fix(nodes): hide the editor's native widgets through one helper (#90 )

The Save to library switch copied the text fallbacks' zero-height computeSize arrow, and neither copy was ever called, so focused-node.js function coverage fell to 87.5 (floor 90). One hideNativeWidget helper now hides both, and the spec checks that the hidden switch and a text fallback take no node height.
Merge remote-tracking branch 'origin/main' into feat/90-save-to-library
2026-10-28 10:36:17 -07:00 · 2026-10-28 10:06:13 -07:00 · 2026-10-28 16:37:24 +00:00 · 2026-10-28 16:00:15 +00:00 · 2026-10-28 08:43:53 -07:00 · 2026-10-28 15:29:41 +00:00
385 changed files with 71215 additions and 7844 deletions
@@ -1,22 +1,12 @@
 {
  "required_status_checks": {
-    "strict": true,
+    "strict": false,
    "contexts": [
-      "py3.10 on ubuntu-latest",
-      "py3.11 on ubuntu-latest",
      "py3.12 on ubuntu-latest",
-      "py3.13 on ubuntu-latest",
-      "py3.10 on windows-latest",
-      "py3.11 on windows-latest",
-      "py3.12 on windows-latest",
-      "py3.13 on windows-latest",
-      "py3.10 on macos-latest",
-      "py3.11 on macos-latest",
-      "py3.12 on macos-latest",
-      "py3.13 on macos-latest",
      "coverage gate (85%)",
      "black and flake8",
      "frontend modules",
+      "all tests",
      "viewerjs",
      "real ComfyUI compatibility",
      "bandit (high severity)"
@@ -4,6 +4,7 @@ permissions:
  contents: read

 on:
+  merge_group:
  push:
    branches: [main]
  pull_request:
@@ -19,14 +20,17 @@ jobs:
  security:
    name: bandit (high severity)
    runs-on: ubuntu-latest
+    # ceil(1.5 x slowest of three green main runs) + 3, never under 5 (test.yml): runs 40257217665,
+    # 40254137380, 40240706583 took 23s / 16s / 23s -> 5 min.
+    timeout-minutes: 5

    steps:
      - uses: actions/checkout@v7

-      - name: Set up Python 3.10
+      - name: Set up Python 3.12
        uses: actions/setup-python@v7
        with:
-          python-version: "3.10"
+          python-version: "3.12"

      - name: Install bandit
        run: pip install bandit[toml]
@@ -0,0 +1,55 @@
+name: Windows and macOS
+
+permissions:
+  contents: read
+
+# Non-blocking portability runs (#420): never on pull requests or in the merge queue, and no context
+# here is a required check. A red run is fixed at its cause before the workspace cutover (#334).
+on:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "17 3 * * *"
+  workflow_dispatch:
+
+# Every run gets its own group (run_id), so no main commit's run is ever cancelled or dropped as pending.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.run_id }}
+  cancel-in-progress: false
+
+env:
+  PYTHONFAULTHANDLER: "1"
+
+# Time limit rule as in test.yml: ceil(1.5 x the slowest of three recent green runs on main) + 3
+# minutes, never under 5. Measured 2026-10-26 in test.yml on runs 40257217681 (3be0ada),
+# 40240706568 (fb9134f), 40228167328 (f9835aa), before these legs moved here in #420:
+#   slowest py3.10 on windows-latest: 12m43s / 15m54s / 14m53s -> 27 min
+#     (macos 6m14s-8m30s, windows 11m42s-15m54s)
+jobs:
+  test:
+    name: py${{ matrix.python-version }} on ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 27
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-latest, macos-latest]
+        python-version: ["3.12", "3.13", "3.14"]
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v7
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+          cache-dependency-path: requirements-dev.txt
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements-dev.txt
+
+      - name: Run tests
+        run: python -m tests.run_suite -v
@@ -4,6 +4,7 @@ permissions:
  contents: read

 on:
+  merge_group:
  pull_request:
    branches: [main]
  push:
@@ -19,15 +20,36 @@ concurrency:
 env:
  PYTHONFAULTHANDLER: "1"

+# Every job has a time limit: ceil(1.5 x the slowest of three recent green runs on main) + 3
+# minutes, never under 5. The 3 minutes leave room for the Python runner's watchdog (120 s, see
+# tests/run_suite.py) to print its stack dump before GitHub cancels the job. A limit changes only
+# with new measurements written here (TESTING.md "Time limits and hangs").
+# Measured 2026-10-26 on runs 40257217681 (3be0ada), 40240706568 (fb9134f), 40228167328 (f9835aa):
+#   py matrix, slowest py3.10 on windows-latest: 12m43s / 15m54s / 14m53s -> 27 min
+#     (ubuntu 5m27s-6m27s, macos 6m14s-8m30s, windows 11m42s-15m54s)
+#     3.10 and 3.11 left the matrix and 3.14 joined it in #356; re-measure after three green main runs.
+#     Windows and macOS moved to portability.yml (#420), which keeps this 27-minute limit; this
+#     Linux-only matrix keeps it too until it is re-measured.
+#   real ComfyUI compatibility: 13m32s / 8m55s / 11m46s -> 24 min
+#   coverage gate (85%): 7m26s / 7m22s / 7m54s -> 15 min
+#   perf budget 30s / 29s / 27s, black and flake8 39s / 37s / 39s,
+#   frontend modules 23s / 19s / 29s -> 5 min (the floor)
+#   all tests: a result check without setup, 5 min (the floor)
+#
+# Pull requests run a fast subset (#420): Python 3.12 on ubuntu-latest, coverage, lint and frontend
+# modules. The merge queue (merge_group), pushes to main and manual runs add Python 3.13 and 3.14 on
+# Linux and the real ComfyUI job. "all tests" is the required gate that holds the queue to that set.
+# Windows and macOS run in portability.yml (push to main, nightly, on demand) and never gate a merge.
 jobs:
  test:
    name: py${{ matrix.python-version }} on ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
+    timeout-minutes: 27
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
-        python-version: ["3.10", "3.11", "3.12", "3.13"]
+        os: [ubuntu-latest]
+        python-version: ${{ github.event_name == 'pull_request' && fromJSON('["3.12"]') || fromJSON('["3.12", "3.13", "3.14"]') }}

    steps:
      - uses: actions/checkout@v7
@@ -45,21 +67,26 @@ jobs:
          pip install -r requirements-dev.txt

      - name: Run tests
-        run: python -m unittest discover -s tests -v
+        run: python -m tests.run_suite -v

  comfyui:
    name: real ComfyUI compatibility
+    # Merge queue, main and manual runs only. A job skipped by its condition reports Success, so this
+    # required context never blocks a pull request; "all tests" fails if it is skipped anywhere else.
+    if: github.event_name != 'pull_request'
    runs-on: ubuntu-latest
-    timeout-minutes: 25
+    # Chromium and its system libraries come from the pinned Playwright image (tag = @playwright/test in
+    # tools/vendor/package-lock.json; tests/vendor/browser-image.test.mjs checks it). The runner install
+    # pulled them from Ubuntu's apt mirror on every run, and three runs (#349, #378, #382) crawled at
+    # ~26 kB/s for 11-12 minutes until the job hit its limit after every test had passed.
+    container:
+      image: mcr.microsoft.com/playwright:v1.64.1-noble
+      options: --user 1001
+    timeout-minutes: 24
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
-      - uses: actions/setup-node@v7
-        with:
-          node-version: "24"
-          cache: npm
-          cache-dependency-path: tools/vendor/package-lock.json
      - name: Read the reviewed runtime pins
        id: runtime
        run: |
@@ -84,21 +111,42 @@ jobs:
          ref: ${{ steps.runtime.outputs.kikoRevision }}
          path: .ci-kikotools
          persist-credentials: false
-      - uses: actions/setup-python@v7
+      # The image's own Python and Node 24: setup-python/setup-node install the runner's toolcache builds,
+      # whose entry points name host paths that do not exist in the container. The image has no ensurepip
+      # and the job has no root, so a checksum-pinned pip wheel bootstraps a user-space venv. The image
+      # Python must be the reviewed host Python, so a pin or image bump that disagrees fails here.
+      - name: Python environment on the reviewed host Python
+        env:
+          PIP_WHEEL: https://files.pythonhosted.org/packages/f3/6e/1736e5b4ae2b778ef2f81c47d797de9f891d4d8acb047a24ca37a60294dd/pip-26.2.1-py3-none-any.whl
+          PIP_SHA256: 71138adf1f4ca900cdb7d289c21b7494329f2332b6d85f0e1c42108c0384ed3e
+          PINNED_PYTHON: ${{ steps.runtime.outputs.pythonVersion }}
+        run: |
+          image="$(python3 -c 'import sys; print("%d.%d" % sys.version_info[:2])')"
+          [ "$image" = "$PINNED_PYTHON" ] || { echo "::error::image Python $image is not the pinned $PINNED_PYTHON"; exit 1; }
+          venv="$RUNNER_TEMP/venv" wheel="$RUNNER_TEMP/pip-26.2.1-py3-none-any.whl"
+          python3 -m venv --without-pip "$venv"
+          curl -fsSL --retry 3 -o "$wheel" "$PIP_WHEEL"
+          echo "$PIP_SHA256  $wheel" | sha256sum -c -
+          "$venv/bin/python" "$wheel/pip" install --no-index --no-cache-dir "$wheel"
+          echo "$venv/bin" >> "$GITHUB_PATH"
+      - run: python --version && node --version && node --version | grep -q '^v24\.'
+      # pip's download cache (torch alone is ~200 MB); inside the container ~ is the job's HOME (/github/home).
+      - name: Cache pip downloads
+        uses: actions/cache@v6
        with:
-          python-version: ${{ steps.runtime.outputs.pythonVersion }}
-          cache: pip
-          cache-dependency-path: |
-            requirements-dev.txt
-            .ci-comfyui/requirements.txt
-            tools/vendor/comfyui-runtime.json
+          path: ~/.cache/pip
+          key: pip-${{ runner.os }}-playwright-v1.64.1-${{ hashFiles('requirements-dev.txt', '.ci-comfyui/requirements.txt', 'tools/vendor/comfyui-runtime.json') }}
      - name: Install CPU runtime and test dependencies
        run: |
-          python -m pip install --upgrade pip
          pip install "torch==${{ steps.runtime.outputs.torchVersion }}" "torchvision==${{ steps.runtime.outputs.torchvisionVersion }}" --index-url https://download.pytorch.org/whl/cpu
          pip install -r .ci-comfyui/requirements.txt -r requirements-dev.txt "torch==${{ steps.runtime.outputs.torchVersion }}" "torchvision==${{ steps.runtime.outputs.torchvisionVersion }}"
+      # npm's download cache, keyed on the lockfile. node_modules itself is still built fresh by npm ci.
+      - name: Cache npm downloads
+        uses: actions/cache@v6
+        with:
+          path: ~/.npm
+          key: npm-${{ runner.os }}-playwright-v1.64.1-${{ hashFiles('tools/vendor/package-lock.json') }}
      - run: npm ci --prefix tools/vendor --ignore-scripts
-      - run: npx --prefix tools/vendor playwright install --with-deps chromium
      - name: Classic and Nodes 2.0 startup and compatibility
        env:
          PM_COMFY_ROOT: ${{ github.workspace }}/.ci-comfyui
@@ -127,6 +175,7 @@ jobs:
  coverage:
    name: coverage gate (85%)
    runs-on: ubuntu-latest
+    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7

@@ -143,7 +192,7 @@ jobs:

      - name: Measure coverage
        run: |
-          python -m coverage run -m unittest discover -s tests
+          python -m coverage run -m tests.run_suite
          python -m coverage combine
          python -m coverage report --fail-under=85

@@ -154,6 +203,7 @@ jobs:
    name: perf budget
    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
+    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v7

@@ -176,24 +226,31 @@ jobs:
  lint:
    name: black and flake8
    runs-on: ubuntu-latest
+    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v7
        with:
          python-version: "3.12"
-      - run: pip install black flake8
+          cache: pip
+          cache-dependency-path: requirements-dev.txt
+      # The exact black and flake8 pins from requirements-dev.txt, so a new release cannot turn CI red.
+      - run: pip install $(grep -E '^(black|flake8)==' requirements-dev.txt)
      - run: black --check .
      - run: flake8 .

  js-test:
    name: frontend modules
    runs-on: ubuntu-latest
+    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-node@v7
        with:
          node-version: "24"
+          cache: npm
+          cache-dependency-path: tools/vendor/package-lock.json

      - name: Check shipped extension and page modules parse
        run: |
@@ -207,3 +264,32 @@ jobs:

      - name: Run JS tests
        run: node --test tests/js/*.test.js
+
+  # The required context "all tests". A dropped matrix leg never reports a check at all, so the eight
+  # legs that pull requests skip cannot be required by name; this gate requires them instead. Every
+  # job must succeed; real ComfyUI must be skipped on a pull request and succeed on every other event.
+  all-tests:
+    name: all tests
+    needs: [test, comfyui, coverage, lint, js-test]
+    if: always()
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Require every test job for this event
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          TEST_RESULT: ${{ needs.test.result }}
+          COMFYUI_RESULT: ${{ needs.comfyui.result }}
+          COVERAGE_RESULT: ${{ needs.coverage.result }}
+          LINT_RESULT: ${{ needs.lint.result }}
+          JS_RESULT: ${{ needs.js-test.result }}
+        run: |
+          queue_only=success
+          if [ "$EVENT_NAME" = pull_request ]; then queue_only=skipped; fi
+          echo "event: $EVENT_NAME (real ComfyUI must be $queue_only)"
+          echo "test matrix: $TEST_RESULT"
+          echo "comfyui: $COMFYUI_RESULT"
+          echo "coverage: $COVERAGE_RESULT"
+          echo "lint: $LINT_RESULT"
+          echo "js-test: $JS_RESULT"
+          test "$TEST_RESULT" = success && test "$COVERAGE_RESULT" = success && test "$LINT_RESULT" = success && test "$JS_RESULT" = success && test "$COMFYUI_RESULT" = "$queue_only"
@@ -1,6 +1,7 @@
 name: Viewer.js vendor and compatibility

 on:
+  merge_group:
  pull_request:
    branches: [main]
  push:
@@ -164,6 +165,8 @@ jobs:

  browser-workflows:
    name: page workflows (${{ matrix.browser }}, shard ${{ matrix.shard }}/2)
+    # Merge queue, main and manual runs only (#420); pull requests run the Chromium/touch coverage shards.
+    if: github.event_name != 'pull_request'
    runs-on: ubuntu-latest
    # Layout comparisons depend on the fonts each browser falls back to, so browser jobs run in the
    # same pinned Playwright image as local runs (tag = @playwright/test in tools/vendor/package-lock.json;
@@ -218,8 +221,9 @@ jobs:
          retention-days: 14

  # Branch protection requires the exact context "viewerjs". This job keeps that
-  # name and fails unless every frontend job above succeeded (every shard, the
-  # coverage merge and every browser shard), including when one was cancelled or skipped.
+  # name and fails unless every coverage shard and the coverage merge succeeded and
+  # the browser shards succeeded, or, on a pull request only, were skipped (#420).
+  # Any failure, cancellation or other skip fails it.
  viewerjs:
    needs: [frontend-coverage, frontend-coverage-merge, browser-workflows]
    if: always()
@@ -228,11 +232,15 @@ jobs:
    steps:
      - name: Require every frontend job to succeed
        env:
+          EVENT_NAME: ${{ github.event_name }}
          COVERAGE_RESULT: ${{ needs.frontend-coverage.result }}
          MERGE_RESULT: ${{ needs.frontend-coverage-merge.result }}
          WORKFLOWS_RESULT: ${{ needs.browser-workflows.result }}
        run: |
+          queue_only=success
+          if [ "$EVENT_NAME" = pull_request ]; then queue_only=skipped; fi
+          echo "event: $EVENT_NAME (browser-workflows must be $queue_only)"
          echo "frontend-coverage: $COVERAGE_RESULT"
          echo "frontend-coverage-merge: $MERGE_RESULT"
          echo "browser-workflows: $WORKFLOWS_RESULT"
-          test "$COVERAGE_RESULT" = success && test "$MERGE_RESULT" = success && test "$WORKFLOWS_RESULT" = success
+          test "$COVERAGE_RESULT" = success && test "$MERGE_RESULT" = success && test "$WORKFLOWS_RESULT" = "$queue_only"
@@ -211,3 +211,6 @@ coverage/

 # Disposable upstream checkout for real-host CI
 .ci-comfyui/
+
+# Old library files a Move library renamed (never deleted; #249 S6b)
+*.moved-to-*
@@ -13,16 +13,18 @@ repos:
        language: system
        types: [python]

+      # Fails at the severity CI enforces (code-quality.yml: -lll, high only), never stricter.
+      # pre-commit appends the staged files, so no shell wrapper can drop the first one.
      - id: bandit
        name: bandit
-        entry: bash -c 'bandit "$@" -ll -q 2>&1; true'
+        entry: bandit -lll -q
        language: system
        types: [python]
        exclude: ^(tests/|reference/)

      - id: tests
        name: tests
-        entry: python -m unittest discover tests/ -v
+        entry: python -m tests.run_suite -q
        language: system
        pass_filenames: false
        stages: [pre-push]
@@ -1,7 +1,7 @@
 # ComfyUI Prompt Manager

 ![License](https://img.shields.io/badge/license-MIT-blue.svg)
-![Python](https://img.shields.io/badge/python-3.10%2B-blue.svg)
+![Python](https://img.shields.io/badge/python-3.12%2B-blue.svg)
 ![ComfyUI](https://img.shields.io/badge/ComfyUI-compatible-green.svg)
 ![Tests](https://github.com/ComfyAssets/ComfyUI_PromptManager/workflows/Tests/badge.svg)
 ![Code Quality](https://github.com/ComfyAssets/ComfyUI_PromptManager/workflows/Code%20Quality/badge.svg)
@@ -56,7 +56,7 @@ Both nodes include the complete PromptManager feature set:
 - **📊 Analytics**: Track prompt usage patterns and effectiveness over time
 - **🔬 Workflow Analysis**: Extract and analyze ComfyUI workflow data from PNG images
 - **📋 Metadata Viewer**: Standalone tool for analyzing ComfyUI-generated images
- **🛠️ System Management**: Built-in diagnostics, backup/restore, and maintenance tools
+- **🛠️ System Management**: Built-in diagnostics, backup/restore, and maintenance tools in System
 - **🏷️ AI AutoTag**: Automatically tag your image collection using WD14 or JoyCaption vision models
 - **🔗 LoRA Manager Integration**: Import LoRA metadata and preview images from [ComfyUI-Lora-Manager](https://github.com/willmiao/ComfyUI-Lora-Manager)

@@ -206,14 +206,11 @@ match Classic and Focused.
 - **Responsive Design**: Works on desktop, tablet, and mobile devices
 - **Real-time Search**: Instant search results as you type
 - **Bulk Operations**: Edit multiple prompts simultaneously with batch tools
- **Settings Panel**: Configure behavior and display options
- **System Management**: Complete toolset for database operations:
+- **Settings and System tools live in System**: the dashboard's **Settings** opens System › Overview, **Maintenance** opens System › Maintenance, **Backup DB** and **Restore DB** open System › Backup & export, and **Diagnostics** and **View Logs** open System › Diagnostics & logs, each in a new tab. System reviews every destructive operation before it runs it as an Activity job.
+- **Page options**: the list header's **Page options** keeps the prompt list's Infinite Scrolling default
+- **Dashboard tools**:
  - **🔍 Metadata Viewer**: Launch standalone PNG analysis tool
-  - **📸 Scan Images**: Bulk scan output directories for ComfyUI images
-  - **💾 Backup/Restore**: Database backup and recovery operations
-  - **🔧 Maintenance**: Database optimization and cleanup tools including orphaned prompt removal
-  - **📋 Logs**: Comprehensive logging system with download capability
-  - **🔍 Diagnostics**: System health checks and troubleshooting
+  - **📸 Scan Images**: Bulk scan output directories for ComfyUI images (with a quick backup first)
 - **Export Tools**: Download prompts and metadata in various formats
 - **Progress Tracking**: Real-time progress indicators for long operations
 - **Error Handling**: Graceful error display with recovery suggestions
@@ -315,6 +312,12 @@ Both nodes support the same metadata fields:

 Both nodes will automatically save prompts to the database and link any generated images to the prompt.

+- **Save to library** (`save_to_library`, on by default; "Save to library" in the Focused, Split and Pair editors):
+  turn it off while iterating and PromptManager ignores that node's runs. The prompt is not saved, the run is not
+  counted and its images are not linked (a scan skips them too), while the node's output is unchanged. Workflows
+  saved before this switch existed load with it on. If any PromptManager node feeding a sampler's positive input
+  has it off, none of that run's images are linked, because the image cannot show which sampler produced it.
+
 ### 🖼️ Using the Output-Wide Gallery

 The comprehensive gallery system provides complete access to all your ComfyUI output:
@@ -333,14 +336,11 @@ The comprehensive gallery system provides complete access to all your ComfyUI ou

 #### **⚙️ Gallery Settings**

-Configure your viewing experience in the settings panel:
+The gallery's **Settings** opens System › Appearance in a new tab: image quality, details on cards, collapsed viewer details, video autoplay/mute/loop, metadata loading and file paths are set there and apply to this page too.

- **Display Settings**: Default view, items per page, grid columns, media info, infinite scrolling
- **Performance Settings**: Image quality, lazy loading
- **Video Settings**: Autoplay, mute by default, loop videos
- **Thumbnail Management**: Generate optimized thumbnails for faster loading (runs on the configured worker threads; a run that stops at the per-run cap tells you how many remain)
- **Find Duplicate Images**: Hashes every file on the worker threads with a progress bar; close the window and it keeps running, results wait in a pill
- **Rescan Output Folder**: Drops the server-side listing cache and rewalks the folders
+The gallery's **Page options** keep the page's own settings: the thumbnail check at startup, lazy loading, items per page, grid columns, infinite scrolling, debug mode and API timeout. Reset puts back only these.
+
+Thumbnail generation, the server thumbnail and browser cache clears, refreshing the file listing and finding duplicate images are in System › Sources & scans and System › Maintenance (Page options links both); each runs as an Activity job you can follow after closing the page.

 #### **🖼️ Image Viewing Experience**

@@ -398,7 +398,7 @@ Import existing ComfyUI images into your database:
   - Any errors or issues encountered
 5. **Access imported data** through the normal gallery interface

-The scan reads PNG text chunks and A1111-style parameters, and, when `ffprobe` is installed, the prompt ComfyUI's video savers embed in MP4/MOV/WebM files. Files are read on the number of **worker threads** set in Settings → Performance (default: half your cores), which makes a large library several times faster.
+The scan reads PNG text chunks and A1111-style parameters, and, when `ffprobe` is installed, the prompt ComfyUI's video savers embed in MP4/MOV/WebM files. Files are read on the number of **worker threads** set in System › Sources & scans (default: half your cores), which makes a large library several times faster.

 ### 🏷️ AI AutoTag

@@ -414,7 +414,7 @@ Automatically tag your entire image collection using AI vision models:

 1. **AutoTag (Batch Mode)**: Tag your entire collection automatically
   - Click **"🏷️ AutoTag"** in the admin dashboard
-   - Choose your model type (FP16 or GGUF)
+   - Choose your model type (FP16 or GGUF). A model that is not downloaded yet shows **Manage in System**: download (or unload) it in System › Auto-tagging, then reopen the dialog
   - Select how to handle already-tagged images:
     - **Skip images with existing tags**: Preserve your meticulous manual tagging work
     - **Re-tag all images**: Overwrite existing tags with fresh AI analysis
@@ -445,7 +445,7 @@ Adjust the system prompt to match your tagging style:
 #### **Requirements**

 - Sufficient VRAM for the chosen model (FP16 requires more, GGUF is lighter)
- Models are downloaded automatically on first use
+- Models are downloaded in System › Auto-tagging
 - Feature requests and improvements are welcome!

 ### 📁 Folder Filter
@@ -470,24 +470,28 @@ If you use [ComfyUI-Lora-Manager](https://github.com/willmiao/ComfyUI-Lora-Manag

 #### **Enabling the Integration**

-1. Open the admin dashboard and click **Settings**
-2. Scroll to the **Integrations** section — PromptManager will auto-detect if LoRA Manager is installed
+1. Open System › Integrations (the admin dashboard's **Settings** opens System)
+2. PromptManager auto-detects whether LoRA Manager is installed

 ![LoRA Enabled](images/pm-lora-enabled.png)

 3. Toggle the **LoraManager** switch to enable
 4. Optionally enable **Auto-inject trigger words** to automatically append LoRA trigger words when `<lora:name:weight>` is detected in your prompts
-5. Click **Save Settings** (requires a ComfyUI restart to take effect)
+5. Click **Save preferences** (requires a ComfyUI restart to take effect)

 #### **Importing LoRA Data**

-Click **Import LoRA Data** in the settings panel to start the import. A progress popup shows real-time status as each LoRA is processed:
+Click **Review import** in System › Integrations; Start runs the import as an Activity job:

- Scans all LoRA directories (including `extra_model_paths.yaml` paths) for metadata
- Downloads example images from CivitAI as 512px thumbnails
+- Reads LoRA Manager's own settings the way LoRA Manager does: from the folder in `LORA_MANAGER_SETTINGS_DIR`, from the plugin's `settings.json` in portable mode, or from your user config folder, and only the keys that say where its files are
+- Finds each LoRA's metadata in both storage modes: beside the model (the default) or in the central sidecar folder, and imports only LoRAs whose model file still exists in a LoRA folder (the review says how many metadata files it skipped)
+- Links LoRA Manager's preview (including `.preview.webp` and video previews) and every downloaded example image and video where they are, without copying them
+- Downloads example images from CivitAI as 512px thumbnails only for LoRAs that have no local image
 - Creates a prompt entry for each LoRA with trigger words, example prompts, and preview images
 - All imported LoRAs are tagged with `lora-manager` category for easy filtering

+The System › Integrations review names the settings it read (source, storage mode and LoRA Manager library) and counts metadata files, LoRAs and LoRAs with local images. If LoRA Manager's settings cannot be used, it says why and nothing is changed.
+
 ![LoRA Results](images/pm-lora-filtered.png)

 After import, filter by the `lora-manager` category to browse your LoRA collection.
@@ -498,9 +502,11 @@ A CivitAI API key is **required if your library contains NSFW LoRAs** — CivitA

 To add your key:
 1. Get your API key from [civitai.com/user/account](https://civitai.com/user/account)
-2. Paste it into the **CivitAI API Key** field in the Integrations settings
+2. Paste it into the **CivitAI API key** field in System › Integrations
 3. Save and re-import to download any previously skipped images

+The key is sent only over HTTPS to CivitAI's own hosts. CivitAI serves images through a redirect to its storage host; PromptManager follows such a redirect only over HTTPS to a host on CivitAI's own `civitai.com`, `civitai.red` or `civitai.green` domains, at most three hops, and never sends the key with it. When downloads fail, the import's status line says how many; when none could be downloaded, it starts with a warning. The server log has one warning per failed image with the reason (HTTP status, refused redirect, size cap, unreadable image, timeout or network error).
+
 > **Note:** Re-importing is safe — PromptManager skips LoRAs that were already imported. To do a fresh import, the previous `lora-manager` data is cleared automatically before re-scanning.

 ### 🌐 Web Interface Features
@@ -511,23 +517,20 @@ The comprehensive web interface provides:
 - **Filter Options**: Filter by category, tags, rating, and date
 - **Bulk Operations**: Select multiple prompts for batch editing
 - **Export Tools**: Download your prompt collection
- **Settings Panel**: Configure auto-save and display options
- **Diagnostics**: System health checks and troubleshooting
+- **Settings**: System (new tab) for settings, maintenance, backups and diagnostics; **Page options** for the page's own display settings

 ### 🔧 Database Maintenance

-Keep your database optimized with built-in maintenance tools:
+Keep your database optimized in System › Maintenance (the admin dashboard's **Maintenance** opens it in a new tab):

-1. **Open the admin dashboard** and click **"🔧 Maintenance"**
-2. **Select maintenance operations**:
-   - **Remove Duplicates**: Find and merge duplicate prompts while preserving images
-   - **Vacuum Database**: Optimize database file size and performance
-   - **Clean Orphaned Images**: Remove image records for missing files
-   - **🚮 Prune Orphaned Prompts**: Remove prompts that have no linked images
-   - **Check Consistency**: Verify database integrity and relationships
-   - **Database Statistics**: Generate detailed database reports
-3. **Run selected operations** and monitor progress in real-time
-4. **Review results** showing detailed information about each operation
+- **Duplicate prompt text**: merge duplicate prompts while preserving images
+- **Optimize database**: reclaim unused SQLite space
+- **Missing-file links**: remove image records for missing files
+- **Unused prompt components**: remove prompts nothing uses
+- **Run health checks**: verify database integrity and relationships (the Health report)
+- **Database size and prompt counts**: System › Diagnostics & logs (Database) and the Overview's Statistics
+
+Each operation opens a review that shows what it will change and the safety backup it takes, then runs as an Activity job.

 ### Database Location

@@ -751,9 +754,51 @@ ComfyUI_PromptManager/

 ## Configuration

+### Where your library lives
+
+New installs keep the library (`prompts.db`, `config.json` with the CivitAI key, the
+database backups and the logs) in ComfyUI's system user folder
+`ComfyUI/user/__promptmanager/`. An update, a reinstall or ComfyUI-Manager replacing
+the node folder no longer touches it, and ComfyUI's `/userdata` web API does not
+serve `__` system folders. Thumbnails stay in `output/thumbnails`.
+
+- **Upgrading from an earlier version:** your library stays where it is, in the node
+  folder, until you move it; nothing is moved on its own. The workspace shows a notice
+  above every page and System › Overview a "Library location" row. **Move library**
+  copies the database with SQLite's backup API, verifies the copy (integrity check, every
+  workflow document, the same rows in every table), copies `config.json` and the backups,
+  switches to the new folder without a restart and only then renames the old files
+  `prompts.db.moved-to-__promptmanager` and `config.json.moved-to-__promptmanager` (never
+  deleted; the old backups stay too). If anything fails, the library stays in the node
+  folder, unchanged. **Keep it here** stops the notice; the Overview row stays. Take a
+  backup first (System › Backup & export or the dashboard's Backup) as with any change.
+- **Your own folder:** set `PROMPT_MANAGER_DATA_DIR` to an absolute folder outside
+  ComfyUI's output, input and temp folders and your image sources. If it is empty and a
+  node-folder library exists, that library stays in use until you move it there.
+- **An explicit `database.default_path`** in `config.json` and `PROMPT_MANAGER_CONFIG_PATH`
+  keep working as before (described below); such a library is not offered a move.
+
+### Thumbnails
+
+Previews in `output/thumbnails` are written as **WebP, quality 80, 512 px** by default
+(System › Appearance › Thumbnails sets the format, quality and size limit for every
+preview). Previews from older versions keep their old format (usually PNG) until you
+run **Convert outdated** (System › Overview or Appearance): it rewrites each one from
+its original and then removes the old file. Nothing converts on its own.
+
+**JPEG XL** (smaller still) can be chosen once the server has an encoder. Install one
+of these, then restart ComfyUI:
+
+- `pip install pillow-jxl-plugin` in ComfyUI's Python environment (simplest), or
+- an `ffmpeg` on PATH built with `libjxl`, or
+- `cjxl` from [libjxl](https://github.com/libjxl/libjxl) on PATH.
+
+Browsers that cannot show JPEG XL see the original images in the grid instead.
+
 ### Database Settings

