts the image pool down; after the app's cleanup
+out) and shuts the view pool down; after the app's cleanup
 (``final=True``) nothing starts a worker again. Importing this module again
 (a package reload) stops the workers the previous import left.
 """
@@ -62,14 +60,13 @@ import functools
 import io
 import os
 import threading
-from concurrent.futures import CancelledError, ThreadPoolExecutor
+from concurrent.futures import ThreadPoolExecutor
 from pathlib import Path
 
 from aiohttp import web
 
-from . import preview_store, thumbnail_settings
+from . import thumbnail_settings
 from .images import (
-    in_trash_below_roots,
     MEDIA_EXTENSIONS,
     THUMBNAIL_CLEAR_TITLE,
     VIDEO_EXTENSIONS,
@@ -78,7 +75,7 @@ from .images import (
     _thumbnail_is_fresh,
     _video_placeholder_image,
     _worker_threads,
-    media_preview_path,
+    media_thumbnail_rel,
 )
 from .jobs import (
     DUPLICATE_CLEANUP_JOB_KIND,
@@ -106,11 +103,8 @@ PLACEHOLDER_SIZE = (thumbnail_settings.DEFAULT_EDGE, thumbnail_settings.DEFAULT_
 PLACEHOLDER_QUALITY = 85
 # Source extensions in the order a shared preview name looks for them (R2).
 _SOURCE_ORDER = thumbnail_settings.IMAGE_SOURCE_ORDER + tuple(sorted(VIDEO_EXTENSIONS))
-# Threads of the interactive image pool (#523): view previews, card facts and
-# inspector reads. Fixed, so image buffers stay in a few threads' arenas.
-IMAGE_POOL_SIZE = 3
-# Previews views may write at once (the whole image pool).
-ON_DEMAND_LIMIT = IMAGE_POOL_SIZE
+# Previews views may write at once (the size of the view pool).
+ON_DEMAND_LIMIT = 3
 # View requests that may wait on the gate; one more gets its fallback at once.
 MAX_WAITING = 64
 # How long a pool thread waits for the capture worker's flight of the same file.
@@ -129,7 +123,7 @@ AUTO_REFUSED_KINDS = frozenset(
     {RESTORE_JOB_KIND, DUPLICATE_CLEANUP_JOB_KIND, SOURCE_CHANGE_JOB_KIND}
 )
 WORKER_NAME = "PromptManagerThumbnailWorker"
-POOL_PREFIX = "pm-image"
+POOL_PREFIX = "pm-preview"
 # Identifies this import's workers: a reload stops the ones it did not start.
 _MODULE_TOKEN = object()
 
@@ -158,36 +152,6 @@ def _dst_key(dst):
     return flight_key(Path(dst).parent, (Path(dst).name,))
 
 
-class DeferredPreview:
-    """The preview of *rel* under *root*, resolved when its write starts
-    (#320): a queued capture follows the thumbnail location at write time,
-    not the one when it was queued."""
-
-    __slots__ = ("root", "rel", "strict")
-
-    def __init__(self, root, rel, *, strict=True):
-        self.root = Path(root)
-        self.rel = Path(rel)
-        # A capture refuses a store linked out of its container (the serve
-        # route's rule); a planned target keeps the plan's rule: inside the
-        # store, as the thumbnail job writes it.
-        self.strict = strict
-
-    def resolve(self):
-        """The preview's path now, or None when nothing may be written."""
-        dst = media_preview_path(self.root, self.rel, create=True)
-        if dst is None:
-            return None
-        if self.strict:
-            return dst if preview_store.owns(self.root, dst) else None
-        store = preview_store.store_dir(self.root)
-        return dst if _is_within(dst, store) else None
-
-
-def _resolved(dst):
-    return dst.resolve() if isinstance(dst, DeferredPreview) else Path(dst)
-
-
 @functools.lru_cache(maxsize=1)
 def video_placeholder_jpeg():
     """The placeholder frame as JPEG bytes (a video whose preview is missing)."""
@@ -245,19 +209,10 @@ def _candidates(parts):
 def _current_preview(root, parts):
     """The preview *parts* names, in the format written now (#317): a request
     for an older name (``_thumb.png`` before a conversion) is answered with
-    the current file. None when the store of *root* has no place for it."""
+    the current file."""
     _folder, base, _wanted = _candidates(parts)
     name = base + thumbnail_settings.THUMB_SUFFIX + writer_settings().extension
-    return preview_store.request_path(root, (*parts[:-1], name))
-
-
-def _request_key(root, parts):
-    """The flight key of the preview *parts* under *root*: the key of its
-    disk path (so the serve and history routes share one flight)."""
-    path = preview_store.request_path(root, parts)
-    if path is None:
-        return flight_key(root, parts)
-    return _dst_key(path)
+    return Path(root).joinpath(*parts[:-1], name)
 
 
 def _quick_source(root, parts):
@@ -269,8 +224,6 @@ def _quick_source(root, parts):
         for name in (base + extension, base + extension.upper()):
             path = folder / name
             if _regular_file(path) and _is_within(path, root):
-                if in_trash_below_roots(path, [root]):
-                    return None  # also the fallback past the gate's cap (#543)
                 return path, extension in VIDEO_EXTENSIONS
     return None
 
@@ -295,17 +248,13 @@ def _thumbnail_source(root, parts):
         found = _scan_folder(root.joinpath(*folder_parts), base, set(wanted))
         if found is None or not _is_within(found, root):
             return None
-    if in_trash_below_roots(found, [root]):
-        return None
     rel = Path(*folder_parts, found.name)
-    dst = media_preview_path(root, rel, create=True)
-    if dst is None:
-        # Nowhere to write (the thumbnail folder is unavailable): the
-        # original is served and nothing is written.
-        return found, None, found.suffix.lower() in VIDEO_EXTENSIONS
+    dst = root / media_thumbnail_rel(rel)
     if dst != _current_preview(root, parts):
         return None
-    if not preview_store.owns(root, dst):
+    if not _is_within(root / "thumbnails", root) or not _is_within(
+        dst, root / "thumbnails"
+    ):
         dst = None
     return found, dst, found.suffix.lower() in VIDEO_EXTENSIONS
 
@@ -325,21 +274,6 @@ def _scan_folder(folder, base, extensions):
     return None
 
 
-def _deferred(roots, src, dst):
-    """The ``DeferredPreview`` of a planned ``(src, dst)``: the root whose
-    store the plan wrote *dst* into (nested roots plan one each); *dst* as
-    planned when none matches."""
-    src = Path(src)
-    for root in roots:
-        root = Path(root)
-        if not src.is_relative_to(root):
-            continue
-        rel = src.relative_to(root)
-        if media_preview_path(root, rel) == Path(dst):
-            return DeferredPreview(root, rel, strict=False)
-    return dst
-
-
 def _stop_stale_workers():
     """Stop capture workers a previous import of this module started."""
     for thread in threading.enumerate():
@@ -355,7 +289,7 @@ class AutoThumbnailer:
     ``generate(src, dst, is_video, *, stop, guard, track)`` writes one
     preview and returns ``_generate_one``'s result dict; ``may_write()``
     says whether automatic previews may be written now. Views call
-    ``ensure`` on the image pool, the monitor calls ``enqueue`` from its
+    ``ensure`` on the view pool, the monitor calls ``enqueue`` from its
     thread.
     """
 