-You can customize the database path by creating a `config.json` file in the extension root:
+You can customize the database path by creating a `config.json` file in the library's
+folder (the node folder for a library that was not moved):

 ```json
 {
@@ -787,8 +832,8 @@ Before upgrading or changing this setting:
 1. Identify the database your current installation actually uses and confirm its
   library contents. Check both the configured path and the prior fallback
   `<extension>/prompts.db`; keep track of which existing file you intend to use.
-2. Preserve a consistent backup of the active database with the dashboard's
-   Backup/Restore backup action or SQLite's online backup API. Do not copy only
+2. Preserve a consistent backup of the active database with
+   System › Backup & export's Back up or SQLite's online backup API. Do not copy only
   the main file of a live SQLite database: committed data may still be in its
   `-wal` file. For a filesystem copy, stop ComfyUI cleanly first and preserve any
   remaining `-wal` file together with the main database.
@@ -880,12 +925,12 @@ db.model.backup_database("backup_prompts.db")
 ```bash
 cd ComfyUI_PromptManager
 pip install -r requirements-dev.txt
-python -m unittest discover -s tests          # Python (what CI runs)
+python -m tests.run_suite                      # Python (what CI runs: unittest discovery plus a hang watchdog)
 node --test tests/js/*.test.js                 # frontend pure modules
-python -m coverage run -m unittest discover -s tests && python -m coverage combine && python -m coverage report
+python -m coverage run -m tests.run_suite && python -m coverage combine && python -m coverage report
 ```

-CI runs the suite on Linux, Windows and macOS for Python 3.10 to 3.12 with an 85% coverage gate. Tests that delete a database file first check that nothing in the process still holds it open (`tests/open_handles.py`), so a connection leak fails on Linux the way it would on Windows.
+CI runs the suite on Linux, Windows and macOS for Python 3.12 to 3.14 with an 85% coverage gate. `python -m unittest discover -s tests` still works; see `TESTING.md` ("Time limits and hangs") for the watchdog. Tests that delete a database file first check that nothing in the process still holds it open (`tests/open_handles.py`), so a connection leak fails on Linux the way it would on Windows.

 ### Code Style

@@ -970,6 +1015,10 @@ MIT License - see LICENSE file for details.

 ## Changelog

+### Unreleased (Library location)
+
+- **📁 Library outside the node folder**: new installs keep `prompts.db`, `config.json`, the database backups and the logs in `ComfyUI/user/__promptmanager/`, where an update or reinstall of the node cannot delete them and ComfyUI's `/userdata` API does not reach. An existing library stays in the node folder until you press **Move library** (a verified copy, then a live switch; the old files are renamed `*.moved-to-__promptmanager`, never deleted) or **Keep it here**. `PROMPT_MANAGER_DATA_DIR` names your own folder. After moving, restart ComfyUI once so the logs follow. Going back to an older version after a move: an older version does not look in `user/__promptmanager`, so stop ComfyUI and copy `user/__promptmanager/prompts.db` (with its `-wal` file, if one is left) and `config.json` into the node folder; the `*.moved-to-__promptmanager` files are the library as it was at the move, without later changes.
+
 ### Unreleased (Workflows stored once)

 - **🗜️ Smaller database**: each distinct workflow and prompt graph is stored once, compressed, instead of again for every image. Images recorded by this version use it from the first start; the maintenance job "Store each workflow once" rewrites the existing records and then reclaims the space. A 20,000-image test library went from 1.4 GB to 60 MB. The job always takes a verified backup first: the first time, `prompts.db.pre-workflow-storage_<date time>` beside the database, kept until you delete it; on later runs, a normal pooled safety backup. No image or video file is opened or changed.
@@ -22,22 +22,21 @@ Features:
 - Comprehensive logging and diagnostics
 """

-import re
+import atexit
+import threading
+import time
 from pathlib import Path


 def get_version():
-    """Parse version from pyproject.toml"""
+    """Parse version from pyproject.toml (``utils/version.py``)."""
+    from .utils.version import project_version
+
    try:
-        pyproject_path = Path(__file__).parent / "pyproject.toml"
-        if pyproject_path.exists():
-            content = pyproject_path.read_text()
-            match = re.search(r'version\s*=\s*["\']([^"\']+)["\']', content)
-            if match:
-                return match.group(1)
+        root = Path(__file__).parent
    except Exception:
-        pass
-    return "unknown"
+        return "unknown"
+    return project_version(root)


 from .prompt_manager import (  # noqa: E402
@@ -72,6 +71,12 @@ NODE_DISPLAY_NAME_MAPPINGS = {
 # are served by our own routes instead (see py/api).
 WEB_DIRECTORY = "web/comfy"

+# Parts the package teardown stops (``_stop_background_work``). Each stays None
+# when its start-up block below fails, and the teardown skips it.
+api = None
+_global_prompt_tracker = None
+_global_image_monitor = None
+
 # Add API routes (same pattern as ComfyUI_Assets)
 try:
    # Set extension URI
@@ -87,10 +92,22 @@ try:
    routes = config.routes
    api = PromptManagerAPI()
    api.add_routes(routes)
+    # Temp files of preview writes a crash interrupted (#317), off the
+    # import path: the walk may cover a large thumbnails folder.
+    threading.Thread(
+        target=api.sweep_thumbnail_temps,
+        name="PromptManagerPreviewTempSweep",
+        daemon=True,
+    ).start()
    host_app = getattr(config.server_instance, "app", None)
    if host_app is not None and hasattr(host_app, "on_cleanup"):
        host_app.on_cleanup.append(api.cleanup_history_reads)
        host_app.on_cleanup.append(api.cleanup_annotation_captures)
+        host_app.on_cleanup.append(api.cleanup_gallery_listings)
+    if host_app is not None and hasattr(host_app, "on_startup"):
+        # Build each output root's Images listing once the server's loop runs,
+        # so the first open does not wait for the walk (#348).
+        host_app.on_startup.append(api.warm_gallery_listings)
    if host_app is not None and hasattr(host_app, "on_shutdown"):
        # Open Needs review change streams end before the server waits on them.
        host_app.on_shutdown.append(api.close_review_events)
@@ -127,25 +144,16 @@ try:

    # The Needs review pass for ambiguous new outputs runs through the API's
    # capture store (the one the scan and the Tag dialog use): a linked output
-    # is never queued and its pending items leave the queue. It stops before
-    # that store is closed at shutdown.
-    _review_api = globals().get("api")
-    if _review_api is not None:
-        _global_image_monitor.set_review_recorder(_review_api.record_review_file)
+    # is never queued and its pending items leave the queue. The package
+    # teardown detaches it before that store is closed at shutdown.
+    if api is not None:
+        _global_image_monitor.set_review_recorder(api.record_review_file)
        # Every settled output's preview is queued for the API's background
        # worker (#249): the workspace never asks to generate thumbnails.
-        _global_image_monitor.set_thumbnail_queue(_review_api.queue_capture_thumbnail)
-        _review_host = getattr(config.server_instance, "app", None)
-        if _review_host is not None and hasattr(_review_host, "on_cleanup"):
-
-            async def _stop_review_recording(
-                app, monitor=_global_image_monitor, api=_review_api
-            ):
-                monitor.set_review_recorder(None)
-                monitor.set_thumbnail_queue(None)
-                api.close_auto_thumbnails(final=True)
-
-            _review_host.on_cleanup.insert(0, _stop_review_recording)
+        _global_image_monitor.set_thumbnail_queue(api.queue_capture_thumbnail)
+        # Every settled output walks its Images listing again (#348): the
+        # API hops from the monitor's thread onto the server's loop.
+        _global_image_monitor.set_output_listener(api.notify_output_settled)

    # Start monitoring
    _global_image_monitor.start_monitoring()
@@ -187,6 +195,26 @@ except Exception as e:
            f"Failed to register usage hook: {e}"
        )

+# A cached node counts what its last execution of the same text counted (#347).
+try:
+    from .py.config import server_instance
+    from .utils.cached_runs import register_cached_runs
+
+    register_cached_runs(server_instance, _db_factory)
+except Exception as e:
+    try:
+        from .utils.logging_config import get_logger
+
+        get_logger("prompt_manager.init").error(
+            f"Failed to register cached-run counting: {e}"
+        )
+    except Exception:
+        import logging
+
+        logging.getLogger("prompt_manager.init").error(
+            f"Failed to register cached-run counting: {e}"
+        )
+

 def _history_db_factory() -> "PromptDatabase":
    """Initialize history on its worker even if monitoring initialization failed."""
@@ -215,6 +243,193 @@ except Exception:
            "Failed to register execution history"
        )

+
+# ── Package teardown (#301, #302) ────────────────────────────────────────────
+# ComfyUI never runs aiohttp's cleanup hooks (it never calls
+# ``runner.cleanup()``), so ``atexit`` is the live host's path: Ctrl+C, and a
+# normal exit. It is registered after the history hook, so at exit (newest
+# first) it runs before the history dispose. Hosts that do run ``on_cleanup``
+# (our test servers) run it there, and the tests' package unload calls it.
+
+TEARDOWN_SECONDS = 10.0
+_clock = time.monotonic
+_background_work_lock = threading.Lock()
+_background_work_result = None
+
+
+def _teardown_step(name, stop, logger):
+    """Run one teardown step; a failure (even Ctrl+C) is logged and is False."""
+    try:
+        return bool(stop())
+    except (Exception, KeyboardInterrupt):
+        logger.error(f"Background work: stopping {name} failed", exc_info=True)
+        return False
+
+
+def _teardown_logger():
+    """PromptManager's init logger; the standard one if that cannot load."""
+    try:
+        from .utils.logging_config import get_logger
+
+        return get_logger("prompt_manager.init")
+    except Exception:
+        import logging
+
+        return logging.getLogger("prompt_manager.init")
+
+
+def _stop_background_work():
+    """Stop the image monitor, the preview worker and the prompt cleanup
+    thread against one TEARDOWN_SECONDS deadline, once.
+
+    Returns ``{"monitor", "thumbnails", "tracker"}`` booleans (True: it
+    stopped), leaving out parts that never started. Later calls return a
+    copy of the first result. A Ctrl+C inside a step is logged and the
+    step is False; one between steps is re-raised after the result (parts
+    not reached are False) is stored and the ``atexit`` entry removed.
+    """
+    global _background_work_result
+    with _background_work_lock:
+        if _background_work_result is not None:
+            return dict(_background_work_result)
+        monitor, thumbnails, tracker = (
+            _global_image_monitor,
+            api,
+            _global_prompt_tracker,
+        )
+        # A part whose global is set has started; False until its step says
+        # otherwise, so an interrupt between steps leaves an honest result.
+        started = (
+            ("monitor", monitor),
+            ("thumbnails", thumbnails),
+            ("tracker", tracker),
+        )
+        result = {name: False for name, part in started if part is not None}
+        try:
+            logger = _teardown_logger()
+            began = _clock()
+            deadline = began + TEARDOWN_SECONDS
+
+            def left(own_bound):
+                return max(0.0, min(own_bound, deadline - _clock()))
+
+            if monitor is not None:
+
+                def stop_monitor():
+                    from .utils.image_monitor import OBSERVER_JOIN_SECONDS
+
+                    # Callbacks first: an image in hand queues no preview into a
+                    # closing preview worker. The worker may have read the queue
+                    # callback already, so the API refuses new previews too (at
+                    # exit, Python 3.12+ refuses to start their worker thread).
+                    if thumbnails is not None:
+                        thumbnails.refuse_auto_thumbnails()
+                    monitor.set_review_recorder(None)
+                    monitor.set_thumbnail_queue(None)
+                    monitor.set_output_listener(None)
+                    return monitor.stop_monitoring(left(OBSERVER_JOIN_SECONDS))
+
+                result["monitor"] = _teardown_step(
+                    "the image monitor", stop_monitor, logger
+                )
+            if thumbnails is not None:
+
+                def close_previews():
+                    from .py.api.thumbnail_auto import CLOSE_WAIT_SECONDS
+
+                    return thumbnails.close_auto_thumbnails(
+                        final=True, timeout=left(CLOSE_WAIT_SECONDS)
+                    )
+
+                result["thumbnails"] = _teardown_step(
+                    "the preview worker", close_previews, logger
+                )
+            if tracker is not None:
+
+                def stop_tracker():
+                    from .utils.prompt_tracker import TRACKER_JOIN_SECONDS
+
+                    return tracker.shutdown(left(TRACKER_JOIN_SECONDS))
+
+                result["tracker"] = _teardown_step(
+                    "the prompt cleanup thread", stop_tracker, logger
+                )
+            elapsed = _clock() - began
+            failed = [name for name, ok in result.items() if not ok]
+            if failed:
+                logger.warning(
+                    f"Background work not stopped in time ({elapsed:.1f} s): "
+                    + ", ".join(failed)
+                )
+            else:
+                parts = " ".join(f"{name}=ok" for name in result)
+                logger.info(f"Background work stopped in {elapsed:.1f} s: {parts}")
+        finally:
+            _background_work_result = result
+            atexit.unregister(_stop_background_work)
+        return dict(result)
+
+
+async def _stop_background_work_on_cleanup(app):
+    """aiohttp ``on_cleanup``: no request is served then, so it runs inline."""
+    _stop_background_work()
+
+
+def _kill_encoders_at_exit():
+    """Run by the exit hook before Python joins the executor threads (#376):
+    a JPEG XL or ffmpeg encoder (no console on Windows, so Ctrl+C never
+    reaches it) is killed instead of being waited for."""
+    from .py.api.thumbnail_encode import shutdown_encoders
+
+    shutdown_encoders()
+
+
+def _abort_downloads_at_exit():
+    """Run by the exit hook (#376): huggingface_hub's Xet transfers ignore
+    the chunk checkpoint, so they are aborted the way hub aborts on Ctrl+C."""
+    import sys
+
+    if "huggingface_hub" not in sys.modules:
+        return  # no download ever ran: import nothing at exit
+    from .py.autotag import abort_hub_downloads
+
+    abort_hub_downloads()
+
+
+try:
+    # Before the executor join: running jobs stop at their next file, item or
+    # chunk (#376). The teardown below still runs from atexit afterwards.
+    from .utils import exit_signal as _exit_signal
+
+    _exit_signal.install(_kill_encoders_at_exit)
+    _exit_signal.install(_abort_downloads_at_exit)
+except Exception as e:
+    try:
+        from .utils.logging_config import get_logger
+
+        get_logger("prompt_manager.init").error(
+            f"Failed to register the exit signal: {e}"
+        )
+    except Exception:
+        pass
+
+try:
+    atexit.register(_stop_background_work)
+    from .py.config import server_instance as _teardown_server
+
+    _teardown_host = getattr(_teardown_server, "app", None)
+    if _teardown_host is not None and hasattr(_teardown_host, "on_cleanup"):
+        _teardown_host.on_cleanup.insert(0, _stop_background_work_on_cleanup)
+except Exception as e:
+    try:
+        from .utils.logging_config import get_logger
+
+        get_logger("prompt_manager.init").error(
+            f"Failed to register the background work teardown: {e}"
+        )
+    except Exception:
+        pass
+
 __all__ = ["NODE_CLASS_MAPPINGS", "NODE_DISPLAY_NAME_MAPPINGS", "WEB_DIRECTORY"]

 # Print startup message with loaded tools
@@ -19,6 +19,11 @@ links (``PromptDatabase._move_tag_links``).
 Cheap reads (spec amendment S1) treat a byte record as *current* only while
 the file's present ``(size, mtime_ns)`` equals the record's verified
 fingerprint; a file without a current record shows no image tags.
+
+A write made from a tagging model's result passes ``mark_autotagged`` (#379):
+the byte record is then marked auto-tagged (``media_image_autotags``) in the
+same transaction, so a mark never exists without the write it records. Hand
+tags never mark.
 """

 import re
@@ -34,6 +39,7 @@ from .annotation_schema import (
    MAX_LOCATOR_LENGTH,
    METADATA_TABLE,
 )
+from .autotag_schema import AUTOTAG_TABLE
 from .library_commands import _UUID, LibraryCommandError, _validate_epoch
 from .models import utc_now_iso
 from .vocabulary import validate_vocabulary_tag_name
@@ -96,12 +102,24 @@ _TAGS_OF = (
    "JOIN tags t ON t.id=mit.tag_id WHERE mit.byte_id IN ({marks}) "
    "ORDER BY mit.byte_id,mit.position"
 )
-_RECORDS = (
-    "SELECT f.locator,b.id,b.size,b.mtime_ns,t.name "  # nosec B608
-    f"FROM {FILES_TABLE} f JOIN {BYTES_TABLE} b ON b.file_id=f.id "
-    f"LEFT JOIN {IMAGE_TAGS_TABLE} mit ON mit.byte_id=b.id "
-    "LEFT JOIN tags t ON t.id=mit.tag_id "
-    "ORDER BY f.locator,b.first_seen_at,b.id,mit.position"
+_MARK = f"INSERT OR IGNORE INTO {AUTOTAG_TABLE}(byte_id) VALUES(?)"  # nosec B608
+_MARKED_OF = (
+    f"SELECT byte_id FROM {AUTOTAG_TABLE} WHERE byte_id IN ({{marks}})"  # nosec B608
+)
+_MARKED_LOCATORS = (
+    f"SELECT DISTINCT f.locator FROM {AUTOTAG_TABLE} m "  # nosec B608
+    f"JOIN {BYTES_TABLE} b ON b.id=m.byte_id JOIN {FILES_TABLE} f ON f.id=b.file_id"
+)
+# Tag search (#379): the names that tag at least one image (the tag index
+# answers the EXISTS), then the locators carrying chosen names (by tag_id).
+_IMAGE_TAG_NAMES = (
+    "SELECT t.id,t.name FROM tags t WHERE EXISTS "  # nosec B608
+    f"(SELECT 1 FROM {IMAGE_TAGS_TABLE} mit WHERE mit.tag_id=t.id)"
+)
+_TAG_LOCATORS = (
+    f"SELECT DISTINCT f.locator FROM {IMAGE_TAGS_TABLE} mit "  # nosec B608
+    f"JOIN {BYTES_TABLE} b ON b.id=mit.byte_id "
+    f"JOIN {FILES_TABLE} f ON f.id=b.file_id WHERE mit.tag_id IN ({{marks}})"
 )


@@ -301,14 +319,17 @@ class AnnotationOperations:
        expected_epoch: str,
        expected_tag_revision: int,
        tags: list,
+        mark_autotagged: bool = False,
    ) -> dict:
        """Replace the set of these exact bytes, guarded by epoch and revision.

        Creates the owner and byte record when the bytes are new (an explicit
        empty set is a real save). The identical set at the current revision,
        or one behind it (a lost-response retry), is ``replayed`` and writes
-        nothing; any other revision mismatch is ``tag-conflict`` with the
-        current set and no writes.
+        no tag; any other revision mismatch is ``tag-conflict`` with the
+        current set and no writes. ``mark_autotagged`` marks the bytes
+        auto-tagged on a saved or replayed receipt (the Tag image dialog's
+        save after Generate suggestions).
        """
        _validate_target(locator, sha256, size, mtime_ns)
        _validate_epoch(expected_epoch)
@@ -329,6 +350,8 @@ class AnnotationOperations:
            ):
                if refingerprinted:
                    conn.execute(_BUMP_INDEX)
+                if mark_autotagged:
+                    conn.execute(_MARK, (byte_id,))
                return _receipt(epoch, sha256, current, revision, True)
            if expected_tag_revision != revision:
                raise AnnotationCommandError(
@@ -337,6 +360,8 @@ class AnnotationOperations:
                    {"sha256": sha256, "tags": current, "tag_revision": revision},
                )
            revision = self._write_image_tags(conn, byte_id, tags)
+            if mark_autotagged:
+                conn.execute(_MARK, (byte_id,))
            return _receipt(epoch, sha256, tags, revision, False)

    def add_image_tags(
@@ -348,16 +373,22 @@ class AnnotationOperations:
        mtime_ns: int,
        expected_epoch: str,
        tags: list,
+        mark_autotagged: bool = False,
    ) -> dict:
        """Union ``tags`` into the set of these exact bytes, keeping stored spelling.

        ``added`` counts the names that were new (case-insensitively). A union
        over ``MAX_IMAGE_TAGS`` is ``tag-limit`` with the current set and no
        writes; a union that adds nothing to an existing record is ``replayed``.
+        ``mark_autotagged`` (a tagging model's result) also marks the bytes
+        auto-tagged, replayed or not; only such a call may pass no tags (the
+        model found none: the image is marked and its set is unchanged).
        """
        _validate_target(locator, sha256, size, mtime_ns)
        _validate_epoch(expected_epoch)
        tags = normalize_image_tags(tags)
+        if not tags and not mark_autotagged:
+            raise ValueError("tags must name at least one tag")
        with self._pair_transaction() as conn:
            epoch = self._library_epoch(conn, expected_epoch)
            now = utc_now_iso()
@@ -375,6 +406,8 @@ class AnnotationOperations:
                    epoch,
                    {"sha256": sha256, "tags": current, "tag_revision": revision},
                )
+            if mark_autotagged:
+                conn.execute(_MARK, (byte_id,))
            if not created and not added:
                if refingerprinted:
                    conn.execute(_BUMP_INDEX)
@@ -403,6 +436,41 @@ class AnnotationOperations:
                conn.execute(_BUMP_INDEX)
            return cursor.rowcount > 0

+    @staticmethod
+    def _validated_stats(stats: object) -> dict:
+        if not isinstance(stats, dict):
+            raise ValueError(
+                "stats must map locators to (size, mtime_ns) integer pairs"
+            )
+        for locator, fingerprint in stats.items():
+            _validate_fingerprint(locator, fingerprint)
+        return stats
+
+    @staticmethod
+    def _current_byte_records(conn: sqlite3.Connection, stats: dict) -> dict:
+        """``{locator: byte_id}`` of each locator's current byte record.
+
+        The one rule every cheap read uses: a record is current while its
+        verified ``(size, mtime_ns)`` equals the file's present fingerprint
+        in ``stats``; the most recently verified wins (ties on ``(verified_at,
+        byte_id)``). A locator without a current record is left out. Lookups
+        go in chunks of 500 locators.
+        """
+        locators = list(stats)
+        chosen: dict[str, tuple[tuple[str, str], str]] = {}
+        for start in range(0, len(locators), _LOOKUP_CHUNK):
+            chunk = locators[start : start + _LOOKUP_CHUNK]
+            marks = ",".join("?" * len(chunk))
+            for locator, byte_id, size, mtime_ns, verified_at in conn.execute(
+                _FINGERPRINTS.format(marks=marks), chunk
+            ):
+                if (size, mtime_ns) != stats[locator]:
+                    continue
+                key = (verified_at, byte_id)
+                if locator not in chosen or key > chosen[locator][0]:
+                    chosen[locator] = (key, byte_id)
+        return {locator: byte_id for locator, (_key, byte_id) in chosen.items()}
+
    def current_image_tags(self, stats: dict) -> dict:
        """Image tags of the files whose current ``(size, mtime_ns)`` is verified.

@@ -411,29 +479,11 @@ class AnnotationOperations:
        exactly that verified fingerprint; the most recently verified record
        wins when several do. Lookups go in chunks of 500 locators.
        """
-        if not isinstance(stats, dict):
-            raise ValueError(
-                "stats must map locators to (size, mtime_ns) integer pairs"
-            )
-        for locator, fingerprint in stats.items():
-            _validate_fingerprint(locator, fingerprint)
-        locators = list(stats)
-        chosen: dict[str, tuple[tuple[str, str], str]] = {}
-        result: dict[str, list[str]] = {}
+        stats = self._validated_stats(stats)
        with self._annotation_read() as conn:
-            for start in range(0, len(locators), _LOOKUP_CHUNK):
-                chunk = locators[start : start + _LOOKUP_CHUNK]
-                marks = ",".join("?" * len(chunk))
-                for locator, byte_id, size, mtime_ns, verified_at in conn.execute(
-                    _FINGERPRINTS.format(marks=marks), chunk
-                ):
-                    if (size, mtime_ns) != stats[locator]:
-                        continue
-                    key = (verified_at, byte_id)
-                    if locator not in chosen or key > chosen[locator][0]:
-                        chosen[locator] = (key, byte_id)
-            owners = {byte_id: locator for locator, (_key, byte_id) in chosen.items()}
-            result = {locator: [] for locator in chosen}
+            current = self._current_byte_records(conn, stats)
+            owners = {byte_id: locator for locator, byte_id in current.items()}
+            result: dict[str, list[str]] = {locator: [] for locator in current}
            byte_ids = list(owners)
            for start in range(0, len(byte_ids), _LOOKUP_CHUNK):
                chunk = byte_ids[start : start + _LOOKUP_CHUNK]
@@ -442,20 +492,60 @@ class AnnotationOperations:
                    result[owners[byte_id]].append(name)
        return result

-    def iter_image_tag_records(self) -> Iterator[tuple[str, int, int, list[str]]]:
-        """Stream every byte record as ``(locator, size, mtime_ns, tags)``.
+    def autotag_state(self, stats: dict) -> dict:
+        """``{locator: bool}``: is each file's current byte record auto-tagged?

-        One SELECT ordered by locator, then by the bytes' first sighting, with
-        each set's names in position order.
+        ``stats`` as for :meth:`current_image_tags`, whose rule picks the
+        current record; a locator without one is False. One read snapshot.
        """
-        conn = self.model.get_connection()
-        current: tuple | None = None
-        for locator, byte_id, size, mtime_ns, name in conn.execute(_RECORDS):
-            if current is None or current[0] != byte_id:
-                if current is not None:
-                    yield current[1]
-                current = (byte_id, (locator, size, mtime_ns, []))
-            if name is not None:
-                current[1][3].append(name)
-        if current is not None:
-            yield current[1]
+        stats = self._validated_stats(stats)
+        with self._annotation_read() as conn:
+            current = self._current_byte_records(conn, stats)
+            byte_ids = list(dict.fromkeys(current.values()))
+            marked: set[str] = set()
+            for start in range(0, len(byte_ids), _LOOKUP_CHUNK):
+                chunk = byte_ids[start : start + _LOOKUP_CHUNK]
+                marks = ",".join("?" * len(chunk))
+                marked.update(
+                    row[0]
+                    for row in conn.execute(_MARKED_OF.format(marks=marks), chunk)
+                )
+        return {locator: current.get(locator) in marked for locator in stats}
+
+    def autotagged_locators(self) -> set:
+        """Locators with at least one auto-tagged byte record, current or not.
+
+        No fingerprint is checked (the Tag output images review's estimate).
+        """
+        with self._annotation_read() as conn:
+            return {row[0] for row in conn.execute(_MARKED_LOCATORS)}
+
+    def image_tag_ids(self, wanted, query: str) -> list[int]:
+        """Ids of the tag names on at least one image that a search wants.
+
+        A name counts when it is in ``wanted`` exactly (the Tags filter) or
+        contains ``query`` case-folded (the text search; ``query`` is
+        already folded). One read of the names that tag an image.
+        """
+        wanted = set(wanted)
+        with self._annotation_read() as conn:
+            return [
+                tag_id
+                for tag_id, name in conn.execute(_IMAGE_TAG_NAMES)
+                if name in wanted or (query and query in name.casefold())
+            ]
+
+    def image_tag_locators(self, tag_ids) -> set[str]:
+        """Locators with any byte record (current or not) carrying one of
+        ``tag_ids``, through the tag index, in chunks of 500 ids."""
+        ids = list(dict.fromkeys(tag_ids))
+        found: set[str] = set()
+        with self._annotation_read() as conn:
+            for start in range(0, len(ids), _LOOKUP_CHUNK):
+                chunk = ids[start : start + _LOOKUP_CHUNK]
+                marks = ",".join("?" * len(chunk))
+                found.update(
+                    row[0]
+                    for row in conn.execute(_TAG_LOCATORS.format(marks=marks), chunk)
+                )
+        return found
@@ -0,0 +1,140 @@
+"""Auto-tagged marks (#379): which image bytes a tagging model has handled.
+
+One table, ``media_image_autotags``: one row per byte record of the image
+annotation group (``media_annotation_bytes``) means "a tagging model looked at
+these exact bytes and its result was stored", or that the bytes were found to
+be untaggable. "Skip already tagged" skips an image whose current byte record
+is marked; hand tags never mark. Rows are written only by the image tag store
+(``database/annotations.py``), in the transaction of the tag write they
+record.
+
+The group installs like ``image_favorites``: optional in old backups,
+required once a database is current, and never backfilled. Like the Needs
+review group it is valid only beside a valid image annotation group, because
+every mark cites one byte record (``ON DELETE CASCADE``). Validation reads
+only: the catalog compared after whitespace compaction, the columns and the
+foreign key through the PRAGMAs, then one bounded value pass and the foreign
+key check.
+"""
+
+import re
+import sqlite3
+from typing import Optional
+
+from .annotation_schema import BYTES_TABLE
+from .annotation_schema import TABLES as ANNOTATION_TABLES
+from .annotation_schema import _catalog as _annotation_catalog
+from .annotation_schema import _uuid, annotation_schema_error
+
+AUTOTAG_TABLE = "media_image_autotags"
+_DDL = (
+    f"CREATE TABLE {AUTOTAG_TABLE} (byte_id TEXT PRIMARY KEY "
+    f"REFERENCES {BYTES_TABLE}(id) ON DELETE CASCADE) WITHOUT ROWID"
+)
+# (cid, name, declared type, not null, default, primary key position): the
+# key of a WITHOUT ROWID table is implicitly NOT NULL.
+_COLUMNS = [(0, "byte_id", "TEXT", 1, None, 1)]
+# (column, parent table, parent column, on delete)
+_FOREIGN_KEYS = {("byte_id", BYTES_TABLE, "id", "CASCADE")}
+
+NEEDS_ANNOTATIONS = "Image auto-tag marks need the image annotation tables"
+INVALID_SCHEMA = "Image auto-tag marks have an invalid schema"
+INVALID_VALUES = "Image auto-tag marks contain invalid values"
+MISSING = "Missing image auto-tag marks schema"
+
+
+def _compact(sql: str) -> str:
+    return re.sub(r"\s+", "", sql).lower()
+
+
+def _catalog(conn: sqlite3.Connection) -> list:
+    return conn.execute(
+        "SELECT type,name,sql FROM sqlite_master WHERE name=? OR tbl_name=?",
+        (AUTOTAG_TABLE, AUTOTAG_TABLE),
+    ).fetchall()
+
+
+def autotag_without_annotations_error(conn: sqlite3.Connection) -> Optional[str]:
+    """Catalog only: the marks table present without its annotation tables.
+
+    Startup asks this before the annotation group installs, which would make
+    a marks table copied without it look valid. It reads no rows.
+    """
+    if not _catalog(conn):
+        return None
+    present = {
+        name for kind, name, _sql in _annotation_catalog(conn) if kind == "table"
+    }
+    if present != set(ANNOTATION_TABLES):
+        return NEEDS_ANNOTATIONS
+    return None
+
+
+def autotag_schema_error(
+    conn: sqlite3.Connection,
+    *,
+    allow_missing: bool = True,
+    annotations_valid: bool = False,
+) -> Optional[str]:
+    """Reject an unsupported marks table or invalid marks; reads only.
+
+    A database without the table is acceptable for backups that predate it
+    unless ``allow_missing`` is false. A present table requires a present,
+    valid image annotation group; ``annotations_valid`` says the caller has
+    just validated it (startup's annotation install), so only its presence is
+    checked again.
+    """
+    objects = _catalog(conn)
+    if not objects:
+        return None if allow_missing else MISSING
+    if annotations_valid:
+        if autotag_without_annotations_error(conn):
+            return NEEDS_ANNOTATIONS
+    elif annotation_schema_error(conn, allow_missing=False):
+        return NEEDS_ANNOTATIONS
+    actual = {(kind, name, _compact(sql or "")) for kind, name, sql in objects}
+    if actual != {("table", AUTOTAG_TABLE, _compact(_DDL))}:
+        return INVALID_SCHEMA
+    columns = [
+        (row[0], row[1], row[2].upper(), row[3], row[4], row[5])
+        for row in conn.execute(f"PRAGMA table_info({AUTOTAG_TABLE})")
+    ]
+    if columns != _COLUMNS:
+        return INVALID_SCHEMA
+    foreign_keys = {
+        (row[3], row[2], row[4], row[6])
+        for row in conn.execute(f"PRAGMA foreign_key_list({AUTOTAG_TABLE})")
+    }
+    if foreign_keys != _FOREIGN_KEYS:
+        return INVALID_SCHEMA
+    # Only this module's constants are interpolated into the SQL below.
+    if conn.execute(
+        f"SELECT 1 FROM {AUTOTAG_TABLE} "  # nosec B608
+        f"WHERE NOT ({_uuid('byte_id')}) LIMIT 1"
+    ).fetchone():
+        return INVALID_VALUES
+    if conn.execute(f"PRAGMA foreign_key_check({AUTOTAG_TABLE})").fetchone():
+        return INVALID_VALUES
+    return None
+
+
+def migrate_autotag_state(conn: sqlite3.Connection) -> None:
+    """Install the table atomically; validate before and after creating it.
+
+    Runs after ``migrate_annotation_state`` (which has just validated the
+    annotation group). Creates one empty table: no row is read or copied.
+    """
+    conn.execute("SAVEPOINT media_autotag_schema")
+    try:
+        error = autotag_schema_error(conn, annotations_valid=True)
+        if error:
+            raise sqlite3.DatabaseError(error)
+        conn.execute(_DDL.replace("CREATE TABLE", "CREATE TABLE IF NOT EXISTS", 1))
+        error = autotag_schema_error(conn, allow_missing=False, annotations_valid=True)
+        if error:
+            raise sqlite3.DatabaseError(error)
+        conn.execute("RELEASE media_autotag_schema")
+    except BaseException:
+        conn.execute("ROLLBACK TO media_autotag_schema")
+        conn.execute("RELEASE media_autotag_schema")
+        raise
@@ -0,0 +1,201 @@
+"""Atomic replacement of one imported category (#221, #249 System S10).
+
+The LoRA reference import used to delete its whole category and then save
+each record in its own transaction, so a failure part way left the previous
+collection deleted and the new one partial. ``replace_category_prompts``
+does both in one ``BEGIN IMMEDIATE`` transaction: the category's current
+prompts (with their tags and image links) are replaced by the staged
+records, or, on any error, nothing changes.
+
+A staged record is ``{text, hash, tags, images}``. A record whose hash a
+prompt outside the category already has links its images to that prompt
+(the legacy import did the same); a second record with the hash of an
+earlier one links its images to that one. Neither is a new prompt.
+"""
+
+from typing import Any, Dict, List, Optional, Sequence
+
+try:
+    from .maintenance import PlanChanged
+    from .pairs import PairDependencyError
+    from .workflow_documents import documents_of_rows, release_documents
+except ImportError:  # pragma: no cover - flat test imports
+    from database.maintenance import PlanChanged
+    from database.pairs import PairDependencyError
+    from database.workflow_documents import documents_of_rows, release_documents
+
+
+class EmptyReplacement(ValueError):
+    """The replacement has no record and would remove every current import."""
+
+
+# The category's prompt ids, as a subquery (one bound parameter).
+_IN_CATEGORY = "SELECT id FROM prompts WHERE category = ?"
+
+# Each record's outcome and the result counter it adds to.
+_COUNTERS = {"imported": "imported", "linked": "linked", "duplicate": "duplicates"}
+
+
+def _placeholders(values: Sequence[Any]) -> str:
+    return ",".join("?" * len(values))
+
+
+class CategoryImportOperations:
+    """Read the state of an imported category and replace it atomically."""
+
+    def category_import_state(self, category: str) -> Dict[str, Any]:
+        """``{ids, paired}``: the category's prompt ids (ascending) and how
+        many of them a saved pair uses (those block a replacement)."""
+        with self.model.get_connection() as conn:
+            ids = [
+                row[0]
+                for row in conn.execute(
+                    "SELECT id FROM prompts WHERE category = ? ORDER BY id",
+                    (category,),
+                ).fetchall()
+            ]
+            paired = conn.execute(
+                "SELECT COUNT(*) FROM prompts WHERE category = ? AND id IN "
+                "(SELECT positive_prompt_id FROM prompt_pairs UNION "
+                "SELECT negative_prompt_id FROM prompt_pairs)",
+                (category,),
+            ).fetchone()[0]
+        return {"ids": ids, "paired": paired}
+
+    def existing_prompt_hashes(
+        self, hashes: Sequence[str], exclude_category: str
+    ) -> set:
+        """The given hashes a prompt outside ``exclude_category`` already has."""
+        found = set()
+        wanted = list(dict.fromkeys(hashes))
+        with self.model.get_connection() as conn:
+            for start in range(0, len(wanted), 500):
+                chunk = wanted[start : start + 500]
+                rows = conn.execute(
+                    f"SELECT hash FROM prompts WHERE hash IN ({_placeholders(chunk)}) "
+                    "AND (category IS NULL OR category != ?)",
+                    [*chunk, exclude_category],
+                ).fetchall()
+                found.update(row[0] for row in rows)
+        return found
+
+    def replace_category_prompts(
+        self,
+        category: str,
+        records: List[Dict[str, Any]],
+        *,
+        expected_ids: Optional[List[int]] = None,
+        allow_empty: bool = False,
+    ) -> Dict[str, Any]:
+        """Replace every prompt of ``category`` with ``records`` in one transaction.
+
+        Raises (and changes nothing): ``PlanChanged`` when ``expected_ids`` is
+        given and the category's prompt ids differ from it;
+        ``PairDependencyError`` when a saved pair uses one of its prompts;
+        ``EmptyReplacement`` when ``records`` is empty while the category has
+        prompts, unless ``allow_empty`` (an empty replacement that was
+        reviewed). Any other error rolls everything back too.
+
+        Returns ``{removed, imported, linked, duplicates, images, rows}``:
+        prompts removed and created, records linked to an existing prompt or
+        to an earlier record with the same text, image links added, and per
+        record ``{name, outcome}`` (``imported``/``linked``/``duplicate``).
+        """
+        with self._pair_transaction() as conn:
+            ids = [
+                row[0]
+                for row in conn.execute(
+                    "SELECT id FROM prompts WHERE category = ? ORDER BY id",
+                    (category,),
+                ).fetchall()
+            ]
+            if expected_ids is not None and ids != list(expected_ids):
+                raise PlanChanged("The imported prompts changed since the review")
+            if not records and ids and not allow_empty:
+                raise EmptyReplacement(
+                    "Nothing to import; the previous imports were kept"
+                )
+            self._ensure_category_unpaired(conn, category)
+            removed = self._delete_category_rows(conn, category, ids)
+            result = {
+                "removed": removed,
+                "imported": 0,
+                "linked": 0,
+                "duplicates": 0,
+                "images": 0,
+                "rows": [],
+            }
+            created = {}
+            for record in records:
+                self._import_record(conn, category, record, created, result)
+            return result
+
+    def _delete_category_rows(self, conn, category: str, ids: List[int]) -> int:
+        """Delete the category's prompts with their image links and tags.
+
+        No commit. The rows are selected by category (just verified against
+        ``ids`` under the write lock), so no statement binds one parameter per
+        prompt and SQLite's variable limit never caps a collection.
+        """
+        if not ids:
+            return 0
+        documents = documents_of_rows(conn, "prompt_id", ids)  # chunked
+        conn.execute(
+            f"DELETE FROM generated_images WHERE prompt_id IN ({_IN_CATEGORY})",
+            (category,),
+        )
+        release_documents(conn, documents)
+        conn.execute(
+            f"DELETE FROM prompt_tags WHERE prompt_id IN ({_IN_CATEGORY})",
+            (category,),
+        )
+        return conn.execute(
+            "DELETE FROM prompts WHERE category = ?", (category,)
+        ).rowcount
+
+    @staticmethod
+    def _ensure_category_unpaired(conn, category: str) -> None:
+        """Raise PairDependencyError when a saved pair uses a category prompt."""
+        row = conn.execute(
+            f"SELECT id FROM prompt_pairs WHERE positive_prompt_id IN ({_IN_CATEGORY}) "
+            f"OR negative_prompt_id IN ({_IN_CATEGORY}) LIMIT 1",
+            (category, category),
+        ).fetchone()
+        if row:
+            raise PairDependencyError(
+                f"Prompt belongs to saved pair {row[0]}; delete the pair first "
+                "or save changed text as a new prompt"
+            )
+
+    def _import_record(self, conn, category, record, created, result) -> None:
+        """Save one staged record on ``conn``, or link it to the prompt it repeats."""
+        prompt_hash = record["hash"]
+        name = record.get("name") or record["text"]
+        if prompt_hash in created:
+            prompt_id, outcome = created[prompt_hash], "duplicate"
+        else:
+            row = conn.execute(
+                "SELECT id FROM prompts WHERE hash = ?", (prompt_hash,)
+            ).fetchone()
+            if row is not None:
+                prompt_id, outcome = row[0], "linked"
+            else:
+                prompt_id = self._insert_prompt(
+                    conn,
+                    record["text"],
+                    category,
+                    list(record.get("tags") or []),
+                    None,
+                    None,
+                    prompt_hash,
+                )
+                outcome = "imported"
+            created[prompt_hash] = prompt_id
+        result[_COUNTERS[outcome]] += 1
+        # Linked last to first: every workspace list shows a prompt's media
+        # newest link first, so the record's first image (the LoRA cover,
+        # #355) is the one a Library card shows.
+        for image in reversed(record.get("images") or []):
+            if self._insert_image_link(conn, prompt_id, image):
+                result["images"] += 1
+        result["rows"].append({"name": name, "outcome": outcome})
@@ -11,6 +11,8 @@ IMMEDIATE`` transaction, so no row ever names a deleted file:
 - its favorite;
 - its image tags (``media_image_tags`` of its byte record), joined onto the
  kept copy's byte record as their union, in order;
+- its own image category (#332), copied to the kept copy when that copy has
+  none; the removed copy's row is kept, so a give-back loses nothing;
 - its pending Needs review items, settled: only an item still ``pending`` at
  revision 0 with no decision row is removed (``review._SETTLE_ITEM``), so a
  decided item is never touched.
@@ -22,6 +24,8 @@ import os

 from .annotation_schema import BYTES_TABLE, FILES_TABLE
 from .annotations import _BUMP_INDEX
+from .image_categories import COPY_SQL as COPY_CATEGORY_SQL
+from .image_categories import copy_image_category
 from .models import normalize_image_path, utc_now_iso
 from .review import _BUMP_REVIEW_INDEX, _PENDING_OF_LOCATOR, _SETTLE_ITEM
 from .review_changes import notify_review_change
@@ -76,6 +80,7 @@ FILE_LINK_SQL = (
    COPY_BYTE_SQL,
    COPY_TAG_COUNT_SQL,
    PENDING_COUNT_SQL,
+    COPY_CATEGORY_SQL,
 )


@@ -137,8 +142,10 @@ class DuplicateCopyOperations:
        removed key, kept root key, kept key)`` per listed root holding the
        file), ``removed_locator``,
        ``kept_locator``, ``sha256`` and the kept copy's ``kept_size`` and
-        ``kept_mtime_ns``. Returns ``{moved, merged, favorites, tags,
-        review}``.
+        ``kept_mtime_ns``; ``categories``: ``(removed file key, kept file
+        key)`` pairs of the image categories (#332). Returns ``{moved,
+        merged, favorites, tags, review, categories}`` (``categories``: the
+        image categories copied to the kept copy).
        """
        counts = dict.fromkeys(("moved", "merged", "favorites", "tags", "review"), 0)
        kept_keys = [normalize_image_path(path) for path in move["kept"]]
@@ -174,6 +181,10 @@ class DuplicateCopyOperations:
            for favorite in move.get("favorites", ()):
                counts["favorites"] += _move_favorite(conn, *favorite)
            counts["tags"] = self._move_copy_tags(conn, move)
+            counts["categories"] = sum(
+                copy_image_category(conn, removed, kept)
+                for removed, kept in move.get("categories", ())
+            )
            for (item_id,) in conn.execute(
                _PENDING_OF_LOCATOR, (move["removed_locator"],)
            ).fetchall():
@@ -196,3 +196,14 @@ class ExecutionHistoryOperations:
            .fetchone()
        )
        return dict(row) if row is not None else None
+
+
+def rekey_history_restore(old_path: str, new_path: str) -> None:
+    """Move the observers of ``old_path`` to ``new_path`` (Move library)."""
+    old, new = _database_identity(old_path), _database_identity(new_path)
+    if old == new:
+        return
+    with _restore_lock:
+        observers = _restore_observers.pop(old, None)
+        if observers:
+            _restore_observers.setdefault(new, {}).update(observers)
@@ -4,6 +4,8 @@ import sqlite3
 from contextlib import ExitStack
 from typing import Callable, ContextManager

+from .run_attribution import notify_outputs_sealed
+
 try:
    from ..utils.execution_history_events import RunFinish, encode_command
    from ..utils.execution_outputs import OutputBundle, validate_output_bundle
@@ -113,6 +115,10 @@ class ExecutionOutputOperations:
                    "VALUES(?,?,?,?,?,?,?,?)",
                    [(run_id, *reference) for reference in prepared],
                )
+        # Committed: images waiting for this run may now be attributed (#342)
+        notify_outputs_sealed(
+            run_id, [dict(zip(_REFERENCE_FIELDS, row)) for row in prepared]
+        )
        return True

    def get_execution_outputs(self, run_id: str) -> dict:
@@ -0,0 +1,249 @@
+"""Image categories (#332): an image file's own category.
+
+An image shows its own category when it has one, otherwise the category its
+link supplies (its recipe's, else its positive prompt's); this table holds
+only the own values. A row is keyed by the file key: the deepest configured
+output source that contains the file (its real, case-normalized path) and the
+path below it, case-folded where the OS folds case
+(``py/api/images.py`` ``image_category_key``). Without nested sources the key
+equals a favorite's key. Nothing follows a moved file: its row stays and is
+hidden until a file appears at the same path again.
+
+Writes validate strictly (the route strips the value and applies
+``validate_category``). Startup checks the structure only, so a value saved
+under older rules never stops the library opening; restore also checks the
+values. Optional in old backups, required once a database is current.
+"""
+
+import re
+import sqlite3
+from typing import Iterable
+
+TABLE = "image_categories"
+INDEX = "idx_image_categories_category"
+MAX_KEY_LENGTH = 4096
+MAX_CATEGORY_LENGTH = 100
+_DDL = (
+    f"CREATE TABLE {TABLE} (root_key TEXT NOT NULL, relative_path TEXT NOT NULL, "
+    "category TEXT NOT NULL, updated_at TEXT NOT NULL, "
+    "PRIMARY KEY (root_key, relative_path))"
+)
+_INDEX_DDL = f"CREATE INDEX {INDEX} ON {TABLE}(category)"
+_AUTOINDEX = f"sqlite_autoindex_{TABLE}_1"
+_COLUMNS = (
+    ("root_key", "TEXT", 1, 1),
+    ("relative_path", "TEXT", 1, 2),
+    ("category", "TEXT", 1, 0),
+    ("updated_at", "TEXT", 1, 0),
+)
+# A category may not hold a character below U+0020 (validate_category).
+_CONTROL_GLOB = "*[" + "".join(chr(code) for code in range(1, 32)) + "]*"
+
+CATEGORY_OF_SQL = (
+    f"SELECT category FROM {TABLE} WHERE root_key = ? AND relative_path = ?"
+)
+CATEGORIES_OF_ROOT_SQL = (
+    f"SELECT relative_path, category FROM {TABLE} WHERE root_key = ?"
+)
+UPSERT_SQL = (
+    f"INSERT INTO {TABLE} (root_key, relative_path, category, updated_at) "
+    "VALUES (?, ?, ?, ?) ON CONFLICT(root_key, relative_path) "
+    "DO UPDATE SET category = excluded.category, updated_at = excluded.updated_at"
+)
+DELETE_SQL = f"DELETE FROM {TABLE} WHERE root_key = ? AND relative_path = ?"
+# The duplicate cleanup's copy (#332 MC11): the removed copy's row is copied
+# to the kept copy only when the kept copy has none; it is never deleted.
+COPY_SQL = (
+    f"INSERT OR IGNORE INTO {TABLE} (root_key, relative_path, category, updated_at) "
+    f"SELECT ?, ?, category, updated_at FROM {TABLE} "
+    "WHERE root_key = ? AND relative_path = ?"
+)
+STATEMENTS = (CATEGORY_OF_SQL, CATEGORIES_OF_ROOT_SQL, UPSERT_SQL, DELETE_SQL, COPY_SQL)
+
+
+def _compact(sql: str) -> str:
+    return re.sub(r"\s+", "", sql or "").lower()
+
+
+def _structure_error(
+    conn: sqlite3.Connection, allow_missing: bool, allow_missing_index: bool = False
+) -> str | None:
+    objects = conn.execute(
+        "SELECT type,name,sql FROM sqlite_master WHERE name=? "
+        "OR (type IN ('index','trigger') AND tbl_name=?)",
+        (TABLE, TABLE),
+    ).fetchall()
+    if not objects:
+        return None if allow_missing else "Missing image categories schema"
+    tables = [sql for kind, _name, sql in objects if kind == "table"]
+    others = {(kind, name) for kind, name, _sql in objects if kind != "table"}
+    expected = {("index", _AUTOINDEX), ("index", INDEX)}
+    # Before its install, a table without the category index is repaired by
+    # CREATE INDEX IF NOT EXISTS rather than refused.
+    if allow_missing_index and others == {("index", _AUTOINDEX)}:
+        expected = others
+    if len(tables) != 1 or others != expected:
+        return "Image categories name is reserved by an unsupported schema object"
+    if _compact(tables[0]) != _compact(_DDL):
+        return "Image categories has an invalid table definition"
+    index_sql = next((sql for kind, name, sql in objects if name == INDEX), None)
+    if ("index", INDEX) in expected and _compact(index_sql) != _compact(_INDEX_DDL):
+        return "Image categories has an invalid index"
+    autoindex_sql = next(sql for kind, name, sql in objects if name == _AUTOINDEX)
+    if autoindex_sql is not None:
+        return "Image categories has an invalid index"
+    columns = tuple(
+        (row[1], row[2].upper(), row[3], row[5])
+        for row in conn.execute(f"PRAGMA table_info({TABLE})")
+    )
+    if columns != _COLUMNS:
+        return "Image categories has invalid columns"
+    return None
+
+
+def _values_error(conn: sqlite3.Connection) -> str | None:
+    # Bytes bound characters from above (UTF-8 is at most 4 bytes each).
+    limit = MAX_KEY_LENGTH * 4
+    if conn.execute(
+        f"SELECT 1 FROM {TABLE} WHERE typeof(root_key) != 'text' "  # nosec B608
+        "OR typeof(relative_path) != 'text' OR typeof(category) != 'text' "
+        "OR typeof(updated_at) != 'text' "
+        f"OR length(CAST(root_key AS BLOB)) > {limit} "
+        f"OR length(CAST(relative_path AS BLOB)) > {limit} "
+        "OR length(CAST(updated_at AS BLOB)) > 64 "
+        "OR instr(CAST(category AS BLOB), x'00') > 0 "
+        f"OR length(category) < 1 OR length(category) > {MAX_CATEGORY_LENGTH} "
+        "OR category != TRIM(category) OR category GLOB ? LIMIT 1",
+        (_CONTROL_GLOB,),
+    ).fetchone():
+        return "Image categories contains invalid values"
+    for root, path in conn.execute(
+        f"SELECT CAST(root_key AS BLOB), CAST(relative_path AS BLOB) "  # nosec B608
+        f"FROM {TABLE} WHERE length(CAST(root_key AS BLOB)) > {MAX_KEY_LENGTH} "
+        f"OR length(CAST(relative_path AS BLOB)) > {MAX_KEY_LENGTH}"
+    ):
+        for raw in (root, path):
+            if len(bytes(raw).decode("utf-8", "replace")) > MAX_KEY_LENGTH:
+                return "Image categories contains invalid values"
+    return None
+
+
+def image_categories_schema_error(
+    conn: sqlite3.Connection,
+    *,
+    allow_missing: bool = True,
+    check_values: bool = True,
+) -> str | None:
+    """Reject an unsupported image categories schema (and, optionally, values).
+
+    Reads only. A missing table is acceptable for backups that predate it
+    unless ``allow_missing`` is false. ``check_values`` also refuses a stored
+    value the write path could never have written.
+    """
+    error = _structure_error(conn, allow_missing)
+    if error is not None or not check_values:
+        return error
+    exists = conn.execute(
+        "SELECT 1 FROM sqlite_master WHERE type='table' AND name=?", (TABLE,)
+    ).fetchone()
+    return _values_error(conn) if exists else None
+
+
+def migrate_image_categories(conn: sqlite3.Connection) -> None:
+    """Install the table and its index atomically; structure is checked
+    before and after. Reads only ``sqlite_master`` and this table's PRAGMAs
+    and writes only its own two objects (no backfill)."""
+    conn.execute("SAVEPOINT image_categories_schema")
+    try:
+        error = _structure_error(conn, True, allow_missing_index=True)
+        if error:
+            raise sqlite3.DatabaseError(error)
+        conn.execute(_DDL.replace("CREATE TABLE", "CREATE TABLE IF NOT EXISTS", 1))
+        conn.execute(
+            _INDEX_DDL.replace("CREATE INDEX", "CREATE INDEX IF NOT EXISTS", 1)
+        )
+        error = image_categories_schema_error(
+            conn, allow_missing=False, check_values=False
+        )
+        if error:
+            raise sqlite3.DatabaseError(error)
+        conn.execute("RELEASE image_categories_schema")
+    except BaseException:
+        conn.execute("ROLLBACK TO image_categories_schema")
+        conn.execute("RELEASE image_categories_schema")
+        raise
+
+
+def copy_image_category(conn: sqlite3.Connection, removed_key, kept_key) -> int:
+    """Give the kept copy the removed copy's category when it has none.
+
+    Runs inside the caller's transaction; never deletes the removed copy's
+    row, so a give-back or a failed delete loses nothing. Returns 1 when a
+    row was inserted, else 0.
+    """
+    if tuple(removed_key) == tuple(kept_key):
+        return 0
+    return max(conn.execute(COPY_SQL, (*kept_key, *removed_key)).rowcount, 0)
+
+
+class ImageCategoryOperations:
+    """PromptDatabase mixin: set, clear and read images' own categories.
+
+    Never reads or writes ``prompts``, ``prompt_pairs`` or
+    ``generated_images``.
+    """
+
+    def image_category(self, root_key: str, relative_key: str) -> str | None:
+        """One file's own category, or None."""
+        row = (
+            self.model.get_connection()
+            .execute(CATEGORY_OF_SQL, (root_key, relative_key))
+            .fetchone()
+        )
+        return row[0] if row else None
+
+    def own_categories_of(self, root_keys: Iterable[str]) -> dict:
+        """``{(root key, relative key): category}`` under the given sources.
+
+        One primary-key range read per source.
+        """
+        found = {}
+        conn = self.model.get_connection()
+        for root_key in dict.fromkeys(root_keys):
+            for relative, category in conn.execute(CATEGORIES_OF_ROOT_SQL, (root_key,)):
+                found[(root_key, relative)] = category
+        return found
+
+    def set_image_categories(self, file_keys, category: str) -> dict:
+        """Set *category* on every file key, in one transaction.
+
+        ``file_keys``: ``(root key, relative key)`` pairs from any number of
+        sources. Returns ``{updated, unchanged}``; a file that already had
+        exactly this value is ``unchanged`` and keeps its ``updated_at``.
+        """
+        from .models import utc_now_iso  # models imports this module's schema
+
+        keys = list(dict.fromkeys(tuple(key) for key in file_keys))
+        counts = {"updated": 0, "unchanged": 0}
+        now = utc_now_iso()
+        with self._pair_transaction() as conn:
+            for key in keys:
+                row = conn.execute(CATEGORY_OF_SQL, key).fetchone()
+                if row is not None and row[0] == category:
+                    counts["unchanged"] += 1
+                    continue
+                conn.execute(UPSERT_SQL, (*key, category, now))
+                counts["updated"] += 1
+        return counts
+
+    def clear_image_categories(self, file_keys) -> int:
+        """Remove the own category of every file key (one transaction).
+
+        Returns the number of rows removed.
+        """
+        keys = list(dict.fromkeys(tuple(key) for key in file_keys))
+        removed = 0
+        with self._pair_transaction() as conn:
+            for key in keys:
+                removed += conn.execute(DELETE_SQL, key).rowcount
+        return removed
@@ -0,0 +1,805 @@
+"""Move library (#249 S6b): copy the node-folder library, verify it, switch.
+
+``plan_move`` checks a ``utils.library_location`` location can move and
+sizes the copy; ``move_library`` does it, in this order:
+
+1. **Disk check** on the target's volume (the copy, the backups and
+   config.json, plus a margin). The source is never renamed across folders,
+   so another drive is simply a copy.
+2. **Copy** with SQLite's backup API from a private connection holding one
+   read transaction: the per-table counts, the workflow documents' digest
+   and ``PRAGMA data_version`` describe exactly the copied snapshot. The copy
+   is a temp file in the target folder, made self-contained
+   (``journal_mode=DELETE``), fsynced and owner-only.
+3. **Verify**: ``verify_database_file`` (integrity check, schema, every
+   workflow document decompressed against its hash, #315), the same row
+   count in every table and the same documents.
+4. **Copy files**: every pooled safety backup and pre-migration backup,
+   checked by size and SHA-256 after the copy (their times are kept, so the
+   pool prunes in the same order).
+5. **Publish** under the old database's write lock (``BEGIN IMMEDIATE``) and
+   the config.json lock: if any other connection wrote since the snapshot
+   (``data_version``), steps 2–4 run again (``attempts``, then
+   ``library-busy``). Else config.json is copied (owner-only, checked), a
+   ``pending`` marker is written, the temp files take their final names
+   (``os.replace`` inside the target folder), the marker turns ``moved``
+   and ``switch`` points the process at the new library while the old file
+   is still locked, so no write can land in it.
+6. **Retire**: the old file's WAL is checkpointed and the old ``prompts.db``
+   and ``config.json`` are renamed ``*.moved-to-<folder>`` (never deleted;
+   the old backups stay where they are). A file still open elsewhere is left
+   in place and reported (``old-in-use``): the marker already makes a restart
+   use the new library.
+
+Any failure before the marker says ``moved`` removes everything the move
+wrote in the target folder and leaves the old library in use, untouched.
+A crash at any point leaves either the old library in use (the marker is
+absent or ``pending``; the next move replaces its own leftovers) or the new
+one (``moved``). ``MoveFailed`` carries a code and a message without paths.
+"""
+
+import contextlib
+import hashlib
+import json
+import os
+import shutil
+import sqlite3
+import time
+import types
+import uuid
+from pathlib import Path
+from dataclasses import dataclass, field
+from typing import Callable, Dict, List, Optional, Tuple
+
+from .models import BUSY_TIMEOUT_SECONDS, PromptModel
+
+try:
+    from ..utils import library_location as ll
+    from ..utils.logging_config import get_logger
+except ImportError:
+    from utils import library_location as ll
+    from utils.logging_config import get_logger
+
+logger = get_logger("prompt_manager.database.library_move")
+
+TEMP_PREFIX = ".pm-move-"
+MOVED_INFIX = ".moved-to-"
+DISK_MARGIN_BYTES = 16 * 2**20
+DEFAULT_ATTEMPTS = 3
+_COPY_CHUNK = 4 * 2**20
+# Backups that live beside the database and move with it.
+BACKUP_INFIXES = (".backup_", ".pre-workflow-storage_")
+
+MESSAGES = {
+    "not-movable": (
+        "This library is not in the node folder, so there is nothing to move."
+    ),
+    "same-folder": "The new folder is the node folder itself.",
+    "target-invalid": "The new folder cannot hold the library.",
+    "target-has-library": (
+        "The new folder already holds a Prompt Manager library. Nothing was moved."
+    ),
+    "target-conflict": (
+        "The new folder already holds files with the same names. Nothing was moved."
+    ),
+    "insufficient-space": (
+        "There is not enough free space for the copy. Nothing was moved."
+    ),
+    "copy-failed": "The copy could not be written or did not match. Nothing was moved.",
+    "verify-failed": "The copy did not pass verification. Nothing was moved.",
+    "library-busy": (
+        "Prompt Manager kept writing to the library while it was copied. "
+        "Nothing was moved; try again when no workflow is running."
+    ),
+    "switch-failed": (
+        "Prompt Manager could not switch to the verified copy, so the copy was "
+        "removed. Nothing was moved."
+    ),
+}
+
+
+class MoveFailed(Exception):
+    """A move that did not happen (or did not finish), with a coded reason."""
+
+    def __init__(self, code: str, message: Optional[str] = None):
+        self.code = code
+        self.message = message or MESSAGES.get(code, "The library was not moved.")
+        super().__init__(self.message)
+
+
+@dataclass(frozen=True)
+class MovePlan:
+    location: "ll.LibraryLocation"
+    db_path: str
+    source_dir: str
+    target_dir: str
+    config_path: Optional[str]
+    backups: Tuple[str, ...]
+    db_bytes: int
+    files_bytes: int
+
+    @property
+    def required_bytes(self) -> int:
+        return self.db_bytes + self.files_bytes + DISK_MARGIN_BYTES
+
+    @property
+    def target_location(self) -> "ll.LibraryLocation":
+        """Where the library is once moved (an explicit config.json stays)."""
+        source = self.location.target_source or ll.SOURCE_DEFAULT
+        config = (
+            self.location.config_path
+            if self.location.config_explicit
+            else os.path.join(self.target_dir, ll.CONFIG_NAME)
+        )
+        return ll.LibraryLocation(
+            source,
+            os.path.join(self.target_dir, ll.DATABASE_NAME),
+            config,
+            self.target_dir,
+            self.target_dir,
+            None,
+            source,
+            self.location.config_explicit,
+        )
+
+
+@dataclass
+class MoveResult:
+    location: "ll.LibraryLocation"
+    counts: Dict[str, int]
+    files: List[str]
+    renamed: List[str] = field(default_factory=list)
+    retire_problem: Optional[str] = None
+
+
+def _size(path: str) -> int:
+    try:
+        return os.path.getsize(path)
+    except OSError:
+        return 0
+
+
+def _free_bytes(path: str) -> int:
+    return shutil.disk_usage(path).free
+
+
+def _existing_ancestor(path: str) -> str:
+    current = os.path.abspath(path)
+    while not os.path.isdir(current):
+        parent = os.path.dirname(current)
+        if parent == current:
+            break
+        current = parent
+    return current
+
+
+def backup_names(db_path: str) -> Tuple[str, ...]:
+    """The pooled and pre-migration backups beside ``db_path`` (names)."""
+    folder = os.path.dirname(os.path.abspath(db_path))
+    base = os.path.basename(db_path)
+    prefixes = tuple(base + infix for infix in BACKUP_INFIXES)
+    try:
+        names = os.listdir(folder)
+    except OSError:
+        return ()
+    return tuple(
+        sorted(
+            name
+            for name in names
+            if name.startswith(prefixes) and os.path.isfile(os.path.join(folder, name))
+        )
+    )
+
+
+def plan_move(location) -> MovePlan:
+    """Check ``location`` can move to its target; raises MoveFailed."""
+    if not location.movable:
+        raise MoveFailed("not-movable")
+    target = os.path.abspath(location.target_dir)
+    source_dir = os.path.dirname(os.path.abspath(location.db_path))
+    if ll.same_folder(target, source_dir) or os.path.normcase(
+        os.path.realpath(target)
+    ) == os.path.normcase(os.path.realpath(source_dir)):
+        raise MoveFailed("same-folder")
+    if os.path.exists(target) and not os.path.isdir(target):
+        raise MoveFailed("target-invalid")
+    backups = backup_names(location.db_path)
+    # config.json moves with a node-folder library; one named by
+    # PROMPT_MANAGER_CONFIG_PATH is the user's and stays where it is.
+    config = None if location.config_explicit else location.config_path
+    config = config if config and os.path.isfile(config) else None
+    if ll.read_marker(target).get("state") != ll.MARKER_PENDING:
+        if os.path.exists(os.path.join(target, ll.DATABASE_NAME)):
+            raise MoveFailed("target-has-library")
+        names = [ll.CONFIG_NAME] if config else []
+        if any(os.path.exists(os.path.join(target, n)) for n in names + list(backups)):
+            raise MoveFailed("target-conflict")
+    db_bytes = _size(location.db_path) + _size(location.db_path + "-wal")
+    files_bytes = sum(_size(os.path.join(source_dir, n)) for n in backups)
+    files_bytes += _size(config) if config else 0
+    return MovePlan(
+        location,
+        os.path.abspath(location.db_path),
+        source_dir,
+        target,
+        config,
+        backups,
+        db_bytes,
+        files_bytes,
+    )
+
+
+def space_problem(plan: MovePlan) -> Optional[Tuple[int, int]]:
+    """``(required, free)`` when the target's volume is short, else None."""
+    free = _free_bytes(_existing_ancestor(plan.target_dir))
+    if free < plan.required_bytes:
+        return plan.required_bytes, free
+    return None
+
+
+# ── copy and verify ───────────────────────────────────────────────────
+
+
+def _tables(conn) -> List[str]:
+    return [
+        row[0]
+        for row in conn.execute(
+            "SELECT name FROM sqlite_master WHERE type='table' "
+            "AND name NOT LIKE 'sqlite_%' ORDER BY name"
+        )
+    ]
+
+
+def _describe(conn) -> Tuple[Dict[str, int], str]:
+    """Row counts per table and a digest of the workflow documents."""
+    counts = {}
+    for table in _tables(conn):
+        # A name read from sqlite_master, quoted as an identifier.
+        quoted = '"' + table.replace('"', '""') + '"'
+        sql = f"SELECT COUNT(*) FROM {quoted}"  # nosec B608
+        counts[table] = conn.execute(sql).fetchone()[0]
+    digest = hashlib.sha256()
+    if "workflow_documents" in counts:
+        for row in conn.execute(
+            "SELECT id, sha256, byte_length FROM workflow_documents ORDER BY id"
+        ):
+            digest.update(repr((row[0], bytes(row[1]), row[2])).encode())
+    return counts, digest.hexdigest()
+
+
+def _fsync_file(path: str) -> None:
+    with open(path, "rb+") as handle:
+        os.fsync(handle.fileno())
+
+
+def _fsync_dir(path: str) -> None:
+    if os.name != "posix":
+        return
+    fd = os.open(path, os.O_RDONLY)
+    try:
+        os.fsync(fd)
+    finally:
+        os.close(fd)
+
+
+def _private(path: str) -> None:
+    if os.name == "posix":
+        os.chmod(path, 0o600)
+
+
+def _copy_snapshot(source: sqlite3.Connection, temp: str):
+    """Back up ``source``'s current snapshot to ``temp``; return what it holds."""
+    source.execute("BEGIN")
+    try:
+        version = source.execute("PRAGMA data_version").fetchone()[0]
+        counts, documents = _describe(source)
+        destination = sqlite3.connect(temp)
+        try:
+            source.backup(destination)
+        finally:
+            destination.close()
+    finally:
+        source.execute("COMMIT")
+    with contextlib.closing(sqlite3.connect(temp)) as conn:
+        conn.execute("PRAGMA journal_mode=DELETE").fetchone()
+    _fsync_file(temp)
+    _private(temp)
+    return version, counts, documents
+
+
+def _verify_copy(temp: str, counts, documents) -> None:
+    ok, reason = PromptModel.verify_database_file(temp)
+    if not ok:
+        logger.error(f"Library move: the copy did not verify: {reason}")
+        detail = reason if reason.startswith("Workflow document") else None
+        raise MoveFailed(
+            "verify-failed",
+            f"{MESSAGES['verify-failed']} {detail}" if detail else None,
+        )
+    uri = Path(os.path.abspath(temp)).as_uri() + "?mode=ro"
+    try:
+        with contextlib.closing(sqlite3.connect(uri, uri=True)) as conn:
+            copied = _describe(conn)
+    except sqlite3.Error as error:
+        logger.error(f"Library move: the copy could not be read: {error}")
+        raise MoveFailed("verify-failed") from error
+    if copied != (counts, documents):
+        logger.error("Library move: the copy's rows or documents differ")
+        raise MoveFailed("verify-failed")
+
+
+def _hash_copy(source: str, destination: str) -> Tuple[int, str]:
+    """Copy ``source`` to ``destination`` (fsynced, owner-only, times kept)."""
+    digest = hashlib.sha256()
+    size = 0
+    with open(source, "rb") as reader, open(destination, "wb") as writer:
+        while True:
+            chunk = reader.read(_COPY_CHUNK)
+            if not chunk:
+                break
+            digest.update(chunk)
+            size += len(chunk)
+            writer.write(chunk)
+        writer.flush()
+        os.fsync(writer.fileno())
+    stat = os.stat(source)
+    os.utime(destination, ns=(stat.st_atime_ns, stat.st_mtime_ns))
+    _private(destination)
+    return size, digest.hexdigest()
+
+
+def _file_digest(path: str) -> Tuple[int, str]:
+    digest = hashlib.sha256()
+    size = 0
+    with open(path, "rb") as reader:
+        while True:
+            chunk = reader.read(_COPY_CHUNK)
+            if not chunk:
+                return size, digest.hexdigest()
+            digest.update(chunk)
+            size += len(chunk)
+
+
+def _check_copies(copies) -> None:
+    for source, temp, expected in copies:
+        if _file_digest(temp) != expected or _file_digest(source) != expected:
+            logger.error(
+                f"Library move: {os.path.basename(source)} did not copy unchanged"
+            )
+            raise MoveFailed("copy-failed")
+
+
+def write_marker(
+    directory: str, state: str, source_db: str, source_config: Optional[str] = None
+) -> str:
+    """Atomically write the move marker; return its path.
+
+    ``from`` and ``config_from`` name the old files, so a restart after a
+    crash between the switch and the rename can finish the rename.
+    """
+    path = os.path.join(directory, ll.MARKER_NAME)
+    temp = os.path.join(directory, f"{TEMP_PREFIX}{uuid.uuid4().hex}.marker")
+    payload = json.dumps(
+        {
+            "version": 1,
+            "state": state,
+            "from": source_db,
+            "config_from": source_config,
+            "updated_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
+        },
+        indent=2,
+    ).encode("utf-8")
+    fd = os.open(temp, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+    try:
+        with os.fdopen(fd, "wb") as handle:
+            handle.write(payload)
+            handle.flush()
+            os.fsync(handle.fileno())
+        _private(temp)
+        os.replace(temp, path)
+    except BaseException:
+        _remove(temp)
+        raise
+    _fsync_dir(directory)
+    return path
+
+
+def _remove(*paths) -> None:
+    for path in paths:
+        try:
+            if path and os.path.lexists(path):
+                os.remove(path)
+        except OSError:
+            logger.warning(f"Library move: could not remove {os.path.basename(path)}")
+
+
+def sweep_move_temps(directory: str) -> List[str]:
+    """Remove the temp files an interrupted move left in ``directory``."""
+    removed = []
+    try:
+        names = os.listdir(directory)
+    except OSError:
+        return removed
+    for name in names:
+        if name.startswith(TEMP_PREFIX):
+            _remove(os.path.join(directory, name))
+            removed.append(name)
+    return removed
+
+
+# ── the move ─────────────────────────────────────────────────────────
+
+
+def _noop(*_args, **_kwargs):
+    return None
+
+
+def switch_process(old_db: str, location, detached: list) -> None:
+    """Point this process at ``location``: resolver, every model, observers.
+
+    Adds the old file's connections, detached and still open, to
+    ``detached`` as soon as they are detached, so the mover retires them
+    (``PromptModel.retire_detached``) whether or not the rest succeeds.
+    """
+    from .execution_history import rekey_history_restore
+    from .review_changes import rekey_review_changes
+
+    ll.switch_to(location)
+    detached.extend(PromptModel.repoint_instances(old_db, location.db_path))
+    rekey_review_changes(old_db, location.db_path)
+    rekey_history_restore(old_db, location.db_path)
+
+
+def unswitch_process(old_db: str, new_db: str) -> list:
+    """Undo ``switch_process`` (any part of it); returns detached connections."""
+    from .execution_history import rekey_history_restore
+    from .review_changes import rekey_review_changes
+
+    ll.clear_override()
+    detached = PromptModel.repoint_instances(new_db, old_db)
+    rekey_review_changes(new_db, old_db)
+    rekey_history_restore(new_db, old_db)
+    return detached
+
+
+class _Move:
+    def __init__(self, plan, *, switch, config_lock, progress, checkpoint):
+        self.plan = plan
+        self.switch = switch
+        self.config_lock = config_lock
+        self.progress = progress
+        self.checkpoint = checkpoint
+        self.created_dir = False
+        self.temps: List[str] = []
+        self.published: List[str] = []
+        self.marker: Optional[str] = None
+        self.moved = False
+        # Retired connections still in use; awaited once the locks are free.
+        self.retiring: list = []
+
+    def temp(self, suffix: str) -> str:
+        path = os.path.join(
+            self.plan.target_dir, f"{TEMP_PREFIX}{uuid.uuid4().hex}{suffix}"
+        )
+        self.temps.append(path)
+        return path
+
+    def prepare_target(self) -> None:
+        target = self.plan.target_dir
+        self.created_dir = not os.path.isdir(target)
+        ll.ensure_private_dir(target)
+        sweep_move_temps(target)
+        if ll.read_marker(target).get("state") == ll.MARKER_PENDING:
+            # An earlier move stopped before it switched: its files are ours.
+            for name in (ll.DATABASE_NAME, ll.CONFIG_NAME) + self.plan.backups:
+                _remove(os.path.join(target, name))
+            for suffix in ("-wal", "-shm", "-journal"):
+                _remove(os.path.join(target, ll.DATABASE_NAME + suffix))
+
+    def copy_round(self, source):
+        """Steps 2–4 once: the verified temp copies and the snapshot version."""
+        self.progress("Copying the database")
+        temp_db = self.temp(".db")
+        version, counts, documents = _copy_snapshot(source, temp_db)
+        self.checkpoint("copied")
+        self.progress("Verifying the copy")
+        _verify_copy(temp_db, counts, documents)
+        self.checkpoint("verified")
+        copies = []
+        for name in self.plan.backups:
+            src = os.path.join(self.plan.source_dir, name)
+            temp = self.temp(".bak")
+            try:
+                expected = _hash_copy(src, temp)
+            except OSError as error:
+                logger.error(f"Library move: copying {name} failed: {error}")
+                raise MoveFailed("copy-failed") from error
+            copies.append((src, temp, expected, name))
+        if copies:
+            self.progress(f"Copied {len(copies)} backup file(s)")
+        self.checkpoint("files")
+        _check_copies([(s, t, e) for s, t, e, _ in copies])
+        return version, counts, temp_db, copies
+
+    def discard_round(self, temp_db, copies) -> None:
+        _remove(temp_db, *[temp for _s, temp, _e, _n in copies])
+
+    def publish(self, temp_db, copies) -> List[str]:
+        """Under the locks: config.json, marker, final names, marker moved."""
+        target = self.plan.target_dir
+        files = []
+        if self.plan.config_path:
+            temp = self.temp(".config")
+            try:
+                expected = _hash_copy(self.plan.config_path, temp)
+            except OSError as error:
+                raise MoveFailed("copy-failed") from error
+            _check_copies([(self.plan.config_path, temp, expected)])
+            copies = copies + [(self.plan.config_path, temp, expected, ll.CONFIG_NAME)]
+        self.marker = write_marker(
+            target, ll.MARKER_PENDING, self.plan.db_path, self.plan.config_path
+        )
+        self.checkpoint("pending")
+        for _src, temp, _expected, name in copies:
+            final = os.path.join(target, name)
+            os.replace(temp, final)
+            self.published.append(final)
+            files.append(name)
+        final_db = os.path.join(target, ll.DATABASE_NAME)
+        os.replace(temp_db, final_db)
+        self.published.append(final_db)
+        files.append(ll.DATABASE_NAME)
+        _fsync_dir(target)
+        self.checkpoint("published")
+        write_marker(target, ll.MARKER_MOVED, self.plan.db_path, self.plan.config_path)
+        self.moved = True
+        self.checkpoint("marked")
+        return files
+
+    def cleanup(self) -> None:
+        if self.moved:
+            return
+        _remove(*self.temps, *self.published, self.marker)
+        if self.created_dir:
+            try:
+                os.rmdir(self.plan.target_dir)
+            except OSError:
+                pass
+
+
+def _unique(path: str) -> str:
+    candidate, number = path, 1
+    while os.path.lexists(candidate):
+        candidate = f"{path}_{number}"
+        number += 1
+    return candidate
+
+
+def retire_old_files(plan: MovePlan) -> Tuple[List[str], Optional[str]]:
+    """Rename the old database and config.json; ``(renamed, problem code)``.
+
+    Every connection to the old file must be closed. The WAL is checkpointed
+    first; when it cannot be emptied (another process still has the file
+    open) nothing is renamed (``old-in-use``).
+    """
+    old = plan.db_path
+    folder = os.path.basename(os.path.normpath(plan.target_dir))
+    try:
+        with contextlib.closing(sqlite3.connect(old, timeout=1)) as conn:
+            busy = conn.execute("PRAGMA wal_checkpoint(TRUNCATE)").fetchone()[0]
+    except sqlite3.Error as error:
+        logger.warning(
+            f"Library move: the old database could not be checkpointed: {error}"
+        )
+        return [], "old-in-use"
+    if busy or _size(old + "-wal") > 0:
+        return [], "old-in-use"
+    renamed = []
+    try:
+        for path in (old, plan.config_path):
+            if not path or not os.path.isfile(path):
+                continue
+            new_name = _unique(path + MOVED_INFIX + folder)
+            os.rename(path, new_name)
+            renamed.append(os.path.basename(new_name))
+        for suffix in ("-wal", "-shm"):
+            if os.path.isfile(old + suffix) and _size(old + suffix) == 0:
+                os.remove(old + suffix)
+    except OSError as error:
+        logger.warning(f"Library move: the old files could not be renamed: {error}")
+        return renamed, "old-locked"
+    return renamed, None
+
+
+def finish_interrupted_move(location) -> List[str]:
+    """Rename old files a crash left between the switch and the rename.
+
+    The marker of the folder in use says ``moved`` and names the old files;
+    an old ``prompts.db`` (and config.json) still there under its own name is
+    renamed ``*.moved-to-<folder>`` now, never deleted. Returns the new
+    names (nothing when there is nothing to finish or the file is in use).
+    """
+    if location.source not in (ll.SOURCE_DEFAULT, ll.SOURCE_ENVIRONMENT):
+        return []
+    marker = ll.read_marker(location.data_dir)
+    old = marker.get("from")
+    if marker.get("state") != ll.MARKER_MOVED or not isinstance(old, str):
+        return []
+    if not os.path.isfile(old) or os.path.basename(old) != ll.DATABASE_NAME:
+        return []
+    if ll.same_folder(os.path.dirname(old), location.data_dir):
+        return []
+    config = marker.get("config_from")
+    if not (
+        isinstance(config, str)
+        and os.path.basename(config) == ll.CONFIG_NAME
+        and os.path.isfile(config)
+        and os.path.normcase(os.path.abspath(config))
+        != os.path.normcase(os.path.abspath(location.config_path))
+    ):
+        config = None
+    pending = types.SimpleNamespace(
+        db_path=old, config_path=config, target_dir=location.data_dir
+    )
+    renamed, problem = retire_old_files(pending)
+    if problem:
+        logger.warning(f"Library move: the old files are still in use ({problem})")
+    elif renamed:
+        logger.info(f"Library move finished: renamed {', '.join(renamed)}")
+    return renamed
+
+
+def move_library(
+    plan: MovePlan,
+    *,
+    switch: Callable = switch_process,
+    unswitch: Callable = unswitch_process,
+    after_switch: Callable = _noop,
+    config_lock=None,
+    progress: Callable[[str], None] = _noop,
+    checkpoint: Callable[[str], None] = _noop,
+    attempts: int = DEFAULT_ATTEMPTS,
+) -> MoveResult:
+    """Move the library as planned (blocking; see the module docstring).
+
+    ``switch(old_db, location, detached)`` points the process at the copy
+    and adds the old connections it detached to ``detached``; if it raises,
+    ``unswitch(old_db, new_db)`` undoes it while both files are still
+    locked, every detached connection is closed, the copy is removed and
+    the move fails (``switch-failed``). ``after_switch()`` runs
+    once the switch is final; it is best effort (logged, never fails the move).
+    """
+    short = space_problem(plan)
+    if short is not None:
+        raise MoveFailed("insufficient-space")
+    lock = config_lock if config_lock is not None else contextlib.nullcontext()
+    move = _Move(
+        plan,
+        switch=switch,
+        config_lock=lock,
+        progress=progress,
+        checkpoint=checkpoint,
+    )
+    move.unswitch = unswitch
+    location = plan.target_location
+    try:
+        move.prepare_target()
+        files, counts = _copy_and_switch(move, location, attempts)
+    except Exception:
+        move.cleanup()
+        raise
+    try:
+        after_switch()
+    except Exception:
+        logger.exception("Library move: a follow-up after the switch failed")
+    from .execution_history import notify_history_restore
+
+    notify_history_restore(location.db_path)
+    progress("Renaming the old files")
+    renamed, problem = retire_old_files(plan)
+    checkpoint("retired")
+    return MoveResult(location, counts, files, renamed, problem)
+
+
+def _switch_guarded(move: _Move, location) -> list:
+    """Switch while the copy is locked too; undo it all if any part fails.
+
+    The copy's write lock keeps every repointed thread from writing to it
+    until the switch is whole, so undoing a partial switch loses nothing.
+    Returns the old file's detached connections (still open). On failure
+    every detached connection is retired; those still in use are added to
+    ``move.retiring`` for the caller to await once the locks are released.
+    """
+    plan = move.plan
+    guard = sqlite3.connect(
+        location.db_path, timeout=BUSY_TIMEOUT_SECONDS, isolation_level=None
+    )
+    try:
+        guard.execute("BEGIN IMMEDIATE")
+        detached: list = []
+        try:
+            move.switch(plan.db_path, location, detached)
+        except Exception as error:
+            logger.exception("Library move: switching failed; undoing it")
+            move.moved = False  # the copy and its marker are removed
+            # Retire, never wait, here: a connection still in use may be
+            # waiting on the very locks this thread holds.
+            try:
+                undone = move.unswitch(plan.db_path, location.db_path)
+            except Exception:
+                logger.exception("Library move: undoing the switch failed")
+            else:
+                _retire(move, undone)
+            # The old file's connections a partial switch detached: the
+            # models reopen it on next use, so close them now, not at GC.
+            _retire(move, detached)
+            raise MoveFailed("switch-failed") from error
+        move.checkpoint("switched")
+        return detached
+    finally:
+        if guard.in_transaction:
+            guard.execute("ROLLBACK")
+        guard.close()
+
+
+def _copy_and_switch(move: _Move, location, attempts: int):
+    """Copy, then switch under both locks; retired connections are awaited.
+
+    A connection that was inside a statement when it was retired is closed
+    by its own thread once the statement ends, which may need the locks
+    released first; the old files are renamed (and a failed copy removed)
+    only after that, since Windows refuses to rename or delete an open file.
+    """
+    try:
+        return _copy_and_switch_locked(move, location, attempts)
+    finally:
+        try:
+            PromptModel.await_detached(move.retiring, logger)
+        except Exception:
+            logger.exception("Library move: waiting for old connections failed")
+
+
+def _retire(move: _Move, connections: list) -> None:
+    """Retire ``connections``, adding those still in use to ``move.retiring``.
+
+    Never raises: a switch that completed must not be reported as failed
+    because one of the old connections could not be retired (logged; the
+    rename then reports the old files as still in use).
+    """
+    try:
+        move.retiring.extend(PromptModel.retire_detached(connections, logger))
+    except Exception:
+        logger.exception("Library move: retiring the old connections failed")
+
+
+def _copy_and_switch_locked(move: _Move, location, attempts: int):
+    plan = move.plan
+    for attempt in range(1, attempts + 1):
+        source = sqlite3.connect(
+            plan.db_path, timeout=BUSY_TIMEOUT_SECONDS, isolation_level=None
+        )
+        try:
+            source.execute(f"PRAGMA busy_timeout = {BUSY_TIMEOUT_SECONDS * 1000}")
+            version, counts, temp_db, copies = move.copy_round(source)
+            source.execute("BEGIN IMMEDIATE")
+            try:
+                if source.execute("PRAGMA data_version").fetchone()[0] != version:
+                    move.progress("The library changed during the copy; copying again")
+                    move.discard_round(temp_db, copies)
+                    continue
+                move.checkpoint("locked")
+                with move.config_lock:
+                    files = move.publish(temp_db, copies)
+                    detached = _switch_guarded(move, location)
+                # Still holding the old file's lock: a write that was waiting
+                # on it is interrupted and cannot commit, so it fails (and
+                # runs again on the new library) instead of landing in the
+                # old file. Its own thread closes the connection.
+                _retire(move, detached)
+            finally:
+                if source.in_transaction:
+                    source.execute("ROLLBACK")
+            return files, counts
+        finally:
+            source.close()
+    raise MoveFailed("library-busy")
@@ -0,0 +1,353 @@
+"""A SQLite connection that is never closed under the thread using it.
+
+``PromptModel`` gives each thread its own connection, but Move library and
+``close_all`` must retire every thread's connection from one thread. Closing
+a ``sqlite3.Connection`` while its owner is inside a statement (Python runs
+``sqlite3_step`` without the GIL) frees memory the owner then reads: on
+Windows the process dies with "access violation", elsewhere the owner sees
+garbage such as a ``MemoryError``.
+
+``ManagedConnection`` counts the calls its owner is inside. ``retire()`` is
+safe from any thread and never raises: an idle connection is closed at once;
+one in use is closed by its owner as the call ends. A retired connection
+refuses new work (cursors, statements, commits) with the error a closed
+connection raises.
+
+What retiring a connection in use does and does not do:
+
+- It calls ``sqlite3_interrupt`` (thread-safe). That ends a running
+  statement at its next step, but it does not wake a statement that is
+  waiting for another connection's lock: that one waits until the lock is
+  released (or the busy timeout ends it), and only then is it interrupted.
+  An interrupt that arrives between two statements, for example between the
+  implicit ``BEGIN`` and the DML or between ``executemany`` rows, is lost.
+- Writes are kept out of a file the process has switched away from because
+  a retired connection never commits: legacy-mode DML runs inside a
+  transaction that only ``commit()`` (refused) or ``close()`` (rolls back)
+  ends. A statement that commits by itself is not covered: DDL or a PRAGMA
+  write outside a transaction, or an explicit ``COMMIT`` passed to
+  ``execute``/``executescript`` (``executescript`` also commits first, in C,
+  on Python before 3.12). Managed connections must never be used that way
+  for library writes.
+"""
+
+from __future__ import annotations
+
+import contextlib
+import logging
+import threading
+import time
+import weakref
+from typing import Iterable, Iterator, List, Optional
+
+import sqlite3
+
+CLOSED_MESSAGE = "Cannot operate on a closed database."
+# Rows fetched per step when a cursor is iterated: the connection is marked
+# in use once per chunk instead of once per row (iteration costs about what
+# a plain cursor costs). A loop that stops early leaves up to this many rows
+# fetched; ``fetchone``/``fetchmany`` after a partial loop skip them.
+ITER_CHUNK = 128
+
+
+class ManagedCursor(sqlite3.Cursor):
+    """A cursor whose calls into SQLite count as its connection being in use."""
+
+    def execute(self, sql, parameters=(), /):
+        conn = self.connection
+        conn._enter()
+        try:
+            return super().execute(sql, parameters)
+        finally:
+            conn._leave()
+
+    def executemany(self, sql, seq_of_parameters, /):
+        conn = self.connection
+        conn._enter()
+        try:
+            return super().executemany(sql, seq_of_parameters)
+        finally:
+            conn._leave()
+
+    def executescript(self, sql_script, /):
+        conn = self.connection
+        conn._enter()
+        try:
+            return super().executescript(sql_script)
+        finally:
+            conn._leave()
+
+    def fetchone(self):
+        conn = self.connection
+        conn._enter()
+        try:
+            return super().fetchone()
+        finally:
+            conn._leave()
+
+    def fetchmany(self, *args, **kwargs):
+        conn = self.connection
+        conn._enter()
+        try:
+            return super().fetchmany(*args, **kwargs)
+        finally:
+            conn._leave()
+
+    def fetchall(self):
+        conn = self.connection
+        conn._enter()
+        try:
+            return super().fetchall()
+        finally:
+            conn._leave()
+
+    def __iter__(self) -> Iterator:
+        return self._chunks()
+
+    def _chunks(self) -> Iterator:
+        while True:
+            rows = self.fetchmany(ITER_CHUNK)
+            if not rows:
+                return
+            yield from rows
+
+    def __next__(self):
+        conn = self.connection
+        conn._enter()
+        try:
+            return super().__next__()
+        finally:
+            conn._leave()
+
+    def close(self):
+        conn = self.connection
+        try:
+            conn._enter()
+        except sqlite3.ProgrammingError:
+            return super().close()  # the connection is closed or closing
+        try:
+            return super().close()
+        finally:
+            conn._leave()
+
+
+class ManagedConnection(sqlite3.Connection):
+    """A connection only its owner closes while a call into it is running."""
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        # Guards _depth, _retired, _closing and _cursors. Re-entrant so that
+        # code running in the closing thread while it holds the lock (a
+        # cursor() during the cursor-set copy) is refused instead of hanging.
+        self._use_lock = threading.RLock()
+        self._depth = 0
+        self._retired = False
+        self._closing = False
+        self._released = threading.Event()
+        # Python before 3.12 keeps the file open after close() while a cursor
+        # still holds a statement; these are closed first (see _close_now).
+        self._cursors: "weakref.WeakSet[sqlite3.Cursor]" = weakref.WeakSet()
+        self.close_logger: Optional[logging.Logger] = None
+
+    # ── in use ───────────────────────────────────────────────────────
+
+    def _enter(self) -> None:
+        with self._use_lock:
+            if self._retired:
+                raise sqlite3.ProgrammingError(CLOSED_MESSAGE)
+            self._depth += 1
+
+    def _leave(self) -> None:
+        with self._use_lock:
+            self._depth -= 1
+            close_now = self._retired and self._depth == 0
+        if close_now:
+            self._close_now()
+
+    @contextlib.contextmanager
+    def using(self):
+        """Mark the connection in use for a call this class cannot wrap.
+
+        For example as the *target* of another connection's ``backup()``.
+        """
+        self._enter()
+        try:
+            yield self
+        finally:
+            self._leave()
+
+    def cursor(self, factory=None):
+        with self._use_lock:
+            if self._retired:
+                raise sqlite3.ProgrammingError(CLOSED_MESSAGE)
+            cursor = super().cursor(factory or ManagedCursor)
+            self._cursors.add(cursor)
+        return cursor
+
+    def execute(self, sql, parameters=(), /):
+        return self.cursor().execute(sql, parameters)
+
+    def executemany(self, sql, seq_of_parameters, /):
+        return self.cursor().executemany(sql, seq_of_parameters)
+
+    def executescript(self, sql_script, /):
+        return self.cursor().executescript(sql_script)
+
+    def commit(self):
+        self._enter()
+        try:
+            return super().commit()
+        finally:
+            self._leave()
+
+    def rollback(self):
+        self._enter()  # a closed connection raises, as sqlite3's does
+        try:
+            return super().rollback()
+        finally:
+            self._leave()
+
+    def backup(self, target, **kwargs):
+        self._enter()
+        try:
+            return super().backup(target, **kwargs)
+        finally:
+            self._leave()
+
+    def create_function(self, *args, **kwargs):
+        self._enter()
+        try:
+            return super().create_function(*args, **kwargs)
+        finally:
+            self._leave()
+
+    @property
+    def in_transaction(self) -> bool:
+        self._enter()
+        try:
+            return super().in_transaction
+        finally:
+            self._leave()
+
+    def __exit__(self, exc_type, exc_value, traceback):
+        # The C implementation calls its own commit/rollback, not these.
+        if exc_type is None:
+            try:
+                self.commit()
+            except BaseException:
+                with contextlib.suppress(sqlite3.Error):
+                    self.rollback()
+                raise
+        else:
+            self.rollback()
+        return False
+
+    # ── closing ──────────────────────────────────────────────────────
+
+    def close(self) -> None:
+        """Close now if idle, else as soon as the running call ends.
+
+        Unlike ``sqlite3.Connection.close``, a call from another thread while
+        the owner is inside a call returns before the file is closed. A caller
+        that must know the file is closed (before renaming or deleting it)
+        waits for ``wait_closed`` (``PromptModel.close_detached`` does).
+        """
+        self.retire()
+
+    def retire(self) -> bool:
+        """Refuse new work and close; True when the connection is closed already.
+
+        Safe from any thread, and never raises: failures are logged.
+        """
+        try:
+            with self._use_lock:
+                if not self._retired:
+                    self._retired = True
+                    if self._depth:
+                        # Ends the running statement (see the module docstring
+                        # for what it does not end). The owner cannot start
+                        # closing the connection while this lock is held.
+                        self.interrupt()
+                        return False
+                elif self._depth:
+                    return False
+                else:
+                    return self._released.wait(0)
+        except Exception:
+            self._log_exception("Error retiring database connection")
+            return self._released.wait(0)