@@ -481,23 +415,16 @@ class AutoThumbnailer:
 
     def enqueue(self, src, dst, is_video):
         """Queue *dst*'s preview for the worker; False when already queued,
-        full, closed, nowhere to write it or its worker is refused at
-        interpreter exit. Never blocks on a write. *dst* may be a
-        ``DeferredPreview``: its path is resolved again when the write
-        starts."""
-        now = _resolved(dst)
-        if now is None:
-            return False
-        key = _dst_key(now)
-        if not isinstance(dst, DeferredPreview):
-            dst = now
+        full, closed or its worker is refused at interpreter exit. Never
+        blocks on a write."""
+        key = _dst_key(dst)
         with self._changed:
             if self._closed or key in self._queued:
                 return False
             if len(self._queue) >= self._max_queued:
                 return False
             self._queued.add(key)
-            self._queue.append((key, Path(src), dst, bool(is_video)))
+            self._queue.append((key, Path(src), Path(dst), bool(is_video)))
             self._busy = True
             started = True
             if self._start_worker and not self._worker_running:
@@ -559,15 +486,12 @@ class AutoThumbnailer:
                     self._worker_running = False
                     self._changed.notify_all()
                     return
-                workers = max(1, int(self._workers() or 1))
-                take = min(len(self._queue), workers)
+                take = min(len(self._queue), max(1, int(self._workers() or 1)))
                 batch = [self._queue.popleft() for _ in range(take)]
                 self._batch = len(batch)
                 self._changed.notify_all()
             try:
-                # The job pool's size is the setting; a smaller batch uses
-                # fewer of its threads (#523: one long-lived pool).
-                map_parallel(self._write_queued, batch, workers)
+                map_parallel(self._write_queued, batch, len(batch))
             finally:
                 with self._changed:
                     self._batch = 0
@@ -577,9 +501,6 @@ class AutoThumbnailer:
     def _write_queued(self, item):
         _key, src, dst, is_video = item
         try:
-            dst = _resolved(dst)
-            if dst is None:
-                return  # nowhere to write it now: made on its first view
             self.ensure(src, dst, is_video)
         except Exception:  # one file never stops the worker
             self._logger.warning(
@@ -607,7 +528,6 @@ class AutoThumbnailer:
             try:
                 process.kill()
             except OSError:
-                # the process has already exited
                 pass
         if worker is None:
             return True
@@ -641,7 +561,7 @@ class _PreviewGate:
     """Admission of view requests on the event loop (#249 I2).
 
     Waiters are coroutines: at most ``limit`` previews are written at once
-    on the image pool, one flight runs per key, and past ``MAX_WAITING``
+    on the view pool, one flight runs per key, and past ``MAX_WAITING``
     waiting requests ``run`` answers ``OVER`` at once.
     """
 
@@ -696,17 +616,13 @@ class _PreviewGate:
                 flight.set_result(result)
 
 
-def _on_image_thread():
-    return threading.current_thread().name.startswith(POOL_PREFIX + "_")
-
-
 class AutoThumbnailMixin:
     """Automatic previews on the API: views, the monitor's queue, scans."""
 
     _auto_thumbnailer = None
     _auto_thumbnails_shut = False
     _preview_gate_obj = None
-    _image_pool_obj = None
+    _preview_pool_obj = None
     _auto_thumbnailer_lock = threading.Lock()
 
     def _auto_thumbnails(self):
@@ -729,7 +645,7 @@ class AutoThumbnailMixin:
             self._auto_thumbnails_shut = True
 
     def close_auto_thumbnails(self, final=False, timeout=None):
-        """Stop the capture worker and the image pool, and forget them.
+        """Stop the capture worker and the view pool, and forget them.
 
         Bounded by ``timeout`` (see AutoThumbnailer.close). ``final`` (the
         package teardown) also keeps a late monitor event from starting a
@@ -740,7 +656,7 @@ class AutoThumbnailMixin:
             if final:
                 self._auto_thumbnails_shut = True
             thumbnailer, self._auto_thumbnailer = self._auto_thumbnailer, None
-            pool, self._image_pool_obj = self._image_pool_obj, None
+            pool, self._preview_pool_obj = self._preview_pool_obj, None
             self._preview_gate_obj = None
         closed = True
         if thumbnailer is not None:
@@ -749,8 +665,6 @@ class AutoThumbnailMixin:
             pool.shutdown(wait=False, cancel_futures=True)
         if final:
             shutdown_encoders()  # kill JPEG XL / ffmpeg encoders still running
-            # The thumbnail folder's probe (#320), bounded like the rest.
-            closed = preview_store.stop_probe() and closed
         return closed
 
     def _auto_thumbnail_failures(self):
@@ -786,67 +700,16 @@ class AutoThumbnailMixin:
             gate = self._preview_gate_obj = _PreviewGate(ON_DEMAND_LIMIT, self.logger)
         return gate
 
-    def _image_pool(self):
-        """The interactive image pool (#523): IMAGE_POOL_SIZE threads for view
-        previews (behind their gate), card facts and inspector reads, so
-        image buffers never spread over the default executor's threads.
-
-        None after the package teardown (``close_auto_thumbnails(final=True)``):
-        a late request then runs on the default executor (``run_in_executor``
-        with None) and starts no thread the teardown no longer stops.
-        """
+    def _preview_pool(self):
         with AutoThumbnailMixin._auto_thumbnailer_lock:
-            if self._image_pool_obj is None and not self._auto_thumbnails_shut:
-                self._image_pool_obj = ThreadPoolExecutor(
-                    IMAGE_POOL_SIZE, thread_name_prefix=POOL_PREFIX
+            if self._preview_pool_obj is None:
+                self._preview_pool_obj = ThreadPoolExecutor(
+                    ON_DEMAND_LIMIT, thread_name_prefix=POOL_PREFIX
                 )
-            return self._image_pool_obj
+            return self._preview_pool_obj
 
-    async def _run_image(self, func, *args, **kwargs):
-        """``_run_in_executor`` for interactive image work: the image pool.
-
-        After the teardown, or with the pool shut down in between (a test
-        reset), the call runs on the default executor as before.
-        """
-        call = functools.partial(func, *args, **kwargs)
-        loop = asyncio.get_running_loop()
-        try:
-            future = loop.run_in_executor(self._image_pool(), call)
-        except RuntimeError:  # submit refused: the pool was shut down
-            future = loop.run_in_executor(None, call)
-        return await future
-
-    def _map_image(self, func, items):
-        """``func`` over *items* on the image pool, in order (blocking).
-
-        Called from an image pool thread, after the teardown, or with the
-        pool shut down in between (its queued items are cancelled), the
-        items it did not run run on the calling thread.
-        """
-        items = list(items)
-        pool = None if not items or _on_image_thread() else self._image_pool()
-        if pool is None:
-            return [func(item) for item in items]
-        futures = []
-        try:
-            for item in items:
-                futures.append(pool.submit(func, item))
-        except RuntimeError:
-            pass  # shut down in between: the rest run here
-        results = []
-        for index, item in enumerate(items):
-            future = futures[index] if index < len(futures) else None
-            if future is None or future.cancelled():
-                results.append(func(item))
-                continue
-            try:
-                results.append(future.result())
-            except CancelledError:  # cancelled while this caller waited
-                results.append(func(item))
-        return results
-
-    def _image_pool_threads(self):
-        pool = self._image_pool_obj
+    def _preview_pool_threads(self):
+        pool = self._preview_pool_obj
         return [] if pool is None else list(getattr(pool, "_threads", ()))
 
     def _video_placeholder_bytes(self):
@@ -861,7 +724,7 @@ class AutoThumbnailMixin:
         return await self._preview_gate().run(
             flight_key(Path(dst).parent, (Path(dst).name,)),
             functools.partial(self._ensure_view, src, dst, is_video),
-            self._image_pool(),
+            self._preview_pool(),
         )
 
     def _ensure_view(self, src, dst, is_video):
@@ -905,17 +768,17 @@ class AutoThumbnailMixin:
         The flight answers only the outcome (a history flight may be the one
         joined); the file it previews is derived here: the preview path is
         the request's own, and a fallback looks its source up again on the
-        image pool (bounded by it, never the default executor).
+        view pool (bounded by it, never the default executor).
         """
         if _has_traversal(filepath) or not _is_preview_request(filepath):
             return None
         parts = tuple(filepath.split("/"))
         gate = self._preview_gate()
-        pool = self._image_pool()
+        pool = self._preview_pool()
         for root in output_dirs:
             root = Path(root)
             outcome = await gate.run(
-                _request_key(root, parts),
+                flight_key(root, parts),
                 functools.partial(self._preview_on_demand, root, parts),
                 pool,
             )
@@ -928,7 +791,7 @@ class AutoThumbnailMixin:
                     continue
                 return self._preview_response(BUSY, quick[0], None, quick[1])
             dst = _current_preview(root, parts)
-            if outcome == READY and dst is not None:
+            if outcome == READY:
                 return self._file_response(dst)
             located = await gate.loop.run_in_executor(
                 pool, _thumbnail_source, root, parts
@@ -951,31 +814,17 @@ class AutoThumbnailMixin:
         """
         if self._auto_thumbnails_shut:
             return "skipped"
-        located = self._capture_source(image_path)
+        located = self._capture_target(image_path)
         if located is None:
             return "skipped"
-        src, root, rel, is_video = located
-        dst = DeferredPreview(root, rel).resolve()
-        if dst is None:
-            return "skipped"
+        src, dst, is_video = located
         if _thumbnail_is_fresh(src, dst):
             return "fresh"
-        if self._auto_thumbnails().enqueue(src, DeferredPreview(root, rel), is_video):
+        if self._auto_thumbnails().enqueue(src, dst, is_video):
             return "queued"
         return "skipped"
 
     def _capture_target(self, image_path):
-        """``(src, dst, is_video)`` of a new output's preview now, or None."""
-        located = self._capture_source(image_path)
-        if located is None:
-            return None
-        src, root, rel, is_video = located
-        dst = DeferredPreview(root, rel).resolve()
-        return None if dst is None else (src, dst, is_video)
-
-    def _capture_source(self, image_path):
-        """``(src, root, rel, is_video)`` of a media file under a current
-        root (not a preview, a link or in a trash folder), or None."""
         path = Path(os.path.abspath(str(image_path)))
         if path.suffix.lower() not in MEDIA_EXTENSIONS or not _regular_file(path):
             return None
@@ -986,9 +835,14 @@ class AutoThumbnailMixin:
             if not folded.startswith(base) or not _is_within(path, root):
                 continue
             rel = Path(os.path.relpath(path, root))
-            if "thumbnails" in rel.parts[:-1] or in_trash_below_roots(path, [root]):
+            if "thumbnails" in rel.parts[:-1]:
                 return None
-            return path, root, rel, path.suffix.lower() in VIDEO_EXTENSIONS
+            dst = root / media_thumbnail_rel(rel)
+            if not _is_within(root / "thumbnails", root) or not _is_within(
+                dst, root / "thumbnails"
+            ):
+                return None
+            return path, dst, path.suffix.lower() in VIDEO_EXTENSIONS
         return None
 
     # ── after a scan ──────────────────────────────────────────────────
@@ -1030,7 +884,7 @@ class AutoThumbnailMixin:
             return "none"
         thumbnailer = self._auto_thumbnails()
         for src, dst, is_video in plan["targets"]:
-            thumbnailer.enqueue(src, _deferred(output_dirs, src, dst), is_video)
+            thumbnailer.enqueue(src, dst, is_video)
         self.logger.info(f"{missing:,} previews missing after the scan; queued")
         return "queued"
 

py/api/thumbnail_convert.py

@@ -153,7 +153,6 @@ class ThumbnailConvertMixin:
             job.log_line("Conversion failed · internal error")
             state = "failed"
         job.finish(state)
-        await self._release_job_memory()
 
     async def _convert_job_body(self, job, options):
         output_dirs = await self._run_in_executor(self._get_all_output_dirs)

py/api/thumbnail_encode.py

@@ -46,7 +46,7 @@ from pathlib import Path
 
 from PIL import Image
 
-from . import preview_store, thumbnail_settings
+from . import thumbnail_settings
 
 try:
     from ...utils.logging_config import get_logger
@@ -101,15 +101,10 @@ def temp_sibling(dst, tag="part"):
 
 
 def replace_unless_held(tmp, dst, guard=None):
-    """Rename *tmp* over *dst*, unless ``guard()`` is false (PreviewWriteHeld).
-
-    The check and the rename run under ``preview_store.write_lock`` (#320): a
-    guard from ``preview_store.write_guard`` also refuses a write that started
-    before the thumbnail location changed."""
-    with preview_store.committed(guard) as allowed:
-        if not allowed:
-            raise PreviewWriteHeld(PREVIEW_HELD)
-        os.replace(tmp, dst)
+    """Rename *tmp* over *dst*, unless ``guard()`` is false (PreviewWriteHeld)."""
+    if guard is not None and not guard():
+        raise PreviewWriteHeld(PREVIEW_HELD)
+    os.replace(tmp, dst)
 
 
 # ``temp_sibling``'s names: ``.<stem>.<tag>-<pid>-<thread id><ext>``.
@@ -163,7 +158,6 @@ def _unlink_quietly(path):
     try:
         Path(path).unlink()
     except FileNotFoundError:
-        # already gone, which is what was wanted
         pass
     except OSError as exc:
         logger.debug(f"Could not remove temp file {Path(path).name}: {exc}")
@@ -227,7 +221,6 @@ def shutdown_encoders():
         try:
             process.kill()
         except OSError:
-            # the process has already exited
             pass
 
 
@@ -366,12 +359,10 @@ def thumbnail_frame(img, edge):
     try:
         img.seek(0)
     except (EOFError, AttributeError, ValueError):
-        # not seekable or a single frame: use the current one
         pass
     try:
         img.draft("RGB", (edge, edge))  # JPEG: decode at a reduced scale
     except (AttributeError, ValueError, OSError):
-        # draft is only a speedup; the full decode below still works
         pass
     frame = img.convert("RGB") if img.mode != "RGB" else img.copy()
     frame.thumbnail((edge, edge), Image.Resampling.LANCZOS)

py/api/thumbnail_jobs.py

@@ -49,7 +49,6 @@ from .images import (
     _worker_threads,
 )
 from .job_routes import busy_response
-from .thumbnail_location import location_refusal
 from .jobs import THUMBNAIL_GROUP_NAMES, THUMBNAILS_JOB_KIND, JobBusy
 from .thumbnail_convert import CONVERT_JOB_TITLE
 from .thumbnail_encode import writer_settings
@@ -183,9 +182,6 @@ class ThumbnailJobsMixin:
         options, error = thumbnail_options(body)
         if error:
             return _invalid(error)
-        refused = location_refusal()
-        if refused is not None:
-            return refused
         try:
             job = self._start_thumbnail_job(options)
         except JobBusy as busy:
@@ -230,7 +226,6 @@ class ThumbnailJobsMixin:
             )
             state = "failed"
         job.finish(state)
-        await self._release_job_memory()
 
     async def _thumbnail_job_body(self, job, options):
         """Plan, then generate in worker batches; returns the final state.
@@ -463,12 +458,8 @@ class ThumbnailJobsMixin:
         or attaches to the running thumbnail job, and streams its frames. A
         legacy hold (the blocking generate or clear) or a record-changing
         job refuses it with the stream's error frame. The job goes on when
-        the client goes away. Refused (409) while the thumbnail folder is
-        unavailable (#320).
+        the client goes away.
         """
-        refused = location_refusal()
-        if refused is not None:
-            return refused
         response = web.StreamResponse(
             status=200,
             headers={