+        self._close_now()
+        return True
+
+    def wait_closed(self, timeout: float) -> bool:
+        return self._released.wait(timeout)
+
+    def _close_now(self) -> None:
+        # Only ever called with no call into the connection running, and a
+        # retired connection refuses new calls and cursors: its cursors are
+        # idle, and the set is copied under the lock that guards it.
+        with self._use_lock:
+            if self._closing:
+                return  # another thread closes it and sets _released
+            self._closing = True
+            cursors = list(self._cursors)
+        try:
+            for cursor in cursors:
+                with contextlib.suppress(sqlite3.Error):
+                    sqlite3.Cursor.close(cursor)
+            super().close()
+        except Exception:
+            self._log_exception("Error closing database connection")
+        finally:
+            self._released.set()
+
+    def _log_exception(self, message: str) -> None:
+        if self.close_logger is not None:
+            self.close_logger.exception(message)
+
+
+def retire_connections(
+    connections: Iterable[sqlite3.Connection], logger=None
+) -> List[ManagedConnection]:
+    """Retire every connection; return those whose owner has yet to close them.
+
+    Safe while holding a lock the owners wait on: nothing here waits for them.
+    One connection failing to retire is logged and never skips the rest.
+    """
+    pending = []
+    for conn in connections:
+        try:
+            if isinstance(conn, ManagedConnection):
+                if logger is not None:
+                    conn.close_logger = logger
+                if not conn.retire():
+                    pending.append(conn)
+            else:
+                conn.close()
+        except Exception:
+            if logger is not None:
+                logger.exception("Error closing database connection")
+    return pending
+
+
+def await_closed(
+    connections: Iterable[ManagedConnection], timeout: float, logger=None
+) -> bool:
+    """Wait until the owners closed ``connections`` (retired); False on timeout.
+
+    A connection still open after ``timeout`` (its owner is blocked, for
+    example on another process's lock after a lost interrupt) is logged and
+    left to close when its call ends; a Move library then reports the old
+    files as still in use instead of renaming them.
+    """
+    deadline = time.monotonic() + timeout
+    still_open = 0
+    for conn in connections:
+        if not conn.wait_closed(max(0.0, deadline - time.monotonic())):
+            still_open += 1
+    if still_open and logger is not None:
+        logger.warning(
+            f"{still_open} database connection(s) still in use after "
+            f"{timeout:g}s; they close when their statement ends"
+        )
+    return not still_open
@@ -9,21 +9,32 @@ import math
 import sqlite3
 import os
 import threading
-import tempfile
 import weakref
 from contextlib import closing
 from pathlib import Path
 from typing import Optional, Set, Tuple

+from .managed_connection import (
+    ManagedConnection,
+    await_closed,
+    retire_connections,
+)
+from . import restore_stage
 from .library_schema import library_schema_error, migrate_library_state
 from .image_favorites import image_favorites_schema_error, migrate_image_favorites
 from .annotation_schema import annotation_schema_error, migrate_annotation_state
+from .autotag_schema import (
+    autotag_schema_error,
+    autotag_without_annotations_error,
+    migrate_autotag_state,
+)
 from .review_schema import (
    migrate_review_state,
    review_schema_error,
    review_without_annotations_error,
 )
 from .saved_views import migrate_saved_views, saved_views_schema_error
+from .image_categories import image_categories_schema_error, migrate_image_categories
 from .workflow_documents import (
    DOCUMENT_ID_COLUMNS,
    migrate_workflow_documents,
@@ -34,7 +45,6 @@ from .workflow_documents import (
 from .execution_history_schema import (
    history_schema_error,
    migrate_execution_history,
-    rotate_history_epoch,
 )

 # Import logging system
@@ -334,8 +344,15 @@ class PromptModel:
        review_error = review_without_annotations_error(conn)
        if review_error:
            raise sqlite3.DatabaseError(review_error)
+        # The auto-tag marks cite annotation bytes the same way (#379).
+        autotag_error = autotag_without_annotations_error(conn)
+        if autotag_error:
+            raise sqlite3.DatabaseError(autotag_error)
        migrate_annotation_state(conn)
        migrate_review_state(conn)
+        migrate_autotag_state(conn)
+        # Image categories (#332): independent of every table above.
+        migrate_image_categories(conn)
        # Last: the older generated_images rebuilds run only before file_path.
        migrate_workflow_documents(conn)

@@ -550,7 +567,10 @@ class PromptModel:
            "WHERE pp.positive_prompt_id IS NOT gi.prompt_id LIMIT 1"
        ).fetchone():
            return "Image pair association has a different positive prompt owner"
-        for row in conn.execute("SELECT provenance FROM image_prompt_pairs"):
+        # fetchone, not iteration: a managed connection's cursor prefetches
+        # ITER_CHUNK rows when iterated, and each provenance may be ~4 MB.
+        cursor = conn.execute("SELECT provenance FROM image_prompt_pairs")
+        while (row := cursor.fetchone()) is not None:
            error = pair_provenance_error(row[0])
            if error:
                return error
@@ -609,19 +629,42 @@ class PromptModel:
        if conn is not None and self._local.generation == self._generation:
            return conn

-        # check_same_thread=False only so close_all can clean up other
-        # threads' connections; each connection is still used by one thread.
-        conn = sqlite3.connect(
-            self.db_path, check_same_thread=False, timeout=BUSY_TIMEOUT_SECONDS
-        )
-        conn.row_factory = sqlite3.Row
-        configure_connection(conn)
+        while True:
+            # The path and generation are read together, and the new
+            # connection is kept only if no Move library repointed the model
+            # meanwhile: otherwise it would write to the old file.
+            with self._conn_lock:
+                path, generation = self.db_path, self._generation
+            # check_same_thread=False only so close_all and Move library can
+            # retire other threads' connections; each connection is still
+            # used by one thread, and ManagedConnection never closes it under
+            # a running statement (see managed_connection).
+            conn = sqlite3.connect(
+                path,
+                check_same_thread=False,
+                timeout=BUSY_TIMEOUT_SECONDS,
+                factory=ManagedConnection,
+            )
+            try:
+                conn.row_factory = sqlite3.Row
+                configure_connection(conn)
+            except BaseException:
+                conn.close()
+                raise
+            with self._conn_lock:
+                if generation == self._generation:
+                    self._connections.add(conn)
+                    break
+            conn.close()
        self._local.conn = conn
-        self._local.generation = self._generation
-        with self._conn_lock:
-            self._connections.add(conn)
+        self._local.generation = generation
        return conn

+    @property
+    def generation(self) -> int:
+        """Bumped whenever every connection is closed or the model repointed."""
+        return self._generation
+
    @classmethod
    def close_all_instances(cls) -> None:
        """Close every connection of every live model in this process."""
@@ -630,22 +673,76 @@ class PromptModel:
        for model in models:
            model.close_all()

+    @classmethod
+    def repoint_instances(cls, old_path: str, new_path: str) -> list:
+        """Point every model of ``old_path`` at ``new_path`` (Move library).
+
+        Every thread opens the new file on its next ``get_connection``. The
+        old connections are detached, not closed, and returned: the caller
+        retires them (``retire_detached``) while it still holds the old
+        file's write lock. A write waiting on that lock is then interrupted
+        and can never commit, so it fails (and, through
+        ``PromptDatabase.survive_library_switch``, runs again on the new file).
+        """
+        old_key = os.path.normcase(os.path.realpath(old_path))
+        with cls._instances_lock:
+            models = list(cls._instances)
+        with cls._init_lock:
+            cls._initialized_paths.add(os.path.normcase(os.path.realpath(new_path)))
+        detached = []
+        for model in models:
+            if model._schema_key() == old_key:
+                detached.extend(model._detach_connections(new_path))
+        return detached
+
+    @staticmethod
+    def retire_detached(connections, logger=None) -> list:
+        """Retire detached connections without waiting for their owners.
+
+        Idle ones close now. One whose owner thread is inside a statement is
+        never closed from here (that frees memory the owner is using: an
+        access violation on Windows); it is interrupted, refuses to commit and
+        is closed by its owner as the statement ends. Returns those still
+        open, for ``await_detached`` once no lock the owners wait on is held.
+        """
+        return retire_connections(connections, logger)
+
+    @staticmethod
+    def await_detached(connections, logger=None) -> bool:
+        """Wait until retired connections are closed; False if some are not."""
+        return await_closed(connections, BUSY_TIMEOUT_SECONDS, logger)
+
+    @staticmethod
+    def close_detached(connections, logger=None) -> bool:
+        """Retire connections ``repoint_instances`` detached and await them.
+
+        Do not call it while holding a lock their owners may wait on; retire
+        them there (``retire_detached``) and await them after releasing it.
+        """
+        pending = retire_connections(connections, logger)
+        return await_closed(pending, BUSY_TIMEOUT_SECONDS, logger)
+
    def close_all(self) -> None:
        """Close every thread's connection; they reopen lazily on next use.

        Needed before deleting the database file (Windows keeps open files
        locked) and by tests that ran queries through executor threads.
        """
+        self.close_detached(self._detach_connections(), self.logger)
+
+    def _detach_connections(self, new_path: Optional[str] = None) -> list:
+        """Forget every connection (optionally pointing the model elsewhere).
+
+        Returns them for the caller to close; threads reopen on next use.
+        """
        with self._conn_lock:
+            if new_path is not None:
+                self.db_path = new_path
            connections = list(self._connections)
            self._connections.clear()
            self._generation += 1
        self._local.conn = None
-        for conn in connections:
-            try:
-                conn.close()
-            except sqlite3.Error as e:
-                self.logger.warning(f"Error closing database connection: {e}")
+        return connections

    def close(self) -> None:
        """Close the calling thread's connection, if it has one.
@@ -659,10 +756,7 @@ class PromptModel:
        self._local.conn = None
        with self._conn_lock:
            self._connections.discard(conn)
-        try:
-            conn.close()
-        except sqlite3.Error as e:
-            self.logger.warning(f"Error closing database connection: {e}")
+        self.close_detached([conn], self.logger)

    def _migrate_workflow_name_removal(self, conn: sqlite3.Connection) -> None:
        """
@@ -1053,7 +1147,7 @@ class PromptModel:

    @staticmethod
    def verify_database_file(
-        path: str, *, require_library_state: bool = False
+        path: str, *, require_library_state: bool = False, documents: bool = True
    ) -> Tuple[bool, str]:
        """
        Check that a file is a healthy prompts database before restoring it.
@@ -1064,9 +1158,13 @@ class PromptModel:
        Args:
            path: File to inspect
            require_library_state: Also require the tables every current
-                database has (Library state, image favorites, saved views,
-                image annotations and the review queue), as a migrated
+                database has (Library state, image favorites, image
+                categories, saved views, image annotations and the review
+                queue), as a migrated
                restore stage must; old backups may lack them.
+            documents: Read every workflow document and refuse a damaged
+                one. A restore checks its upload without it and repairs
+                damaged documents on the stage (``database/restore_stage.py``).

        Returns:
            (ok, reason): reason is "ok" when the file is acceptable, otherwise
@@ -1126,6 +1224,11 @@ class PromptModel:
            )
            if favorites_error:
                return False, favorites_error
+            categories_error = image_categories_schema_error(
+                conn, allow_missing=not require_library_state
+            )
+            if categories_error:
+                return False, categories_error
            views_error = saved_views_schema_error(
                conn, allow_missing=not require_library_state
            )
@@ -1141,8 +1244,13 @@ class PromptModel:
            )
            if review_error:
                return False, review_error
+            autotag_error = autotag_schema_error(
+                conn, allow_missing=not require_library_state
+            )
+            if autotag_error:
+                return False, autotag_error
            documents_error = workflow_documents_schema_error(
-                conn, allow_missing=not require_library_state, documents=True
+                conn, allow_missing=not require_library_state, documents=documents
            )
            if documents_error:
                return False, documents_error
@@ -1168,21 +1276,51 @@ class PromptModel:
            Path(src_path).resolve().as_uri() + "?mode=ro", uri=True
        )
        try:
-            source.backup(self.get_connection())
+            target = self.get_connection()
+            # The target is written under backup's step too: mark it in use
+            # so a concurrent close_all retires it instead of closing it.
+            with target.using():
+                source.backup(target)
        finally:
            source.close()

+    def stage_restore(self, src_path: str):
+        """Stage ``src_path`` beside this database for a restore (blocking).
+
+        Returns a ``StagedRestore`` (``database/restore_stage.py``): a
+        migrated, repaired and verified copy in the library's folder, its
+        digest and what it holds. Neither the live database nor the source
+        is touched. Raises ValueError when either does not verify.
+        """
+        return restore_stage.stage_restore(PromptModel, self.db_path, src_path)
+
+    def publish_staged(self, staged) -> str:
+        """Replace the live database with ``staged``; return the safety backup.
+
+        See ``restore_stage.publish_staged``: the staged bytes are rechecked,
+        the current database is kept as ``<db_path>.backup_<stamp>`` and the
+        WAL is truncated afterwards.
+        """
+        backup_path = restore_stage.publish_staged(self, staged)
+        self.logger.info("Database restored from a staged copy")
+        from .execution_history import notify_history_restore
+
+        notify_history_restore(self.db_path)
+        return backup_path
+
    def restore_from_file(self, src_path: str) -> str:
        """
        Replace the live database with the file at src_path.

-        A disposable SQLite backup of the source is migrated and verified first.
-        Only then is the current database backed up next to itself as
-        ``<db_path>.backup_<YYYYmmdd_HHMMSS>`` (WAL content included), and the
-        staged pages replace the live pages through SQLite's backup API.
-        Migration failures never replace live content or modify the source.
-        An online replacement failure leaves the live database intact and
-        propagates; the completed safety backup remains available.
+        ``stage_restore`` then ``publish_staged``: a disposable copy of the
+        source is migrated, repaired and verified in the library's folder
+        first. Only then is the current database backed up next to itself as
+        ``<db_path>.backup_<YYYYmmdd_HHMMSS_ffffff>`` (WAL content included),
+        and the staged pages replace the live pages through SQLite's backup
+        API. Staging failures never replace live content or modify the
+        source. An online replacement failure leaves the live database intact
+        and propagates; the completed safety backup remains available. The
+        stage is removed either way.

        Args:
            src_path: SQLite file to restore
@@ -1192,55 +1330,14 @@ class PromptModel:
            there was no database to back up.

        Raises:
-            RuntimeError: If the previous database could not be backed up
+            ValueError: If the source or its migrated copy does not verify
+            SafetyBackupFailed: If the previous database could not be backed up
            sqlite3.OperationalError: If SQLite refuses online replacement
        """
-        ok, reason = self.verify_database_file(src_path)
-        if not ok:
-            raise ValueError(reason)
-        with tempfile.TemporaryDirectory(prefix="prompt-manager-restore-") as directory:
-            staged_path = str(Path(directory) / "staged.db")
-            source = sqlite3.connect(
-                Path(src_path).resolve().as_uri() + "?mode=ro", uri=True
-            )
-            try:
-                with closing(sqlite3.connect(staged_path)) as destination:
-                    source.backup(destination)
-            finally:
-                source.close()
-            staged = None
-            try:
-                staged = PromptModel(staged_path)
-                rotate_history_epoch(staged.get_connection())
-                ok, reason = self.verify_database_file(
-                    staged_path, require_library_state=True
-                )
-                if not ok:
-                    raise ValueError(reason)
-                staged.close_all()
-                backup_path = ""
-                if os.path.exists(self.db_path):
-                    timestamp = datetime.datetime.now().strftime("%Y%m%d_%H%M%S")
-                    backup_path = f"{self.db_path}.backup_{timestamp}"
-                    if not self.backup_database(backup_path):
-                        raise RuntimeError("Could not back up the current database")
-                    self.logger.info(f"Current database backed up to: {backup_path}")
-                try:
-                    self._replace_contents_from(staged_path)
-                except sqlite3.OperationalError as exc:
-                    exc._prompt_manager_restore_backup_created = bool(backup_path)
-                    raise
-                with PromptModel._init_lock:
-                    PromptModel._initialized_paths.add(self._schema_key())
-                self.logger.info(f"Database restored from {src_path}")
-                from .execution_history import notify_history_restore
-
-                notify_history_restore(self.db_path)
-                return backup_path
-            finally:
-                if staged is not None:
-                    staged.close_all()
-                with PromptModel._init_lock:
-                    PromptModel._initialized_paths.discard(
-                        os.path.normcase(os.path.realpath(staged_path))
-                    )
+        staged = self.stage_restore(src_path)
+        try:
+            backup_path = self.publish_staged(staged)
+        finally:
+            staged.discard()
+        self.logger.info(f"Database restored from {src_path}")
+        return backup_path
@@ -26,6 +26,8 @@ from .history_reads import HistoryReadOperations
 from .health import HealthOperations, iter_consistency_issues
 from .duplicate_copies import DuplicateCopyOperations
 from .workflow_storage import WorkflowStorageOperations
+from .category_import import CategoryImportOperations, EmptyReplacement  # noqa: F401
+from .image_categories import ImageCategoryOperations
 from .workflow_documents import (
    DocumentReader,
    documents_of_rows,
@@ -46,6 +48,7 @@ try:
    from ..utils.logging_config import get_logger
    from ..utils.hashing import generate_prompt_hash
    from ..utils.json_strict import dumps_strict
+    from ..utils import library_location
 except ImportError:
    import sys

@@ -54,6 +57,7 @@ except ImportError:
    from utils.logging_config import get_logger
    from utils.hashing import generate_prompt_hash
    from utils.json_strict import dumps_strict
+    from utils import library_location


 # Subquery to fetch tags from junction table, embedded in SELECT statements
@@ -99,40 +103,56 @@ def escape_like(term: str) -> str:
    )


-def _resolve_db_path(db_path: Optional[str] = None) -> str:
-    """Resolve the database path from config, falling back to defaults.
+def _configured_default_path():
+    """config.json's ``database.default_path``, or None.

-    When no explicit path is given, reads PromptManagerConfig.DEFAULT_DB_PATH
-    (set via config.json). Relative paths are resolved against the extension
-    root directory so the database location is predictable regardless of the
-    process working directory (important for Docker deployments).
+    The package-qualified config wins over a standalone ``py.config`` (a
+    custom-node package uses its own configuration).
+    """
+    try:
+        try:
+            from ..py.config import PromptManagerConfig
+        except ImportError:
+            from py.config import PromptManagerConfig
+    except Exception:
+        return None
+    return getattr(PromptManagerConfig, "DEFAULT_DB_PATH", None)
+
+
+def resolve_library_location():
+    """Where the library lives now (``utils.library_location``, #249 S6b).
+
+    The image sources that rule out a ``PROMPT_MANAGER_DATA_DIR`` are read by
+    the resolver itself, exactly as ``config_location`` reads them.
+    """
+    return library_location.resolve_library(_configured_default_path())
+
+
+def _resolve_db_path(db_path: Optional[str] = None) -> str:
+    """Resolve the database path through the one library resolver.
+
+    With no explicit path, ``utils.library_location.resolve_library`` decides
+    (``PROMPT_MANAGER_DATA_DIR``, an explicit ``database.default_path``, a
+    node-folder library not moved yet, else ComfyUI's ``user/__promptmanager``).
+    An explicit relative path is resolved against the extension root, as
+    before, so the location does not depend on the working directory.

    Args:
-        db_path: Explicit database path, or None to use config/default.
+        db_path: Explicit database path, or None to use the resolver.

    Returns:
-        Absolute path to the SQLite database file.
+        Absolute path to the SQLite database file; its folder exists (a new
+        data folder is created owner-only).
    """
-    extension_root = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
-
    if db_path is None:
-        try:
-            try:
-                from ..py.config import PromptManagerConfig
-            except ImportError:
-                from py.config import PromptManagerConfig
-
-            db_path = PromptManagerConfig.DEFAULT_DB_PATH
-        except Exception:
-            db_path = "prompts.db"
-
-    if not os.path.isabs(db_path):
+        db_path = resolve_library_location().db_path
+    elif not os.path.isabs(db_path):
+        extension_root = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
        db_path = os.path.normpath(os.path.join(extension_root, db_path))

-    # Ensure parent directory exists for custom paths
    parent = os.path.dirname(db_path)
    if parent:
-        os.makedirs(parent, exist_ok=True)
+        library_location.ensure_private_dir(parent)

    return db_path

@@ -223,7 +243,8 @@ WHERE gi.image_path IN ({marks}) OR gi.file_path IN ({marks}){fallback}"""
 # writer since the 3.2.4 migration stores file_path, so it is the path key.
 # The prompt-level conditions are uncorrelated IN sets SQLite builds once, and
 # the CASE evaluates the per-row ambiguity probe only for admitted rows.
-_LINK_FILTER_SQL = """SELECT gi.file_path, p.rating, {hit}, p.id
+_LINK_FILTER_SQL = """SELECT gi.file_path AS file_path, p.rating AS rating,
+       {hit} AS matched, p.id AS positive
 FROM generated_images gi
 LEFT JOIN prompt_pairs pp ON pp.id = (
    SELECT CASE WHEN COUNT(DISTINCT ip.pair_id) = 1 THEN MIN(ip.pair_id) END
@@ -232,6 +253,19 @@ JOIN prompts p ON p.id = COALESCE(pp.positive_prompt_id, gi.prompt_id)
 WHERE gi.file_path IS NOT NULL AND CASE WHEN {admit} THEN NOT EXISTS (
    SELECT 1 FROM generated_images other
    WHERE other.file_path = gi.file_path AND other.id <> gi.id) ELSE 0 END"""
+# _LINK_FILTER_SQL's rows as one JSON array, built by SQLite in one step (#354).
+# Python's sqlite3 releases and retakes the GIL around every step, so a read
+# that steps once per linked row waits on a busy ComfyUI thread thousands of
+# times. A BLOB file_path or rating (no writer stores one) makes the value NULL
+# (or json_array refuses it), and the read streams instead.
+_LINK_MATCHES_JSON_SQL = """SELECT CASE
+    WHEN max(typeof(file_path) = 'blob' OR typeof(rating) = 'blob') THEN NULL
+    ELSE json_group_array(json_array(file_path, rating, matched, positive)) END
+FROM ({select})"""
+# Set when this SQLite has no JSON functions: every later read streams.
+_one_step_unsupported = False
+# One warning per process when a read falls back to streaming.
+_one_step_warned = False
 # The linked positive of each given path (one unambiguous link, pair scope as
 # in _LINK_FILTER_SQL) with its category; {hit} as in link_filter_query. Used
 # for the few files whose current image tags meet a Tags filter (#249 B3).
@@ -290,6 +324,25 @@ def link_filter_query(
    return sql, params


+def link_matches_json_query(sql: str) -> str:
+    """*sql* from link_filter_query, wrapped to return its rows as one JSON value."""
+    return _LINK_MATCHES_JSON_SQL.format(select=sql)
+
+
+def _streamed_link_matches(
+    conn: sqlite3.Connection,
+    sql: str,
+    params: Dict[str, Any],
+    wanted: Optional[Set[str]],
+) -> Dict[str, Tuple[bool, Optional[int], int]]:
+    """The link read stepped once per row (the fallback of the one-step read)."""
+    matches: Dict[str, Tuple[bool, Optional[int], int]] = {}
+    for path, rating, matched, positive in conn.execute(sql, params):
+        if wanted is None or path in wanted:
+            matches[path] = (bool(matched), rating, positive)
+    return matches
+
+
 _ASCII_FOLD = str.maketrans("ABCDEFGHIJKLMNOPQRSTUVWXYZ", "abcdefghijklmnopqrstuvwxyz")


@@ -348,6 +401,8 @@ class PromptDatabase(
    MaintenanceOperations,
    DuplicateCopyOperations,
    WorkflowStorageOperations,
+    CategoryImportOperations,
+    ImageCategoryOperations,
 ):
    """Database operations class for managing prompts."""

@@ -365,6 +420,25 @@ class PromptDatabase(
        self.model = PromptModel(db_path)
        self.logger.debug("Database operations initialized successfully")

+    def survive_library_switch(self, write):
+        """Run ``write()``; once more if it failed while the library moved.
+
+        A background write (run counting, the image monitor) that was waiting
+        on the old file when Move library switched fails when its connection
+        is closed. When the model's generation changed during the attempt,
+        the write runs again on a fresh connection, which is the new library;
+        any other failure is raised as it was. ``write`` must open its own
+        transaction (every PromptDatabase method does).
+        """
+        generation = self.model.generation
+        try:
+            return write()
+        except Exception:
+            if self.model.generation == generation:
+                raise
+            self.logger.info("Running a write again on the moved library")
+            return write()
+
    def close(self) -> None:
        """Close the calling thread's database connection (see PromptModel.close)."""
        self.model.close()
@@ -418,26 +492,9 @@ class PromptDatabase(

        try:
            with self.model.get_connection() as conn:
-                cursor = conn.execute(
-                    """
-                    INSERT INTO prompts (
-                        text, category, tags, rating, notes, hash, created_at,
-                        updated_at
-                    ) VALUES (?, ?, NULL, ?, ?, ?, ?, ?)
-                    """,
-                    (
-                        text.strip(),
-                        category,
-                        rating,
-                        notes,
-                        prompt_hash,
-                        datetime.datetime.now(datetime.timezone.utc).isoformat(),
-                        datetime.datetime.now(datetime.timezone.utc).isoformat(),
-                    ),
+                prompt_id = self._insert_prompt(
+                    conn, text, category, tags, rating, notes, prompt_hash
                )
-                prompt_id = cursor.lastrowid
-                if tags:
-                    self._sync_prompt_tags(conn, prompt_id, tags)
                conn.commit()
                self.logger.debug(f"Successfully saved prompt with ID: {prompt_id}")
                return prompt_id
@@ -453,6 +510,32 @@ class PromptDatabase(
            )
            return existing["id"]

+    def _insert_prompt(
+        self,
+        conn: sqlite3.Connection,
+        text: str,
+        category: Optional[str],
+        tags: Optional[List[str]],
+        rating: Optional[int],
+        notes: Optional[str],
+        prompt_hash: Optional[str],
+    ) -> int:
+        """Insert one prompt row and its tags on ``conn`` (no commit)."""
+        now = datetime.datetime.now(datetime.timezone.utc).isoformat()
+        cursor = conn.execute(
+            """
+            INSERT INTO prompts (
+                text, category, tags, rating, notes, hash, created_at,
+                updated_at
+            ) VALUES (?, ?, NULL, ?, ?, ?, ?, ?)
+            """,
+            (text.strip(), category, rating, notes, prompt_hash, now, now),
+        )
+        prompt_id = cursor.lastrowid
+        if tags:
+            self._sync_prompt_tags(conn, prompt_id, tags)
+        return prompt_id
+
    def record_prompt_use(self, prompt_id: int, times: int = 1) -> bool:
        """
        Count runs of a prompt and mark it as most recently used.
@@ -1580,104 +1663,137 @@ class PromptDatabase(
            metadata: Optional metadata about the image

        Returns:
-            int: The ID of the created image record
+            int: The ID of the created image record, or 0 when nothing was
+            linked (invalid or unknown prompt, already linked, or an error,
+            which is logged)
        """
-        # Validate that prompt_id is a valid integer and exists in prompts table
        try:
-            # Convert prompt_id to integer if it's a string number
-            if isinstance(prompt_id, str) and prompt_id.isdigit():
-                prompt_id_int = int(prompt_id)
-            elif isinstance(prompt_id, int):
-                prompt_id_int = prompt_id
-            else:
-                # Handle temporary IDs like "temp_123456" - skip linking
-                if isinstance(prompt_id, str) and prompt_id.startswith("temp_"):
-                    self.logger.debug(
-                        f"Skipping image linking for temporary prompt ID: {prompt_id}"
-                    )
-                    return 0
-                else:
-                    self.logger.warning(
-                        f"Invalid prompt_id format: {prompt_id}, skipping image linking"
-                    )
-                    return 0
-
-            # Verify the prompt exists in the database
-            with self.model.get_connection() as conn:
-                cursor = conn.execute(
-                    "SELECT id FROM prompts WHERE id = ?", (prompt_id_int,)
-                )
-                if not cursor.fetchone():
-                    self.logger.warning(
-                        f"Prompt ID {prompt_id_int} not found in database, skipping "
-                        "image linking"
-                    )
-                    return 0
-
-                # Proceed with linking
-                if not isinstance(metadata, dict):
-                    metadata = {}
-                filename = os.path.basename(image_path)
-                file_path = normalize_image_path(image_path)
-                file_size, width, height, image_format = _coerce_file_info(metadata)
-                # Each workflow and prompt graph is stored once (new form).
-                documents = stored_values(
-                    conn,
-                    {
-                        "workflow_data": dumps_strict(metadata.get("workflow", {})),
-                        "prompt_metadata": dumps_strict(metadata.get("prompt", {})),
-                    },
-                )
-
-                # INSERT OR IGNORE skips a file already linked to this prompt
-                # (same prompt_id + normalised full path)
-                cursor = conn.execute(
-                    """
-                    INSERT OR IGNORE INTO generated_images
-                    (prompt_id, image_path, filename, file_path, file_size, width,
-                     height, format, workflow_data, prompt_metadata, parameters,
-                     workflow_document_id, prompt_document_id)
-                    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-                    """,
-                    (
-                        prompt_id_int,
-                        image_path,
-                        filename,
-                        file_path,
-                        file_size,
-                        width,
-                        height,
-                        image_format,
-                        documents["workflow_data"],
-                        documents["prompt_metadata"],
-                        dumps_strict(metadata.get("parameters", {})),
-                        documents["workflow_document_id"],
-                        documents["prompt_document_id"],
-                    ),
-                )
-                if cursor.rowcount == 0:
-                    # Already linked: a document made only for this row goes.
-                    release_documents(
-                        conn,
-                        (
-                            documents["workflow_document_id"],
-                            documents["prompt_document_id"],
-                        ),
-                    )
-                conn.commit()
-
-                if cursor.rowcount == 0:
-                    self.logger.debug(
-                        f"Image {file_path} already linked to prompt {prompt_id_int}"
-                    )
-                    return 0
-
-                return cursor.lastrowid
-
+            return self.link_image_to_prompt_or_raise(prompt_id, image_path, metadata)
        except Exception as e:
            self.logger.error(f"Error linking image to prompt {prompt_id}: {e}")
            return 0

+    def link_image_to_prompt_or_raise(
+        self, prompt_id: str, image_path: str, metadata: Optional[Dict[str, Any]] = None
+    ) -> int:
+        """``link_image_to_prompt`` that raises database errors.
+
+        The image monitor links through this so a write that failed because
+        Move library switched reaches ``survive_library_switch`` and runs
+        again on the new library (#249 S6b). Each call is one transaction:
+        a failed attempt rolls back, and a committed one does not raise.
+        Returns 0 for an invalid or unknown prompt or an image already linked.
+        """
+        # Validate that prompt_id is a valid integer and exists in prompts table
+        # Convert prompt_id to integer if it's a string number
+        if isinstance(prompt_id, str) and prompt_id.isdigit():
+            prompt_id_int = int(prompt_id)
+        elif isinstance(prompt_id, int):
+            prompt_id_int = prompt_id
+        else:
+            # Handle temporary IDs like "temp_123456" - skip linking
+            if isinstance(prompt_id, str) and prompt_id.startswith("temp_"):
+                self.logger.debug(
+                    f"Skipping image linking for temporary prompt ID: {prompt_id}"
+                )
+                return 0
+            else:
+                self.logger.warning(
+                    f"Invalid prompt_id format: {prompt_id}, skipping image linking"
+                )
+                return 0
+
+        # Verify the prompt exists in the database
+        with self.model.get_connection() as conn:
+            cursor = conn.execute(
+                "SELECT id FROM prompts WHERE id = ?", (prompt_id_int,)
+            )
+            if not cursor.fetchone():
+                self.logger.warning(
+                    f"Prompt ID {prompt_id_int} not found in database, skipping "
+                    "image linking"
+                )
+                return 0
+
+            # Proceed with linking
+            image_id = self._insert_image_link(
+                conn, prompt_id_int, image_path, metadata
+            )
+            conn.commit()
+
+            if not image_id:
+                self.logger.debug(
+                    f"Image {normalize_image_path(image_path)} already linked to "
+                    f"prompt {prompt_id_int}"
+                )
+                return 0
+
+            return image_id
+
+    def _insert_image_link(
+        self,
+        conn: sqlite3.Connection,
+        prompt_id_int: int,
+        image_path: str,
+        metadata: Optional[Dict[str, Any]] = None,
+    ) -> int:
+        """Insert one image link on ``conn`` (no commit).
+
+        Returns the new image row's id, or 0 when the file is already linked
+        to this prompt (``INSERT OR IGNORE``).
+        """
+        if not isinstance(metadata, dict):
+            metadata = {}
+        filename = os.path.basename(image_path)
+        file_path = normalize_image_path(image_path)
+        file_size, width, height, image_format = _coerce_file_info(metadata)
+        # Each workflow and prompt graph is stored once (new form).
+        documents = stored_values(
+            conn,
+            {
+                "workflow_data": dumps_strict(metadata.get("workflow", {})),
+                "prompt_metadata": dumps_strict(metadata.get("prompt", {})),
+            },
+        )
+
+        # INSERT OR IGNORE skips a file already linked to this prompt
+        # (same prompt_id + normalised full path)
+        cursor = conn.execute(
+            """
+            INSERT OR IGNORE INTO generated_images
+            (prompt_id, image_path, filename, file_path, file_size, width,
+             height, format, workflow_data, prompt_metadata, parameters,
+             workflow_document_id, prompt_document_id)
+            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+            """,
+            (
+                prompt_id_int,
+                image_path,
+                filename,
+                file_path,
+                file_size,
+                width,
+                height,
+                image_format,
+                documents["workflow_data"],
+                documents["prompt_metadata"],
+                dumps_strict(metadata.get("parameters", {})),
+                documents["workflow_document_id"],
+                documents["prompt_document_id"],
+            ),
+        )
+        if cursor.rowcount == 0:
+            # Already linked: a document made only for this row goes.
+            release_documents(
+                conn,
+                (
+                    documents["workflow_document_id"],
+                    documents["prompt_document_id"],
+                ),
+            )
+            return 0
+        return cursor.lastrowid
+
    def get_prompt_images(self, prompt_id: str) -> List[Dict[str, Any]]:
        """
        Get all images associated with a prompt.
@@ -2475,17 +2591,65 @@ class PromptDatabase(
        names its negative variant and is not searched.
        Without category or tags only hits are returned, unless *every_link*
        asks for every linked image (the rating sort and the positive count).
-        The positive id is the card's linked positive. One SELECT whose rows
-        are streamed; with *wanted* (the listing's normalized paths) only those
-        paths are kept, so memory is bounded by the listing, not the database.
+        The positive id is the card's linked positive.
+
+        One SELECT, returned as one JSON value (#354): SQLite steps once, so
+        the read takes the GIL back a constant two or three times instead of
+        once per linked row while ComfyUI generates. Peak memory therefore
+        grows with the database's matching linked rows (about 530 bytes each,
+        freed on return); the result is bounded by *wanted* (the listing's
+        normalized paths) when given. Where the JSON step fails (no JSON
+        functions, a BLOB value, a JSON text over SQLite's length limit) the
+        rows are streamed as before.
        """
        sql, params = link_filter_query(q, category, tags, every_link=every_link)
-        matches: Dict[str, Tuple[bool, Optional[int], int]] = {}
        with self.model.get_connection() as conn:
-            for path, rating, matched, positive in conn.execute(sql, params):
-                if wanted is None or path in wanted:
-                    matches[path] = (bool(matched), rating, positive)
-        return matches
+            rows = None
+            if not _one_step_unsupported:
+                rows = self._one_step_link_rows(conn, sql, params)
+            if rows is None:
+                return _streamed_link_matches(conn, sql, params, wanted)
+        return {
+            path: (bool(matched), rating, positive)
+            for path, rating, matched, positive in rows
+            if wanted is None or path in wanted
+        }
+
+    def _one_step_link_rows(
+        self, conn: sqlite3.Connection, sql: str, params: Dict[str, Any]
+    ) -> Optional[List[List[Any]]]:
+        """*sql*'s rows from one JSON value, or None when this read must stream.
+
+        An interrupted read (Move library retiring the connection) is raised
+        as before, never retried row by row.
+        """
+        global _one_step_unsupported, _one_step_warned
+        error: Optional[str] = None
+        try:
+            cursor = conn.execute(link_matches_json_query(sql), params)
+            try:
+                ((document,),) = cursor.fetchall()
+            finally:
+                cursor.close()  # resets the statement: its snapshot ends now
+        except (sqlite3.OperationalError, sqlite3.DataError) as failure:
+            # DataError: the JSON text is longer than SQLITE_LIMIT_LENGTH.
+            error = str(failure)
+            if error == "interrupted":
+                raise
+            if error.startswith("no such function"):
+                _one_step_unsupported = True
+        else:
+            if document is not None:
+                return json.loads(document)
+            error = "a BLOB value"
+        if not _one_step_warned:
+            _one_step_warned = True
+            self.logger.warning(
+                "Reading image links row by row (slower while ComfyUI "
+                "generates); the one-step read failed: %s",
+                error,
+            )
+        return None

    def get_image_link_facts(
        self, paths: List[str], q: str = ""
@@ -23,10 +23,26 @@ except ImportError:
    from utils.prompt_pair_resolver import RESOLVER_VERSION


+def blank_positive(resolution: Dict[str, Any]) -> bool:
+    """A resolved pair whose stored positive text is empty (#342).
+
+    A PromptManager node whose editor is empty encodes only its prepend and
+    append text, which is never stored as a prompt: such a result names no
+    prompt to link.
+    """
+    if resolution.get("state") != "resolved":
+        return False
+    positive = resolution.get("positive") or {}
+    text = positive.get("storage_text", positive.get("text"))
+    return not (isinstance(text, str) and text.strip())
+
+
 def ingest_resolved_pair(
    db: Any, image_path: str, metadata: Dict[str, Any], resolution: Dict[str, Any]
 ) -> Dict[str, Any]:
    state = resolution.get("state", "unresolved")
+    if state == "resolved" and blank_positive(resolution):
+        state = "unresolved"
    if state != "resolved":
        return {"status": state, "pairs_added": 0, "links_added": 0}
    with db._pair_transaction() as conn:
@@ -0,0 +1,365 @@
+"""A restore in two steps: stage the upload, then publish it (#249 System S8).
+
+**Stage** (``stage_restore``) never touches the live database or the source.
+In a new folder ``.pm-restore-*`` in the library's own folder (#318: never
+the system temp folder, which may be another disk), it:
+
+1. checks the source (``verify_database_file`` without reading every
+   workflow document: a damaged one is repaired below, not refused);
+2. copies it with SQLite's backup API (a rollback-journal file and a WAL file
+   alike) and opens the copy as a ``PromptModel``, which migrates an older
+   schema;
+3. repairs damaged workflow documents (``repair_damaged_documents``),
+   rotates the history epoch and counts what the copy holds;
+4. makes the copy one self-contained file and verifies it fully (every
+   current table, every document);
+5. records the copy's SHA-256, so publishing binds exactly these bytes.
+
+**Publish** (``publish_staged``) re-hashes the stage (``StageChanged`` if it
+differs), keeps the current database as a uniquely named, standalone safety
+backup beside it (``database/safety_backup.py``; not verified, because the
+database being replaced may be the damaged one), copies the stage over the
+live pages through the backup API (no file is swapped under open handles; an
+``OperationalError`` there leaves the live data intact, #226), then
+checkpoints the WAL with TRUNCATE so the copied pages do not leave a
+database-sized ``-wal`` behind. A reader that keeps a snapshot past the busy
+wait is logged, not fatal: the restore itself is done.
+
+Every handle on the stage is closed before its folder is removed (Windows).
+``sweep_restore_temps`` removes what an interrupted restore left (startup).
+"""
+
+import hashlib
+import logging
+import os
+import sqlite3
+import tempfile
+from contextlib import closing
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Dict, Optional
+
+from . import workflow_documents as wd
+from .execution_history_schema import rotate_history_epoch
+from .safety_backup import take_safety_backup
+
+logger = logging.getLogger("prompt_manager.database.restore_stage")
+
+STAGE_PREFIX = ".pm-restore-"
+UPLOAD_PREFIX = ".pm-restore-upload-"
+STAGED_NAME = "staged.db"
+# How long the post-restore TRUNCATE checkpoint waits for readers to leave.
+CHECKPOINT_BUSY_MS = 30_000
+_HASH_CHUNK = 1024 * 1024
+SUMMARY_KEYS = (
+    "prompts",
+    "positives",
+    "pairs",
+    "archived_pairs",
+    "image_links",
+    "runs",
+    "saved_views",
+)
+
+
+class StageChanged(ValueError):
+    """The staged file is no longer the bytes that were reviewed."""
+
+
+@dataclass
+class StagedRestore:
+    """A verified, migrated copy of an upload, ready to publish."""
+
+    path: str
+    digest: str
+    size: int
+    summary: Dict[str, int]
+    schema: Dict[str, bool]
+    documents: Dict[str, int] = field(
+        default_factory=lambda: {"repaired": 0, "cleared": 0, "images": 0}
+    )
+
+    @property
+    def directory(self) -> str:
+        return os.path.dirname(self.path)
+
+    def discard(self) -> None:
+        """Remove the stage folder (idempotent; its handles are all closed)."""
+        remove_stage_folder(self.directory)
+
+
+def remove_stage_folder(directory: str) -> None:
+    """Remove a stage folder and its files, logging what cannot be removed."""
+    if not directory or not os.path.isdir(directory):
+        return
+    for name in os.listdir(directory):
+        try:
+            os.remove(os.path.join(directory, name))
+        except OSError as error:
+            logger.warning(f"Could not remove restore stage file {name}: {error}")
+    try:
+        os.rmdir(directory)
+    except OSError as error:
+        logger.warning(f"Could not remove the restore stage folder: {error}")
+
+
+def file_digest(path: str) -> str:
+    """``sha256:<hex>`` of the file's bytes (blocking)."""
+    digest = hashlib.sha256()
+    with open(path, "rb") as handle:
+        for chunk in iter(lambda: handle.read(_HASH_CHUNK), b""):
+            digest.update(chunk)
+    return "sha256:" + digest.hexdigest()
+
+
+def _readonly(path: str) -> sqlite3.Connection:
+    return sqlite3.connect(Path(path).resolve().as_uri() + "?mode=ro", uri=True)
+
+
+def _schema(path: str) -> list:
+    """The file's schema objects, to tell whether staging migrated it."""
+    with closing(_readonly(path)) as conn:
+        return sorted(
+            conn.execute(
+                "SELECT type, name, tbl_name, sql FROM sqlite_master "
+                "WHERE name NOT LIKE 'sqlite_%'"
+            ).fetchall(),
+            key=repr,
+        )
+
+
+def _count(conn: sqlite3.Connection, table: str, where: str = "") -> int:
+    exists = conn.execute(
+        "SELECT 1 FROM sqlite_master WHERE type='table' AND name=?", (table,)
+    ).fetchone()
+    if not exists:
+        return 0
+    # ``table`` and ``where`` are constants of library_summary, never input.
+    return conn.execute(f"SELECT COUNT(*) FROM {table} {where}").fetchone()[0]  # nosec
+
+
+def library_summary(conn: sqlite3.Connection) -> Dict[str, int]:
+    """What a library holds, for a restore's review (reads only).
+
+    ``positives`` are the Library's prompts (``library_counts``'s
+    ``positive_prompts``); ``pairs`` the active saved pairs and
+    ``archived_pairs`` the archived ones; ``image_links`` the indexed image
+    rows; ``runs`` the recorded executions.
+    """
+    from .library import _ELIGIBLE
+
+    has_state = conn.execute(
+        "SELECT 1 FROM sqlite_master WHERE type='table' AND "
+        "name='prompt_library_state'"
+    ).fetchone()
+    has_pairs = conn.execute(
+        "SELECT 1 FROM sqlite_master WHERE type='table' AND name='prompt_pairs'"
+    ).fetchone()
+    if has_state and has_pairs:
+        positives = conn.execute(
+            "SELECT COUNT(*) FROM prompts p WHERE " + _ELIGIBLE
+        ).fetchone()[0]
+    else:
+        positives = _count(conn, "prompts")
+    return {
+        "prompts": _count(conn, "prompts"),
+        "positives": positives,
+        "pairs": _count(conn, "prompt_pairs", "WHERE archived=0"),
+        "archived_pairs": _count(conn, "prompt_pairs", "WHERE archived<>0"),
+        "image_links": _count(conn, "generated_images"),
+        "runs": _count(conn, "execution_runs"),
+        "saved_views": _count(conn, "saved_views"),
+    }
+
+
+# The newest row of each table a restore would overwrite: with the counts,
+# a write after the review (a new run, image, prompt or edit) changes it.
+_FINGERPRINT_SQL = (
+    ("prompts", "SELECT MAX(id), MAX(updated_at), MAX(last_used_at) FROM prompts"),
+    ("generated_images", "SELECT MAX(id) FROM generated_images"),
+    ("prompt_pairs", "SELECT MAX(id), MAX(updated_at) FROM prompt_pairs"),
+    ("execution_runs", "SELECT COUNT(*), MAX(rowid) FROM execution_runs"),
+    ("saved_views", "SELECT MAX(rowid) FROM saved_views"),
+)
+
+
+def live_fingerprint(conn: sqlite3.Connection):
+    """``(summary, fingerprint)`` of a live library, read in one snapshot.
+
+    The fingerprint changes when rows are added to or removed from the
+    tables a restore replaces, or when a prompt, pair, run or saved view is
+    the newest edited (counts plus the newest row and edit of each table);
+    the apply refuses with ``plan-changed`` then. It does not see every
+    edit (a tag or favorite change on an older row); those are kept in the
+    restore's safety backup. A read transaction the caller already has is
+    used and left open; one opened here is ended here.
+    """
+    import json
+
+    opened = not conn.in_transaction
+    if opened:
+        conn.execute("BEGIN")  # one read snapshot for every count
+    try:
+        summary = library_summary(conn)
+        newest = []
+        for table, sql in _FINGERPRINT_SQL:
+            try:
+                newest.append([table, list(conn.execute(sql).fetchone())])
+            except sqlite3.OperationalError:
+                newest.append([table, None])  # no such table or column
+    finally:
+        if opened:
+            conn.rollback()  # it only read
+    text = json.dumps([summary, newest], sort_keys=True, default=str)
+    return summary, "sha256:" + hashlib.sha256(text.encode("utf-8")).hexdigest()
+
+
+def _copy(src_path: str, staged_path: str) -> None:
+    source = _readonly(src_path)
+    try:
+        with closing(sqlite3.connect(staged_path)) as destination:
+            source.backup(destination)
+    finally:
+        source.close()
+
+
+def _standalone(path: str) -> None:
+    with closing(sqlite3.connect(path)) as conn:
+        conn.execute("PRAGMA journal_mode=DELETE").fetchone()
+
+
+def stage_restore(model_cls, db_path: str, src_path: str) -> StagedRestore:
+    """Stage ``src_path`` beside ``db_path`` (blocking); see the module docstring.
+
+    Raises ValueError with a readable reason when the source or the migrated
+    stage does not verify; the stage folder is then already removed.
+    """
+    ok, reason = model_cls.verify_database_file(src_path, documents=False)
+    if not ok:
+        raise ValueError(reason)
+    before = _schema(src_path)
+    with closing(_readonly(src_path)) as conn:
+        library_state = bool(
+            conn.execute(
+                "SELECT 1 FROM sqlite_master WHERE type='table' AND "
+                "name='prompt_library_state'"
+            ).fetchone()
+        )
+    folder = os.path.dirname(os.path.abspath(db_path))
+    directory = tempfile.mkdtemp(prefix=STAGE_PREFIX, dir=folder)
+    staged_path = os.path.join(directory, STAGED_NAME)
+    staged_key = os.path.normcase(os.path.realpath(staged_path))
+    try:
+        _copy(src_path, staged_path)
+        staged = None
+        try:
+            staged = model_cls(staged_path)
+            conn = staged.get_connection()
+            documents = wd.repair_damaged_documents(conn)
+            rotate_history_epoch(conn)
+            summary = library_summary(conn)
+        finally:
+            if staged is not None:
+                staged.close_all()
+        _standalone(staged_path)
+        ok, reason = model_cls.verify_database_file(
+            staged_path, require_library_state=True
+        )
+        if not ok:
+            raise ValueError(reason)
+        result = StagedRestore(
+            path=staged_path,
+            digest=file_digest(staged_path),
+            size=os.path.getsize(staged_path),
+            summary=summary,
+            schema={
+                "migrated": _schema(staged_path) != before,
+                "library_state": library_state,
+            },
+            documents=documents,
+        )
+    except BaseException:
+        remove_stage_folder(directory)
+        raise
+    finally:
+        with model_cls._init_lock:
+            model_cls._initialized_paths.discard(staged_key)
+    return result
+
+
+def checkpoint_truncate(conn: sqlite3.Connection) -> bool:
+    """Checkpoint the WAL and truncate it to 0 bytes; False when a reader held it."""
+    previous = conn.execute("PRAGMA busy_timeout").fetchone()[0]
+    try:
+        conn.execute(f"PRAGMA busy_timeout = {int(CHECKPOINT_BUSY_MS)}")
+        busy = conn.execute("PRAGMA wal_checkpoint(TRUNCATE)").fetchone()[0]
+    finally:
+        conn.execute(f"PRAGMA busy_timeout = {int(previous)}")
+    return not busy
+
+
+def publish_staged(model, staged: StagedRestore) -> str:
+    """Publish ``staged`` over ``model``'s database; return the safety backup path.
+
+    "" when there was no database to back up. Raises StageChanged before
+    anything is written when the stage's bytes changed since staging, and
+    SafetyBackupFailed when the current database could not be kept. An
+    ``OperationalError`` from the page copy propagates with
+    ``_prompt_manager_restore_backup_created`` set; the live data is intact.
+    """
+    if not os.path.isfile(staged.path) or file_digest(staged.path) != staged.digest:
+        raise StageChanged("The staged restore changed since it was reviewed")
+    backup_path = ""
+    if os.path.exists(model.db_path):
+        backup_path = take_safety_backup(model, verify=False)
+        logger.info(f"Current database backed up to: {os.path.basename(backup_path)}")
+    try:
+        model._replace_contents_from(staged.path)
+    except sqlite3.OperationalError as exc:
+        exc._prompt_manager_restore_backup_created = bool(backup_path)
+        raise
+    with model._init_lock:
+        model._initialized_paths.add(model._schema_key())
+    _truncate_wal(model)
+    return backup_path
+
+
+def _truncate_wal(model) -> Optional[bool]:
+    """TRUNCATE-checkpoint the live WAL after a publish (never raises)."""
+    try:
+        conn = model.get_connection()
+        with conn.using():
+            truncated = checkpoint_truncate(conn)
+    except sqlite3.Error as error:
+        logger.warning(f"The database log could not be truncated: {error}")
+        return None
+    if not truncated:
+        logger.warning(
+            "The database log could not be truncated after the restore: a "
+            "reader kept it open. It shrinks at the next checkpoint with no "
+            "reader."
+        )
+    return truncated
+
+
+def sweep_restore_temps(db_path: str) -> list:
+    """Remove the stages and uploads an interrupted restore left (startup)."""
+    folder = os.path.dirname(os.path.abspath(db_path))
+    removed = []
+    try:
+        names = os.listdir(folder)
+    except OSError:
+        return removed
+    for name in names:
+        path = os.path.join(folder, name)
+        if name.startswith(UPLOAD_PREFIX) and os.path.isfile(path):
+            try:
+                os.remove(path)
+                removed.append(name)
+            except OSError:
+                continue
+        elif name.startswith(STAGE_PREFIX) and os.path.isdir(path):
+            remove_stage_folder(path)
+            if not os.path.exists(path):
+                removed.append(name)
+    return removed
@@ -62,3 +62,14 @@ def notify_review_change(db_path: str) -> None:
            callback()
        except Exception:
            _logger.warning("Needs review change observer failed", exc_info=True)
+
+
+def rekey_review_changes(old_path: str, new_path: str) -> None:
+    """Move the observers of ``old_path`` to ``new_path`` (Move library)."""
+    old, new = _identity(old_path), _identity(new_path)
+    if old == new:
+        return
+    with _lock:
+        observers = _observers.pop(old, None)
+        if observers:
+            _observers.setdefault(new, {}).update(observers)
@@ -229,13 +229,15 @@ def evidence_offers_choice(evidence: Any) -> bool:
    """
    if not isinstance(evidence, dict):
        return False
+    # The saver anchor's one pair (#390) is a suggestion to confirm.
+    needed = 1 if evidence.get("anchor") == "saver" else MIN_CHOOSABLE
    if evidence.get("limited"):
        total = evidence.get("candidate_total")
-        return type(total) is int and total >= MIN_CHOOSABLE
+        return type(total) is int and total >= needed
    candidates = evidence.get("candidates")
    if not isinstance(candidates, list):
        return False
-    return sum(1 for c in candidates if choosable(c)) >= MIN_CHOOSABLE
+    return sum(1 for c in candidates if choosable(c)) >= needed


 def evidence_digest(text: str) -> str:
@@ -380,15 +382,21 @@ def _structure_error(conn: sqlite3.Connection) -> Optional[str]:


 def _evidence_error(conn: sqlite3.Connection) -> Optional[str]:
-    """Stream every evidence document once; one row is held at a time."""
-    for evidence_hash, text in conn.execute(
+    """Stream every evidence document once; one row is held at a time.
+
+    Rows are read with ``fetchone``: iterating a managed connection's cursor
+    would prefetch ``ITER_CHUNK`` (128) rows (``database/managed_connection.py``).
+    """
+    items = conn.execute(
        f"SELECT evidence_hash, evidence FROM {ITEMS_TABLE}"  # nosec B608
-    ):
+    )
+    while (row := items.fetchone()) is not None:
+        evidence_hash, text = row[0], row[1]
        if not _is_canonical(text) or evidence_digest(text) != evidence_hash:
            return f"Review queue table {ITEMS_TABLE} contains invalid evidence"
-    for (text,) in conn.execute(
-        f"SELECT evidence FROM {DECISIONS_TABLE}"  # nosec B608
-    ):
+    decisions = conn.execute(f"SELECT evidence FROM {DECISIONS_TABLE}")  # nosec B608
+    while (row := decisions.fetchone()) is not None:
+        text = row[0]
        if not _is_canonical(text):
            return f"Review queue table {DECISIONS_TABLE} contains invalid evidence"
    return None
@@ -0,0 +1,368 @@
+"""Attribute an output file to a stored prompt through recorded history (#342).
+
+Execution history records, per run, the files ComfyUI reported
+(``execution_run_outputs``) and the PromptManager texts the run used
+(``execution_run_contexts``, whose ``positive_prompt_id`` hint is set only
+while the raw text matches exactly one stored prompt). A file is attributed
+only when all of this holds:
+
+- exactly one recorded run reported the file's output location (same output
+  root, subfolder and name);
+- the file was last written while that run was executing, from its dequeue
+  to its terminal event (else the finish callback): a later run that history
+  did not record may have reused the name;
+- every positive context of that run names the same stored prompt.
+
+Anything else returns None: the caller leaves the file unlinked. Read-only.
+
+``recorded_output`` applies the first two rules and returns, for the
+inspector (#386), the one output node (save node) that run reported the file
+from and the texts PromptManager recorded at execution per sampler.
+
+Lookups are batched (``stored_run_prompts``): one parameterized query per
+chunk of at most ``LOOKUP_CHUNK`` distinct file names, matched in memory. The
+history schema is left exactly as it is (no extra index), so older builds can
+still open the library.
+"""
+
+import logging
+import os
+import sqlite3
+import threading
+import weakref
+from dataclasses import dataclass
+from typing import Any, Callable, Dict, Iterable, List, Optional
+
+try:
+    from ..utils.execution_outputs import snapshot_output_roots
+    from ..utils.library_location import import_folder_paths
+except ImportError:
+    from utils.execution_outputs import snapshot_output_roots
+    from utils.library_location import import_folder_paths
+
+# File times may trail or lead the recorded run times a little (coarse file
+# system clocks, the write finishing just after the host reported it).
+MTIME_SLACK_MS = 2000
+
+# Distinct file names per lookup query: well under SQLite's bound-parameter
+# limit (999 on old builds), so a scan batch costs one query per chunk.
+LOOKUP_CHUNK = 500
+
+_RUNS_FOR_NAMES = (
+    "SELECT DISTINCT o.filename, o.subfolder, o.root_key, o.path_style, o.run_id, "
+    "r.observed_dequeue_at, COALESCE(r.terminal_event_at, r.observed_callback_at), "
+    "o.output_node_id "
+    "FROM execution_run_outputs o JOIN execution_runs r ON r.run_id = o.run_id "
+    "WHERE o.folder_type = 'output' AND o.filename IN ({marks})"
+)
+
+
+def host_output_directory() -> Optional[str]:
+    """ComfyUI's output directory, or None outside ComfyUI."""
+    folder_paths = import_folder_paths()
+    if folder_paths is None:
+        return None
+    try:
+        value = folder_paths.get_output_directory()
+    except Exception:
+        return None
+    return value if isinstance(value, str) and value else None
+
+
+def _inside(image_path: str, output_root: str) -> Optional[str]:
+    """``image_path`` relative to ``output_root``, or None when outside it."""
+    try:
+        relative = os.path.relpath(image_path, output_root)
+    except ValueError:  # another drive on Windows
+        return None
+    if os.path.isabs(relative) or relative == os.pardir:
+        return None
+    if relative.startswith(os.pardir + os.sep):
+        return None
+    return relative
+
+
+def _resolved(path: str) -> str:
+    try:
+        return os.path.realpath(path)
+    except (OSError, ValueError):
+        return os.path.abspath(path)
+
+
+def _location(image_path: str, output_root: str, path_style: str):
+    """(root key, subfolder, filename) as history records them, or None.
+
+    The root key is always the host's own spelling of its output folder,
+    because history recorded that one. The file may be spelled through the
+    same folder or through its resolved path (a symlinked or junction output
+    folder, as scan roots are): the lexical spelling is tried first, then
+    both sides resolved.
+    """
+    root_key = snapshot_output_roots(path_style, output_root, output_root).output_key
+    if root_key is None:
+        return None
+    relative = _inside(os.path.abspath(image_path), os.path.abspath(output_root))
+    if relative is None:
+        relative = _inside(_resolved(image_path), _resolved(output_root))
+    if relative is None:
+        return None
+    subfolder, filename = os.path.split(relative)
+    if not filename:
+        return None
+    return root_key, subfolder, filename
+
+
+def in_output_folder(image_path: str, output_root: Optional[str]) -> bool:
+    """Whether history could ever attribute ``image_path`` (inside the host's
+    output folder, in either spelling)."""
+    if not image_path or not output_root:
+        return False
+    style = "windows" if os.name == "nt" else "posix"
+    return _location(image_path, output_root, style) is not None
+
+
+def _written_during(image_path: str, started: Any, finished: Any) -> bool:
+    if not isinstance(started, int) or not isinstance(finished, int):
+        return False
+    try:
+        written = os.stat(image_path).st_mtime_ns // 1_000_000
+    except OSError:
+        return False
+    return started - MTIME_SLACK_MS <= written <= finished + MTIME_SLACK_MS
+
+
+def stored_run_prompt(
+    db: Any,
+    image_path: str,
+    output_root: Optional[str],
+    path_style: Optional[str] = None,
+) -> Optional[int]:
+    """The stored prompt id history attributes to ``image_path``, else None."""
+    if not image_path:
+        return None
+    return stored_run_prompts(db, [image_path], output_root, path_style).get(image_path)
+
+
+def _runs_by_location(db: Any, names: List[str]) -> Optional[Dict[tuple, dict]]:
+    """``{(filename, subfolder, root_key, style): {run_id: (start, end, nodes)}}``.
+
+    ``nodes`` is the set of output node ids that reported the location in that
+    run. One query per ``LOOKUP_CHUNK`` names; None without history tables.
+    """
+    found: Dict[tuple, dict] = {}
+    conn = db.model.get_connection()
+    for start in range(0, len(names), LOOKUP_CHUNK):
+        chunk = names[start : start + LOOKUP_CHUNK]
+        query = _RUNS_FOR_NAMES.format(marks=",".join("?" for _ in chunk))
+        try:
+            rows = conn.execute(query, chunk).fetchall()  # nosec B608
+        except sqlite3.Error:
+            return None  # no history tables (a library without history)
+        for name, subfolder, root_key, style, run_id, began, ended, node in rows:
+            runs = found.setdefault((name, subfolder, root_key, style), {})
+            runs.setdefault(run_id, (began, ended, set()))[2].add(node)
+    return found
+
+
+def _recorded_runs(
+    db: Any,
+    image_paths: Iterable[str],
+    output_root: Optional[str],
+    path_style: Optional[str],
+) -> Dict[str, tuple]:
+    """``{path: (run_id, output node ids)}`` for each file history attributes.
+
+    A file is attributed when exactly one recorded run reported its location
+    and it was last written while that run executed.
+    """
+    paths = list(dict.fromkeys(path for path in image_paths if path))
+    if not paths or not output_root:
+        return {}
+    style = path_style or ("windows" if os.name == "nt" else "posix")
+    located = {}
+    for path in paths:
+        location = _location(path, output_root, style)
+        if location is not None:
+            located[path] = location
+    if not located:
+        return {}
+    names = sorted({filename for _key, _sub, filename in located.values()})
+    runs = _runs_by_location(db, names)
+    if not runs:
+        return {}
+    attributed = {}
+    for path, (root_key, subfolder, filename) in located.items():
+        reported = runs.get((filename, subfolder, root_key, style), {})
+        if len(reported) != 1:
+            continue
+        ((run_id, (began, ended, nodes)),) = reported.items()
+        if _written_during(path, began, ended):
+            attributed[path] = (run_id, nodes)
+    return attributed
+
+
+def _named_prompt(db: Any, run_id: str) -> Optional[int]:
+    contexts = db.get_execution_contexts(run_id).get("contexts") or []
+    named = {
+        context.get("positive_prompt_id")
+        for context in contexts
+        if context.get("positive") is not None
+    }
+    if len(named) != 1:
+        return None
+    (prompt_id,) = named
+    return prompt_id if isinstance(prompt_id, int) else None
+
+
+def stored_run_prompts(
+    db: Any,
+    image_paths: Iterable[str],
+    output_root: Optional[str],
+    path_style: Optional[str] = None,
+) -> Dict[str, Optional[int]]:
+    """``{path: stored prompt id or None}`` for many files in few queries.
+
+    The output lookup is one query per ``LOOKUP_CHUNK`` distinct names; each
+    run that alone reported a file is then read once for its contexts.
+    """
+    paths = list(dict.fromkeys(path for path in image_paths if path))
+    result: Dict[str, Optional[int]] = dict.fromkeys(paths)
+    prompts: Dict[str, Optional[int]] = {}
+    for path, (run_id, _nodes) in _recorded_runs(
+        db, paths, output_root, path_style
+    ).items():
+        if run_id not in prompts:
+            prompts[run_id] = _named_prompt(db, run_id)
+        result[path] = prompts[run_id]
+    return result
+
+
+@dataclass(frozen=True)
+class RecordedOutput:
+    """What recorded history knows about the run that wrote one file (#386).
+
+    ``saver_id`` is the one output node the run reported the file from (None
+    when several did). ``texts`` maps each sampler anchor of the run to the
+    effective texts PromptManager recorded at execution for its roles
+    (``{"positive": text or None, "negative": text or None}``); a role whose
+    text was only inferred from the graph is None.
+    """
+
+    saver_id: Optional[str]
+    texts: Dict[str, Dict[str, Optional[str]]]
+
+
+def _recorded_texts(db: Any, run_id: str) -> Dict[str, Dict[str, Optional[str]]]:
+    texts = {}
+    for context in db.get_execution_contexts(run_id).get("contexts") or []:
+        evidence = context.get("evidence") or {}
+        roles = {}
+        for role in ("positive", "negative"):
+            values = context.get(role) or {}
+            proof = (evidence.get(role) or {}).get("effective") or {}
+            value = values.get("effective")
+            recorded = proof.get("provenance") == "recorded"
+            roles[role] = value if recorded and isinstance(value, str) else None
+        texts[context["anchor_id"]] = roles
+    return texts
+
+
+def recorded_output(
+    db: Any,
+    image_path: str,
+    output_root: Optional[str],
+    path_style: Optional[str] = None,
+) -> Optional[RecordedOutput]:
+    """The recorded run facts for ``image_path``, else None (#386).
+
+    The file must be attributed to one run (``_recorded_runs``: one run
+    reported its location and it was written during that run). Read-only; it
+    never links anything.
+    """
+    if not image_path:
+        return None
+    conn = db.model.get_connection()
+    own_transaction = not conn.in_transaction
+    if own_transaction:  # outputs and texts from one state of history
+        conn.execute("BEGIN")
+    try:
+        found = _recorded_runs(db, [image_path], output_root, path_style)
+        if image_path not in found:
+            return None
+        run_id, nodes = found[image_path]
+        saver = next(iter(nodes)) if len(nodes) == 1 else None
+        return RecordedOutput(saver, _recorded_texts(db, run_id))
+    finally:
+        if own_transaction:
+            conn.rollback()
+
+
+_LOGGER = logging.getLogger("prompt_manager.run_attribution")
+
+
+def recorded_output_lookup(
+    db: Any, *, close: bool = False, reference: Optional[dict] = None
+) -> Callable[[Any], Any]:
+    """``lookup(path) -> RecordedOutput or None`` for the inspect routes (#386).
+
+    Uses ComfyUI's output folder. Any failure (no history, a locked library)
+    is logged and names no node, so the file is judged from its own metadata.
+    ``close`` closes the calling thread's connection afterwards, for routes
+    that close theirs after reading. ``reference`` (a history occurrence's
+    output reference) spells the file as history recorded it: the route's
+    target is case-normalized on Windows, and history matches names exactly.
+    """
+
+    def lookup(path: Any) -> Optional[RecordedOutput]:
+        root = host_output_directory()
+        if reference is not None:
+            if reference.get("folder_type") != "output" or not root:
+                return None
+            path = os.path.join(
+                root, reference.get("subfolder") or "", reference.get("filename") or ""
+            )
+        try:
+            return recorded_output(db, str(path), root)
+        except (sqlite3.Error, OSError, ValueError):
+            _LOGGER.warning("Recorded run lookup failed", exc_info=True)
+            return None
+        except Exception:
+            _LOGGER.exception("Recorded run lookup failed unexpectedly")
+            return None
+        finally:
+            if close:
+                db.model.close()
+
+    return lookup
+
+
+_SEALED_LISTENERS: List[weakref.WeakMethod] = []
+_SEALED_LOCK = threading.Lock()
+
+
+def subscribe_outputs_sealed(method: Callable[[str, List[dict]], None]) -> None:
+    """Call bound ``method(run_id, references)`` after a run's outputs are recorded.
+
+    Held weakly: a listener that is garbage collected is dropped.
+    """
+    with _SEALED_LOCK:
+        _SEALED_LISTENERS.append(weakref.WeakMethod(method))
+
+
+def notify_outputs_sealed(run_id: str, references: Iterable[dict]) -> None:
+    """Tell listeners a run's output references were just committed.
+
+    A listener failure is logged and never reaches the history writer.
+    """
+    references = list(references)
+    with _SEALED_LOCK:
+        alive = [ref for ref in _SEALED_LISTENERS if ref() is not None]
+        _SEALED_LISTENERS[:] = alive
+        listeners = [ref() for ref in alive]
+    for listener in listeners:
+        if listener is None:
+            continue
+        try:
+            listener(run_id, references)
+        except Exception:
+            _LOGGER.warning("Output seal listener failed", exc_info=True)
@@ -0,0 +1,185 @@
+"""Safety backups beside the live database: one writer for every caller.
+
+A safety backup is ``<db>.<label>_<YYYYmmdd_HHMMSS_ffffff>[_n]`` in the
+library's own folder. It is written by SQLite's backup API into a temp file
+beside the database (``SAFETY_TEMP_PREFIX``, swept at startup after a crash),
+made one self-contained file (rollback journal), optionally verified, fsynced,
+made private (``0o600`` on POSIX) and only then given its unique name, so a
+backup name never carries a half-written file. The names are unique within
+one second (microseconds, then a counter): on Windows two backups in the same
+second must not overwrite each other.
+
+Maintenance applies take a verified backup (``py/api/maintenance.py``); a
+restore takes an unverified one, because the database it replaces may be the
+damaged one the user is recovering from (``database/restore_stage.py``).
+"""
+
+import datetime
+import os
+import sqlite3
+import tempfile
+from contextlib import closing
+
+SAFETY_TEMP_PREFIX = ".pm-safety-"
+_NAME_ATTEMPTS = 1000
+
+
+class SafetyBackupFailed(Exception):
+    """The safety backup could not be written, verified or put in place.
+
+    ``reason`` is the verify reason when the copy did not verify.
+    """
+
+    def __init__(self, message, reason=None):
+        super().__init__(message)
+        self.reason = reason
+
+
+def _now():
+    return datetime.datetime.now()
+
+
+def remove_quietly(*paths):
+    """Remove each existing path, ignoring errors (cleanup after a failure)."""
+    for path in paths:
+        try:
+            if path and os.path.exists(path):
+                os.remove(path)
+        except OSError:
+            pass
+
+
+def backup_names(db_path, label="backup"):
+    """Candidate names, unique within one second (microseconds, then ``_n``)."""
+    base = f"{db_path}.{label}_{_now().strftime('%Y%m%d_%H%M%S_%f')}"
+    for attempt in range(_NAME_ATTEMPTS):
+        yield base if attempt == 0 else f"{base}_{attempt}"
+
+
+def reserve_backup_name(db_path, label="backup"):
+    """Create and return an unused ``<db>.<label>_<stamp>[_n]`` (O_EXCL)."""
+    for candidate in backup_names(db_path, label):
+        try:
+            fd = os.open(candidate, os.O_CREAT | os.O_EXCL | os.O_WRONLY, 0o600)
+        except FileExistsError:
+            continue
+        os.close(fd)
+        return candidate
+    raise SafetyBackupFailed("No free backup name")
+
+
+def place_backup(temp, db_path, label="backup"):
+    """Give the finished ``temp`` its unique backup name; return that path.
+
+    ``os.link`` is atomic and refuses an existing name, so no empty or half
+    file ever carries a backup name, even across a crash. A filesystem
+    without hard links falls back to reserving the name (``O_EXCL``) and
+    ``os.replace``. The temp file is removed by the caller.
+    """
+    for candidate in backup_names(db_path, label):
+        try:
+            os.link(temp, candidate)
+        except FileExistsError:
+            continue
+        except (OSError, NotImplementedError):
+            break  # no hard links here
+        else:
+            return candidate
+    else:
+        raise SafetyBackupFailed("No free backup name")
+    final = reserve_backup_name(db_path, label)
+    try:
+        os.replace(temp, final)
+    except OSError:
+        remove_quietly(final)
+        raise
+    return final
+
+
+def sweep_safety_temps(db_path):
+    """Remove the temp copies an interrupted safety backup left (blocking).
+
+    Called once at startup, before any job can take a backup. Returns the
+    names removed.
+    """
+    folder = os.path.dirname(os.path.abspath(db_path))
+    removed = []
+    try:
+        names = os.listdir(folder)
+    except OSError:
+        return removed
+    for name in names:
+        if not (name.startswith(SAFETY_TEMP_PREFIX) and ".tmp" in name):
+            continue
+        try:
+            os.remove(os.path.join(folder, name))
+            removed.append(name)
+        except OSError:
+            continue
+    return removed
+
+
+def make_standalone(path):
+    """Make the copy one self-contained file (rollback journal, not WAL).
+
+    The backup API copies the live database's WAL flag; a WAL file opened
+    read-only later (a verify, a restore preview) would leave ``-wal`` and
+    ``-shm`` sidecars beside it.
+    """
+    try:
+        with closing(sqlite3.connect(path)) as conn:
+            conn.execute("PRAGMA journal_mode=DELETE").fetchone()
+    except sqlite3.Error as exc:
+        raise SafetyBackupFailed("The backup could not be finished") from exc
+
+
+def fsync_file(path):
+    with open(path, "rb+") as handle:
+        os.fsync(handle.fileno())
+
+
+def safety_temp(db_path):
+    """A new, closed temp file beside the database (``SAFETY_TEMP_PREFIX``)."""
+    fd, temp = tempfile.mkstemp(
+        dir=os.path.dirname(os.path.abspath(db_path)),
+        prefix=SAFETY_TEMP_PREFIX,
+        suffix=".tmp",
+    )
+    os.close(fd)
+    return temp
+
+
+def take_safety_backup(model, label="backup", *, verify=True):
+    """Write (and by default verify) a safety backup; return its path (blocking).
+
+    The copy is made in a temp file beside the database and only renamed
+    onto its final, unique name ``<db>.<label>_<stamp>`` once it is complete
+    (and verified), so a backup file on disk is always a whole one. ``label``
+    "backup" joins the pruned pool; another label (the workflow storage
+    migration's ``pre-workflow-storage``) is kept until the user removes it.
+    Raises SafetyBackupFailed, leaving no file.
+    """
+    db_path = os.path.abspath(model.db_path)
+    temp = safety_temp(db_path)
+    final = None
+    try:
+        if not model.backup_database(temp):
+            raise SafetyBackupFailed("The backup could not be written")
+        make_standalone(temp)
+        if verify:
+            ok, reason = model.verify_database_file(temp)
+            if not ok:
+                raise SafetyBackupFailed("The backup did not verify", reason)
+        fsync_file(temp)
+        if os.name != "nt":
+            os.chmod(temp, 0o600)
+        final = place_backup(temp, db_path, label)
+        return final
+    except OSError as exc:
+        remove_quietly(final)
+        raise SafetyBackupFailed("The backup could not be put in place") from exc
+    except SafetyBackupFailed:
+        remove_quietly(final)
+        raise
+    finally:
+        remove_quietly(temp, temp + "-journal", temp + "-wal", temp + "-shm")
@@ -475,3 +475,178 @@ def release_documents(conn: sqlite3.Connection, ids: Iterable[Optional[int]]) ->
 def sweep_documents(conn: sqlite3.Connection) -> int:
    """Delete every document no image row references; returns the count."""
    return conn.execute(SWEEP_SQL).rowcount
+
+
+# ── repair (a restore's stage) ────────────────────────────────────────
+
+INLINE_TEXTS_SQL = (
+    "SELECT workflow_data, prompt_metadata FROM generated_images "
+    "WHERE workflow_data IS NOT NULL OR prompt_metadata IS NOT NULL"
+)
+REKEY_SQL = "UPDATE workflow_documents SET sha256=?, byte_length=? WHERE id=?"
+
+
+def _rows(conn: sqlite3.Connection, sql: str, params=()):
+    """Each row of ``sql``, read one at a time.
+
+    Iterating a managed connection's cursor prefetches ``ITER_CHUNK`` (128)
+    rows, and a document or inline text can be megabytes.
+    """
+    cursor = conn.execute(sql, params)
+    while (row := cursor.fetchone()) is not None:
+        yield row
+
+
+def _inflated(data) -> Optional[bytes]:
+    """The complete text bytes ``data`` inflates to, or None.
+
+    Complete means the zlib stream ends (its Adler-32 checked) within
+    MAX_DOCUMENT_BYTES with nothing after it: the body is intact even when
+    the row's recorded hash or length is not.
+    """
+    try:
+        inflater = zlib.decompressobj()
+        raw = inflater.decompress(bytes(data), MAX_DOCUMENT_BYTES + 1)
+        if not inflater.eof or inflater.unconsumed_tail or inflater.unused_data:
+            return None
+        if len(raw) > MAX_DOCUMENT_BYTES:
+            return None
+        raw.decode("utf-8")
+        return raw
+    except (zlib.error, TypeError, UnicodeDecodeError):
+        return None
+
+
+def _one_column_off(row, raw: bytes) -> bool:
+    """Whether only the recorded hash or only the recorded length is wrong.
+
+    The two columns check the body independently. When the body inflates
+    completely and one of them still agrees with it, that column vouches for
+    the body and the other one is the damaged value. When both disagree, the
+    body itself is the suspect (another valid stream), so it is not trusted.
+    """
+    hash_ok = hashlib.sha256(raw).digest() == bytes(row[0])
+    length_ok = row[1] == len(raw)
+    return hash_ok != length_ok
+
+
+def _inline_copies(conn: sqlite3.Connection, wanted: Dict[bytes, int]):
+    """``{document id: text}`` for each wanted hash an inline row still holds."""
+    found: Dict[int, str] = {}
+    for row in _rows(conn, INLINE_TEXTS_SQL):
+        for text in row:
+            if not isinstance(text, str) or not storable(text):
+                continue
+            document_id = wanted.get(hashlib.sha256(text.encode("utf-8")).digest())
+            if document_id is not None and document_id not in found:
+                found[document_id] = text
+        if len(found) == len(wanted):
+            break
+    return found
+
+
+def _rekey(conn: sqlite3.Connection, document_id: int, raw: bytes) -> Optional[int]:
+    """Give an intact body its true key, or merge it into the document that has it.
+
+    Returns the holder's id when its own body was damaged and has just been
+    rewritten from ``raw`` (it is repaired, never to be cleared), else None.
+    """
+    digest = hashlib.sha256(raw).digest()
+    holder = conn.execute(LOOKUP_SQL, (digest,)).fetchone()
+    if holder is None or holder[0] == document_id:
+        conn.execute(REKEY_SQL, (digest, len(raw), document_id))
+        return None
+    for column in DOCUMENT_ID_COLUMNS:
+        # ``column`` is one of DOCUMENT_ID_COLUMNS, never caller data.
+        conn.execute(
+            f"UPDATE generated_images SET {column}=? WHERE {column}=?",  # nosec B608
+            (holder[0], document_id),
+        )
+    conn.execute("DELETE FROM workflow_documents WHERE id=?", (document_id,))
+    if _decode(holder[1:], holder[0], quiet=True) is None:
+        conn.execute(
+            REPAIR_SQL, (len(raw), zlib.compress(raw, COMPRESSION_LEVEL), holder[0])
+        )
+        return holder[0]
+    return None
+
+
+def repair_damaged_documents(conn: sqlite3.Connection) -> Dict[str, int]:
+    """Repair or clear every document failing its checks; commit (writes).
+
+    For a restore's stage only, never the live library. In order:
+
+    1. A document whose body inflates completely and whose recorded hash or
+       length (not both) disagrees is re-keyed from its text, or merged
+       into the document that already holds that text (``_one_column_off``).
+    2. A damaged body whose exact text an inline row still holds (the same
+       SHA-256, its key) is stored again from that text.
+    3. Any other damaged document is unreadable for good: its images'
+       references are cleared (they already showed no workflow) and the
+       document is removed, so the stage verifies.
+
+    Returns ``{repaired, cleared, images}``: documents repaired (1 and 2),
+    documents cleared and the distinct image rows whose reference was
+    cleared. Rows are read one at a time.
+    """
+    damaged: Dict[bytes, int] = {}
+    intact: Dict[int, bytes] = {}
+    for row in _rows(conn, ALL_DOCUMENTS_SQL):
+        if _decode(row[:3], row[3], quiet=True) is None:
+            raw = _inflated(row[2])
+            if raw is not None and _one_column_off(row, raw):
+                intact[row[3]] = raw
+            else:
+                damaged[bytes(row[0])] = row[3]
+    result = {"repaired": 0, "cleared": 0, "images": 0}
+    if not damaged and not intact:
+        return result
+    with conn:
+        healed = []
+        for document_id, raw in intact.items():
+            holder = _rekey(conn, document_id, raw)
+            if holder is not None and holder in damaged.values():
+                # Rewritten from the merged body: repaired, not to be cleared
+                # (it now also holds the merged images' references).
+                damaged = {k: v for k, v in damaged.items() if v != holder}
+                healed.append(holder)
+        copies = _inline_copies(conn, damaged) if damaged else {}
+        for document_id, text in copies.items():
+            raw = text.encode("utf-8")
+            data = zlib.compress(raw, COMPRESSION_LEVEL)
+            conn.execute(REPAIR_SQL, (len(raw), data, document_id))
+        lost = sorted(set(damaged.values()) - set(copies))
+        images: Set[int] = set()
+        for chunk in _chunks(lost):
+            marks = ",".join("?" * len(chunk))
+            # ``marks`` is only "?" placeholders; the ids are bound.
+            for (image_id,) in _rows(
+                conn,
+                "SELECT id FROM generated_images WHERE "  # nosec B608
+                f"workflow_document_id IN ({marks}) OR prompt_document_id IN ({marks})",
+                chunk + chunk,
+            ):
+                images.add(image_id)
+            for column in DOCUMENT_ID_COLUMNS:
+                conn.execute(
+                    f"UPDATE generated_images SET {column}=NULL "  # nosec B608
+                    f"WHERE {column} IN ({marks})",
+                    chunk,
+                )
+            conn.execute(
+                f"DELETE FROM workflow_documents WHERE id IN ({marks})",  # nosec B608
+                chunk,
+            )
+    for document_id in list(intact) + healed + list(copies):
+        logger.warning(f"Workflow document {document_id} was damaged; repaired")
+    if lost:
+        logger.warning(
+            f"{len(lost)} damaged workflow document(s) could not be repaired; "
+            f"{len(images)} image(s) show no workflow"
+        )
+    result.update(
+        repaired=len(intact) + len(healed) + len(copies),
+        cleared=len(lost),
+        images=len(images),
+    )
+    return result
@@ -26,13 +26,13 @@ except ImportError:
    InputTypeDict = dict

 try:
-    from .prompt_manager_base import PromptManagerBase
+    from .prompt_manager_base import SAVE_TO_LIBRARY_INPUT, PromptManagerBase
 except ImportError:
    import os
    import sys

    sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
-    from prompt_manager_base import PromptManagerBase
+    from prompt_manager_base import SAVE_TO_LIBRARY_INPUT, PromptManagerBase


 class PromptManager(PromptManagerBase, ComfyNodeABC):
@@ -115,6 +115,7 @@ class PromptManager(PromptManagerBase, ComfyNodeABC):
                        )
                    },
                ),
+                "save_to_library": SAVE_TO_LIBRARY_INPUT,
            },
            "hidden": {
                # The queued graph and this node's id: used to tell the positive
@@ -152,6 +153,7 @@ class PromptManager(PromptManagerBase, ComfyNodeABC):
        append_text: str = "",
        prompt: Optional[Dict[str, Any]] = None,
        unique_id: Optional[str] = None,
+        save_to_library: bool = True,
    ) -> Tuple[Any]:
        """
        Encode the text prompt and save it to the database.
@@ -164,6 +166,7 @@ class PromptManager(PromptManagerBase, ComfyNodeABC):
            search_text: Text to search for in past prompts
            prepend_text: Text to prepend to the main prompt
            append_text: Text to append to the main prompt
+            save_to_library: Off: nothing is saved, counted or tracked (#90)

        Returns:
            Tuple containing the conditioning for the diffusion model and the final
@@ -205,7 +208,9 @@ class PromptManager(PromptManagerBase, ComfyNodeABC):
        # Save prompt to database and set execution context for gallery tracking
        prompt_id = None
        extended_tags = []
-        if storage_text and storage_text.strip():
+        if not save_to_library:
+            self._skip_not_saved(prompt, unique_id)
+        elif storage_text and storage_text.strip():
            self.logger.debug(f"Processing prompt text: {storage_text[:100]}...")

            # Add prepend/append info to tags if they exist
@@ -238,6 +243,9 @@ class PromptManager(PromptManagerBase, ComfyNodeABC):
            except Exception as e:
                # Log error but don't fail the encoding
                self.logger.warning(f"Failed to save prompt to database: {e}")
+                self._mark_untracked(prompt, unique_id)
+        else:
+            self._skip_empty_prompt(prompt, unique_id)

        # Perform standard CLIP text encoding using the combined text
        self.logger.debug(
@@ -246,6 +254,11 @@ class PromptManager(PromptManagerBase, ComfyNodeABC):
        tokens = clip.tokenize(encoding_text)
        conditioning = clip.encode_from_tokens_scheduled(tokens)

+        self.logger.info(f"CLIP encoding completed, text: {repr(encoding_text)[:80]}")
+        result = (conditioning, encoding_text)
+        if not save_to_library:
+            return result  # #90: no metadata registration, no history text
+
        # Register with ComfyUI integration for standard metadata compatibility
        node_id = f"promptmanager_{int(time.time() * 1000)}"
        self.comfyui_integration.register_prompt(
@@ -259,12 +272,10 @@ class PromptManager(PromptManagerBase, ComfyNodeABC):
                "append_text": append_text.strip() if append_text else None,
            },
        )
-
-        self.logger.info(f"CLIP encoding completed, text: {repr(encoding_text)[:80]}")
-        result = (conditioning, encoding_text)
        record_runtime_context(
            type(self).__name__, text, prepend_text, append_text, encoding_text
        )
+        self._record_cached_item(unique_id, (encoding_text,), storage_text)
        return result

    @classmethod
@@ -23,8 +23,16 @@ try:
    from .utils.image_monitor import get_image_monitor
    from .utils.prompt_tracker import get_prompt_tracker
    from .utils.hashing import generate_prompt_hash
-    from .utils.prompt_graph import resolve_text, run_prompt_nodes
+    from .utils.prompt_graph import resolve_text, run_prompt_nodes, save_setting
+    from .utils.run_keys import executing_run_id, prompt_node_key
    from .utils.usage_tracking import PENDING_FIRST_USE
+    from .utils.cached_runs import (
+        CACHED_RUNS,
+        Role,
+        Seen,
+        own_counts,
+        stored_facts,
+    )
 except ImportError:
    import sys

@@ -34,8 +42,32 @@ except ImportError:
    from utils.image_monitor import get_image_monitor
    from utils.prompt_tracker import get_prompt_tracker
    from utils.hashing import generate_prompt_hash
-    from utils.prompt_graph import resolve_text, run_prompt_nodes
+    from utils.prompt_graph import resolve_text, run_prompt_nodes, save_setting
+    from utils.run_keys import executing_run_id, prompt_node_key
    from utils.usage_tracking import PENDING_FIRST_USE
+    from utils.cached_runs import (
+        CACHED_RUNS,
+        Role,
+        Seen,
+        own_counts,
+        stored_facts,
+    )
+
+
+# The optional input every PromptManager node declares last (#90): declared
+# last so no widget value of a workflow saved before it shifts.
+SAVE_TO_LIBRARY_INPUT = (
+    "BOOLEAN",
+    {
+        "default": True,
+        "label_on": "save",
+        "label_off": "skip",
+        "tooltip": (
+            "Save this node's prompt to the library, count its runs and link its "
+            "images. Off: PromptManager ignores the run; the output is unchanged."
+        ),
+    },
+)


 class PromptManagerBase:
@@ -69,8 +101,10 @@ class PromptManagerBase:
        """Save the prompt to the SQLite database.

        Runs are normally counted by the queue hook (utils/usage_tracking.py), so a
-        save only counts one when asked to (batch items whose text the hook could not
-        see) or when the hook queued this prompt before it existed.
+        save only counts one when asked to (text the hook could not see, unless
+        this job already counted the node from ComfyUI's cache) or when the hook
+        queued this prompt before it existed. The two are independent: the
+        pending catch-up is written even when ``count_run`` is False.

        Args:
            text: The prompt text
@@ -138,7 +172,9 @@ class PromptManagerBase:
        resolved = resolve_text(prompt_graph, node_id)
        return {
            "is_run_prompt": node_id in run_prompt_nodes(prompt_graph),
+            # The hook skips a switch it cannot read (#90): the node counts
            "seen_at_queue": resolved is not None
+            and save_setting(prompt_graph, node_id) is True
            and generate_prompt_hash(resolved) == generate_prompt_hash(text),
            "known": True,
        }
@@ -165,17 +201,127 @@ class PromptManagerBase:
        batch_item = (
            role["known"] and role["is_run_prompt"] and not role["seen_at_queue"]
        )
-        prompt_id = self._save_prompt_to_database(
-            text=text, category=category, tags=tags, count_run=batch_item
+        counts = own_counts(
+            type(self).__name__,
+            stored_facts(text),
+            Role(
+                frozenset({"text"} if role["known"] and role["is_run_prompt"] else ())
+            ),
+            Seen(text=role["seen_at_queue"]),
        )
-        if prompt_id and role["is_run_prompt"]:
+        prompt_id = self._save_prompt_to_database(
+            text=text,
+            category=category,
+            tags=tags,
+            count_run=bool(counts) and not self._replayed(unique_id),
+        )
+        if role["is_run_prompt"] and not prompt_id:
+            # The save failed: an older entry of this key must not stand in (#342)
+            self._mark_untracked(prompt_graph, unique_id)
+        elif role["is_run_prompt"]:
            self.prompt_tracker.set_current_prompt(
                prompt_text=encoding_text,
                additional_data={**additional_data, "prompt_id": prompt_id},
                push_to_queue=batch_item or not role["known"],
+                **self._run_identity(prompt_graph, unique_id),
            )
        return prompt_id

+    def _cached_runs(self) -> Any:
+        return getattr(self, "cached_runs", CACHED_RUNS)
+
+    def _replayed(self, unique_id: Any) -> bool:
+        """This job already counted the node from ComfyUI's cache (#347).
+
+        A RAM-pressure cache can free the entry after ``execution_cached``, so
+        the node executes in a job that replayed it: its own count is skipped.
+        """
+        try:
+            return unique_id is not None and self._cached_runs().replayed(unique_id)
+        except Exception as error:
+            self.logger.debug(f"Could not check the cached-run replay: {error}")
+            return False
+
+    def _record_cached_item(
+        self, unique_id: Any, outputs: tuple, text: Any, negative_text: Any = None
+    ) -> None:
+        """Remember this execution's outputs and stored text for cached jobs (#347)."""
+        if unique_id is None:
+            return
+        try:
+            self._cached_runs().record_item(
+                unique_id, outputs, stored_facts(text, negative_text)
+            )
+        except Exception as error:
+            self.logger.debug(f"Could not record the cached-run receipt: {error}")
+
+    @staticmethod
+    def _run_identity(prompt_graph: Any, unique_id: Any) -> Dict[str, Any]:
+        """The tracker's proof that an image belongs to this execution (#342)."""
+        return {
+            "run_key": prompt_node_key(prompt_graph, unique_id),
+            "run_id": executing_run_id(),
+        }
+
+    def _skip_not_saved(self, prompt_graph: Any = None, unique_id: Any = None) -> None:
+        """``save_to_library`` is off: nothing is saved, counted or tracked (#90).
+
+        A literal off makes the node no run prompt (``utils.prompt_graph``), so
+        no image looks up its run key. A switch wired from a node the graph
+        cannot read keeps the node a run prompt: its run key is marked like an
+        empty editor's, so an earlier run's entry of that key never links this
+        run's images.
+        """
+        message = (
+            "Save to library is off for this node: its prompt is not saved, the "
+            "run is not counted and its images are not linked"
+        )
+        if isinstance(prompt_graph, dict) and unique_id is not None:
+            self._mark_untracked(prompt_graph, unique_id, message)
+        else:
+            self.logger.info(message)
+
+    def _skip_empty_prompt(self, prompt_graph: Any, unique_id: Any) -> None:
+        """The ``text`` editor is empty: save and track nothing (#342).
+
+        Prepend and append text are deliberately never stored as the prompt, so
+        an empty editor has no prompt to save, count or link. For the run's
+        positive node this is logged at info and the node's run key is marked
+        empty (``_mark_untracked``).
+        """
+        self._mark_untracked(
+            prompt_graph,
+            unique_id,
+            "Prompt text is empty (prepend and append text are not stored): "
+            "nothing saved or tracked, and this run's images stay unlinked",
+        )
+
+    def _mark_untracked(
+        self, prompt_graph: Any, unique_id: Any, message: Optional[str] = None
+    ) -> None:
+        """This execution of a positive node has no prompt to link (#342).
+
+        An empty editor, or a save or tracking failure. The node's run key is
+        marked with a placeholder, so no earlier prompt of that key can be
+        linked to this run's images, and a batch item keeps its queue place.
+        ``message`` is logged at info for a positive node.
+        """
+        try:
+            role = self._prompt_role(prompt_graph, unique_id, "")
+            if not role["is_run_prompt"]:
+                if message:
+                    self.logger.debug("Empty text on a non-positive node; not saved")
+                return
+            if message:
+                self.logger.info(message)
+            self.prompt_tracker.mark_empty(
+                push_to_queue=role["known"],
+                **self._run_identity(prompt_graph, unique_id),
+            )
+        except Exception as error:
+            # Tracking must never block generation
+            self.logger.warning(f"Could not mark the untracked prompt: {error}")
+
    def _record_use(self, prompt_id: int, times: int = 1) -> None:
        """Count runs; a tracking failure must never block generation."""
        try:
@@ -213,8 +359,10 @@ class PromptManagerBase:

        cache = get_trigger_cache()

-        # Lazy-load cache on first use
-        if not cache.is_loaded and IntegrationConfig.LORA_MANAGER_PATH:
+        # Lazy-load cache on first use; a failed load waits before the next try
+        # (#355: never a rescan of LoraManager's folders on every run).
+        retry_due = getattr(cache, "retry_due", lambda: True)
+        if not cache.is_loaded and IntegrationConfig.LORA_MANAGER_PATH and retry_due():
            cache.load(IntegrationConfig.LORA_MANAGER_PATH)

        modified, injected = inject_trigger_words(text, cache)
@@ -12,9 +12,21 @@ else:

 try:
    from .prompt_manager import IO, InputTypeDict, PromptManagerFocused
+    from .utils.cached_runs import (
+        PAIR,
+        Role,
+        Seen,
+        own_counts,
+        pair_components,
+        stored_facts,
+    )
    from .utils.hashing import generate_prompt_hash
    from .utils.pair_execution import record_pair_execution
-    from .utils.prompt_graph import intrinsic_pair_nodes, run_prompt_components
+    from .utils.prompt_graph import (
+        intrinsic_pair_nodes,
+        run_prompt_components,
+        save_setting,
+    )
    from .utils.prompt_pair_resolver import resolve_text_input
    from .utils.usage_tracking import (
        PENDING_FIRST_USE,
@@ -23,9 +35,21 @@ try:
    )
 except ImportError:
    from prompt_manager import IO, InputTypeDict, PromptManagerFocused
+    from utils.cached_runs import (
+        PAIR,
+        Role,
+        Seen,
+        own_counts,
+        pair_components,
+        stored_facts,
+    )
    from utils.hashing import generate_prompt_hash
    from utils.pair_execution import record_pair_execution
-    from utils.prompt_graph import intrinsic_pair_nodes, run_prompt_components
+    from utils.prompt_graph import (
+        intrinsic_pair_nodes,
+        run_prompt_components,
+        save_setting,
+    )
    from utils.prompt_pair_resolver import resolve_text_input
    from utils.usage_tracking import (
        PENDING_FIRST_USE,
@@ -74,8 +98,13 @@ class PromptManagerPair(PromptManagerFocused):
        prompt: Optional[Dict[str, Any]] = None,
        unique_id: Optional[str] = None,
        extra_pnginfo: Optional[Dict[str, Any]] = None,
+        save_to_library: bool = True,
    ) -> Tuple[Any, Any, str, str]:
-        """Encode both sides once; database and tracking failures never block CLIP."""
+        """Encode both sides once; database and tracking failures never block CLIP.
+
+        With ``save_to_library`` off nothing is saved, counted, tracked or
+        recorded (#90); the four outputs are the same.
+        """
        if clip is None:
            raise RuntimeError("ERROR: clip input is invalid: None")
        if not isinstance(text, str) or not isinstance(negative_text, str):
@@ -93,6 +122,10 @@ class PromptManagerPair(PromptManagerFocused):
        negative_conditioning = clip.encode_from_tokens_scheduled(
            clip.tokenize(negative_text)
        )
+        result = positive_conditioning, negative_conditioning, positive, negative_text
+        if not save_to_library:
+            self._skip_not_saved(prompt, unique_id)
+            return result
        record_pair_execution(
            extra_pnginfo,
            unique_id,
@@ -117,85 +150,29 @@ class PromptManagerPair(PromptManagerFocused):
        )
        is_positive = "text" in used_fields
        pair_used = node_id in intrinsic_pair_nodes(prompt) if known else True
-        try:
-            pair_id = self.db.save_prompt_pair(
-                text,
-                negative_text,
-                category=category.strip() or None,
-                tags=self._parse_tags(tags),
-            )
-            pair = self.db.get_prompt_pair(pair_id)
-            prompt_id = pair["positive_prompt_id"]
-            resolved_positive = (
-                resolve_text_input(prompt, node_id, "text") if known else None
-            )
-            resolved_negative = (
-                resolve_text_input(prompt, node_id, "negative_text") if known else None
-            )
-            positive_seen = resolved_positive is not None and generate_prompt_hash(
-                resolved_positive
-            ) == generate_prompt_hash(text)
-            pair_seen = (
-                positive_seen
-                and resolved_negative is not None
-                and generate_prompt_hash(resolved_negative)
-                == generate_prompt_hash(negative_text)
-            )
-            positive_pending = getattr(self, "pending_first_use", PENDING_FIRST_USE)
-            pair_pending = getattr(
-                self, "pending_pair_first_use", PENDING_PAIR_FIRST_USE
-            )
-            counted = set()
-            for field, component_text, resolved_text, component_id in (
-                ("text", text, resolved_positive, prompt_id),
-                (
-                    "negative_text",
+        if not text.strip():
+            # Nothing to store: prepend/append are never the stored prompt (#342)
+            self._skip_empty_prompt(prompt, unique_id)
+        else:
+            try:
+                pair_id, prompt_id = self._save_and_track_pair(
+                    text,
                    negative_text,
-                    resolved_negative,
-                    pair["negative_prompt_id"],
-                ),
-            ):
-                component_hash = generate_prompt_hash(component_text)
-                if (
-                    field not in used_fields
-                    or not component_id
-                    or component_hash in counted
-                ):
-                    continue
-                counted.add(component_hash)
-                seen_at_queue = (
-                    resolved_text is not None
-                    and generate_prompt_hash(resolved_text) == component_hash
+                    positive,
+                    category=category,
+                    tags=tags,
+                    prepend_text=prepend_text,
+                    append_text=append_text,
+                    prompt=prompt,
+                    unique_id=unique_id,
+                    used_fields=used_fields,
+                    is_positive=is_positive,
+                    pair_used=pair_used,
                )
-                runs = positive_pending.consume(component_hash) + int(not seen_at_queue)
-                if runs:
-                    self.db.record_prompt_use(component_id, times=runs)
-            if pair_used:
-                runs = pair_pending.consume(pair_run_key(text, negative_text)) + int(
-                    not pair_seen
-                )
-                if runs:
-                    self.db.record_prompt_pair_use(pair_id, times=runs)
-            if is_positive:
-                self.prompt_tracker.set_current_prompt(
-                    prompt_text=positive,
-                    additional_data={
-                        "prompt_id": prompt_id,
-                        "pair_id": pair_id if pair_used else None,
-                        "positive_text": positive,
-                        "negative_text": negative_text,
-                        "positive_storage_text": text.strip(),
-                        "negative_storage_text": negative_text.strip(),
-                        "prepend_text": prepend_text.strip(),
-                        "append_text": append_text.strip(),
-                        "final_text": positive,
-                        "category": category.strip() or None,
-                        "tags": self._parse_tags(tags) or [],
-                    },
-                    push_to_queue=not positive_seen or (pair_used and not pair_seen),
-                )
-        except Exception as error:
-            self.logger.warning(f"Could not save or track paired prompt: {error}")
+            except Exception as error:
+                self.logger.warning(f"Could not save or track paired prompt: {error}")
+                if is_positive:
+                    self._mark_untracked(prompt, unique_id)
        try:
            self.comfyui_integration.register_prompt(
                f"promptmanager_pair_{time.time_ns()}",
@@ -209,7 +186,6 @@ class PromptManagerPair(PromptManagerFocused):
            )
        except Exception as error:
            self.logger.warning(f"Could not register paired metadata: {error}")
-        result = positive_conditioning, negative_conditioning, positive, negative_text
        record_runtime_context(
            type(self).__name__,
            text,
@@ -221,8 +197,109 @@ class PromptManagerPair(PromptManagerFocused):
        record_runtime_context(
            type(self).__name__, negative_text, "", "", negative_text, role="negative"
        )
+        self._record_cached_item(
+            unique_id, (positive, negative_text), text, negative_text
+        )
        return result

+    def _save_and_track_pair(
+        self,
+        text: str,
+        negative_text: str,
+        positive: str,
+        *,
+        category: str,
+        tags: str,
+        prepend_text: str,
+        append_text: str,
+        prompt: Optional[Dict[str, Any]],
+        unique_id: Optional[str],
+        used_fields: set,
+        is_positive: bool,
+        pair_used: bool,
+    ) -> Tuple[Optional[int], Optional[int]]:
+        """Save the recipe, count its runs and register the positive for linking."""
+        known = isinstance(prompt, dict) and unique_id is not None
+        node_id = str(unique_id)
+        pair_id = self.db.save_prompt_pair(
+            text,
+            negative_text,
+            category=category.strip() or None,
+            tags=self._parse_tags(tags),
+        )
+        pair = self.db.get_prompt_pair(pair_id)
+        prompt_id = pair["positive_prompt_id"]
+        resolved_positive = (
+            resolve_text_input(prompt, node_id, "text") if known else None
+        )
+        resolved_negative = (
+            resolve_text_input(prompt, node_id, "negative_text") if known else None
+        )
+        if known and save_setting(prompt, node_id) is not True:
+            # The hook skips a switch it cannot read (#90): the node counts
+            resolved_positive = resolved_negative = None
+        positive_seen = resolved_positive is not None and generate_prompt_hash(
+            resolved_positive
+        ) == generate_prompt_hash(text)
+        pair_seen = (
+            positive_seen
+            and resolved_negative is not None
+            and generate_prompt_hash(resolved_negative)
+            == generate_prompt_hash(negative_text)
+        )
+        negative_seen = resolved_negative is not None and generate_prompt_hash(
+            resolved_negative
+        ) == generate_prompt_hash(negative_text)
+        positive_pending = getattr(self, "pending_first_use", PENDING_FIRST_USE)
+        pair_pending = getattr(self, "pending_pair_first_use", PENDING_PAIR_FIRST_USE)
+        facts = stored_facts(text, negative_text)
+        role = Role(frozenset(used_fields), pair_used)
+        # Own counts are skipped when this job already counted the node from
+        # ComfyUI's cache (#347); the pending first-use catch-up never is.
+        counts = (
+            []
+            if self._replayed(unique_id)
+            else own_counts(
+                PAIR, facts, role, Seen(positive_seen, negative_seen, pair_seen)
+            )
+        )
+        component_ids = {"text": prompt_id, "negative_text": pair["negative_prompt_id"]}
+        for field, component_hash in pair_components(facts, role):
+            component_id = component_ids[field]
+            if not component_id:
+                continue
+            runs = positive_pending.consume(component_hash) + int(
+                ("prompt", component_hash) in counts
+            )
+            if runs:
+                self.db.record_prompt_use(component_id, times=runs)
+        if pair_used:
+            runs = pair_pending.consume(pair_run_key(text, negative_text)) + int(
+                ("pair", facts.positive_hash, facts.negative_hash) in counts
+            )
+            if runs:
+                self.db.record_prompt_pair_use(pair_id, times=runs)
+        if is_positive:
+            self.prompt_tracker.set_current_prompt(
+                prompt_text=positive,
+                additional_data={
+                    "prompt_id": prompt_id,
+                    "pair_id": pair_id if pair_used else None,
+                    "positive_text": positive,
+                    "negative_text": negative_text,
+                    "positive_storage_text": text.strip(),
+                    "negative_storage_text": negative_text.strip(),
+                    "prepend_text": prepend_text.strip(),
+                    "append_text": append_text.strip(),
+                    "final_text": positive,
+                    "category": category.strip() or None,
+                    "tags": self._parse_tags(tags) or [],
+                },
+                push_to_queue=not positive_seen or (pair_used and not pair_seen),
+                **self._run_identity(prompt, unique_id),
+            )
+        return pair_id, prompt_id
+
    @classmethod
    def IS_CHANGED(
        cls,
@@ -26,13 +26,13 @@ except ImportError:
    InputTypeDict = dict

 try:
-    from .prompt_manager_base import PromptManagerBase
+    from .prompt_manager_base import SAVE_TO_LIBRARY_INPUT, PromptManagerBase
 except ImportError:
    import os
    import sys

    sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
-    from prompt_manager_base import PromptManagerBase
+    from prompt_manager_base import SAVE_TO_LIBRARY_INPUT, PromptManagerBase


 class PromptManagerText(PromptManagerBase, ComfyNodeABC):
@@ -115,6 +115,7 @@ class PromptManagerText(PromptManagerBase, ComfyNodeABC):
                        ),
                    },
                ),
+                "save_to_library": SAVE_TO_LIBRARY_INPUT,
            },
            "hidden": {
                # The queued graph and this node's id: used to tell the positive
@@ -149,6 +150,7 @@ class PromptManagerText(PromptManagerBase, ComfyNodeABC):
        append_text: str = "",
        prompt: Optional[Dict[str, Any]] = None,
        unique_id: Optional[str] = None,
+        save_to_library: bool = True,
    ) -> Tuple[str]:
        """
        Process the text prompt and save it to the database.
@@ -160,6 +162,7 @@ class PromptManagerText(PromptManagerBase, ComfyNodeABC):
            search_text: Text to search for in past prompts
            prepend_text: Text to prepend to the main prompt
            append_text: Text to append to the main prompt
+            save_to_library: Off: nothing is saved, counted or tracked (#90)

        Returns:
            Tuple containing the final processed text string
@@ -184,7 +187,9 @@ class PromptManagerText(PromptManagerBase, ComfyNodeABC):
        # Save prompt to database and set execution context for gallery tracking
        prompt_id = None
        extended_tags = []
-        if storage_text and storage_text.strip():
+        if not save_to_library:
+            self._skip_not_saved(prompt, unique_id)
+        elif storage_text and storage_text.strip():
            self.logger.debug(f"Processing prompt text: {storage_text[:100]}...")

            # Add prepend/append info to tags if they exist
@@ -216,6 +221,14 @@ class PromptManagerText(PromptManagerBase, ComfyNodeABC):
            except Exception as e:
                # Log error but don't fail the processing
                self.logger.warning(f"Failed to save prompt to database: {e}")
+                self._mark_untracked(prompt, unique_id)
+        else:
+            self._skip_empty_prompt(prompt, unique_id)
+
+        self.logger.debug(f"Text processing completed: {final_text[:100]}...")
+        result = (final_text,)
+        if not save_to_library:
+            return result  # #90: no metadata registration, no history text

        # Register with ComfyUI integration for standard metadata compatibility
        node_id = f"promptmanagertext_{int(time.time() * 1000)}"
@@ -230,12 +243,10 @@ class PromptManagerText(PromptManagerBase, ComfyNodeABC):
                "append_text": append_text.strip() if append_text else None,
            },
        )
-
-        self.logger.debug(f"Text processing completed: {final_text[:100]}...")
-        result = (final_text,)
        record_runtime_context(
            type(self).__name__, text, prepend_text, append_text, final_text
        )
+        self._record_cached_item(unique_id, (final_text,), storage_text)
        return result

    @classmethod
@@ -5,18 +5,23 @@ Split into domain-specific mixins for maintainability:
 - ImageRoutesMixin: gallery, thumbnails, image serving and linking
 - AdminRoutesMixin: duplicates, stats, settings, diagnostics, maintenance, backup, scan
 - LoggingRoutesMixin: log management endpoints
+- LogCleanupMixin: the reviewed rotated-log cleanup (a maintenance plan)
+- DiagnosticsReportMixin: the shareable diagnostic report, without secrets or paths
 - AutotagRoutesMixin: auto-tagging model management and tagging
 - JobRoutesMixin: the session job registry behind Activity (py/api/jobs.py)
 - ImageTagJobsMixin: bulk Add tags / Auto-tag as image-tags jobs
 - ThumbnailJobsMixin: thumbnail plan, thumbnail job and the gallery stream on it
+- ThumbnailConvertMixin: Convert outdated thumbnails (#317), a thumbnail job mode
 - AutoThumbnailMixin: previews made on first view, on capture and after a scan
 - ReviewRoutesMixin: the Needs review queue, item detail and decisions
 - ReviewRecordingMixin: Needs review recording for the scan and the monitor
 - ReviewEventsMixin: the Needs review change stream an open page re-reads on
 - SystemRoutesMixin: System health check, Overview and usage statistics
+- LibraryLocationRoutesMixin: where the library lives, Move library, Keep it here
 - MaintenanceRoutesMixin: reviewed maintenance plans (preview, apply)
 - WorkflowStorageRoutesMixin: store each workflow once, then Reclaim space
 - DuplicateFilesMixin: duplicate image files as find and removal jobs
+- LoraImportRoutesMixin: the reviewed, staged LoRA reference import job
 """

 import asyncio
@@ -28,6 +33,7 @@ import math
 import ntpath
 import os
 import re
+import threading
 from pathlib import Path

 from aiohttp import web
@@ -44,21 +50,29 @@ from .review_events import ReviewEventsMixin
 from .saved_views import SavedViewRoutesMixin
 from .history import HistoryRoutesMixin
 from .images import ImageRoutesMixin
+from .gallery_listing import WALK_STOPPED, RootListing, WalkOutcome
 from .admin import AdminRoutesMixin
 from .settings_routes import SettingsRoutesMixin
 from .job_routes import JobRoutesMixin
 from .image_tag_jobs import ImageTagJobsMixin
 from .thumbnail_jobs import ThumbnailJobsMixin
+from .thumbnail_convert import ThumbnailConvertMixin
 from .thumbnail_auto import AutoThumbnailMixin
 from .system import SystemRoutesMixin
+from .library_location import LibraryLocationRoutesMixin
 from .maintenance import MaintenanceRoutesMixin
+from .backup_restore import BackupRestoreRoutesMixin
 from .workflow_storage import WorkflowStorageRoutesMixin
 from .duplicate_files import DuplicateFilesMixin
 from .maintenance_plans import PlanStore
 from .jobs import JobRegistry
 from .logging_routes import LoggingRoutesMixin
+from .log_cleanup import LogCleanupMixin
+from .diagnostics_report import DiagnosticsReportMixin
 from .autotag_routes import AutotagRoutesMixin
 from .lora_integration import LoraIntegrationMixin
+from .lora_import_routes import LoraImportRoutesMixin
+from .image_categories import ImageCategoryRoutesMixin

 try:
    from ...database.operations import PromptDatabase
@@ -80,6 +94,18 @@ def _get_project_root():
    return os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__))))


+# How long an executor thread waits for the loop to drop the listings.
+_OFF_LOOP_DROP_WAIT = 30
+
+
+def _running_loop():
+    """The event loop running in this thread, or None."""
+    try:
+        return asyncio.get_running_loop()
+    except RuntimeError:
+        return None
+
+
 def _public_path(path) -> str:
    """Render a server path for an API response without revealing the layout.

@@ -270,6 +296,10 @@ async def _gzip_middleware(request, handler):
    if len(compressed) >= len(body):
        return response

+    # A length the handler declared is the uncompressed one: drop it so the
+    # compressed body's own length is sent (#329: a stale length made the
+    # browser wait for bytes that never came).
+    response.headers.pop("Content-Length", None)
    response.body = compressed
    response.headers["Content-Encoding"] = "gzip"
    response.headers["Vary"] = "Accept-Encoding"
@@ -293,14 +323,21 @@ class PromptManagerAPI(
    JobRoutesMixin,
    ImageTagJobsMixin,
    ThumbnailJobsMixin,
+    ThumbnailConvertMixin,
    AutoThumbnailMixin,
    SystemRoutesMixin,
+    LibraryLocationRoutesMixin,
    MaintenanceRoutesMixin,
+    BackupRestoreRoutesMixin,
    WorkflowStorageRoutesMixin,
    DuplicateFilesMixin,
    LoggingRoutesMixin,
+    LogCleanupMixin,
+    DiagnosticsReportMixin,
    AutotagRoutesMixin,
    LoraIntegrationMixin,
+    LoraImportRoutesMixin,
+    ImageCategoryRoutesMixin,
 ):
    """REST API handler for PromptManager operations and web interface.

@@ -328,13 +365,28 @@ class PromptManagerAPI(
        # Private media captures of the annotation routes (py/api/annotations.py),
        # created on first use with their restore subscription.
        self._captures = None
+        # Capture tokens Generate suggestions ran on: a save of one marks the
+        # image auto-tagged (#379).
+        self._suggested_tokens = set()
        self._captures_unsubscribe = None
        # Set by close_annotation_captures (shutdown): no store is recreated.
        self._captures_closed = False
        self._cached_output_dir = None  # Lazy-cached by _find_comfyui_output_dir()
        self._html_cache = {}  # Cached HTML file contents keyed by path
-        self._gallery_cache = {}  # dict: path_str -> (files, timestamp)
-        self._gallery_cache_ttl = 30  # Cache TTL in seconds
+        # One shared listing per output root, keyed by str(root), and the
+        # background walks refreshing them (py/api/gallery_listing.py, #348).
+        self._root_listings: dict[str, RootListing] = {}
+        self._listing_tasks: set = set()
+        # The loop the walks run on, set by the startup warm-up or the first
+        # walk; the monitor's thread hops onto it (notify_output_settled).
+        self._listing_loop = None
+        # Set by cleanup_gallery_listings: no background walk starts after it.
+        self._listings_closed = False
+        # The workspace caches rebuilt behind a stored walk that changed the
+        # listing, once the host's startup warm-up has run (#348).
+        self._workspace_warm_enabled = False
+        self._workspace_warm_task = None
+        self._workspace_warm_again = False
        # Workspace listing values and sort orders derived from a cached scan
        # (py/api/images.py _workspace_listed/_workspace_orders).
        self._workspace_listed_cache = {}
@@ -370,12 +422,19 @@ class PromptManagerAPI(
        try:
            from .maintenance import sweep_safety_temps

+            from .backup_restore import restore_stage
+
            swept = sweep_safety_temps(self.db.model.db_path)
+            swept += restore_stage.sweep_restore_temps(self.db.model.db_path)
            if swept:
                self.logger.info(f"Removed {len(swept)} interrupted backup copies")
        except Exception as e:
            self.logger.warning(f"Could not sweep interrupted backup copies: {e}")

+        # A crash between Move library's switch and its rename left the old
+        # node-folder files under their own names (#249 S6b): rename them now.
+        self.finish_interrupted_library_move()
+
        # Run cleanup on initialization to remove any existing duplicates
        try:
            removed = self.db.cleanup_duplicates()
@@ -447,23 +506,122 @@ class PromptManagerAPI(
            return await loop.run_in_executor(None, call)
        return await loop.run_in_executor(None, func, *args)

-    def invalidate_gallery_cache(self):
-        """Invalidate the cached gallery file listing.
+    def _root_listing(self, root) -> RootListing:
+        """The shared listing record of one output root (created empty)."""
+        return self._root_listings.setdefault(str(root), RootListing())

-        Called by the image monitor when new files are detected. The workspace
-        keeps its per-file values and card facts, so the next request rebuilds
-        only new or changed files (see ImageRoutesMixin._workspace_listed and
-        _card_facts); its sort orders
-        are dropped, as the rescan replaces them anyway, and so is the
-        favorites lookup, which holds the old scan list.
+    def invalidate_gallery_cache(self, retire=False):
+        """Drop every root's listing, so the next read waits for a new walk.
+
+        Called after files are deleted through the app (duplicate cleanup and
+        the legacy duplicate delete), never for thumbnail writes. A walk
+        running now is not stored (its generation moved on). The workspace
+        keeps its per-file values and card facts, so the next request
+        rebuilds only new or changed files (see ImageRoutesMixin.
+        _workspace_listed and _card_facts); its sort orders are dropped, as
+        the walk replaces them anyway, and so is the favorites lookup, which
+        holds the old list.
+
+        ``retire`` (the roots changed): no background walk of a root starts
+        again until a reader or the warm-up asks for it.
        """
-        self._gallery_cache = {}
+        loop = self._listing_loop
+        if loop is not None and loop.is_running() and _running_loop() is not loop:
+            # Called from an executor thread (a settings save, a test seed):
+            # listing records are touched only on the loop, and the caller
+            # expects the drop done when this returns.
+            dropped = threading.Event()
+
+            def drop():
+                try:
+                    self._drop_listings(retire)
+                finally:
+                    dropped.set()
+
+            loop.call_soon_threadsafe(drop)
+            if not dropped.wait(_OFF_LOOP_DROP_WAIT):
+                self.logger.warning("The Images listing drop is still queued")
+            return
+        self._drop_listings(retire)
+
+    def _drop_listings(self, retire=False):
+        for record in list(self._root_listings.values()):
+            record.drop()
+            if retire:
+                # The roots changed: a removed root must not come back through
+                # a pending timer, a trailing walk or a monitor mark.
+                record.retired = True
+                record.dirty = False
+                handle, record.rewalk_handle = record.rewalk_handle, None
+                if handle is not None:
+                    handle.cancel()
        self._workspace_order_cache = {}
        self._favorite_listing_cache = {}

+    async def warm_gallery_listings(self, app=None):
+        """Start one background walk per output root (aiohttp on_startup).
+
+        Registered by the root ``__init__.py``, so the first Images open after
+        ComfyUI starts finds the listing built. It never fails startup: a
+        root that cannot be walked is retried by the first read.
+        """
+        # Each stored walk that changes a listing then rebuilds the workspace's
+        # per-file values, orders and favorites behind it (_warm_workspace).
+        self._workspace_warm_enabled = True
+        self._listing_loop = asyncio.get_running_loop()
+        self._listings_closed = False
+        try:
+            for root in self._get_all_output_dirs():
+                self._root_listing(root).retired = False
+                self._schedule_walk(root)
+        except Exception as e:
+            self.logger.warning(f"Could not warm the Images listing: {e}")
+
+    def notify_output_settled(self, path):
+        """The image monitor settled an output at *path* (any thread).
+
+        Called on the monitor's worker thread with the resolved path. It only
+        hands the path to the event loop (``output_settled``) and never
+        touches a listing from this thread; before the loop is known, or once
+        the listings are cleaned up, it does nothing.
+        """
+        loop = self._listing_loop
+        if loop is None or self._listings_closed or not loop.is_running():
+            return
+        try:
+            loop.call_soon_threadsafe(self.output_settled, path)
+        except RuntimeError:
+            pass  # the loop closed meanwhile (shutdown)
+
+    async def cleanup_gallery_listings(self, app=None):
+        """Stop the background listing walks (aiohttp on_cleanup)."""
+        self._workspace_warm_enabled = False
+        # No mark, deferred walk or trailing walk starts a walk from now on.
+        self._listings_closed = True
+        # Before any await, so no delayed refresh can start a walk meanwhile.
+        for record in self._root_listings.values():
+            handle, record.rewalk_handle = record.rewalk_handle, None
+            if handle is not None:
+                handle.cancel()
+        warm, self._workspace_warm_task = self._workspace_warm_task, None
+        if warm is not None:
+            warm.cancel()
+            await asyncio.gather(warm, return_exceptions=True)
+        tasks = list(self._listing_tasks)
+        for task in tasks:
+            task.cancel()
+        if tasks:
+            await asyncio.gather(*tasks, return_exceptions=True)
+        self._listing_tasks.clear()
+        # A walk cancelled before its first step never ran its own cleanup.
+        for record in self._root_listings.values():
+            flight, record.flight = record.flight, None
+            if flight is not None and not flight.done():
+                flight.set_result(WalkOutcome.failed(RuntimeError(WALK_STOPPED)))
+
    def reset_gallery_roots_cache(self):
        """Drop every cached listing and derived workspace value (roots changed)."""
-        self.invalidate_gallery_cache()
+        self.invalidate_gallery_cache(retire=True)
        self._workspace_listed_cache = {}
        self._workspace_card_cache = {}

@@ -535,11 +693,16 @@ class PromptManagerAPI(
        self._register_settings_routes(routes)
        self._register_job_routes(routes)
        self._register_system_routes(routes)
+        self._register_diagnostics_report_routes(routes)
+        self._register_library_location_routes(routes)
        self._register_maintenance_routes(routes)
+        self._register_backup_restore_routes(routes)
        self._register_duplicate_routes(routes)
        self._register_logging_routes(routes)
        self._register_autotag_routes(routes)
        self._register_lora_routes(routes)
+        self._register_lora_import_routes(routes)
+        self._register_image_category_routes(routes)

        # Register gzip compression middleware (once)
        global _gzip_registered
@@ -604,7 +767,12 @@ class PromptManagerAPI(
    # ── Shared utilities used by multiple mixins ──────────────────────

    def _enrich_images(self, images):
-        """Add url and thumbnail_url to a flat list of image dicts."""
+        """Add url and thumbnail_url to a flat list of image dicts.
+
+        Each dict without ``is_video`` also gets ``is_video`` and
+        ``media_type`` from its extension (#355: a linked LoraManager video
+        outside the output folders is shown as a video, not a picture).
+        """
        from urllib.parse import quote as url_quote

        output_dirs = self._get_all_output_dirs()
@@ -614,6 +782,11 @@ class PromptManagerAPI(
            if not image_path_str:
                continue

+            if "is_video" not in image:
+                video = is_video_path(image_path_str)
+                image["is_video"] = video
+                image["media_type"] = "video" if video else "image"
+
            img_path = Path(image_path_str)

            # Set fallback url via image ID
@@ -630,16 +803,20 @@ class PromptManagerAPI(
                        f"{url_quote(rel_path.as_posix(), safe='/')}"
                    )

-                    # Check for thumbnail
-                    rel_no_ext = rel_path.with_suffix("")
-                    thumb_rel = (
-                        f"thumbnails/{rel_no_ext.as_posix()}_thumb{rel_path.suffix}"
-                    )
+                    # Any preview the file owns, the current format first (#317)
+                    from . import thumbnail_settings
                    from .prompts import thumbnail_url_for

-                    thumbnail_url = thumbnail_url_for(
-                        thumb_rel, output_path / thumb_rel
+                    existing = thumbnail_settings.existing_thumbnail(
+                        output_path, rel_path
                    )
+                    thumbnail_url = None
+                    if existing is not None:
+                        thumb_rel = (
+                            thumbnail_settings.thumbnail_stem_rel(rel_path)
+                            + existing.suffix
+                        )
+                        thumbnail_url = thumbnail_url_for(thumb_rel, existing)
                    if thumbnail_url:
                        image["thumbnail_url"] = thumbnail_url
                    break  # Found matching root, stop searching
@@ -933,196 +1110,3 @@ class PromptManagerAPI(
                        result["parameters"][field] = metadata[field]

        return result
-
-    def _extract_readable_prompt(self, parsed_data):
-        """Extract human-readable prompt text from ComfyUI/A1111 data."""
-
-        def safe_to_string(value):
-            if isinstance(value, str):
-                return value
-            elif isinstance(value, list):
-                return " ".join(str(item) for item in value if item)
-            elif value is not None:
-                return str(value)
-            return None
-
-        # First check if we already extracted a positive prompt (A1111 format)
-        if parsed_data.get("positive_prompt"):
-            return parsed_data["positive_prompt"]
-
-        # Check if prompt is already a string
-        if isinstance(parsed_data.get("prompt"), str):
-            return parsed_data["prompt"]
-
-        # Check if prompt is a simple value that can be converted
-        if parsed_data.get("prompt") and not isinstance(
-            parsed_data.get("prompt"), dict
-        ):
-            return safe_to_string(parsed_data["prompt"])
-
-        prompt_data = parsed_data.get("prompt")
-        if isinstance(prompt_data, dict):
-            # Use the enhanced logic from parse-metadata.py
-            positive_prompt = self._extract_positive_prompt_from_comfyui_data(
-                prompt_data
-            )
-            if positive_prompt:
-                return positive_prompt
-
-        # Check workflow data if available
-        workflow_data = parsed_data.get("workflow")
-        if isinstance(workflow_data, dict):
-            positive_prompt = self._extract_positive_prompt_from_comfyui_data(
-                workflow_data
-            )
-            if positive_prompt:
-                return positive_prompt
-
-        # Check parameters for positive prompt
-        if parsed_data.get("parameters", {}).get("positive"):
-            return safe_to_string(parsed_data["parameters"]["positive"])
-
-        return None
-
-    def _get_node_inputs(self, node):
-        """Safely get inputs from a node, handling both dict and list formats.
-
-        Old format: inputs is a dict with direct key-value pairs
-            inputs = {"text": "my prompt", "seed": 123}
-
-        New format: inputs is a list of connection objects
-            inputs = [
-                {"name": "text", "type": "STRING", "link": null,
-                 "widget": {"name": "text"}},
-                {"name": "clip", "type": "CLIP", "link": 11}
-            ]
-        """
-        if not isinstance(node, dict):
-            return {}
-
-        inputs = node.get("inputs", {})
-
-        # If inputs is already a dict, return it
-        if isinstance(inputs, dict):
-            return inputs
-
-        # If inputs is a list, convert to dict format
-        if isinstance(inputs, list):
-            inputs_dict = {}
-            for input_item in inputs:
-                if isinstance(input_item, dict) and "name" in input_item:
-                    name = input_item["name"]
-                    inputs_dict[name] = input_item
-            return inputs_dict
-
-        return {}
-
-    def _find_text_in_node(self, node):
-        """Try to find text content in a node using various strategies.
-
-        Handles both old and new workflow formats.
-        """
-        if not isinstance(node, dict):
-            return None
-
-        # Strategy 1: Check normalized inputs for 'text' field
-        inputs = self._get_node_inputs(node)
-        if "text" in inputs and isinstance(inputs["text"], str):
-            return inputs["text"]
-
-        # Strategy 2: For text encoder nodes, check widgets_values
-        class_type = node.get("class_type", node.get("type", ""))
-        text_encoder_types = [
-            "CLIPTextEncode",
-            "CLIPTextEncodeSDXL",
-            "CLIPTextEncodeSDXLRefiner",
-            "CLIPTextEncodeFlux",
-            "PromptManager",
-            "PromptManagerText",
-            "BNK_CLIPTextEncoder",
-            "Text Encoder",
-            "CLIP Text Encode",
-        ]
-
-        if any(
-            encoder_type.lower() in class_type.lower()
-            for encoder_type in text_encoder_types
-        ):
-            widgets_values = node.get("widgets_values", [])
-            if widgets_values and len(widgets_values) > 0:
-                if isinstance(widgets_values[0], str) and widgets_values[0].strip():
-                    return widgets_values[0]
-
-        return None
-
-    def _extract_positive_prompt_from_comfyui_data(self, data):
-        """Extract positive prompt from ComfyUI data.
-
-        Handles both old and new formats.
-        """
-        if not isinstance(data, dict):
-            return None
-
-        # Build nodes dictionary
-        nodes_by_id = {}
-        if "nodes" in data:
-            # Handle nodes array format
-            for node in data["nodes"]:
-                if isinstance(node, dict):
-                    nid = node.get("id")
-                    if nid is not None:
-                        nodes_by_id[nid] = node
-        else:
-            # Handle flat dictionary format (node_id -> node_data)
-            for nid_str, node in data.items():
-                try:
-                    nid = int(nid_str)
-                except (ValueError, TypeError):
-                    nid = nid_str
-                if isinstance(node, dict):
-                    if "id" in node:
-                        nid = node["id"]
-                    nodes_by_id[nid] = node
-
-        if not nodes_by_id:
-            return None
-
-        # First, try to find positive/negative connection pattern
-        pos_id = None
-        for node in nodes_by_id.values():
-            if isinstance(node, dict):
-                inputs = self._get_node_inputs(node)
-                if "positive" in inputs and "negative" in inputs:
-                    try:
-                        pos_input = inputs["positive"]
-                        if isinstance(pos_input, list) and len(pos_input) > 0:
-                            pos_id = int(pos_input[0])
-                            break
-                    except (ValueError, TypeError, IndexError):
-                        continue
-
-        # Get text from the positive node
-        if pos_id is not None and pos_id in nodes_by_id:
-            text_val = self._find_text_in_node(nodes_by_id[pos_id])
-            if text_val:
-                return text_val
-
-        # Fallback: find any text encoder node with text content
-        text_nodes = []
-        for node in nodes_by_id.values():
-            if isinstance(node, dict):
-                text_val = self._find_text_in_node(node)
-                if text_val:
-                    # Try to determine if this is positive or negative
-                    node_title = node.get("title", "").lower()
-                    if "neg" not in node_title and "negative" not in node_title:
-                        # Prioritize non-negative prompts
-                        text_nodes.insert(0, text_val)
-                    else:
-                        text_nodes.append(text_val)
-
-        # Return the first positive-looking prompt
-        if text_nodes:
-            return text_nodes[0]
-
-        return None
@@ -3,21 +3,21 @@
 import asyncio
 import contextlib
 from contextlib import closing
-import datetime
 import functools
 import hashlib
 import json
 import math
 import os
 import sqlite3
-import tempfile
 import threading
 import time
+import urllib.parse
 from pathlib import Path

 from aiohttp import web

 from .prompts import thumbnail_url_for
+from . import thumbnail_settings
 from .jobs import (
    DEFAULT_SCAN_SCOPE,
    SCAN_GROUP_NAMES,
@@ -26,7 +26,6 @@ from .jobs import (
    DUPLICATE_CLEANUP_JOB_KIND,
    DUPLICATES_JOB_KIND,
    MAINTENANCE_JOB_KIND,
-    RESTORE_JOB_KIND,
    JobBusy,
 )

@@ -36,26 +35,41 @@ except ImportError:
    from utils.parallel import map_parallel

 try:
-    from ...database.operations import PromptDatabase
-    from ...database.pair_ingestion import ingest_resolved_pair
+    from ...utils import exit_signal
+except ImportError:
+    from utils import exit_signal
+
+try:
+    from ...database.pair_ingestion import blank_positive, ingest_resolved_pair
+    from ...database.run_attribution import (
+        host_output_directory,
+        stored_run_prompt,
+        stored_run_prompts,
+    )
    from ...utils.generation_params import (
        PLACEHOLDERS,
        GenerationParamsError,
        extract_generation_params,
        parse_page_json,
    )
-    from ...utils.prompt_pair_resolver import resolve_prompt_pair
+    from ...utils.prompt_graph import metadata_opted_out, side_opted_out
+    from ...utils.prompt_pair_resolver import resolve_prompt_pair, sampler_less_prompt
    from ...utils.review_capture import reviewable
 except ImportError:
-    from database.operations import PromptDatabase
-    from database.pair_ingestion import ingest_resolved_pair
+    from database.pair_ingestion import blank_positive, ingest_resolved_pair
+    from database.run_attribution import (
+        host_output_directory,
+        stored_run_prompt,
+        stored_run_prompts,
+    )
    from utils.generation_params import (
        PLACEHOLDERS,
        GenerationParamsError,
        extract_generation_params,
        parse_page_json,
    )
-    from utils.prompt_pair_resolver import resolve_prompt_pair
+    from utils.prompt_graph import metadata_opted_out, side_opted_out
+    from utils.prompt_pair_resolver import resolve_prompt_pair, sampler_less_prompt
    from utils.review_capture import reviewable


@@ -111,6 +125,7 @@ def _collect_media_files(output_dirs, extensions):
        if not os.path.isdir(root):
            continue
        for current, dirnames, filenames in os.walk(root, followlinks=False):
+            exit_signal.checkpoint()  # #376: stop between directories at exit
            depth = 0 if current == root else len(Path(current).relative_to(root).parts)
            dirnames[:] = sorted(
                d
@@ -146,39 +161,48 @@ def _physical_file_key(path, stat):
    return ("path", os.path.normcase(os.path.realpath(str(path))))


-def _thumbnail_rel_path(rel_path, thumbnail_ext):
-    """Relative path of the thumbnail the gallery would generate for ``rel_path``."""
-    return f"thumbnails/{rel_path.with_suffix('').as_posix()}_thumb{thumbnail_ext}"
-
-
-def _media_thumbnail_rel_path(rel_path):
-    """The thumbnail of a media file: a video's preview is a ``.jpg``."""
-    extension = rel_path.suffix.lower()
-    return _thumbnail_rel_path(
-        rel_path, ".jpg" if extension in VIDEO_EXTENSIONS else rel_path.suffix
-    )
+def _other_sources(output_path, rel_path):
+    """Whether another media file shares *rel_path*'s stem in its folder."""
+    folder = Path(output_path) / Path(rel_path).parent
+    stem = Path(rel_path).stem
+    own = Path(rel_path).suffix.lower()
+    for extension in IMAGE_EXTENSIONS + VIDEO_EXTENSIONS:
+        if extension == own:
+            continue
+        for name in (stem + extension, stem + extension.upper()):
+            if (folder / name).is_file():
+                return True
+    return False


 def _remove_thumbnail(output_path, rel_path, logger=None):
-    """Remove the thumbnail of ``rel_path`` under ``output_path``, if any.
+    """Remove the previews of ``rel_path`` under ``output_path``, if any.

-    Shared by the legacy duplicate delete and the reviewed removal job. A
-    thumbnail that is a link, or one that cannot be removed, is left alone
-    (a stale preview never fails a removal). Returns whether one was removed.
+    Shared by the legacy duplicate delete and the reviewed removal job.
+    Every preview the file owns goes, in any format (#317); a preview name
+    another same-stem file still shares (``x_thumb.webp`` of ``x.png`` and
+    ``x.mp4``, ruling R2) stays for it. A preview that is a link, or one that
+    cannot be removed, is left alone (a stale preview never fails a removal).
+    Returns whether one was removed.
    """
    output_path = Path(output_path)
-    thumbnail_path = output_path / _media_thumbnail_rel_path(Path(rel_path))
-    try:
-        if thumbnail_path.is_symlink() or not thumbnail_path.is_file():
-            return False
-        os.remove(thumbnail_path)
-    except OSError as e:
+    rel_path = Path(rel_path)
+    shared = _other_sources(output_path, rel_path)
+    removed = False
+    for thumbnail_path in thumbnail_settings.owned_thumbnails(output_path, rel_path):
+        extension = thumbnail_path.suffix.lower()
+        if shared and extension in thumbnail_settings.WRITTEN_EXTENSIONS:
+            continue
+        try:
+            os.remove(thumbnail_path)
+        except OSError as e:
+            if logger is not None:
+                logger.warning(f"Could not delete thumbnail for {rel_path}: {e}")
+            continue
+        removed = True
        if logger is not None:
-            logger.warning(f"Could not delete thumbnail for {rel_path}: {e}")
-        return False
-    if logger is not None:
-        logger.debug(f"Deleted associated thumbnail: {thumbnail_path}")
-    return True
+            logger.debug(f"Deleted associated thumbnail: {thumbnail_path}")
+    return removed


 async def _read_json(request):
@@ -238,6 +262,11 @@ SCAN_DETAILS = {
    "failed": "Error: the prompt could not be stored",
    "error": "Error: the file could not be processed (see the server log)",
    "found": "Metadata found, but no prompt text to store",
+    "not_saved": "Skipped · its PromptManager node does not save to the library",
+    "not_saved_wired": (
+        "Skipped · its Save to library switch is wired from another node, so only "
+        "the run itself can link it"
+    ),
    None: "No prompt metadata in the file",
 }

@@ -473,9 +502,29 @@ def _diagnose_dependencies():
    }


-def _diagnose_output_dirs(configured_dirs):
+def legacy_checks(db_path, public_path=None):
+    """The four checks of ``GET /diagnostics`` (blocking).
+
+    Shared with the diagnostic report (``py/api/diagnostics_report.py``),
+    which passes its own ``public_path`` so a folder outside ComfyUI is never
+    named.
+    """
+    from ..config import GalleryConfig
+
+    return {
+        "database": _diagnose_database(db_path),
+        "dependencies": _diagnose_dependencies(),
+        "comfyui_output": _diagnose_output_dirs(
+            GalleryConfig.MONITORING_DIRECTORIES, public_path
+        ),
+        "image_monitor": _diagnose_image_monitor(public_path),
+    }
+
+
+def _diagnose_output_dirs(configured_dirs, public_path=None):
    """Configured gallery roots, ComfyUI's output dir, or relative fallbacks."""
    _public_path, _ = _public_helpers()
+    _public_path = public_path or _public_path
    candidates = list(configured_dirs)
    try:
        import folder_paths
@@ -509,9 +558,10 @@ def _diagnose_output_dirs(configured_dirs):
    }


-def _diagnose_image_monitor():
+def _diagnose_image_monitor(public_path=None):
    """Status of the running image monitor, with public directory names."""
    _public_path, _public_error = _public_helpers()
+    _public_path = public_path or _public_path
    try:
        monitor = _current_image_monitor()
        if monitor is None:
@@ -542,6 +592,24 @@ def _current_image_monitor():
    return getattr(_image_monitor_module(), "_monitor_instance", None)


+class _BatchHistory:
+    """A scan batch's recorded-history lookup, made on the first file needing it.
+
+    Most files link through their metadata and never ask; the first one that
+    does triggers one lookup for the whole batch (``_recorded_runs_for``).
+    """
+
+    def __init__(self, api, media_files):
+        self._api = api
+        self._files = media_files
+        self._found = None
+
+    def get(self, path):
+        if self._found is None:
+            self._found = self._api._recorded_runs_for(self._files)
+        return self._found.get(path)
+
+
 class AdminRoutesMixin:
    """Mixin providing admin, diagnostics, and maintenance API endpoints."""

@@ -724,9 +792,20 @@ class AdminRoutesMixin:

        Only the files under ``output_dir`` count (paths are relative to it);
        a group needs two of them. A file that vanished since it was hashed
-        is left out.
+        is left out. Each ``url`` names the source ``output_dir`` is
+        (``?root=``) when it is one, so View Full never opens another
+        source's file at the same path.
        """
        output_path = Path(os.path.abspath(output_dir))
+        identity = os.path.normcase(os.path.realpath(str(output_path)))
+        root_index = next(
+            (
+                index
+                for index, root in enumerate(self._get_all_output_dirs())
+                if os.path.normcase(os.path.realpath(str(root))) == identity
+            ),
+            None,
+        )
        base = os.path.normcase(str(output_path)).rstrip("\\/") + os.sep
        duplicates = []
        for group in groups:
@@ -737,7 +816,10 @@ class AdminRoutesMixin:
                try:
                    images.append(
                        self._describe_media_file(
-                            Path(record["abs"]), output_path, file_hash=group["hash"]
+                            Path(record["abs"]),
+                            output_path,
+                            file_hash=group["hash"],
+                            root_index=root_index,
                        )
                    )
                except (OSError, ValueError) as e:
@@ -837,23 +919,36 @@ class AdminRoutesMixin:
                )
        return groups

-    def _describe_media_file(self, media_path, output_path, file_hash=None):
+    def _describe_media_file(
+        self, media_path, output_path, file_hash=None, root_index=None
+    ):
        """Describe one media file for the duplicates response (hashing it
-        unless ``file_hash`` is given)."""
+        unless ``file_hash`` is given). With ``root_index`` the ``url`` names
+        that source and its path is URL-encoded."""
        stat = media_path.stat()
        rel_path = media_path.relative_to(output_path)
        extension = media_path.suffix.lower()
        is_video = extension in VIDEO_EXTENSIONS

-        thumb_rel = _thumbnail_rel_path(rel_path, ".jpg" if is_video else extension)
-        thumbnail_url = thumbnail_url_for(thumb_rel, output_path / thumb_rel)
+        existing = thumbnail_settings.existing_thumbnail(output_path, rel_path)
+        thumbnail_url = None
+        if existing is not None:
+            thumb_rel = (
+                thumbnail_settings.thumbnail_stem_rel(rel_path) + existing.suffix
+            )
+            thumbnail_url = thumbnail_url_for(thumb_rel, existing)
+        if root_index is None:
+            url = f"/prompt_manager/images/serve/{rel_path.as_posix()}"
+        else:
+            encoded = urllib.parse.quote(rel_path.as_posix(), safe="/")
+            url = f"/prompt_manager/images/serve/{encoded}?root={root_index}"

        return {
            "id": str(hash(str(media_path))),
            "filename": media_path.name,
            "path": str(rel_path),
            "relative_path": str(rel_path),
-            "url": f"/prompt_manager/images/serve/{rel_path.as_posix()}",
+            "url": url,
            "thumbnail_url": thumbnail_url,
            "size": stat.st_size,
            "modified_time": stat.st_mtime,
@@ -994,16 +1089,7 @@ class AdminRoutesMixin:
    async def run_diagnostics(self, request):
        """Run comprehensive system diagnostics and health checks."""
        try:
-            from ..config import GalleryConfig
-
-            results = {
-                "database": _diagnose_database(self.db.model.db_path),
-                "dependencies": _diagnose_dependencies(),
-                "comfyui_output": _diagnose_output_dirs(
-                    GalleryConfig.MONITORING_DIRECTORIES
-                ),
-                "image_monitor": _diagnose_image_monitor(),
-            }
+            results = legacy_checks(self.db.model.db_path)
            return web.json_response({"success": True, "diagnostics": results})

        except Exception as e:
@@ -1221,216 +1307,6 @@ class AdminRoutesMixin:
            "message": f"Found {len(issues)} consistency issues",
        }

-    async def backup_database(self, request):
-        """Download a consistent copy of the prompts database (WAL included)."""
-        try:
-            model = self.db.model
-            db_path = model.db_path
-
-            if not os.path.exists(db_path):
-                return web.json_response(
-                    {"success": False, "error": "Database file not found"}, status=404
-                )
-
-            fd, temp_path = tempfile.mkstemp(suffix=".db")
-            os.close(fd)
-            try:
-                ok = await self._run_in_executor(model.backup_database, temp_path)
-                if not ok:
-                    return web.json_response(
-                        {"success": False, "error": "Failed to create database backup"},
-                        status=500,
-                    )
-                # Read once (the file is deleted right after) rather than
-                # streaming so the temp file never outlives the request.
-                with open(temp_path, "rb") as fh:
-                    file_data = fh.read()
-            finally:
-                if os.path.exists(temp_path):
-                    os.unlink(temp_path)
-
-            timestamp = datetime.datetime.now().strftime("%Y%m%d_%H%M%S")
-            filename = f"prompts_backup_{timestamp}.db"
-
-            return web.Response(
-                body=file_data,
-                content_type="application/octet-stream",
-                headers={
-                    "Content-Disposition": f'attachment; filename="{filename}"',
-                    "Content-Length": str(len(file_data)),
-                },
-            )
-
-        except Exception as e:
-            self.logger.error(f"Backup error: {e}", exc_info=True)
-            return web.json_response(
-                {
-                    "success": False,
-                    "error": f"Failed to backup database: {self._public_error(e)}",
-                },
-                status=500,
-            )
-
-    async def restore_database(self, request):
-        """Restore the prompts database from an uploaded SQLite file.
-
-        The upload is streamed to a temp file. Free disk space decides how
-        large it may be (``maintenance.restore_room``), under a 64 GiB ceiling
-        (``restore_max_bytes``): a request whose Content-Length does not fit
-        is refused before anything is written, and one without is refused as
-        soon as its running size does not. The file is
-        verified with PromptModel.verify_database_file and only then copied
-        over the live database, which is backed up first. The whole request
-        holds the registry (records): it is refused while a scan or another
-        record-changing job runs, and those are refused while it runs.
-        """
-        return await self._run_held(
-            RESTORE_JOB_KIND,
-            "Database restore (admin page)",
-            "records",
-            lambda: self._restore_database(request),
-        )
-
-    def _restore_refusal(self, size, ceiling, room, *, known):
-        """``400 too-large`` past the ceiling, else ``507 insufficient-space``."""
-        from .maintenance import restore_space_message
-
-        if size > ceiling:
-            return web.json_response(
-                {
-                    "success": False,
-                    "code": "too-large",
-                    "error": (
-                        "File too large. Maximum size is "
-                        f"{ceiling // (1024 * 1024)}MB"
-                    ),
-                },
-                status=400,
-            )
-        return web.json_response(
-            {
-                "success": False,
-                "code": "insufficient-space",
-                "error": restore_space_message(size, room, known=known),
-            },
-            status=507,
-        )
-
-    async def _restore_database(self, request):
-        from .maintenance import RESTORE_MAX_BYTES, restore_room
-
-        ceiling = getattr(self, "restore_max_bytes", RESTORE_MAX_BYTES)
-        temp_path = None
-        try:
-            # Free disk space decides how large a backup may be (#313): the
-            # upload, its staged copy and the swap must all fit.
-            room = await self._run_in_executor(restore_room, self.db.model.db_path)
-            max_bytes = min(ceiling, room)
-            length = request.content_length
-            if length is not None and length > max_bytes:
-                return self._restore_refusal(length, ceiling, room, known=True)
-            reader = await request.multipart()
-            field = await reader.next()
-
-            if not field or field.name != "database_file":
-                return web.json_response(
-                    {
-                        "success": False,
-                        "error": (
-                            "No database file uploaded. "
-                            "Expected field name: database_file"
-                        ),
-                    },
-                    status=400,
-                )
-
-            fd, temp_path = tempfile.mkstemp(suffix=".db")
-            os.close(fd)
-            size = 0
-            with open(temp_path, "wb") as out:
-                while True:
-                    chunk = await field.read_chunk()
-                    if not chunk:
-                        break
-                    size += len(chunk)
-                    if size > max_bytes:
-                        return self._restore_refusal(size, ceiling, room, known=False)
-                    out.write(chunk)
-
-            if size == 0:
-                return web.json_response(
-                    {"success": False, "error": "Uploaded file is empty"}, status=400
-                )
-
-            model = self.db.model
-            ok, reason = await self._run_in_executor(
-                model.verify_database_file, temp_path
-            )
-            if ok:
-                reason = await self._run_in_executor(_inspect_restore_upload, temp_path)
-                ok = reason is None
-            if not ok:
-                return web.json_response(
-                    {"success": False, "error": reason}, status=400
-                )
-
-            try:
-                backup_path = await self._run_in_executor(
-                    model.restore_from_file, temp_path
-                )
-            except sqlite3.OperationalError as exc:
-                if (
-                    getattr(exc, "_prompt_manager_restore_backup_created", False)
-                    is True
-                ):
-                    try:
-                        await self._run_in_executor(
-                            _prune_safety_backups, model.db_path
-                        )
-                    except Exception:
-                        self.logger.warning(
-                            "Could not prune safety backups after failed restore"
-                        )
-                raise
-            removed = await self._run_in_executor(_prune_safety_backups, model.db_path)
-            if removed:
-                self.logger.info(f"Removed {len(removed)} old safety backups")
-            previous = self.db
-            self.db = PromptDatabase(model.db_path)
-            self._database_replaced()  # a health report described the old one
-            # Its connections would otherwise linger (a file lock on Windows)
-            previous.close_all()
-            prompt_count = self.db.model.get_database_info().get("total_prompts", 0)
-
-            return web.json_response(
-                {
-                    "success": True,
-                    "message": (
-                        "Database restored successfully. "
-                        f"Found {prompt_count} prompts."
-                    ),
-                    "prompt_count": prompt_count,
-                    "backup_created": (
-                        self._public_path(backup_path) if backup_path else None
-                    ),
-                }
-            )
-
-        except Exception as e:
-            self.logger.error(f"Restore error: {e}", exc_info=True)
-            return web.json_response(
-                {
-                    "success": False,
-                    "error": f"Failed to restore database: {self._public_error(e)}",
-                },
-                status=500,
-            )
-        finally:
-            if temp_path:
-                for suffix in ("", "-wal", "-shm", "-journal"):
-                    if os.path.exists(temp_path + suffix):
-                        os.unlink(temp_path + suffix)
-
    async def scan_images(self, request):
        """Scan ComfyUI output images for prompt metadata and add them to the database.

@@ -1741,6 +1617,8 @@ class AdminRoutesMixin:
            if outcomes is not None:
                outcomes.append(_scan_outcome(media_file, roots, status, title))

+        batch_results = list(batch_results)
+        history = _BatchHistory(self, [media for media, _meta in batch_results])
        for media_file, metadata in batch_results:
            if self._scan_job and self._scan_job.cancelled:
                break
@@ -1754,6 +1632,7 @@ class AdminRoutesMixin:
                    ambiguous=ambiguous,
                    untraced=untraced,
                    records=records,
+                    history=history,
                )
            except Exception as e:
                self.logger.error(f"Error processing {media_file.name}: {e}")
@@ -1764,7 +1643,14 @@ class AdminRoutesMixin:
                if self._review_file_linked(media_file, roots):
                    outcome = "unchanged"  # already linked: not a review case
                else:
-                    self._record_scanned_review(media_file, roots, review)
+                    # The records name the item versions that count; the
+                    # saver anchor (#390) is checked on the captured bytes.
+                    self._record_scanned_review(
+                        media_file,
+                        roots,
+                        review,
+                        scanned=(records.get("canonical"), None),
+                    )
            elif untraced and outcome == "unresolved":
                # Untraced by the default profile: the inspection profile may
                # still offer a choice (queued for review, never linked).
@@ -1812,6 +1698,7 @@ class AdminRoutesMixin:
        ambiguous=None,
        untraced=None,
        records=None,
+        history=None,
    ):
        """Enrich exact pairs; retain legacy positive-only import for absent pairs.

@@ -1824,12 +1711,14 @@ class AdminRoutesMixin:
        ``"ambiguous"`` (nothing linked it) is a Needs review case. An
        ambiguous result with nothing to choose (``reviewable`` is False: fewer
        than two candidates carry a prompt) that nothing links returns
-        ``"unresolved"`` instead, and ``media_file`` goes to ``untraced``;
-        its parsed records go to ``records["canonical"]`` when ``records`` is
-        a dict.
+        ``"unresolved"`` instead, and ``media_file`` goes to ``untraced``.
+        The parsed records of either ambiguous file go to
+        ``records["canonical"]`` when ``records`` is a dict.
        """
        if not metadata:
-            return None
+            # No prompt metadata (--disable-metadata, bare savers): only the
+            # recorded run can say which prompt made it (#342)
+            return self._link_recorded_run(media_file, {}, detailed, history)
        canonical = dict(metadata)
        for key in ("prompt", "workflow"):
            if isinstance(canonical.get(key), str):
@@ -1838,10 +1727,37 @@ class AdminRoutesMixin:
                except (ValueError, TypeError):
                    # Preserve malformed metadata for conservative resolver rejection.
                    pass
+        if metadata_opted_out(canonical):
+            # Save to library was off for the run's prompt: no prompt, link,
+            # recorded-run fallback or Needs review item (#90)
+            return "not_saved"
+        if metadata_opted_out(canonical, unreadable=True):
+            # The switch is wired from a node the file cannot show: only the
+            # live run (the node saw the value) can link it, never a scan
+            return "not_saved_wired"
        if not canonical.get("prompt") and not canonical.get("parameters"):
-            return None
+            return self._link_recorded_run(media_file, canonical, detailed, history)
        _with_file_size(canonical, media_file)
        resolution = resolve_prompt_pair(canonical)
+        if resolution["state"] == "resolved" and side_opted_out(
+            canonical.get("prompt"), resolution["negative"]
+        ):
+            # Only the negative's node is off: store the positive alone (#90)
+            prompt_text = (
+                resolution["positive"]
+                .get("storage_text", resolution["positive"]["text"])
+                .strip()
+            )
+            status = self._store_scanned_prompt(media_file, canonical, prompt_text)
+            if not detailed or status not in SCAN_TITLED_DETAILS:
+                return status
+            return {
+                "status": status,
+                "title": self._scan_title(media_file, prompt_text),
+            }
+        if blank_positive(resolution):
+            # Only prepend/append text: no stored prompt can own it (#342)
+            resolution = {**resolution, "state": "unresolved"}
        # Ambiguous without a choice: unresolved unless something links it.
        unchoosable = resolution["state"] == "ambiguous" and not reviewable(resolution)
        if unchoosable:
@@ -1851,6 +1767,8 @@ class AdminRoutesMixin:
                records["canonical"] = canonical
        elif resolution["state"] == "ambiguous" and ambiguous is not None:
            ambiguous.append(media_file)
+            if records is not None:
+                records["canonical"] = canonical
        if resolution["state"] == "resolved":
            result = ingest_resolved_pair(
                self.db, str(media_file), canonical, resolution
@@ -1870,6 +1788,11 @@ class AdminRoutesMixin:
            # Graphs without a recognized sampler keep the legacy extractor below.
            prompt_text = self._graph_prompt_text(metadata)
            if not prompt_text:
+                linked = self._link_recorded_run(
+                    media_file, canonical, detailed, history
+                )
+                if linked is not None:
+                    return linked
                return "unresolved" if unchoosable else resolution["state"]
        elif resolution["state"] == "ambiguous":
            return "unresolved" if unchoosable else "ambiguous"
@@ -1877,13 +1800,24 @@ class AdminRoutesMixin:
            canonical.get("parameters"), str
        ):
            return resolution["state"]
+        elif canonical.get("prompt"):
+            # No node takes a positive or negative input (a guider or wrapper
+            # graph): the one wired text, never a guess (#252).
+            found = sampler_less_prompt(canonical["prompt"])
+            prompt_text = found["text"]
+            if prompt_text is None and isinstance(canonical.get("parameters"), str):
+                # A metadata saver also wrote A1111 text: its positive prompt.
+                parsed = self._parse_comfyui_prompt(metadata)["positive_prompt"]
+                prompt_text = parsed.strip() if parsed and parsed.strip() else None
+            if prompt_text is None:
+                linked = self._link_recorded_run(
+                    media_file, canonical, detailed, history
+                )
+                if linked is not None:
+                    return linked
+                return "unresolved" if found["state"] == "ambiguous" else "found"
        else:
-            parsed = self._parse_comfyui_prompt(metadata)
-            if not (parsed.get("prompt") or parsed.get("parameters")):
-                return None
-            prompt_text = self._extract_readable_prompt(parsed)
-            if prompt_text is not None and not isinstance(prompt_text, str):
-                prompt_text = str(prompt_text)
+            prompt_text = self._parse_comfyui_prompt(metadata)["positive_prompt"]
            if not (prompt_text and prompt_text.strip()):
                return "found"
            prompt_text = prompt_text.strip()
@@ -1893,6 +1827,62 @@ class AdminRoutesMixin:
            return status
        return {"status": status, "title": self._scan_title(media_file, prompt_text)}

+    def _recorded_runs_for(self, media_files):
+        """``{path: prompt id or None}`` from recorded history for a scan batch.
+
+        One output lookup per chunk of names (``stored_run_prompts``), so a
+        batch never queries history once per file. An empty dict on failure.
+        """
+        try:
+            return stored_run_prompts(
+                self.db, [str(path) for path in media_files], host_output_directory()
+            )
+        except Exception:
+            self.logger.warning(
+                "History attribution failed for a scan batch", exc_info=True
+            )
+            return {}
+
+    def _link_recorded_run(self, media_file, canonical, detailed=False, history=None):
+        """Link a file recorded history attributes to one stored prompt (#342).
+
+        Returns the scan status (with ``detailed``, a stored or linked file's
+        ``{"status", "title"}``), or None when history names no single stored
+        prompt for the file (``database.run_attribution``). Never creates a
+        prompt. Works without any prompt metadata in the file. ``history`` is
+        the batch's precomputed lookup; without it the file is looked up alone.
+        """
+        if history is not None:
+            prompt_id = history.get(str(media_file))
+        else:
+            try:
+                prompt_id = stored_run_prompt(
+                    self.db, str(media_file), host_output_directory()
+                )
+            except Exception:
+                self.logger.warning(
+                    f"History attribution failed for {media_file.name}",
+                    exc_info=True,
+                )
+                return None
+        if prompt_id is None:
+            return None
+        try:
+            image_id = self.db.link_image_to_prompt(
+                prompt_id, str(media_file), metadata=canonical
+            )
+        except Exception as e:
+            self.logger.error(f"Failed to link {media_file.name} from history: {e}")
+            return "found"
+        status = "linked" if image_id else "unchanged"
+        if not detailed or status not in SCAN_TITLED_DETAILS:
+            return status
+        prompt = self.db.get_prompt_by_id(prompt_id) or {}
+        return {
+            "status": status,
+            "title": self._scan_title(media_file, prompt.get("text") or ""),
+        }
+
    def _scan_title(self, media_file, text):
        """The linked prompt's Library title (its stored title, else ``text``'s
        first line), as the Library and the inspector name it."""
@@ -10,12 +10,15 @@ filesystem or the database.

 import math

-WD14_MODELS = frozenset({"wd14-swinv2", "wd14-vit"})
-LLM_MODELS = frozenset({"gguf", "hf"})
-MODEL_TYPES = WD14_MODELS | LLM_MODELS
-
-MAX_INSTRUCTION_CHARS = 4000
-MAX_INSTRUCTION_BYTES = 16 * 1024
+from ..tagging_defaults import (  # noqa: F401 - re-exported for the route
+    LLM_MODEL_TYPES as LLM_MODELS,
+    MAX_INSTRUCTION_BYTES,
+    MAX_INSTRUCTION_CHARS,
+    MODEL_TYPES,
+    WD14_MODEL_TYPES as WD14_MODELS,
+    validate_template,
+    validate_threshold,
+)

 SUGGEST_FIELDS = frozenset(
    {"target", "capture_token", "expected_epoch", "model_type", "options"}
@@ -24,7 +27,7 @@ _COMMON = frozenset({"suggestion_limit", "use_gpu"})
 _WD14_REQUIRED = frozenset({"general_threshold", "character_threshold"})
 _LLM_REQUIRED = frozenset({"instructions"})

-UNAVAILABLE_HINT = "Download it from the legacy Auto-tag page."
+UNAVAILABLE_HINT = "Download it in System › Auto-tagging."


 class OptionError(ValueError):
@@ -32,27 +35,17 @@ class OptionError(ValueError):


 def _threshold(name: str, value) -> float:
-    if type(value) not in (int, float) or not math.isfinite(value):
-        raise OptionError(f"{name} must be a finite number")
-    if not 0 <= value <= 1:
-        raise OptionError(f"{name} must be between 0 and 1")
-    return float(value)
+    try:
+        return validate_threshold(name, value)
+    except ValueError as error:
+        raise OptionError(str(error)) from None


 def _instructions(value) -> str:
-    if not isinstance(value, str) or not value.strip():
-        raise OptionError("instructions must be non-empty text")
-    if len(value) > MAX_INSTRUCTION_CHARS:
-        raise OptionError(
-            f"instructions must be at most {MAX_INSTRUCTION_CHARS} characters"
-        )
    try:
-        encoded = value.encode("utf-8")
-    except UnicodeEncodeError:
-        raise OptionError("instructions must be valid Unicode text") from None
-    if len(encoded) > MAX_INSTRUCTION_BYTES:
-        raise OptionError("instructions are too long")
-    return value
+        return validate_template(value)
+    except ValueError as error:
+        raise OptionError(str(error)) from None


 def validate_options(model_type, options, *, default_limit: int, max_limit: int):
@@ -27,7 +27,12 @@ from .annotation_suggest import (
    validate_options,
 )
 from .autotag_routes import model_busy_response
-from .images import _forbidden, _has_traversal, _unavailable_link, _verified_title
+
+# The target check is shared with the collection routes (#331); both names
+# stay importable from here.
+from .media_target import MAX_TARGET_PATH  # noqa: F401
+from .media_target import media_target as _target
+from .images import _unavailable_link, _verified_title
 from .prompts import bad_request
 from .. import model_gate

@@ -40,7 +45,7 @@ try:
    )
    from ...database.execution_history import subscribe_history_restore
    from ...database.library_commands import LibraryCommandError
-    from ...utils.media_capture import CAPTURE_EXTENSIONS, CaptureError, CaptureStore
+    from ...utils.media_capture import CaptureError, CaptureStore
 except ImportError:
    from database.annotations import (
        MAX_IMAGE_TAGS,
@@ -50,15 +55,13 @@ except ImportError:
    )
    from database.execution_history import subscribe_history_restore
    from database.library_commands import LibraryCommandError
-    from utils.media_capture import CAPTURE_EXTENSIONS, CaptureError, CaptureStore
+    from utils.media_capture import CaptureError, CaptureStore

 # Request bodies of the annotation routes are small (a target plus a tag set).
 MAX_BODY_BYTES = 64 * 1024
-MAX_TARGET_PATH = 1024
 CAPTURE_URL = "/prompt_manager/image-annotations/capture/"
 _PREVIEW_CHUNK = 64 * 1024

-_TARGET_FIELDS = frozenset({"root_index", "root_scope", "path"})
 _OBSERVE_FIELDS = frozenset({"target"})
 _SAVE_FIELDS = frozenset(
    {
@@ -188,37 +191,6 @@ def _capture_error(exc: CaptureError) -> web.Response:
    return _coded(exc.code, _MESSAGES.get(exc.code) or str(exc))


-def _target(data: object):
-    """``((index, scope, relative), None)`` for a target, else ``(None, error)``.
-
-    Only the listing identity is accepted: an int root index, the root's
-    64-hex scope and a bounded root-relative POSIX media path, never an
-    absolute, drive-qualified, backslash or ``..`` path. Nothing here touches
-    the filesystem or the database.
-    """
-    if not isinstance(data, dict) or set(data) != _TARGET_FIELDS:
-        return None, bad_request("target must name root_index, root_scope and path")
-    index, scope, relative = data["root_index"], data["root_scope"], data["path"]
-    if type(index) is not int or index < 0:
-        return None, bad_request("Invalid gallery root")
-    if not isinstance(scope, str) or _HEX64.fullmatch(scope) is None:
-        return None, bad_request("Invalid gallery root scope")
-    if not isinstance(relative, str) or not relative or len(relative) > MAX_TARGET_PATH:
-        return None, bad_request("path must be a relative media path")
-    parts = relative.split("/")
-    if (
-        "\0" in relative
-        or "\\" in relative
-        or relative.startswith("/")
-        or _has_traversal(relative)
-        or any(part in ("", ".", "..") or ":" in part for part in parts)
-    ):
-        return None, _forbidden()
-    if os.path.splitext(parts[-1])[1].lower() not in CAPTURE_EXTENSIONS:
-        return None, _forbidden("Only media files can be tagged")
-    return (index, scope, relative), None
-
-
 def _expires_at(seconds: float | None) -> str:
    moment = datetime.datetime.now(datetime.timezone.utc) + datetime.timedelta(
        seconds=max(0.0, seconds or 0.0)
@@ -296,6 +268,7 @@ class AnnotationRoutesMixin:
                self._captures_closed = True
            unsubscribe, self._captures_unsubscribe = self._captures_unsubscribe, None
            store, self._captures = self._captures, None
+            self._suggested_tokens = set()
        if unsubscribe is not None:
            unsubscribe()
        if store is not None:
@@ -515,6 +488,7 @@ class AnnotationRoutesMixin:
        store = self._captures
        if store is not None and _TOKEN.fullmatch(token) is not None:
            store.release(token)
+        self._suggested_tokens.discard(token)
        return web.json_response(
            {"success": True}, headers={"Cache-Control": "no-store"}
        )
@@ -564,6 +538,9 @@ class AnnotationRoutesMixin:
            return _coded("capture-expired", _OTHER_FILE)
        if facts.sha256 != capture.sha256:
            return _coded("file-changed")
+        # A save after Generate suggestions ran on this capture marks the
+        # image auto-tagged (#379), so a Skip batch leaves the review alone.
+        suggested = token in self._suggested_tokens
        try:
            receipt = await self._run_in_executor(
                self.db.replace_image_tags,
@@ -574,6 +551,7 @@ class AnnotationRoutesMixin:
                expected_epoch=expected_epoch,
                expected_tag_revision=revision,
                tags=tags,
+                mark_autotagged=suggested,
            )
        except AnnotationCommandError as exc:
            current = exc.current or {}
@@ -590,10 +568,23 @@ class AnnotationRoutesMixin:
        except Exception:
            self.logger.exception("Image tag save failed")
            return _error(500, "save-failed", "The tags could not be saved.")
+        # Dropped only after a saved or replayed receipt: a retry after a
+        # tag-conflict still marks.
+        self._suggested_tokens.discard(token)
        return web.json_response(
            {"success": True, **receipt}, headers={"Cache-Control": "no-store"}
        )

+    def _remember_suggested(self, store, token: str) -> None:
+        """Note that Generate ran on *token*; forget tokens whose capture is
+        gone. ``expires_in`` does not reset a capture's idle clock."""
+        self._suggested_tokens = {
+            kept
+            for kept in self._suggested_tokens
+            if store.expires_in(kept) is not None
+        }
+        self._suggested_tokens.add(token)
+
    # -- suggest ---------------------------------------------------------------

    async def suggest_image_tags(self, request: web.Request) -> web.Response:
@@ -675,6 +666,7 @@ class AnnotationRoutesMixin:
        finally:
            if not started:
                store.release_use(token)
+        self._remember_suggested(store, token)
        return web.json_response(
            {
                "success": True,
@@ -0,0 +1,289 @@
+"""The shareable diagnostic report (#329 System S12).
+
+``GET /prompt_manager/system/diagnostics`` answers a report built on the
+server from an explicit list of fields: the project and Viewer.js versions,
+Python and the platform, the four checks of the legacy ``GET /diagnostics``
+(one helper, ``admin.legacy_checks``), the database's public info, source
+counts, the log configuration and statistics, the last health summary and
+the configuration keys that only ``config.json`` holds. It never copies
+``PromptManagerConfig.get_config()``: no path leaf is listed, and the CivitAI
+key is reported only as ``has_civitai_api_key``.
+
+Every path in the report goes through ``report_path``: relative to the
+closest public anchor that is not a filesystem root, else ``"outside
+ComfyUI"``, never a basename that could be a user name. As a backstop,
+``scrub`` replaces any string that still looks like an absolute path, holds
+the saved key or the home folder (with or without its root), and counts each
+replacement in ``redacted`` (0 for a correct builder).
+
+The report opens the database, so it takes a registry lease: it is refused
+(409 ``busy``) while an ``exclusive`` job (a restore) runs, and a restore
+waits for it. It is built off the event loop.
+"""
+
+import datetime
+import json
+import ntpath
+import os
+import platform
+import posixpath
+import re
+from pathlib import Path, PurePosixPath, PureWindowsPath
+
+from aiohttp import web
+
+from . import admin as _admin
+from .job_routes import busy_response
+from .jobs import JobBusy
+from .system import health_summary
+
+try:
+    from ...utils.version import project_version
+except ImportError:  # loaded as the top-level ``py`` package (tests)
+    from utils.version import project_version
+
+DIAGNOSTICS_LEASE = "Diagnostics"
+_ROOT = Path(__file__).resolve().parents[2]
+VIEWERJS_PROVENANCE = str(_ROOT / "web" / "lib" / "viewerjs" / "provenance.json")
+OUTSIDE = "outside ComfyUI"
+REMOVED = "[removed]"
+# The CivitAI key is searched for only when it is long enough to be a key.
+MIN_KEY_LENGTH = 8
+_WINDOWS_ABSOLUTE = re.compile(r"^[A-Za-z]:[\\/]")
+
+
+def anchored_path(canonical, anchors, home, pathmod=os.path):
+    """``canonical`` relative to the closest usable anchor, else ``outside ComfyUI``.
+
+    All three are already canonical (``normcase``) in ``pathmod``'s spelling.
+    A filesystem root is never usable, nor is a strict ancestor of ``home``
+    (``/home``, ``C:\\Users``), whose relative paths would start with a user
+    name; so a path inside the home folder needs an anchor at or below it.
+    """
+    flavor = PureWindowsPath if pathmod is ntpath else PurePosixPath
+    target = flavor(canonical)
+    home_path = flavor(home) if home else None
+    usable = []
+    for anchor in map(flavor, anchors):
+        if anchor.parent == anchor:
+            continue
+        if home_path is not None and home_path != anchor:
+            if home_path.is_relative_to(anchor):
+                continue
+        if target.is_relative_to(anchor):
+            usable.append(anchor)
+    if not usable:
+        return OUTSIDE
+    anchor = max(usable, key=lambda a: len(a.parts))
+    return target.relative_to(anchor).as_posix() or "."
+
+
+def _canonical(path):
+    return os.path.normcase(os.path.realpath(str(path)))
+
+
+def report_path(path):
+    """``path`` relative to a public anchor (POSIX style), else ``outside ComfyUI``."""
+    if not path:
+        return ""
+    from ..config import GalleryConfig
+
+    try:
+        canonical = _canonical(path)
+        anchors = [_canonical(anchor) for anchor in GalleryConfig.path_anchors()]
+        home = os.path.expanduser("~")
+        home = _canonical(home) if home and home != "~" else None
+    except (OSError, ValueError):
+        return OUTSIDE
+    return anchored_path(canonical, anchors, home)
+
+
+def _looks_absolute(text):
+    return (
+        posixpath.isabs(text)
+        or ntpath.isabs(text)
+        or _WINDOWS_ABSOLUTE.match(text) is not None
+        or text.startswith("\\\\")
+    )
+
+
+# The home folder is matched only as whole path parts, never inside a word.
+_PART = r"(?<![\w.-]){}(?![\w.-])"
+MIN_HOME_NAME = 3
+
+
+def _home_patterns():
+    """``(pattern, paths_only)`` for the home folder: in full, rootless, its name.
+
+    Accepted residual risk: only this process's own home folder is known, so
+    another user's home (an output folder under /home/<them> while ComfyUI
+    runs as a service account) can still be named by a report path.
+    """
+    home = os.path.expanduser("~")
+    if not home or home == "~" or len(home) < 4 or home in ("/", "\\"):
+        return ()
+    spellings = {home, home.replace("\\", "/")}
+    relative = os.path.splitdrive(home)[1].strip("\\/")
+    for spelling in (relative, relative.replace("\\", "/")):
+        if "/" in spelling or "\\" in spelling:
+            spellings.add(spelling)
+    patterns = [
+        (re.compile(_PART.format(re.escape(spelling)), re.IGNORECASE), False)
+        for spelling in spellings
+    ]
+    name = re.split(r"[\\/]", relative)[-1] if relative else ""
+    if len(name) >= MIN_HOME_NAME:
+        # The bare name only inside a path ("info/x"), not a word ("INFO").
+        patterns.append(
+            (re.compile(_PART.format(re.escape(name)), re.IGNORECASE), True)
+        )
+    return tuple(patterns)
+
+
+def scrub(report, key):
+    """``report`` with leaked paths and the key replaced, counted in ``redacted``."""
+    key = key if isinstance(key, str) and len(key) >= MIN_KEY_LENGTH else None
+    homes = _home_patterns()
+    count = 0
+
+    def clean(value):
+        nonlocal count
+        if isinstance(value, str):
+            if (
+                _looks_absolute(value)
+                or (key and key in value)
+                or any(
+                    pattern.search(value)
+                    for pattern, paths_only in homes
+                    if not paths_only or "/" in value or "\\" in value
+                )
+            ):
+                count += 1
+                return REMOVED
+            return value
+        if isinstance(value, dict):
+            return {name: clean(item) for name, item in value.items()}
+        if isinstance(value, (list, tuple)):
+            return [clean(item) for item in value]
+        return value
+
+    cleaned = clean(report)
+    cleaned["redacted"] = int(cleaned.get("redacted") or 0) + count
+    return cleaned
+
+
+def viewerjs_version(path=None):
+    """The pinned Viewer.js version from its provenance file, or ``unknown``."""
+    try:
+        with open(path or VIEWERJS_PROVENANCE, encoding="utf-8") as handle:
+            version = json.load(handle).get("version")
+    except (OSError, ValueError, AttributeError):
+        return "unknown"
+    return version if isinstance(version, str) and version else "unknown"
+
+
+def public_config():
+    """The configuration keys only ``config.json`` holds, from an explicit list."""
+    from ..config import GalleryConfig, IntegrationConfig, PromptManagerConfig
+
+    return {
+        "database": {
+            "enable_duplicate_detection": (
+                PromptManagerConfig.ENABLE_DUPLICATE_DETECTION
+            ),
+            "enable_auto_save": PromptManagerConfig.ENABLE_AUTO_SAVE,
+        },
+        "web_ui": {
+            "result_timeout": PromptManagerConfig.RESULT_TIMEOUT,
+            "show_test_button": PromptManagerConfig.SHOW_TEST_BUTTON,
+            "webui_display_mode": PromptManagerConfig.WEBUI_DISPLAY_MODE,
+            "infinite_scroll": PromptManagerConfig.INFINITE_SCROLL,
+        },
+        "performance": {
+            "max_search_results": PromptManagerConfig.MAX_SEARCH_RESULTS,
+            "enable_fuzzy_search": PromptManagerConfig.ENABLE_FUZZY_SEARCH,
+            "auto_backup_interval": PromptManagerConfig.AUTO_BACKUP_INTERVAL,
+            "worker_threads": PromptManagerConfig.WORKER_THREADS,
+        },
+        "gallery": {
+            "processing_delay": GalleryConfig.PROCESSING_DELAY,
+            "prompt_timeout": GalleryConfig.PROMPT_TIMEOUT,
+            "cleanup_interval": GalleryConfig.CLEANUP_INTERVAL,
+            "auto_cleanup_missing_files": GalleryConfig.AUTO_CLEANUP_MISSING_FILES,
+            "max_image_age_days": GalleryConfig.MAX_IMAGE_AGE_DAYS,
+            "max_concurrent_processing": GalleryConfig.MAX_CONCURRENT_PROCESSING,
+            "metadata_extraction_timeout": GalleryConfig.METADATA_EXTRACTION_TIMEOUT,
+        },
+        "integrations": {
+            "lora_manager_enabled": bool(IntegrationConfig.LORA_MANAGER_ENABLED),
+            "has_civitai_api_key": bool(IntegrationConfig.CIVITAI_API_KEY),
+        },
+    }
+
+
+def _source_counts(sources):
+    configured = sources.get("configured") or []
+    effective = sources.get("effective") or []
+    return {
+        "configured": len(configured),
+        "effective": len(effective),
+        "watching": sum(1 for row in effective if row.get("watch") == "watching"),
+        "unavailable": sum(1 for row in configured if row.get("valid") is False),
+    }
+
+
+class DiagnosticsReportMixin:
+    """Mixin providing ``GET /prompt_manager/system/diagnostics``."""
+
+    def _register_diagnostics_report_routes(self, routes):
+        @routes.get("/prompt_manager/system/diagnostics")
+        async def diagnostics_report_route(request):
+            return await self.get_diagnostics_report(request)
+
+    async def get_diagnostics_report(self, request):
+        """The report, built off the loop under a lease (409 ``busy`` in a restore)."""
+        from ..config import IntegrationConfig
+
+        try:
+            async with self._jobs.lease(DIAGNOSTICS_LEASE):
+                report = await self._run_in_executor(self.build_report)
+        except JobBusy as busy:
+            return busy_response(busy)
+        except Exception:
+            self.logger.exception("The diagnostic report could not be built")
+            return web.json_response(
+                {
+                    "success": False,
+                    "code": None,
+                    "error": "The diagnostic report could not be built.",
+                },
+                status=500,
+            )
+        report = scrub(report, IntegrationConfig.CIVITAI_API_KEY)
+        return web.json_response(report, headers={"Cache-Control": "no-store"})
+
+    def build_report(self):
+        """The report's fields (blocking: reads the database and the log folder)."""
+        db = self.db
+        manager = self._get_logger_manager()
+        stats = dict(manager.get_log_stats())
+        stats["log_directory"] = report_path(stats.get("log_directory"))
+        info = dict(db.model.get_database_info() or {})
+        if "database_path" in info:
+            info["database_path"] = report_path(info["database_path"])
+        sources, _monitor = self._source_status()
+        return {
+            "success": True,
+            "generated_at": datetime.datetime.now().replace(microsecond=0).isoformat(),
+            "version": project_version(_ROOT),
+            "python": platform.python_version(),
+            "platform": {"system": platform.system(), "release": platform.release()},
+            "viewerjs": viewerjs_version(VIEWERJS_PROVENANCE),
+            "checks": _admin.legacy_checks(db.model.db_path, report_path),
+            "database_info": info,
+            "sources": _source_counts(sources),
+            "logging": {"config": dict(manager.get_config()), "stats": stats},
+            "health": health_summary(self._current_health_report()),
+            "config": public_config(),
+            "redacted": 0,
+        }
@@ -589,6 +589,7 @@ class DuplicateFilesMixin:
        spellings = await self._run_in_executor(self._source_spellings)
        removed, failure, keepers = 0, None, {}
        totals = dict.fromkeys(("moved", "merged", "favorites", "tags", "review"), 0)
+        totals["categories"] = 0  # image categories kept on the kept copies (#332)
        for done, target in enumerate(targets, start=1):
            if failure is not None:
                self._record_target(job, "kept", target, NOT_ATTEMPTED)
@@ -635,6 +636,9 @@ class DuplicateFilesMixin:
            job.log_line(
                f"Added {_plural(totals['tags'], 'image tag')} to the kept copies"
            )
+        if totals.get("categories"):
+            kept = _plural(totals["categories"], "image category", "image categories")
+            job.log_line(f"Kept {kept} on the kept copies")
        if totals["review"]:
            job.log_line(
                f"Settled {_plural(totals['review'], 'Needs review item')} "
@@ -18,7 +18,7 @@ Blocking: each lookup stats the file's folders once (cached).
 import os
 from pathlib import Path

-from .images import _favorite_relative_key, _favorite_root_key
+from .images import _favorite_relative_key, _favorite_root_key, image_category_key


 def _identity(path):
@@ -78,6 +78,15 @@ class Spellings:
                )