py/api/thumbnail_location.py

@@ -1,160 +0,0 @@
-"""The thumbnail location on the API (#320): startup, the settings payload
-and the refusals while the thumbnail folder is unavailable.
-
-The setting itself is config.json ``thumbnails.location``
-(``preview_location``); the runtime state is ``preview_store``. POST
-``/settings`` never changes it (409 ``location-needs-move``): the Move
-thumbnails job is its only writer.
-"""
-
-import os
-
-from aiohttp import web
-
-from . import preview_location, preview_store
-
-try:
-    from ...utils import library_location
-except ImportError:  # tests import the package top-level
-    from utils import library_location
-
-# The node folder (its web/ is served and a reinstall wipes it).
-NODE_FOLDER = os.path.dirname(
-    os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
-)
-
-
-def default_path():
-    """``<data folder>/data/thumbnails`` (D7B), or None when unknown."""
-    try:
-        return library_location.cache_dir("thumbnails")
-    except Exception:  # no data folder can be decided: no default
-        return None
-
-
-def location_refusal(location=None):
-    """The 409 ``location-unavailable`` response while the thumbnail folder
-    is unavailable, else None (thumbnail generate, convert, clear, prune)."""
-    location = location or preview_store.current()
-    if location.mode != preview_store.FOLDER_MODE or location.available:
-        return None
-    status, text = preview_location.message("location-unavailable")
-    return web.json_response(
-        {"success": False, "code": "location-unavailable", "error": text},
-        status=status,
-    )
-
-
-def needs_move_response():
-    status, text = preview_location.message("location-needs-move")
-    return web.json_response(
-        {"success": False, "code": "location-needs-move", "error": text},
-        status=status,
-    )
-
-
-class ThumbnailLocationMixin:
-    """Startup check and payloads of the thumbnail location."""
-
-    def _all_source_roots(self):
-        """Every image source of every root list: the Images roots, the
-        configured sources and the extra gallery roots (as strings)."""
-        from ..config import GalleryConfig, _extra_gallery_roots
-
-        roots = [str(root) for root in self._get_all_output_dirs()]
-        roots += [str(root) for root in GalleryConfig.MONITORING_DIRECTORIES]
-        roots += list(_extra_gallery_roots())
-        return tuple(dict.fromkeys(root for root in roots if root))
-
-    def _thumbnail_location_context(self):
-        """What a thumbnail folder is validated against (blocking)."""
-        contained = []
-        try:
-            import folder_paths
-
-            for name in (
-                "get_output_directory",
-                "get_input_directory",
-                "get_temp_directory",
-            ):
-                getter = getattr(folder_paths, name, None)
-                folder = getter() if getter is not None else None
-                if folder:
-                    contained.append(str(folder))
-        except ImportError:
-            pass
-        try:
-            contained.append(library_location.config_location()[1])
-        except Exception:  # no data folder can be decided
-            self.logger.debug("No library folder for the thumbnail check")
-        setting = preview_store.setting()
-        return preview_location.Context(
-            roots=self._all_source_roots(),
-            contained=tuple(contained),
-            node_folder=NODE_FOLDER,
-            default_path=default_path(),
-            current_path=(
-                setting.path if setting.mode == preview_store.FOLDER_MODE else None
-            ),
-        )
-
-    def use_preview_location(self):
-        """Put the configured location in force at once, unchecked (the
-        package's import, before any request): folder mode is unavailable
-        until ``start_preview_location`` has checked it, so nothing is ever
-        written to the sources meanwhile. No filesystem access."""
-        from ..config import PromptManagerConfig
-
-        try:
-            return preview_store.configure(
-                PromptManagerConfig.THUMBNAIL_LOCATION, check=False
-            )
-        except Exception:
-            self.logger.warning("The thumbnail location is unusable", exc_info=True)
-            preview_store.mark_invalid()
-            return preview_store.current()
-
-    def start_preview_location(self):
-        """Parse and check the configured location once (startup thread);
-        the probe takes over. Never raises; a check that fails leaves a
-        folder location unavailable (``invalid``), never the sources."""
-        from ..config import PromptManagerConfig
-
-        try:
-            value = PromptManagerConfig.THUMBNAIL_LOCATION
-            parsed = preview_location.parse_location(value)
-            context = None
-            if parsed.mode == preview_store.FOLDER_MODE:
-                context = self._thumbnail_location_context()
-            location = preview_store.configure(value, context=context)
-        except Exception:
-            self.logger.warning("The thumbnail location check failed", exc_info=True)
-            if (
-                preview_location.parse_location(
-                    PromptManagerConfig.THUMBNAIL_LOCATION
-                ).mode
-                == preview_store.FOLDER_MODE
-            ):
-                preview_store.mark_invalid()
-            return preview_store.current()
-        if location.mode == preview_store.FOLDER_MODE and not location.available:
-            self.logger.warning(
-                "The thumbnail folder is unavailable "
-                f"({location.problem or 'checking'}): originals are shown and "
-                "no thumbnails are written until it is back"
-            )
-        return location
-
-    def _thumbnail_location_payload(self, *, with_path):
-        """``{mode, available, problem}`` plus, for the settings GET only,
-        ``path`` and ``default_path`` (D6A)."""
-        location = preview_store.current()
-        payload = {
-            "mode": location.mode,
-            "available": location.available,
-            "problem": location.problem,
-        }
-        if with_path:
-            payload["path"] = location.path
-            payload["default_path"] = default_path()
-        return payload

py/api/thumbnail_settings.py

@@ -114,16 +114,9 @@ def validate_edge(value):
 # ── names ────────────────────────────────────────────────────────────
 
 
-def preview_stem(rel_path):
-    """``<rel without extension>_thumb`` (POSIX): a preview's name inside the
-    store of its source (``preview_store``)."""
-    return f"{Path(rel_path).with_suffix('').as_posix()}{THUMB_SUFFIX}"
-
-
 def thumbnail_stem_rel(rel_path):
-    """``thumbnails/<rel without extension>_thumb`` (POSIX): URL text only.
-    Where the preview is on disk is ``preview_store``'s answer."""
-    return f"thumbnails/{preview_stem(rel_path)}"
+    """``thumbnails/<rel without extension>_thumb`` (POSIX)."""
+    return f"thumbnails/{Path(rel_path).with_suffix('').as_posix()}{THUMB_SUFFIX}"
 
 
 def thumbnail_rel(rel_path, extension=None):
@@ -214,20 +207,9 @@ def owned_in_folder(folder, stem, source_extension, preferred=None):
 
 
 def _owned(root, rel_path, preferred):
-    from . import preview_store
-
     rel_path = Path(rel_path)
-    store = preview_store.store_dir(root)
-    if store is None:
-        return iter(())
-    stem = store / preview_stem(rel_path)
-    found = owned_in_folder(stem.parent, stem.name, rel_path.suffix, preferred)
-    if preview_store.current().mode == preview_store.SOURCE_MODE:
-        return found
-    # Folder mode: timed, so a stalled share marks the folder unreachable,
-    # and only previews no link takes out of the key folder (deletes use it).
-    with preview_store.store_io():
-        return iter([path for path in found if preview_store.may_write(path)])
+    stem = Path(root) / thumbnail_stem_rel(rel_path)
+    return owned_in_folder(stem.parent, stem.name, rel_path.suffix, preferred)
 
 
 def owned_thumbnails(root, rel_path, preferred=None):

py/api/workflow_storage.py

@@ -275,4 +275,3 @@ class WorkflowStorageRoutesMixin:
         job.record_counted("changed", 1)
         job.log_line(line)
         job.update(progress=100, status_line=line)
-        return None

py/config.py

@@ -767,8 +767,6 @@ class PromptManagerConfig:
     THUMBNAIL_QUALITY = 80
     THUMBNAIL_EDGE = 512
     THUMBNAIL_EDGE_RANGE = (128, 2048)
-    # #320 thumbnail location (config.json ``thumbnails.location``), as read.
-    THUMBNAIL_LOCATION = None
 
     @classmethod
     def max_worker_threads(cls) -> int:
@@ -830,12 +828,6 @@ class PromptManagerConfig:
                 "format": cls.THUMBNAIL_FORMAT,
                 "quality": cls.THUMBNAIL_QUALITY,
                 "edge": cls.THUMBNAIL_EDGE,
-                # #320: as read; only the Move thumbnails job writes it.
-                **(
-                    {"location": cls.THUMBNAIL_LOCATION}
-                    if cls.THUMBNAIL_LOCATION is not None
-                    else {}
-                ),
             },
             "gallery": GalleryConfig.get_config(),
             "integrations": IntegrationConfig.get_config(),
@@ -1010,11 +1002,6 @@ class PromptManagerConfig:
         low, high = cls.THUMBNAIL_EDGE_RANGE
         if type(edge) is int and low <= edge <= high:
             cls.THUMBNAIL_EDGE = edge
-        # #320: kept as read (``preview_location.parse_location`` checks it;
-        # a bad value becomes an unavailable ``invalid`` location, never a
-        # silent fall-back to the sources).
-        if "location" in section:
-            cls.THUMBNAIL_LOCATION = section["location"]
 