        return spelled

+    @property
+    def listed_roots(self):
+        """The listed roots (the output sources), in order."""
+        return [root for root, _identity in self._listed]
+
+    def category_key(self, path):
+        """*path*'s image category file key (#332), or None outside every source."""
+        return image_category_key(self.listed_roots, path)
+
    def favorites(self, path):
        """``{listed root: path below it (POSIX)}`` for each listed root holding it."""
        path = os.path.abspath(str(path))
@@ -125,9 +134,23 @@ def copy_move(target, kept_stat, spellings):
        "targets": targets,
        "kept_path": target["keeper_abs"],
        "favorites": favorites,
+        "categories": _category_pairs(target, spellings),
        "removed_locator": target["locator"],
        "kept_locator": target["keeper_locator"],
        "sha256": target["hash"],
        "kept_size": kept_stat.st_size,
        "kept_mtime_ns": kept_stat.st_mtime_ns,
    }
+
+
+def _category_pairs(target, spellings):
+    """``[(removed file key, kept file key)]`` for the image category (#332).
+
+    From the two absolute paths, not the favorites tuples: those follow the
+    listed root, which differs from the file key when sources nest.
+    """
+    removed = spellings.category_key(target["abs"])
+    kept = spellings.category_key(target["keeper_abs"])
+    if removed is None or kept is None:
+        return []
+    return [(removed, kept)]
@@ -0,0 +1,337 @@
+"""One shared listing per output root, and the pure helpers behind it (#348).
+
+The API keeps one ``RootListing`` per output root (``_root_listings`` in
+``py/api/__init__.py``). The record is read and written only on the event
+loop; the walk itself, the comparison with the previous listing and both
+folder sets run in the executor through ``walk_root``. Routes live in
+``py/api/images.py`` (``_listing``); this module has no aiohttp import so
+tests can exercise it without a server.
+
+A settled output the image monitor reports is added to its root's stored
+listing without a walk (``output_settled``, ``insert_entry``), in the place
+a walk would list it. When that cannot be exact, the root is marked dirty
+(``mark_root_dirty``) instead; a dirty root gets one background walk, no
+sooner than ``rewalk_interval`` after its previous walk started (PR 2).
+"""
+
+from __future__ import annotations
+
+import asyncio
+import os
+from bisect import bisect_left
+from dataclasses import dataclass, field
+from pathlib import PurePath
+from typing import Callable, NamedTuple
+
+# A listing older than this (seconds) is served as it is, and one background
+# walk replaces it. Read as ``gallery_listing.REFRESH_AFTER`` so tests can
+# patch it.
+REFRESH_AFTER = 30
+
+# The stale read is served at once; its refresh walk starts this many seconds
+# later, so the walk does not share the GIL with the page's own requests
+# (#348 live test: reads during the walk took 2.2 s instead of 0.07 s).
+REFRESH_DELAY = 1.0
+
+# No background walk of a root starts sooner than rewalk_interval(last walk's
+# duration) after its previous walk started: FACTOR times that duration, at
+# least FLOOR and at most CAP seconds. Walks up to CAP / FACTOR (3 s) then
+# hold the GIL at most ~20% of the time; the cap keeps a new output listed
+# within ~20 s, at the cost of a higher share (back to back from 15 s) on
+# slower walks. Read through this module so tests can patch them.
+REWALK_FLOOR = 5
+REWALK_FACTOR = 5
+REWALK_CAP = 15
+
+# A deferred walk is never armed sooner than this: no zero-delay loop.
+MIN_REWALK_DELAY = 0.5
+
+# A reader with no listing gives up (500) after this many walks in a row were
+# discarded by invalidations made while they ran.
+MAX_DISCARDED_WALKS = 3
+
+WALK_STOPPED = "The listing walk was stopped"
+
+STORED = "stored"
+DISCARDED = "discarded"
+FAILED = "failed"
+
+
+class WalkOutcome(NamedTuple):
+    """What one walk ended with; a walk's flight future resolves to this."""
+
+    kind: str
+    error: BaseException | None = None
+
+    @classmethod
+    def stored(cls) -> "WalkOutcome":
+        return cls(STORED)
+
+    @classmethod
+    def discarded(cls) -> "WalkOutcome":
+        return cls(DISCARDED)
+
+    @classmethod
+    def failed(cls, error: BaseException) -> "WalkOutcome":
+        return cls(FAILED, error)
+
+
+@dataclass
+class RootListing:
+    """The shared listing of one output root.
+
+    A record is never deleted: ``drop()`` clears the listing and bumps
+    ``generation``, so a walk that started before a drop can never be stored
+    after it.
+    """
+
+    # (path, mtime) newest first, as _scan_gallery_files_sync returns it.
+    files: list | None = None
+    folders: frozenset | None = None
+    folders_with_ancestors: frozenset | None = None
+    # Monotonic time the last walk finished, stored or failed.
+    walked_at: float | None = None
+    # Number of the last walk started; a running walk is always that one.
+    walk_seq: int = 0
+    # Number of the walk whose files are stored (Rescan waits on it).
+    stored_seq: int = 0
+    generation: int = 0
+    # The running walk's future (resolves to a WalkOutcome), or None.
+    flight: asyncio.Future | None = None
+    # True while walks keep failing: one warning per streak.
+    failing: bool = False
+    # The one deferred background walk not started yet (loop.call_later), or
+    # None: a stale refresh or a dirty root's rewalk, whichever is due first.
+    rewalk_handle: asyncio.TimerHandle | None = None
+    # normcase(realpath(root)), computed by the walk in the executor: monitor
+    # paths are matched against it without file I/O on the loop.
+    resolved_root: str | None = None
+    # Monotonic start and duration of the last walk (rewalk_interval).
+    last_started_at: float | None = None
+    last_duration: float | None = None
+    # A settled output was reported under this root; cleared when a walk starts.
+    dirty: bool = False
+    # Dropped because the output roots changed: no background walk until a
+    # reader (or the warm-up) asks for this root again. The monitor keeps
+    # watching a removed root until ComfyUI restarts.
+    retired: bool = False
+    # Relative paths of settled outputs waiting to be added to ``files``
+    # without a walk, and the one task adding them (``output_settled``).
+    pending_adds: list = field(default_factory=list)
+    add_task: asyncio.Task | None = None
+    # Settled outputs added to the stored listing since the last walk stored.
+    patched: int = 0
+
+    def drop(self) -> None:
+        self.files = None
+        self.folders = None
+        self.folders_with_ancestors = None
+        self.walked_at = None
+        self.pending_adds = []
+        self.patched = 0
+        self.generation += 1
+
+
+def folder_sets(root, files) -> tuple[frozenset, frozenset]:
+    """``(folders, folders_with_ancestors)`` of the files listed under *root*.
+
+    Folders keep the spelling ``/gallery/subfolders`` has always answered:
+    ``str(relative.parent)`` (native separators) for the folders holding
+    files, plus every ancestor joined by ``/``.
+    """
+    # From the path strings: relative_to per file was half of a large walk.
+    sep, prefix = _root_prefix(root)
+    folders = set()
+    for path, _mtime in files:
+        rel_dir = _folder_of(root, path, sep, prefix)
+        if rel_dir:
+            folders.add(rel_dir)
+    with_ancestors = set(folders)
+    for folder in folders:
+        with_ancestors.update(_ancestors(folder))
+    return frozenset(folders), frozenset(with_ancestors)
+
+
+def add_folder(root, path, folders, with_ancestors) -> tuple[frozenset, frozenset]:
+    """Both folder sets once *path* is listed too (the same sets when it adds none)."""
+    sep, prefix = _root_prefix(root)
+    rel_dir = _folder_of(root, path, sep, prefix)
+    if not rel_dir or rel_dir in folders:
+        return folders, with_ancestors
+    return folders | {rel_dir}, with_ancestors | {rel_dir, *_ancestors(rel_dir)}
+
+
+def _root_prefix(root) -> tuple[str, str]:
+    # The separator is the path flavour's own (tests use PureWindowsPath).
+    sep = str(type(root)("a", "b"))[1]
+    prefix = str(root)
+    if not prefix.endswith(sep):
+        prefix += sep
+    return sep, prefix
+
+
+def _folder_of(root, path, sep, prefix) -> str:
+    """The folder ``/gallery/subfolders`` names for *path*; "" for the root."""
+    text = str(path)
+    if text.startswith(prefix):
+        rel_dir = text[len(prefix) :].rpartition(sep)[0]
+    else:
+        rel_dir = str(path.relative_to(root).parent)
+    return "" if rel_dir == "." else rel_dir
+
+
+def _ancestors(folder: str) -> list[str]:
+    parts = folder.replace("\\", "/").split("/")
+    return ["/".join(parts[:i]) for i in range(1, len(parts))]
+
+
+def relative_part(resolved_root: str, path, pathmod=os.path) -> str | None:
+    """The part of the resolved *path* below *resolved_root*, as a walk spells it.
+
+    Kept in *path*'s own case (``realpath`` gives a file's on-disk case on
+    Windows) with the native separator. None when *path* is not below the
+    root, or when the case folding changed the length so the slice would
+    not be exact.
+    """
+    sep = pathmod.sep
+    text = str(path)
+    if sep == "\\":
+        text = _plain(text.replace("/", sep), pathmod)
+    folded = pathmod.normcase(text)
+    prefix = _plain(resolved_root, pathmod)
+    if not prefix.endswith(sep):
+        prefix += sep
+    if len(folded) != len(text) or not folded.startswith(prefix):
+        return None
+    relative = text[len(prefix) :]
+    if any(part in ("", ".", "..") for part in relative.split(sep)):
+        return None
+    return relative
+
+
+def insert_entry(files: list, entry: tuple, max_files: int) -> list | None:
+    """A new listing with *entry* ``(path, mtime)`` where a walk would list it.
+
+    *files* is newest first; an entry for the same path is replaced. Returns
+    *files* itself when it already holds *entry*, and None when the place is
+    not exact: another file has the same mtime (a walk orders those by its
+    own visit order), or the listing is at the walk's *max_files* cap.
+    Blocking (one pass over *files*): run it in the executor.
+    """
+    path, mtime = entry
+    text = str(path)
+    kept = files
+    for index, (listed, listed_mtime) in enumerate(files):
+        if str(listed) == text:
+            if listed_mtime == mtime:
+                return files
+            kept = files[:index] + files[index + 1 :]
+            break
+    else:
+        if len(files) >= max_files:
+            return None
+    index = bisect_left(kept, -mtime, key=lambda item: -item[1])
+    if index < len(kept) and kept[index][1] == mtime:
+        return None
+    return [*kept[:index], entry, *kept[index:]]
+
+
+# A listing that differs from the cached one by more entries than this is
+# rebuilt in full by the workspace caches (listing_delta).
+MAX_DELTA = 256
+
+
+def listing_delta(old: list, new: list, limit: int = MAX_DELTA):
+    """``(added, removed)`` entries from *old* to *new*, or None past *limit*.
+
+    A listing patched by ``insert_entry`` shares every unchanged entry object
+    with the one it came from, so entries are told apart by identity: a walk
+    builds new tuples, shares none and is rebuilt in full. *old* must still
+    be alive (the
+    caller's cache holds it), so no identity was reused.
+    """
+    if abs(len(new) - len(old)) > limit:
+        return None
+    old_ids = set(map(id, old))
+    added = []
+    for entry in new:
+        if id(entry) not in old_ids:
+            added.append(entry)
+            if len(added) > limit:
+                return None
+    if new and len(added) == len(new):
+        return None  # nothing shared: a walk
+    if len(old) + len(added) == len(new):
+        return added, []
+    new_ids = set(map(id, new))
+    return added, [entry for entry in old if id(entry) not in new_ids]
+
+
+def rewalk_interval(last_duration) -> float:
+    """Seconds from a walk's start to the next background walk of its root."""
+    scaled = REWALK_FACTOR * (last_duration or 0.0)
+    return min(REWALK_CAP, max(REWALK_FLOOR, scaled))
+
+
+def root_contains(resolved_root: str, path, pathmod=os.path) -> bool:
+    """True when the resolved *path* lies under *resolved_root* (no file I/O).
+
+    *resolved_root* is already ``normcase``d; *path* is folded the same way,
+    so Windows matches case-insensitively and with either separator. The
+    match ends at a separator: ``/out2/x.png`` is not under ``/out``.
+    """
+    target = _plain(pathmod.normcase(str(path)), pathmod)
+    prefix = _plain(resolved_root, pathmod)
+    if not prefix.endswith(pathmod.sep):
+        prefix += pathmod.sep
+    return target.startswith(prefix)
+
+
+def _plain(path: str, pathmod) -> str:
+    """*path* (normcased or not) without a Windows extended-length prefix.
+
+    ``realpath`` may keep ``\\\\?\\`` on a file past MAX_PATH while its shorter
+    root resolves without it.
+    """
+    if pathmod.sep != "\\":
+        return path
+    if path[:8].lower() == "\\\\?\\unc\\":
+        return "\\\\" + path[8:]
+    if path.startswith("\\\\?\\"):
+        return path[4:]
+    return path
+
+
+def resolve_root(root) -> str:
+    """``normcase(realpath(root))``, the spelling monitor paths are matched in.
+
+    File I/O (realpath follows links): call it in the executor.
+    """
+    return os.path.normcase(os.path.realpath(str(root)))
+
+
+def same_listing(old, new) -> bool:
+    """True when two listings hold the same ``(path, mtime)`` pairs in order."""
+    if old is None or new is None:
+        return False
+    return old is new or old == new
+
+
+def walk_root(
+    scan_fn: Callable[[PurePath], list], root, previous_files
+) -> tuple[list, frozenset, frozenset, str]:
+    """The single executor job of a walk.
+
+    Returns ``(files, folders, with_ancestors, resolved_root)``.
+
+    Opens the root first, so a missing or unreadable root raises ``OSError``
+    instead of listing nothing. Returns *previous_files* itself when nothing
+    changed, which keeps the identity-keyed caches built on it warm.
+    """
+    with os.scandir(root):
+        pass
+    files = scan_fn(root)
+    if same_listing(previous_files, files):
+        files = previous_files
+    folders, with_ancestors = folder_sets(root, files)
+    return files, folders, with_ancestors, resolve_root(root)
@@ -20,6 +20,7 @@ from .history_current import (
    _OpenedCurrentMedia,
    _current_media_response,
    _prepare_current_media,
+    accepts_jxl,
    _reauthorize_current_target,
    candidate_locator,
    resolve_current_candidate,
@@ -30,6 +31,7 @@ from .inspection_service import CurrentFileChanged, inspect_current_file
 try:
    from ...database.execution_history import HistoryEpochChanged
    from ...database.history_gallery import read_history_gallery
+    from ...database.run_attribution import recorded_output_lookup
    from ...database.history_reads import (
        HistoryCaptureChanged,
        OutputPosition,
@@ -41,6 +43,7 @@ try:
 except ImportError:
    from database.execution_history import HistoryEpochChanged
    from database.history_gallery import read_history_gallery
+    from database.run_attribution import recorded_output_lookup
    from database.history_reads import (
        HistoryCaptureChanged,
        OutputPosition,
@@ -142,6 +145,18 @@ def _query(request: web.Request) -> None:
        raise ValueError("Duplicate history query parameter")


+def _jxl_flag(request: web.Request) -> bool:
+    """The cover's ``jxl`` flag (#317): ``1`` when the workspace decoded a
+    JPEG XL image (a browser may not list ``image/jxl`` in Accept), ``0`` or
+    absent otherwise; anything else is a bad request."""
+    value = request.query.get("jxl")
+    if value is None:
+        return False
+    if value not in ("0", "1"):
+        raise ValueError("Invalid jxl flag")
+    return value == "1"
+
+
 def _page_limit(request: web.Request) -> int:
    limit = _decimal(request.query.get("limit", "40"), minimum=1)
    if limit > 100:
@@ -715,6 +730,9 @@ class HistoryRoutesMixin:
                            "library",
                            {"status": "unavailable" if saved_unavailable else "none"},
                        ),
+                        recorded=recorded_output_lookup(
+                            db, close=True, reference=receipt["reference"]
+                        ),
                    )
                    _reauthorize_current_target(resolved, scope)
                    identity = {
@@ -794,6 +812,7 @@ class HistoryRoutesMixin:
            media_options = {
                "ensure_preview": lambda *preview: needed.append(preview),
                "placeholder": self._video_placeholder_bytes(),
+                "accepts_jxl": _jxl_flag(request) or accepts_jxl(request),
            }
        prepared = await execute()
        if needed:
@@ -15,7 +15,9 @@ from typing import BinaryIO

 from aiohttp import web

+from . import thumbnail_settings
 from .images import _canonical, _public_path, SERVABLE_EXTENSIONS, VIDEO_EXTENSIONS
+from .images import existing_media_thumbnail, media_thumbnail_rel

 try:
    from ...utils.execution_outputs import (
@@ -239,14 +241,19 @@ def resolve_current_candidate(


 def _open_current_target(
-    target: Path, namespace: Path, scope: CurrentOutputScope
+    target: Path, namespace: Path, scope: CurrentOutputScope, preview: bool = False
 ) -> BinaryIO:
-    """Open only the canonical target and verify authority against the actual handle."""
+    """Open only the canonical target and verify authority against the actual handle.
+
+    A *preview* (a file under ``thumbnails/``) may also be JPEG XL (#317)."""
    if _canonical(target) != target:
        raise CurrentLocationUnavailable("not_authorized", stale=True)
    if not _authorized(target, namespace, scope):
        raise CurrentLocationUnavailable("not_authorized")
-    if target.suffix.lower() not in SERVABLE_EXTENSIONS:
+    suffix = target.suffix.lower()
+    if suffix not in SERVABLE_EXTENSIONS and not (
+        preview and suffix in thumbnail_settings.THUMBNAIL_EXTENSIONS
+    ):
        raise CurrentLocationUnavailable("unsupported_media")
    flags = (
        os.O_RDONLY
@@ -319,6 +326,61 @@ def _preview_writable(root: Path, preview: Path) -> bool:
    ).is_relative_to(_canonical(folder))


+def _is_jxl(path) -> bool:
+    return Path(path).suffix.lower() == ".jxl"
+
+
+def _preview_without_jxl(root: Path, relative: Path) -> Path | None:
+    """The first existing preview *relative* owns that is not JPEG XL."""
+    return next(
+        (
+            path
+            for path in thumbnail_settings.owned_thumbnails(root, relative)
+            if not _is_jxl(path)
+        ),
+        None,
+    )
+
+
+def accepts_jxl(request) -> bool:
+    """Whether the request's ``Accept`` lists ``image/jxl``."""
+    accept = request.headers.get("Accept", "")
+    return any(
+        part.split(";", 1)[0].strip().lower() == "image/jxl"
+        for part in accept.split(",")
+    )
+
+
+def _placeholder_media(placeholder: bytes) -> "_OpenedCurrentMedia":
+    return _OpenedCurrentMedia(io.BytesIO(placeholder), len(placeholder), "image/jpeg")
+
+
+def _cover_target(resolved, ensure_preview, placeholder, accepts_jxl):
+    """What the cover opens: a preview path, the placeholder media, or None
+    for the original (see ``_prepare_current_media``)."""
+    target = resolved.canonical_target
+    relative = target.relative_to(resolved.gallery_root)
+    is_video = target.suffix.lower() in VIDEO_EXTENSIONS
+    # #317: any preview the file owns (the current format first); a missing
+    # one is made under the current format's name.
+    preview = existing_media_thumbnail(resolved.gallery_root, relative)
+    if preview is not None and not accepts_jxl and _is_jxl(preview):
+        preview = _preview_without_jxl(resolved.gallery_root, relative)
+        if preview is None:
+            if is_video and placeholder is not None:
+                return _placeholder_media(placeholder)
+            return None
+        return _canonical(preview)
+    if preview is not None:
+        return _canonical(preview)
+    preview = resolved.gallery_root / media_thumbnail_rel(relative)
+    if ensure_preview is not None and _preview_writable(resolved.gallery_root, preview):
+        ensure_preview(target, preview, is_video)
+    if is_video and placeholder is not None:
+        return _placeholder_media(placeholder)
+    return None
+
+
 def _prepare_current_media(
    resolved: ResolvedCurrentCandidate,
    scope: CurrentOutputScope,
@@ -326,6 +388,7 @@ def _prepare_current_media(
    thumbnail: bool,
    ensure_preview=None,
    placeholder: bytes | None = None,
+    accepts_jxl: bool = True,
 ) -> _OpenedCurrentMedia:
    """Open the current file, or its preview for ``thumbnail``.

@@ -333,36 +396,28 @@ def _prepare_current_media(
    ``ensure_preview(src, dst, is_video)`` (the route makes it and reads
    again, #249). Without one an image's original is opened and a video is
    the ``placeholder`` JPEG, never the video inside an ``<img>``.
+
+    The cover's URL names no format, so a JPEG XL preview goes only to a
+    browser whose ``Accept`` lists ``image/jxl`` (*accepts_jxl*, review M3).
+    Another one gets the file's preview in another format when there is one,
+    else the original image or a video's placeholder: never a broken image.
    """
    target = resolved.canonical_target
+    is_preview = False
    if thumbnail:
-        relative = target.relative_to(resolved.gallery_root)
-        is_video = target.suffix.lower() in VIDEO_EXTENSIONS
-        extension = ".jpg" if is_video else target.suffix.lower()
-        preview = (
-            resolved.gallery_root
-            / "thumbnails"
-            / f"{relative.with_suffix('').as_posix()}_thumb{extension}"
-        )
-        try:
-            preview.stat()
-        except FileNotFoundError:
-            if ensure_preview is not None and _preview_writable(
-                resolved.gallery_root, preview
-            ):
-                ensure_preview(target, preview, is_video)
-            if is_video and placeholder is not None:
-                return _OpenedCurrentMedia(
-                    io.BytesIO(placeholder), len(placeholder), "image/jpeg"
-                )
-        else:
-            target = _canonical(preview)
-    handle = _open_current_target(target, resolved.namespace, scope)
+        chosen = _cover_target(resolved, ensure_preview, placeholder, accepts_jxl)
+        if isinstance(chosen, _OpenedCurrentMedia):
+            return chosen
+        if chosen is not None:
+            target, is_preview = chosen, True
+    handle = _open_current_target(target, resolved.namespace, scope, is_preview)
    try:
        return _OpenedCurrentMedia(
            handle,
            os.fstat(handle.fileno()).st_size,
-            mimetypes.guess_type(target.name)[0] or "application/octet-stream",
+            thumbnail_settings.content_type(target)
+            or mimetypes.guess_type(target.name)[0]
+            or "application/octet-stream",
        )
    except BaseException:
        handle.close()
@@ -0,0 +1,361 @@
+"""Image category routes (#332): an image file's own category.
+
+``PUT /prompt_manager/images/category`` sets the own category of up to 500
+listed files; ``DELETE`` removes it (listed or not, so a missing file's
+category can still be removed); ``GET /prompt_manager/images/categories``
+lists the own-category values of files the sources list. Targets are the
+Images listing identity (``{root_index, root_scope, path}``, checked by
+``media_target``) of an output source; LoRA folders are not sources here.
+Instead of ``items`` a request may name ``filter``, the Images listing's own
+query ("Select all N matching", #392), resolved now up to 500 images.
+Each file is stored under its file key (``images.image_category_key``).
+These routes never read or write prompts, recipes or image links.
+"""
+
+import os
+from pathlib import Path
+
+from aiohttp import web
+
+from .image_tag_jobs import MAX_JOB_TARGETS, _parse_targets
+from .images import (
+    _favorite_relative_key,
+    _favorite_root_key,
+    _forbidden,
+    _json_body_or_error,
+    image_category_key,
+)
+from .prompts import bad_request
+
+try:
+    from ...database.image_categories import MAX_CATEGORY_LENGTH, MAX_KEY_LENGTH
+    from ...utils.validators import validate_category
+except ImportError:
+    from database.image_categories import MAX_CATEGORY_LENGTH, MAX_KEY_LENGTH
+    from utils.validators import validate_category
+
+CATEGORY_MEDIA_MESSAGE = "Only media files can have a category"
+_PUT_FIELDS = frozenset({"category"})
+_DELETE_FIELDS = frozenset()
+TOO_MANY = f"Select at most {MAX_JOB_TARGETS} images."
+SOURCE_CHANGED_MESSAGE = "The sources changed. Refresh the images and try again."
+WRITE_FAILED = "The category could not be changed."
+READ_FAILED = "Image categories could not be read."
+
+
+def _coded(status: int, code: str, message: str) -> web.Response:
+    return web.json_response(
+        {"success": False, "code": code, "error": message},
+        status=status,
+        headers={"Cache-Control": "no-store"},
+    )
+
+
+def _category_value(raw) -> tuple[str | None, web.Response | None]:
+    """The stripped category, or a 400 (an empty value is a 400: use DELETE)."""
+    if not isinstance(raw, str):
+        return None, bad_request("category must be a string")
+    value = raw.strip()
+    if not value:
+        return None, bad_request("category must not be empty")
+    if len(value) > MAX_CATEGORY_LENGTH:
+        return None, bad_request(
+            f"Category cannot exceed {MAX_CATEGORY_LENGTH} characters"
+        )
+    try:
+        value.encode("utf-8")
+        validate_category(value)
+    except UnicodeEncodeError:
+        return None, bad_request("category must be valid text")
+    except ValueError as exc:
+        return None, bad_request(str(exc))
+    return value, None
+
+
+class _KeyRefused(Exception):
+    """A target has no storable file key (outside every source, or too long)."""
+
+    def __init__(self, message: str = "Access denied"):
+        super().__init__(message)
+        self.message = message
+
+
+def _file_key(roots, root, relative) -> tuple[str, str]:
+    """The target's file key (blocking: resolves the sources)."""
+    key = image_category_key(roots, Path(root) / relative)
+    if key is None:
+        raise _KeyRefused()
+    if max(len(key[0]), len(key[1])) > MAX_KEY_LENGTH:
+        raise _KeyRefused("Path is too long")
+    return key
+
+
+def _nested_sources(root: Path, sources) -> list[tuple[str, str]]:
+    """``[(relative key prefix, source root key)]`` of sources inside *root*.
+
+    Deepest first, so the first prefix that matches is the file's source.
+    """
+    base = os.path.join(os.path.normcase(os.path.realpath(str(root))), "")
+    nested = []
+    for source in sources:
+        real = os.path.realpath(str(source))
+        if not os.path.normcase(real).startswith(base):
+            continue
+        relative = os.path.relpath(real, os.path.realpath(str(root)))
+        nested.append(
+            (
+                _favorite_relative_key(relative.replace(os.sep, "/")),
+                _favorite_root_key(source),
+            )
+        )
+    nested.sort(key=lambda item: item[0].count("/"), reverse=True)
+    return nested
+
+
+def _source_prefix(relative_key: str, nested) -> str | None:
+    """The prefix of the deepest nested source holding *relative_key*."""
+    for prefix, _source_key in nested:
+        if relative_key.startswith(prefix + "/"):
+            return prefix
+    return None
+
+
+class ImageCategoryRoutesMixin:
+    """Routes for images' own categories (#332)."""
+
+    def _register_image_category_routes(self, routes):
+        # Fixed paths beside DELETE /prompt_manager/images/{image_id}, as the
+        # favorite routes are. Registered after it, they still win: aiohttp
+        # (3.10+) looks fixed paths up before dynamic resources
+        # (test_delete_category_never_reaches_delete_image).
+        @routes.put("/prompt_manager/images/category")
+        async def set_image_category_route(request):
+            return await self.set_image_category(request)
+
+        @routes.delete("/prompt_manager/images/category")
+        async def clear_image_category_route(request):
+            return await self.clear_image_category(request)
+
+        @routes.get("/prompt_manager/images/categories")
+        async def list_image_categories_route(request):
+            return await self.list_image_categories(request)
+
+    # -- reading ---------------------------------------------------------------
+
+    def _own_category_map(self, sources, listings) -> dict:
+        """``{root / listed path: own category}`` for the listed files (blocking).
+
+        One primary-key range read per source; each stored row is matched to
+        the listing of every selected root that holds its source, so the work
+        follows the stored rows, not the files. A file under a nested source
+        is keyed by the deepest one (``image_category_key``). A row whose file
+        is gone matches nothing. A failed read raises.
+        """
+        sources = list(sources)
+        rows = self.db.own_categories_of(_favorite_root_key(s) for s in sources)
+        if not rows:
+            return {}
+        by_source: dict[str, dict[str, str]] = {}
+        for (root_key, relative), category in rows.items():
+            by_source.setdefault(root_key, {})[relative] = category
+        found = {}
+        for _index, root, files in listings:
+            listing = self._favorite_listing(root, files)
+            root_key = _favorite_root_key(root)
+            nested = [
+                item for item in _nested_sources(root, sources) if item[1] != root_key
+            ]
+            for relative, category in by_source.get(root_key, {}).items():
+                listed = listing.get(relative)
+                if listed is not None and _source_prefix(relative, nested) is None:
+                    found[root / listed] = category
+            for prefix, source_key in nested:
+                for relative, category in by_source.get(source_key, {}).items():
+                    full = f"{prefix}/{relative}"
+                    listed = listing.get(full)
+                    if listed is not None and _source_prefix(full, nested) == prefix:
+                        found[root / listed] = category
+        return found
+
+    async def _source_listings(self, roots) -> list[tuple]:
+        return [
+            (index, root, await self._get_gallery_files(root))
+            for index, root in enumerate(roots)
+        ]
+
+    async def list_image_categories(self, request):
+        """GET: the own-category values of listed files, sorted."""
+        try:
+            roots = list(self._get_all_output_dirs())
+            listings = await self._source_listings(roots)
+            found = await self._run_in_executor(self._own_category_map, roots, listings)
+        except Exception:
+            self.logger.exception("Image categories read failed")
+            return _coded(500, "categories-failed", READ_FAILED)
+        return web.json_response(
+            {"success": True, "categories": sorted(set(found.values()))},
+            headers={"Cache-Control": "no-store"},
+        )
+
+    # -- writing ---------------------------------------------------------------
+
+    async def _filter_targets(self, raw):
+        """``(targets, None)`` for an Images listing filter, else ``(None, error)``.
+
+        "Select all N matching" (#392) sends the listing's own query; it is
+        resolved now, up to 500 images (a 400 ``too-many-images`` above).
+        """
+        from .images import ListingSourceChanged, parse_listing_filter
+
+        try:
+            selection = await self.resolve_listing_filter(
+                parse_listing_filter(raw), MAX_JOB_TARGETS
+            )
+        except ListingSourceChanged:
+            return None, _coded(409, "source-changed", SOURCE_CHANGED_MESSAGE)
+        except ValueError as exc:
+            return None, bad_request(str(exc))
+        if selection.truncated:
+            return None, _coded(400, "too-many-images", TOO_MANY)
+        return tuple(selection.targets), None
+
+    async def _category_request(self, request, fields: frozenset):
+        """``(data, targets, roots, None)`` or ``(None, None, None, error)``.
+
+        The images are ``items`` (1 to 500 targets) or ``filter`` (all images
+        an Images listing filter admits), besides *fields*.
+        """
+        data, error = await _json_body_or_error(request)
+        if error is not None:
+            return None, None, None, error
+        names = set(data) - fields
+        if set(data) & fields != fields or names not in ({"items"}, {"filter"}):
+            return (
+                None,
+                None,
+                None,
+                bad_request(
+                    "Request must contain "
+                    + ", ".join(sorted(fields))
+                    + (" and " if fields else "")
+                    + "either items or filter"
+                ),
+            )
+        if "filter" in data:
+            targets, error = await self._filter_targets(data["filter"])
+            if error is not None:
+                return None, None, None, error
+            return data, targets, list(self._get_all_output_dirs()), None
+        items = data["items"]
+        if not isinstance(items, list) or not 1 <= len(items) <= MAX_JOB_TARGETS:
+            return (
+                None,
+                None,
+                None,
+                bad_request(f"items must list 1 to {MAX_JOB_TARGETS} images"),
+            )
+        targets, error = _parse_targets(items, media_message=CATEGORY_MEDIA_MESSAGE)
+        if error is not None:
+            return None, None, None, error
+        try:
+            for _index, _scope, relative in targets:
+                relative.encode("utf-8")
+        except UnicodeEncodeError:
+            return None, None, None, bad_request("path must be valid text")
+        roots = list(self._get_all_output_dirs())
+        for index, scope in dict.fromkeys((t[0], t[1]) for t in targets):
+            if index >= len(roots):
+                return None, None, None, bad_request("Invalid gallery root")
+            error = self._gallery_scope_error(
+                {"root_scope": scope, "root": str(index)}, roots
+            )
+            if error is not None:
+                if error.status == 409:
+                    error = _coded(409, "source-changed", SOURCE_CHANGED_MESSAGE)
+                return None, None, None, error
+        return data, targets, roots, None
+
+    def _listed_file_keys(self, roots, targets, files) -> tuple[list, list]:
+        """``(listed keys, unlisted keys)`` of the targets (blocking).
+
+        A target counts as listed when its source's listing holds it; its key
+        then follows the listed spelling. Targets folding to one key count
+        once, and a key that is listed through any target is listed.
+        """
+        listings, listed, missing = {}, {}, {}
+        for index, _scope, relative in targets:
+            root = roots[index]
+            if index not in listings:
+                listings[index] = self._favorite_listing(root, files[index])
+            spelled = listings[index].get(_favorite_relative_key(relative))
+            key = _file_key(roots, root, spelled or relative)
+            (missing if spelled is None else listed)[key] = True
+        return list(listed), [key for key in missing if key not in listed]
+
+    async def set_image_category(self, request):
+        """PUT ``{items, category}``: set the own category of listed files."""
+        data, targets, roots, error = await self._category_request(request, _PUT_FIELDS)
+        if error is not None:
+            return error
+        category, error = _category_value(data["category"])
+        if error is not None:
+            return error
+        try:
+            files = {}
+            for index in dict.fromkeys(t[0] for t in targets):
+                files[index] = await self._get_gallery_files(roots[index])
+            listed_keys, missing_keys = await self._run_in_executor(
+                self._listed_file_keys, roots, targets, files
+            )
+        except _KeyRefused as refused:
+            return _forbidden(refused.message)
+        except Exception:
+            self.logger.exception("Image category update failed")
+            return _coded(500, "category-failed", WRITE_FAILED)
+        try:
+            if not listed_keys:
+                return _coded(
+                    404,
+                    "files-not-found",
+                    "None of the selected images could be found.",
+                )
+            counts = await self._run_in_executor(
+                self.db.set_image_categories, listed_keys, category
+            )
+        except Exception:
+            self.logger.exception("Image category update failed")
+            return _coded(500, "category-failed", WRITE_FAILED)
+        return web.json_response(
+            {
+                "success": True,
+                "category": category,
+                "updated": counts["updated"],
+                "unchanged": counts["unchanged"],
+                "not_found": len(missing_keys),
+            },
+            headers={"Cache-Control": "no-store"},
+        )
+
+    async def clear_image_category(self, request):
+        """DELETE ``{items}``: remove the own category, listed or not."""
+        _data, targets, roots, error = await self._category_request(
+            request, _DELETE_FIELDS
+        )
+        if error is not None:
+            return error
+        try:
+            keys = await self._run_in_executor(
+                lambda: list(
+                    dict.fromkeys(_file_key(roots, roots[i], r) for i, _s, r in targets)
+                )
+            )
+            cleared = await self._run_in_executor(self.db.clear_image_categories, keys)
+        except _KeyRefused as refused:
+            return _forbidden(refused.message)
+        except Exception:
+            self.logger.exception("Image category removal failed")
+            return _coded(500, "category-failed", WRITE_FAILED)
+        return web.json_response(
+            {"success": True, "cleared": cleared},
+            headers={"Cache-Control": "no-store"},
+        )
@@ -2,7 +2,9 @@

 ``POST /prompt_manager/jobs/image-tags`` starts one ``image-tags`` job over
 1..500 listed images, named by the listing identity ``{root_index,
-root_scope, path}``. The job is record-changing (it writes image tag sets and
+root_scope, path}``, or over every image a listing ``filter`` admits (at most
+10,000, resolved at start in the listing's order; "Select all N matching",
+#392). The job is record-changing (it writes image tag sets and
 new vocabulary names), so it never runs beside the metadata scan.

 - **Add tags** (``mode: "add"``) hashes each current file and unions a fixed
@@ -18,13 +20,21 @@ the suggestion worker and the storage call ``add_image_tags``. Files are
 handled one at a time and the job stops at a file boundary when cancelled,
 keeping what it already wrote. Rows and log lines carry root-relative paths
 and public root labels only.
+
+Auto-tag marks each image it ran the model on as auto-tagged (#379), with the
+union of its tags. The ``autotag`` job ("Tag output images", started by
+``POST /jobs/autotag``) runs the same per-file loop over every still image the
+output folders list (:meth:`ImageTagJobsMixin._run_autotag_batch`): image
+tags only, never a prompt tag or prompt text.
 """

 import asyncio
+import dataclasses
 import functools
 import os
 import time
 from dataclasses import dataclass, field
+from typing import NamedTuple

 from aiohttp import web

@@ -45,10 +55,24 @@ from .annotations import (
    _submit,
    _target,
 )
-from .autotag_routes import model_busy_response
-from .images import _public_path
+from .autotag_routes import BATCH_CANCELLED, MODEL_BUSY_ERROR, model_busy_response
+from .images import (
+    MAX_LISTING_SELECTION,
+    ListingSourceChanged,
+    _current_fingerprint,
+    _listing_posix,
+    _public_path,
+    parse_listing_filter,
+)
 from .job_routes import busy_response
-from .jobs import IMAGE_TAG_GROUP_NAMES, IMAGE_TAG_JOB_KIND, JobBusy
+from .jobs import (
+    AUTOTAG_BATCH_JOB_KIND,
+    AUTOTAG_GROUP_NAMES,
+    IMAGE_TAG_GROUP_NAMES,
+    IMAGE_TAG_JOB_KIND,
+    JobBusy,
+)
+from .maintenance import disk_plan, short_space_message
 from .prompts import bad_request

 try:
@@ -75,6 +99,11 @@ except ImportError:
    from utils.video_metadata import is_video_path

 MAX_JOB_TARGETS = 500
+# A filter start resolves on the server, so the request body does not bound it.
+MAX_FILTER_TARGETS = MAX_LISTING_SELECTION
+NO_IMAGES = "No images match this view."
+FILTER_LISTING_FAILED = "The matching images could not be listed. Try again."
+TOO_MANY_IMAGES = "Narrow the view to at most {cap:,} images."
 # 500 maximal targets plus the options: a path of MAX_TARGET_PATH code points
 # takes at most 6 bytes each on the wire (a \uXXXX escape; raw UTF-8 is at most
 # 4), and the root index and scope fit in 256. The annotation routes' 64 KiB
@@ -88,9 +117,10 @@ ADD_TITLE = "Add tags to images"
 AUTO_TITLE = "Auto-tag images"
 GATE_OWNER_KIND = "image-tag-job"

+# Each mode's fields besides the images, named by ``targets`` or ``filter``.
 _FIELDS = {
-    "add": frozenset({"mode", "targets", "tags"}),
-    "auto": frozenset({"mode", "targets", "model_type", "options"}),
+    "add": frozenset({"mode", "tags"}),
+    "auto": frozenset({"mode", "model_type", "options"}),
 }
 _VERBS = {"add": "Add tags", "auto": "Auto-tag"}
 _LOG_PREFIXES = {"tagged": "+", "unchanged": "=", "skipped": "-", "errors": "!"}
@@ -107,6 +137,14 @@ READ_FAILED = "The file could not be read."
 SOURCE_CHANGED = "The source changed. Refresh the image collection."
 STORAGE_RESTORED = "Prompt storage was restored; start the job again."
 BUSY_RETRY = "The file could not be read now. Run the job again for it."
+# Tag output images (#379): the per-image batch.
+ALREADY_AUTOTAGGED = "Already auto-tagged"
+LISTING_FAILED = "The output folders could not be listed. Try again."
+LISTING_STATUS = "Listing output images…"
+_INTERNAL_ERROR = "An internal error occurred. Check server logs for details."
+# The pre-pass stats and looks up this many targets at a time, checking for a
+# cancel between chunks.
+PREPASS_CHUNK = 500

 _monotonic = time.monotonic  # the job's clock (a test can fake it)

@@ -141,6 +179,8 @@ class _Spec:
    tags: tuple = ()
    model_type: str | None = None
    options: dict | None = None
+    # A listing filter the start resolves into ``targets`` (#392).
+    filter: dict | None = None

    @property
    def title(self) -> str:
@@ -153,13 +193,17 @@ class _Spec:
        return scope


-def _parse_targets(raw):
-    """Unique validated targets in request order, or ``(None, error)``."""
+def _parse_targets(raw, **target_options):
+    """Unique validated targets in request order, or ``(None, error)``.
+
+    ``target_options`` reach the target check (the image category routes
+    pass their own ``media_message``, #332).
+    """
    if not isinstance(raw, list) or not 1 <= len(raw) <= MAX_JOB_TARGETS:
        return None, bad_request(f"targets must list 1 to {MAX_JOB_TARGETS} images")
    seen, targets = set(), []
    for item in raw:
-        target, error = _target(item)
+        target, error = _target(item, **target_options)
        if error is not None:
            return None, error
        if target not in seen:
@@ -199,21 +243,35 @@ def parse_image_tag_request(data: dict):
    """A :class:`_Spec` for a start body, or ``(None, error response)``.

    ``{mode:"add", targets, tags}`` or ``{mode:"auto", targets, model_type,
-    options}`` exactly; options follow the Tag dialog's Generate rules.
+    options}`` exactly; options follow the Tag dialog's Generate rules. A
+    ``filter`` (a listing query object, parse_listing_filter) may stand in for
+    ``targets``; the start resolves it.
    """
    fields = _FIELDS.get(data.get("mode"))
    if fields is None:
        return None, bad_request('mode must be "add" or "auto"')
+    fields = fields | {"filter" if "filter" in data else "targets"}
    if set(data) != fields:
        return None, bad_request(
            "Request must contain exactly " + ", ".join(sorted(fields))
        )
-    targets, error = _parse_targets(data["targets"])
-    if error is not None:
-        return None, error
+    listing_filter, targets = None, ()
+    if "filter" in data:
+        try:
+            listing_filter = parse_listing_filter(data["filter"])
+        except ValueError as exc:
+            return None, bad_request(str(exc))
+    else:
+        targets, error = _parse_targets(data["targets"])
+        if error is not None:
+            return None, error
    if data["mode"] == "add":
-        return _parse_add(targets, data)
-    return _parse_auto(targets, data)
+        spec, error = _parse_add(targets, data)
+    else:
+        spec, error = _parse_auto(targets, data)
+    if spec is not None and listing_filter is not None:
+        spec = dataclasses.replace(spec, filter=listing_filter)
+    return spec, error


 def _capture_outcome(exc: CaptureError, root, relative: str):
@@ -246,6 +304,92 @@ async def _capacity_retried(job, attempt):
    return await attempt()


+class Refusal(NamedTuple):
+    """Why a Tag output images start was refused.
+
+    ``response`` is the native route's JSON answer; ``message`` the sentence
+    a legacy stream frame carries.
+    """
+
+    status: int
+    code: str
+    message: str
+    response: web.Response
+
+
+@dataclass(frozen=True)
+class AutotagRun:
+    """What one Tag output images job runs with (validated at its start)."""
+
+    model_type: str
+    existing: str
+    options: dict
+    keep_in_memory: bool
+    backup_on: bool
+    owner: object
+
+
+@dataclass(frozen=True)
+class _BatchTarget:
+    """One still image of the batch: the job target and its private keys."""
+
+    target: tuple  # (root_index, root_scope, relative): the image-tags target
+    path: str  # the listed file, for the pre-pass stat (never sent out)
+    locator: str  # the image tag key: normcase(join(realpath(root), relative))
+    label: str  # the root's public label
+
+
+def _still_targets(api, index, root, files, seen: set) -> list:
+    """Worker thread: one root's listed still images as _BatchTargets.
+
+    Newest first (the listing's order). A locator an earlier root already
+    produced (overlapping roots) is dropped; ``seen`` collects them.
+    """
+    scope = api._gallery_root_scope(root, index)
+    label = _public_path(root)
+    real = os.path.realpath(root)
+    prefix = os.path.join(str(root), "")
+    found = []
+    for path, _mtime in files:
+        relative = _listing_posix(root, prefix, path)
+        if is_video_path(relative):
+            continue
+        locator = os.path.normcase(os.path.join(real, *relative.split("/")))
+        if locator in seen:
+            continue
+        seen.add(locator)
+        found.append(_BatchTarget((index, scope, relative), str(path), locator, label))
+    return found
+
+
+def _prepass_chunk(db, chunk, skip_marked: bool, max_file: int):
+    """Worker thread: ``(remaining, skips)`` for a chunk of _BatchTargets.
+
+    Stats each file (no open, no hash): gone is "File not found", over the
+    capture limit "Too large to verify"; under "Skip already tagged" a file
+    whose current bytes are marked is "Already auto-tagged". ``skips`` are
+    ``(target, detail)`` pairs in target order.
+    """
+    stats, skips, alive = {}, [], []
+    for item in chunk:
+        fingerprint = _current_fingerprint(item.path)
+        if fingerprint is None:
+            skips.append((item, FILE_NOT_FOUND))
+        elif fingerprint[0] > max_file:
+            skips.append((item, TOO_LARGE))
+        else:
+            stats[item.locator] = fingerprint
+            alive.append(item)
+    marked = db.autotag_state(stats) if skip_marked and stats else {}
+    remaining = []
+    for item in alive:
+        if marked.get(item.locator):
+            skips.append((item, ALREADY_AUTOTAGGED))
+        else:
+            remaining.append(item)
+    return remaining, skips
+
+
 def _load_model(service, model_type: str, use_gpu: bool) -> None:
    """Worker thread: load (or swap to) *model_type*; never downloads."""
    if service.is_model_loaded() and service.get_loaded_model_type() == model_type:
@@ -254,6 +398,25 @@ def _load_model(service, model_type: str, use_gpu: bool) -> None:
        raise RuntimeError(f"{model_type} could not be loaded")


+def _refusal(status: int, code: str, message: str) -> Refusal:
+    response = web.json_response(
+        {"success": False, "code": code, "error": message}, status=status
+    )
+    return Refusal(status, code, message, response)
+
+
+def _busy_refusal(busy: JobBusy) -> Refusal:
+    title = getattr(busy.running, "title", "") or "Another job"
+    return Refusal(409, "busy", f"{title} already running", busy_response(busy))
+
+
+def _batch_cancelled(job) -> str:
+    """Say the batch was cancelled; its end state (the runner ends the job)."""
+    job.update(status_line=BATCH_CANCELLED)
+    job.log_line(BATCH_CANCELLED)
+    return "cancelled"
+
+
 class ImageTagJobsMixin:
    """The ``image-tags`` job kind: start route and runner."""

@@ -270,6 +433,10 @@ class ImageTagJobsMixin:
        spec, error = parse_image_tag_request(data)
        if error is not None:
            return error
+        if spec.filter is not None:
+            spec, error = await self._resolve_job_filter(spec)
+            if error is not None:
+                return error
        roots = await self._run_in_executor(self._job_roots, spec.targets)
        if any(root is None for root, _label in roots.values()):
            return _coded("source-changed")
@@ -301,6 +468,246 @@ class ImageTagJobsMixin:
            job.task.add_done_callback(lambda _task: model_gate.release(owner))
        return web.json_response({"success": True, "job": job.summary()}, status=202)

+    # -- Tag output images (#379) ---------------------------------------------
+
+    async def _autotag_targets(self) -> list:
+        """Every still image the output folders list, as _BatchTargets.
+
+        Root by root in configured order, each newest first (the shared
+        listing, ``_get_gallery_files``, used as it is even when stale). Videos
+        are not targets; a file under two overlapping roots is one target.
+        """
+        seen: set = set()
+        found = []
+        for index, root in enumerate(list(self._get_all_output_dirs())):
+            files = await self._get_gallery_files(root)
+            found.extend(
+                await self._run_in_executor(
+                    _still_targets, self, index, root, files, seen
+                )
+            )
+        return found
+
+    async def _start_autotag(
+        self, *, model_type, existing, options, keep_in_memory, title, owner_kind
+    ):
+        """Register a Tag output images job: ``(job, None)`` or ``(None, Refusal)``.
+
+        ``options`` are already validated (``validate_options``). The checks
+        run in this order: 409 ``model-unavailable``; 507
+        ``insufficient-space`` (only when the safety backup is on); 409
+        ``busy`` (another records job); 409 ``model-busy``. No await follows
+        the busy check. The gate is taken before the job registers and
+        released when the task ends, also before its runner ever starts.
+        """
+        from ..autotag import MODELS, get_autotag_service
+
+        backup_on = self._safety_backup_policy() == "on"
+        status = await self._run_in_executor(get_autotag_service().get_models_status)
+        _disk, short, _size = await self._run_in_executor(
+            functools.partial(
+                disk_plan, self.db.model.db_path, backup=backup_on, vacuum=False
+            )
+        )
+        label = MODELS[model_type]["label"]
+        if not (status.get(model_type) or {}).get("downloaded"):
+            message = (
+                f"{label} is not downloaded. Download it in System › Auto-tagging."
+            )
+            return None, _refusal(409, "model-unavailable", message)
+        if backup_on and short is not None:
+            return None, _refusal(507, "insufficient-space", short_space_message(short))
+        busy = self._jobs.blocker(AUTOTAG_BATCH_JOB_KIND, admission="records")
+        if busy is not None:
+            return None, _busy_refusal(JobBusy(busy))
+        owner = model_gate.new_owner(owner_kind)
+        if not model_gate.try_acquire(owner):
+            response = model_busy_response()
+            return None, Refusal(409, "model-busy", MODEL_BUSY_ERROR, response)
+        run = AutotagRun(
+            model_type, existing, options, keep_in_memory, backup_on, owner
+        )
+        try:
+            job = self._jobs.start(
+                AUTOTAG_BATCH_JOB_KIND,
+                title,
+                admission="records",
+                cancellable=True,
+                scope={"model_type": model_type, "existing": existing, "label": label},
+                groups=AUTOTAG_GROUP_NAMES,
+                runner=functools.partial(self._run_autotag_batch, run),
+            )
+        except BaseException as refused:
+            model_gate.release(owner)
+            if isinstance(refused, JobBusy):
+                return None, _busy_refusal(refused)
+            raise
+        job.task.add_done_callback(lambda _task: model_gate.release(owner))
+        return job, None
+
+    async def _run_autotag_batch(self, run: AutotagRun, job) -> None:
+        """The ``autotag`` job: backup, model, listing, pre-pass, per-image loop.
+
+        ``job.cancelled`` is checked between phases (and per pre-pass chunk
+        and per image). Each phase publishes ``{"type": "phase", "phase"}``.
+        With ``keep_in_memory`` false the model is unloaded under the gate.
+        The job ends only after that cleanup and the gate release, so a job
+        that reads as ended never still holds the gate.
+        """
+        state = "failed"
+        try:
+            state = await self._autotag_batch_phases(run, job)
+        except Exception:
+            self.logger.exception("Tag output images failed")
+            job.update(status_line=_INTERNAL_ERROR)
+            job.log_line(f"Tagging failed · {_INTERNAL_ERROR}")
+        finally:
+            try:
+                if not run.keep_in_memory:
+                    await self._unload_batch_model(run.owner)
+                if run.backup_on:
+                    await self._prune_backup_pool(job, self.db)
+            finally:
+                model_gate.release(run.owner)
+                job.publish({"type": state, "progress": job.progress})
+                job.finish(state)
+
+    async def _unload_batch_model(self, owner) -> None:
+        from ..autotag import get_autotag_service
+
+        service = get_autotag_service()
+        try:
+            if service.is_model_loaded():
+                await model_gate.run(owner, service.unload_model)
+        except Exception:
+            self.logger.exception("The tagging model could not be unloaded")
+
+    async def _autotag_batch_phases(self, run: AutotagRun, job) -> str:
+        """Run the phases; the job's end state (the caller ends the job)."""
+        job.publish({"type": "phase", "phase": "backup"})
+        ok, _backup = await self._safety_backup_step(job, self.db, run.backup_on)
+        if not ok:
+            return "failed"
+        if job.cancelled:
+            return _batch_cancelled(job)
+        job.publish({"type": "phase", "phase": "model"})
+        job.update(status_line="Loading the tagging model")
+        spec = _Spec("auto", (), model_type=run.model_type, options=run.options)
+        service = await self._prepare_tagging_model(job, spec, run.owner)
+        if service is None:
+            return "failed"
+        if job.cancelled:
+            return _batch_cancelled(job)
+        job.publish({"type": "phase", "phase": "listing"})
+        job.update(status_line=LISTING_STATUS)
+        epoch = await self._run_in_executor(self.db.get_execution_epoch)
+        try:
+            targets = await self._autotag_targets()
+        except Exception:
+            self.logger.exception("Tag output images could not list the outputs")
+            job.update(status_line=LISTING_FAILED)
+            job.log_line(f"! {LISTING_FAILED}")
+            return "failed"
+        total = len(targets)
+        job.scope["images"] = total
+        job.update(total=total)
+        policy = (
+            "skip images already auto-tagged" if run.existing == "skip" else "merge"
+        )
+        job.log_line(
+            f"Tagging started · {job.scope.get('label') or run.model_type} · "
+            f"{_plural(total, 'image')} · {policy}"
+        )
+        if job.cancelled:
+            return _batch_cancelled(job)
+        remaining = await self._autotag_prepass(job, targets, run.existing == "skip")
+        if remaining is None:
+            return _batch_cancelled(job)
+        done = total - len(remaining)
+        spec = dataclasses.replace(
+            spec, targets=tuple(item.target for item in remaining)
+        )
+        loop_run = _Run(job, spec, epoch, run.owner, service)
+        if not await self._tag_each_file(loop_run, done_before=done):
+            job.update(status_line=STORAGE_RESTORED)
+            job.log_line(f"Tagging stopped · {STORAGE_RESTORED}")
+            return "failed"
+        if job.cancelled:
+            return _batch_cancelled(job)
+        finished = f"Tagged {_plural(job.counters.get('tagged', 0), 'image')}"
+        job.update(status_line=finished, progress=100)
+        job.log_line(finished)
+        return "finished"
+
+    async def _autotag_prepass(self, job, targets, skip_marked: bool):
+        """The targets left for the model, or None when cancelled meanwhile.
+
+        Opens and hashes nothing: one stat per file and one indexed read per
+        chunk. Skips are counted with ``record_counted`` (exact counters, rows
+        up to the cap, no log line each).
+        """
+        max_file = self._capture_store().max_file
+        remaining, skipped = [], 0
+        total = len(targets)
+        for start in range(0, total, PREPASS_CHUNK):
+            if job.cancelled:
+                return None
+            chunk = targets[start : start + PREPASS_CHUNK]
+            left, skips = await self._run_in_executor(
+                _prepass_chunk, self.db, chunk, skip_marked, max_file
+            )
+            remaining.extend(left)
+            if skips:
+                job.record_counted(
+                    "skipped",
+                    len(skips),
+                    [
+                        {
+                            "path": item.target[2],
+                            "root": item.label,
+                            "root_index": item.target[0],
+                            "detail": detail,
+                        }
+                        for item, detail in skips
+                    ],
+                )
+                skipped += len(skips)
+                job.update(processed=skipped, progress=skipped * 100 // total)
+                job.publish({"type": "progress", "progress": job.progress})
+        if skipped:
+            job.log_line(f"Skipped {_plural(skipped, 'image')} before tagging")
+        return remaining
+
+    async def _resolve_job_filter(self, spec: _Spec):
+        """``spec`` with its filter resolved into targets, or ``(None, error)``.
+
+        The listing's own identities, in its order, kept only where a target
+        could have named them (a media path the job can tag).
+        """
+        cap = MAX_FILTER_TARGETS
+        try:
+            selection = await self.resolve_listing_filter(spec.filter, cap)
+        except ListingSourceChanged:
+            return None, _coded("source-changed")
+        except ValueError as exc:
+            return None, bad_request(str(exc))
+        except Exception:
+            # Never echo it: it can carry SQL or database text.
+            self.logger.error("A tagging filter could not be resolved", exc_info=True)
+            return None, _error(500, "listing-failed", FILTER_LISTING_FAILED)
+        if selection.truncated:
+            return None, _error(400, "too-many-images", TOO_MANY_IMAGES.format(cap=cap))
+        targets = []
+        for index, scope, relative in selection.targets:
+            target, error = _target(
+                {"root_index": index, "root_scope": scope, "path": relative}
+            )
+            if error is None:
+                targets.append(target)
+        if not targets:
+            return None, _error(400, "no-images", NO_IMAGES)
+        return dataclasses.replace(spec, targets=tuple(targets)), None
+
    # -- runner ----------------------------------------------------------------

    def _job_roots(self, targets) -> dict:
@@ -331,28 +738,39 @@ class ImageTagJobsMixin:
                    job.finish("failed")
                    return
            if not await self._tag_each_file(run):
+                job.update(status_line=STORAGE_RESTORED)
                job.log_line(f"{verb} stopped · {STORAGE_RESTORED}")
                job.finish("failed")
                return
            state = "cancelled" if job.cancelled else "finished"
-            job.log_line(f"{verb} {state} · {_plural(job.processed, 'file')} processed")
+            # An ended job never keeps the loop's "about X min left" (#379).
+            ended = f"{verb} {state} · {_plural(job.processed, 'file')} processed"
+            job.update(status_line=ended)
+            job.log_line(ended)
            job.publish({"type": state, "progress": job.progress})
            job.finish(state)
        finally:
            if owner is not None:
                model_gate.release(owner)

-    async def _tag_each_file(self, run: _Run) -> bool:
-        """Tag the targets in order; False when the job had to stop."""
-        job, total = run.job, len(run.spec.targets)
+    async def _tag_each_file(self, run: _Run, *, done_before: int = 0) -> bool:
+        """Tag the targets in order; False when the job had to stop.
+
+        ``done_before`` files were already counted (the batch's pre-pass): file
+        n of this loop is "file done_before + n" of the job, and the time left
+        uses this loop's rate only.
+        """
+        job, count = run.job, len(run.spec.targets)
+        total = done_before + count
        run.roots = await self._run_in_executor(self._job_roots, run.spec.targets)
        started = _monotonic()
        for number, target in enumerate(run.spec.targets, 1):
            if job.cancelled:
                break
            # The scan's estimate (D56), with each finished file as one batch.
-            left = _time_left(number - 1, total, number - 1, _monotonic() - started)
-            job.update(status_line=f"Processing file {number:,} of {total:,}{left}")
+            left = _time_left(number - 1, count, number - 1, _monotonic() - started)
+            shown = done_before + number
+            job.update(status_line=f"Processing file {shown:,} of {total:,}{left}")
            job.publish({"type": "progress", "progress": job.progress})
            stopped = False
            try:
@@ -363,7 +781,7 @@ class ImageTagJobsMixin:
                self.logger.exception("Image tagging failed for one file")
                group, detail = "errors", SAVE_FAILED
            self._record_tag_outcome(run, target, group, detail)
-            job.update(processed=number, progress=number * 100 // total)
+            job.update(processed=shown, progress=shown * 100 // total)
            if stopped:
                return False
        return True
@@ -439,9 +857,17 @@ class ImageTagJobsMixin:
            store.release(capture.token)

    async def _auto_tag_capture(self, run: _Run, store, capture, root, relative):
-        """Suggest on the capture, then union only onto the same current bytes."""
+        """Suggest on the capture, then union only onto the same current bytes.
+
+        The bytes are marked auto-tagged with the union, also when the model
+        returned no names; captured bytes no model can read are marked too
+        (and stay skipped), so a "Skip already tagged" run passes them by.
+        """
        if not capture.inferable:
-            return "skipped", NOT_A_STILL
+            group, detail = await self._union_image_tags(
+                capture, [], run.epoch, mark_autotagged=True
+            )
+            return (group, detail) if group == "errors" else ("skipped", NOT_A_STILL)
        if store.acquire(capture.token) is None:
            raise _JobStopped  # every capture was invalidated (restore)
        spec = run.spec
@@ -467,21 +893,30 @@ class ImageTagJobsMixin:
        if facts.locator != capture.locator or facts.sha256 != capture.sha256:
            return "skipped", FILE_CHANGED
        names = [str(name) for name, _score in pairs]
-        if not names:
-            return "unchanged", NO_NEW_TAGS
-        return await self._union_image_tags(facts, names, run.epoch)
+        return await self._union_image_tags(
+            facts, names, run.epoch, mark_autotagged=True
+        )

-    async def _union_image_tags(self, facts, tags: list, epoch: str):
-        """``add_image_tags`` on the verified bytes, as a (group, detail)."""
+    async def _union_image_tags(
+        self, facts, tags: list, epoch: str, *, mark_autotagged: bool = False
+    ):
+        """``add_image_tags`` on the verified bytes, as a (group, detail).
+
+        ``mark_autotagged`` (a model's result) marks the bytes auto-tagged in
+        the same write; then ``tags`` may be empty.
+        """
        try:
            receipt = await self._run_in_executor(
-                self.db.add_image_tags,
-                locator=facts.locator,
-                sha256=facts.sha256,
-                size=facts.size,
-                mtime_ns=facts.mtime_ns,
-                expected_epoch=epoch,
-                tags=tags,
+                functools.partial(
+                    self.db.add_image_tags,
+                    locator=facts.locator,
+                    sha256=facts.sha256,
+                    size=facts.size,
+                    mtime_ns=facts.mtime_ns,
+                    expected_epoch=epoch,
+                    tags=tags,
+                    mark_autotagged=mark_autotagged,
+                )
            )
        except LibraryCommandError as exc:
            if exc.code == "storage-changed":
@@ -3,7 +3,7 @@
 import os
 import stat
 from pathlib import Path
-from typing import Callable
+from typing import Any, Callable

 try:
    from ...utils.prompt_inspector import (
@@ -100,18 +100,23 @@ def inspect_current_file(
    saved: dict | None,
    library: dict,
    image_tags: Callable[[int, int], dict] | None = None,
+    recorded: Callable[[Path], Any] | None = None,
 ) -> dict:
    """Current-file evidence read between two equal stats of *path*.

    *image_tags*, when given, is called once with that stable
    ``(st_size, st_mtime_ns)`` and its facet is returned as ``image_tags``
    (spec amendment S1: tags of a byte record verified at exactly that stat).
+    *recorded*, when given, is asked within the same stat window for what
+    recorded run history knows about *path* (``RecordedOutput`` or None: the
+    save node that wrote it and the texts PromptManager recorded, #386).
    """
    before = _current_file_facts(path)
    try:
        inspection = read_inspection_file(path)
    except MetadataReadError:
        inspection = None
+    run = recorded(path) if recorded is not None and inspection is not None else None
    after = _current_file_facts(path)
    fields = ("st_dev", "st_ino", "st_mode", "st_size", "st_mtime_ns", "st_ctime_ns")
    if any(getattr(before, key) != getattr(after, key) for key in fields):
@@ -129,8 +134,15 @@ def inspect_current_file(
        profile = (
            PREVIEW_INSPECTION_PROFILE if _in_host_temp(path) else INSPECTION_PROFILE
        )
+        # The file name anchors on the saver that wrote it (#381); recorded run
+        # history names that saver when the file alone cannot (#386).
        evidence = inspect_prompt_evidence(
-            inspection.metadata, role_saved, profile=profile
+            inspection.metadata,
+            role_saved,
+            profile=profile,
+            file_name=path.name,
+            recorded_saver_id=run.saver_id if run is not None else None,
+            recorded_texts=run.texts if run is not None else None,
        )
    return {
        "file": {
@@ -130,6 +130,14 @@ class JobRoutesMixin:
        async def start_image_tag_job_route(request):
            return await self.start_image_tag_job(request)

+        @routes.post("/prompt_manager/jobs/model-download")
+        async def start_model_download_job_route(request):
+            return await self.start_model_download_job(request)
+
+        @routes.post("/prompt_manager/jobs/autotag")
+        async def start_autotag_job_route(request):
+            return await self.start_autotag_job(request)
+
        @routes.post("/prompt_manager/jobs/thumbnails")
        async def start_thumbnail_job_route(request):
            return await self.start_thumbnail_job(request)
@@ -28,6 +28,15 @@ ones. One job of a kind runs at a time, and each job has an admission class
 A short legacy-page operation takes a ``hold``: a running, non-cancellable
 job that lasts as long as the request, so the Activity page lists it and a
 workspace job is refused while it runs (and the other way round).
+
+Short request-scoped work that reads or writes the library beside any
+ordinary job (a Needs review decision, a maintenance or restore preview)
+takes a ``lease`` instead: it is not listed (so quick requests never push
+real jobs out of the finished history, and two of them never refuse each
+other), but it is refused while an ``exclusive`` job runs, and an
+``exclusive`` job that replaces the database (a restore) awaits
+``drain_leases`` before it switches the file, so no lease's connection is
+open across the switch (#249 S8).
 """

 import asyncio
@@ -38,6 +47,11 @@ import time
 import uuid
 from pathlib import PurePosixPath, PureWindowsPath

+try:
+    from ...utils import exit_signal
+except ImportError:  # tests import the package top-level
+    from utils import exit_signal
+
 logger = logging.getLogger(__name__)
 # Start and finish order: wall-clock times can tie (coarse Windows clocks).
 _sequence = itertools.count()
@@ -48,6 +62,9 @@ MAX_OUTCOME_ROWS = 200  # rows listed per outcome group; counters stay exact
 MAX_LOG_LINES = 2000
 LOG_CAP_LINE = "[Log capped at 2,000 lines]"
 MAX_FINISHED_JOBS = 20  # finished jobs this session keeps
+# The longest an exclusive job waits for running leases to end (a ceiling a
+# hung request reaches, not a pacing timer: leases end with their request).
+LEASE_DRAIN_SECONDS = 60

 # The metadata scan's outcome groups, in counter-tile order of the spec's
 # mapping, and the per-file scan status each group collects. Files without
@@ -75,6 +92,8 @@ SCAN_GROUPS = {
 # Record-changing: it writes image tag sets and new vocabulary names.
 IMAGE_TAG_JOB_KIND = "image-tags"
 IMAGE_TAG_GROUP_NAMES = ("tagged", "unchanged", "skipped", "errors")
+# Tag output images (#328) counts its prompts the same way.
+AUTOTAG_GROUP_NAMES = IMAGE_TAG_GROUP_NAMES

 # Thumbnail generation (#249 System S5): previews written, already fresh, failed.
 THUMBNAIL_GROUP_NAMES = ("generated", "skipped", "errors")
@@ -97,6 +116,8 @@ DUPLICATE_CLEANUP_JOB_KIND = "duplicate_cleanup"
 THUMBNAILS_JOB_KIND = "thumbnails"
 LORA_IMPORT_JOB_KIND = "lora_import"
 AUTOTAG_BATCH_JOB_KIND = "autotag"
+# A tagging model download (#328): read admission, not cancellable.
+MODEL_DOWNLOAD_JOB_KIND = "model_download"
 # Duplicate image files (#249 System S6, py/api/duplicate_files.py): the
 # find is a cancellable ``read`` job; the reviewed removal is ``records``.
 DUPLICATES_JOB_KIND = "duplicates"
@@ -179,11 +200,21 @@ class Job:
        self.counters = dict.fromkeys(groups, 0)
        self.outcomes = {group: [] for group in groups}
        self.log = []
-        self.cancelled = False
+        self._cancel_requested = False
        self.last_event = None
        self.task = None
        self._subscribers = set()

+    @property
+    def cancelled(self):
+        """Cancel was requested, or the interpreter is exiting (#376): every
+        check a job already makes between files also stops it at exit."""
+        return self._cancel_requested or exit_signal.requested()
+
+    @cancelled.setter
+    def cancelled(self, value):
+        self._cancel_requested = bool(value)
+
    @property
    def record_changing(self):
        return self.admission == "records"
@@ -403,6 +434,74 @@ class JobRegistry:
    def __init__(self, logger_=None):
        self._logger = logger_ or logger
        self._jobs = {}
+        self._leases = {}  # title -> running count
+        self._drain_waiters = []
+
+    # ── leases ────────────────────────────────────────────────────────
+
+    def lease(self, title):
+        """An async context manager for short request-scoped library work.
+
+        Entering raises JobBusy, naming the job, while an ``exclusive`` job
+        runs; otherwise the lease is counted until the block exits. Leases
+        are never listed and never refuse one another or any job.
+        """
+        return _Lease(self, title)
+
+    def lease_blocker(self):
+        """The running ``exclusive`` job a new lease is refused for, or None."""
+        for job in self.running():
+            if job.admission == "exclusive":
+                return job
+        return None
+
+    @property
+    def leases(self):
+        """Running leases by title (a copy)."""
+        return dict(self._leases)
+
+    def _take_lease(self, title):
+        blocker = self.lease_blocker()
+        if blocker is not None:
+            raise JobBusy(blocker)
+        self._leases[title] = self._leases.get(title, 0) + 1
+
+    def _release_lease(self, title):
+        count = self._leases.get(title, 0) - 1
+        if count > 0:
+            self._leases[title] = count
+        else:
+            self._leases.pop(title, None)
+        if not self._leases:
+            waiters, self._drain_waiters = self._drain_waiters, []
+            for waiter in waiters:
+                if not waiter.done():
+                    waiter.set_result(True)
+
+    async def drain_leases(self, timeout=None):
+        """Wait until no lease runs; False when ``timeout`` ended the wait.
+
+        For an ``exclusive`` job about to switch the database: once it runs
+        no new lease is admitted, so the count only goes down.
+        """
+        if not self._leases:
+            return True
+        waiter = asyncio.get_running_loop().create_future()
+        self._drain_waiters.append(waiter)
+        try:
+            await asyncio.wait_for(
+                asyncio.shield(waiter),
+                LEASE_DRAIN_SECONDS if timeout is None else timeout,
+            )
+            return True
+        except asyncio.TimeoutError:
+            self._logger.warning(
+                "Still running after the wait: " + ", ".join(sorted(self._leases))
+            )
+            return False
+        finally:
+            if waiter in self._drain_waiters:
+                self._drain_waiters.remove(waiter)

    def start(
        self,
@@ -565,3 +664,23 @@ class _Hold:
        if self._job.running:
            self._job.finish("finished" if exc_type is None else "failed")
        return False
+
+
+class _Lease:
+    """The async context manager ``JobRegistry.lease`` returns."""
+
+    def __init__(self, registry, title):
+        self._registry = registry
+        self._title = title
+        self._held = False
+
+    async def __aenter__(self):
+        self._registry._take_lease(self._title)
+        self._held = True
+        return self
+
+    async def __aexit__(self, exc_type, exc, tb):
+        if self._held:
+            self._held = False
+            self._registry._release_lease(self._title)
+        return False
@@ -234,9 +234,22 @@ class LibraryRoutesMixin:
        )

    def _library_media(
-        self, records: list[dict], roots: list[Path], *, linked: bool = True
+        self,
+        records: list[dict],
+        roots: list[Path],
+        *,
+        linked: bool = True,
+        outputs: int | None = None,
    ) -> list[dict]:
+        """Workspace descriptors for a prompt's linked media under ``roots``.
+
+        Roots from index ``outputs`` on are linked-only (LoRA media, #355):
+        their media keeps its rooted identity, but gets no preview file (the
+        card loads the original; a video shows its label), no favorite star
+        and is marked ``linked_only`` (no Tag action).
+        """
        page = []
+        linked_only = set()
        for record in records:
            try:
                raw_path = Path(record["image_path"])
@@ -250,10 +263,25 @@ class LibraryRoutesMixin:
                    canonical_root = _canonical(root)
                    if path.is_relative_to(canonical_root):
                        page.append((path, 0, canonical_root, index))
+                        if outputs is not None and index >= outputs:
+                            relative = path.relative_to(canonical_root).as_posix()
+                            linked_only.add((index, relative))
                        break
            except (OSError, ValueError, RuntimeError):
                continue
-        return self._format_workspace_page(page, linked=linked)
+        images = self._format_workspace_page(page, linked=linked)
+        for image in images:
+            if (image["root_index"], image["path"]) in linked_only:
+                image["thumbnail_url"] = None
+                image["thumbnail_ready"] = False
+                image["linked_only"] = True
+                image.pop("favorite", None)
+        return images
+
+    def _library_roots(self) -> tuple[list[Path], int]:
+        """``(roots, number of output roots)`` for a prompt's linked media."""
+        outputs = list(self._get_all_output_dirs())
+        return self._media_roots(outputs), len(outputs)

    @pair_response
    async def get_library_options(self, request: web.Request) -> web.Response:
@@ -294,13 +322,13 @@ class LibraryRoutesMixin:
            return result, records

        result, records = await self._run_in_executor(read)
-        roots = list(self._get_all_output_dirs())

        def previews() -> None:
+            roots, outputs = self._library_roots()
            for parent in result["items"]:
                # Previews belong to their parent; a per-parent link read is N+1.
                parent["previews"] = self._library_media(
-                    records[parent["id"]], roots, linked=False
+                    records[parent["id"]], roots, linked=False, outputs=outputs
                )

        await self._run_in_executor(previews)
@@ -342,9 +370,9 @@ class LibraryRoutesMixin:
        result, records = await self._run_in_executor(read)
        if result is None:
            return _missing()
-        roots = list(self._get_all_output_dirs())
+        roots, outputs = await self._run_in_executor(self._library_roots)
        result["positive"]["previews"] = await self._run_in_executor(
-            self._library_media, records, roots
+            lambda: self._library_media(records, roots, outputs=outputs)
        )
        return web.json_response({"success": True, **result})

@@ -358,7 +386,7 @@ class LibraryRoutesMixin:
        archive = _archive_scope(request)
        limit = _page_limit(request)
        cursor = request.query.get("cursor")
-        roots = list(self._get_all_output_dirs())
+        roots, outputs = await self._run_in_executor(self._library_roots)
        canonical_roots = [str(_canonical(root)) for root in roots]

        def read() -> dict | None:
@@ -391,7 +419,7 @@ class LibraryRoutesMixin:
        if result is None:
            return _missing()
        result["images"] = await self._run_in_executor(
-            self._library_media, result["images"], roots
+            lambda: self._library_media(result["images"], roots, outputs=outputs)
        )
        return web.json_response({"success": True, **result})

@@ -0,0 +1,420 @@
+"""Library location routes (#249 S6b): where the library lives, Move, Keep.
+
+- ``GET /prompt_manager/system/library`` → ``{success, location}``: the
+  database's path (relative to ComfyUI, as the statistics show it), why it is
+  there (``source``: ``default``, ``environment``, ``config`` or
+  ``node_folder``), whether it can move and where to (``target``), the
+  "Keep it here" choice (``keep``), whether to offer the move (``offer``:
+  movable and not kept), a ``problem`` code and the database's size. The
+  System Overview carries the same object as ``location``.
+- ``POST /prompt_manager/system/library/move`` → 202 ``{job}``: the
+  ``library_move`` job, ``exclusive`` (it runs alone and every other job,
+  legacy-page operations included, is refused while it runs), not
+  cancellable. It copies, verifies and switches the live library
+  (``database/library_move.py``) and ends with one truthful line; a failure
+  leaves the library in the node folder, unchanged. Refused before any job
+  starts: 400 ``not-movable``/``same-folder``/``target-invalid``, 409
+  ``target-has-library``/``target-conflict``/``busy``, 507
+  ``insufficient-space``.
+- ``POST /prompt_manager/system/library/keep {keep: bool}`` persists
+  ``library.keep_in_node_folder`` through the config store and answers the
+  new location.
+
+Errors are ``{success:false, code, error}`` and never name a path.
+"""
+
+import asyncio
+import functools
+import os
+
+from aiohttp import web
+
+from .job_routes import busy_response
+from .jobs import JobBusy
+
+try:
+    from ...database import library_move as lm
+    from ...database.operations import resolve_library_location
+    from ...utils import library_location as ll
+except ImportError:
+    from database import library_move as lm
+    from database.operations import resolve_library_location
+    from utils import library_location as ll
+
+LIBRARY_MOVE_JOB_KIND = "library_move"
+LIBRARY_MOVE_TITLE = "Move library"
+LIBRARY_MOVE_GROUPS = ("files", "errors")
+KEEP_BODY_MAX = 1024
+
+_REFUSAL_STATUS = {
+    "not-movable": 400,
+    "same-folder": 400,
+    "target-invalid": 400,
+    "target-has-library": 409,
+    "target-conflict": 409,
+    "insufficient-space": 507,
+}
+STILL_THERE = "The library is still in the node folder, unchanged."
+NOT_MOVED = "The library was not moved."
+OLD_LEFT = {
+    "old-in-use": (
+        "The old database is still open elsewhere, so it was left in the node "
+        "folder; it is no longer used."
+    ),
+    "old-locked": (
+        "The old files could not be renamed, so they were left in the node "
+        "folder; they are no longer used."
+    ),
+}
+
+
+def _failure(message, status, code):
+    return web.json_response(
+        {"success": False, "code": code, "error": message}, status=status
+    )
+
+
+def _plural(count, one, many=None):
+    return f"{count:,} {one if count == 1 else (many or one + 's')}"
+
+
+def _same_file(first, second):
+    try:
+        return os.path.samefile(first, second)
+    except OSError:
+        return os.path.normcase(os.path.realpath(first)) == os.path.normcase(
+            os.path.realpath(second)
+        )
+
+
+CUSTOM_NODES = "custom_nodes"
+
+
+def _inside(path, folder):
+    """``path`` relative to ``folder`` by text (normalised spellings), or None."""
+    child, parent = os.path.normcase(path), os.path.normcase(folder)
+    if child == parent:
+        return ""
+    prefix = parent.rstrip(os.sep) + os.sep
+    return path[len(prefix) :] if child.startswith(prefix) else None
+
+
+def _comfyui_custom_nodes():
+    """ComfyUI's custom_nodes folders as it lists them (unresolved), or []."""
+    try:
+        from ..config import _import_folder_paths
+
+        getter = getattr(_import_folder_paths(), "get_folder_paths", None)
+        folders = getter(CUSTOM_NODES) if getter else []
+        return [folder for folder in folders or [] if isinstance(folder, str)]
+    except Exception:
+        return []
+
+
+def node_folder_public_path(path, extension_root, custom_nodes):
+    """``custom_nodes/<node folder>/...`` for a path in the node folder, or None.
+
+    The node folder is matched at its own unresolved place in a custom_nodes
+    folder (one of ``custom_nodes``, or the parent of ``extension_root`` when
+    that is named custom_nodes), so a node folder that is a symlink to a
+    checkout outside ComfyUI still reads relative to ComfyUI. ``path`` may be
+    spelled through the link or resolved. Never absolute, never ``..``:
+    anything else is None and the caller uses ``_public_path``.
+    """
+    if not path or not extension_root:
+        return None
+    try:
+        root = os.path.normpath(os.path.abspath(extension_root))
+        name = os.path.basename(root)
+        folders = [os.path.normpath(os.path.abspath(f)) for f in custom_nodes]
+        parent = os.path.dirname(root)
+        if os.path.normcase(os.path.basename(parent)) == CUSTOM_NODES:
+            folders.append(parent)
+        spellings = [os.path.normpath(os.path.abspath(path))]
+        spellings.append(os.path.realpath(spellings[0]))
+    except (OSError, ValueError, TypeError):
+        return None
+    for folder in folders:
+        node = os.path.join(folder, name)
+        for spelling, node_spelling in zip(spellings, (node, os.path.realpath(node))):
+            rest = _inside(spelling, node_spelling)
+            if rest is None:
+                continue
+            parts = [os.path.basename(folder), name] + (
+                rest.split(os.sep) if rest else []
+            )
+            if all(part and part not in (".", "..") for part in parts):
+                return "/".join(parts)
+    return None
+
+
+class LibraryLocationRoutesMixin:
+    """Mixin for the /prompt_manager/system/library endpoints."""
+
+    # Replaced in tests with a resolver over a temp tree.
+    _library_resolver = staticmethod(resolve_library_location)
+
+    def _register_library_location_routes(self, routes):
+        @routes.get("/prompt_manager/system/library")
+        async def library_location_route(request):
+            return await self.get_library_location(request)
+
+        @routes.post("/prompt_manager/system/library/move")
+        async def library_move_route(request):
+            return await self.start_library_move(request)
+
+        @routes.post("/prompt_manager/system/library/keep")
+        async def library_keep_route(request):
+            return await self.keep_library(request)
+
+    # ── location ──────────────────────────────────────────────────────
+
+    def _library_public_path(self, path):
+        """The library's path for display: through the node folder's place in
+        custom_nodes when it is there (a symlinked node folder included), else
+        ``_public_path``. Only the library location uses this; sources and
+        jobs keep ``_public_path``, which their requests round-trip."""
+        shown = node_folder_public_path(
+            path, self._extension_root, _comfyui_custom_nodes()
+        )
+        return shown or self._public_path(path)
+
+    def _live_location(self):
+        """The resolved location, unless the live database is another file.
+
+        A database the API was handed (tests, the browser fixture server) or
+        one the resolver no longer names is reported as configured and is
+        never moved.
+        """
+        location = self._library_resolver()
+        live = self.db.model.db_path
+        if _same_file(location.db_path, live):
+            return location
+        return ll.LibraryLocation(
+            ll.SOURCE_CONFIG,
+            live,
+            location.config_path,
+            os.path.dirname(live),
+            config_explicit=location.config_explicit,
+        )
+
+    def _location_payload(self, location):
+        """The public view of ``location`` (blocking: stats the database)."""
+        from ..config import PromptManagerConfig
+
+        keep = bool(PromptManagerConfig.KEEP_LIBRARY_IN_NODE_FOLDER)
+        size = 0
+        try:
+            size = os.path.getsize(location.db_path)
+        except OSError:
+            pass
+        return {
+            "path": self._library_public_path(location.db_path),
+            # Where Move library would put it, and whether config.json goes too.
+            "target_source": location.target_source if location.movable else None,
+            "config_moves": location.movable and not location.config_explicit,
+            "source": location.source,
+            "movable": location.movable,
+            "keep": keep,
+            "offer": location.movable and not keep,
+            "target": (
+                self._library_public_path(location.target_dir)
+                if location.movable
+                else None
+            ),
+            "problem": location.problem or self._node_folder_risk(location),
+            "size_bytes": size,
+        }
+
+    # The node folder (tests point it at a temp tree).
+    _extension_root = ll.EXTENSION_ROOT
+
+    def _node_folder_risk(self, location):
+        """``inside-node-folder`` for a library that stays in the node folder.
+
+        A configured database path, or a config.json the resolver still reads
+        from the node folder, is deleted with the node by a reinstall, and
+        it is never offered a move.
+        """
+        if location.source == ll.SOURCE_NODE_FOLDER:
+            return None
+        paths = [location.db_path] + (
+            [] if location.config_explicit else [location.config_path]
+        )
+        root = self._extension_root
+        for path in paths:
+            parent = os.path.dirname(os.path.abspath(path))
+            if ll.same_folder(parent, root) or os.path.normcase(
+                os.path.realpath(parent)
+            ).startswith(os.path.normcase(os.path.realpath(root)) + os.sep):
+                return "inside-node-folder"
+        return None
+
+    def _library_payload(self):
+        return self._location_payload(self._live_location())
+
+    async def get_library_location(self, request):
+        try:
+            payload = await self._run_in_executor(self._library_payload)
+        except Exception:
+            self.logger.exception("Library location could not be read")
+            return _failure(
+                "The library location could not be read.", 500, "location-failed"
+            )
+        return web.json_response(
+            {"success": True, "location": payload},
+            headers={"Cache-Control": "no-store"},
+        )
+
+    # ── move ──────────────────────────────────────────────────────────
+
+    def _plan_library_move(self):
+        """The checked plan (blocking); raises MoveFailed."""
+        plan = lm.plan_move(self._live_location())
+        if lm.space_problem(plan) is not None:
+            raise lm.MoveFailed("insufficient-space")
+        return plan
+
+    async def start_library_move(self, request):
+        blocker = self._jobs.blocker(LIBRARY_MOVE_JOB_KIND, admission="exclusive")
+        if blocker is not None:
+            return busy_response(JobBusy(blocker))
+        try:
+            await self._run_in_executor(self._plan_library_move)
+        except lm.MoveFailed as refused:
+            status = _REFUSAL_STATUS.get(refused.code, 400)
+            return _failure(refused.message, status, refused.code)
+        except Exception:
+            self.logger.exception("Move library could not be planned")
+            return _failure(NOT_MOVED, 500, "move-failed")
+        try:
+            job = self._jobs.start(
+                LIBRARY_MOVE_JOB_KIND,
+                LIBRARY_MOVE_TITLE,
+                admission="exclusive",
+                cancellable=False,
+                scope={},
+                groups=LIBRARY_MOVE_GROUPS,
+                runner=self._run_library_move,
+            )
+        except JobBusy as busy:
+            return busy_response(busy)
+        return web.json_response({"success": True, "job": job.summary()}, status=202)
+
+    def _after_library_switch(self):
+        """Forget what described the old file (best effort, after the switch).
+
+        Plans, the health report and the history read fence named the old
+        file; the fence is closed before it is dropped.
+        """
+        self._database_replaced()
+        fence, self._history_read_fence = self._history_read_fence, None
+        if fence is not None:
+            fence.close()
+
+    def finish_interrupted_library_move(self):
+        """Startup: rename old files a crash left after a move (blocking)."""
+        try:
+            location = self._library_resolver()
+            if _same_file(location.db_path, self.db.model.db_path):
+                return lm.finish_interrupted_move(location)
+        except Exception:
+            self.logger.exception("Could not finish an interrupted library move")
+        return []
+
+    async def _run_library_move(self, job):
+        from ..config_store import _COMMIT_LOCK
+
+        loop = asyncio.get_running_loop()
+
+        def progress(line):
+            def show():
+                job.log_line(line)
+                job.update(status_line=line)
+
+            loop.call_soon_threadsafe(show)
+
+        job.update(status_line="Checking the new folder")
+        try:
+            plan = await self._run_in_executor(self._plan_library_move)
+            target = self._library_public_path(plan.target_dir)
+            job.log_line(f"Moving the library to {target}")
+            result = await self._run_in_executor(
+                functools.partial(
+                    lm.move_library,
+                    plan,
+                    after_switch=self._after_library_switch,
+                    config_lock=_COMMIT_LOCK,
+                    progress=progress,
+                )
+            )
+        except lm.MoveFailed as failed:
+            self.logger.error(f"Move library failed: {failed.code}")
+            return self._fail_library_move(
+                job, failed.code, f"{failed.message} {STILL_THERE}"
+            )
+        except Exception:
+            self.logger.exception("Move library failed")
+            return self._fail_library_move(job, None, f"{NOT_MOVED} {STILL_THERE}")
+        await asyncio.sleep(0)  # the progress lines come first
+        job.record_counted("files", len(result.files))
+        line = (
+            f"Moved the library to {target}: "
+            f"{_plural(result.counts.get('prompts', 0), 'prompt')} and "
+            f"{_plural(result.counts.get('generated_images', 0), 'image')} verified"
+        )
+        if result.retire_problem:
+            line += ". " + OLD_LEFT.get(result.retire_problem, OLD_LEFT["old-locked"])
+        elif result.renamed:
+            line += (
+                f". The old files were renamed {', '.join(result.renamed)}; "
+                "nothing was deleted"
+            )
+        line += ". Logs move at the next restart."
+        job.log_line(line)
+        job.update(progress=100, status_line=line)
+
+    @staticmethod
+    def _fail_library_move(job, code, message):
+        from .maintenance import _fail_job
+
+        _fail_job(job, code, message)
+
+    # ── keep it here ─────────────────────────────────────────────────
+
+    async def keep_library(self, request):
+        from ..config import PromptManagerConfig
+        from ..config_store import get_config_store
+
+        try:
+            if (request.content_length or 0) > KEEP_BODY_MAX:
+                raise ValueError("too large")
+            data = await request.json()
+        except Exception:
+            data = None
+        if not isinstance(data, dict) or not isinstance(data.get("keep"), bool):
+            return _failure("keep must be true or false.", 400, "invalid-request")
+        keep = data["keep"]
+
+        def mutate(config):
+            library = config.get("library")
+            library = dict(library) if isinstance(library, dict) else {}
+            library["keep_in_node_folder"] = keep
+            config["library"] = library
+            return config
+
+        def publish(_config):
+            PromptManagerConfig.KEEP_LIBRARY_IN_NODE_FOLDER = keep
+
+        try:
+            await self._run_in_executor(
+                functools.partial(
+                    get_config_store().commit,
+                    mutate,
+                    expected_revision=None,
+                    publish=publish,
+                )
+            )
+        except Exception as exc:
+            return self._config_commit_failure(exc)
+        return await self.get_library_location(request)
@@ -0,0 +1,207 @@
+"""Reviewed rotated-log cleanup as a maintenance plan (#329 System S12).
+
+``POST /prompt_manager/maintenance/preview {operation: "rotated_logs",
+options: {}}`` lists the rotated copies of the active log that Rule R allows
+(``utils/logging_config.py``: ``prompt_manager.log.<n>`` regular files that
+are not links, directly in the log folder) and writes nothing. The plan keeps
+each copy's name, size, ``mtime_ns`` and inode under its token; the response
+is the maintenance ``Plan`` shape with basenames only, a ``none`` backup
+policy (no library record changes) and no ``disk`` key.
+
+``POST /prompt_manager/maintenance/apply {token}`` starts a ``maintenance``
+job titled "Rotated log copies" with admission ``read``: it may run beside a
+scan and is refused only beside another maintenance job or an ``exclusive``
+one. The job deletes exactly the reviewed copies under the logger's files
+lock and the file handler's lock, or nothing, failing ``plan-changed``, when
+any of them is missing, is no longer a rotated copy or differs in size,
+``mtime_ns`` or inode. A copy that cannot be deleted (open in another program
+on Windows) is an ``errors`` row; the others are deleted.
+"""
+
+import datetime