 
 # Load configuration on import

py/config_store.py

@@ -109,7 +109,6 @@ def _write_atomically(path: str, payload: bytes) -> None:
         try:
             os.unlink(temp_path)
         except OSError:
-            # nothing to clean up; the original error is raised below
             pass
         raise
 

py/lora_manager_layout.py

@@ -642,7 +642,6 @@ def layout_summary(layout: LoraManagerLayout, home: Path) -> Dict:
             relative = Path(settings_file).relative_to(home)
             settings_file = os.path.join("~", str(relative))
         except ValueError:
-            # outside the home folder: show the full path
             pass
     return {
         "source": layout.source,

py/lora_utils.py

@@ -585,7 +585,6 @@ def _read_capped(resp, cap: int) -> Optional[bytes]:
             if int(declared) > cap:
                 return None
         except ValueError:
-            # a bad header says nothing; the read below enforces the cap
             pass
 
     chunks = []
@@ -708,7 +707,6 @@ def _save_atomically(image, local_path: Path) -> None:
         try:
             os.remove(temp)
         except OSError:
-            # nothing to clean up; the original error is raised below
             pass
         raise
 

pyproject.toml

@@ -1,7 +1,7 @@
 [project]
 name = "promptmanager"
 description = "A powerful ComfyUI custom node that extends the standard text encoder with persistent prompt storage, advanced search capabilities, and an automatic image gallery system using SQLite."
-version = "3.4.1"
+version = "3.3.1"
 license = {file = "LICENSE"}
 requires-python = ">=3.12"
 dependencies = ["watchdog>=2.1.0", "Pillow>=8.0.0"]

requirements.txt

@@ -1,4 +1,4 @@
 # Runtime dependencies for PromptManager.
 # aiohttp, numpy and torch come from ComfyUI itself and are not listed here.
-watchdog>=2.1.0               # Output directory monitoring
+watchdog>=2.1.0              # Output directory monitoring
 Pillow>=8.0.0                # Image metadata extraction and thumbnails

tests/browser/activity-concept.spec.mjs

@@ -6,6 +6,7 @@ import { THEMES, seedConcept, openConcept, openProduction, diffInventory, mutate
 // app.js 1428–1432) and its backup box with the concept's System `.notice`; the differences are D55. The job view
 // has no concept counterpart: it is compared with the approved mockup `activity-scan.html` (a local, ignored file),
 // whose structure and CSS values are restated below (D56). Each comparison is shown to notice a mutation.
+const workspace = '/prompt_manager/workspace';
 
 test.beforeEach(async ({ page, request, browserName }) => {
     await startCoverage(page, browserName);

tests/browser/classic-node.spec.mjs

@@ -7,7 +7,7 @@ test.beforeEach(async ({page, browserName}) => {
     page.classicErrors = [];
     page.on('pageerror', error => page.classicErrors.push(error.message));
     await page.route('**/scripts/app.js', route => route.fulfill({contentType:'text/javascript', body:'export const app = window.fixtureApp;'}));
-    await page.route('**/scripts/api.js', route => route.fulfill({contentType:'text/javascript', body:'export const api = {fileURL: path => (window.fixtureApiBase ?? "") + path, queuePrompt: async (...args) => args};'}));
+    await page.route('**/scripts/api.js', route => route.fulfill({contentType:'text/javascript', body:'export const api = {fileURL: path => path, queuePrompt: async (...args) => args};'}));
     await page.route('**/extensions/promptmanager/prompt_manager.js', route => route.fulfill({contentType:'text/javascript', body:readFileSync(new URL('../../web/comfy/prompt_manager.js', import.meta.url),'utf8')}));
     await page.goto('/prompt_manager/test');
     await page.evaluate(() => {
@@ -64,28 +64,6 @@ test('Classic keeps immediate selection, search query and metadata serialization
     await expect(page.getByRole('button',{name:'🌐 Web UI',exact:true})).toBeVisible();
 });
 
-test('Classic Web UI opens the workspace Library in the saved display mode, through the mount prefix (#525)',async({page})=>{
-    await page.evaluate(()=>{window.fixtureApiBase='/mounted';window.open=(...args)=>{window.openArgs=args;return {};};});
-    const webUi=page.getByRole('button',{name:'🌐 Web UI',exact:true});
-    for (const [mode,args] of [
-        ['newtab',['/mounted/prompt_manager/workspace#/library','_blank']],
-        ['popup',['/mounted/prompt_manager/workspace#/library','_blank','width=1200,height=800,scrollbars=yes,resizable=yes']],
-    ]) {
-        await page.evaluate(value=>{node.properties.webuiDisplayMode=value;},mode);
-        await webUi.click();
-        expect(await page.evaluate(()=>window.openArgs)).toEqual(args);
-    }
-});
-
-test('Classic Web UI reports a blocked popup and keeps the canvas open (#525)',async({page})=>{
-    const before=page.url();
-    await page.evaluate(()=>{window.open=()=>null;});
-    await page.getByRole('button',{name:'🌐 Web UI',exact:true}).click();
-    await expect(page.getByText('Allow popups to open Web UI, then try again.')).toBeVisible();
-    expect(page.url()).toBe(before);
-    await expect(page.locator('.pm-classic')).toBeVisible();
-});
-
 test('Classic detaches native text synchronization on removal',async({page})=>{
     // The page installs the text sync (serializeValue and its listeners) in a 50 ms timer; wait for it, not for time.
     await expect.poll(()=>page.evaluate(()=>typeof node.widgets.find(item=>item.name==='text').serializeValue)).toBe('function');

tests/browser/concept-inventory.mjs

@@ -111,23 +111,9 @@ async function selectTheme(page,theme) {
 }
 
 /** The concept at `#<route>` with its own Theme select. */
-/**
- * The recorded layout deviations (#530), applied to the opened concept page and never to its files, so every box that
- * follows from them (wider columns, wrapped text, row heights) is compared rather than excused path by path.
- * Every other measurement still differs if production moves. workspace-layout-tags-system.spec.mjs pins the real values
- * and that the concept itself still has the old ones.
- * D182: the second `.two-col` card starts level, and a surface after a row is 18px below it. D184: no 1000px limit on System. D183: the sticky tag header's background and drawn line.
- */
-export const CONCEPT_LAYOUT_DEVIATIONS=`.two-col > .surface + .surface { margin-top: 0; }
-.two-col + .surface { margin-top: 18px; }
-.settings-layout { max-width: none; }
-.two-col > .surface > .table-wrap thead th { background: var(--ca-surface); border-bottom-color: transparent; }`;
-export const mapConceptLayout=page=>page.addStyleTag({content:CONCEPT_LAYOUT_DEVIATIONS});
-
 export async function openConcept(page,route,theme,motion='no-preference') {
     await page.emulateMedia({reducedMotion:motion});
     await page.goto('about:blank');await page.goto(`${CONCEPT_URL}#${route}`);
-    await mapConceptLayout(page);
     await selectTheme(page,theme);
     await expect(page.locator('#main #page-title')).toBeVisible();
 }
@@ -435,8 +421,7 @@ export function measureInventory(scope) {
             description:when(description,()=>({className:description.className,text:description.textContent,...font(description),...edges(description)})),
             actions:when(actions,()=>({...layout(actions),...edges(actions),
                 fullWidth:px(rect(actions).width)===px(rect(heading).width),stacked:copy?rect(actions).top>=rect(copy).bottom-0.5:null,
-                // D163: a closed menu's items are not heading actions.
-                buttons:[...actions.querySelectorAll('button')].filter(node=>!node.closest('[role="menu"]')).map(node=>({text:node.textContent.trim(),primary:node.classList.contains('ca-primary'),
+                buttons:[...actions.querySelectorAll('button')].map(node=>({text:node.textContent.trim(),primary:node.classList.contains('ca-primary'),
                     ...font(node),...edges(node),minHeight:getComputedStyle(node).minHeight,height:px(rect(node).height)}))}))};
     }
     // ---- Images (#249 C7). Every box is relative to its section, every section to `main` (vertical rhythm). ----