+import json
+
+from aiohttp import web
+
+try:
+    from ...utils.logging_config import RotatedChanged, rotated_sort_key
+except ImportError:  # loaded as the top-level ``py`` package (tests)
+    from utils.logging_config import RotatedChanged, rotated_sort_key
+
+from .jobs import MAINTENANCE_JOB_KIND
+from .maintenance_plans import ScopeTooLarge
+
+ROTATED_LOGS = "rotated_logs"
+LOG_CLEANUP_TITLE = "Rotated log copies"
+LOGS_CHANGED = (
+    "The log files changed since the review; nothing was deleted. Review again."
+)
+LOG_CLEANUP_FAILED = "The log cleanup failed."
+TOO_MANY_LOG_FILES = "Too many log files to review at once."
+LOG_CLEANUP_MEDIA = (
+    "Deletes only the listed log files. No image, video or library record changes."
+)
+_GROUPS = ("changed", "protected", "errors")
+
+
+def size_label(size):
+    """``1000 bytes``, ``2.0 KB``, ``10.0 MB`` or ``1.2 GB`` (1 KB = 1024 bytes)."""
+    size = max(0, int(size or 0))
+    if size < 1024:
+        return f"{size} {'byte' if size == 1 else 'bytes'}"
+    for unit, scale in (("KB", 2**10), ("MB", 2**20)):
+        if size < scale * 1024:
+            return f"{size / scale:.1f} {unit}"
+    return f"{size / 2**30:.1f} GB"
+
+
+def time_label(mtime_ns):
+    """The local modification time as ``YYYY-MM-DD HH:MM``."""
+    try:
+        moment = datetime.datetime.fromtimestamp(mtime_ns / 1e9)
+    except (OSError, OverflowError, ValueError):  # a time before 1970 on Windows
+        return "unknown time"
+    return moment.strftime("%Y-%m-%d %H:%M")
+
+
+def _count(count, singular, plural):
+    return f"{count} {singular if count == 1 else plural}"
+
+
+def _protected_reasons(rows):
+    """The plan's Protected reasons: what the cleanup keeps, zero counts left out."""
+    active = sum(1 for row in rows if row["kind"] == "active")
+    links = sum(1 for row in rows if row["kind"] == "link")
+    other = sum(1 for row in rows if row["kind"] == "other")
+    reasons = []
+    if active:
+        reasons.append("Kept: the active log")
+    if links:
+        reasons.append(f"Kept: {_count(links, 'link', 'links')}")
+    if other:
+        reasons.append(f"Kept: {_count(other, 'other file', 'other files')}")
+    return active + links + other, reasons
+
+
+def _scope_label(files):
+    if not files:
+        return "No rotated log copies"
+    total = sum(row["size"] for row in files)
+    return (
+        f"{_count(len(files), 'rotated log copy', 'rotated log copies')}"
+        f" · {size_label(total)}"
+    )
+
+
+class LogCleanupMixin:
+    """The ``rotated_logs`` maintenance plan and its job.
+
+    The logger manager is reached only through ``_get_logger_manager``
+    (``logging_routes.py``), so the tests can point it at a temporary folder.
+    """
+
+    async def preview_log_cleanup(self):
+        """The ``rotated_logs`` plan (runs inside the preview's lease)."""
+        from . import maintenance
+
+        manager = self._get_logger_manager()
+        try:
+            rows = await self._run_in_executor(manager.scan_log_folder)
+        except Exception:
+            self.logger.exception("Rotated log review failed")
+            return maintenance._failure("Failed to review maintenance", 500)
+        rotated = sorted(
+            (row for row in rows if row["kind"] == "rotated"),
+            key=rotated_sort_key,
+        )
+        files = [
+            {
+                "name": row["name"],
+                "size": row["size"],
+                "mtime_ns": row["mtime_ns"],
+                "ino": row["ino"],
+            }
+            for row in rotated
+        ]
+        protected, reasons = _protected_reasons(rows)
+        store = self._maintenance_plans
+        try:
+            token = store.issue(
+                ROTATED_LOGS,
+                json.dumps(files, sort_keys=True),
+                {"files": files, "protected": protected},
+                (),
+            )
+        except ScopeTooLarge:
+            return maintenance._failure(TOO_MANY_LOG_FILES, 413, "too-large")
+        plan = store.peek(token, ROTATED_LOGS)
+        return web.json_response(
+            {
+                "success": True,
+                "token": token,
+                "operation": ROTATED_LOGS,
+                "expires_at": maintenance._iso(plan.expires_at),
+                "scope": {"count": len(files), "label": _scope_label(files)},
+                "protected": {"count": protected, "reasons": reasons},
+                "backup": {
+                    "policy": "none",
+                    "destination_label": None,
+                    "expected_bytes": None,
+                },
+                "media": {"deletes_files": True, "label": LOG_CLEANUP_MEDIA},
+                "details": [
+                    {
+                        "label": row["name"],
+                        "detail": (
+                            f"{size_label(row['size'])} · {time_label(row['mtime_ns'])}"
+                        ),
+                    }
+                    for row in files
+                ],
+            },
+            headers={"Cache-Control": "no-store"},
+        )
+
+    def _start_log_cleanup(self, plan):
+        """Register the cleanup job (on the loop); raises JobBusy when refused."""
+        return self._jobs.start(
+            MAINTENANCE_JOB_KIND,
+            LOG_CLEANUP_TITLE,
+            admission="read",
+            cancellable=False,
+            scope={"operation": ROTATED_LOGS},
+            groups=_GROUPS,
+            runner=lambda job: self._run_log_cleanup(job, plan),
+        )
+
+    async def _run_log_cleanup(self, job, plan):
+        from . import maintenance
+
+        files = plan.payload["files"]
+        sizes = {row["name"]: row["size"] for row in files}
+        job.update(total=len(files), status_line="Deleting rotated log copies")
+        manager = self._get_logger_manager()
+        try:
+            result = await self._run_in_executor(manager.delete_rotated, files)
+        except RotatedChanged:
+            return maintenance._fail_job(job, "plan-changed", LOGS_CHANGED)
+        except Exception:
+            self.logger.exception("Rotated log cleanup failed")
+            return maintenance._fail_job(job, None, LOG_CLEANUP_FAILED)
+        for name in result["removed"]:
+            detail = f"Deleted · {size_label(sizes.get(name, 0))}"
+            job.record(
+                "changed", {"path": name, "detail": detail}, f"- {name} · {detail}"
+            )
+        for name, error in result["failed"]:
+            detail = self._public_error(error)
+            job.record(
+                "errors", {"path": name, "detail": detail}, f"! {name} · {detail}"
+            )
+        job.record_counted("protected", plan.payload["protected"])
+        removed, failed = len(result["removed"]), len(result["failed"])
+        line = f"Deleted {_count(removed, 'rotated log copy', 'rotated log copies')}"
+        if failed:
+            line += f", {failed} could not be deleted"
+        job.log_line(line)
+        job.update(processed=len(files), progress=100, status_line=line)
@@ -1,9 +1,21 @@
-"""Logging API routes for PromptManager."""
+"""Logging API routes for PromptManager.
+
+Every route that names a log file goes through Rule R (#329,
+``utils/logging_config.py``): a download is served only for a regular,
+non-link file listed directly in the log folder, and Clear deletes only
+rotated copies. File work runs off the event loop.
+"""

 import os
+import stat

 from aiohttp import web

+try:
+    from ...utils.logging_config import ClearRefused, parse_confirmed
+except ImportError:  # loaded as the top-level ``py`` package (tests)
+    from utils.logging_config import ClearRefused, parse_confirmed
+
 # Keys PromptManagerLogger.update_config() understands. Anything else is
 # rejected so a client cannot inject arbitrary entries into the logging config.
 LOG_CONFIG_KEYS = frozenset(
@@ -85,6 +97,41 @@ def _validate_log_config(data):
    return clean, None


+def _read_log_bytes(path):
+    """The whole file at ``path``, opened without following a link (blocking).
+
+    The file is checked again through the open handle: a regular file with
+    one name and, when ``path`` carries it, the inode it was listed with. A
+    name swapped for a link or another file after it was listed, or a hard
+    link to a file elsewhere, is refused as missing. The handle is closed
+    before this returns.
+    """
+    flags = os.O_RDONLY | getattr(os, "O_BINARY", 0) | getattr(os, "O_NOFOLLOW", 0)
+    # A FIFO swapped in after the listing must not block the executor thread.
+    flags |= getattr(os, "O_NONBLOCK", 0)
+    try:
+        fd = os.open(str(path), flags)
+    except OSError as error:
+        if getattr(os, "O_NOFOLLOW", 0) and os.path.islink(str(path)):
+            raise FileNotFoundError("Log file not found") from error
+        raise
+    listed_ino = getattr(path, "listed_ino", 0)
+    with os.fdopen(fd, "rb") as handle:
+        opened = os.fstat(handle.fileno())
+        if (
+            not stat.S_ISREG(opened.st_mode)
+            or opened.st_nlink > 1  # a hard link to a file elsewhere
+            or (listed_ino and opened.st_ino and opened.st_ino != listed_ino)
+        ):
+            raise FileNotFoundError("Log file not found")
+        return handle.read()
+
+
+def _download(logger_manager, filename):
+    """``bytes`` of a downloadable log file; FileNotFoundError otherwise."""
+    return _read_log_bytes(logger_manager.log_file_entry(filename))
+
+
 class LoggingRoutesMixin:
    """Mixin providing logging-related API endpoints."""

@@ -195,16 +242,16 @@ class LoggingRoutesMixin:
                    {"success": False, "error": "Invalid filename"}, status=400
                )

-            log_file_path = logger_manager.log_dir / filename
-
-            if not log_file_path.exists():
+            try:
+                file_content = await self._run_in_executor(
+                    _download, logger_manager, filename
+                )
+            except FileNotFoundError:
+                # Missing, a link, a folder or not listed: all read as absent.
                return web.json_response(
                    {"success": False, "error": "Log file not found"}, status=404
                )

-            with open(log_file_path, "rb") as f:
-                file_content = f.read()
-
            return web.Response(
                body=file_content,
                content_type="text/plain",
@@ -221,10 +268,43 @@ class LoggingRoutesMixin:
            )

    async def truncate_logs(self, request):
-        """Truncate all log files."""
+        """Clear all logs: what ``{"expected": [...]}`` lists, or all (#389).
+
+        ``expected`` holds the ``{name, identity}`` rows of ``/logs/files`` the
+        confirmation showed. Without a body (the legacy admin page, whose
+        confirmation lists nothing) every rotated copy present now is deleted.
+        A malformed list is 400; a clear that would empty or delete what was
+        not confirmed changes nothing and is 409 with the reason's ``code``.
+        """
        try:
+            args = ()
+            if request.can_read_body:
+                data, error_response = await self._read_json_body(request)
+                if error_response is not None:
+                    return error_response
+                if "expected" in data:
+                    try:
+                        parse_confirmed(data["expected"])
+                    except ValueError:
+                        return web.json_response(
+                            {
+                                "success": False,
+                                "error": "expected must list name and identity"
+                                " rows from /logs/files",
+                            },
+                            status=400,
+                        )
+                    args = (data["expected"],)
            logger_manager = self._get_logger_manager()
-            results = logger_manager.truncate_logs()
+            try:
+                results = await self._run_in_executor(
+                    logger_manager.truncate_logs, *args
+                )
+            except ClearRefused as refused:
+                return web.json_response(
+                    {"success": False, "error": str(refused), "code": refused.code},
+                    status=409,
+                )

            return web.json_response(
                {
@@ -266,7 +346,7 @@ class LoggingRoutesMixin:
                return web.json_response({"success": False, "error": error}, status=400)

            logger_manager = self._get_logger_manager()
-            logger_manager.update_config(clean)
+            await self._run_in_executor(logger_manager.update_config, clean)

            return web.json_response(
                {
@@ -0,0 +1,520 @@
+"""The staged LoRA reference import as a reviewed Activity job (#221, S10).
+
+``POST /prompt_manager/lora/import/preview`` (body ``{}``) reviews an import:
+it lists the LoraManager metadata files and parses them, and counts the
+current imports, those a saved pair uses and the example images an import
+would download. It writes nothing and requests nothing. It answers a
+``Plan`` (the maintenance plan's shape, ``py/api/maintenance.py``) plus
+``{lora_files, with_metadata, skipped, with_local_media, current_imports,
+blocked_by_pairs, planned_downloads, network:{planned_downloads, api_key},
+layout}`` (#355: ``layout`` says which LoraManager settings file, storage mode
+and library the import read, and ``error`` when they cannot be used). A plan
+that saved pairs block, or whose layout is unusable, carries no token
+(nothing can be applied).
+
+``POST /prompt_manager/lora/import/apply {token}`` starts the job (202
+``{job}``): kind ``lora_import``, titled "LoRA reference import", admission
+``records``, cancellable while it downloads only. Refused before it starts:
+``plan-changed`` (409: the metadata files changed since the review),
+``plan-expired``, ``plan-used``, ``storage-changed``, ``busy``,
+``insufficient-space`` (as maintenance). The job stages the records
+(downloads into the cache first, each counted in ``downloaded`` or
+``download_errors``), takes the safety backup the policy promises, then
+replaces the collection in one transaction bound to the reviewed imports. Any
+failure leaves the previous imports exactly as they were, and the job says so.
+
+The legacy ``POST /lora/scan`` runs the same stages (``stage_lora_import``
+and ``replace_lora_imports``) under its SSE event shape.
+"""
+
+import asyncio
+import os
+import sqlite3
+
+from aiohttp import web
+
+from .. import lora_import, lora_utils
+from .inspection_service import SERVABLE_EXTENSIONS
+from .job_routes import busy_response
+from .jobs import LORA_IMPORT_JOB_KIND, JobBusy
+from .maintenance import (
+    MAX_TOKEN_LENGTH,
+    _failure,
+    _fail_job,
+    _invalid,
+    _iso,
+    disk_plan,
+    short_space_message,
+)
+from .maintenance_plans import ScopeTooLarge
+
+try:
+    from ...database.category_import import EmptyReplacement
+    from ...database.maintenance import PlanChanged
+    from ...database.pairs import PairDependencyError
+except ImportError:  # pragma: no cover - flat test imports
+    from database.category_import import EmptyReplacement
+    from database.maintenance import PlanChanged
+    from database.pairs import PairDependencyError
+
+LORA_OPERATION = "lora_import"
+# The review reads the library: a request lease, so it is refused while a
+# restore runs and a restore waits for it before switching the file (S8).
+LORA_PREVIEW_LEASE = "LoRA import review"
+CATEGORY = lora_import.LORA_CATEGORY
+SOURCE_CHANGED = (
+    "The LoRA metadata files changed since the review; nothing was changed. "
+    "Review the import again."
+)
+IMPORTS_CHANGED = (
+    "The imported LoRA prompts changed since the review; the previous imports "
+    "were kept. Review the import again."
+)
+BLOCKED = (
+    "Saved pairs use some imported LoRA prompts, so the collection cannot be "
+    "replaced; the previous imports were kept."
+)
+INTEGRATION_CHANGED = (
+    "The LoraManager integration changed since the review; nothing was changed. "
+    "Review the import again."
+)
+EMPTY = "No LoRA could be prepared for import; the previous imports were kept."
+FAILED = "The import failed; the previous LoRA imports were kept."
+CACHE_NOTE = "Images already downloaded stay in the image cache."
+CANCELLED = "Cancelled before anything was written; the previous imports were kept."
+DISABLED = "LoraManager integration is not enabled"
+NO_PATH = "LoraManager path not configured"
+
+
+def _noun(count, word, plural=None):
+    return word if count == 1 else (plural or word + "s")
+
+
+def _count(count, word, plural=None):
+    return f"{count:,} {_noun(count, word, plural)}"
+
+
+def _import_line(result, skipped):
+    parts = [f"Imported {_count(result['imported'], 'LoRA')}"]
+    if result["linked"] or result["duplicates"]:
+        linked = result["linked"] + result["duplicates"]
+        parts.append(f"{linked:,} linked to an existing prompt")
+    if skipped:
+        parts.append(f"{skipped:,} skipped")
+    return " · ".join(parts)
+
+
+def _all_downloads_failed(errors):
+    """The warning when every planned download failed (#337)."""
+    if errors == 1:
+        return "Warning: the example image could not be downloaded"
+    return f"Warning: none of the {errors:,} example images could be downloaded"
+
+
+def _with_downloads(line, downloaded, errors):
+    """``line`` with the failed downloads: counted when some failed, led by
+    a warning when every planned download failed (#337). The job still
+    finishes: the import itself succeeded and the downloads are best effort."""
+    if not errors:
+        return line
+    if not downloaded:
+        return f"{_all_downloads_failed(errors)} · {line}"
+    failed = f"{_count(errors, 'example image')} could not be downloaded"
+    return f"{line} · {failed}"
+
+
+class LoraImportRoutesMixin:
+    """Mixin providing the reviewed LoRA import (preview, apply, job)."""
+
+    def _register_lora_import_routes(self, routes):
+        @routes.post("/prompt_manager/lora/import/preview")
+        async def lora_import_preview_route(request):
+            return await self.preview_lora_import(request)
+
+        @routes.post("/prompt_manager/lora/import/apply")
+        async def lora_import_apply_route(request):
+            return await self.apply_lora_import(request)
+
+    # ── shared stages ─────────────────────────────────────────────────
+
+    async def _lora_source(self):
+        """``(path, None)``: the configured, allowed LoraManager path, or
+        ``(None, (code, message))`` when the import cannot run."""
+        from ..config import IntegrationConfig
+
+        if not IntegrationConfig.LORA_MANAGER_ENABLED:
+            return None, ("lora-disabled", DISABLED)
+        lm_path = IntegrationConfig.LORA_MANAGER_PATH
+        if not lm_path:
+            return None, ("lora-path", NO_PATH)
+        allowed = await self._run_in_executor(
+            lora_utils.resolve_lora_manager_path, lm_path
+        )
+        if allowed is None:
+            from .lora_integration import _LORA_PATH_ERROR
+
+            return None, ("lora-path", _LORA_PATH_ERROR)
+        return allowed, None
+
+    async def stage_lora_import(self, discovery, *, on_record=None, cancelled=None):
+        """Stage ``discovery``'s sidecars off the loop: records, skips and
+        download counts."""
+        from ..config import IntegrationConfig
+
+        cache_dir = await self._run_in_executor(lora_utils.get_lora_image_cache_dir)
+        await self._run_in_executor(lora_utils.sweep_stale_downloads, cache_dir)
+        loop = asyncio.get_running_loop()
+
+        def report(index, record, staged):
+            if on_record is not None:
+                loop.call_soon_threadsafe(on_record, index, record, staged)
+
+        return await self._run_in_executor(
+            lambda: lora_import.stage(
+                discovery,
+                cache_dir,
+                IntegrationConfig.CIVITAI_API_KEY,
+                media_extensions=SERVABLE_EXTENSIONS,
+                on_record=report,
+                cancelled=cancelled or (lambda: False),
+                logger=self.logger,
+            )
+        )
+
+    async def lora_files_unchanged(self, lm_path, expected):
+        """Whether LoraManager's sidecars for ``lm_path`` still fingerprint as
+        ``expected`` (found again, so an added file counts too)."""
+
+        def current():
+            return lora_import.fingerprint(lora_import.discover(lm_path))
+
+        try:
+            return await self._run_in_executor(current) == expected
+        except OSError:
+            return False
+
+    async def replace_lora_imports(self, db, staged, *, expected_ids, allow_empty):
+        """Swap the collection for ``staged.records`` in one transaction.
+
+        Then the image routes' layout cache is dropped (#362): the import may
+        have linked files under a folder LoraManager created after the cache
+        stored its layout (its first example-image download creates one).
+        """
+        result = await self._run_in_executor(
+            lambda: db.replace_category_prompts(
+                CATEGORY,
+                staged.records,
+                expected_ids=expected_ids,
+                allow_empty=allow_empty,
+            )
+        )
+        lora_utils.clear_layout_cache()
+        return result
+
+    # ── preview ───────────────────────────────────────────────────────
+
+    async def preview_lora_import(self, request):
+        try:
+            async with self._jobs.lease(LORA_PREVIEW_LEASE):
+                return await self._preview_lora_import(request)
+        except JobBusy as busy:
+            return busy_response(busy)
+
+    async def _preview_lora_import(self, request):
+        data, error = await self._read_maintenance_body(request, ())
+        if error is not None:
+            return error
+        lm_path, refused = await self._lora_source()
+        if refused is not None:
+            return _failure(refused[1], 400, refused[0])
+        db = self.db
+        identity = self._database_identity(db)
+        try:
+            cache_dir = await self._run_in_executor(
+                lambda: lora_utils.get_lora_image_cache_dir(create=False)
+            )
+            found = await self._run_in_executor(
+                lora_import.preview, lm_path, cache_dir, SERVABLE_EXTENSIONS
+            )
+            state = await self._run_in_executor(db.category_import_state, CATEGORY)
+        except OSError as error:
+            # A folder discovery cannot list refuses the import (it must not
+            # replace the collection with part of it): say which one.
+            self.logger.warning(
+                f"LoRA import review: a folder could not be listed: {error}"
+            )
+            return _failure(
+                f"A LoRA folder could not be listed ({self._public_error(error)}). "
+                "Nothing was changed.",
+                500,
+                "folder-unreadable",
+            )
+        except Exception:
+            self.logger.exception("LoRA import preview failed")
+            return _failure("The LoRA import could not be reviewed.", 500)
+        if identity != self._database_identity(self.db):
+            return _failure(
+                "The database was replaced while it was reviewed. Review again.",
+                409,
+                "storage-changed",
+            )
+        return await self._lora_plan_response(db, identity, lm_path, found, state)
+
+    async def _lora_plan_response(self, db, identity, lm_path, found, state):
+        from ..config import IntegrationConfig
+
+        current = len(state["ids"])
+        blocked = state["paired"]
+        policy = self._safety_backup_policy()
+        try:
+            disk, _short, size = await self._run_in_executor(
+                disk_plan, db.model.db_path, backup=policy != "off", vacuum=False
+            )
+        except (OSError, sqlite3.Error):
+            self.logger.exception("Could not measure the disk space for a plan")
+            return _failure("The LoRA import could not be reviewed.", 500)
+        token = None
+        expires_at = None
+        layout = found["layout"]
+        # An unusable LoraManager layout found nothing it may replace with.
+        if not blocked and layout["error"] is None:
+            payload = {
+                "path": lm_path,
+                "fingerprint": found["fingerprint"],
+                "expected_ids": state["ids"],
+                "empty": found["with_metadata"] == 0,
+                "backup": policy,
+            }
+            try:
+                token = self._maintenance_plans.issue(
+                    LORA_OPERATION, found["fingerprint"], payload, identity
+                )
+            except ScopeTooLarge:
+                return _failure(
+                    "This import is too large to review at once.", 413, "too-large"
+                )
+            expires_at = _iso(self._maintenance_plans.peek(token).expires_at)
+        name = os.path.basename(db.model.db_path)
+        downloads = found["planned_downloads"]
+        reasons = (
+            [f"{_count(blocked, 'imported prompt')} used by saved pairs"]
+            if blocked
+            else []
+        )
+        return web.json_response(
+            {
+                "success": True,
+                "operation": LORA_OPERATION,
+                "token": token,
+                "expires_at": expires_at,
+                "lora_files": found["lora_files"],
+                "with_metadata": found["with_metadata"],
+                "skipped": found["skipped"],
+                "with_local_media": found["with_local_media"],
+                "layout": layout,
+                "current_imports": current,
+                "blocked_by_pairs": blocked,
+                "planned_downloads": downloads,
+                "scope": {
+                    "count": found["with_metadata"],
+                    "label": (
+                        f"Replace {_count(current, 'imported prompt')} with "
+                        f"{_count(found['with_metadata'], 'LoRA')}"
+                    ),
+                },
+                "protected": {"count": blocked, "reasons": reasons},
+                "backup": {
+                    "policy": policy,
+                    "destination_label": f"{name}.backup_<date and time>",
+                    "expected_bytes": size if policy != "off" else None,
+                },
+                "media": {
+                    "deletes_files": False,
+                    "label": "No files are removed; image links are replaced",
+                },
+                "network": {
+                    "planned_downloads": downloads,
+                    "api_key": bool(IntegrationConfig.CIVITAI_API_KEY),
+                },
+                "details": [{"label": n, "detail": ""} for n in found["names"]],
+                "disk": disk,
+            },
+            headers={"Cache-Control": "no-store"},
+        )
+
+    # ── apply ─────────────────────────────────────────────────────────
+
+    async def apply_lora_import(self, request):
+        data, error = await self._read_maintenance_body(request, ("token",))
+        if error is not None:
+            return error
+        token = data.get("token")
+        if not isinstance(token, str) or not 0 < len(token) <= MAX_TOKEN_LENGTH:
+            return _invalid("token must be the plan's token")
+        plan, refused = self._peek_plan(token)
+        if refused is not None:
+            return refused
+        if plan.operation != LORA_OPERATION:
+            return _failure(
+                "This review expired. Review the plan again.", 410, "plan-expired"
+            )
+        store = self._maintenance_plans
+        db = self.db
+        if plan.db_identity != self._database_identity(db):
+            store.discard(token)
+            return _failure(
+                "The database was replaced since the review. Review again.",
+                409,
+                "storage-changed",
+            )
+        lm_path = plan.payload["path"]
+        # M5: the integration must still be on and at the reviewed install.
+        current, _refused = await self._lora_source()
+        if current != lm_path:
+            store.discard(token)
+            return _failure(INTEGRATION_CHANGED, 409, "plan-changed")
+        try:
+            discovery = await self._run_in_executor(lora_import.discover, lm_path)
+            now = await self._run_in_executor(lora_import.fingerprint, discovery)
+            backup = self._backup_promised(plan)
+            _disk, short, _size = await self._run_in_executor(
+                disk_plan, db.model.db_path, backup=backup, vacuum=False
+            )
+        except Exception:
+            self.logger.exception("LoRA import could not start")
+            return _failure(
+                "The import could not start. Nothing was changed.", 500, "apply-failed"
+            )
+        if now != plan.fingerprint:
+            store.discard(token)
+            return _failure(SOURCE_CHANGED, 409, "plan-changed")
+        if short is not None:
+            return _failure(short_space_message(short), 507, "insufficient-space")
+        plan, refused = self._peek_plan(token)
+        if refused is not None:
+            return refused
+        try:
+            job = self._jobs.start(
+                LORA_IMPORT_JOB_KIND,
+                lora_import.JOB_TITLE,
+                admission="records",
+                cancellable=True,
+                scope={
+                    "operation": LORA_OPERATION,
+                    "lora_files": len(discovery.sidecars),
+                },
+                groups=lora_import.GROUPS,
+                runner=lambda job: self._run_lora_import(
+                    job, db, plan, discovery, backup
+                ),
+            )
+        except JobBusy as busy:
+            return busy_response(busy)
+        store.consume(token, LORA_OPERATION, job_id=job.id)
+        return web.json_response({"success": True, "job": job.summary()}, status=202)
+
+    # ── the job ───────────────────────────────────────────────────────
+
+    async def _run_lora_import(self, job, db, plan, discovery, backup_on):
+        total = len(discovery.sidecars)
+        job.update(total=total, status_line="Preparing LoRA records")
+        job.log_line(f"Found {_count(total, 'LoRA metadata file')}")
+
+        def on_record(index, record, staged):
+            job.update(
+                processed=index + 1,
+                progress=int(90 * (index + 1) / max(total, 1)),
+                status_line=f"Prepared {index + 1:,} of {total:,}",
+            )
+            job.publish({"type": "progress", "progress": job.progress})
+
+        try:
+            staged = await self.stage_lora_import(
+                discovery, on_record=on_record, cancelled=lambda: job.cancelled
+            )
+        except lora_import.ImportCancelled:
+            job.log_line(f"{CANCELLED} {CACHE_NOTE}")
+            job.update(status_line=CANCELLED)
+            job.finish("cancelled")
+            return
+        except Exception:
+            self.logger.exception("LoRA import staging failed")
+            return _fail_job(job, "import-failed", f"{FAILED} {CACHE_NOTE}")
+        self._count_downloads(job, staged)
+        # M4: what staging skipped stays on the job whatever happens next.
+        job.record_counted(
+            "skipped",
+            len(staged.skipped),
+            [{"path": "", "detail": name} for name in staged.skipped],
+        )
+        # Past this point nothing stops halfway: the replace is one transaction.
+        # Published, so a view that offered Cancel during the downloads drops it.
+        job.cancellable = False
+        job.publish({"type": "progress", "progress": job.progress})
+        if job.cancelled:
+            job.log_line(f"{CANCELLED} {CACHE_NOTE}")
+            job.update(status_line=CANCELLED)
+            job.finish("cancelled")
+            return
+        ok, _backup = await self._safety_backup_step(job, db, backup_on)
+        if not ok:
+            return
+        # I1: the files are listed and fingerprinted again right before the
+        # replace, so a file changed, removed or added while the downloads ran
+        # (LoraManager refreshing its CivitAI info) aborts with nothing deleted.
+        if not await self.lora_files_unchanged(plan.payload["path"], plan.fingerprint):
+            return _fail_job(job, "plan-changed", f"{SOURCE_CHANGED} {CACHE_NOTE}")
+        job.update(status_line="Replacing the LoRA collection", progress=95)
+        await self._replace_in_job(job, db, plan, staged)
+
+    def _count_downloads(self, job, staged):
+        downloaded = staged.stats.get("downloaded", 0)
+        errors = staged.stats.get("download_errors", 0)
+        job.record_counted("downloaded", downloaded)
+        rows = []
+        if errors and not downloaded:
+            warning = _all_downloads_failed(errors)
+            rows = [{"path": "", "detail": f"{warning}; the log has the details"}]
+            job.log_line(warning)
+        job.record_counted("download_errors", errors, rows)
+        if downloaded or errors:
+            job.log_line(
+                f"Downloaded {_count(downloaded, 'example image')}"
+                + (f"; {errors:,} could not be downloaded" if errors else "")
+            )
+
+    async def _replace_in_job(self, job, db, plan, staged):
+        try:
+            result = await self.replace_lora_imports(
+                db,
+                staged,
+                expected_ids=plan.payload["expected_ids"],
+                allow_empty=plan.payload["empty"],
+            )
+        except PlanChanged:
+            return _fail_job(job, "plan-changed", f"{IMPORTS_CHANGED} {CACHE_NOTE}")
+        except PairDependencyError:
+            return _fail_job(job, "blocked-by-pairs", f"{BLOCKED} {CACHE_NOTE}")
+        except EmptyReplacement:
+            return _fail_job(job, "nothing-to-import", f"{EMPTY} {CACHE_NOTE}")
+        except Exception:
+            self.logger.exception("LoRA import failed")
+            return _fail_job(job, "import-failed", f"{FAILED} {CACHE_NOTE}")
+        rows = {"imported": [], "linked": []}
+        for row in result["rows"]:
+            group = "imported" if row["outcome"] == "imported" else "linked"
+            rows[group].append({"path": "", "detail": row["name"]})
+        job.record_counted("imported", result["imported"], rows["imported"])
+        job.record_counted(
+            "linked", result["linked"] + result["duplicates"], rows["linked"]
+        )
+        line = _import_line(result, len(staged.skipped))
+        if result["removed"]:
+            job.log_line(f"Replaced {_count(result['removed'], 'previous import')}")
+        job.log_line(line)
+        line = _with_downloads(
+            line,
+            staged.stats.get("downloaded", 0),
+            staged.stats.get("download_errors", 0),
+        )
+        job.update(progress=100, processed=job.total, status_line=line)
@@ -1,7 +1,9 @@
 """LoraManager integration API routes for PromptManager."""

+import asyncio
+import contextlib
 import json
-from pathlib import Path
+import threading

 from aiohttp import web

@@ -37,6 +39,30 @@ def _lora_settings_mutation(values):
    return mutate


+# The admin page's own words for the refusals it can meet (it has no review).
+_FILES_CHANGED = (
+    "The LoRA metadata files changed during the scan; the previous imports "
+    "were kept. Run the scan again."
+)
+_IMPORTS_CHANGED = (
+    "The imported LoRA prompts changed during the scan; the previous imports "
+    "were kept. Run the scan again."
+)
+
+
+class LoraSettingsUnusable(Exception):
+    """LoraManager's settings cannot be used; nothing was imported (#355)."""
+
+    def __init__(self, reason):
+        super().__init__(
+            f"LoraManager settings: not usable: {reason}. Nothing was changed."
+        )
+
+
+class LoraFilesChanged(Exception):
+    """A metadata file changed, appeared or went while the legacy scan staged."""
+
+
 def _lora_error_frame(message):
    """An import stream's error event, as the admin page's modal reads it.

@@ -46,6 +72,23 @@ def _lora_error_frame(message):
    return {"type": "error", "status": message, "progress": 0, "message": message}


+def _closed(request):
+    """A check (safe off the loop) for whether ``request``'s client left."""
+
+    def closed():
+        transport = request.transport
+        return transport is None or transport.is_closing()
+
+    return closed
+
+
+def _stopped(error) -> bool:
+    """Whether a legacy scan ended because its page closed the connection."""
+    from .. import lora_import
+
+    return isinstance(error, (ConnectionError, lora_import.ImportCancelled))
+
+
 class LoraIntegrationMixin:
    """Mixin providing LoraManager detection, scanning, and trigger word endpoints."""

@@ -108,7 +151,11 @@ class LoraIntegrationMixin:
        """Get current LoraManager integration status."""
        try:
            from ..config import IntegrationConfig
-            from ..lora_utils import detect_lora_manager, get_trigger_cache
+            from ..lora_utils import (
+                detect_lora_manager,
+                get_trigger_cache,
+                resolve_lora_manager_path,
+            )

            config = IntegrationConfig.get_config()["lora_manager"]
            cache = get_trigger_cache()
@@ -117,6 +164,12 @@ class LoraIntegrationMixin:
            detected_path = await self._run_in_executor(
                detect_lora_manager, config.get("path", "")
            )
+            # A detected install reached through a link outside custom_nodes is
+            # found but cannot be enabled (S10 review N5): say which.
+            usable = bool(detected_path) and (
+                await self._run_in_executor(resolve_lora_manager_path, detected_path)
+                is not None
+            )

            return web.json_response(
                {
@@ -126,6 +179,7 @@ class LoraIntegrationMixin:
                    "trigger_words_enabled": config["trigger_words_enabled"],
                    "has_civitai_api_key": bool(config.get("civitai_api_key")),
                    "detected": detected_path is not None,
+                    "detected_usable": usable,
                    "detected_path": (
                        self._public_path(detected_path) if detected_path else ""
                    ),
@@ -168,6 +222,9 @@ class LoraIntegrationMixin:
    async def lora_enable(self, request):
        """Enable or disable LoraManager integration and save it to config.json.

+        ``expected_revision`` (optional, GET /settings' ``revision``) refuses
+        a save over a config.json changed meanwhile (``settings-changed``).
+
        The values are committed through the config store first (#220) and
        published at runtime only once config.json holds them; a save that
        cannot be written reports ``persisted: false`` and changes nothing.
@@ -180,6 +237,11 @@ class LoraIntegrationMixin:
            for flag in _LORA_FLAGS:
                if flag in data and not isinstance(data[flag], bool):
                    return self._bad_lora_request(f"{flag} must be true or false")
+            # The System Save row sends the revision it read (#220); the
+            # legacy page sends none and merges into what is on disk.
+            expected_revision = data.get("expected_revision")
+            if expected_revision is not None and not isinstance(expected_revision, str):
+                return self._bad_lora_request("expected_revision must be a string")
            enabled = data.get("enabled", False)
            path = data.get("path", "")
            trigger_words = data.get("trigger_words_enabled", False)
@@ -226,7 +288,7 @@ class LoraIntegrationMixin:
                _saved, revision = await self._run_in_executor(
                    get_config_store().commit,
                    _lora_settings_mutation(values),
-                    expected_revision=None,
+                    expected_revision=expected_revision,
                    publish=publish,
                )
            except (ConfigUnreadable, RevisionConflict, OSError) as exc:
@@ -308,43 +370,75 @@ class LoraIntegrationMixin:
            ) as job:
                await response.prepare(request)
                try:
-                    await self._lora_scan_stream(allowed, send_progress)
+                    await self._lora_scan_stream(
+                        allowed, send_progress, disconnected=_closed(request)
+                    )
+                except asyncio.CancelledError:
+                    # The server cancelled the handler when the page left.
+                    job.finish("cancelled")
+                    raise
                except Exception as e:
-                    self.logger.exception("LoRA scan failed")
-                    job.finish("failed")
-                    await send_progress(_lora_error_frame(self._public_error(e)))
-
-                await response.write_eof()
+                    # A page that left stopped the scan; nothing failed (R2).
+                    job.finish("cancelled" if _stopped(e) else "failed")
+                    await self._send_scan_failure(e, send_progress)
+                with contextlib.suppress(ConnectionError, RuntimeError):
+                    await response.write_eof()
            return response

        except Exception as e:
            self.logger.error(f"LoRA scan failed: {e}")
            return self._error_response(e)

-    async def _lora_scan_stream(self, lm_path, send_progress):
-        """Import every LoRA under ``lm_path``, reporting through ``send_progress``."""
-        from ..config import IntegrationConfig
-        from ..lora_utils import (
-            download_civitai_images,
-            find_lora_directories,
-            get_example_prompt_from_metadata,
-            get_lora_image_cache_dir,
-            get_preview_images_from_metadata,
-            get_trigger_words_from_metadata,
-            get_model_name_from_metadata,
-            read_lora_metadata,
+    async def _send_scan_failure(self, error, send_progress):
+        """The error frame for a failed legacy scan; quiet when the page left.
+
+        Expected refusals (files or imports changed, saved pairs, nothing to
+        import) are warnings in the admin page's own words; anything else is
+        logged with its traceback.
+        """
+        from .lora_import_routes import (
+            EmptyReplacement,
+            PairDependencyError,
+            PlanChanged,
        )

-        await send_progress(
-            {
-                "type": "progress",
-                "status": "Clearing previous lora-manager imports...",
-                "progress": 0,
-            }
-        )
+        if _stopped(error):
+            self.logger.info("LoRA scan stopped: the page closed its connection")
+            return
+        if isinstance(error, PlanChanged):
+            message = _IMPORTS_CHANGED
+        elif isinstance(error, (LoraFilesChanged, LoraSettingsUnusable)):
+            message = str(error)
+        else:
+            message = self._public_error(error)
+        if isinstance(
+            error,
+            (
+                PlanChanged,
+                LoraFilesChanged,
+                LoraSettingsUnusable,
+                EmptyReplacement,
+                PairDependencyError,
+            ),
+        ):
+            self.logger.warning(f"LoRA scan refused: {message}")
+        else:
+            self.logger.exception("LoRA scan failed")
+        with contextlib.suppress(ConnectionError, RuntimeError):
+            await send_progress(_lora_error_frame(message))

-        # Clear previous imports so reimport is always clean
-        await self._run_in_executor(self.db.delete_prompts_by_category, "lora-manager")
+    async def _lora_scan_stream(
+        self, lm_path, send_progress, disconnected=lambda: False
+    ):
+        """Import every LoRA under ``lm_path``, reporting through ``send_progress``.
+
+        The staged path of the System import (#221, ``lora_import_routes``):
+        discover, stage every record (downloads into the cache first), then
+        replace the collection in one transaction. A failure at any stage
+        raises with the previous imports untouched; an empty replacement of a
+        non-empty collection is refused (it needs the reviewed import).
+        """
+        from .. import lora_import

        await send_progress(
            {
@@ -353,19 +447,11 @@ class LoraIntegrationMixin:
                "progress": 2,
            }
        )
-
-        lora_dirs = await self._run_in_executor(find_lora_directories, lm_path)
-
-        # Collect all metadata files
-        meta_files = []
-        for d in lora_dirs:
-            dir_path = Path(d)
-            meta_files.extend(dir_path.rglob("*.metadata.json"))
-
-        total = len(meta_files)
-        imported = 0
-        skipped = 0
-
+        discovery = await self._run_in_executor(lora_import.discover, lm_path)
+        if discovery.layout.error is not None:
+            raise LoraSettingsUnusable(discovery.layout.error)
+        sidecars = discovery.sidecars
+        total = len(sidecars)
        await send_progress(
            {
                "type": "progress",
@@ -375,116 +461,105 @@ class LoraIntegrationMixin:
            }
        )

-        cache_dir = get_lora_image_cache_dir()
+        reviewed = await self._run_in_executor(lora_import.fingerprint, discovery)
+        events = asyncio.Queue()
+        state = await self._run_in_executor(
+            self.db.category_import_state, lora_import.LORA_CATEGORY
+        )
+        # Records whose prompt already exists outside the collection are
+        # linked, not imported (the running counts; the end ones are exact).
+        known = set()

-        for i, meta_file in enumerate(meta_files):
-            metadata = await self._run_in_executor(read_lora_metadata, meta_file)
-            if not metadata:
-                skipped += 1
-                continue
+        def on_record(index, record, _staged):
+            events.put_nowait((index, record))

-            model_name = get_model_name_from_metadata(metadata)
-            trigger_words = get_trigger_words_from_metadata(metadata)
-
-            # Collect all images: local previews + downloaded civitai examples
-            preview_paths = await self._run_in_executor(
-                get_preview_images_from_metadata, metadata, meta_file
-            )
-            civitai_paths = await self._run_in_executor(
-                download_civitai_images,
-                metadata,
-                meta_file,
-                cache_dir,
-                IntegrationConfig.CIVITAI_API_KEY,
-            )
-
-            # Merge, local first, dedup
-            seen = set(preview_paths)
-            all_images = list(preview_paths)
-            for cp in civitai_paths:
-                if cp not in seen:
-                    all_images.append(cp)
-                    seen.add(cp)
-
-            # Build prompt text: prefer example prompt, then model name
-            example_prompt = get_example_prompt_from_metadata(metadata)
-            prompt_text = example_prompt or model_name
-
-            # Build tags
-            tags = ["lora-manager", f"lora:{model_name}"]
-            tags.extend(trigger_words)
-
-            # Save to database via existing mechanism
-            try:
-                import hashlib
-
-                prompt_hash = hashlib.sha256(
-                    prompt_text.strip().lower().encode("utf-8")
-                ).hexdigest()
+        counts = {"imported": 0}

+        async def report(index, record):
+            if record is not None and record["hash"] not in known:
+                known.add(record["hash"])
                existing = await self._run_in_executor(
-                    self.db.get_prompt_by_hash, prompt_hash
+                    self.db.existing_prompt_hashes,
+                    [record["hash"]],
+                    lora_import.LORA_CATEGORY,
                )
-
-                if existing:
-                    # Link all images
-                    for pp in all_images:
-                        await self._run_in_executor(
-                            self.db.link_image_to_prompt,
-                            existing["id"],
-                            pp,
-                        )
-                    skipped += 1
-                else:
-                    prompt_id = await self._run_in_executor(
-                        self.db.save_prompt,
-                        prompt_text,
-                        "lora-manager",  # category
-                        tags,
-                        None,  # rating
-                        None,  # notes
-                        prompt_hash,
-                    )
-
-                    if prompt_id:
-                        for pp in all_images:
-                            await self._run_in_executor(
-                                self.db.link_image_to_prompt,
-                                prompt_id,
-                                pp,
-                            )
-                        imported += 1
-                    else:
-                        skipped += 1
-
-            except Exception as e:
-                self.logger.warning(f"Failed to import LoRA {model_name}: {e}")
-                skipped += 1
-
-            # Progress update for every LoRA
-            progress = int(5 + (90 * (i + 1) / max(total, 1)))
-            img_count = len(all_images)
-            status = f"{model_name}"
-            if img_count:
-                status += f" ({img_count} images)"
+                if not existing:
+                    counts["imported"] += 1
+            status = record["name"] if record else sidecars[index].metadata_path.name
+            if record and record["images"]:
+                status += f" ({len(record['images'])} images)"
            await send_progress(
                {
                    "type": "progress",
                    "status": status,
-                    "progress": progress,
-                    "processed": i + 1,
-                    "imported": imported,
-                    "skipped": skipped,
+                    "progress": int(5 + (90 * (index + 1) / max(total, 1))),
+                    "processed": index + 1,
+                    "imported": counts["imported"],
+                    "skipped": index + 1 - counts["imported"],
                }
            )

+        # Each record's event is queued (through the loop) before staging
+        # ends, so reporting until staging is done and then draining the
+        # queue reports every record in order. I2: when the page goes away
+        # (its connection closes, or a report cannot be sent) staging stops
+        # before its next LoRA, and this returns only once it has stopped, so
+        # the caller's records hold covers every download.
+        stop = threading.Event()
+        staging = asyncio.ensure_future(
+            self.stage_lora_import(
+                discovery,
+                on_record=on_record,
+                cancelled=lambda: stop.is_set() or disconnected(),
+            )
+        )
+        try:
+            while not staging.done():
+                getter = asyncio.ensure_future(events.get())
+                await asyncio.wait(
+                    {getter, staging}, return_when=asyncio.FIRST_COMPLETED
+                )
+                if getter.done():
+                    await report(*getter.result())
+                else:
+                    getter.cancel()
+            while not events.empty():
+                await report(*events.get_nowait())
+        finally:
+            stop.set()
+            # Staging must have stopped before the records hold is released,
+            # even when the handler is cancelled again while it waits (R3).
+            interrupted = False
+            while not staging.done():
+                try:
+                    await asyncio.shield(staging)
+                except asyncio.CancelledError:
+                    interrupted = True
+                except Exception:
+                    pass
+            if interrupted:
+                raise asyncio.CancelledError
+        staged = await staging
+        if not await self.lora_files_unchanged(lm_path, reviewed):
+            raise LoraFilesChanged(_FILES_CHANGED)
+
+        await send_progress(
+            {
+                "type": "progress",
+                "status": "Replacing previous lora-manager imports...",
+                "progress": 96,
+            }
+        )
+        result = await self.replace_lora_imports(
+            self.db, staged, expected_ids=state["ids"], allow_empty=False
+        )
        await send_progress(
            {
                "type": "complete",
                "progress": 100,
                "total": total,
-                "imported": imported,
-                "skipped": skipped,
+                "imported": result["imported"],
+                "skipped": total - result["imported"],
            }
        )

@@ -2,7 +2,9 @@

 ``POST /prompt_manager/maintenance/preview {operation, options:{}}`` reviews
 one operation (``duplicate_prompts``, ``optimize``, ``unused_components`` or
-``missing_links``; ``database/maintenance.py``) off the event loop and
+``missing_links``; ``database/maintenance.py``; ``duplicate_files``,
+``py/api/duplicate_files.py``; ``rotated_logs``, the rotated log copies,
+``py/api/log_cleanup.py``, which has its own apply job) off the event loop and
 answers a ``Plan``: ``{success, token, operation, expires_at, scope:{count,
 label}, protected:{count, reasons}, backup:{policy, destination_label},
 media:{deletes_files, label}, details:[≤50 {label, detail}]}``. The preview
@@ -37,7 +39,8 @@ runner runs); a refused start keeps it. The runner:

 The job log names the backup by its file name only, and the job says "No
 safety backup" when none was taken. Apply errors: ``invalid-request`` (400),
-``plan-expired`` (410: unknown, expired or forgotten after a restart),
+``apply-failed`` (500: nothing started), ``plan-expired`` (410: unknown,
+expired or forgotten after a restart),
 ``plan-used`` (409, with the job that applied it), ``storage-changed`` (409:
 a restore replaced the database since the review) and ``busy`` (409).
 """
@@ -47,31 +50,44 @@ import json
 import os
 import shutil
 import sqlite3
-import tempfile
-from contextlib import closing

 from aiohttp import web

 from .admin import _prune_safety_backups, _scan_location, _scan_roots
 from .job_routes import busy_response
 from .jobs import MAINTENANCE_JOB_KIND, JobBusy
+from .log_cleanup import ROTATED_LOGS
 from .maintenance_plans import PlanExpired, PlanUsed, ScopeTooLarge

 try:
+    from ...database import safety_backup as _backups
+    from ...database.safety_backup import (  # noqa: F401 - re-exported
+        SAFETY_TEMP_PREFIX,
+        SafetyBackupFailed,
+        sweep_safety_temps,
+    )
    from ...database.workflow_storage import PRE_MIGRATION_LABEL, pre_migration_backups
    from ...database.health import readonly_uri
    from ...database.maintenance import MAINTENANCE_OPERATIONS, PlanChanged
 except ImportError:
+    from database import safety_backup as _backups
+    from database.safety_backup import (  # noqa: F401 - re-exported
+        SAFETY_TEMP_PREFIX,
+        SafetyBackupFailed,
+        sweep_safety_temps,
+    )
    from database.workflow_storage import PRE_MIGRATION_LABEL, pre_migration_backups
    from database.health import readonly_uri
    from database.maintenance import MAINTENANCE_OPERATIONS, PlanChanged

 PREVIEW_BODY_MAX = 4096
+MAINTENANCE_PREVIEW_LEASE = "Maintenance preview"
 # Duplicate-file previews carry the reviewed keepers (py/api/duplicate_files.py).
 DUPLICATE_PREVIEW_BODY_MAX = 1024 * 1024
 DUPLICATE_FILES = "duplicate_files"
 WORKFLOW_STORAGE = "workflow_storage"  # applied by py/api/workflow_storage.py
-PREVIEW_OPERATIONS = MAINTENANCE_OPERATIONS + (DUPLICATE_FILES,)
+# rotated_logs (#329, py/api/log_cleanup.py) reviews log files, not records.
+PREVIEW_OPERATIONS = MAINTENANCE_OPERATIONS + (DUPLICATE_FILES, ROTATED_LOGS)
 # Room left over beyond what a step writes, so a disk is never filled to 0.
 DISK_MARGIN_BYTES = 16 * 2**20
 # The concept's Maintenance row titles, which name each operation's job.
@@ -95,18 +111,6 @@ PLAN_CHANGED = (
 APPLY_FAILED = "Maintenance failed; nothing was changed."
 NOTHING_TO_DO = "Every image record already stores its workflow once; nothing to do."
 NO_BACKUP = "No safety backup"
-_NAME_ATTEMPTS = 1000
-
-
-class SafetyBackupFailed(Exception):
-    """The safety backup could not be written, verified or put in place.
-
-    ``reason`` is the verify reason when the copy did not verify.
-    """
-
-    def __init__(self, message, reason=None):
-        super().__init__(message)
-        self.reason = reason


 def backup_failed_message(error):
@@ -117,10 +121,6 @@ def backup_failed_message(error):
    return BACKUP_FAILED


-def _now():
-    return datetime.datetime.now()
-
-
 def _free_bytes(path):
    return shutil.disk_usage(path).free

@@ -243,29 +243,18 @@ def size_label(size):


 def restore_room(db_path):
-    """The largest restore upload the disks have room for (blocking).
+    """The largest restore upload the disk has room for (blocking).

-    The upload is written to a temp file and staged once more in the
-    temporary folder (2x), then copied over the live database beside it,
-    whose current contents are first kept as a safety backup (1x the upload
-    for the WAL, plus the current database). Needs on one device add up,
-    each with ``DISK_MARGIN_BYTES``.
+    Everything a restore writes is in the library's folder (#318): the
+    upload, its staged copy (``database/restore_stage.py``) and the WAL
+    growth while the stage is copied over the live database (3x the upload),
+    plus the safety backup of the current database (1x its size), with
+    ``DISK_MARGIN_BYTES`` to spare.
    """
    db_path = os.path.abspath(db_path)
    folder = os.path.dirname(db_path)
    current = database_bytes(db_path) if os.path.exists(db_path) else 0
-    devices = {}
-    for path, per_upload, fixed in (
-        (tempfile.gettempdir(), 2, 0),
-        (folder, 1, current),
-    ):
-        entry = devices.setdefault(_device(path), {"path": path, "per": 0, "fixed": 0})
-        entry["per"] += per_upload
-        entry["fixed"] += fixed
-    room = min(
-        (_free_bytes(e["path"]) - e["fixed"] - DISK_MARGIN_BYTES) // e["per"]
-        for e in devices.values()
-    )
+    room = (_free_bytes(folder) - current - DISK_MARGIN_BYTES) // 3
    return max(0, room)


@@ -305,142 +294,13 @@ def _changed_line(operation, count):
    return f"Removed {count:,} {noun}"


-def _remove_quietly(*paths):
-    for path in paths:
-        try:
-            if path and os.path.exists(path):
-                os.remove(path)
-        except OSError:
-            pass
-
-
-def _reserve_backup_name(db_path, label="backup"):
-    """Create and return an unused ``<db>.<label>_<stamp>[_n]`` (O_EXCL)."""
-    for candidate in _backup_names(db_path, label):
-        try:
-            fd = os.open(candidate, os.O_CREAT | os.O_EXCL | os.O_WRONLY, 0o600)
-        except FileExistsError:
-            continue
-        os.close(fd)
-        return candidate
-    raise SafetyBackupFailed("No free backup name")
-
-
-def _backup_names(db_path, label="backup"):
-    base = f"{db_path}.{label}_{_now().strftime('%Y%m%d_%H%M%S_%f')}"
-    for attempt in range(_NAME_ATTEMPTS):
-        yield base if attempt == 0 else f"{base}_{attempt}"
-
-
-def _place_backup(temp, db_path, label="backup"):
-    """Give the verified ``temp`` its unique backup name; return that path.
-
-    ``os.link`` is atomic and refuses an existing name, so no empty or half
-    file ever carries a backup name, even across a crash. A filesystem
-    without hard links falls back to reserving the name (``O_EXCL``) and
-    ``os.replace``. The temp file is removed by the caller.
-    """
-    for candidate in _backup_names(db_path, label):
-        try:
-            os.link(temp, candidate)
-        except FileExistsError:
-            continue
-        except (OSError, NotImplementedError):
-            break  # no hard links here
-        else:
-            return candidate
-    else:
-        raise SafetyBackupFailed("No free backup name")
-    final = _reserve_backup_name(db_path, label)
-    try:
-        os.replace(temp, final)
-    except OSError:
-        _remove_quietly(final)
-        raise
-    return final
-
-
-SAFETY_TEMP_PREFIX = ".pm-safety-"
-
-
-def sweep_safety_temps(db_path):
-    """Remove the temp copies an interrupted safety backup left (blocking).
-
-    Called once at startup, before any job can take a backup. Returns the
-    names removed.
-    """
-    folder = os.path.dirname(os.path.abspath(db_path))
-    removed = []
-    try:
-        names = os.listdir(folder)
-    except OSError:
-        return removed
-    for name in names:
-        if not (name.startswith(SAFETY_TEMP_PREFIX) and ".tmp" in name):
-            continue
-        try:
-            os.remove(os.path.join(folder, name))
-            removed.append(name)
-        except OSError:
-            continue
-    return removed
-
-
-def _standalone(path):
-    """Make the copy one self-contained file (rollback journal, not WAL).
-
-    The backup API copies the live database's WAL flag; a WAL file opened
-    read-only later (a verify, a restore preview) would leave ``-wal`` and
-    ``-shm`` sidecars beside it.
-    """
-    try:
-        with closing(sqlite3.connect(path)) as conn:
-            conn.execute("PRAGMA journal_mode=DELETE").fetchone()
-    except sqlite3.Error as exc:
-        raise SafetyBackupFailed("The backup could not be finished") from exc
-
-
-def _fsync(path):
-    with open(path, "rb+") as handle:
-        os.fsync(handle.fileno())
-
-
 def take_safety_backup(model, label="backup"):
    """Write and verify a safety backup; return its file name (blocking).

-    The copy is made in a temp file beside the database and only renamed
-    onto its final, unique name ``<db>.<label>_<stamp>`` once it verified,
-    so a backup file on disk is always a verified one. ``label`` "backup"
-    joins the pruned pool; another label (the workflow storage migration's
-    ``pre-workflow-storage``) is kept until the user removes it. Raises
-    SafetyBackupFailed, leaving no file.
+    See ``database/safety_backup.py``: a backup file on disk is always a
+    verified one. Raises SafetyBackupFailed, leaving no file.
    """
-    db_path = os.path.abspath(model.db_path)
-    fd, temp = tempfile.mkstemp(
-        dir=os.path.dirname(db_path), prefix=SAFETY_TEMP_PREFIX, suffix=".tmp"
-    )
-    os.close(fd)
-    final = None
-    try:
-        if not model.backup_database(temp):
-            raise SafetyBackupFailed("The backup could not be written")
-        _standalone(temp)
-        ok, reason = model.verify_database_file(temp)
-        if not ok:
-            raise SafetyBackupFailed("The backup did not verify", reason)
-        _fsync(temp)
-        if os.name != "nt":
-            os.chmod(temp, 0o600)
-        final = _place_backup(temp, db_path, label)
-        return os.path.basename(final)
-    except OSError as exc:
-        _remove_quietly(final)
-        raise SafetyBackupFailed("The backup could not be put in place") from exc
-    except SafetyBackupFailed:
-        _remove_quietly(final)
-        raise
-    finally:
-        _remove_quietly(temp, temp + "-journal", temp + "-wal", temp + "-shm")
+    return os.path.basename(_backups.take_safety_backup(model, label))


 def _failure(message, status, code=None, **extra):
@@ -503,6 +363,19 @@ class MaintenanceRoutesMixin:
        return data, None

    async def preview_maintenance(self, request):
+        """Review one operation under a registry lease (#249 S8).
+
+        The preview's read-only connections must not be open while a restore
+        switches the database: it is refused (409 ``busy``) while an
+        ``exclusive`` job runs, and a restore waits for running previews.
+        """
+        try:
+            async with self._jobs.lease(MAINTENANCE_PREVIEW_LEASE):
+                return await self._preview_maintenance(request)
+        except JobBusy as busy:
+            return busy_response(busy)
+
+    async def _preview_maintenance(self, request):
        data, error = await self._read_maintenance_body(
            request,
            ("operation", "options"),
@@ -522,6 +395,8 @@ class MaintenanceRoutesMixin:
            return await self.preview_duplicate_files(options)
        if not isinstance(options, dict) or options:
            return _invalid(f"{operation} takes no options")
+        if operation == ROTATED_LOGS:
+            return await self.preview_log_cleanup()
        db = self.db
        identity = self._database_identity(db)
        try:
@@ -623,6 +498,17 @@ class MaintenanceRoutesMixin:
        if refused is not None:
            return refused
        store = self._maintenance_plans
+        if plan.operation == ROTATED_LOGS:
+            # Log files only: no database identity, backup or disk check.
+            try:
+                job = self._start_log_cleanup(plan)
+            except JobBusy as busy:
+                return busy_response(busy)  # the token stays usable
+            # Same loop turn as the peek and the start: the runner has not run.
+            store.consume(token, plan.operation, job_id=job.id)
+            return web.json_response(
+                {"success": True, "job": job.summary()}, status=202
+            )
        db = self.db
        if plan.db_identity != self._database_identity(db):
            store.discard(token)
@@ -644,7 +530,9 @@ class MaintenanceRoutesMixin:
            )
        except (OSError, sqlite3.Error):
            self.logger.exception("Could not measure the disk space for an apply")
-            return _failure(APPLY_FAILED, 500)
+            # Coded: the workspace tells the server's own refusal (nothing
+            # started) from a proxy's 5xx (the job may have started).
+            return _failure(APPLY_FAILED, 500, "apply-failed")
        if short is not None:
            # Refused before any job starts: nothing fails halfway for space.
            return _failure(short_space_message(short), 507, "insufficient-space")
@@ -808,7 +696,13 @@ def backup_note(backup):


 def _fail_job(job, code, message):
-    """End ``job`` failed with ``message`` (one error row) and its code."""
+    """End ``job`` failed with ``message`` (one error row) and its code.
+
+    The code is also the job's ``scope["failure"]``, so Activity can offer
+    Review again for a plan the library overtook.
+    """
+    if code:
+        job.scope["failure"] = code
    job.record("errors", {"path": "", "detail": message}, f"! {message}")
    job.update(status_line=message)
    job.publish({"type": "error", "code": code, "message": message})
@@ -0,0 +1,54 @@
+"""The listing identity of one media file, as a request names it.
+
+Shared by the image-annotation routes and the collection routes (#331): a
+target is ``{root_index, root_scope, path}``, checked here without touching
+the filesystem or the database. The scope is compared with the current roots
+by the caller.
+"""
+
+import os
+import re
+
+from .images import _forbidden, _has_traversal
+from .prompts import bad_request
+
+try:
+    from ...utils.media_capture import CAPTURE_EXTENSIONS
+except ImportError:
+    from utils.media_capture import CAPTURE_EXTENSIONS
+
+MAX_TARGET_PATH = 1024
+TARGET_FIELDS = frozenset({"root_index", "root_scope", "path"})
+_HEX64 = re.compile(r"[0-9a-f]{64}")
+TAGGING_MEDIA_MESSAGE = "Only media files can be tagged"
+
+
+def media_target(data: object, *, media_message: str = TAGGING_MEDIA_MESSAGE):
+    """``((index, scope, relative), None)`` for a target, else ``(None, error)``.
+
+    Only the listing identity is accepted: an int root index, the root's
+    64-hex scope and a bounded root-relative POSIX media path, never an
+    absolute, drive-qualified, backslash or ``..`` path (a 400 for a malformed
+    shape, a 403 for an unsafe or non-media path, carrying *media_message*).
+    """
+    if not isinstance(data, dict) or set(data) != TARGET_FIELDS:
+        return None, bad_request("target must name root_index, root_scope and path")
+    index, scope, relative = data["root_index"], data["root_scope"], data["path"]
+    if type(index) is not int or index < 0:
+        return None, bad_request("Invalid gallery root")
+    if not isinstance(scope, str) or _HEX64.fullmatch(scope) is None:
+        return None, bad_request("Invalid gallery root scope")
+    if not isinstance(relative, str) or not relative or len(relative) > MAX_TARGET_PATH:
+        return None, bad_request("path must be a relative media path")
+    parts = relative.split("/")
+    if (
+        "\0" in relative
+        or "\\" in relative
+        or relative.startswith("/")
+        or _has_traversal(relative)
+        or any(part in ("", ".", "..") or ":" in part for part in parts)
+    ):
+        return None, _forbidden()
+    if os.path.splitext(parts[-1])[1].lower() not in CAPTURE_EXTENSIONS:
+        return None, _forbidden(media_message)
+    return (index, scope, relative), None
@@ -1178,6 +1178,8 @@ class PromptRoutesMixin:
                return web.json_response(
                    {"success": False, "error": "Expected a JSON object"}, status=400
                )
+            if "images_filter" in data:
+                return await self._bulk_category_by_filter(data)
            if not data.get("prompt_ids"):
                return web.json_response(
                    {"success": False, "error": "No prompt IDs provided"}, status=400
@@ -1214,6 +1216,66 @@ class PromptRoutesMixin:
                status=500,
            )

+    async def _bulk_category_by_filter(self, data: dict) -> web.Response:
+        """Set the category on every linked positive a listing filter admits.
+
+        #392 "Select all N matching": ``{images_filter, category}``, the filter
+        being the Images listing's own query (parse_listing_filter), resolved
+        now. The answer adds ``prompt_count`` (the distinct linked positives)
+        and ``skipped`` (matching images without one); none linked changes
+        nothing.
+        """
+        from .images import (
+            MAX_LISTING_SELECTION,
+            ListingSourceChanged,
+            parse_listing_filter,
+        )
+
+        def refused(message, **extra):
+            return web.json_response(
+                {"success": False, "error": message, **extra}, status=400
+            )
+
+        if set(data) != {"images_filter", "category"}:
+            return refused("Request must contain exactly category, images_filter")
+        category = data["category"]
+        try:
+            params = parse_listing_filter(data["images_filter"])
+            validate_category(category)
+            selection = await self.resolve_listing_filter(params)
+        except ListingSourceChanged:
+            return web.json_response(
+                {
+                    "success": False,
+                    "code": "source-changed",
+                    "error": "The source changed. Refresh the image collection.",
+                },
+                status=409,
+            )
+        except ValueError as exc:
+            return refused(str(exc))
+        if selection.truncated:
+            return refused(
+                f"Narrow the view to at most {MAX_LISTING_SELECTION:,} images.",
+                code="too-many-images",
+            )
+        category = (category or "").strip()
+        ids = selection.positive_ids
+        updated = (
+            await self._run_in_executor(self.db.bulk_set_category, ids, category)
+            if ids
+            else 0
+        )
+        return web.json_response(
+            {
+                "success": True,
+                "message": f"Set category for {updated} prompts",
+                "updated_count": updated,
+                "prompt_count": len(ids),
+                "skipped": selection.unlinked,
+            }
+        )
+
    def _all_prompts_for_export(self):
        """Every prompt, fetched in EXPORT_PAGE_SIZE pages (blocking)."""
        prompts, offset = [], 0
@@ -0,0 +1,146 @@
+"""Reviewed restores: staged uploads held under single-use tokens (#249 S8).
+
+A restore preview stages the upload (``database/restore_stage.py``) and
+keeps it here under a ``secrets.token_urlsafe(32)`` token with the live
+library's fingerprint and the database identity it was reviewed against.
+``take`` hands the stage to the restore job exactly once; a second apply of
+the token names that job (``PlanUsed``). An expired, discarded or unknown
+token raises ``PlanExpired``; its stage folder is removed. A restart forgets
+every token (the startup sweep removes the folders).
+
+At most ``max_stages`` stages are held. Bytes are bounded by free disk space
+(the upload is refused when the disk has no room, and held stages use that
+disk), not by a fixed budget. A stage being applied belongs to its job and is
+never evicted or counted.
+
+The store is only read and changed on the event loop (it has no lock). Its
+entries own stage folders, whose removal is blocking: every method that
+drops an entry returns it (or keeps it in ``take_doomed``), and the caller
+removes the folder in the executor (``HeldRestore.staged.discard``).
+"""
+
+import secrets
+import time
+from dataclasses import dataclass
+from typing import Any, Callable, Dict, List, Optional
+
+from .maintenance_plans import PlanExpired, PlanUsed
+
+STAGE_TTL_SECONDS = 900
+MAX_STAGES = 2
+_USED_KEPT = 32  # applied tokens remembered for plan-used answers
+
+
+class TooManyStages(Exception):
+    """Every stage slot is held by a reviewed restore."""
+
+
+@dataclass
+class HeldRestore:
+    staged: Any  # database.restore_stage.StagedRestore
+    fingerprint: str
+    db_identity: Any
+    live: Dict[str, int]
+    expires_at: float
+
+
+class RestorePlanStore:
+    def __init__(
+        self,
+        clock: Optional[Callable[[], float]] = None,
+        ttl: float = STAGE_TTL_SECONDS,
+        max_stages: int = MAX_STAGES,
+    ):
+        self._ttl = ttl
+        self._max = max_stages
+        self._clock = clock or time.time
+        self._held: Dict[str, HeldRestore] = {}
+        self._used: Dict[str, str] = {}
+        self._doomed: List[HeldRestore] = []
+
+    @property
+    def ttl(self) -> float:
+        return self._ttl
+
+    def now(self) -> float:
+        return self._clock()
+
+    def __len__(self):
+        return len(self._held)
+
+    def full(self) -> bool:
+        return len(self._held) >= self._max
+
+    def issue(self, staged, fingerprint, db_identity, live) -> str:
+        """Hold ``staged`` and return its token; TooManyStages when full."""
+        if self.full():
+            raise TooManyStages()
+        token = secrets.token_urlsafe(32)
+        self._held[token] = HeldRestore(
+            staged=staged,
+            fingerprint=fingerprint,
+            db_identity=db_identity,
+            live=dict(live),
+            expires_at=self._clock() + self._ttl,
+        )
+        return token
+
+    def peek(self, token) -> HeldRestore:
+        if token in self._used:
+            raise PlanUsed(self._used[token])
+        held = self._held.get(token)
+        if held is None:
+            raise PlanExpired()
+        if held.expires_at <= self._clock():
+            self._doomed.append(self._held.pop(token))
+            raise PlanExpired()
+        return held
+
+    def take(self, token, job_id) -> HeldRestore:
+        """Hand the held stage to the job applying it (single use)."""
+        held = self.peek(token)
+        del self._held[token]
+        self._used[token] = job_id
+        while len(self._used) > _USED_KEPT:
+            self._used.pop(next(iter(self._used)))
+        return held
+
+    def give_back(self, token, held) -> bool:
+        """Hold a taken stage again under its token (its job did not apply it).
+
+        False, holding nothing, when the review expired meanwhile or its slot
+        was reused (the store is full): the caller then discards the stage.
+        """
+        if held.expires_at <= self._clock() or self.full():
+            return False
+        self._used.pop(token, None)
+        self._held[token] = held
+        return True
+
+    def entry(self, token) -> Optional[HeldRestore]:
+        """The held entry, expired or not (for the response that issued it)."""
+        return self._held.get(token)
+
+    def pop(self, token) -> Optional[HeldRestore]:
+        """Drop the token; its entry (to discard) or None when it was not held."""
+        return self._held.pop(token, None)
+
+    def pop_expired(self) -> List[HeldRestore]:
+        """Drop every expired entry; them, with any ``peek`` found expired."""
+        now = self._clock()
+        expired = [t for t, held in self._held.items() if held.expires_at <= now]
+        return [self._held.pop(token) for token in expired] + self.take_doomed()
+
+    def pop_all(self) -> List[HeldRestore]:
+        """Drop every entry (the library was replaced); them, to discard."""
+        held = list(self._held.values()) + self.take_doomed()
+        self._held.clear()
+        return held
+
+    def take_doomed(self) -> List[HeldRestore]:
+        doomed, self._doomed = self._doomed, []
+        return doomed
+
+    def next_expiry(self) -> Optional[float]:
+        """When the soonest held entry expires (clock time), or None."""
+        return min((held.expires_at for held in self._held.values()), default=None)
@@ -31,6 +31,8 @@ from aiohttp import web
 from .annotations import _HEX64, _TOKEN, _UUID, _capture_error, _error
 from .images import media_thumbnail_url
 from .inspection_service import VIDEO_EXTENSIONS
+from .job_routes import busy_response
+from .jobs import JobBusy
 from .prompts import bad_request

 try:
@@ -239,6 +241,9 @@ def _side_label(titles: dict, side, empty: str) -> str:
    return display_title(titles.get(stored, ()), text) or empty


+REVIEW_DECISION_LEASE = "Needs review decision"
+
+
 class ReviewRoutesMixin:
    """The Needs review queue over E1's schema and E2's recorded items."""

@@ -446,7 +451,20 @@ class ReviewRoutesMixin:
    # -- decision --------------------------------------------------------------

    async def decide_review_item(self, request: web.Request) -> web.Response:
-        """POST one explicit decision on one pending item."""
+        """POST one explicit decision on one pending item.
+
+        The decision runs under a registry lease (#249 S8): it is refused
+        (409 ``busy``) while a restore or another ``exclusive`` job runs, and
+        a restore waits for decisions already running before it switches the
+        database. Decisions never refuse one another or a scan.
+        """
+        try:
+            async with self._jobs.lease(REVIEW_DECISION_LEASE):
+                return await self._decide_review_item(request)
+        except JobBusy as busy:
+            return busy_response(busy)
+
+    async def _decide_review_item(self, request: web.Request) -> web.Response:
        data, error = await self._read_json_body(request, max_bytes=MAX_BODY_BYTES)
        if error is not None:
            return error
@@ -659,7 +677,14 @@ def _verify_and_read(store, capture, item, root, need_metadata: bool):
    facts = store.verify(root, relative)
    captured = None
    if need_metadata:
-        captured = captured_review(store, capture, item_profile(item["evidence"]))
+        # The file's own name, so an inspection item resolves anchored on its
+        # saver as it was recorded (#390).
+        captured = captured_review(
+            store,
+            capture,
+            item_profile(item["evidence"]),
+            relative.rsplit("/", 1)[-1],
+        )
    return relative, facts, captured


@@ -705,6 +730,9 @@ def _candidate_still_offered(resolution: dict, choice: str) -> bool:
    that rewords the top-level reason or reorders candidates leaves a
    pending item applicable.
    """
+    if isinstance(resolution, dict) and resolution.get("anchor") == "saver":
+        # Only the saver anchor resolves the bytes (#390): its pair alone.
+        resolution = {"state": "ambiguous", "candidates": [resolution]}
    if not isinstance(resolution, dict) or resolution.get("state") != "ambiguous":
        return False
    evidence, _count, limited = review_evidence(resolution)
@@ -88,7 +88,8 @@ class ReviewRecordingMixin:
    def _record_scanned_review(self, media_file, roots, review=None, scanned=None):
        """Record one ambiguous, unlinked scanned file (logged and counted).

-        ``scanned`` is the scan's ``(metadata, inspection_resolution)``.
+        ``scanned`` is the scan's ``(metadata, inspection_resolution)``; the
+        resolution is None when the scan did not run the inspection profile.
        """
        try:
            outcome = self._record_review_sync(
@@ -199,7 +200,7 @@ class ReviewRecordingMixin:
        key = _memory_key(locator)
        if state is not None and memory.get(key) == state:
            return None
-        resolution = review_capture.inspection_choice(canonical)
+        resolution = review_capture.inspection_choice(canonical, media_file.name)
        if resolution is not None:
            memory.pop(key, None)
            return canonical, resolution
@@ -13,6 +13,7 @@ checks one path and writes nothing.
 """

 import contextlib
+import functools
 import os

 from aiohttp import web
@@ -23,9 +24,11 @@ from ..config_store import (
    get_config_store,
 )
 from . import sources
+from . import thumbnail_encode
+from . import thumbnail_settings
 from .admin import _current_image_monitor
 from .job_routes import busy_response
-from .jobs import JobBusy
+from .jobs import THUMBNAILS_JOB_KIND, JobBusy

 try:
    from ...utils.validators import validate_result_timeout, validate_worker_threads
@@ -41,9 +44,26 @@ _SETTINGS_FILE_KEYS = {
    "WORKER_THREADS": ("performance", "worker_threads"),
    "MONITORING_ENABLED": ("gallery", "monitoring", "enabled"),
    "SAFETY_BACKUP": ("maintenance", "safety_backup"),
+    "THUMBNAIL_FORMAT": ("thumbnails", "format"),
+    "THUMBNAIL_QUALITY": ("thumbnails", "quality"),
+    "THUMBNAIL_EDGE": ("thumbnails", "edge"),
+    # The one tagging configuration (#328), published to AutotagConfig.
+    "AUTOTAG_MODEL_TYPE": ("autotag", "defaults", "model_type"),
+    "AUTOTAG_EXISTING": ("autotag", "defaults", "existing"),
+    "AUTOTAG_GENERAL_THRESHOLD": ("autotag", "defaults", "general_threshold"),
+    "AUTOTAG_CHARACTER_THRESHOLD": ("autotag", "defaults", "character_threshold"),
+    "AUTOTAG_TEMPLATE": ("autotag", "defaults", "template"),
+    "AUTOTAG_SUGGESTION_LIMIT": ("autotag", "defaults", "suggestion_limit"),
 }
+# The thumbnail settings a running Convert outdated job fixes (#317).
+_THUMBNAIL_SETTINGS = ("THUMBNAIL_FORMAT", "THUMBNAIL_QUALITY", "THUMBNAIL_EDGE")
 # Attributes that live on GalleryConfig; the others on PromptManagerConfig.
 _GALLERY_SETTINGS = frozenset({"MONITORING_ENABLED"})
+# Attributes that live on AutotagConfig, named without the AUTOTAG_ prefix.
+_AUTOTAG_SETTINGS = frozenset(
+    name for name in _SETTINGS_FILE_KEYS if name.startswith("AUTOTAG_")
+)
+_AUTOTAG_PREFIX = "AUTOTAG_"
 SOURCE_CHANGE_JOB_KIND = "source_change"
 SOURCE_CHANGE_JOB_TITLE = "Source change"

@@ -143,6 +163,63 @@ def _set_nested(config, sections, key, value):
    config[sections[0]] = merged


+def _validate_autotag_settings(data):
+    """The ``autotag_*`` settings as ``{AUTOTAG_ATTR: value}``.
+
+    The first bad value raises ValueError with a message that names the
+    setting by its label in System › Auto-tagging.
+    """
+    from ..config import (
+        EXISTING_POLICIES,
+        MAX_SUGGESTION_LIMIT,
+        MODEL_TYPES,
+        validate_saved_threshold,
+        validate_template,
+    )
+
+    updates = {}
+    if "autotag_model_type" in data:
+        value = data["autotag_model_type"]
+        if not isinstance(value, str) or value not in MODEL_TYPES:
+            raise ValueError(
+                "Tagging model must be one of " + ", ".join(sorted(MODEL_TYPES)) + "."
+            )
+        updates["AUTOTAG_MODEL_TYPE"] = value
+    if "autotag_existing" in data:
+        value = data["autotag_existing"]
+        if not isinstance(value, str) or value not in EXISTING_POLICIES:
+            raise ValueError(
+                "Existing tags must be skip, merge or replace_after_review."
+            )
+        updates["AUTOTAG_EXISTING"] = value
+    for key, label in (
+        ("autotag_general_threshold", "General-tag confidence"),
+        ("autotag_character_threshold", "Character-tag confidence"),
+    ):
+        if key in data:
+            try:
+                value = validate_saved_threshold(label, data[key])
+            except ValueError as error:
+                raise ValueError(f"{error}.") from None
+            updates[key.upper()] = value
+    if "autotag_template" in data:
+        try:
+            updates["AUTOTAG_TEMPLATE"] = validate_template(
+                data["autotag_template"], "LLM tag template"
+            )
+        except ValueError as error:
+            raise ValueError(f"{error}.") from None
+    if "autotag_suggestion_limit" in data:
+        value = data["autotag_suggestion_limit"]
+        if type(value) is not int or not 1 <= value <= MAX_SUGGESTION_LIMIT:
+            raise ValueError(
+                "Suggestions per image must be a whole number from 1 to "
+                f"{MAX_SUGGESTION_LIMIT}."
+            )
+        updates["AUTOTAG_SUGGESTION_LIMIT"] = value
+    return updates
+
+
 async def _read_json(request):
    """Parse a JSON object body through the package's capped reader."""
    from . import _read_json_body
@@ -169,19 +246,22 @@ class SettingsRoutesMixin:
    async def get_settings(self, request):
        """Get current settings."""
        try:
-            from ..config import PromptManagerConfig, GalleryConfig
+            from ..config import AutotagConfig, PromptManagerConfig, GalleryConfig

            root_paths = [
                self._public_path(d) for d in GalleryConfig.MONITORING_DIRECTORIES
            ]
            revision = await self._run_in_executor(self._config_revision)
            source_status, monitor = await self._run_in_executor(self._source_status)
+            # #317: which thumbnail formats can be written (a cached probe).
+            encoders = await self._run_in_executor(thumbnail_encode.encoder_status)
            return web.json_response(
                {
                    "success": True,
                    **revision,
                    "sources": source_status,
                    "monitor": monitor,
+                    "thumbnail_encoders": encoders,
                    "settings": {
                        "monitoring_enabled": GalleryConfig.MONITORING_ENABLED,
                        "result_timeout": PromptManagerConfig.RESULT_TIMEOUT,
@@ -189,6 +269,17 @@ class SettingsRoutesMixin:
                        "infinite_scroll": PromptManagerConfig.INFINITE_SCROLL,
                        "worker_threads": PromptManagerConfig.WORKER_THREADS,
                        "safety_backup": PromptManagerConfig.SAFETY_BACKUP,
+                        "thumbnail_format": PromptManagerConfig.THUMBNAIL_FORMAT,
+                        "thumbnail_quality": PromptManagerConfig.THUMBNAIL_QUALITY,
+                        "thumbnail_edge": PromptManagerConfig.THUMBNAIL_EDGE,
+                        "autotag_model_type": AutotagConfig.MODEL_TYPE,
+                        "autotag_existing": AutotagConfig.EXISTING,
+                        "autotag_general_threshold": AutotagConfig.GENERAL_THRESHOLD,
+                        "autotag_character_threshold": (
+                            AutotagConfig.CHARACTER_THRESHOLD
+                        ),
+                        "autotag_template": AutotagConfig.TEMPLATE,
+                        "autotag_suggestion_limit": AutotagConfig.SUGGESTION_LIMIT,
                        "cpu_count": PromptManagerConfig.max_worker_threads(),
                        "gallery_root_paths": root_paths,
                        "gallery_root_path": root_paths[0] if root_paths else "",
@@ -295,6 +386,26 @@ class SettingsRoutesMixin:
                return web.json_response(
                    {"success": False, "error": str(ve)}, status=400
                )
+            if updates.get("THUMBNAIL_FORMAT") == "jxl":
+                # #317: JPEG XL only with an encoder (a cached probe).
+                encoder = await self._run_in_executor(
+                    functools.partial(
+                        thumbnail_encode.detect_jxl_encoder, recheck_missing=True
+                    )
+                )
+                if encoder is None:
+                    return web.json_response(
+                        {
+                            "success": False,
+                            "code": "jxl-unavailable",
+                            "error": thumbnail_encode.JXL_UNAVAILABLE,
+                        },
+                        status=400,
+                    )
+
+            refused = self._thumbnail_change_refused(updates)
+            if refused is not None:
+                return refused

            # Off the loop: an accepted root is resolved (filesystem access).
            new_roots, error = await self._run_in_executor(
@@ -355,6 +466,33 @@ class SettingsRoutesMixin:
                status=500,
            )

+    def _thumbnail_change_refused(self, updates):
+        """409 ``busy`` for a thumbnail format, quality or size change while
+        Convert outdated runs (review I4): the job converts to the settings
+        it started with, and a change under it would make it remove previews
+        in the newly chosen format. Unchanged values pass."""
+        from ..config import PromptManagerConfig
+
+        changed = any(
+            key in updates and updates[key] != getattr(PromptManagerConfig, key)
+            for key in _THUMBNAIL_SETTINGS
+        )
+        job = self._jobs.active(THUMBNAILS_JOB_KIND) if changed else None
+        if job is None or job.scope.get("mode") != "convert":
+            return None
+        return web.json_response(
+            {
+                "success": False,
+                "code": "busy",
+                "error": (
+                    f"{job.title} is running. Change the thumbnail settings "
+                    "when it finishes, or cancel it first."
+                ),
+                "running": {"id": job.id, "title": job.title},
+            },
+            status=409,
+        )
+
    def _publish_settings(self, updates, new_roots):
        """Install committed settings at runtime (inside the config commit).

@@ -364,7 +502,12 @@ class SettingsRoutesMixin:
        """
        from ..config import GalleryConfig, PromptManagerConfig

+        from ..config import AutotagConfig
+
        for name, value in updates.items():
+            if name in _AUTOTAG_SETTINGS:
+                setattr(AutotagConfig, name[len(_AUTOTAG_PREFIX) :], value)
+                continue
            owner = GalleryConfig if name in _GALLERY_SETTINGS else PromptManagerConfig
            setattr(owner, name, value)
        restart_fields = []
@@ -491,6 +634,19 @@ class SettingsRoutesMixin:
            updates["WORKER_THREADS"] = validate_worker_threads(
                data["worker_threads"], PromptManagerConfig.max_worker_threads()
            )
+        if "thumbnail_format" in data:
+            updates["THUMBNAIL_FORMAT"] = thumbnail_settings.validate_format(
+                data["thumbnail_format"]
+            )
+        if "thumbnail_quality" in data:
+            updates["THUMBNAIL_QUALITY"] = thumbnail_settings.validate_quality(
+                data["thumbnail_quality"]
+            )
+        if "thumbnail_edge" in data:
+            updates["THUMBNAIL_EDGE"] = thumbnail_settings.validate_edge(
+                data["thumbnail_edge"]
+            )
+        updates.update(_validate_autotag_settings(data))
        return updates

    def _parse_gallery_roots(self, data):
@@ -13,7 +13,9 @@
 - ``describe_sources`` (blocking: it resolves paths) reports the configured
  sources with their validity, the effective sources with their listing
  index and watch state, and the image monitor's state. Every path in it is
-  a public path (``_public_path``), never an absolute one.
+  a public path (``_public_path``), never an absolute one; ``in_comfyui``
+  says whether an effective source's public path is relative to the ComfyUI
+  base (``in_comfyui_base``), so the page can read it as ``ComfyUI/<path>``.

 A source's watch state is ``watching`` when the monitor's observer is alive,
 scheduled that directory and monitoring is on; ``stopping`` when it still
@@ -209,6 +211,27 @@ def watch_state(path, *, present, alive, scheduled_keys, enabled):
    return "restart_pending"


+def in_comfyui_base(path):
+    """Whether ``_public_path(path)`` is relative to the ComfyUI base directory.
+
+    The base is the first anchor ``_public_path`` tries, so this agrees with
+    it: the same canonical (realpath + normcase) spelling on both sides.
+    """
+    from pathlib import Path
+
+    from ..config import _comfyui_base_directory
+
+    base = _comfyui_base_directory()
+    if not path or not base:
+        return False
+    try:
+        canonical = Path(os.path.normcase(os.path.realpath(str(path))))
+        anchor = Path(os.path.normcase(os.path.realpath(base)))
+    except (OSError, ValueError):
+        return False
+    return canonical.is_relative_to(anchor)
+
+
 def describe_sources(*, configured, output_dirs, auto_detected, monitor, enabled):
    """``(sources, monitor)`` for GET /settings (blocking; public paths only).

@@ -233,6 +256,7 @@ def describe_sources(*, configured, output_dirs, auto_detected, monitor, enabled
                scheduled_keys=scheduled_keys,
                enabled=enabled,
            ),
+            "in_comfyui": in_comfyui_base(path),
        }
        for index, path in enumerate(output_dirs)
    ]
@@ -168,9 +168,10 @@ class SystemRoutesMixin:
        from ..config import GalleryConfig

        try:
-            (output_dirs, auto_detected), counts = await _gather_settled(
+            (output_dirs, auto_detected), counts, location = await _gather_settled(
                self._run_in_executor(self._output_dirs_with_origin),
                self._run_in_executor(self.db.library_counts),
+                self._run_in_executor(self._library_payload),
            )
        except Exception:
            self.logger.exception("System overview failed")
@@ -194,6 +195,8 @@ class SystemRoutesMixin:
                    "effective": len(output_dirs),
                    "auto_detected": auto_detected,
                },
+                # Where the library lives and why (py/api/library_location.py).
+                "location": location,
            },
            headers={"Cache-Control": "no-store"},
        )
@@ -33,9 +33,11 @@ previews behind those URLs are made here, in three ways:
  (missing only, visible and cancellable) instead of writing them silently,
  and fewer go through the worker.

-Every preview is written by ``_generate_one`` with the thumbnail job's default
-size and quality (``DEFAULT_THUMBNAIL_EDGE``, medium), into a temp sibling
-renamed over the old one, so a reader never sees a partial file.
+Every preview is written by ``_generate_one`` with the server's thumbnail
+settings (format, quality, size limit; ``thumbnail_settings``, #317), into a
+temp sibling verified and renamed over the old one, so a reader never sees a
+partial file. A request for an older preview name (``_thumb.png``) is answered
+with the preview in the current format.

 Holds: automatic previews only write files under ``thumbnails/`` and never
 touch the database, like the thumbnail job, so they run beside a scan, image
@@ -63,11 +65,10 @@ from pathlib import Path

 from aiohttp import web

+from . import thumbnail_settings
 from .images import (
-    GALLERY_IMAGE_EXTENSIONS,
    MEDIA_EXTENSIONS,
    THUMBNAIL_CLEAR_TITLE,
-    THUMBNAIL_ENCODINGS,
    VIDEO_EXTENSIONS,
    _has_traversal,
    _is_within,
@@ -83,16 +84,25 @@ from .jobs import (
    JobBusy,
 )
 from .settings_routes import SOURCE_CHANGE_JOB_KIND
-from .thumbnail_jobs import DEFAULT_THUMBNAIL_EDGE, ThumbnailOptions
+from .thumbnail_encode import shutdown_encoders, writer_settings
+from .thumbnail_jobs import ThumbnailOptions

 try:
-    from ...utils.parallel import map_parallel
+    from ...utils.parallel import map_parallel, note_refusal, refused_at_shutdown
 except ImportError:  # tests import the package top-level
-    from utils.parallel import map_parallel
+    from utils.parallel import map_parallel, note_refusal, refused_at_shutdown

-AUTO_THUMBNAIL_EDGE = DEFAULT_THUMBNAIL_EDGE
-AUTO_THUMBNAIL_SIZE = (AUTO_THUMBNAIL_EDGE, AUTO_THUMBNAIL_EDGE)
-AUTO_THUMBNAIL_ENCODING = THUMBNAIL_ENCODINGS["medium"]
+try:
+    from ...utils.exit_signal import ExitRequested
+except ImportError:  # tests import the package top-level
+    from utils.exit_signal import ExitRequested
+
+# The placeholder frame a video without a preview is answered with (JPEG
+# bytes, never written to disk); written previews follow the settings.
+PLACEHOLDER_SIZE = (thumbnail_settings.DEFAULT_EDGE, thumbnail_settings.DEFAULT_EDGE)
+PLACEHOLDER_QUALITY = 85
+# Source extensions in the order a shared preview name looks for them (R2).
+_SOURCE_ORDER = thumbnail_settings.IMAGE_SOURCE_ORDER + tuple(sorted(VIDEO_EXTENSIONS))
 # Previews views may write at once (the size of the view pool).
 ON_DEMAND_LIMIT = 3
 # View requests that may wait on the gate; one more gets its fallback at once.
@@ -146,8 +156,8 @@ def _dst_key(dst):
 def video_placeholder_jpeg():
    """The placeholder frame as JPEG bytes (a video whose preview is missing)."""
    buffer = io.BytesIO()
-    _video_placeholder_image(AUTO_THUMBNAIL_SIZE).save(
-        buffer, "JPEG", **AUTO_THUMBNAIL_ENCODING
+    _video_placeholder_image(PLACEHOLDER_SIZE).save(