tests/browser/fixtures.mjs

@@ -8,9 +8,6 @@
 // browser that exits abnormally prints one `pm-browser-exit|` line, and a test
 // that fails on a closed or crashed target gets that log attached as
 // `browser-stderr`.
-// The one-time older-images notice (#527) shows above every workspace page and as
-// a modal on the admin page until dismissed, so every context starts with it
-// dismissed. A spec about the notice sets `test.use({ olderImagesNotice: true })`.
 import { test as base, expect } from '../../tools/vendor/node_modules/@playwright/test/index.mjs';
 import { attachServerStderr, createServerSupervisor, startBrowserServer } from '../../tools/vendor/start-browser-server.mjs';
 import { attachBrowserLogs, createBrowserLogRecorder } from '../../tools/vendor/browser-logs.mjs';
@@ -47,11 +44,6 @@ export const test = base.extend({
         if (crash) throw crash;
     }, { auto: true, timeout: SERVER_FIXTURE_TIMEOUT_MS }],
     baseURL: async ({ workerServer }, use) => use(workerServer.url),
-    olderImagesNotice: [false, { option: true }],
-    storageState: async ({ baseURL, olderImagesNotice }, use) => use(olderImagesNotice ? undefined : {
-        cookies: [],
-        origins: [{ origin: new URL(baseURL).origin, localStorage: [{ name: 'pm_update_notice_dismissed', value: '3.2.0' }] }],
-    }),
 });
 
 export { expect };

tests/browser/focused-node.spec.mjs

@@ -485,7 +485,7 @@ test(`${variant} respects the existing Web UI display preference`,async({page})=
     });
     await page.evaluate(()=>node._focusedSettingsReady);
     await page.getByRole('button',{name:'Web UI ↗',exact:true}).click();
-    expect(await page.evaluate(()=>window.openArgs)).toEqual(['/prompt_manager/workspace#/library','_blank']);
+    expect(await page.evaluate(()=>window.openArgs)).toEqual(['/prompt_manager/web','_blank']);
 });
 
 test(`${variant} reports blocked Web UI popups without leaving the workflow`,async({page})=>{

tests/browser/full-inspector.spec.mjs

@@ -362,14 +362,10 @@ test('Show in folder asks the server to open the listed file and announces each
     const body=sent.postDataJSON();
     expect(Object.keys(body).sort()).toEqual(['path','root_index','root_scope']);
     expect(body).toMatchObject({root_index:0,path:'inspector/complete.png'});expect(body.root_scope).toMatch(/^[0-9a-f]{64}$/);
-    await expect(toast).toHaveText('Opened the folder on the computer running ComfyUI.');
-    // #533: the answer is really on screen and reachable above the modal viewer, not covered by it.
-    await expect(toast).toBeVisible();
-    expect(await toast.evaluate(node=>{const box=node.getBoundingClientRect();const top=document.elementFromPoint(box.x+box.width/2,box.y+box.height/2);return top===node;})).toBe(true);
-    await expect(page.locator('#viewer-dialog').getByRole('status').filter({hasText:'Opened the folder on the computer running ComfyUI.'})).toHaveCount(1);
+    await expect(toast).toHaveText('Opened the folder on this computer.');
     const opened=async()=>(await (await request.get('/__test__/reveal')).json()).opened;
     expect(await opened()).toEqual(['output/inspector/complete.png']);
-    for (const [outcome,message] of [['unavailable','No file manager is available on the computer running ComfyUI.'],['fail','The folder could not be opened. Try again.']]) {
+    for (const [outcome,message] of [['unavailable','No file manager is available on this computer.'],['fail','The folder could not be opened. Try again.']]) {
         await expect(await request.post('/__test__/reveal',{data:{outcome}})).toBeOK();
         await show.click();await expect(toast).toHaveText(message);
     }
@@ -377,56 +373,11 @@ test('Show in folder asks the server to open the listed file and announces each
     await page.route('**/prompt_manager/images/reveal',route=>route.fulfill({status:429,contentType:'application/json',body:JSON.stringify({success:false,code:'busy',error:'The folder is already opening.'})}));
     await show.click();await expect(toast).toHaveText('The folder is already opening.');
     await page.unroute('**/prompt_manager/images/reveal');
-    // A proxied click opens the folder: the proxy's headers, not the browser's address, name the page (#533).
+    // A proxied request counts as remote, so the real route answers 403 not-local.
     await expect(await request.post('/__test__/reveal',{data:{outcome:'opened'}})).toBeOK();
     await page.route('**/prompt_manager/images/reveal',route=>route.continue({headers:{...route.request().headers(),'x-forwarded-for':'203.0.113.7'}}));
-    await show.click();await expect(toast).toHaveText('Opened the folder on the computer running ComfyUI.');
-    expect(await opened()).toHaveLength(2);
-    await page.unroute('**/prompt_manager/images/reveal');
-    // A plain cross-site POST is refused, and the toast says so.
-    // Chromium keeps its own Origin on a routed fetch, so the real route is asked directly and the toast gets its answer.
-    const refused=await request.post('/prompt_manager/images/reveal',{data:body,headers:{origin:'https://evil.example'}});
-    expect(refused.status()).toBe(403);expect((await refused.json()).code).toBe('not-same-origin');
-    await page.route('**/prompt_manager/images/reveal',route=>route.fulfill({status:403,contentType:'application/json',body:JSON.stringify({success:false,code:'not-same-origin',error:"This page's address does not match the server's."})}));
-    await show.click();await expect(toast).toHaveText("The folder was not opened: this page's address does not match the server's.");
-    await expect(toast).toBeVisible();
-    expect(await opened()).toHaveLength(2);
-    // #533: closing the viewer takes the toast back to the page, still showing the message.
-    await page.keyboard.press('Escape');await expect(page.locator('#viewer-dialog')).toHaveCount(0);
-    await expect(toast).toBeVisible();await expect(page.locator('body > #workspace-toast')).toHaveCount(1);
-});
-// #533 D176: real modals in the real top layer, with the page's own toast module.
-test('a toast stays on screen across nested, switched and closing modals',async({page,request})=>{
-    await fullFixture(page,request);
-    await page.evaluate(async()=>{
-        const url=performance.getEntriesByType('resource').map(entry=>entry.name).find(name=>name.includes('/toast.mjs'));
-        const {showWorkspaceToast}=await import(url);
-        window.say=showWorkspaceToast;
-        window.modal=(id,first=false)=>{const dialog=document.createElement('dialog');dialog.id=id;dialog.textContent=id;document.body[first?'prepend':'append'](dialog);dialog.showModal();return dialog;};
-        window.onTop=()=>{const node=document.getElementById('workspace-toast');const box=node.getBoundingClientRect();return box.width>0&&document.elementFromPoint(box.x+box.width/2,box.y+box.height/2)===node;};
-    });
-    const parent=()=>page.evaluate(()=>{const host=document.getElementById('workspace-toast')?.parentElement;return host?host.id||host.localName:null;});
-    const onTop=()=>page.evaluate(()=>window.onTop());
-    await page.evaluate(()=>{window.modal('a');say('one');});
-    expect(await parent()).toBe('a');expect(await onTop()).toBe(true);
-    // Nested: the top one holds it, even earlier in the page than the one under it.
-    await page.evaluate(()=>{window.modal('b',true);say('two');});
-    expect(await parent()).toBe('b');expect(await onTop()).toBe(true);
-    // The top one closes while the toast shows: the message stays, in the modal now on top.
-    await page.evaluate(()=>document.getElementById('b').close());
-    await expect.poll(parent).toBe('a');expect(await onTop()).toBe(true);
-    await expect(page.locator('#workspace-toast')).toHaveText('two');
-    // Switched: the next modal takes the next toast.
-    await page.evaluate(()=>{document.getElementById('a').close();window.modal('c');say('three');});
-    expect(await parent()).toBe('c');expect(await onTop()).toBe(true);
-    // Closed and removed at once, as the workspace's dialogs do: home, still showing.
-    await page.evaluate(()=>{const c=document.getElementById('c');c.close();c.remove();});
-    await expect.poll(parent).toBe('body');expect(await onTop()).toBe(true);
-    await expect(page.locator('#workspace-toast')).toHaveText('three');
-    // Removed while open, with no close event: the next message still shows.
-    await page.evaluate(()=>{window.modal('d');say('four');document.getElementById('d').remove();say('five');});
-    expect(await parent()).toBe('body');expect(await onTop()).toBe(true);
-    await expect(page.locator('#workspace-toast')).toHaveText('five');
+    await show.click();await expect(toast).toHaveText('Show in folder works only in a browser on the computer running ComfyUI.');
+    expect(await opened()).toEqual(['output/inspector/complete.png']);
 });
 test('full inspector shows six facts and scoped provenance',async({page,request},testInfo)=>{
     await page.setViewportSize({width:1600,height:1100});await fullFixture(page,request);const panel=inspector(page);
@@ -464,7 +415,7 @@ test('full inspector preserves long role text and exact sends',async({page,reque
         await fullFixture(page,request);const panel=inspector(page);const positive=panel.locator('.prompt-section.positive .prompt-text');await expect(positive).toContainText('猫 😀');const text=await positive.textContent();expect(text.length).toBeGreaterThan(1000);
         await panel.locator('.detail-footer button.send').click();const sender=page.getByRole('dialog',{name:'Send to ComfyUI',exact:true});
         await expect(sender.getByRole('combobox',{name:'ComfyUI window',exact:true}).locator('option')).toContainText(['Exact host']);
-        await sender.getByRole('combobox',{name:'ComfyUI window',exact:true}).selectOption({label:'Exact host'});await sender.getByRole('combobox',{name:'Destination node',exact:true}).selectOption({label:'#pair Exact pair'});
+        await sender.getByRole('combobox',{name:'ComfyUI window',exact:true}).selectOption({label:'Exact host'});await sender.getByRole('combobox',{name:'Destination node',exact:true}).selectOption({label:'Exact pair'});
         await sender.getByRole('button',{name:'Preview changes',exact:true}).click();await sender.getByRole('button',{name:'Apply to ComfyUI',exact:true}).click();await expect(sender).toContainText('Sent to ComfyUI.');
         expect(await host.evaluate(()=>window.sent)).toEqual([{positive:text,negative:'blurred edges, watermark'}]);
     } finally {await host.evaluate(()=>window.bridge.dispose());await host.close();}
@@ -676,10 +627,6 @@ test('viewer matches the concept shell and toolbar order',async({page,request})=
         expect(modePaths.map(path=>path.split(' > ').slice(2).join(' > '))).toEqual(['button#viewer-mode.icon-btn','button#viewer-mode.icon-btn > svg.icon','button#viewer-mode.icon-btn > svg.icon > path']);
         expect(production.paths[production.paths.indexOf(modePaths[2])+1]).toBe('dialog#viewer-dialog > div.dialog-header > button#viewer-close');
         production.paths=production.paths.filter(path=>!modePaths.includes(path));
-        // #532 D170: production's shortcuts button sits right before the view switch; the concept has none.
-        const keysPaths=production.paths.filter(path=>path.includes('button#viewer-keys'));
-        expect(keysPaths.map(path=>path.split(' > ').slice(2).join(' > '))).toEqual(['button#viewer-keys.icon-btn','button#viewer-keys.icon-btn > svg.icon','button#viewer-keys.icon-btn > svg.icon > path']);
-        production.paths=production.paths.filter(path=>!keysPaths.includes(path));
         // #480 D159: the Images viewer's Delete… (`danger`) follows Download; the concept has none.
         expect(production.toolbar[8].text).toBe('Delete…');
         production.toolbar.splice(8,1);