+        buffer, "JPEG", quality=PLACEHOLDER_QUALITY, optimize=True
    )
    return buffer.getvalue()

@@ -171,7 +181,7 @@ def _is_preview_request(filepath):
        stem.endswith("_thumb")
        and len(stem) > len("_thumb")
        and extension == extension.lower()
-        and extension in GALLERY_IMAGE_EXTENSIONS
+        and extension in thumbnail_settings.THUMBNAIL_EXTENSIONS
    )


@@ -184,12 +194,27 @@ def _regular_file(path):


 def _candidates(parts):
-    """``(folder parts, base, extensions)`` of a checked preview request."""
+    """``(folder parts, base, source extensions)`` of a checked preview
+    request: every media extension that owns the requested preview name
+    (``thumbnail_settings.owns``), images first (ruling R2)."""
    stem, extension = os.path.splitext(parts[-1])
-    wanted = [extension] + (sorted(VIDEO_EXTENSIONS) if extension == ".jpg" else [])
+    wanted = [
+        source
+        for source in _SOURCE_ORDER
+        if source in MEDIA_EXTENSIONS and thumbnail_settings.owns(extension, source)
+    ]
    return parts[1:-1], stem[: -len("_thumb")], wanted


+def _current_preview(root, parts):
+    """The preview *parts* names, in the format written now (#317): a request
+    for an older name (``_thumb.png`` before a conversion) is answered with
+    the current file."""
+    _folder, base, _wanted = _candidates(parts)
+    name = base + thumbnail_settings.THUMB_SUFFIX + writer_settings().extension
+    return Path(root).joinpath(*parts[:-1], name)
+
+
 def _quick_source(root, parts):
    """``(src, is_video)`` by exact name only (no folder listing), or None."""
    root = Path(root)
@@ -207,11 +232,12 @@ def _thumbnail_source(root, parts):
    """``(src, dst, is_video)`` for the preview *parts* under *root*, or None.

    *parts* passed ``_is_preview_request``. The source has the preview's name
-    without ``_thumb`` and an extension that previews as the requested one
-    (any case: exact names first, then one listing of the folder); a ``.jpg``
-    may also be a video's. It must be a regular file inside *root*. ``dst``
-    is None when the preview's folder resolves outside ``root/thumbnails`` (a
-    link): nothing is written there.
+    without ``_thumb`` and an extension that owns the requested one (any case:
+    exact names first, then one listing of the folder; ruling R4). It must be
+    a regular file inside *root*. ``dst`` is the preview in the format written
+    now (#317), whatever extension was requested; it is None when the
+    preview's folder resolves outside ``root/thumbnails`` (a link): nothing is
+    written there.
    """
    root = Path(root)
    folder_parts, base, wanted = _candidates(parts)
@@ -224,7 +250,7 @@ def _thumbnail_source(root, parts):
            return None
    rel = Path(*folder_parts, found.name)
    dst = root / media_thumbnail_rel(rel)
-    if dst != root.joinpath(*parts):
+    if dst != _current_preview(root, parts):
        return None
    if not _is_within(root / "thumbnails", root) or not _is_within(
        dst, root / "thumbnails"
@@ -389,7 +415,8 @@ class AutoThumbnailer:

    def enqueue(self, src, dst, is_video):
        """Queue *dst*'s preview for the worker; False when already queued,
-        full or closed. Never blocks on a write."""
+        full, closed or its worker is refused at interpreter exit. Never
+        blocks on a write."""
        key = _dst_key(dst)
        with self._changed:
            if self._closed or key in self._queued:
@@ -399,34 +426,47 @@ class AutoThumbnailer:
            self._queued.add(key)
            self._queue.append((key, Path(src), Path(dst), bool(is_video)))
            self._busy = True
+            started = True
            if self._start_worker and not self._worker_running:
-                self._start_worker_locked()
+                started = self._start_worker_locked()
+            if not started:
+                # Refused at interpreter exit: no worker will take it (#375).
+                self._queue.pop()
+                self._queued.discard(key)
            self._changed.notify_all()
-        return True
+        return started

    def _start_worker_locked(self):
-        """Start the worker (lock held). A start that fails leaves the file
-        queued and the next enqueue tries again."""
+        """Start the worker (lock held); False only when the interpreter is
+        exiting (#375: logged once at DEBUG, the caller drops the file).
+        Another start failure leaves the file queued and the next enqueue
+        tries again."""
        worker = threading.Thread(target=self._run, name=WORKER_NAME, daemon=True)
        worker.pm_preview_token = _MODULE_TOKEN
        worker.pm_preview_close = self.close
        self._worker_running = True
        try:
            worker.start()
-        except RuntimeError:
+        except RuntimeError as error:
            self._worker_running = False
            self._busy = False
+            if refused_at_shutdown(error):
+                note_refusal(self._logger, "The automatic preview worker")
+                return False
            self._logger.warning(
                "The automatic preview worker could not start; the next output "
                "tries again",
                exc_info=True,
            )
-            return
+            return True
        self._worker = worker
+        return True

    def _run(self):
        try:
            self._drain()
+        except ExitRequested:
+            pass  # #376: the interpreter is exiting; queued files are dropped
        except Exception:
            self._logger.warning("The automatic preview worker stopped", exc_info=True)
        finally:
@@ -467,10 +507,16 @@ class AutoThumbnailer:
                f"Automatic preview failed for {src.name}", exc_info=True
            )

-    def close(self):
+    def close(self, timeout=None):
        """Stop the worker at its next file boundary (queued files are
-        dropped), kill a running ffmpeg and wait up to CLOSE_WAIT_SECONDS;
-        a worker still running after that is logged."""
+        dropped), kill a running ffmpeg and wait up to ``timeout`` seconds
+        (None: CLOSE_WAIT_SECONDS, read now); a worker still running after
+        that is logged.
+
+        Returns True when there was no worker or it ended; False when it is
+        still running, or when called on the worker itself (it only signals).
+        """
+        wait = CLOSE_WAIT_SECONDS if timeout is None else timeout
        with self._changed:
            self._closed = True
            self._queue.clear()
@@ -483,14 +529,18 @@ class AutoThumbnailer:
                process.kill()
            except OSError:
                pass
-        if worker is None or worker is threading.current_thread():
-            return
-        worker.join(CLOSE_WAIT_SECONDS)
+        if worker is None:
+            return True
+        if worker is threading.current_thread():
+            return False
+        worker.join(wait)
        if worker.is_alive():
            self._logger.warning(
                "The automatic preview worker is still running after "
-                f"{CLOSE_WAIT_SECONDS} s; it stops at its next file"
+                f"{wait} s; it stops at its next file"
            )
+            return False
+        return True

    # ── waits (tests and shutdown; never timers) ──────────────────────

@@ -588,12 +638,19 @@ class AutoThumbnailMixin:
                )
            return self._auto_thumbnailer

-    def close_auto_thumbnails(self, final=False):
+    def refuse_auto_thumbnails(self):
+        """Refuse every later capture without stopping the worker yet (the
+        package teardown, before ``close_auto_thumbnails(final=True)``)."""
+        with AutoThumbnailMixin._auto_thumbnailer_lock:
+            self._auto_thumbnails_shut = True
+
+    def close_auto_thumbnails(self, final=False, timeout=None):
        """Stop the capture worker and the view pool, and forget them.

-        Bounded (see AutoThumbnailer.close). ``final`` (the app's cleanup)
-        also keeps a late monitor event from starting a worker again; a
-        test reset passes False and the next use starts fresh ones.
+        Bounded by ``timeout`` (see AutoThumbnailer.close). ``final`` (the
+        package teardown) also keeps a late monitor event from starting a
+        worker again; a test reset passes False and the next use starts
+        fresh ones. Returns True when no capture worker is left running.
        """
        with AutoThumbnailMixin._auto_thumbnailer_lock:
            if final:
@@ -601,10 +658,14 @@ class AutoThumbnailMixin:
            thumbnailer, self._auto_thumbnailer = self._auto_thumbnailer, None
            pool, self._preview_pool_obj = self._preview_pool_obj, None
            self._preview_gate_obj = None
+        closed = True
        if thumbnailer is not None:
-            thumbnailer.close()
+            closed = thumbnailer.close(timeout)
        if pool is not None:
            pool.shutdown(wait=False, cancel_futures=True)
+        if final:
+            shutdown_encoders()  # kill JPEG XL / ffmpeg encoders still running
+        return closed

    def _auto_thumbnail_failures(self):
        thumbnailer = self._auto_thumbnailer
@@ -614,9 +675,8 @@ class AutoThumbnailMixin:
        return self._generate_one(
            src,
            dst,
-            AUTO_THUMBNAIL_SIZE,
+            writer_settings(),
            is_video,
-            encoding=AUTO_THUMBNAIL_ENCODING,
            stop=stop,
            guard=guard,
            track=track,
@@ -730,7 +790,7 @@ class AutoThumbnailMixin:
                if quick is None:
                    continue
                return self._preview_response(BUSY, quick[0], None, quick[1])
-            dst = root.joinpath(*parts)
+            dst = _current_preview(root, parts)
            if outcome == READY:
                return self._file_response(dst)
            located = await gate.loop.run_in_executor(
@@ -749,8 +809,8 @@ class AutoThumbnailMixin:

        Returns ``queued``, ``fresh`` (its preview is current) or ``skipped``
        (not a media file under a current root, a link, a preview itself,
-        already queued, or after the app's cleanup). Never writes on the
-        caller's thread.
+        already queued, after the app's cleanup, or when its worker is refused
+        at interpreter exit). Never writes on the caller's thread.
        """
        if self._auto_thumbnails_shut:
            return "skipped"
@@ -807,7 +867,7 @@ class AutoThumbnailMixin:
        plan = await self._run_in_executor(self._plan_gallery_thumbnails, output_dirs)
        missing = len(plan["targets"]) + plan["remaining"]
        if missing >= SCAN_THUMBNAIL_JOB_THRESHOLD:
-            options = ThumbnailOptions("missing", AUTO_THUMBNAIL_EDGE, "medium")
+            options = ThumbnailOptions("missing", writer_settings())
            try:
                self._start_thumbnail_job(options)
            except JobBusy as busy:
@@ -0,0 +1,404 @@
+"""Convert outdated thumbnails (#317): an explicit, cancellable Activity job.
+
+``POST /prompt_manager/jobs/thumbnails {mode: "convert"}`` (and
+``GET /prompt_manager/images/thumbnails/plan?mode=convert`` for its count)
+starts "Convert outdated thumbnails": the thumbnail job's kind, ``guarded``
+admission (never beside a record-changing job such as a scan, a restore or
+a duplicate removal; one thumbnail job at a time), its worker threads and
+its outcome groups. Nothing converts on its own: changing the format in
+Appearance only makes previews "outdated".
+
+A preview is outdated when the file owns one in another format than the one
+written now (``writer_settings``: a legacy ``_thumb.png``, or a format
+switched away from). For each such file, at a file boundary (Cancel keeps
+what was converted):
+
+1. the new preview is written from the SOURCE media in the configured
+   format (``_generate_one``: atomic, verified to decode; a video whose frame
+   cannot be decoded fails rather than getting the placeholder), unless a
+   current preview at least as new as the source is already there and
+   decodes;
+2. only then are that file's old-format previews removed: regular files (no
+   links) in its ``thumbnails/`` folder, owned by that source
+   (``thumbnail_settings.owns``), with the source still present. One already
+   gone counts as removed.
+
+Files sharing a stem in one folder (``x.png`` and ``x.mp4``) share one
+preview (ruling R2), so they are converted once, as a group: the preview is
+made from the first source in ``thumbnail_settings.source_rank`` order
+(``.png``, ``.jpg``, ``.jpeg``, ``.webp``, ``.gif``, then videos), the old
+previews of every source in the group are removed, and each removed or
+written file's bytes count once.
+
+A failure keeps the old preview. Previews whose source is gone (orphans) are
+never planned, so never touched. The format the job converts to is fixed
+when it starts; Appearance refuses a thumbnail settings change while it runs
+(409), and should the format still change underneath, the job stops at the
+next file without removing anything in another format. The final status line
+reads "N converted · F failed · <bytes before> → <bytes after>".
+"""
+
+import asyncio
+import functools
+import os
+import time
+from pathlib import Path
+
+from . import thumbnail_settings
+from .thumbnail_encode import ThumbnailVerifyError, verify_thumbnail, writer_settings
+from .admin import _plural, _scan_location, _scan_roots, _scan_status_line
+from .images import _thumbnail_is_fresh, _worker_threads, _thumbnail_batch_size
+from .prompts import safe_error_message
+
+try:
+    from ...utils.parallel import map_parallel
+except ImportError:  # tests import the package top-level
+    from utils.parallel import map_parallel
+
+CONVERT_JOB_TITLE = "Convert outdated thumbnails"
+NOTHING_OUTDATED = "No outdated previews to convert"
+CANCELLED_BEFORE_CONVERTING = "Cancelled before any preview was converted"
+SOURCE_GONE = "The file is gone; its old preview was kept"
+OLD_NOT_REMOVED = "Converted; the old preview could not be removed"
+FORMAT_CHANGED = (
+    "Stopped: the thumbnail format changed while converting · "
+    "{converted} converted. Run Convert outdated again."
+)
+_UNITS = ("B", "KB", "MB", "GB", "TB")
+
+
+def readable_bytes(count):
+    """``1.5 KB``-style size (whole bytes below 1 KB)."""
+    size = float(count)
+    for unit in _UNITS:
+        if size < 1024 or unit == _UNITS[-1]:
+            return f"{int(size)} B" if unit == "B" else f"{size:.1f} {unit}"
+        size /= 1024
+    return f"{size:.1f} {_UNITS[-1]}"  # pragma: no cover - loop always returns
+
+
+def _old_previews(src, dst, settings):
+    """``[(path, size)]``: *src*'s previews beside *dst* in another format."""
+    stem = dst.name[: -len(dst.suffix)] if dst.suffix else dst.name
+    old = []
+    for path in thumbnail_settings.owned_in_folder(
+        dst.parent, stem, src.suffix, settings.extension
+    ):
+        if path.suffix == settings.extension:
+            continue
+        try:
+            old.append((path, path.stat().st_size))
+        except OSError:
+            continue
+    return old
+
+
+def _group_targets(targets):
+    """``[[(src, dst, is_video)]]``: targets sharing a preview name (one
+    folder, one stem) in one group, its first source first (R2)."""
+    groups = {}
+    for target in targets:
+        dst = Path(target[1])
+        key = os.path.normcase(str(dst.with_suffix("")))
+        groups.setdefault(key, []).append(target)
+    ordered = []
+    for group in groups.values():
+        group.sort(
+            key=lambda t: (thumbnail_settings.source_rank(Path(t[0]).suffix), str(t[0]))
+        )
+        ordered.append(group)
+    return ordered
+
+
+def _same_file(a, b):
+    """Whether *a* and *b* name one file (re-review N1: on a case-insensitive
+    disk ``x_thumb.JPG`` is the ``x_thumb.jpg`` just written). Without inode
+    numbers (st_ino 0 on some SMB/FAT mounts) the resolved, normcased paths
+    are compared."""
+    try:
+        first, second = os.stat(a), os.stat(b)
+    except OSError:
+        return False
+    if first.st_ino and second.st_ino:
+        return (first.st_dev, first.st_ino) == (second.st_dev, second.st_ino)
+    return os.path.normcase(os.path.realpath(a)) == os.path.normcase(
+        os.path.realpath(b)
+    )
+
+
+def _format_changed(settings):
+    """Whether previews are written in another format than *settings* now."""
+    return writer_settings().extension != settings.extension
+
+
+def _finished_line(totals, remaining):
+    line = (
+        f"{totals['converted']:,} converted · {totals['failed']:,} failed · "
+        f"{readable_bytes(totals['before'])} → {readable_bytes(totals['after'])}"
+    )
+    if remaining:
+        line += f" · {remaining:,} more on the next run"
+    return line
+
+
+class ThumbnailConvertMixin:
+    """The Convert outdated job (started through ``_start_thumbnail_job``)."""
+
+    async def _run_convert_job(self, job, options):
+        try:
+            state = await self._convert_job_body(job, options)
+        except Exception:
+            self.logger.exception("Thumbnail conversion failed")
+            job.update(status_line="Thumbnail conversion stopped on an internal error.")
+            job.log_line("Conversion failed · internal error")
+            state = "failed"
+        job.finish(state)
+
+    async def _convert_job_body(self, job, options):
+        output_dirs = await self._run_in_executor(self._get_all_output_dirs)
+        if not output_dirs:
+            message = "ComfyUI output directory not found"
+            job.update(status_line=message)
+            job.log_line(f"Conversion failed · {message}")
+            return "failed"
+        folders = _plural(len(output_dirs), "output folder")
+        job.scope["output_folders"] = len(output_dirs)
+        job.update(status_line=f"Looking for outdated previews in {folders}")
+        job.log_line(
+            f"Conversion started · {folders} · to {options.settings.describe()}"
+        )
+        plan = await self._plan_conversion(job, options, output_dirs)
+        if job.cancelled:
+            return self._end_conversion(job, 0, CANCELLED_BEFORE_CONVERTING)
+        if not plan["targets"]:
+            job.update(progress=100, status_line=NOTHING_OUTDATED)
+            job.log_line(f"Conversion finished · {NOTHING_OUTDATED.lower()}")
+            return "finished"
+        totals, left = await self._convert_in_batches(job, options, plan, output_dirs)
+        if totals["stopped"]:
+            job.update(status_line=FORMAT_CHANGED.format(converted=totals["converted"]))
+            job.log_line(
+                "Conversion stopped · the thumbnail format changed · "
+                f"{_plural(totals['converted'], 'preview')} converted"
+            )
+            return "cancelled"
+        if job.cancelled:
+            return self._end_conversion(
+                job,
+                totals["converted"],
+                f"Cancelled · {_plural(totals['converted'], 'preview')} converted",
+            )
+        line = _finished_line(totals, left)
+        job.update(progress=100, status_line=line)
+        job.log_line(f"Conversion finished · {line}")
+        self.logger.info(f"Thumbnail conversion: {line}")
+        return "finished"
+
+    @staticmethod
+    def _end_conversion(job, converted, status_line):
+        job.update(status_line=status_line)
+        job.log_line(
+            f"Conversion cancelled · {_plural(converted, 'preview')} converted"
+        )
+        return "cancelled"
+
+    async def _plan_conversion(self, job, options, output_dirs, exclude=None):
+        """One batch's plan (at most MAX_THUMBNAIL_FILES targets), off-loop."""
+        return await self._run_in_executor(
+            self._plan_gallery_thumbnails,
+            output_dirs,
+            "convert",
+            stop=lambda: job.cancelled,
+            settings=options.settings,
+            exclude=exclude,
+        )
+
+    async def _convert_in_batches(self, job, options, plan, output_dirs):
+        """Convert ``plan``, then plan again after each batch until nothing
+        is left, the job is cancelled or stopped, or a batch converted
+        nothing (files that fail are never planned again). Returns
+        ``(totals across batches, files left)``."""
+        totals = {"converted": 0, "failed": 0, "before": 0, "after": 0}
+        totals["stopped"] = False
+        run = {
+            "index": 0,
+            "batches": 0,
+            "total": len(plan["targets"]) + plan["remaining"],
+        }
+        run["start"] = time.monotonic()
+        job.update(
+            total=run["total"], status_line=_scan_status_line(0, run["total"], 0, 0)
+        )
+        attempted = set()
+        while True:
+            before = totals["converted"]
+            await self._convert_targets(
+                job, options, plan["targets"], output_dirs, totals, run
+            )
+            attempted.update(src for src, _dst, _video in plan["targets"])
+            stop = job.cancelled or totals["stopped"]
+            if stop or not plan["remaining"] or totals["converted"] == before:
+                return totals, plan["remaining"]
+            plan = await self._plan_conversion(
+                job, options, output_dirs, exclude=attempted
+            )
+            if job.cancelled:
+                return totals, 0
+            run["total"] = run["index"] + len(plan["targets"]) + plan["remaining"]
+            job.update(total=run["total"])
+            if not plan["targets"]:
+                return totals, plan["remaining"]
+
+    async def _convert_targets(self, job, options, targets, output_dirs, totals, run):
+        """Convert one batch's *targets* in worker batches of preview groups,
+        recording each file against the job's overall ``run`` counters."""
+        roots = _scan_roots(output_dirs)
+        groups = _group_targets(targets)
+        batch_size = _thumbnail_batch_size(_worker_threads())
+        for batch_start in range(0, len(groups), batch_size):
+            if job.cancelled or totals["stopped"]:
+                break
+            batch = groups[batch_start : batch_start + batch_size]
+            results = await self._run_in_executor(
+                self._convert_batch, batch, options.settings, lambda: job.cancelled
+            )
+            for group, group_results in zip(batch, results):
+                for (src, _dst, _video), result in zip(group, group_results):
+                    if result["action"] == "stopped":
+                        totals["stopped"] = True
+                    if result["action"] in ("cancelled", "stopped"):
+                        continue
+                    run["index"] += 1
+                    index, total = run["index"], max(run["total"], run["index"])
+                    self._record_conversion(job, src, result, roots, totals)
+                    job.update(processed=index, progress=index * 100 // total)
+            run["batches"] += 1
+            job.update(
+                status_line=_scan_status_line(
+                    run["index"],
+                    run["total"],
+                    run["batches"],
+                    time.monotonic() - run["start"],
+                )
+            )
+            await asyncio.sleep(0)  # let other requests run between batches
+
+    @staticmethod
+    def _record_conversion(job, src, result, roots, totals):
+        path, label, index = _scan_location(src, roots)
+        where = f"{label}/{path}" if label else path
+        row = {"path": path, "root": label, "root_index": index}
+        if result["action"] == "converted":
+            totals["converted"] += 1
+            totals["before"] += result["before"]
+            totals["after"] += result["after"]
+            detail = result["detail"]
+            job.record("generated", {**row, "detail": detail}, f"+ {where} · {detail}")
+            return
+        totals["failed"] += 1
+        detail = result.get("error") or "failed"
+        job.record("errors", {**row, "detail": detail}, f"! {where} · {detail}")
+
+    def _convert_batch(self, groups, settings, stop):
+        """Convert preview ``groups`` on the configured worker threads
+        (blocking); one result list per group."""
+        convert = functools.partial(self._convert_group, settings=settings, stop=stop)
+        return map_parallel(convert, groups, _worker_threads())
+
+    def _convert_group(self, group, settings, stop):
+        """Convert the preview a group of same-stem files shares, once.
+
+        The first source writes it; the others are recorded with the same
+        outcome and no bytes of their own."""
+        src, dst, is_video = group[0]
+        siblings = [Path(target[0]) for target in group[1:]]
+        result = self._convert_one(
+            src, dst, is_video, settings, stop=stop, siblings=siblings
+        )
+        if result["action"] != "converted":
+            return [result] * len(group)
+        shared = {**result, "before": 0, "after": 0}
+        shared["detail"] = f"{result['detail']} (shares {Path(src).name}'s preview)"
+        return [result] + [shared] * len(siblings)
+
+    def _convert_one(self, src, dst, is_video, settings, stop=None, siblings=()):
+        """Convert one file's preview (blocking; never raises).
+
+        ``converted`` with the bytes removed and written, ``error`` (the old
+        preview kept), ``cancelled`` (a file boundary) or ``stopped`` (the
+        format changed underneath, review I4). *siblings* share the preview
+        (R2): their old previews go too.
+        """
+        if stop is not None and stop():
+            return {"action": "cancelled"}
+        if _format_changed(settings):
+            return {"action": "stopped"}
+        dst = Path(dst)
+        try:
+            old = self._old_group_previews([Path(src), *siblings], dst, settings)
+            if not self._current_preview_usable(src, dst, settings):
+                made = self._generate_one(
+                    src, dst, settings, is_video, rebuild=True, placeholder=False
+                )
+                if made["action"] != "generated":
+                    return {"action": "error", "error": made.get("error")}
+                dst = Path(made["path"])
+            if dst.suffix != settings.extension or not dst.is_file():
+                return {"action": "error", "error": "The new preview was not written"}
+            if not os.path.isfile(src):
+                return {"action": "error", "error": SOURCE_GONE}
+            if _format_changed(settings):
+                return {"action": "stopped"}
+            old = [(path, size) for path, size in old if not _same_file(path, dst)]
+            removed, kept = self._remove_old_previews(old)
+            if kept:
+                return {"action": "error", "error": OLD_NOT_REMOVED}
+            label = thumbnail_settings.FORMAT_LABELS[settings.format]
+            return {
+                "action": "converted",
+                "before": removed,
+                "after": dst.stat().st_size,
+                "detail": f"Converted to {label}",
+            }
+        except Exception as exc:
+            self.logger.warning(f"Conversion failed for {src.name}", exc_info=True)
+            return {"action": "error", "error": safe_error_message(exc)}
+
+    @staticmethod
+    def _old_group_previews(sources, dst, settings):
+        """``[(path, size)]`` of every source's old previews, each path once."""
+        seen, old = set(), []
+        for source in sources:
+            for path, size in _old_previews(source, dst, settings):
+                key = os.path.normcase(str(path))
+                if key not in seen:
+                    seen.add(key)
+                    old.append((path, size))
+        return old
+
+    @staticmethod
+    def _current_preview_usable(src, dst, settings):
+        """A current preview at least as new as *src* that decodes (M4)."""
+        if not _thumbnail_is_fresh(src, dst):
+            return False
+        try:
+            verify_thumbnail(dst, settings.format)
+        except ThumbnailVerifyError:
+            return False
+        return True
+
+    def _remove_old_previews(self, old):
+        """``(bytes removed, [kept paths])``; a file already gone counts as
+        removed, with no bytes (another run or a sibling removed it)."""
+        removed, kept = 0, []
+        for path, size in old:
+            try:
+                os.remove(path)
+            except FileNotFoundError:
+                continue
+            except OSError as exc:
+                self.logger.warning(f"Could not remove old preview {path}: {exc}")
+                kept.append(path)
+                continue
+            removed += size
+        return removed, kept
@@ -0,0 +1,524 @@
+"""Thumbnail encoders (#317): every preview file is written here.
+
+``write_thumbnail(frame, dst, settings)`` encodes a prepared frame
+(``thumbnail_frame``: the first frame, RGB, fitted inside the edge) in the
+configured format into a hidden temp sibling, closes it, verifies that it
+decodes, and renames it over ``dst`` (``os.replace``), so a reader never sees
+a partial file and a failure keeps the old preview. ``guard()`` is asked just
+before the rename (automatic previews' holds, #249).
+
+Formats: WebP (Pillow, ``method=4``) and JPEG (Pillow, ``optimize``) always
+work. JPEG XL needs no new dependency; the first encoder found is used:
+
+1. Pillow, natively or through the ``pillow_jxl`` plugin (imported when
+   installed: ``pip install pillow-jxl-plugin``), given the quality itself;
+2. ffmpeg built with ``libjxl`` (``-distance``), fed a PNG on stdin;
+3. ``cjxl`` from libjxl (``-d``), fed a temp PNG that is closed first.
+
+Quality maps to a JPEG XL distance with libjxl's own
+``JxlEncoderDistanceFromQuality``: ``0.1 + (100 - q) * 0.09`` from 30 up
+(q80 → d1.9, q85 → d1.45, q90 → d1.0), the quadratic below 30, and q100 →
+d0.1 (a preview is never lossless). Pillow's plugin applies the same mapping
+inside libjxl. Detection is cached (``detect_jxl_encoder(refresh=True)``
+probes again); "none found" is probed again on the settings read
+(``encoder_status``) and after MISSING_ENCODER_TTL, so one slow probe never
+turns JPEG XL off until a restart. An encoder that fails because its binary
+or module is gone makes that write detect again: another encoder found is
+used for that file, none at all writes it as WebP (logged once) and
+refreshes what Appearance reads. Any other failure (one bad file) raises
+without a probe.
+
+Encoder processes (and ffmpeg's video frames, images.py) go through
+``run_encoder``: tracked, bounded by a timeout, and killed by
+``shutdown_encoders()`` at the app's cleanup, after which none starts.
+"""
+
+import importlib
+import io
+import os
+import re
+import shutil
+import subprocess  # nosec B404 - fixed argv lists, never a shell
+import threading
+import time
+from dataclasses import replace
+from pathlib import Path
+
+from PIL import Image
+
+from . import thumbnail_settings
+
+try:
+    from ...utils.logging_config import get_logger
+except ImportError:  # tests import the package top-level
+    from utils.logging_config import get_logger
+
+logger = get_logger("prompt_manager.thumbnails")
+
+PILLOW_JXL_FORMAT = "JXL"
+JXL_UNAVAILABLE = (
+    "No JPEG XL encoder found. Install pillow-jxl-plugin "
+    "(pip install pillow-jxl-plugin), ffmpeg built with libjxl, or cjxl from "
+    "libjxl, then restart ComfyUI."
+)
+# Seconds an encoder process may run (ffmpeg's video frame shares it).
+ENCODE_TIMEOUT = 30
+PROBE_TIMEOUT = 10
+JXL_EFFORT = 7
+WEBP_METHOD = 4
+JXL_SIGNATURES = (b"\xff\x0a", b"\x00\x00\x00\x0cJXL \r\n\x87\n")
+_NO_WINDOW = getattr(subprocess, "CREATE_NO_WINDOW", 0)
+
+
+class PreviewWriteHeld(Exception):
+    """A preview write stopped before its rename: ``guard()`` said no (#249)."""
+
+
+# The result error of a write held before its rename (never remembered).
+PREVIEW_HELD = "Preview writes are held while another job runs"
+
+
+class ThumbnailVerifyError(RuntimeError):
+    """The encoded preview did not decode; it was never renamed in."""
+
+
+class EncoderFailed(RuntimeError):
+    """An encoder process failed or wrote nothing."""
+
+
+class EncoderClosed(RuntimeError):
+    """The app is shutting down: no encoder process runs any more."""
+
+
+# ── temp files ───────────────────────────────────────────────────────
+
+
+def temp_sibling(dst, tag="part"):
+    """Hidden temp path next to *dst* that keeps its extension."""
+    dst = Path(dst)
+    token = f"{os.getpid()}-{threading.get_ident()}"
+    return dst.with_name(f".{dst.stem}.{tag}-{token}{dst.suffix}")
+
+
+def replace_unless_held(tmp, dst, guard=None):
+    """Rename *tmp* over *dst*, unless ``guard()`` is false (PreviewWriteHeld)."""
+    if guard is not None and not guard():
+        raise PreviewWriteHeld(PREVIEW_HELD)
+    os.replace(tmp, dst)
+
+
+# ``temp_sibling``'s names: ``.<stem>.<tag>-<pid>-<thread id><ext>``.
+_TEMP_NAME = re.compile(r"^\..+\.(?:part|src)-(\d+)-\d+\.[A-Za-z0-9]+$")
+# A temp at least this old (seconds) outlived its write: no encode runs longer.
+STRAY_TEMP_AGE = 4 * ENCODE_TIMEOUT
+# When this process started (this module's import): a temp carrying its PID
+# that is older was left by an earlier run with the same PID (containers).
+PROCESS_STARTED = time.time()
+
+
+def sweep_stray_temps(folder, min_age=None):
+    """Remove the temp files a crashed write left under *folder* (a preview
+    folder, walked without following links); returns ``(count, bytes)``.
+
+    Only ``temp_sibling`` names are touched, never a link. With *min_age*
+    (seconds, the startup sweep) a temp younger than that, or one this
+    process wrote since it started (it may still be writing it), is left;
+    ``min_age=0`` (the clear, which holds every preview write) removes them
+    all.
+    """
+    min_age = STRAY_TEMP_AGE if min_age is None else min_age
+    now = time.time()
+    own = str(os.getpid())
+    count = size = 0
+    for root, _dirs, files in os.walk(folder):
+        for name in files:
+            match = _TEMP_NAME.match(name)
+            if match is None:
+                continue
+            path = Path(root) / name
+            try:
+                stat = path.lstat()
+                if path.is_symlink() or not path.is_file():
+                    continue
+                if min_age and (
+                    now - stat.st_mtime < min_age
+                    or (match.group(1) == own and stat.st_mtime >= PROCESS_STARTED)
+                ):
+                    continue
+                path.unlink()
+            except OSError as exc:
+                logger.debug(f"Could not remove stray temp {name}: {exc}")
+                continue
+            count += 1
+            size += stat.st_size
+    return count, size
+
+
+def _unlink_quietly(path):
+    try:
+        Path(path).unlink()
+    except FileNotFoundError:
+        pass
+    except OSError as exc:
+        logger.debug(f"Could not remove temp file {Path(path).name}: {exc}")
+
+
+# ── encoder processes ────────────────────────────────────────────────
+
+_process_lock = threading.Lock()
+_processes = set()
+_closed = False
+
+
+def run_encoder(cmd, *, input=None, timeout=ENCODE_TIMEOUT, track=None):
+    """Run *cmd* (a fixed argv) with *input* on stdin; returns a
+    CompletedProcess with bytes output.
+
+    The process is tracked so ``shutdown_encoders`` can kill it; past
+    *timeout* it is killed and TimeoutExpired raised. After the shutdown
+    nothing starts (EncoderClosed). ``track(process)`` sees it too.
+    """
+    with _process_lock:
+        if _closed:
+            raise EncoderClosed("Encoders are shut down")
+    process = subprocess.Popen(  # nosec B603 - fixed argv, no shell
+        cmd,
+        stdin=subprocess.PIPE if input is not None else subprocess.DEVNULL,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        creationflags=_NO_WINDOW,
+    )
+    with _process_lock:
+        _processes.add(process)
+        closed = _closed
+    try:
+        if closed:
+            process.kill()
+        if track is not None:
+            track(process)
+        try:
+            out, err = process.communicate(input=input, timeout=timeout)
+        except subprocess.TimeoutExpired:
+            process.kill()
+            process.communicate()
+            raise
+    finally:
+        with _process_lock:
+            _processes.discard(process)
+            closed = _closed
+    if closed:
+        raise EncoderClosed("Encoder stopped by the shutdown")
+    return subprocess.CompletedProcess(cmd, process.returncode, out, err)
+
+
+def shutdown_encoders():
+    """Kill every running encoder process; none starts afterwards."""
+    global _closed
+    with _process_lock:
+        _closed = True
+        running = list(_processes)
+    for process in running:
+        try:
+            process.kill()
+        except OSError:
+            pass
+
+
+def reset_encoders():
+    """Allow encoders again and forget the detection (tests, a reload)."""
+    global _closed, _detected, _fallback_logged
+    with _process_lock:
+        _closed = False
+    with _detect_lock:
+        _detected = _UNSET
+        _fallback_logged = False
+
+
+# ── JPEG XL detection ────────────────────────────────────────────────
+
+_UNSET = object()
+_detect_lock = threading.Lock()
+_detected = _UNSET
+_detected_at = 0.0
+# Seconds after which "no JPEG XL encoder" is probed again.
+MISSING_ENCODER_TTL = 60
+_fallback_logged = False
+
+
+def _pillow_jxl_format():
+    """Pillow's JPEG XL format id when it can save one, else None."""
+    try:
+        native = Image.registered_extensions().get(".jxl")
+    except Exception:
+        native = None
+    if native and native in Image.SAVE:
+        return native
+    return PILLOW_JXL_FORMAT if PILLOW_JXL_FORMAT in Image.SAVE else None
+
+
+def _pillow_can_save_jxl():
+    if _pillow_jxl_format():
+        return True
+    try:
+        importlib.import_module("pillow_jxl")
+    except Exception:
+        return False
+    return _pillow_jxl_format() is not None
+
+
+def _pillow_decodes_jxl():
+    try:
+        native = Image.registered_extensions().get(".jxl")
+    except Exception:
+        native = None
+    return bool(native and native in Image.OPEN) or PILLOW_JXL_FORMAT in Image.OPEN
+
+
+def _ffmpeg_has_libjxl():
+    """Whether the ffmpeg on PATH lists the ``libjxl`` encoder."""
+    if not shutil.which("ffmpeg"):
+        return False
+    try:
+        done = run_encoder(
+            ["ffmpeg", "-hide_banner", "-encoders"], timeout=PROBE_TIMEOUT
+        )
+    except (OSError, subprocess.SubprocessError, EncoderClosed):
+        return False
+    listing = done.stdout
+    if isinstance(listing, bytes):
+        listing = listing.decode("utf-8", "replace")
+    return any(
+        len(line.split()) > 1 and line.split()[1] == "libjxl"
+        for line in listing.splitlines()
+    )
+
+
+def _detect():
+    if _pillow_can_save_jxl():
+        return "pillow"
+    if _ffmpeg_has_libjxl():
+        return "ffmpeg"
+    if shutil.which("cjxl"):
+        return "cjxl"
+    return None
+
+
+def detect_jxl_encoder(refresh=False, recheck_missing=False):
+    """``pillow``, ``ffmpeg``, ``cjxl`` or None (cached; blocking on a probe).
+
+    A cached None is probed again with *recheck_missing* or once it is older
+    than MISSING_ENCODER_TTL."""
+    global _detected, _detected_at
+    with _detect_lock:
+        now = time.monotonic()
+        stale_missing = _detected is None and (
+            recheck_missing or now - _detected_at >= MISSING_ENCODER_TTL
+        )
+        if refresh or _detected is _UNSET or stale_missing:
+            _detected = _detect()
+            _detected_at = now
+        return _detected
+
+
+def _encoder_gone(encoder):
+    """Whether *encoder*'s binary or module is no longer there."""
+    if encoder == "pillow":
+        return not _pillow_can_save_jxl()
+    return shutil.which(encoder) is None
+
+
+def encoder_status():
+    """Which formats can be written now (``GET /prompt_manager/settings``;
+    a "none found" is probed again here)."""
+    encoder = detect_jxl_encoder(recheck_missing=True)
+    return {
+        "webp": {"available": True},
+        "jpeg": {"available": True},
+        "jxl": {
+            "available": encoder is not None,
+            "encoder": encoder,
+            "reason": None if encoder is not None else JXL_UNAVAILABLE,
+        },
+    }
+
+
+def jxl_distance(quality):
+    """libjxl's distance for a 1–100 quality (q100 gives 0.1, never lossless)."""
+    if quality >= 100:
+        return 0.1
+    if quality >= 30:
+        return 0.1 + (100 - quality) * 0.09
+    return 53.0 / 3000.0 * quality * quality - 23.0 / 20.0 * quality + 25.0
+
+
+# ── frames and writers ───────────────────────────────────────────────
+
+
+def thumbnail_frame(img, edge):
+    """The first frame of *img* as RGB, fitted inside ``edge`` x ``edge``."""
+    try:
+        img.seek(0)
+    except (EOFError, AttributeError, ValueError):
+        pass
+    try:
+        img.draft("RGB", (edge, edge))  # JPEG: decode at a reduced scale
+    except (AttributeError, ValueError, OSError):
+        pass
+    frame = img.convert("RGB") if img.mode != "RGB" else img.copy()
+    frame.thumbnail((edge, edge), Image.Resampling.LANCZOS)
+    return frame
+
+
+def _png_bytes(img):
+    buffer = io.BytesIO()
+    img.save(buffer, "PNG", compress_level=1)
+    return buffer.getvalue()
+
+
+def _write_webp(img, tmp, settings, track):
+    img.save(tmp, "WEBP", quality=settings.quality, method=WEBP_METHOD)
+
+
+def _write_jpeg(img, tmp, settings, track):
+    img.save(tmp, "JPEG", quality=settings.quality, optimize=True)
+
+
+def _check(done, tmp, name):
+    if done.returncode != 0 or not Path(tmp).is_file():
+        detail = (done.stderr or b"")[-300:]
+        if isinstance(detail, bytes):
+            detail = detail.decode("utf-8", "replace")
+        raise EncoderFailed(f"{name} could not encode the preview: {detail.strip()}")
+
+
+class _EncoderGone(RuntimeError):
+    """No JPEG XL encoder is left: this file is written as WebP."""
+
+
+def _write_jxl(img, tmp, settings, track):
+    """Encode with the detected encoder. One that failed because it is gone
+    makes the write detect again once (another one is used, none raises
+    _EncoderGone); any other failure raises without a probe."""
+    encoder = detect_jxl_encoder()
+    try:
+        _encode_jxl(encoder, img, tmp, settings, track)
+        return
+    except (OSError, EncoderFailed) as exc:
+        if encoder is not None and not _encoder_gone(encoder):
+            raise
+        again = detect_jxl_encoder(refresh=True)
+        if again is None:
+            raise _EncoderGone(str(exc)) from exc
+        if again == encoder:
+            raise
+        logger.info(f"JPEG XL encoder {encoder} failed; using {again}")
+    _unlink_quietly(tmp)
+    _encode_jxl(again, img, tmp, settings, track)
+
+
+def _encode_jxl(encoder, img, tmp, settings, track):
+    distance = f"{jxl_distance(settings.quality):.2f}"
+    if encoder == "pillow":
+        img.save(
+            tmp,
+            _pillow_jxl_format() or PILLOW_JXL_FORMAT,
+            quality=min(settings.quality, 99),
+            effort=JXL_EFFORT,
+            num_threads=1,
+        )
+        return
+    if encoder == "ffmpeg":
+        cmd = [
+            "ffmpeg", "-v", "error", "-f", "png_pipe", "-i", "-",
+            "-frames:v", "1", "-c:v", "libjxl", "-distance", distance,
+            "-effort", str(JXL_EFFORT), "-f", "image2", "-update", "1",
+            "-y", str(tmp),
+        ]  # fmt: skip
+        _check(run_encoder(cmd, input=_png_bytes(img), track=track), tmp, "ffmpeg")
+        return
+    if encoder == "cjxl":
+        source = temp_sibling(Path(tmp).with_suffix(".png"), "src")
+        try:
+            with open(source, "wb") as handle:
+                handle.write(_png_bytes(img))
+            cmd = ["cjxl", str(source), str(tmp), "-d", distance, "-e", str(JXL_EFFORT)]
+            _check(run_encoder(cmd, track=track), tmp, "cjxl")
+        finally:
+            _unlink_quietly(source)
+        return
+    raise EncoderFailed(JXL_UNAVAILABLE)
+
+
+_WRITERS = {"webp": _write_webp, "jpeg": _write_jpeg, "jxl": _write_jxl}
+
+
+def verify_thumbnail(path, fmt):
+    """Raise ThumbnailVerifyError unless *path* decodes as a preview.
+
+    A JPEG XL file Pillow cannot read (no plugin) is checked by signature.
+    """
+    try:
+        if fmt == "jxl" and not _pillow_decodes_jxl():
+            with open(path, "rb") as handle:
+                head = handle.read(12)
+            if not head.startswith(JXL_SIGNATURES):
+                raise ThumbnailVerifyError("The JPEG XL preview has no signature")
+            return
+        with Image.open(path) as written:
+            written.load()
+    except ThumbnailVerifyError:
+        raise
+    except Exception as exc:
+        raise ThumbnailVerifyError(f"The new preview does not decode: {exc}") from exc
+
+
+def _jxl_fallback():
+    """Log once that JPEG XL previews are being written as WebP."""
+    global _fallback_logged
+    with _detect_lock:
+        first, _fallback_logged = not _fallback_logged, True
+    if first:
+        logger.warning(
+            "JPEG XL is the thumbnail format but no JPEG XL encoder is available "
+            "any more; previews are written as WebP until one is installed"
+        )
+
+
+def writer_settings(settings=None):
+    """The settings a preview is written with now: the configured ones, but
+    WebP while JPEG XL has no encoder (logged once). Its extension names the
+    file, so "outdated" means a preview this server would not write now."""
+    settings = settings or thumbnail_settings.current()
+    if settings.format == "jxl" and detect_jxl_encoder() is None:
+        _jxl_fallback()
+        return replace(settings, format="webp")
+    return settings
+
+
+def write_thumbnail(frame, dst, settings, *, guard=None, track=None):
+    """Encode *frame* into *dst* in ``settings``' format; returns the path
+    written (``.webp`` when JPEG XL fell back). Atomic and verified; raises
+    PreviewWriteHeld, ThumbnailVerifyError, EncoderFailed, EncoderClosed or
+    the OSError of the write."""
+    dst = Path(dst)
+    fmt = settings.format
+    if fmt == "jxl" and detect_jxl_encoder() is None:
+        _jxl_fallback()
+        fmt, dst = "webp", dst.with_suffix(".webp")
+    try:
+        return _write_verified(frame, dst, fmt, settings, guard, track)
+    except _EncoderGone:
+        _jxl_fallback()
+        dst = dst.with_suffix(".webp")
+        return _write_verified(frame, dst, "webp", settings, guard, track)
+
+
+def _write_verified(frame, dst, fmt, settings, guard, track):
+    tmp = temp_sibling(dst)
+    try:
+        _WRITERS[fmt](frame, tmp, settings, track)
+        verify_thumbnail(tmp, fmt)
+        replace_unless_held(tmp, dst, guard)
+    finally:
+        _unlink_quietly(tmp)
+    return dst
@@ -1,29 +1,32 @@
-"""Thumbnail generation as an Activity job (#249 System S5, Task 12).
+"""Thumbnail generation as an Activity job (#249 System S5, Task 12; #317).

- ``GET /prompt_manager/images/thumbnails/plan?mode=&size=&quality=`` counts
-  what a run would do over every gallery root and writes nothing:
-  ``{success, targets, fresh, remaining, roots, mode, size, quality}``.
- ``POST /prompt_manager/jobs/thumbnails {mode, size, quality}`` starts the
-  ``thumbnails`` job (202 ``{job}``). Its admission class is ``guarded``: it
-  never runs beside a record-changing job, and one thumbnail job runs at a
-  time. It stops at a file boundary when cancelled, keeping the previews it
-  wrote. Its outcome groups are ``generated``, ``skipped`` (already fresh)
-  and ``errors``.
+- ``GET /prompt_manager/images/thumbnails/plan?mode=`` counts what a run
+  would do over every gallery root and writes nothing: ``{success, targets,
+  fresh, outdated, remaining, roots, mode, format, quality, size}``.
+- ``POST /prompt_manager/jobs/thumbnails {mode}`` starts the ``thumbnails``
+  job (202 ``{job}``). Its admission class is ``guarded``: it never runs
+  beside a record-changing job, and one thumbnail job runs at a time. It
+  stops at a file boundary when cancelled, keeping the previews it wrote.
+  Its outcome groups are ``generated``, ``skipped`` (already fresh) and
+  ``errors``.

-``mode`` is ``missing`` (previews that are absent or older than their file)
-or ``rebuild`` (every preview again, fresh ones too). ``size`` is the
-preview's longest edge, 128 to 2048 pixels. ``quality`` picks the encoder
-settings (``THUMBNAIL_ENCODINGS``). Every preview is written next to the old
-one and renamed over it, so nothing is cleared first and a failure keeps the
-old preview; originals are only read.
+``mode`` is ``missing`` (previews that are absent or older than their file),
+``rebuild`` (every preview again, fresh ones too) or ``convert`` (Convert
+outdated: previews in another format, see ``thumbnail_convert.py``). Format, quality and
+size limit are the server's thumbnail settings (``thumbnail_settings``,
+#317), read once when the job starts and shown in its scope; a ``size`` or
+``quality`` an older client sends is ignored. Every preview is written next
+to the old one, verified and renamed over it, so nothing is cleared first and
+a failure keeps the old preview; originals are only read.

 The legacy gallery stream ``POST /images/generate-thumbnails/progress``
-starts this job (its quality preset still sizes the previews) or attaches to
-the running one. Its first frame, ``job {id, started}``, names that job and
-whether this stream started it (the gallery cancels by that id, and only a
-job it started); then come the job's legacy ``status``/``start``/
-``progress``/``file_error``/``complete`` frames. A client that goes away no
-longer stops the work: the job outlives the request, as a scan does.
+starts this job (missing previews, the server's settings; its ``quality``
+preset is ignored, #317 R3) or attaches to the running one. Its first frame,
+``job {id, started}``, names that job and whether this stream started it (the
+gallery cancels by that id, and only a job it started); then come the job's
+legacy ``status``/``start``/``progress``/``file_error``/``complete`` frames. A
+client that goes away no longer stops the work: the job outlives the request,
+as a scan does.
 """

 import asyncio
@@ -36,7 +39,6 @@ from aiohttp import web

 from .admin import _plural, _scan_location, _scan_roots, _scan_status_line
 from .images import (
-    THUMBNAIL_ENCODINGS,
    _BodyTooLarge,
    _new_thumbnail_stats,
    _read_json_body,
@@ -48,24 +50,13 @@ from .images import (
 )
 from .job_routes import busy_response
 from .jobs import THUMBNAIL_GROUP_NAMES, THUMBNAILS_JOB_KIND, JobBusy
+from .thumbnail_convert import CONVERT_JOB_TITLE
+from .thumbnail_encode import writer_settings
+from .thumbnail_settings import ThumbnailSettings

 THUMBNAIL_JOB_TITLE = "Thumbnail generation"
-THUMBNAIL_MODES = ("missing", "rebuild")
-THUMBNAIL_QUALITIES = tuple(THUMBNAIL_ENCODINGS)
-MIN_THUMBNAIL_EDGE = 128
-MAX_THUMBNAIL_EDGE = 2048
-# The concept's "Preview size limit" default.
-DEFAULT_THUMBNAIL_EDGE = 512
-DEFAULT_THUMBNAIL_OPTIONS = {
-    "mode": "missing",
-    "size": DEFAULT_THUMBNAIL_EDGE,
-    "quality": "medium",
-}
-_OPTIONS_ERROR = (
-    'mode must be "missing" or "rebuild", quality "low", "medium" or "high", '
-    f"and size a whole number of pixels from {MIN_THUMBNAIL_EDGE} "
-    f"to {MAX_THUMBNAIL_EDGE}"
-)
+THUMBNAIL_MODES = ("missing", "rebuild", "convert")
+_OPTIONS_ERROR = 'mode must be "missing", "rebuild" or "convert"'
 CANCELLED_ERROR = "Thumbnail generation was cancelled"
 CANCELLED_BEFORE_WRITING = "Cancelled before any preview was written"
 NOTHING_TO_PREVIEW = "No images or videos to preview"
@@ -80,56 +71,35 @@ _LOG_PREFIXES = {"generated": "+", "errors": "!"}

@dataclass(frozen=True)
 class ThumbnailOptions:
-    """One run's choices: the mode, the preview's longest edge and quality."""
+    """One run's choices: the mode and the thumbnail settings it writes with."""

    mode: str
-    edge: int
-    quality: str
-
-    @property
-    def size(self):
-        return (self.edge, self.edge)
-
-    @property
-    def encoding(self):
-        return THUMBNAIL_ENCODINGS[self.quality]
+    settings: ThumbnailSettings

    @property
    def rebuild(self):
        return self.mode == "rebuild"

    def scope(self):
-        return {"mode": self.mode, "size": self.edge, "quality": self.quality}
-
-
-def _edge(value, *, from_query):
-    """The preview edge as an int, or None when it is not one in range."""
-    if from_query and isinstance(value, str):
-        if not value.isascii() or not value.isdigit() or len(value) > 5:
-            return None
-        value = int(value)
-    if isinstance(value, bool) or not isinstance(value, int):
-        return None
-    return value if MIN_THUMBNAIL_EDGE <= value <= MAX_THUMBNAIL_EDGE else None
+        return {
+            "mode": self.mode,
+            "format": self.settings.format,
+            "quality": self.settings.quality,
+            "size": self.settings.edge,
+        }


 def thumbnail_options(raw, *, from_query=False):
    """``(ThumbnailOptions, None)`` from a body or query, or ``(None, message)``.

-    Absent fields take ``DEFAULT_THUMBNAIL_OPTIONS``. Query values are
-    strings, so a query ``size`` may be decimal digits; a JSON ``size`` must
-    be an int.
+    An absent mode is ``missing``; the settings are the server's now.
    """
    if not isinstance(raw, dict) and not hasattr(raw, "get"):
        return None, _OPTIONS_ERROR
-    mode = raw.get("mode", DEFAULT_THUMBNAIL_OPTIONS["mode"])
-    quality = raw.get("quality", DEFAULT_THUMBNAIL_OPTIONS["quality"])
-    edge = _edge(raw.get("size", DEFAULT_THUMBNAIL_EDGE), from_query=from_query)
-    if mode not in THUMBNAIL_MODES or quality not in THUMBNAIL_QUALITIES:
+    mode = raw.get("mode", "missing")
+    if mode not in THUMBNAIL_MODES:
        return None, _OPTIONS_ERROR
-    if edge is None:
-        return None, _OPTIONS_ERROR
-    return ThumbnailOptions(mode, edge, quality), None
+    return ThumbnailOptions(mode, writer_settings()), None


 def _invalid(message):
@@ -168,7 +138,10 @@ class ThumbnailJobsMixin:
        try:
            output_dirs = await self._run_in_executor(self._get_all_output_dirs)
            plan = await self._run_in_executor(
-                self._plan_gallery_thumbnails, output_dirs, rebuild=options.rebuild
+                self._plan_gallery_thumbnails,
+                output_dirs,
+                options.mode,
+                settings=options.settings,
            )
        except Exception:
            self.logger.exception("Thumbnail plan failed")
@@ -185,6 +158,7 @@ class ThumbnailJobsMixin:
                "success": True,
                "targets": len(plan["targets"]),
                "fresh": plan["fresh"],
+                "outdated": plan["outdated"],
                "remaining": plan["remaining"],
                "roots": [self._public_path(root) for root in output_dirs],
                **options.scope(),
@@ -215,14 +189,20 @@ class ThumbnailJobsMixin:
        return web.json_response({"success": True, "job": job.summary()}, status=202)

    def _start_thumbnail_job(self, options):
-        """Register the thumbnail job synchronously; raises JobBusy."""
+        """Register the thumbnail job synchronously; raises JobBusy.
+
+        ``convert`` runs Convert outdated (``thumbnail_convert.py``) under the
+        same kind, admission, cancel and groups.
+        """
+        convert = options.mode == "convert"
+        runner = self._run_convert_job if convert else self._run_thumbnail_job
        return self._jobs.start(
            THUMBNAILS_JOB_KIND,
-            THUMBNAIL_JOB_TITLE,
+            CONVERT_JOB_TITLE if convert else THUMBNAIL_JOB_TITLE,
            admission="guarded",
            cancellable=True,
            scope=options.scope(),
-            runner=functools.partial(self._run_thumbnail_job, options=options),
+            runner=functools.partial(runner, options=options),
            groups=THUMBNAIL_GROUP_NAMES,
        )

@@ -265,7 +245,7 @@ class ThumbnailJobsMixin:
        job.update(status_line=f"Looking for media files in {folders}")
        job.log_line(
            f"Thumbnails started · {folders} · {_MODE_LOG[options.mode]} · "
-            f"{options.edge} px · {options.quality}"
+            f"{options.settings.describe()}"
        )
        job.publish(
            _frame(
@@ -273,41 +253,83 @@ class ThumbnailJobsMixin:
                {"phase": "scanning", "message": "Scanning for images and videos..."},
            )
        )
-        plan = await self._run_in_executor(
-            self._plan_gallery_thumbnails,
-            output_dirs,
-            rebuild=options.rebuild,
-            stop=lambda: job.cancelled,
-        )
+        plan = await self._plan_thumbnail_batch(job, options, output_dirs)
        if job.cancelled:  # M2: stopped during the walk, before any start frame
            return self._end_cancelled(job, 0, CANCELLED_BEFORE_WRITING)
        roots = _scan_roots(output_dirs)
        self._record_fresh(job, plan, roots)
-        stats, start = await self._generate_thumbnail_targets(job, options, plan, roots)
-        self.invalidate_gallery_cache()
+        stats, start, left, attempted = await self._generate_in_batches(
+            job, options, plan, roots, output_dirs
+        )
        generated = _plural(stats["generated"], "preview")
        if job.cancelled:
            return self._end_cancelled(
                job, stats["generated"], f"Cancelled · {generated} written"
            )
+        overall = {"targets": attempted, "skipped": plan["skipped"], "remaining": left}
        payload = _thumbnail_complete_payload(
-            len(plan["targets"]) + plan["skipped"] + plan["remaining"],
+            len(attempted) + plan["skipped"] + left,
            stats,
            start,
-            remaining=plan["remaining"],
-            processed=len(plan["targets"]),
+            remaining=left,
+            processed=len(attempted),
        )
-        job.update(progress=100, status_line=_finished_line(plan, stats))
-        if plan["remaining"]:
-            job.log_line(
-                f"{plan['remaining']:,} more previews are left for the next run"
-            )
+        job.update(progress=100, status_line=_finished_line(overall, stats))
+        if left:
+            job.log_line(f"{left:,} more previews are left for the next run")
        errors = _plural(len(stats["errors"]), "error")
        job.log_line(f"Thumbnails finished · {generated} written · {errors}")
        self.logger.info(payload["message"])
        job.publish(_frame("complete", payload))
        return "finished"

+    async def _plan_thumbnail_batch(self, job, options, output_dirs, exclude=None):
+        """One batch's plan (at most MAX_THUMBNAIL_FILES targets), off-loop."""
+        return await self._run_in_executor(
+            self._plan_gallery_thumbnails,
+            output_dirs,
+            options.mode,
+            stop=lambda: job.cancelled,
+            settings=options.settings,
+            exclude=exclude,
+        )
+
+    async def _generate_in_batches(self, job, options, plan, roots, output_dirs):
+        """Work through ``plan``, then plan again after each batch until
+        nothing is left, the job is cancelled, or a batch made no progress
+        (every file failed: they are not planned again, and the rest waits
+        for the next run). Files worked on are never planned twice. Returns
+        ``(stats, start, files left, files worked on)``; progress counts
+        against the overall total."""
+        run = {
+            "index": 0,
+            "batches": 0,
+            "total": len(plan["targets"]) + plan["remaining"],
+        }
+        stats = _new_thumbnail_stats()
+        stats["skipped"] = plan["skipped"]
+        start = time.monotonic()
+        self._publish_thumbnail_start(job, plan, run["total"])
+        attempted = set()
+        while True:
+            before = stats["generated"] + stats["skipped"]
+            await self._generate_thumbnail_targets(
+                job, options, plan, roots, stats, run, start
+            )
+            attempted.update(src for src, _dst, _video in plan["targets"])
+            progressed = stats["generated"] + stats["skipped"] > before
+            if job.cancelled or not plan["remaining"] or not progressed:
+                return stats, start, plan["remaining"], attempted
+            plan = await self._plan_thumbnail_batch(
+                job, options, output_dirs, exclude=attempted
+            )
+            if job.cancelled:
+                return stats, start, 0, attempted
+            run["total"] = run["index"] + len(plan["targets"]) + plan["remaining"]
+            job.update(total=run["total"])
+            if not plan["targets"]:
+                return stats, start, plan["remaining"], attempted
+
    @staticmethod
    def _end_cancelled(job, generated, status_line):
        """Close a cancelled job: its status line, log line and error frame."""
@@ -335,10 +357,10 @@ class ThumbnailJobsMixin:
        if plan["skipped"]:
            job.log_line(f"= {plan['skipped']:,} previews already up to date")

-    async def _generate_thumbnail_targets(self, job, options, plan, roots):
-        """Generate ``plan``'s targets in worker batches, publishing each file."""
+    @staticmethod
+    def _publish_thumbnail_start(job, plan, total):
+        """The legacy stream's start frame, with the job's overall total."""
        targets = plan["targets"]
-        total = len(targets)
        video_count = sum(1 for _, _, is_video in targets if is_video)
        message = (
            f"Found {total - video_count} images and {video_count} videos to process"
@@ -354,7 +376,7 @@ class ThumbnailJobsMixin:
                {
                    "total_images": total,
                    "skipped": plan["skipped"],
-                    "remaining": plan["remaining"],
+                    "remaining": 0,
                    "phase": "processing",
                    "image_count": total - video_count,
                    "video_count": video_count,
@@ -362,28 +384,30 @@ class ThumbnailJobsMixin:
                },
            )
        )
-        stats = _new_thumbnail_stats()
-        stats["skipped"] = plan["skipped"]
-        start = time.monotonic()
+
+    async def _generate_thumbnail_targets(
+        self, job, options, plan, roots, stats, run, start
+    ):
+        """Generate one batch (``plan``'s targets) in worker batches,
+        publishing each file against the job's overall ``run`` counters."""
+        targets = plan["targets"]
        batch_size = _thumbnail_batch_size(_worker_threads())
        generate = {
-            "encoding": options.encoding,
            "rebuild": options.rebuild,
            "stop": lambda: job.cancelled,
        }
-        index = 0
-        batches = 0
-        for batch_start in range(0, total, batch_size):
+        for batch_start in range(0, len(targets), batch_size):
            if job.cancelled:
                break
            batch = targets[batch_start : batch_start + batch_size]
            results = await self._run_in_executor(
-                self._generate_batch, batch, options.size, **generate
+                self._generate_batch, batch, options.settings, **generate
            )
            for (src, _dst, _video), result in zip(batch, results):
                if result["action"] == "cancelled":
                    continue
-                index += 1
+                run["index"] += 1
+                index, total = run["index"], max(run["total"], run["index"])
                _record_thumbnail_result(stats, result)
                self._record_thumbnail_outcome(job, src, result, roots)
                job.update(processed=index, progress=index * 100 // total)
@@ -400,14 +424,13 @@ class ThumbnailJobsMixin:
                        _thumbnail_progress_payload(index, total, stats, result, start),
                    )
                )
-            batches += 1
+            run["batches"] += 1
            job.update(
                status_line=_scan_status_line(
-                    index, total, batches, time.monotonic() - start
+                    run["index"], run["total"], run["batches"], time.monotonic() - start
                )
            )
            await asyncio.sleep(0)  # let other requests run between batches
-        return stats, start

    @staticmethod
    def _record_thumbnail_outcome(job, src, result, roots):
@@ -430,14 +453,13 @@ class ThumbnailJobsMixin:
    async def generate_thumbnails_with_progress(self, request):
        """The gallery's thumbnail stream (POST, server-sent events).

-        Starts the thumbnail job with the gallery's quality preset as the
-        preview size (missing previews, medium encoding, as before), or
-        attaches to the running thumbnail job, and streams its frames. A
+        Starts the thumbnail job (missing previews with the server's
+        thumbnail settings; the gallery's ``quality`` preset is ignored, R3),
+        or attaches to the running thumbnail job, and streams its frames. A
        legacy hold (the blocking generate or clear) or a record-changing
        job refuses it with the stream's error frame. The job goes on when
        the client goes away.
        """
-        thumbnail_size = self._thumbnail_size(request.query.get("quality", "medium"))
        response = web.StreamResponse(
            status=200,
            headers={
@@ -449,7 +471,7 @@ class ThumbnailJobsMixin:
        await response.prepare(request)
        # M3: read the registry after the last await, so a job that started
        # while the headers went out is attached to, not refused.
-        job, started, busy = self._legacy_stream_job(thumbnail_size)
+        job, started, busy = self._legacy_stream_job()
        if busy is not None:
            message = f"{busy.title} already running"
            await self._emit_sse(
@@ -476,19 +498,21 @@ class ThumbnailJobsMixin:
            await events.aclose()
        return response

-    def _legacy_stream_job(self, thumbnail_size):
+    def _legacy_stream_job(self):
        """``(job, started, busy)`` for the legacy stream, synchronously.

-        Attaches to the running cancellable thumbnail job, or starts one with
-        the gallery's preset as the size (missing previews, medium encoding,
-        as the gallery always wrote), or names the job in the way.
+        Attaches to the running cancellable thumbnail job, or starts one for
+        the missing previews with the server's settings, or names the job in
+        the way.
        """
        running = self._jobs.active(THUMBNAILS_JOB_KIND)
+        if running is not None and running.scope.get("mode") == "convert":
+            return None, False, running  # no legacy frames to follow (#317)
        if running is not None and running.cancellable:
            return running, False, None
        busy = self._jobs.blocker(THUMBNAILS_JOB_KIND, admission="guarded")
        if busy is not None:
            return None, False, busy
        # blocker() said free and nothing awaited since, so the start is admitted.
-        options = ThumbnailOptions("missing", thumbnail_size[0], "medium")
+        options = ThumbnailOptions("missing", writer_settings())
        return self._start_thumbnail_job(options), True, None
@@ -0,0 +1,228 @@
+"""Thumbnail settings and names (#317): the one place every preview writer reads.
+
+Settings (System › Appearance, ``POST /prompt_manager/settings``, config.json
+``thumbnails``): ``thumbnail_format`` (``webp`` default, ``jxl``, ``jpeg``),
+``thumbnail_quality`` (1–100, default 80) and ``thumbnail_edge`` (the longest
+edge, 128–2048 px, default 512). ``current()`` is the snapshot a writer takes
+once per preview; automatic previews, the Activity job, the history route and
+the legacy gallery routes all go through it.
+
+Names: a media file ``<rel>/<stem>.<ext>`` previews as
+``thumbnails/<rel>/<stem>_thumb<extension of the format>`` (``.webp``,
+``.jxl``, ``.jpg``), images and videos alike. Two files with one stem in one
+folder share that name (ruling R2). Older releases kept the source's own
+extension (``.png``, ``.jpeg``, ``.gif``, ``.webp``, ``.jpg``; ``.jpg`` for a
+video): those are read, served and converted, never written. A preview with a
+format extension (``.webp``, ``.jxl``, ``.jpg``) belongs to every same-stem
+source; a legacy-only one (``.png``, ``.jpeg``, ``.gif``) only to a source
+with that extension (``owns``, ruling R4). Lookups take the first existing
+preview the source owns, preferring the configured format.
+"""
+
+import os
+from dataclasses import dataclass
+from pathlib import Path
+
+FORMATS = ("webp", "jxl", "jpeg")
+FORMAT_EXTENSIONS = {"webp": ".webp", "jxl": ".jxl", "jpeg": ".jpg"}
+FORMAT_LABELS = {"webp": "WebP", "jxl": "JPEG XL", "jpeg": "JPEG"}
+DEFAULT_FORMAT = "webp"
+DEFAULT_QUALITY = 80
+DEFAULT_EDGE = 512
+MIN_QUALITY, MAX_QUALITY = 1, 100
+MIN_EDGE, MAX_EDGE = 128, 2048
+
+# Extensions a format writes, then the ones only older releases wrote.
+WRITTEN_EXTENSIONS = (".webp", ".jxl", ".jpg")
+LEGACY_EXTENSIONS = (".png", ".jpeg", ".gif")
+THUMBNAIL_EXTENSIONS = WRITTEN_EXTENSIONS + LEGACY_EXTENSIONS
+CONTENT_TYPES = {
+    ".webp": "image/webp",
+    ".jxl": "image/jxl",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".png": "image/png",
+    ".gif": "image/gif",
+}
+THUMB_SUFFIX = "_thumb"
+
+
+@dataclass(frozen=True)
+class ThumbnailSettings:
+    """One preview's settings: the format, the quality and the longest edge."""
+
+    format: str
+    quality: int
+    edge: int
+
+    @property
+    def extension(self):
+        return FORMAT_EXTENSIONS[self.format]
+
+    @property
+    def size(self):
+        return (self.edge, self.edge)
+
+    def describe(self):
+        """``WebP · quality 80 · 512 px`` (log lines and the job's scope)."""
+        return f"{FORMAT_LABELS[self.format]} · quality {self.quality} · {self.edge} px"
+
+
+def current():
+    """The configured settings now (read once per preview or per run)."""
+    from ..config import PromptManagerConfig
+
+    fmt = PromptManagerConfig.THUMBNAIL_FORMAT
+    return ThumbnailSettings(
+        fmt if fmt in FORMATS else DEFAULT_FORMAT,
+        int(PromptManagerConfig.THUMBNAIL_QUALITY),
+        int(PromptManagerConfig.THUMBNAIL_EDGE),
+    )
+
+
+def _whole(value, low, high, message):
+    if type(value) is not int or not low <= value <= high:
+        raise ValueError(message)
+    return value
+
+
+def validate_format(value):
+    if not isinstance(value, str) or value not in FORMATS:
+        raise ValueError('thumbnail_format must be "webp", "jxl" or "jpeg"')
+    return value
+
+
+def validate_quality(value):
+    return _whole(
+        value,
+        MIN_QUALITY,
+        MAX_QUALITY,
+        f"thumbnail_quality must be a whole number from {MIN_QUALITY} to {MAX_QUALITY}",
+    )
+
+
+def validate_edge(value):
+    return _whole(
+        value,
+        MIN_EDGE,
+        MAX_EDGE,
+        "thumbnail_edge must be a whole number of pixels "
+        f"from {MIN_EDGE} to {MAX_EDGE}",
+    )
+
+
+# ── names ────────────────────────────────────────────────────────────
+
+
+def thumbnail_stem_rel(rel_path):
+    """``thumbnails/<rel without extension>_thumb`` (POSIX)."""
+    return f"thumbnails/{Path(rel_path).with_suffix('').as_posix()}{THUMB_SUFFIX}"
+
+
+def thumbnail_rel(rel_path, extension=None):
+    """The preview of *rel_path* in *extension* (the configured one when None)."""
+    return thumbnail_stem_rel(rel_path) + (extension or current().extension)
+
+
+# Ruling R2: files sharing a stem share one preview, made from the first
+# source in this order: these images, then videos (by extension name).
+IMAGE_SOURCE_ORDER = (".png", ".jpg", ".jpeg", ".webp", ".gif")
+
+
+def source_rank(source_extension):
+    """Sort key of a source extension in R2's order (images first)."""
+    extension = source_extension.lower()
+    if extension in IMAGE_SOURCE_ORDER:
+        return (0, IMAGE_SOURCE_ORDER.index(extension), extension)
+    return (1, 0, extension)
+
+
+def owns(thumb_extension, source_extension):
+    """Whether a ``_thumb<thumb_extension>`` preview can belong to a source
+    with *source_extension* (ruling R4)."""
+    thumb_extension = thumb_extension.lower()
+    if thumb_extension in WRITTEN_EXTENSIONS:
+        return True
+    if thumb_extension in LEGACY_EXTENSIONS:
+        return thumb_extension == source_extension.lower()
+    return False
+
+
+def _legacy_extension(source_extension):
+    from .inspection_service import VIDEO_EXTENSIONS
+
+    source_extension = source_extension.lower()
+    return ".jpg" if source_extension in VIDEO_EXTENSIONS else source_extension
+
+
+def candidate_extensions(source_extension, preferred=None):
+    """The preview extensions a source owns, in lookup order: the configured
+    one, the name an older release gave it, then the other written ones."""
+    preferred = preferred or current().extension
+    ordered = [preferred, _legacy_extension(source_extension), *WRITTEN_EXTENSIONS]
+    seen = []
+    for extension in ordered:
+        if extension not in seen and owns(extension, source_extension):
+            seen.append(extension)
+    return tuple(seen)
+
+
+def owned_extensions(source_extension, preferred=None):
+    """``candidate_extensions`` plus the other spellings an older release
+    may have given a legacy preview (review M1): the source's own
+    (``X_thumb.JPG`` for ``X.JPG``) and the upper-case legacy one."""
+    extensions = list(candidate_extensions(source_extension, preferred))
+    legacy = _legacy_extension(source_extension)
+    for spelling in (source_extension, legacy.upper()):
+        if spelling not in extensions and owns(spelling, source_extension):
+            extensions.append(spelling)
+    return tuple(extensions)
+
+
+def _is_preview_file(path):
+    try:
+        return not path.is_symlink() and path.is_file()
+    except OSError:
+        return False
+
+
+def owned_in_folder(folder, stem, source_extension, preferred=None):
+    """Yield the existing previews ``<folder>/<stem><ext>`` a source with
+    *source_extension* owns, in lookup order (regular files, no links; one
+    file found under two spellings on a case-insensitive disk once)."""
+    seen = set()
+    for extension in owned_extensions(source_extension, preferred):
+        path = Path(folder) / (stem + extension)
+        if not _is_preview_file(path):
+            continue
+        try:
+            stat = path.stat()
+            identity = (stat.st_dev, stat.st_ino) if stat.st_ino else str(path)
+        except OSError:
+            continue
+        if identity in seen:
+            continue  # the same file under another case (Windows, macOS)
+        seen.add(identity)
+        yield path
+
+
+def _owned(root, rel_path, preferred):
+    rel_path = Path(rel_path)
+    stem = Path(root) / thumbnail_stem_rel(rel_path)
+    return owned_in_folder(stem.parent, stem.name, rel_path.suffix, preferred)
+
+
+def owned_thumbnails(root, rel_path, preferred=None):
+    """Every existing preview of *rel_path* under *root*, in lookup order."""
+    return list(_owned(root, rel_path, preferred))
+
+
+def existing_thumbnail(root, rel_path, preferred=None):
+    """The preview a listing shows for *rel_path*: the first owned one that
+    exists (the configured format first), or None."""
+    return next(_owned(root, rel_path, preferred), None)
+
+
+def content_type(path):
+    """The Content-Type of a preview file by its extension, or None."""
+    return CONTENT_TYPES.get(os.path.splitext(str(path))[1].lower())
@@ -7,6 +7,7 @@ Refactored from standalone_tagger.py for integration with PromptManager API.

 import errno
 import gc
+import inspect
 import os
 import sys
 from pathlib import Path
@@ -25,6 +26,71 @@ except ImportError:
    from database.annotations import MAX_IMAGE_TAGS
    from database.vocabulary import validate_vocabulary_tag_name

+# The tag template and thresholds live with the saved tagging defaults
+# (#328), so config.py never imports PIL.
+try:
+    from .tagging_defaults import DEFAULT_TAG_TEMPLATE
+except ImportError:
+    from py.tagging_defaults import DEFAULT_TAG_TEMPLATE
+
+try:
+    from ..utils import exit_signal
+except ImportError:
+    from utils import exit_signal
+
+
+def abort_hub_downloads() -> None:
+    """Abort huggingface_hub's Xet transfers (run by the exit hook, #376).
+
+    Xet downloads report progress from native code, which ignores an
+    exception raised in ``tqdm.update``; huggingface_hub aborts them itself
+    on Ctrl+C with ``abort_xet_session``. Nothing happens when
+    huggingface_hub was never imported or has no Xet support.
+    """
+    if "huggingface_hub" not in sys.modules:
+        return
+    try:
+        from huggingface_hub.utils import _xet
+    except ImportError:
+        return
+    abort = getattr(_xet, "abort_xet_session", None)
+    if callable(abort):
+        abort()
+
+
+def _stop_at_exit(download) -> Dict[str, Any]:
+    """Keyword arguments that stop a huggingface_hub download at its next
+    chunk once the interpreter is exiting (#376), or none when this
+    huggingface_hub does not take ``tqdm_class``.
+
+    huggingface_hub 1.x removes its partial temp file on any failure; older
+    versions keep their resumable ``.incomplete`` file. The model's own path
+    is only written by the final rename either way.
+    """
+    try:
+        if "tqdm_class" not in inspect.signature(download).parameters:
+            return {}
+        from huggingface_hub.utils import tqdm as hub_tqdm
+    except (ImportError, TypeError, ValueError):
+        return {}
+
+    class StopAtExit(hub_tqdm):
+        def update(self, n=1):
+            exit_signal.checkpoint()
+            return super().update(n)
+
+    return {"tqdm_class": StopAtExit}
+
+
+def _autotag_config():
+    """The saved defaults; imported late, as config needs ComfyUI's server."""
+    try:
+        from .config import AutotagConfig
+    except ImportError:
+        from py.config import AutotagConfig
+    return AutotagConfig
+
+
 # Try to import logging from utils, fallback to standard logging
 try:
    from ..utils.logging_config import get_logger
@@ -45,10 +111,12 @@ except ImportError:
        return logger


-# Model configurations - same as standalone_tagger.py
+# Model configurations - same as standalone_tagger.py. ``label`` is the short
+# name System, Activity and a 409 model-busy show (#328).
 MODELS = {
    "gguf": {
        "name": "GGUF (Recommended)",
+        "label": "GGUF JoyCaption",
        "description": "Quantized model, ~4.5GB, faster loading",
        "size": "~4.5GB",
        "repo": "mradermacher/llama-joycaption-beta-one-hf-llava-GGUF",
@@ -59,6 +127,7 @@ MODELS = {
    },
    "hf": {
        "name": "HuggingFace",
+        "label": "HuggingFace JoyCaption",
        "description": "Full precision model, ~16GB, higher quality",
        "size": "~16GB",
        "repo": "fancyfeast/llama-joycaption-beta-one-hf-llava",
@@ -66,6 +135,7 @@ MODELS = {
    },
    "wd14-swinv2": {
        "name": "WD14 SwinV2",
+        "label": "WD14 SwinV2",
        "description": "Fast classifier tagger, ~400MB, no prompt needed",
        "size": "~400MB",
        "repo": "SmilingWolf/wd-swinv2-tagger-v3",
@@ -75,6 +145,7 @@ MODELS = {
    },
    "wd14-vit": {
        "name": "WD14 ViT",
+        "label": "WD14 ViT",
        "description": "Fast classifier tagger, ~400MB, ViT architecture",
        "size": "~400MB",
        "repo": "SmilingWolf/wd-vit-tagger-v3",
@@ -85,17 +156,7 @@ MODELS = {
 }

 # Default prompts
-DEFAULT_PROMPT = (
-    "Generate only comma-separated Danbooru tags (lowercase_underscores, no spaces).\n"
-    "Include: subject_count (1girl/1boy/etc), gender, ethnicity (asian, caucasian, "
-    "etc), age_approx (teen, young_woman), body_attributes, face_features, "
-    "hairstyle, appearance, clothing, accessories, pose, expression, action, "
-    "camera_angle, camera_shot, scene_composition (wide_shot, long_shot, "
-    "dutch_angle), environment, background_elements, lighting, mood.\n"
-    "Prioritize visual accuracy.\n"
-    "No sentences, no commentary, no captions. Only tags. Keep length short but "
-    "descriptive."
-)
+DEFAULT_PROMPT = DEFAULT_TAG_TEMPLATE

 # Upper bound of one suggestion request: the image tag set cap.
 MAX_SUGGESTION_LIMIT = MAX_IMAGE_TAGS
@@ -179,10 +240,6 @@ class AutoTagService:
        self._current_model_type: Optional[str] = None
        self._custom_prompt: str = DEFAULT_PROMPT

-        # WD14 threshold defaults
-        self._wd14_general_threshold: float = 0.35
-        self._wd14_character_threshold: float = 0.85
-
    @property
    def models_config(self) -> Dict[str, Dict[str, Any]]:
        """Get the models configuration dictionary."""
@@ -205,19 +262,13 @@ class AutoTagService:

    @property
    def wd14_general_threshold(self) -> float:
-        return self._wd14_general_threshold
-
-    @wd14_general_threshold.setter
-    def wd14_general_threshold(self, value: float):
-        self._wd14_general_threshold = max(0.0, min(1.0, value))
+        """The saved General-tag confidence (``autotag.defaults``)."""
+        return _autotag_config().GENERAL_THRESHOLD

    @property
    def wd14_character_threshold(self) -> float:
-        return self._wd14_character_threshold
-
-    @wd14_character_threshold.setter
-    def wd14_character_threshold(self, value: float):
-        self._wd14_character_threshold = max(0.0, min(1.0, value))
+        """The saved Character-tag confidence (``autotag.defaults``)."""
+        return _autotag_config().CHARACTER_THRESHOLD

    def get_models_status(self) -> Dict[str, Dict[str, Any]]:
        """Get availability status for all model types.
@@ -395,6 +446,7 @@ class AutoTagService:
                    filename=filename,
                    local_dir=str(model_dir),
                    local_dir_use_symlinks=False,
+                    **_stop_at_exit(hf_hub_download),
                )

        if progress_callback:
@@ -539,6 +591,13 @@ class AutoTagService:
            else:
                return self._download_hf_model(progress_callback)
        except Exception as e:
+            if exit_signal.requested():
+                # ExitRequested between chunks, or the Xet session aborted
+                # by the exit hook (abort_hub_downloads).
+                self.logger.info(
+                    f"Model download stopped: ComfyUI is exiting ({model_type})"
+                )
+                return False
            self.logger.error(f"Download failed: {e}")
            if progress_callback:
                progress_callback(f"Error: {str(e)}", 0)
@@ -568,6 +627,7 @@ class AutoTagService:
                filename=config["filename"],
                local_dir=str(gguf_dir),
                local_dir_use_symlinks=False,
+                **_stop_at_exit(hf_hub_download),
            )
            self.logger.info("GGUF model downloaded")

@@ -585,6 +645,7 @@ class AutoTagService:
                filename=config["mmproj_filename"],
                local_dir=str(gguf_dir),
                local_dir_use_symlinks=False,
+                **_stop_at_exit(hf_hub_download),
            )
            self.logger.info("mmproj downloaded")

@@ -611,6 +672,7 @@ class AutoTagService:
                repo_id=config["repo"],
                local_dir=str(model_dir),
                local_dir_use_symlinks=False,
+                **_stop_at_exit(snapshot_download),
            )
            self.logger.info("HF model downloaded")

@@ -754,6 +816,24 @@ class AutoTagService:

            self.logger.info("Model unloaded, memory freed")

+    def wd14_device(self) -> str:
+        """``"gpu"`` when WD14 runs (or would run) on CUDA, else ``"cpu"``.
+
+        A loaded WD14 session answers from its own first provider; otherwise
+        ONNX Runtime's available providers say whether CUDA would be offered
+        (a session can still fall back to the processor). Loads no model.
+        """
+        tagger = self._tagger
+        if tagger is not None and tagger[0] == "wd14":
+            providers = tagger[1][0].get_providers()
+            return "gpu" if providers[:1] == ["CUDAExecutionProvider"] else "cpu"
+        try:
+            import onnxruntime as ort
+        except ImportError:
+            return "cpu"
+        available = ort.get_available_providers()
+        return "gpu" if "CUDAExecutionProvider" in available else "cpu"
+
    def is_model_loaded(self) -> bool:
        """Check if a model is currently loaded."""
        return self._tagger is not None
@@ -860,12 +940,12 @@ class AutoTagService:
            gen_thresh = (
                general_threshold
                if general_threshold is not None
-                else self._wd14_general_threshold
+                else _autotag_config().GENERAL_THRESHOLD
            )
            char_thresh = (
                character_threshold
                if character_threshold is not None
-                else self._wd14_character_threshold
+                else _autotag_config().CHARACTER_THRESHOLD
            )
            return self._generate_wd14(
                session, tags_list, image, gen_thresh, char_thresh
@@ -36,12 +36,14 @@ from typing import Any, Dict, List, Optional, Tuple  # noqa: E402
 # Import logging system
 try:
    from ..utils.logging_config import get_logger
+    from ..utils import library_location
 except ImportError:
    import sys

    current_dir = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
    sys.path.insert(0, current_dir)
    from utils.logging_config import get_logger
+    from utils import library_location

 # Initialize logger for config operations
 config_logger = get_logger("prompt_manager.config")
@@ -200,7 +202,6 @@ class GalleryConfig:
        AUTO_CLEANUP_MISSING_FILES (bool): Automatically remove missing file records
        MAX_IMAGE_AGE_DAYS (int): Maximum age in days before cleaning up images
        IMAGES_PER_PAGE (int): Number of images to display per page in web UI
-        THUMBNAIL_SIZE (int): Size in pixels for generated thumbnails
        ENABLE_SEARCH (bool): Enable search functionality in web interface
        ENABLE_METADATA_VIEW (bool): Enable metadata viewing for images
        MAX_CONCURRENT_PROCESSING (int): Maximum concurrent image processing tasks
@@ -225,7 +226,6 @@ class GalleryConfig:

    # Web interface settings
    IMAGES_PER_PAGE = 20
-    THUMBNAIL_SIZE = 256
    ENABLE_SEARCH = True
    ENABLE_METADATA_VIEW = True

@@ -265,7 +265,6 @@ class GalleryConfig:
            },
            "web_interface": {
                "images_per_page": cls.IMAGES_PER_PAGE,
-                "thumbnail_size": cls.THUMBNAIL_SIZE,
                "enable_search": cls.ENABLE_SEARCH,
                "enable_metadata_view": cls.ENABLE_METADATA_VIEW,
            },
@@ -328,8 +327,6 @@ class GalleryConfig:
        web_interface = new_config.get("web_interface", {})
        if "images_per_page" in web_interface:
            cls.IMAGES_PER_PAGE = web_interface["images_per_page"]
-        if "thumbnail_size" in web_interface:
-            cls.THUMBNAIL_SIZE = web_interface["thumbnail_size"]
        if "enable_search" in web_interface:
            cls.ENABLE_SEARCH = web_interface["enable_search"]
        if "enable_metadata_view" in web_interface:
@@ -566,18 +563,92 @@ class IntegrationConfig:
 DEFAULT_SUGGESTION_LIMIT = 10
 MAX_SUGGESTION_LIMIT = 100  # pinned to MAX_IMAGE_TAGS by tests/test_config.py

+# The tagging engines, options, template and validators (server-free, #328).
+try:
+    from .tagging_defaults import (  # noqa: F401 - re-exported
+        DEFAULT_TAG_TEMPLATE,
+        EXISTING_POLICIES,
+        LLM_MODEL_TYPES,
+        MAX_INSTRUCTION_BYTES,
+        MAX_INSTRUCTION_CHARS,
+        MODEL_TYPES,
+        WD14_MODEL_TYPES,
+        validate_saved_threshold,
+        validate_template,
+        validate_threshold,
+    )
+except ImportError:
+    from py.tagging_defaults import (  # noqa: F401 - re-exported
+        DEFAULT_TAG_TEMPLATE,
+        EXISTING_POLICIES,
+        LLM_MODEL_TYPES,
+        MAX_INSTRUCTION_BYTES,
+        MAX_INSTRUCTION_CHARS,
+        MODEL_TYPES,
+        WD14_MODEL_TYPES,
+        validate_saved_threshold,
+        validate_template,
+        validate_threshold,
+    )
+
+
+def _valid_model_type(value: Any) -> str:
+    if not isinstance(value, str) or value not in MODEL_TYPES:
+        raise ValueError("must be one of " + ", ".join(sorted(MODEL_TYPES)))
+    return value
+
+
+def _valid_existing(value: Any) -> str:
+    if not isinstance(value, str) or value not in EXISTING_POLICIES:
+        raise ValueError("must be one of " + ", ".join(EXISTING_POLICIES))
+    return value
+
+
+def _valid_suggestion_limit(value: Any) -> int:
+    if type(value) is not int or not 1 <= value <= MAX_SUGGESTION_LIMIT:
+        raise ValueError(f"must be an integer from 1 to {MAX_SUGGESTION_LIMIT}")
+    return value
+

 class AutotagConfig:
    """Persisted tagging defaults under ``autotag.defaults`` in config.json.

-    ``suggestion_limit`` is how many suggestions Generate returns (the top N
-    by score), an integer in ``1..MAX_SUGGESTION_LIMIT``. A hand-edited value
-    outside that range, or of another type, falls back to the default with a
-    warning rather than failing the load.
+    One tagging configuration (#328): the model, what a batch does with
+    prompts already tagged, the two WD14 thresholds, the language-model
+    template and how many suggestions Generate returns. Each key is checked
+    alone on load; a hand-edited value that fails its check falls back to
+    its default with one warning rather than failing the load.
    """

+    MODEL_TYPE = "wd14-swinv2"
+    EXISTING = "skip"
+    GENERAL_THRESHOLD = 0.35
+    CHARACTER_THRESHOLD = 0.85
+    TEMPLATE = DEFAULT_TAG_TEMPLATE
    SUGGESTION_LIMIT = DEFAULT_SUGGESTION_LIMIT

+    # config.json key -> (attribute, validator, default)
+    _KEYS = {
+        "model_type": ("MODEL_TYPE", _valid_model_type, "wd14-swinv2"),
+        "existing": ("EXISTING", _valid_existing, "skip"),
+        "general_threshold": (
+            "GENERAL_THRESHOLD",
+            lambda v: validate_saved_threshold("value", v),
+            0.35,
+        ),
+        "character_threshold": (
+            "CHARACTER_THRESHOLD",
+            lambda v: validate_saved_threshold("value", v),
+            0.85,
+        ),
+        "template": ("TEMPLATE", validate_template, DEFAULT_TAG_TEMPLATE),
+        "suggestion_limit": (
+            "SUGGESTION_LIMIT",
+            _valid_suggestion_limit,
+            DEFAULT_SUGGESTION_LIMIT,
+        ),
+    }
+
    @classmethod
    def suggestion_limit(cls) -> int:
        return cls.SUGGESTION_LIMIT
@@ -590,7 +661,14 @@ class AutotagConfig:

    @classmethod
    def get_config(cls) -> Dict[str, Any]:
-        return {"defaults": {"suggestion_limit": cls.SUGGESTION_LIMIT}}
+        """The saved defaults; the template only when it is not the built-in
+        one, so a later built-in template still reaches who never set one."""
+        defaults = {
+            key: getattr(cls, attr) for key, (attr, _v, _d) in cls._KEYS.items()
+        }
+        if defaults["template"] == DEFAULT_TAG_TEMPLATE:
+            del defaults["template"]
+        return {"defaults": defaults}

    @classmethod
    def update_config(cls, new_config: Any) -> None:
@@ -601,17 +679,18 @@ class AutotagConfig:
        if not isinstance(defaults, dict):
            config_logger.warning("Ignoring autotag.defaults that is not an object")
            return
-        if "suggestion_limit" not in defaults:
-            return
-        value = defaults["suggestion_limit"]
-        if cls.valid_suggestion_limit(value):
-            cls.SUGGESTION_LIMIT = value
-            return
-        config_logger.warning(
-            "autotag.defaults.suggestion_limit must be an integer from 1 to "
-            f"{MAX_SUGGESTION_LIMIT}; using {DEFAULT_SUGGESTION_LIMIT}"
-        )
-        cls.SUGGESTION_LIMIT = DEFAULT_SUGGESTION_LIMIT
+        for key, (attr, validate, default) in cls._KEYS.items():
+            if key not in defaults:
+                continue
+            try:
+                setattr(cls, attr, validate(defaults[key]))
+            except ValueError as error:
+                config_logger.warning(
+                    f"autotag.defaults.{key} {error}; using {default!r}"
+                    if key != "template"
+                    else f"autotag.defaults.template {error}; using the built-in one"
+                )
+                setattr(cls, attr, default)


 class PromptManagerConfig:
@@ -663,6 +742,19 @@ class PromptManagerConfig:
    # database first (System › Backup & export › Recovery policy, #249 S6).
    SAFETY_BACKUP = True

+    # "Keep it here" (#249 S6b): the user chose to keep a node-folder library
+    # where it is, so the workspace stops offering to move it.
+    KEEP_LIBRARY_IN_NODE_FOLDER = False
+
+    # Thumbnails (#317): every preview writer reads these through
+    # py/api/thumbnail_settings.py (System › Appearance). The legacy
+    # ``gallery.web_interface.thumbnail_size`` was never read and is ignored.
+    THUMBNAIL_FORMATS = ("webp", "jxl", "jpeg")
+    THUMBNAIL_FORMAT = "webp"
+    THUMBNAIL_QUALITY = 80
+    THUMBNAIL_EDGE = 512
+    THUMBNAIL_EDGE_RANGE = (128, 2048)
+
    @classmethod
    def max_worker_threads(cls) -> int:
        """Largest accepted worker-thread count: the detected core count."""
@@ -718,6 +810,12 @@ class PromptManagerConfig:
                "worker_threads": cls.WORKER_THREADS,
            },
            "maintenance": {"safety_backup": cls.SAFETY_BACKUP},
+            "library": {"keep_in_node_folder": cls.KEEP_LIBRARY_IN_NODE_FOLDER},
+            "thumbnails": {
+                "format": cls.THUMBNAIL_FORMAT,
+                "quality": cls.THUMBNAIL_QUALITY,
+                "edge": cls.THUMBNAIL_EDGE,
+            },
            "gallery": GalleryConfig.get_config(),
            "integrations": IntegrationConfig.get_config(),
            "autotag": AutotagConfig.get_config(),
@@ -727,14 +825,12 @@ class PromptManagerConfig:
    def get_config_path(cls) -> str:
        """Path of the persisted config.json.

-        Honours ``PROMPT_MANAGER_CONFIG_PATH`` when set; otherwise the file
-        lives at the repository root next to ``pyproject.toml``.
+        Honours ``PROMPT_MANAGER_CONFIG_PATH`` when set; otherwise it lives in
+        the library's data folder (``utils.library_location``): the node
+        folder for a library that was not moved, else ComfyUI's
+        ``user/__promptmanager``.
        """
-        override = os.environ.get(CONFIG_PATH_ENV, "").strip()
-        if override:
-            return override
-        repo_root = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
-        return os.path.join(repo_root, "config.json")
+        return library_location.config_location()[0]

    @classmethod
    def load_from_file(cls, config_path: Optional[str] = None):
@@ -859,6 +955,14 @@ class PromptManagerConfig:
        ):
            cls.SAFETY_BACKUP = maintenance["safety_backup"]

+        library = new_config.get("library", {})
+        if isinstance(library, dict) and isinstance(
+            library.get("keep_in_node_folder"), bool
+        ):
+            cls.KEEP_LIBRARY_IN_NODE_FOLDER = library["keep_in_node_folder"]
+
+        cls._update_thumbnails(new_config.get("thumbnails"))
+
        # Update gallery config
        if "gallery" in new_config:
            GalleryConfig.update_config(new_config["gallery"])
@@ -870,6 +974,22 @@ class PromptManagerConfig:
        if "autotag" in new_config:
            AutotagConfig.update_config(new_config["autotag"])

+    @classmethod
+    def _update_thumbnails(cls, section: Any) -> None:
+        """Apply a ``thumbnails`` section; a hand-edited bad value is ignored."""
+        if not isinstance(section, dict):
+            return
+        fmt = section.get("format")
+        if fmt in cls.THUMBNAIL_FORMATS:
+            cls.THUMBNAIL_FORMAT = fmt
+        quality = section.get("quality")
+        if type(quality) is int and 1 <= quality <= 100:
+            cls.THUMBNAIL_QUALITY = quality
+        edge = section.get("edge")
+        low, high = cls.THUMBNAIL_EDGE_RANGE
+        if type(edge) is int and low <= edge <= high:
+            cls.THUMBNAIL_EDGE = edge
+

 # Load configuration on import
 try:
@@ -0,0 +1,229 @@
+"""The staged LoRA reference import (#221, #249 System S10, #355).
+
+The import reads LoraManager's ``*.metadata.json`` sidecars and turns each
+LoRA into one prompt of the ``lora-manager`` category, tagged with its name and
+trigger words and linked to its images. It runs in three stages, and only the
+last writes to the database:
+
+1. **discover**: read LoraManager's settings the way LoraManager does
+   (``py/lora_manager_layout.py``: the settings file from the environment
+   folder, the portable plugin file or the user config folder; the LoRA
+   roots, the storage mode, the sidecar and example-images roots) and find
+   the sidecars (``discover``). In ``alongside`` mode a sidecar beside its
+   model is kept when ``<base>.safetensors`` exists; in ``centralized`` mode
+   every sidecar under the sidecar root is kept when its ``file_path`` names
+   a model inside a LoRA root. ``fingerprint`` covers every scanned sidecar,
+   kept or skipped (path, size, modification time, kept or not, #362) and the
+   layout; ``preview`` adds the counts a review shows. Nothing is written
+   and nothing is requested.
+2. **stage**: read each sidecar and build its record. Its LoraManager preview
+   and example images are linked where they are (``local_media``); only a
+   LoRA without any local image downloads its CivitAI example images into the
+   image cache first (best effort, counted). A cancelled or failed stage
+   leaves the database untouched; downloaded images stay in the cache.
+3. **replace**: the sidecars are found and fingerprinted once more (a file
+   changed, removed or added while staging aborts the import), then
+   ``PromptDatabase.replace_category_prompts`` swaps the old collection for
+   the staged records in one transaction (or changes nothing).