tests/browser/history-canonical-comparison.mjs

@@ -107,7 +107,7 @@ export async function exerciseCurrentPairSend(page, roles) {
         const send = viewer.getByRole('button', { name: /^Send prompt pair to ComfyUI: / });await send.click();
         const sender = page.getByRole('dialog', { name: 'Send to ComfyUI', exact: true });await expect(sender).toBeVisible();
         await sender.getByRole('combobox', { name: 'ComfyUI window', exact: true }).selectOption({ label: 'Canonical ComfyUI' });
-        await sender.getByRole('combobox', { name: 'Destination node', exact: true }).selectOption({ label: '#canonical-pair Canonical destination' });
+        await sender.getByRole('combobox', { name: 'Destination node', exact: true }).selectOption({ label: 'Canonical destination' });
         await sender.getByRole('button', { name: 'Preview changes', exact: true }).click();
         await expect(sender).toContainText(roles.positive);await expect(sender).toContainText(roles.negative);
         await sender.getByRole('button', { name: 'Apply to ComfyUI', exact: true }).click();await expect(sender).toContainText('Sent to ComfyUI.');

tests/browser/history-concept.spec.mjs

@@ -26,8 +26,7 @@ const SECTIONS=['heading','history','noPageScroll'];
  */
 export function mapHistoryConcept(reference) {
     const {history}=reference.oracle;
-    // D163 (#512): the heading as laid out with the More menu button (the oracle's heading).
-    return {...reference,heading:reference.oracle.heading,history:{...history,
+    return {...reference,history:{...history,
         // D24: "N tracked runs" is the recorded window's `recorded_run_count`; the fixture records one run per image, so
         // the concept's "4 tracked runs" holds by construction (asserted on both documents below).
         summary:history.summary,
@@ -121,14 +120,11 @@ async function conceptAsRecorded(page) {
         const add=[...document.querySelectorAll('.timeline-panel .row-actions > button')].find(node=>node.textContent==='+ Add negative');
         const archived=add.cloneNode(false);archived.removeAttribute('data-action');archived.removeAttribute('data-prompt');
         archived.setAttribute('aria-pressed','false');archived.textContent=label;add.after(archived);
-        // D163 (#512): the heading ends with the "⋯" More menu button, drawn as the concept's Edit metadata button.
-        const edit=[...document.querySelectorAll('#main > .heading .heading-actions > button')].find(node=>node.textContent.trim()==='Edit metadata');
-        const moreButton=edit.cloneNode(false);moreButton.removeAttribute('data-action');moreButton.textContent='⋯';edit.parentElement.append(moreButton);
-        window.__historyOracle={timeline,order:[...lanes].reverse(),texts,archived,moreButton};
+        window.__historyOracle={timeline,order:[...lanes].reverse(),texts,archived};
     },SHOW_ARCHIVED);
     await settle(page);
     return ()=>page.evaluate(()=>{
-        const {timeline,order,texts,archived,moreButton}=window.__historyOracle;moreButton.remove();
+        const {timeline,order,texts,archived}=window.__historyOracle;
         order.forEach((lane,index)=>{lane.style.setProperty('--lane-offset',`${38+index*47}px`);timeline.append(lane);});
         for(const [span,text] of texts)span.textContent=text;
         archived.remove();delete window.__historyOracle;
@@ -194,7 +190,7 @@ function productionSent(host) {
     return async page=>{
         const sender=page.getByRole('dialog',{name:'Send to ComfyUI',exact:true});
         await sender.getByRole('combobox',{name:'ComfyUI window',exact:true}).selectOption({label:'Concept ComfyUI'});
-        await sender.getByRole('combobox',{name:'Destination node',exact:true}).selectOption({label:'#pair-1 Concept destination'});
+        await sender.getByRole('combobox',{name:'Destination node',exact:true}).selectOption({label:'Concept destination'});
         await sender.getByRole('button',{name:'Preview changes',exact:true}).click();
         await expect.poll(()=>host.evaluate(()=>window.previewed.length)).toBe(1);
         const roles=await host.evaluate(()=>window.previewed.pop());

tests/browser/images-concept.spec.mjs

@@ -474,10 +474,7 @@ for(const [width,height] of SIZES)for(const theme of THEMES)test(`images selecti
     expect.soft(actual.bulkbar.bar.items.map(item=>item.text),'production bar').toEqual(['1 selected','Add tags','Auto-tag selected',
         'Set category','Add to collection','Export metadata','Delete…','Clear']);
     expect.soft(compare(empty,emptyActual,manifest,['bulkbar','cards','panel']),'nothing checked').toEqual([]);
-    // D186: the panel's sticky offset clears the shown bar; at one column the bar is one sideways row (its items are checked above).
-    const stuckPanel={...oracle,panel:{...oracle.panel,...(width<=700?{top:actual.panel.top}:{}),box:{...oracle.panel.box,top:actual.panel.box.top}}};
-    expect(parseFloat(actual.panel.box.top)).toBeGreaterThanOrEqual(20);
-    expect.soft(compare(stuckPanel,actual,manifest,width<=700?['panel']:['bulkbar','cards','panel']),'one card checked').toEqual([]);
+    expect.soft(compare(oracle,actual,manifest,['bulkbar','cards','panel']),'one card checked').toEqual([]);
     // The bar comparison notices a change to the production bar.
     await mutate(page,{css:'.bulkbar { padding: 4px }'});
     expect(compare(oracle,await inventoryOf(page,'#workspace-main'),manifest,['bulkbar']).map(item=>item.path)).toContain('bulkbar.bar.paddingTop');

tests/browser/images-removed-concept.spec.mjs

@@ -1,65 +0,0 @@
-import {test,expect} from './fixtures.mjs';
-import {seedConceptAt,openConcept,openProduction} from './concept-inventory.mjs';
-
-// #498 (D162): the concept has no Show removed images screen, so production builds it from the concept's own parts:
-// the heading action button (as the concept's Images heading button), the card's `.chip` (as a concept card chip) and
-// the selection bar's buttons (as the concept bar's plain buttons). Each is compared with its concept counterpart.
-test.use({locale:'en-US',timezoneId:'UTC'});
-
-const CARDS='.gallery-body > .image-grid > .media-card';
-const KEYS=['color','backgroundColor','borderTopColor','borderTopWidth','fontSize','fontWeight','paddingTop','paddingLeft',
-    'borderTopLeftRadius','height'];
-const CHIP_KEYS=['color','backgroundColor','borderTopColor','fontSize','fontWeight','paddingTop','paddingLeft',
-    'borderTopLeftRadius'];
-
-/** Runs in the page: the computed style of the first node `selector` matches. */
-function styleOf([selector,keys]) {
-    const node=document.querySelector(selector);
-    return node?Object.fromEntries(keys.map(key=>[key,getComputedStyle(node)[key]])):null;
-}
-
-async function measure(page,selectors) {
-    const found={};
-    for (const [name,selector,keys] of selectors) found[name]=await page.evaluate(styleOf,[selector,keys]);
-    return found;
-}
-
-test.beforeEach(async({page,request})=>{await seedConceptAt(page,request);});
-
-for (const theme of ['dark','light']) {
-    test(`Show removed images uses the concept's heading button, chip and bar buttons (${theme})`,async({page})=>{
-        await page.setViewportSize({width:1600,height:1100});
-        await openConcept(page,'images',theme);
-        await page.locator(CARDS).first().locator('.image-overlays > label > input[type="checkbox"]').check();
-        await page.mouse.move(0,0);
-        const reference=await measure(page,[
-            ['heading','#main .heading-actions > button:not(.ca-primary)',KEYS],
-            ['chip','#main .chip',CHIP_KEYS],
-            ['bar','#main #bulkbar > .bulkbar > button:not(.danger)',KEYS],
-        ]);
-
-        await openProduction(page,'images',theme);
-        await expect(page.locator(CARDS).first()).toBeVisible();
-        await page.locator(CARDS).first().locator('.image-overlays > label > input[type="checkbox"]').check();
-        await page.locator('#workspace-main #bulkbar').getByRole('button',{name:'Delete…',exact:true}).click();
-        const dialog=page.locator('dialog#modal[open]');
-        await dialog.getByRole('radio',{name:/^Remove from the library only/}).check();
-        await dialog.locator('.dialog-actions button.danger').click();
-        const toggle=page.locator('.heading-actions').getByRole('button',{name:/^Show removed images \(1\)$/});
-        await expect(toggle).toBeVisible();
-        await page.mouse.move(0,0);
-        const heading=await measure(page,[['heading','#workspace-main .heading-actions > button[aria-pressed]',KEYS]]);
-        await toggle.click();
-        await expect(page.locator(`${CARDS} .chip`,{hasText:'Removed'})).toBeVisible();
-        await page.locator(CARDS).first().locator('.image-overlays > label > input[type="checkbox"]').check();
-        await expect(page.locator('#workspace-main #bulkbar').getByRole('button',{name:'Return to library'})).toBeVisible();
-        await page.mouse.move(0,0);
-        const actual={...heading,...await measure(page,[
-            ['chip',`${CARDS} .media-info .chip`,CHIP_KEYS],
-            ['bar','#workspace-main #bulkbar > .bulkbar > button',KEYS],
-        ])};
-        // Every part was found on both sides: two missing nodes must never compare equal.
-        expect(Object.values(reference).every(Boolean)).toBe(true);
-        expect(actual).toEqual(reference);
-    });
-}

tests/browser/inspector-concept.spec.mjs

@@ -259,7 +259,7 @@ async function productionSendOf(page,context) {
         const sender=page.getByRole('dialog',{name:'Send to ComfyUI',exact:true});await expect(sender).toBeVisible();
         const windows=sender.getByRole('combobox',{name:'ComfyUI window',exact:true});
         await expect(windows.locator('option')).toContainText(['Test ComfyUI']);await windows.selectOption({label:'Test ComfyUI'});
-        await sender.getByRole('combobox',{name:'Destination node',exact:true}).selectOption({label:'#pair-1 My prompt pair'});
+        await sender.getByRole('combobox',{name:'Destination node',exact:true}).selectOption({label:'My prompt pair'});
         await sender.getByRole('button',{name:'Preview changes',exact:true}).click();
         await sender.getByRole('button',{name:'Apply to ComfyUI',exact:true}).click();
         await expect(sender).toContainText('Sent to ComfyUI.');

tests/browser/job-end.mjs

@@ -1,13 +0,0 @@
-// A job's end toast follows the job, which has no time limit: under load it outlasts the 5 s expect default (#533, as
-// #520). Do `action`, whose POST to `url` answers with the job it started, then wait for that job's event stream to end.
-export const APPLY_URL = '/prompt_manager/maintenance/apply';
-export const RETURN_URL = '/prompt_manager/images/removed/return';
-
-export async function startAndAwaitJob(page, action, url = APPLY_URL) {
-    const applied = page.waitForResponse(response => response.url().endsWith(url));
-    await action();
-    const { job } = await (await applied).json();
-    const events = await page.request.get(`/prompt_manager/jobs/${job.id}/events`);
-    if (!events.ok()) throw new Error(`Job ${job.id} events answered ${events.status()}`);
-    return job;
-}

tests/browser/library-concept.spec.mjs

@@ -233,7 +233,7 @@ function productionSent(host) {
     return async page=>{
         const sender=page.getByRole('dialog',{name:'Send to ComfyUI',exact:true});
         await sender.getByRole('combobox',{name:'ComfyUI window',exact:true}).selectOption({label:'Concept ComfyUI'});
-        await sender.getByRole('combobox',{name:'Destination node',exact:true}).selectOption({label:'#pair-1 Concept destination'});
+        await sender.getByRole('combobox',{name:'Destination node',exact:true}).selectOption({label:'Concept destination'});
         await sender.getByRole('button',{name:'Preview changes',exact:true}).click();
         await expect.poll(()=>host.evaluate(()=>window.previewed.length)).toBe(1);
         const roles=await host.evaluate(()=>window.previewed.pop());
@@ -374,9 +374,7 @@ for(const [width,height] of SIZES)for(const theme of THEMES)test(`the Library se
     await captureCanonicalState(page,testInfo,`production-library-selection-${width}-${theme}`);
     await testInfo.attach('library-selection',{body:JSON.stringify({reference,actual},null,2),contentType:'application/json'});
     expect(reference.bar.buttons.map(button=>button.text),'the concept bar has every Library action').toEqual(['Add tags','Set category','Clear']);
-    // D186: at one column the bar is one row that scrolls sideways, with the same buttons.
-    const mapped=width<=700?{...reference,bar:{...reference.bar,flexWrap:'nowrap',buttons:reference.bar.buttons.map((button,index)=>({...button,left:actual.bar.buttons[index].left,top:actual.bar.buttons[index].top}))}}:reference;
-    expect(actual).toEqual(mapped);
+    expect(actual).toEqual(reference);
     // The comparison notices a moved checkbox (spec §7 mutation check).
     await mutate(page,{css:'.prompt-card .image-overlays { inset: 20px 9px auto }'});
     expect((await measureSelection(page,{card:CARDS,main:'#workspace-main'})).overlay.top).not.toBe(reference.overlay.top);