+
+Both the System job (``POST /lora/import/apply``) and the legacy ``POST
+/lora/scan`` run these stages (``py/api/lora_integration.py``).
+"""
+
+import hashlib
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import AbstractSet, Callable, Dict, List, Optional
+
+from . import lora_utils
+from .lora_manager_layout import (
+    Discovery,
+    discover_sidecars,
+    layout_summary,
+    local_media,
+)
+
+try:
+    from ..utils import exit_signal
+    from ..utils.hashing import generate_prompt_hash
+except ImportError:  # pragma: no cover - flat test imports
+    from utils import exit_signal
+    from utils.hashing import generate_prompt_hash
+
+LORA_CATEGORY = "lora-manager"
+JOB_TITLE = "LoRA reference import"
+# The job's outcome groups, in its counter-tile order.
+GROUPS = ("imported", "linked", "skipped", "downloaded", "download_errors", "errors")
+
+
+class ImportCancelled(Exception):
+    """The import was cancelled while staging; nothing was written."""
+
+
+def discover(lora_manager_path: Optional[str]) -> Discovery:
+    """The sidecars of every LoRA whose model exists inside a LoRA root.
+
+    ``lora_manager_path`` is resolved as the integration resolves it (an
+    install under ``custom_nodes``; empty means auto-detection). Raises
+    whatever listing a folder raised: a discovery that cannot see every
+    folder must not replace the collection with part of it.
+    """
+    return discover_sidecars(lora_utils.lora_manager_layout(lora_manager_path))
+
+
+def fingerprint(discovery: Discovery) -> str:
+    """What a review saw: the layout, then every scanned sidecar, kept or
+    skipped, with its path, size, modification time and whether it was kept
+    (#362). A LoraManager save that changes unrelated settings leaves it as
+    it was."""
+    layout = discovery.layout
+    digest = hashlib.sha256()
+    for value in (
+        layout.settings_path,
+        layout.source,
+        layout.error,
+        layout.mode,
+        "\0".join(layout.lora_roots),
+        layout.sidecar_root,
+        layout.example_images_root,
+        layout.library,
+    ):
+        digest.update(f"{value}\n".encode("utf-8", "surrogatepass"))
+    for name in discovery.unreadable:
+        digest.update(f"unreadable\0{name}\n".encode("utf-8", "surrogatepass"))
+    kept = {str(sidecar.metadata_path) for sidecar in discovery.sidecars}
+    for path in discovery.scanned_files:
+        flag = 1 if str(path) in kept else 0
+        try:
+            stat = path.stat()
+            entry = f"{path}\0{stat.st_size}\0{stat.st_mtime_ns}\0{flag}\n"
+        except OSError:
+            entry = f"{path}\0missing\0{flag}\n"
+        digest.update(entry.encode("utf-8", "surrogatepass"))
+    return "sha256:" + digest.hexdigest()
+
+
+def preview(
+    lora_manager_path: Optional[str],
+    cache_dir: Path,
+    media_extensions: AbstractSet[str],
+) -> Dict:
+    """The review's counts (blocking; reads only, requests nothing).
+
+    ``{lora_files, with_metadata, skipped, with_local_media,
+    planned_downloads, fingerprint, names, layout}``: the metadata files
+    seen, the kept LoRAs whose sidecar parses, the rest, the LoRAs with a
+    local image, the CivitAI images an import would download for the LoRAs
+    without one (not yet in the cache), the first LoRA names and what the
+    layout says (``layout_summary``).
+    """
+    discovery = discover(lora_manager_path)
+    layout = discovery.layout
+    with_metadata = 0
+    with_local_media = 0
+    planned = 0
+    names = []
+    for sidecar in discovery.sidecars:
+        metadata = lora_utils.read_lora_metadata(sidecar.metadata_path)
+        if not metadata:
+            continue
+        with_metadata += 1
+        if local_media(sidecar, metadata, layout, media_extensions):
+            with_local_media += 1
+        else:
+            planned += lora_utils.planned_civitai_downloads(
+                metadata, sidecar.metadata_path, cache_dir
+            )
+        if len(names) < 50:
+            names.append(lora_utils.get_model_name_from_metadata(metadata))
+    return {
+        "lora_files": discovery.scanned,
+        "with_metadata": with_metadata,
+        "skipped": discovery.scanned - with_metadata,
+        "with_local_media": with_local_media,
+        "planned_downloads": planned,
+        "fingerprint": fingerprint(discovery),
+        "names": names,
+        "layout": layout_summary(layout, Path.home()),
+    }
+
+
+def build_record(metadata: Dict, path: Path, images: List[str]) -> Dict:
+    """The prompt a LoRA becomes: its example prompt (else its name), tags, images."""
+    model_name = lora_utils.get_model_name_from_metadata(metadata)
+    text = lora_utils.get_example_prompt_from_metadata(metadata) or model_name
+    tags = ["lora-manager", f"lora:{model_name}"]
+    tags.extend(lora_utils.get_trigger_words_from_metadata(metadata))
+    return {
+        "name": model_name,
+        "text": text,
+        "hash": generate_prompt_hash(text),
+        "tags": list(dict.fromkeys(tags)),
+        "images": images,
+    }
+
+
+@dataclass
+class StagedImport:
+    """The records an import will write, and what staging counted."""
+
+    total: int
+    records: List[Dict] = field(default_factory=list)
+    skipped: List[str] = field(default_factory=list)
+    stats: Dict[str, int] = field(
+        default_factory=lambda: {"downloaded": 0, "download_errors": 0}
+    )
+
+
+def stage(
+    discovery: Discovery,
+    cache_dir: Path,
+    api_key: str = "",
+    *,
+    media_extensions: AbstractSet[str],
+    on_record: Optional[Callable[[int, Dict, "StagedImport"], None]] = None,
+    cancelled: Callable[[], bool] = lambda: False,
+    logger=None,
+) -> StagedImport:
+    """Read each sidecar and build its record with its images.
+
+    Blocking. Local images (``local_media``) come first; a LoRA without any
+    downloads its CivitAI example images. A sidecar that cannot be read, or
+    whose record fails to build, is skipped by its name, as are the
+    centralized sidecars discovery could not parse. ``cancelled()`` is asked
+    before each sidecar, and so is the exit signal (#376: the legacy scan's
+    ``cancelled`` does not read it); either raises ImportCancelled. ``on_record(index,
+    record_or_None, staged)`` follows each one.
+    """
+    sidecars = discovery.sidecars
+    staged = StagedImport(total=len(sidecars))
+    staged.skipped.extend(discovery.unreadable)
+    for index, sidecar in enumerate(sidecars):
+        if cancelled() or exit_signal.requested():
+            raise ImportCancelled()
+        record = None
+        path = sidecar.metadata_path
+        metadata = lora_utils.read_lora_metadata(path)
+        if not metadata:
+            staged.skipped.append(path.name)
+        else:
+            try:
+                local = local_media(
+                    sidecar, metadata, discovery.layout, media_extensions
+                )
+                remote = []
+                if not local:
+                    remote = lora_utils.download_civitai_images(
+                        metadata, path, cache_dir, api_key, stats=staged.stats
+                    )
+                images = list(dict.fromkeys([*local, *remote]))
+                record = build_record(metadata, path, images)
+                staged.records.append(record)
+            except Exception as error:  # one LoRA never stops the import
+                name = lora_utils.get_model_name_from_metadata(metadata)
+                if logger is not None:
+                    logger.warning(f"Failed to prepare LoRA {name}: {error}")
+                staged.skipped.append(name)
+        if on_record is not None:
+            on_record(index, record, staged)
+    return staged
@@ -0,0 +1,217 @@
+"""A per-process cache of LoraManager's layout for the image hot paths (#362).
+
+Every Library list, prompt detail, inspect, reveal and serve request needs the
+LoRA allow-list (``ImagesMixin._lora_image_dirs``). Building it means finding
+the LoraManager install, reading its plugin settings file and its settings
+file, and resolving every folder. ``LayoutCache`` keeps the last result and
+reuses it while all of these hold:
+
+- the key (the configured install path, stripped) and the home folder the
+  folder guard compares against are the same;
+- the entry is younger than ``MAX_AGE_SECONDS`` (monotonic clock);
+- the plugin settings file and the settings file have the same signature
+  (``st_mtime_ns``, ``st_size``, or ``MISSING``) as when it was stored;
+- the install and every stored media root still resolve to themselves (a
+  folder swapped for a symlink reloads, so the folder guard runs again).
+
+A result is stored only when no watched file is "racy" (modified within
+``RACY_SECONDS`` of the load, git's rule for racily clean index entries),
+every watched file could be checked, the settings file was readable, and no
+``clear()`` ran during the load. What each rule covers: signatures catch a
+settings change on the next request; the racy rule catches a write during the
+load, a half-written file and coarse timestamps; the maximum age bounds the
+inputs no signature sees (``extra_model_paths.yaml``, environment, temporary
+failures); ``clear()`` makes a finished import's new folders servable at once.
+
+Hits and loads take no lock: a slow ``os.stat`` on a network share holds up
+only its own request, and two threads that miss together both load (both
+loads only read). A short lock guards the compare-and-store and the logging
+state; no file I/O runs under it. Standard library only, so it is tested
+without ComfyUI or LoraManager.
+"""
+
+import logging
+import os
+import threading
+import time
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Callable, Optional, Tuple
+
+from .lora_manager_layout import UNREADABLE, LoraManagerLayout, _canonical
+
+# A watched file modified this recently is not trusted: LoraManager writes its
+# settings in place, and FAT/exFAT store modification times in 2 s steps.
+RACY_SECONDS = 3
+# Bounds what no signature sees (unwatched inputs, temporary failures).
+MAX_AGE_SECONDS = 30
+
+# The signature of a watched file that does not exist (a valid state).
+MISSING = object()
+# ERROR_BAD_NETPATH and ERROR_BAD_NET_NAME, which Windows raises as
+# FileNotFoundError.
+_OFFLINE_SHARE_ERRORS = frozenset({53, 67})
+
+logger = logging.getLogger("prompt_manager.lora_layout_cache")
+
+
+@dataclass(frozen=True)
+class _Entry:
+    key: str
+    home: str
+    install: Optional[str]
+    layout: LoraManagerLayout
+    signatures: Tuple[Tuple[str, object], ...]
+    stored_at: float
+
+
+class _CannotValidate(Exception):
+    """A watched file could not be checked (not merely missing)."""
+
+
+class LayoutCache:
+    """At most one ``(install, layout)`` for the active LoraManager config."""
+
+    def __init__(
+        self,
+        resolve: Callable[[str], Optional[str]],
+        load: Callable[[Optional[str]], LoraManagerLayout],
+        *,
+        wall_ns: Callable[[], int] = time.time_ns,
+        monotonic: Callable[[], float] = time.monotonic,
+        stat=os.stat,
+        pathmod=os.path,
+        home: Callable[[], str] = lambda: str(Path.home()),
+    ):
+        self._resolve = resolve
+        self._load = load
+        self._wall_ns = wall_ns
+        self._monotonic = monotonic
+        self._stat = stat
+        self._pathmod = pathmod
+        self._home = home
+        self._entry: Optional[_Entry] = None
+        self._generation = 0
+        self._lock = threading.Lock()
+        # What was last logged; survives clear() so a reload of the same
+        # layout stays quiet.
+        self._logged_layout: Optional[LoraManagerLayout] = None
+        self._logged_refused: Tuple[str, ...] = ()
+
+    def get(self, configured: str) -> Tuple[Optional[str], LoraManagerLayout]:
+        """``(install, layout)`` for the configured path ("" auto-detects)."""
+        key = (configured or "").strip()
+        home = self._home()
+        entry = self._entry
+        if entry is not None and self._valid(entry, key, home):
+            return entry.install, entry.layout
+        with self._lock:
+            if entry is not None and self._entry is entry:
+                self._entry = None
+            generation = self._generation
+        install = self._resolve(key)
+        layout = self._load(install)
+        self._log_refused(layout)
+        try:
+            signatures = tuple(
+                (path, self._signature(path)) for path in self._watched(install, layout)
+            )
+        except _CannotValidate:
+            return install, layout
+        if layout.error == UNREADABLE or self._racy(signatures, self._wall_ns()):
+            return install, layout
+        stored = _Entry(key, home, install, layout, signatures, self._monotonic())
+        changed = False
+        with self._lock:
+            if self._generation == generation:
+                self._entry = stored
+                changed = layout != self._logged_layout
+                if changed:
+                    self._logged_layout = layout
+        if changed:
+            logger.info(
+                f"LoraManager layout changed: {layout.source or 'no'} settings, "
+                f"{layout.mode} storage, {len(layout.media_roots)} media folders"
+            )
+        return install, layout
+
+    def clear(self) -> None:
+        """Drop the entry; a load that started before this stores nothing."""
+        with self._lock:
+            self._entry = None
+            self._generation += 1
+
+    def _log_refused(self, layout: LoraManagerLayout) -> None:
+        """One warning per default LoRA folder newly refused by the guard."""
+        refused = tuple(layout.refused_defaults)
+        with self._lock:
+            if refused == self._logged_refused:
+                return
+            new = [folder for folder in refused if folder not in self._logged_refused]
+            self._logged_refused = refused
+        for folder in new:
+            logger.warning(
+                f"ComfyUI LoRA folder '{folder}' is neither scanned nor served: "
+                "it is a filesystem root, the home folder or a folder that "
+                "contains it"
+            )
+
+    # ── validation ──────────────────────────────────────────────────
+
+    def _valid(self, entry: _Entry, key: str, home: str) -> bool:
+        if entry.key != key or entry.home != home:
+            return False
+        if self._monotonic() - entry.stored_at >= MAX_AGE_SECONDS:
+            return False
+        try:
+            for path, signature in entry.signatures:
+                if self._signature(path) != signature:
+                    return False
+        except _CannotValidate:
+            return False
+        folders = entry.layout.media_roots
+        if entry.install is not None:
+            folders = (entry.install,) + tuple(folders)
+        for folder in folders:
+            try:
+                if _canonical(folder, self._pathmod) != folder:
+                    return False
+            except (OSError, ValueError):
+                return False
+        return True
+
+    def _watched(self, install, layout) -> Tuple[str, ...]:
+        """The plugin settings file, then the settings file, each once."""
+        if install is None:
+            return ()
+        paths = [self._pathmod.join(install, "settings.json")]
+        if layout.settings_path is not None:
+            paths.append(str(layout.settings_path))
+        watched, seen = [], set()
+        for path in paths:
+            identity = self._pathmod.normcase(self._pathmod.abspath(path))
+            if identity not in seen:
+                seen.add(identity)
+                watched.append(path)
+        return tuple(watched)
+
+    def _signature(self, path: str):
+        try:
+            result = self._stat(path)
+        except (FileNotFoundError, NotADirectoryError) as error:
+            # Windows reports an offline share as "not found": that is a
+            # temporary failure, not a missing file.
+            if getattr(error, "winerror", None) in _OFFLINE_SHARE_ERRORS:
+                raise _CannotValidate(path) from error
+            return MISSING
+        except (OSError, ValueError) as error:
+            raise _CannotValidate(path) from error
+        return (result.st_mtime_ns, result.st_size)
+
+    @staticmethod
+    def _racy(signatures, now_ns: int) -> bool:
+        threshold = now_ns - RACY_SECONDS * 10**9
+        return any(
+            signature is not MISSING and signature[0] > threshold
+            for _path, signature in signatures
+        )
@@ -0,0 +1,653 @@
+"""Where LoraManager keeps its files (#355).
+
+LoraManager (``custom_nodes/comfyui-lora-manager``) stores one
+``<name>.metadata.json`` sidecar per model, a preview image or video beside
+it, and each model's downloaded CivitAI example images. Where it stores them
+is a user setting, and its settings file itself can live in three places.
+This module repeats LoraManager's own rules, reading its files only (never
+importing it), so the LoRA import, the trigger-word cache and the image
+server share one definition:
+
+- ``load_layout`` finds the settings file (environment folder, portable
+  plugin file, or the user config folder, in LoraManager's order), keeps only
+  the seven keys the import needs, and resolves the LoRA roots, the sidecar
+  root (centralized storage), the example-images root and the active
+  LoraManager library. Every folder from the settings, and each of
+  ComfyUI's default LoRA folders, passes the folder guard: it must exist and
+  must not be a filesystem root, the home folder or a folder that contains
+  it. Default folders the guard refuses are listed in ``refused_defaults``.
+- ``discover_sidecars`` finds every sidecar whose model file exists inside a
+  LoRA root: beside the models in ``alongside`` mode, under the sidecar root
+  (matched to its model by ``file_path``) in ``centralized`` mode.
+- ``local_media`` lists a LoRA's preview and example images that the image
+  server may serve.
+
+Standard library plus ``platformdirs`` only (LoraManager depends on it), so
+it is testable outside ComfyUI.
+"""
+
+import json
+import logging
+import os
+import re
+from dataclasses import dataclass, replace
+from pathlib import Path
+from typing import (
+    AbstractSet,
+    Callable,
+    Dict,
+    Iterator,
+    List,
+    Mapping,
+    Optional,
+    Sequence,
+    Tuple,
+)
+
+# py/utils/settings_paths.py: SETTINGS_DIR_ENV, _LM_PORTABLE_ENV, APP_NAME.
+SETTINGS_DIR_ENV = "LORA_MANAGER_SETTINGS_DIR"
+PORTABLE_ENV = "LORA_MANAGER_PORTABLE"
+APP_NAME = "ComfyUI-LoRA-Manager"
+# py/utils/constants.py PREVIEW_EXTENSIONS, in LoraManager's order.
+PREVIEW_EXTENSIONS = (
+    ".webp",
+    ".preview.webp",
+    ".preview.png",
+    ".preview.jpeg",
+    ".preview.jpg",
+    ".preview.mp4",
+    ".png",
+    ".jpeg",
+    ".jpg",
+    ".mp4",
+    ".gif",
+    ".webm",
+    ".avif",
+    ".jxl",
+)
+# LoraManager's LoRA scanner accepts .safetensors only (py/services/lora_scanner.py).
+MODEL_SUFFIX = ".safetensors"
+# py/utils/sidecar_paths.py METADATA_SUFFIX.
+METADATA_SUFFIX = ".metadata.json"
+MAX_SETTINGS_BYTES = 5 * 1024 * 1024
+# The only settings the import reads; every other key (the file can hold API
+# keys) is dropped right after parsing.
+SETTINGS_KEYS = frozenset(
+    {
+        "sidecar_storage_mode",
+        "sidecar_storage_path",
+        "example_images_path",
+        "folder_paths",
+        "extra_folder_paths",
+        "libraries",
+        "active_library",
+    }
+)
+# py/utils/sidecar_paths.py STORAGE_MODE_ALONGSIDE / STORAGE_MODE_CENTRALIZED.
+MODE_ALONGSIDE = "alongside"
+MODE_CENTRALIZED = "centralized"
+# utils/video_metadata.py VIDEO_EXTENSIONS (not imported: that package needs
+# the node's relative imports).
+VIDEO_SUFFIXES = frozenset({".mp4", ".mov", ".m4v", ".webm", ".mkv", ".avi", ".wmv"})
+
+SOURCE_ENVIRONMENT = "environment"
+SOURCE_PORTABLE = "portable"
+SOURCE_USER_CONFIG = "user config"
+
+NO_INSTALL = "no LoraManager install found"
+UNREADABLE = "the settings file could not be read"
+NOT_JSON = "the settings file is not valid JSON"
+NOT_OBJECT = "the settings file is not a JSON object"
+TOO_LARGE = "the settings file is larger than 5 MB"
+NO_PLATFORMDIRS = "platformdirs is not available"
+NO_SIDECAR_ROOT = "the sidecar folder does not exist"
+BAD_SIDECAR_ROOT = (
+    "the sidecar folder is a filesystem root, the home folder or a folder "
+    "that contains it"
+)
+
+logger = logging.getLogger("prompt_manager.lora_manager_layout")
+
+
+@dataclass(frozen=True)
+class LoraManagerLayout:
+    """What LoraManager's settings say about where its files are."""
+
+    settings_path: Optional[Path]
+    source: Optional[str]
+    error: Optional[str]
+    mode: str
+    lora_roots: Tuple[str, ...]
+    sidecar_root: Optional[str]
+    example_images_root: Optional[str]
+    library: str
+    media_roots: Tuple[str, ...]
+    # ComfyUI's default LoRA folders that exist but that the folder guard
+    # refused (canonical): the layout cache logs them (#362).
+    refused_defaults: Tuple[str, ...] = ()
+
+
+@dataclass(frozen=True)
+class Sidecar:
+    """One LoRA's metadata file and the model file it describes."""
+
+    metadata_path: Path
+    model_path: Path
+
+
+@dataclass(frozen=True)
+class Discovery:
+    """The sidecars kept, every metadata file seen, and those unread."""
+
+    layout: LoraManagerLayout
+    sidecars: List[Sidecar]
+    # Every ``*.metadata.json`` seen, kept or skipped: resolved, once each,
+    # sorted by ``str(path)``. The import's fingerprint covers all of them.
+    scanned_files: Tuple[Path, ...]
+    unreadable: List[str]
+
+    @property
+    def scanned(self) -> int:
+        """How many metadata files were seen."""
+        return len(self.scanned_files)
+
+
+class _SettingsError(Exception):
+    """The settings file cannot be used, for the reason it carries."""
+
+
+# ── paths ────────────────────────────────────────────────────────────
+
+
+def _canonical(path: str, pathmod=os.path) -> str:
+    # py/config.py _canonical_path (not imported: py.config imports ComfyUI's
+    # ``server`` at import time).
+    return pathmod.normcase(pathmod.realpath(path))
+
+
+def _is_filesystem_root(path: str, pathmod=os.path) -> bool:
+    # py/config.py _is_filesystem_root: '/', 'C:\\' and UNC share roots.
+    return pathmod.dirname(path) == path
+
+
+def _guard_folder(
+    path: str,
+    home: str,
+    *,
+    pathmod=os.path,
+    isdir: Optional[Callable[[str], bool]] = None,
+) -> Optional[str]:
+    """The canonical form of ``path`` when it may be read and served, else None.
+
+    Kept only when it is a folder, not a filesystem root, and neither the
+    home folder nor one of its ancestors (``/home``, ``C:\\Users``: a
+    security review ruled that a folder holding the home folder must never
+    be read or served).
+    """
+    isdir = isdir or os.path.isdir
+    try:
+        canonical = _canonical(path, pathmod)
+        if not isdir(canonical) or _is_filesystem_root(canonical, pathmod):
+            return None
+        if _inside(home, (canonical,), pathmod):
+            return None
+    except (OSError, ValueError):
+        return None
+    return canonical
+
+
+def _inside(path, roots: Sequence[str], pathmod=os.path) -> bool:
+    """True when ``path`` (canonical) is one of ``roots`` or below one."""
+    try:
+        candidate = _canonical(str(path), pathmod)
+    except (OSError, ValueError):
+        return False
+    for root in roots:
+        prefix = root if root.endswith(pathmod.sep) else root + pathmod.sep
+        if candidate == root or candidate.startswith(prefix):
+            return True
+    return False
+
+
+def _absolute(value) -> Optional[str]:
+    """A settings path, stripped, ``~``-expanded and absolute; None when unset."""
+    if not isinstance(value, str) or not value.strip():
+        return None
+    return os.path.abspath(os.path.expanduser(value.strip()))
+
+
+# ── the settings file ───────────────────────────────────────────────
+
+
+def _platform_user_config_dir() -> str:
+    from platformdirs import user_config_dir
+
+    return user_config_dir(APP_NAME, appauthor=False)
+
+
+def _read_bytes(path: Path) -> bytes:
+    with open(path, "rb") as handle:
+        return handle.read(MAX_SETTINGS_BYTES + 1)
+
+
+def _read_settings(path: Path) -> Optional[Dict]:
+    """The parsed object in ``path``; None when it does not exist."""
+    try:
+        raw = _read_bytes(path)
+    except FileNotFoundError:
+        return None
+    except OSError:
+        raise _SettingsError(UNREADABLE) from None
+    if len(raw) > MAX_SETTINGS_BYTES:
+        raise _SettingsError(TOO_LARGE)
+    try:
+        data = json.loads(raw.decode("utf-8"))
+    except (UnicodeDecodeError, ValueError):
+        raise _SettingsError(NOT_JSON) from None
+    if not isinstance(data, dict):
+        raise _SettingsError(NOT_OBJECT)
+    return data
+
+
+def _settings_subset(data: Mapping) -> Dict:
+    """Only the keys the import reads."""
+    return {key: data[key] for key in SETTINGS_KEYS if key in data}
+
+
+def _portable_flag(environ: Mapping[str, str], plugin_settings: Path) -> bool:
+    """LoraManager's portable mode (settings_paths._should_use_portable_settings)."""
+    forced = environ.get(PORTABLE_ENV)
+    if forced == "1":
+        return True
+    if forced == "0":
+        return False
+    try:
+        data = _read_settings(plugin_settings)
+    except _SettingsError:
+        return False
+    return bool(data) and data.get("use_portable_settings") is True
+
+
+def _settings_location(
+    lora_manager_path: str,
+    environ: Mapping[str, str],
+    user_config_dir: Callable[[], str],
+) -> Tuple[Path, str]:
+    """``(settings file, source)`` in LoraManager's lookup order."""
+    override = environ.get(SETTINGS_DIR_ENV)
+    if override:
+        folder = os.path.abspath(os.path.expanduser(override))
+        return Path(folder) / "settings.json", SOURCE_ENVIRONMENT
+    plugin_settings = Path(lora_manager_path) / "settings.json"
+    if _portable_flag(environ, plugin_settings):
+        return plugin_settings, SOURCE_PORTABLE
+    try:
+        folder = user_config_dir()
+    except ImportError:
+        raise _SettingsError(NO_PLATFORMDIRS) from None
+    return Path(folder) / "settings.json", SOURCE_USER_CONFIG
+
+
+# ── libraries and folders ───────────────────────────────────────────
+
+
+def _sanitize_library_name(name: str) -> str:
+    # py/utils/example_images_paths.py sanitize_library_name.
+    safe = re.sub(r"[^A-Za-z0-9_.-]", "_", name or "")
+    return safe or "default"
+
+
+def _active_library(settings: Mapping) -> Tuple[str, Optional[Dict], int]:
+    """``(name, library dict or None, number of libraries)``."""
+    libraries = settings.get("libraries")
+    if not isinstance(libraries, dict) or not libraries:
+        return "default", None, 0
+    active = settings.get("active_library")
+    if not isinstance(active, str) or active not in libraries:
+        active = next(iter(libraries))
+    library = libraries[active]
+    return str(active), library if isinstance(library, dict) else None, len(libraries)
+
+
+def _lora_list(settings: Mapping, library: Optional[Dict], key: str) -> List[str]:
+    """The ``loras`` folders of ``key`` (the library's, else the top level)."""
+    source = library if library is not None and key in library else settings
+    section = source.get(key)
+    if not isinstance(section, dict):
+        return []
+    value = section.get("loras")
+    if isinstance(value, str):
+        value = [value]
+    if not isinstance(value, list):
+        return []
+    return [entry for entry in value if isinstance(entry, str) and entry.strip()]
+
+
+def _guarded(paths, home: str) -> Tuple[str, ...]:
+    kept = []
+    for path in paths:
+        absolute = _absolute(path)
+        guarded = _guard_folder(absolute, home) if absolute else None
+        if guarded and guarded not in kept:
+            kept.append(guarded)
+    return tuple(kept)
+
+
+def _refused(paths, home: str) -> Tuple[str, ...]:
+    """The folders in ``paths`` that exist but that the guard refuses."""
+    refused = []
+    for path in paths:
+        absolute = _absolute(path)
+        if not absolute or not os.path.isdir(absolute):
+            continue
+        if _guard_folder(absolute, home) is None:
+            try:
+                canonical = _canonical(absolute)
+            except (OSError, ValueError):
+                continue
+            if canonical not in refused:
+                refused.append(canonical)
+    return tuple(refused)
+
+
+def _example_images_root(
+    settings: Mapping, library: str, libraries: int, home: str
+) -> Optional[str]:
+    """py/utils/example_images_paths.py get_library_root, when the folder exists."""
+    configured = _absolute(settings.get("example_images_path"))
+    root = _guard_folder(configured, home) if configured else None
+    if root is None or libraries <= 1:
+        return root
+    # Guarded (canonical) like its root: a library name keeps its case, and
+    # the media check compares normcased paths.
+    return _guard_folder(os.path.join(root, _sanitize_library_name(library)), home)
+
+
+def _media_roots(*groups) -> Tuple[str, ...]:
+    roots = []
+    for group in groups:
+        for root in group:
+            if root and root not in roots:
+                roots.append(root)
+    return tuple(roots)
+
+
+def load_layout(
+    lora_manager_path: Optional[str],
+    *,
+    default_roots: Callable[[], List[str]],
+    environ: Mapping[str, str] = os.environ,
+    user_config_dir: Callable[[], str] = _platform_user_config_dir,
+) -> LoraManagerLayout:
+    """Read LoraManager's settings the way LoraManager does (read only).
+
+    ``lora_manager_path`` is the resolved install (``None`` when none was
+    found). An unusable layout carries ``error``, alongside mode and the
+    default LoRA roots, so serving and trigger words keep working.
+    """
+    home = str(Path.home())
+    default_list = list(default_roots())
+    defaults = _guarded(default_list, home)
+    refused_defaults = _refused(default_list, home)
+    fallback = LoraManagerLayout(
+        settings_path=None,
+        source=None,
+        error=NO_INSTALL,
+        mode=MODE_ALONGSIDE,
+        lora_roots=defaults,
+        sidecar_root=None,
+        example_images_root=None,
+        library="default",
+        media_roots=defaults,
+        refused_defaults=refused_defaults,
+    )
+    if not lora_manager_path:
+        return fallback
+    try:
+        settings_path, source = _settings_location(
+            lora_manager_path, environ, user_config_dir
+        )
+    except _SettingsError as error:
+        return replace(fallback, error=str(error))
+    fallback = replace(fallback, settings_path=settings_path, source=source)
+    try:
+        raw = _read_settings(settings_path)
+    except _SettingsError as error:
+        return replace(fallback, error=str(error))
+    settings = _settings_subset(raw or {})
+    return _layout_from_settings(
+        settings, settings_path, source, defaults, home, refused_defaults
+    )
+
+
+def _layout_from_settings(
+    settings, settings_path, source, defaults, home, refused_defaults=()
+):
+    library, entry, libraries = _active_library(settings)
+    lora_roots = _media_roots(
+        defaults,
+        _guarded(_lora_list(settings, entry, "folder_paths"), home),
+        _guarded(_lora_list(settings, entry, "extra_folder_paths"), home),
+    )
+    mode = settings.get("sidecar_storage_mode")
+    mode = MODE_CENTRALIZED if mode == MODE_CENTRALIZED else MODE_ALONGSIDE
+    example_root = _example_images_root(settings, library, libraries, home)
+    layout = LoraManagerLayout(
+        settings_path=settings_path,
+        source=source,
+        error=None,
+        mode=mode,
+        lora_roots=lora_roots,
+        sidecar_root=None,
+        example_images_root=example_root,
+        library=library,
+        media_roots=_media_roots(lora_roots, [example_root]),
+        refused_defaults=refused_defaults,
+    )
+    if mode != MODE_CENTRALIZED:
+        return layout
+    configured = _absolute(settings.get("sidecar_storage_path"))
+    configured = configured or os.path.join(str(settings_path.parent), "sidecars")
+    sidecar_root = _guard_folder(configured, home)
+    if sidecar_root is None:
+        reason = NO_SIDECAR_ROOT if not os.path.isdir(configured) else BAD_SIDECAR_ROOT
+        return replace(
+            layout,
+            error=reason,
+            lora_roots=defaults,
+            example_images_root=None,
+            media_roots=defaults,
+        )
+    return replace(
+        layout,
+        sidecar_root=sidecar_root,
+        media_roots=_media_roots(lora_roots, [sidecar_root], [example_root]),
+    )
+
+
+# ── sidecars ────────────────────────────────────────────────────────
+
+
+def _metadata_files(folder: str) -> Iterator[Path]:
+    """Every ``*.metadata.json`` under ``folder``; an unlistable folder raises.
+
+    Symlinked folders are followed, each real folder once (no loops).
+    """
+
+    def fail(error):
+        raise error
+
+    visited = set()
+    for current, dirs, files in os.walk(folder, onerror=fail, followlinks=True):
+        real = _canonical(current)
+        if real in visited:
+            dirs[:] = []
+            continue
+        visited.add(real)
+        dirs.sort()
+        for name in sorted(files):
+            if name.endswith(METADATA_SUFFIX):
+                yield Path(current) / name
+
+
+def _read_sidecar(path: Path) -> Optional[Dict]:
+    try:
+        with open(path, "r", encoding="utf-8") as handle:
+            data = json.load(handle)
+    except (OSError, ValueError):
+        return None
+    return data if isinstance(data, dict) else None
+
+
+def _model_for(path: Path, layout: LoraManagerLayout, unreadable: List[str]):
+    """The model file a sidecar describes, when it exists inside a LoRA root."""
+    if layout.mode == MODE_ALONGSIDE:
+        base = path.name[: -len(METADATA_SUFFIX)]
+        model = path.parent / f"{base}{MODEL_SUFFIX}"
+        return model if model.is_file() else None
+    metadata = _read_sidecar(path)
+    if metadata is None:
+        unreadable.append(path.name)
+        return None
+    file_path = metadata.get("file_path")
+    if not isinstance(file_path, str) or not file_path.strip():
+        return None
+    model = Path(file_path)
+    if not model.is_file() or not _inside(model, layout.lora_roots):
+        return None
+    return model
+
+
+def discover_sidecars(layout: LoraManagerLayout) -> Discovery:
+    """Every sidecar whose model exists inside a LoRA root, sorted, once each.
+
+    Raises ``OSError`` when a folder cannot be listed: a discovery that
+    cannot see every folder must not replace the collection with part of it.
+    """
+    if layout.error is not None:
+        return Discovery(layout, [], (), [])
+    if layout.mode == MODE_CENTRALIZED:
+        folders = [layout.sidecar_root]
+    else:
+        folders = list(layout.lora_roots)
+    seen = set()
+    scanned: List[Path] = []
+    unreadable: List[str] = []
+    sidecars = []
+    for folder in folders:
+        for path in _metadata_files(folder):
+            resolved = Path(os.path.realpath(path))
+            key = os.path.normcase(str(resolved))
+            if key in seen:
+                continue
+            seen.add(key)
+            scanned.append(resolved)
+            model = _model_for(resolved, layout, unreadable)
+            if model is not None:
+                sidecars.append(Sidecar(resolved, Path(os.path.realpath(model))))
+    sidecars.sort(key=lambda sidecar: str(sidecar.metadata_path))
+    scanned.sort(key=str)
+    return Discovery(layout, sidecars, tuple(scanned), unreadable)
+
+
+# ── images ──────────────────────────────────────────────────────────
+
+
+def _natural_key(name: str):
+    parts = re.split(r"(\d+)", name)
+    return [int(part) if part.isdigit() else part.lower() for part in parts], name
+
+
+def _example_files(folder: str) -> List[str]:
+    try:
+        with os.scandir(folder) as entries:
+            names = [entry.name for entry in entries if entry.is_file()]
+    except OSError:
+        return []
+    return [os.path.join(folder, name) for name in sorted(names, key=_natural_key)]
+
+
+def _preview_candidates(sidecar: Sidecar, metadata: Dict) -> Iterator[str]:
+    """The paths a preview is looked for at, in LoraManager's order."""
+    url = metadata.get("preview_url")
+    if isinstance(url, str) and url.strip():
+        if os.path.isabs(url.strip()):
+            yield url.strip()
+        else:
+            # LoraManager writes absolute paths; it would resolve a relative
+            # one against its working directory, not the sidecar folder.
+            logger.debug(
+                "Relative preview_url skipped in %s", sidecar.metadata_path.name
+            )
+    base = sidecar.metadata_path.name[: -len(METADATA_SUFFIX)]
+    for suffix in PREVIEW_EXTENSIONS:
+        yield str(sidecar.metadata_path.parent / f"{base}{suffix}")
+
+
+def local_media(
+    sidecar: Sidecar,
+    metadata: Dict,
+    layout: LoraManagerLayout,
+    media_extensions: AbstractSet[str],
+) -> List[str]:
+    """The LoRA's preview, then its example images: absolute, resolved paths.
+
+    A file counts only when its extension is in ``media_extensions`` (what the
+    image server serves) and it lies inside ``layout.media_roots``.
+    """
+
+    def usable(path: str) -> bool:
+        return (
+            os.path.splitext(path)[1].lower() in media_extensions
+            and os.path.isfile(path)
+            and _inside(path, layout.media_roots)
+        )
+
+    found: List[str] = []
+    for path in _preview_candidates(sidecar, metadata):
+        if usable(path):
+            found.append(path)
+            break
+    sha256 = metadata.get("sha256")
+    if layout.example_images_root and isinstance(sha256, str) and sha256.strip():
+        folder = os.path.join(layout.example_images_root, sha256.strip().lower())
+        found.extend(path for path in _example_files(folder) if usable(path))
+    media: List[str] = []
+    for path in found:
+        resolved = os.path.realpath(path)
+        if resolved not in media:
+            media.append(resolved)
+    return _cover_first(media)
+
+
+def _cover_first(media: List[str]) -> List[str]:
+    """A still image in front of a leading video (no thumbnails for these yet)."""
+    if not media or os.path.splitext(media[0])[1].lower() not in VIDEO_SUFFIXES:
+        return media
+    for index, path in enumerate(media):
+        if os.path.splitext(path)[1].lower() not in VIDEO_SUFFIXES:
+            return [path] + media[:index] + media[index + 1 :]
+    return media
+
+
+# ── the review ──────────────────────────────────────────────────────
+
+
+def layout_summary(layout: LoraManagerLayout, home: Path) -> Dict:
+    """What the review shows about the layout (no settings values)."""
+    settings_file = None
+    if layout.settings_path is not None:
+        settings_file = str(layout.settings_path)
+        try:
+            relative = Path(settings_file).relative_to(home)
+            settings_file = os.path.join("~", str(relative))
+        except ValueError:
+            pass
+    return {
+        "source": layout.source,
+        "settings_file": settings_file,
+        "error": layout.error,
+        "mode": layout.mode,
+        "library": layout.library,
+        "example_images": layout.example_images_root is not None,
+    }
@@ -8,14 +8,17 @@ return empty results rather than raising.
 """

 import hashlib
+import http.client
 import json
 import os
 import re
 import threading
+import time
+import urllib.error
 import urllib.request
 from pathlib import Path
 from typing import Dict, List, Optional, Tuple
-from urllib.parse import urlsplit
+from urllib.parse import urljoin, urlsplit

 try:
    from ..utils.logging_config import get_logger
@@ -25,6 +28,17 @@ except ImportError:
    sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
    from utils.logging_config import get_logger

+from dataclasses import replace
+
+from .lora_layout_cache import LayoutCache
+from .lora_manager_layout import (
+    MODE_ALONGSIDE,
+    METADATA_SUFFIX,
+    LoraManagerLayout,
+    discover_sidecars,
+    load_layout,
+)
+
 logger = get_logger("prompt_manager.lora_utils")

 # ── LoraManager detection ────────────────────────────────────────────
@@ -82,23 +96,46 @@ def detect_lora_manager(custom_path: str = "") -> Optional[str]:
        if p.is_dir() and _looks_like_lora_manager(p):
            return str(p.resolve())

-    # 2. Auto-detect via custom_nodes (case-insensitive scan)
+    # 2. Auto-detect in every custom_nodes folder (case-insensitive scan):
+    # ComfyUI's own first, then the extra ones it registered (#144).
+    folders = []
    root = find_comfyui_root()
    if root:
-        custom_nodes = root / "custom_nodes"
-        if custom_nodes.is_dir():
-            for entry in custom_nodes.iterdir():
-                if (
-                    entry.is_dir()
-                    and "lora" in entry.name.lower()
-                    and "manager" in entry.name.lower()
-                    and _looks_like_lora_manager(entry)
-                ):
-                    return str(entry.resolve())
+        folders.append(root / "custom_nodes")
+    folders.extend(custom_nodes_directories())
+    seen = set()
+    for custom_nodes in folders:
+        key = os.path.normcase(os.path.abspath(str(custom_nodes)))
+        if key in seen:
+            continue
+        seen.add(key)
+        found = _lora_manager_in(Path(custom_nodes))
+        if found:
+            return found

    return None


+def _lora_manager_in(custom_nodes: Path) -> Optional[str]:
+    """The LoraManager install directly under ``custom_nodes``, or None."""
+    try:
+        entries = sorted(custom_nodes.iterdir()) if custom_nodes.is_dir() else []
+    except OSError:
+        return None
+    for entry in entries:
+        try:
+            if (
+                entry.is_dir()
+                and "lora" in entry.name.lower()
+                and "manager" in entry.name.lower()
+                and _looks_like_lora_manager(entry)
+            ):
+                return str(entry.resolve())
+        except OSError:
+            continue
+    return None
+
+
 def _looks_like_lora_manager(path: Path) -> bool:
    """Heuristic: does this directory look like a LoraManager install?"""
    # Must have __init__.py (ComfyUI extension) or README.md
@@ -209,23 +246,22 @@ def resolve_lora_manager_path(path) -> Optional[str]:
 # ── Metadata reading ─────────────────────────────────────────────────


-def find_lora_directories(lora_manager_path: str) -> List[str]:
-    """Find directories that contain LoRA models (with .metadata.json files).
+def default_lora_roots() -> List[str]:
+    """The LoRA folders ComfyUI knows, without LoraManager's settings.

-    Searches: ComfyUI models/loras, extra_model_paths.yaml lora dirs,
-    and the LoraManager extension dir itself.
+    ComfyUI's ``models/loras``, the ``loras`` entries of
+    ``extra_model_paths.yaml`` and, inside ComfyUI, every folder
+    ``folder_paths`` registers for ``loras``. ``lora_manager_layout`` adds
+    the folders LoraManager's own settings name.
    """
    dirs = set()
-    lm_path = Path(lora_manager_path)

    root = find_comfyui_root()
    if root:
-        # Default models/loras
        models_loras = root / "models" / "loras"
        if models_loras.is_dir():
            dirs.add(str(models_loras.resolve()))

-        # Extra model paths from ComfyUI config
        for extra_dir in _get_extra_lora_paths(root):
            if extra_dir.is_dir():
                dirs.add(str(extra_dir.resolve()))
@@ -242,13 +278,53 @@ def find_lora_directories(lora_manager_path: str) -> List[str]:
        # folder_paths unavailable — not running inside ComfyUI runtime
        pass

-    # Check for any .metadata.json in the LoraManager dir tree
-    for meta in lm_path.rglob("*.metadata.json"):
-        dirs.add(str(meta.parent.resolve()))
-
    return sorted(dirs)


+def lora_manager_install(lora_manager_path: Optional[str]) -> Optional[str]:
+    """The LoraManager install to read: the configured path when it is an
+    allowed install under ``custom_nodes``, auto-detection when it is empty."""
+    if isinstance(lora_manager_path, str) and lora_manager_path.strip():
+        return resolve_lora_manager_path(lora_manager_path)
+    detected = detect_lora_manager()
+    return resolve_lora_manager_path(detected) if detected else None
+
+
+def layout_for_install(install: Optional[str]) -> LoraManagerLayout:
+    """The layout of an already resolved install (None: none was found)."""
+    return load_layout(install, default_roots=default_lora_roots)
+
+
+def lora_manager_layout(lora_manager_path: Optional[str]) -> LoraManagerLayout:
+    """Where LoraManager keeps its files (``py/lora_manager_layout.py``).
+
+    A fresh read: the import review, Start, the legacy scan and the trigger
+    word cache use it. The image hot paths use ``cached_lora_manager_layout``.
+    """
+    return layout_for_install(lora_manager_install(lora_manager_path))
+
+
+# The image hot paths' layout cache (#362). The lambdas look the functions up
+# when called, so a test that patches them here is seen by the cache.
+_layout_cache = LayoutCache(
+    lambda path: lora_manager_install(path),
+    lambda install: layout_for_install(install),
+)
+
+
+def cached_lora_manager_layout(
+    configured: Optional[str],
+) -> Tuple[Optional[str], LoraManagerLayout]:
+    """``(install, layout)`` for the configured path, from the layout cache
+    while LoraManager's settings files are unchanged (``py/lora_layout_cache.py``)."""
+    return _layout_cache.get(configured or "")
+
+
+def clear_layout_cache() -> None:
+    """Drop the cached layout (after an import linked files in new folders)."""
+    _layout_cache.clear()
+
+
 def _get_extra_lora_paths(comfyui_root: Path) -> List[Path]:
    """Parse extra_model_paths.yaml for additional LoRA directories."""
    results = []
@@ -292,7 +368,7 @@ def read_lora_metadata(metadata_path: Path) -> Optional[Dict]:
    try:
        with open(metadata_path, "r", encoding="utf-8") as f:
            return json.load(f)
-    except (json.JSONDecodeError, OSError) as e:
+    except (ValueError, OSError) as e:  # JSONDecodeError, UnicodeDecodeError
        logger.debug(f"Failed to read {metadata_path}: {e}")
        return None

@@ -354,61 +430,42 @@ def get_model_name_from_metadata(metadata: Dict) -> str:
    return name


-def get_preview_images_from_metadata(metadata: Dict, metadata_path: Path) -> List[str]:
-    """Find all local preview/example image paths for a LoRA.
-
-    Returns:
-        List of absolute path strings to image files.
-    """
-    results = []
-    lora_dir = metadata_path.parent
-    file_name = metadata.get("file_name", "")
-    if not file_name:
-        stem = metadata_path.name.replace(".metadata.json", "")
-        file_name = stem
-
-    base_name = Path(file_name).stem
-
-    # Check standard preview naming conventions
-    for ext in (
-        ".png",
-        ".jpg",
-        ".jpeg",
-        ".webp",
-        ".preview.png",
-        ".preview.jpg",
-        ".preview.jpeg",
-    ):
-        candidate = lora_dir / f"{base_name}{ext}"
-        if candidate.exists():
-            results.append(str(candidate.resolve()))
-
-    return results
-
-
-def get_preview_image_from_metadata(
-    metadata: Dict, metadata_path: Path
-) -> Optional[str]:
-    """Find the first preview image path for a LoRA (backward compat)."""
-    images = get_preview_images_from_metadata(metadata, metadata_path)
-    return images[0] if images else None
-
-
 _THUMB_MAX_SIZE = 512

+# CivitAI's own domains (#340: civitai.red and civitai.green serve the same
+# content as civitai.com).
+CIVITAI_DOMAINS = ("civitai.com", "civitai.red", "civitai.green")
 # Only these hosts may ever receive the CivitAI API key, and only over HTTPS.
 CIVITAI_HOSTS = frozenset(
-    {"civitai.com", "www.civitai.com", "api.civitai.com", "image.civitai.com"}
+    f"{prefix}{domain}"
+    for domain in CIVITAI_DOMAINS
+    for prefix in ("", "www.", "api.", "image.")
 )
 MAX_CIVITAI_DOWNLOAD_BYTES = 50 * 1024 * 1024
 _DOWNLOAD_CHUNK_BYTES = 64 * 1024


+# A redirect is followed (#337: image.civitai.com now answers with a redirect
+# to blobs-b2.civitai.com) only over HTTPS to one of CIVITAI_DOMAINS or a
+# subdomain of one, at most this many hops, and never with the API key.
+MAX_CIVITAI_REDIRECTS = 3
+_REDIRECT_CODES = frozenset({301, 302, 303, 307, 308})
+_USER_AGENT = "ComfyUI-PromptManager/1.0"
+
+
+class _DownloadFailed(Exception):
+    """A download failed for the short, loggable ``reason`` it carries."""
+
+    def __init__(self, reason: str):
+        super().__init__(reason)
+        self.reason = reason
+
+
 class _RefuseRedirects(urllib.request.HTTPRedirectHandler):
-    """Never follow a redirect: urllib would re-send the Bearer header to it."""
+    """Never follow a redirect inside urllib: it would re-send the Bearer
+    header. A 3xx surfaces as ``HTTPError``; ``_download_one`` decides."""

    def redirect_request(self, req, fp, code, msg, headers, newurl):
-        logger.warning(f"Refusing redirect from {req.full_url} to {newurl}")
        return None


@@ -425,6 +482,84 @@ def _open_url(req: urllib.request.Request, timeout: float = 10):
    return _opener.open(req, timeout=timeout)


+def _loggable(url: str) -> str:
+    """``url`` without its query, fragment or credentials (signed URLs)."""
+    try:
+        parts = urlsplit(url)
+        host = parts.hostname or ""
+    except ValueError:
+        return "<unparsable URL>"
+    return f"{parts.scheme}://{host}{parts.path}"
+
+
+def _on_civitai_domain(hostname: str) -> bool:
+    """True when ``hostname`` is one of CIVITAI_DOMAINS or a subdomain of one."""
+    return any(
+        hostname == domain or hostname.endswith(f".{domain}")
+        for domain in CIVITAI_DOMAINS
+    )
+
+
+def is_civitai_redirect_target(url: str) -> bool:
+    """True when a redirect to ``url`` may be followed: HTTPS on one of
+    CIVITAI_DOMAINS or a subdomain of one, matched on the parsed host name,
+    default port and no credentials in the URL."""
+    try:
+        parts = urlsplit(url)
+        port = parts.port
+    except ValueError:
+        return False
+    hostname = (parts.hostname or "").lower()
+    return (
+        parts.scheme == "https"
+        and _on_civitai_domain(hostname)
+        and parts.username is None
+        and parts.password is None
+        and port in (None, 443)
+    )
+
+
+def _redirect_target(url: str, error) -> Optional[str]:
+    """The URL a 3xx ``error`` for ``url`` points to, or None when absent."""
+    if error.code not in _REDIRECT_CODES:
+        return None
+    location = (error.headers.get("Location") or "").strip()
+    if not location:
+        return None
+    return urljoin(url, location)
+
+
+def _open_following_civitai_redirects(url: str, api_key: str):
+    """Open ``url``, following only allowed CivitAI redirects (keyless).
+
+    The first request carries the key; every redirected one carries the
+    User-Agent alone. Returns the open response; raises ``_DownloadFailed``
+    when a redirect is refused or the hop limit is reached. Other HTTP
+    errors propagate.
+    """
+    headers = {"User-Agent": _USER_AGENT}
+    if api_key:
+        headers["Authorization"] = f"Bearer {api_key}"
+    current = url
+    for hop in range(MAX_CIVITAI_REDIRECTS + 1):
+        req = urllib.request.Request(current, headers=headers)
+        try:
+            return _open_url(req, timeout=10)
+        except urllib.error.HTTPError as error:
+            with error:
+                target = _redirect_target(current, error)
+            if target is None:
+                raise
+        if hop == MAX_CIVITAI_REDIRECTS:
+            raise _DownloadFailed(f"more than {MAX_CIVITAI_REDIRECTS} redirects")
+        if not is_civitai_redirect_target(target):
+            raise _DownloadFailed(f"redirect refused to {_loggable(target)}")
+        logger.debug(f"Following redirect to {_loggable(target)}")
+        current = target
+        headers = {"User-Agent": _USER_AGENT}  # never the key across a redirect
+    raise AssertionError("unreachable")  # pragma: no cover - loop ends above
+
+
 def is_civitai_url(url: str) -> bool:
    """True when ``url`` is an HTTPS URL on an allow-listed CivitAI host."""
    try:
@@ -465,73 +600,160 @@ def _read_capped(resp, cap: int) -> Optional[bytes]:
    return b"".join(chunks)


+def _network_reason(error: BaseException) -> str:
+    """A short reason for a failed request: a timeout or a network error."""
+    cause = getattr(error, "reason", error)  # URLError wraps the socket error
+    if isinstance(cause, TimeoutError):
+        return "timed out"
+    return f"network error: {cause}"
+
+
+def _fetch_civitai_body(url: str, api_key: str) -> bytes:
+    """The body behind ``url`` (redirects as allowed, size capped), or
+    ``_DownloadFailed`` with the reason it could not be fetched."""
+    try:
+        with _open_following_civitai_redirects(url, api_key) as resp:
+            raw = _read_capped(resp, MAX_CIVITAI_DOWNLOAD_BYTES)
+    except urllib.error.HTTPError as error:
+        error.close()
+        raise _DownloadFailed(f"HTTP {error.code}") from None
+    except (urllib.error.URLError, OSError, http.client.HTTPException) as error:
+        raise _DownloadFailed(_network_reason(error)) from None
+    if raw is None:
+        cap = MAX_CIVITAI_DOWNLOAD_BYTES
+        size = f"{cap // (1024 * 1024)} MB" if cap >= 1024 * 1024 else f"{cap} byte"
+        raise _DownloadFailed(f"larger than the {size} cap")
+    return raw
+
+
+def _thumbnail(raw: bytes):
+    """``raw`` decoded and shrunk to an RGB thumbnail, or ``_DownloadFailed``."""
+    from io import BytesIO
+
+    from PIL import Image
+
+    try:
+        with Image.open(BytesIO(raw)) as img:
+            img.thumbnail((_THUMB_MAX_SIZE, _THUMB_MAX_SIZE), Image.LANCZOS)
+            return img.convert("RGB")
+    except Exception as error:  # PIL raises several types for bad data
+        raise _DownloadFailed(
+            f"image could not be decoded ({type(error).__name__})"
+        ) from None
+
+
 def _download_one(url: str, local_path: Path, api_key: str) -> Optional[str]:
    """Download a single CivitAI image, resize to thumbnail, save as JPEG.

    Refuses any URL that is not HTTPS on an allow-listed CivitAI host so the
-    API key is never sent elsewhere, and refuses bodies larger than
-    MAX_CIVITAI_DOWNLOAD_BYTES.
+    API key is never sent elsewhere, follows a redirect only as
+    ``_open_following_civitai_redirects`` allows (without the key), and
+    refuses bodies larger than MAX_CIVITAI_DOWNLOAD_BYTES. A failure logs
+    one warning with a short reason and the URL without query or
+    credentials (#340), and returns None.
    """
-    if not is_civitai_url(url):
-        logger.warning(f"Refusing non-CivitAI download URL: {url}")
-        return None
    try:
-        headers = {"User-Agent": "ComfyUI-PromptManager/1.0"}
-        if api_key:
-            headers["Authorization"] = f"Bearer {api_key}"
-        req = urllib.request.Request(url, headers=headers)
-        with _open_url(req, timeout=10) as resp:
-            raw = _read_capped(resp, MAX_CIVITAI_DOWNLOAD_BYTES)
-        if raw is None:
-            logger.warning(f"Refusing oversized download: {url}")
-            return None
-
-        # Resize to thumbnail to save disk space
-        from io import BytesIO
-
-        from PIL import Image
-
-        img = Image.open(BytesIO(raw))
-        img.thumbnail((_THUMB_MAX_SIZE, _THUMB_MAX_SIZE), Image.LANCZOS)
-        img = img.convert("RGB")
-        img.save(str(local_path), "JPEG", quality=85)
-
+        if not is_civitai_url(url):
+            raise _DownloadFailed("not an allowed CivitAI URL")
+        image = _thumbnail(_fetch_civitai_body(url, api_key))
+        try:
+            _save_atomically(image, local_path)
+        except OSError as error:
+            raise _DownloadFailed(
+                f"image could not be saved ({error.strerror or type(error).__name__})"
+            ) from None
+    except _DownloadFailed as failure:
+        reason = failure.reason
+    except Exception as error:  # best effort: an import never fails on one image
+        reason = f"unexpected {type(error).__name__}"
+    else:
        return str(local_path.resolve())
-    except Exception as e:
-        logger.debug(f"Failed to download {url}: {e}")
-        return None
+    logger.warning(f"CivitAI image download failed: {_loggable(url)}: {reason}")
+    return None


-def download_civitai_images(
-    metadata: Dict, metadata_path: Path, cache_dir: Path, api_key: str = ""
-) -> List[str]:
-    """Download civitai example images to a local cache directory.
+_PART_PREFIX = ".pm-"
+_PART_SUFFIX = ".part"
+# A temp download older than this was left by a killed process, not a live one
+# (each download has a 10 s timeout).
+STALE_PART_SECONDS = 3600

-    Uses thumbnail URLs (512px) instead of full-size originals, and
-    downloads in parallel (up to 8 concurrent) for speed.

-    Args:
-        api_key: CivitAI API key for authenticated downloads (NSFW content).
+def _save_atomically(image, local_path: Path) -> None:
+    """Write ``image`` as JPEG so ``local_path`` only ever names a whole file.

-    Returns:
-        List of absolute paths to downloaded image files.
+    The image goes to a ``.pm-*.part`` file in the same folder, which is
+    closed before ``os.replace`` puts it in place (Windows cannot replace an
+    open file); a failure removes the temp file. A reader (another import's
+    cache check) never sees a half-written image. The temp file is opened
+    like ``img.save`` opens a file, so the image keeps the umask's mode.
    """
-    from concurrent.futures import ThreadPoolExecutor
+    import secrets

+    while True:
+        temp = local_path.parent / (
+            f"{_PART_PREFIX}{secrets.token_hex(8)}{_PART_SUFFIX}"
+        )
+        try:
+            handle = open(temp, "xb")
+        except FileExistsError:
+            continue
+        break
+    try:
+        with handle:
+            image.save(handle, "JPEG", quality=85)
+        os.replace(temp, local_path)
+    except BaseException:
+        try:
+            os.remove(temp)
+        except OSError:
+            pass
+        raise
+
+
+def sweep_stale_downloads(cache_dir: Path) -> None:
+    """Remove ``.pm-*.part`` files a killed download left in the image cache.
+
+    Only that exact pattern, only in ``cache_dir`` and its LoRA folders, and
+    only once older than ``STALE_PART_SECONDS``; a file that cannot be read
+    or removed is left for a later import.
+    """
+    import time
+
+    cutoff = time.time() - STALE_PART_SECONDS
+    try:
+        folders = [cache_dir] + [p for p in cache_dir.iterdir() if p.is_dir()]
+    except OSError:
+        return
+    for folder in folders:
+        try:
+            candidates = list(folder.glob(f"{_PART_PREFIX}*{_PART_SUFFIX}"))
+        except OSError:
+            continue
+        for path in candidates:
+            try:
+                if path.is_file() and path.stat().st_mtime < cutoff:
+                    os.remove(path)
+            except OSError:
+                logger.debug(f"Could not remove stale download {path}")
+
+
+def _civitai_cache_plan(
+    metadata: Dict, metadata_path: Path, cache_dir: Path
+) -> Tuple[Path, List[str], List[Tuple[str, Path]]]:
+    """``(lora_cache, cached, tasks)`` for a LoRA's CivitAI example images.
+
+    ``cached`` are the images already in the cache, ``tasks`` the
+    ``(url, local_path)`` downloads still needed. Reads only; creates nothing.
+    """
    civitai = _get_civitai(metadata)
    images = civitai.get("images", []) or []
-    if not images:
-        return []

    file_name = metadata.get("file_name", "")
    if not file_name:
        file_name = metadata_path.name.replace(".metadata.json", "")
-    lora_stem = Path(file_name).stem
+    lora_cache = cache_dir / Path(file_name).stem

-    lora_cache = cache_dir / lora_stem
-    lora_cache.mkdir(parents=True, exist_ok=True)
-
-    # Build download tasks
    cached = []
    tasks = []  # (url, local_path)
    for img in images:
@@ -548,9 +770,42 @@ def download_civitai_images(
            cached.append(str(local_path.resolve()))
        else:
            tasks.append((url, local_path))
+    return lora_cache, cached, tasks

+
+def planned_civitai_downloads(
+    metadata: Dict, metadata_path: Path, cache_dir: Path
+) -> int:
+    """How many example images an import would download (no request, no write)."""
+    return len(_civitai_cache_plan(metadata, metadata_path, cache_dir)[2])
+
+
+def download_civitai_images(
+    metadata: Dict,
+    metadata_path: Path,
+    cache_dir: Path,
+    api_key: str = "",
+    stats: Optional[Dict[str, int]] = None,
+) -> List[str]:
+    """Download civitai example images to a local cache directory.
+
+    Uses thumbnail URLs (512px) instead of full-size originals, and
+    downloads in parallel (up to 8 concurrent) for speed.
+
+    Args:
+        api_key: CivitAI API key for authenticated downloads (NSFW content).
+        stats: When given, ``downloaded`` and ``download_errors`` are
+            increased by the downloads that succeeded and failed.
+
+    Returns:
+        List of absolute paths to downloaded image files.
+    """
+    from concurrent.futures import ThreadPoolExecutor
+
+    lora_cache, cached, tasks = _civitai_cache_plan(metadata, metadata_path, cache_dir)
    if not tasks:
        return cached
+    lora_cache.mkdir(parents=True, exist_ok=True)

    # Download in parallel
    downloaded = []
@@ -563,42 +818,46 @@ def download_civitai_images(
            if result:
                downloaded.append(result)

+    if stats is not None:
+        stats["downloaded"] = stats.get("downloaded", 0) + len(downloaded)
+        stats["download_errors"] = (
+            stats.get("download_errors", 0) + len(tasks) - len(downloaded)
+        )
    return cached + downloaded


-def get_lora_image_cache_dir() -> Path:
-    """Get the directory used to cache downloaded LoRA example images."""
-    # Store in the extension's own directory
+def get_lora_image_cache_dir(create: bool = True) -> Path:
+    """Get the directory used to cache downloaded LoRA example images.
+
+    ``<data folder>/data/lora_images`` (``utils.library_location``): the node
+    folder for a library that was not moved, else ComfyUI's
+    ``user/__promptmanager``. ``create=False`` only names it (a preview
+    writes nothing).
+    """
+    try:
+        from ..utils import library_location
+    except ImportError:
+        from utils import library_location
+
    ext_root = Path(__file__).resolve().parent.parent
-    cache = ext_root / "data" / "lora_images"
-    cache.mkdir(parents=True, exist_ok=True)
+    cache = Path(
+        library_location.cache_dir("lora_images", extension_root=str(ext_root))
+    )
+    if create:
+        cache.mkdir(parents=True, exist_ok=True)
    return cache


-def get_example_images_dir(lora_manager_path: str) -> Optional[str]:
-    """Find the LoraManager example_images directory."""
-    lm_path = Path(lora_manager_path)
-
-    # Direct subdirectory
-    candidate = lm_path / "example_images"
-    if candidate.is_dir():
-        return str(candidate.resolve())
-
-    # Search one level in user data dirs
-    for child in lm_path.iterdir():
-        if child.is_dir():
-            sub = child / "example_images"
-            if sub.is_dir():
-                return str(sub.resolve())
-
-    return None
-
-
 # ── Trigger word cache & injection ───────────────────────────────────

 _LORA_PATTERN = re.compile(r"<lora:([^:>]+):[^>]+>", re.IGNORECASE)


+# A failed load is retried by a running node only after this long (an explicit
+# reload, from the settings routes, always runs).
+TRIGGER_RETRY_SECONDS = 60
+
+
 class TriggerWordCache:
    """Thread-safe cache mapping LoRA names to their trigger words.

@@ -609,52 +868,89 @@ class TriggerWordCache:
        self._cache: Dict[str, List[str]] = {}
        self._lock = threading.Lock()
        self._loaded = False
+        self._failed_at: Optional[float] = None

    def load(self, lora_manager_path: str) -> int:
-        """Scan LoRA metadata files and build the trigger word mapping.
+        """Build the trigger word map from the sidecars LoraManager uses.
+
+        Never raises (a node calls this while it runs): a folder that cannot
+        be listed, or any other failure, is logged and the previous map is
+        kept. When LoraManager's settings cannot be used, the reason is
+        logged and the default LoRA folders are read in alongside mode.

        Returns:
-            Number of LoRAs with trigger words found.
+            Number of LoRAs with trigger words in the map.
        """
-        new_cache: Dict[str, List[str]] = {}
-
-        lora_dirs = find_lora_directories(lora_manager_path)
-        for lora_dir in lora_dirs:
-            dir_path = Path(lora_dir)
-            for meta_file in dir_path.rglob("*.metadata.json"):
-                metadata = read_lora_metadata(meta_file)
-                if not metadata:
-                    continue
-
-                words = get_trigger_words_from_metadata(metadata)
-                if not words:
-                    continue
-
-                # Key by filename stem (what appears in <lora:NAME:weight>)
-                file_name = metadata.get("file_name", "")
-                if file_name:
-                    stem = Path(file_name).stem
-                    new_cache[stem.lower()] = words
-
-                # Also key by the metadata file stem
-                meta_stem = meta_file.name.replace(".metadata.json", "")
-                if meta_stem.lower() not in new_cache:
-                    new_cache[meta_stem.lower()] = words
+        try:
+            new_cache = self._build(lora_manager_path)
+        except OSError as error:
+            logger.warning(f"Trigger word cache not refreshed: {error}")
+            return self._failed()
+        except Exception:
+            # Not a disk error: keep the traceback (#362).
+            logger.exception("Trigger word cache not refreshed")
+            return self._failed()

        with self._lock:
            self._cache = new_cache
            self._loaded = True
+            self._failed_at = None

        logger.info(
            f"Trigger word cache loaded: {len(new_cache)} LoRAs with trigger words"
        )
        return len(new_cache)

+    def _failed(self) -> int:
+        """Keep the previous map and note when this load failed."""
+        with self._lock:
+            self._failed_at = time.monotonic()
+            return len(self._cache)
+
+    @staticmethod
+    def _build(lora_manager_path: str) -> Dict[str, List[str]]:
+        layout = lora_manager_layout(lora_manager_path)
+        if layout.error is not None:
+            logger.warning(
+                f"LoraManager settings not usable ({layout.error}); trigger words "
+                "come from the default LoRA folders"
+            )
+            layout = replace(
+                layout,
+                error=None,
+                mode=MODE_ALONGSIDE,
+                sidecar_root=None,
+                example_images_root=None,
+            )
+        new_cache: Dict[str, List[str]] = {}
+        for sidecar in discover_sidecars(layout).sidecars:
+            metadata = read_lora_metadata(sidecar.metadata_path)
+            if not metadata:
+                continue
+            words = get_trigger_words_from_metadata(metadata)
+            if not words:
+                continue
+            # Key by the model file name (what appears in <lora:NAME:weight>)
+            # and by the sidecar's name.
+            new_cache[sidecar.model_path.stem.lower()] = words
+            sidecar_stem = sidecar.metadata_path.name[: -len(METADATA_SUFFIX)]
+            new_cache.setdefault(sidecar_stem.lower(), words)
+        return new_cache
+
    def get_trigger_words(self, lora_name: str) -> List[str]:
        """Look up trigger words for a LoRA by name (case-insensitive)."""
        with self._lock:
            return self._cache.get(lora_name.lower(), [])

+    def retry_due(self) -> bool:
+        """Whether a node may try loading again: never failed, or the last
+        failure is TRIGGER_RETRY_SECONDS old (no rescan on every prompt run)."""
+        with self._lock:
+            failed_at = self._failed_at
+        return failed_at is None or time.monotonic() - failed_at >= (
+            TRIGGER_RETRY_SECONDS
+        )
+
    @property
    def is_loaded(self) -> bool:
        with self._lock:
@@ -664,6 +960,7 @@ class TriggerWordCache:
        with self._lock:
            self._cache.clear()
            self._loaded = False
+            self._failed_at = None


 # Module-level singleton
@@ -0,0 +1,90 @@
+"""The tagging configuration's constants and validators (#328).
+
+Server-free on purpose: ``py.api`` must import without ComfyUI's ``server``
+module, which ``py/config.py`` needs; config re-exports all of this.
+"""
+
+import math
+from typing import Any
+
+# The tagging engines (``py/autotag.py`` MODELS) and the options they take.
+WD14_MODEL_TYPES = frozenset({"wd14-swinv2", "wd14-vit"})
+LLM_MODEL_TYPES = frozenset({"gguf", "hf"})
+MODEL_TYPES = WD14_MODEL_TYPES | LLM_MODEL_TYPES
+MAX_INSTRUCTION_CHARS = 4000
+MAX_INSTRUCTION_BYTES = 16 * 1024
+# Tag output images' review estimate (#379): seconds per image for the WD14
+# engines, by where ONNX Runtime runs them. The graphics card figure was
+# measured in PR 1's live check (RTX 4090, CUDA: Auto-tag selected on 100
+# images in 16.7 s with the model load, 0.167 s/image). The processor figure
+# is an upper bound from the maintainer's cancelled CPU run (19 min / 697
+# images, backup, model load and skips included), kept as the fallback. The
+# language-model engines have no figure.
+WD14_SECONDS_PER_IMAGE = 1.6
+WD14_GPU_SECONDS_PER_IMAGE = 0.17
+
+
+def wd14_seconds_per_image(device: str) -> float:
+    """The estimate's rate for ``"gpu"`` or ``"cpu"`` (anything else)."""
+    return WD14_GPU_SECONDS_PER_IMAGE if device == "gpu" else WD14_SECONDS_PER_IMAGE
+
+
+# What a batch does with an image that already has tags (#328, #379).
+EXISTING_POLICIES = ("skip", "merge", "replace_after_review")
+
+# The language-model tag template every page starts from until one is saved.
+DEFAULT_TAG_TEMPLATE = (
+    "Generate only comma-separated Danbooru tags (lowercase_underscores, no spaces).\n"
+    "Include: subject_count (1girl/1boy/etc), gender, ethnicity (asian, caucasian, "
+    "etc), age_approx (teen, young_woman), body_attributes, face_features, "
+    "hairstyle, appearance, clothing, accessories, pose, expression, action, "
+    "camera_angle, camera_shot, scene_composition (wide_shot, long_shot, "
+    "dutch_angle), environment, background_elements, lighting, mood.\n"
+    "Prioritize visual accuracy.\n"
+    "No sentences, no commentary, no captions. Only tags. Keep length short but "
+    "descriptive."
+)
+
+
+def validate_threshold(name: str, value: Any) -> float:
+    """A WD14 confidence threshold in [0, 1], or ValueError naming ``name``."""
+    if type(value) not in (int, float) or not math.isfinite(value):
+        raise ValueError(f"{name} must be a finite number")
+    if not 0 <= value <= 1:
+        raise ValueError(f"{name} must be between 0 and 1")
+    return float(value)
+
+
+# Every page shows the thresholds in steps of 0.05 (the concept's System rows,
+# the Tag image dialogs and the legacy sliders), so a saved one must be on that
+# grid (#369). Per-request thresholds keep their own checks.
+THRESHOLD_STEP = 0.05
+_STEPS_PER_UNIT = round(1 / THRESHOLD_STEP)
+# A computed float can miss the grid by a hair: (0.1 + 0.2) * 20 is 6.000000000000001.
+_STEP_TOLERANCE = 1e-12  # in steps; refuses 0.35000000001
+
+
+def validate_saved_threshold(name: str, value: Any) -> float:
+    """A saved WD14 threshold: in [0, 1] and a multiple of ``THRESHOLD_STEP``,
+    returned exactly on the grid; else ValueError naming ``name``."""
+    value = validate_threshold(name, value)
+    steps = value * _STEPS_PER_UNIT
+    if abs(steps - round(steps)) > _STEP_TOLERANCE:
+        raise ValueError(f"{name} must be a multiple of {THRESHOLD_STEP}")
+    return round(steps) / _STEPS_PER_UNIT
+
+
+def validate_template(value: Any, name: str = "instructions") -> str:
+    """Non-empty language-model instructions within the character and byte
+    caps, or ValueError naming ``name``."""
+    if not isinstance(value, str) or not value.strip():
+        raise ValueError(f"{name} must be non-empty text")
+    if len(value) > MAX_INSTRUCTION_CHARS:
+        raise ValueError(f"{name} must be at most {MAX_INSTRUCTION_CHARS} characters")
+    try:
+        encoded = value.encode("utf-8")
+    except UnicodeEncodeError:
+        raise ValueError(f"{name} must be valid Unicode text") from None
+    if len(encoded) > MAX_INSTRUCTION_BYTES:
+        raise ValueError(f"{name} {'are' if name == 'instructions' else 'is'} too long")
+    return value
@@ -3,11 +3,11 @@ name = "promptmanager"
 description = "A powerful ComfyUI custom node that extends the standard text encoder with persistent prompt storage, advanced search capabilities, and an automatic image gallery system using SQLite."
 version = "3.3.1"
 license = {file = "LICENSE"}
-requires-python = ">=3.10"
+requires-python = ">=3.12"
 dependencies = ["watchdog>=2.1.0", "Pillow>=8.0.0"]

 [build-system]
-requires = ["setuptools>=84.0.0"]
+requires = ["setuptools>=84.2.1"]
 build-backend = "setuptools.build_meta"

 [project.urls]
@@ -8,8 +8,8 @@ coverage>=7.16.2
 numpy>=2.2.6  # WD14 engine tests

 # Code quality
-black>=26.10.1
-flake8>=7.4.1
+black==26.10.1
+flake8==7.4.1

 # Security scanning
 bandit[toml]>=1.9.4
@@ -0,0 +1,27 @@
+"""Final stops for the background threads a test starts (#301, #302).
+
+Every real ``ImageGenerationHandler``, ``ImageMonitor`` or ``PromptTracker``
+a test constructs ends with its final stop and an assertion, before the
+test's folder and databases go: ``close()`` for a handler,
+``stop_monitoring()`` for a monitor, ``shutdown()`` for a tracker.
+"""
+
+from utils.prompt_tracker import PromptTracker
+
+
+def stop_tracker(testcase, tracker):
+    """Shut a real tracker's cleanup thread down; mocks are left alone."""
+    if isinstance(tracker, PromptTracker):
+        testcase.assertTrue(tracker.shutdown(), "prompt cleanup thread still running")
+
+
+def close_handler(testcase, handler):
+    """Close ``handler`` for good, then stop the tracker it was built with."""
+    testcase.assertTrue(handler.close(), "image worker still running")
+    stop_tracker(testcase, getattr(handler, "prompt_tracker", None))
+
+
+def stop_monitor(testcase, monitor):
+    """Stop ``monitor`` (its observer and worker), then its tracker."""
+    testcase.assertTrue(monitor.stop_monitoring(), "image monitor still running")
+    stop_tracker(testcase, getattr(monitor, "prompt_tracker", None))
@@ -19,7 +19,7 @@ test.beforeEach(async ({page, browserName}) => {
        await import('/extensions/promptmanager/prompt_manager.js');
        class Node {
            constructor(){
-                this.widgets=['text','category','tags','search_text'].map(name=>({name,value:'',inputEl:document.createElement('textarea')}));
+                this.widgets=[...['text','category','tags','search_text'].map(name=>({name,value:'',inputEl:document.createElement('textarea')})),{name:'save_to_library',type:'toggle',value:true}];
                this.widgets_values=[]; this.inputs=[];
            }
            addDOMWidget(name,type,element){document.body.append(element);return {element};}
@@ -36,6 +36,14 @@ test.afterEach(async ({page,browserName}) => {
    expect(page.classicErrors).toEqual([]);
 });

+test('Classic loads an older workflow with Save to library on and keeps a saved off (#90)',async({page})=>{
+    // A workflow saved before the switch held the search UI's slot ('') at the switch's index
+    const loaded=await page.evaluate(()=>{const widget=node.widgets.find(w=>w.name==='save_to_library');widget.value='';node.configure({});return widget.value;});
+    expect(loaded).toBe(true);
+    const off=await page.evaluate(()=>{const widget=node.widgets.find(w=>w.name==='save_to_library');widget.value=false;node.configure({});return [widget.value,node.serialize().widgets_values[4]];});
+    expect(off).toEqual([false,false]);
+});
+
 test('Classic keeps immediate selection, search query and metadata serialization',async({page})=>{
    await page.route('**/prompt_manager/search?**', route=>route.fulfill({json:{success:true,results:[{text:'A new portrait',category:'Portrait',tags:['film grain'],rating:5}]}}));
    await page.evaluate(()=>{node.widgets.find(w=>w.name==='search_text').value='tag:"film grain" portrait';});
@@ -149,3 +157,49 @@ test('Classic test button reports success and failure and releases expired notif
    await page.clock.fastForward(3001);
    await expect(page.locator('.pm-classic-notification')).toHaveCount(0);
 });
+
+test('Classic shows linked text, keeps the typed text through save and refuses to overwrite it (#343)',async({page})=>{
+    await page.route('**/prompt_manager/recent?**',route=>route.fulfill({json:{success:true,results:[{text:'Saved prompt',tags:[]}]}}));
+    const note=page.locator('.pm-classic').getByText('Text comes from a link. Your typed text is kept for when you disconnect it.',{exact:true});
+    await expect(note).toBeHidden();
+    await page.evaluate(()=>{
+        const widget=node.widgets.find(item=>item.name==='text');widget.value=widget.inputEl.value='Typed classic';
+        node.inputs=[{name:'text',type:'STRING',link:3,widget:{name:'text'}}];node.onConnectionsChange();
+    });
+    await expect(note).toBeVisible();
+    // The link drives the run; the saved workflow keeps what the user typed, not a stale or empty value.
+    expect(await page.evaluate(()=>node.serialize().widgets_values[0])).toBe('Typed classic');
+    await page.getByRole('button',{name:'📋 Recent',exact:true}).click();
+    await page.getByRole('button',{name:/Saved prompt/}).click();
+    expect(await page.evaluate(()=>node.widgets.find(item=>item.name==='text').value)).toBe('Typed classic');
+    await expect(page.getByRole('alert').filter({hasText:'Text comes from a link. Disconnect it to use a saved prompt.'})).toBeVisible();
+    await page.evaluate(()=>{node.inputs[0].link=null;node.onConnectionsChange();});
+    await expect(note).toBeHidden();
+    await page.getByRole('button',{name:/Saved prompt/}).click();
+    expect(await page.evaluate(()=>node.widgets.find(item=>item.name==='text').value)).toBe('Saved prompt');
+    // A workflow load re-evaluates the link state.
+    await page.evaluate(()=>{node.inputs[0].link=8;node.configure({});});
+    await expect(note).toBeVisible();
+});
+
+test('PromptManagerText shows linked text in its legacy controls and keeps the typed text (#343)',async({page})=>{
+    await page.evaluate(async()=>{
+        class TextNode {
+            constructor(){this.widgets=['text','category','tags','search_text'].map(name=>({name,value:'',inputEl:document.createElement('textarea')}));this.widgets_values=[];this.inputs=[{name:'text',type:'STRING',link:null,widget:{name:'text'}}];}
+            addDOMWidget(name,type,element){element.id='legacy-text-node';document.body.append(element);return {element};}
+            setSize(){} setDirtyCanvas(){} serialize(){return {properties:{...this.properties}};}
+        }
+        await fixtureApp.extensions[0].beforeRegisterNodeDef(TextNode,{name:'PromptManagerText'},fixtureApp);
+        window.textNode=new TextNode();textNode.onNodeCreated();
+        const widget=textNode.widgets[0];widget.value=widget.inputEl.value='Typed text node';
+    });
+    const note=page.locator('#legacy-text-node').getByText('Text comes from a link. Your typed text is kept for when you disconnect it.',{exact:true});
+    await expect(note).toBeHidden();
+    await page.evaluate(()=>{textNode.inputs[0].link=5;textNode.onConnectionsChange();});
+    await expect(note).toBeVisible();
+    expect(await page.evaluate(()=>textNode.serialize().widgets_values[0])).toBe('Typed text node');
+    await page.evaluate(()=>{textNode.usePrompt({text:'Replacement'},0);});
+    expect(await page.evaluate(()=>textNode.widgets[0].value)).toBe('Typed text node');
+    await page.evaluate(()=>{textNode.inputs[0].link=null;textNode.onConnectionsChange();textNode.onRemoved();});
+    await expect(note).toBeHidden();
+});
@@ -676,3 +676,73 @@ export function measureInspector(selector) {
            primary:node.classList.contains('ca-primary'),minHeight:getComputedStyle(node).minHeight})),
    };
 }
+
+// #249 System S7 Task 20, shared since S12 (#329): the maintenance plan dialog's measurement and its D100 mapping,
+// moved unchanged from system-maintenance-concept.spec.mjs so the rotated-log review uses the same ones.
+/** Runs in the page: the open review dialog (plan or duplicates): its title, body and the concept's tokens. */
+export function measureReview() {
+    const dialog = document.querySelector('dialog#modal[open]');
+    const css = (node, ...keys) => node ? Object.fromEntries(keys.map(key => [key, getComputedStyle(node)[key]])) : null;
+    const name = node => [node.localName, ...[...node.classList].sort()].join('.');
+    const text = node => node?.textContent.trim() ?? null;
+    const body = dialog.querySelector('#modal-body');
+    const grid = body.querySelector(':scope > dl.meta-grid');
+    const compare = body.querySelector('.compare-grid');
+    const item = compare?.querySelector('.compare-item');
+    const notes = [...body.querySelectorAll(':scope > p.small')];
+    const note = notes.at(-1);
+    const actions = body.querySelector(':scope > .dialog-actions');
+    return {
+        title: text(dialog.querySelector('#modal-title')),
+        tree: [...body.children].map(name),
+        heading: body.querySelector(':scope > h3') && { text: text(body.querySelector(':scope > h3')),
+            ...css(body.querySelector(':scope > h3'), 'fontSize', 'fontWeight', 'color', 'marginBottom') },
+        grid: grid && { rows: [...grid.children].map(row => [text(row.querySelector('dt')), text(row.querySelector('dd'))]),
+            ...css(grid, 'display', 'gridTemplateColumns', 'columnGap', 'rowGap'),
+            dt: css(grid.querySelector('dt'), 'fontSize', 'color', 'textTransform'), dd: css(grid.querySelector('dd'), 'fontSize', 'color') },
+        details: body.querySelector(':scope > details') && { summary: text(body.querySelector(':scope > details > summary')),
+            tree: [...body.querySelector(':scope > details').children].map(name) },
+        backup: body.querySelector(':scope > .notice') && { tree: [...body.querySelector(':scope > .notice').children].map(name),
+            text: [...body.querySelectorAll(':scope > .notice > div:first-child > *')].map(node => [node.localName, text(node)]),
+            buttons: [...body.querySelectorAll(':scope > .notice button')].map(text) },
+        compare: compare && { tree: [...compare.children].map(name), ...css(compare, 'display', 'gridTemplateColumns', 'columnGap'),
+            items: [...compare.children].map(entry => ({ tree: [...entry.children].map(name), label: text(entry.querySelector('label')),
+                checked: entry.querySelector('input[type=radio]').checked, image: entry.querySelector('img')?.className ?? null })),
+            item: css(item, 'paddingTop', 'paddingLeft', 'backgroundColor', 'borderTopWidth', 'borderTopColor', 'borderTopLeftRadius'),
+            image: css(item.querySelector('img'), 'width', 'objectFit'),
+            label: css(item.querySelector('label'), 'fontSize', 'color'),
+            radio: { name: item.querySelector('input[type=radio]').name.startsWith('keep-') ? 'keep-*' : 'other',
+                type: item.querySelector('input').type } },
+        note: note && { text: text(note), ...css(note, 'fontSize', 'color', 'marginTop') },
+        actions: { tree: [...actions.children].map(name), ...css(actions, 'display', 'justifyContent', 'columnGap', 'marginTop'),
+            buttons: [...actions.children].map(item => ({ text: text(item), className: item.className,
+                ...css(item, 'backgroundColor', 'color', 'fontSize', 'paddingTop', 'paddingLeft', 'borderTopColor') })) },
+    };
+}
+
+export const BACKUP_BOX = Object.freeze({ tree: ['div', 'div.row-actions'], text: [['h3', 'Back up the database first (recommended)'],
+    ['p', 'Downloads a copy of the prompts database before this operation changes any records.']], buttons: ['Back up now'] });
+
+/**
+ * D100: the server's plan in the concept's dialog: the operation's row title as its `h3` (the concept prints its
+ * `data-plan` name), the four rows with the plan's values, the listed records (`details`), the hold line in the
+ * concept's `p.small`, the D55 backup box before the actions, and "Apply reviewed operation". No sample note.
+ */
+export function mapPlanConcept(reference, title, plan) {
+    const backup = plan.backup.policy === 'off' ? 'No safety backup (the policy is off)'
+        : `Create and verify before changes (${plan.backup.destination_label})`;
+    const tree = ['h3', 'dl.meta-grid', ...(plan.details.length ? ['details'] : []), 'p.small', 'div.notice', 'div.dialog-actions'];
+    const [cancel, apply] = reference.actions.buttons;
+    return {
+        ...reference,
+        tree,
+        heading: { ...reference.heading, text: title },
+        grid: { ...reference.grid, rows: [['Scope', plan.scope.label],
+            ['Protected', plan.protected.reasons.length ? plan.protected.reasons.join(' · ') : 'Nothing is protected'],
+            ['Backup', backup], ['Media on disk', plan.media.label]] },
+        details: plan.details.length ? { summary: `Listed records (${plan.details.length})`, tree: ['summary', 'pre'] } : null,
+        backup: BACKUP_BOX,
+        note: { ...reference.note, text: 'Nothing changes until you apply. This review holds for 15 minutes.' },
+        actions: { ...reference.actions, buttons: [cancel, { ...apply, text: 'Apply reviewed operation' }] },
+    };
+}
@@ -0,0 +1,283 @@
+"""Run a browser-test fixture seeder off the live database, then publish once (#384).
+
+The seeders make hundreds of small commits. On a slow CI disk the live
+database's commits queue behind WAL checkpoint syncs and a reset took over
+30 s. ``ScratchSeeder.run`` instead:
+
+1. copies the live database into a scratch database (SQLite backup API) whose
+   connections never sync (a crash loses only the copy);
+2. runs the unchanged seeder against an API proxy whose ``db`` is the scratch
+   database; everything else (files, thumbnails, caches, command state) is
+   the live API's, written exactly as before;
+3. replaces the rows of every table the seed changed in the live database, in
+   one transaction on the live connection. Tables the seed left alone are not
+   touched, so state another fixture owns stays as it was.
+
+A commit by any other live connection while the seed ran fails the reset
+instead of being overwritten (``PRAGMA data_version``).
+"""
+
+from __future__ import annotations
+
+import hashlib
+import os
+import shutil
+import sqlite3
+import tempfile
+import weakref
+from pathlib import Path
+from typing import Any, Callable, TypeVar
+
+T = TypeVar("T")
+
+# Set to 1 to run seeders on the live database as before #384 (the equivalence
+# proof, tests/browser/reset_equivalence.py, compares both ways).
+SEED_ON_LIVE_ENV = "PM_TEST_SEED_ON_LIVE"
+SCRATCH_SCHEMA = "reset_seed"
+# API calls a seed makes that must see the published rows (see _SeedApi).
+DEFERRED_CALLS = frozenset({"invalidate_gallery_cache"})
+# Linux's shared-memory tmpfs (present in the Playwright image and on runners).
+MEMORY_ROOT = Path("/dev/shm")
+# The largest fixtures' scratch copy is about 8 MB (database plus a WAL that
+# autocheckpoints near 4 MB). Docker's default /dev/shm is 64 MB, shared with
+# the browsers and the other workers; with less free than this, the scratch
+# copy goes on disk instead.
+MEMORY_FREE_BYTES = 32 * 1024 * 1024
+# Scratch folders are named <prefix><owner pid>-<random>.
+SCRATCH_PREFIX = "pm-reset-"
+
+
+def _quote(name: str) -> str:
+    return '"' + name.replace('"', '""') + '"'
+
+
+def _tables(conn: sqlite3.Connection, schema: str = "main") -> list[str]:
+    rows = conn.execute(
+        f"SELECT name, sql FROM {schema}.sqlite_master WHERE type = 'table' "
+        "ORDER BY name"
+    ).fetchall()
+    for name, sql in rows:
+        if sql and sql.lstrip().upper().startswith("CREATE VIRTUAL"):
+            raise NotImplementedError(f"virtual table {name} cannot be copied")
+    return [name for name, _sql in rows]
+
+
+def _columns(conn: sqlite3.Connection, table: str, schema: str = "main") -> list[str]:
+    """Writable columns (hidden and generated ones excluded), plus ``rowid``
+    when the table has a rowid that no INTEGER PRIMARY KEY column carries."""
+    info = conn.execute(f"PRAGMA {schema}.table_xinfo({_quote(table)})").fetchall()
+    columns = [row[1] for row in info if row[6] == 0]
+    keys = [row for row in info if row[5]]
+    sql = conn.execute(
+        f"SELECT sql FROM {schema}.sqlite_master WHERE type = 'table' AND name = ?",
+        (table,),
+    ).fetchone()[0]
+    without_rowid = sql is not None and "WITHOUT ROWID" in sql.upper()
+    integer_key = len(keys) == 1 and str(keys[0][2]).upper() == "INTEGER"
+    if not without_rowid and not integer_key and table != "sqlite_sequence":
+        columns.insert(0, "rowid")
+    return columns
+
+
+def table_digests(conn: sqlite3.Connection, schema: str = "main") -> dict[str, str]:
+    """A digest of every table's rows (rowids included), by table name."""
+    result = {}
+    for table in _tables(conn, schema):
+        selected = ", ".join(
+            _quote(c) if c != "rowid" else "rowid"
+            for c in _columns(conn, table, schema)
+        )
+        digest = hashlib.sha256()
+        rows = conn.execute(f"SELECT {selected} FROM {schema}.{_quote(table)}")
+        for row in sorted(repr(tuple(row)) for row in rows):
+            digest.update(row.encode("utf-8", "surrogatepass"))
+            digest.update(b"\n")
+        result[table] = digest.hexdigest()
+    return result
+
+
+def _process_alive(pid: int) -> bool:
+    try:
+        os.kill(pid, 0)
+    except ProcessLookupError:
+        return False
+    except OSError:
+        return True  # it exists but belongs to someone else
+    return True
+
+
+def remove_orphaned_scratch(root: Path) -> None:
+    """Remove scratch folders of servers that died without cleaning up.
+
+    A server killed outright (SIGKILL, a crash) never runs ``close``, and
+    tmpfs keeps its folder in memory until reboot. The folder name carries
+    the owner's process id; a folder whose process is gone is removed.
+    """
+    if os.name != "posix":
+        return  # os.kill(pid, 0) would terminate the process on Windows
+    for folder in root.glob(f"{SCRATCH_PREFIX}*-*"):
+        pid = folder.name[len(SCRATCH_PREFIX) :].split("-", 1)[0]
+        if pid.isdigit() and not _process_alive(int(pid)):
+            shutil.rmtree(folder, ignore_errors=True)
+
+
+class _SeedApi:
+    """The live API, except that ``db`` is the scratch database.
+
+    Cache drops the seed asks for (``DEFERRED_CALLS``) are recorded and made
+    after the publish: dropped earlier, a request in between would cache the
+    live database's old rows again.
+    """
+
+    def __init__(self, api: Any, db: Any) -> None:
+        object.__setattr__(self, "_api", api)
+        object.__setattr__(self, "db", db)
+        object.__setattr__(self, "deferred", [])
+
+    def __getattr__(self, name: str) -> Any:
+        if name in DEFERRED_CALLS:
+
+            def record(*args: Any, **kwargs: Any) -> None:
+                self.deferred.append((name, args, kwargs))
+
+            return record
+        return getattr(self._api, name)
+
+    def __setattr__(self, name: str, value: Any) -> None:
+        setattr(self._api, name, value)
+
+
+class ScratchSeeder:
+    """Seed into a scratch copy and publish the changed tables in one commit."""
+
+    def __init__(
+        self,
+        api: Any,
+        directory: Path,
+        *,
+        on_live: bool = False,
+        memory_root: Path | None = MEMORY_ROOT,
+    ) -> None:
+        self._api = api
+        self._fallback = Path(directory)
+        self._memory_root = memory_root
+        self._directory: Path | None = None
+        self._on_live = on_live
+        self._scratch = None
+        self._unsynced: "weakref.WeakSet[sqlite3.Connection]" = weakref.WeakSet()
+
+    def run(self, seed: Callable[[Any], T]) -> T:
+        """Run ``seed(api)`` (blocking; call it in an executor thread)."""
+        if self._on_live:
+            return seed(self._api)
+        live = self._api.db.model.get_connection()
+        if live.in_transaction:
+            raise RuntimeError("the live connection has an open transaction")
+        version = live.execute("PRAGMA data_version").fetchone()[0]
+        scratch = self._scratch_database()
+        target = self._scratch_connection(scratch)
+        with target.using():
+            live.backup(target)
+        before = table_digests(target)
+        target_api = _SeedApi(self._api, scratch)
+        result = seed(target_api)
+        target = self._scratch_connection(scratch)
+        if target.in_transaction:
+            raise RuntimeError("the seed left a scratch transaction open")
+        after = table_digests(target)
+        changed = [table for table in after if after[table] != before.get(table)]
+        if set(before) != set(after):
+            raise RuntimeError("the seed changed the database schema")
+        if live.execute("PRAGMA data_version").fetchone()[0] != version:
+            raise RuntimeError("the live database changed while the seed ran")
+        self._publish(live, scratch.model.db_path, changed, version)
+        for name, args, kwargs in target_api.deferred:
+            getattr(self._api, name)(*args, **kwargs)
+        return result
+
+    def _scratch_database(self):
+        if self._scratch is None:
+            from database.operations import PromptDatabase
+
+            self._directory = self._scratch_directory()
+            self._scratch = PromptDatabase(str(self._directory / "seed.db"))
+        return self._scratch
+
+    def _scratch_connection(self, scratch) -> sqlite3.Connection:
+        """The calling thread's scratch connection, set never to sync."""
+        conn = scratch.model.get_connection()
+        if conn not in self._unsynced:
+            conn.execute("PRAGMA synchronous = OFF")
+            self._unsynced.add(conn)
+        return conn
+
+    @staticmethod
+    def _publish(
+        live: sqlite3.Connection, path: str, tables: list[str], version: int
+    ) -> None:
+        """Replace ``tables`` with the scratch rows in one live transaction.
+
+        ``version`` is the live ``data_version`` read before the seed. It is
+        checked again under the write lock: a writer whose transaction was
+        open during the seed commits before ``BEGIN IMMEDIATE`` returns, and
+        its rows must fail the reset instead of being overwritten.
+        """
+        if not tables:
+            return
+        foreign_keys = live.execute("PRAGMA foreign_keys").fetchone()[0]
+        # Rows are copied as they are; no cascade may reach a table left alone.
+        live.execute("PRAGMA foreign_keys = OFF")
+        try:
+            live.execute(f"ATTACH DATABASE ? AS {SCRATCH_SCHEMA}", (path,))
+            try:
+                live.execute("BEGIN IMMEDIATE")
+                try:
+                    if live.execute("PRAGMA data_version").fetchone()[0] != version:
+                        raise RuntimeError(
+                            "the live database changed while the seed ran"
+                        )
+                    for table in tables:
+                        columns = ", ".join(
+                            _quote(c) if c != "rowid" else "rowid"
+                            for c in _columns(live, table)
+                        )
+                        name = _quote(table)
+                        live.execute(f"DELETE FROM main.{name}")
+                        live.execute(
+                            f"INSERT INTO main.{name} ({columns}) "
+                            f"SELECT {columns} FROM {SCRATCH_SCHEMA}.{name}"
+                        )
+                    live.commit()
+                except BaseException:
+                    live.rollback()
+                    raise
+            finally:
+                live.execute(f"DETACH DATABASE {SCRATCH_SCHEMA}")
+        finally:
+            live.execute(f"PRAGMA foreign_keys = {int(foreign_keys)}")
+
+    def close(self) -> None:
+        """Close every scratch connection, then remove the scratch files."""
+        if self._on_live:
+            return
+        if self._scratch is not None:
+            self._scratch.close_all()
+            self._scratch = None
+        if self._directory is not None:
+            shutil.rmtree(self._directory, ignore_errors=True)
+            self._directory = None
+
+    def _scratch_directory(self) -> Path:
+        """A folder in memory (tmpfs) where there is one, else ``directory``.
+
+        Even unsynced, scratch writes on the runner's disk wait whenever the
+        kernel is writing back the pages they rewrite.
+        """
+        root = self._memory_root
+        if root is not None and root.is_dir() and os.access(root, os.W_OK):
+            remove_orphaned_scratch(root)
+            if shutil.disk_usage(root).free >= MEMORY_FREE_BYTES:
+                prefix = f"{SCRATCH_PREFIX}{os.getpid()}-"
+                return Path(tempfile.mkdtemp(prefix=prefix, dir=root))
+        self._fallback.mkdir(parents=True, exist_ok=True)
+        return self._fallback
@@ -26,7 +26,8 @@ test.beforeEach(async({page,browserName})=>{
        window.fixtureApp={registerExtension(extension){this.extension=extension;},ui:{settings:new EventTarget()},graph:{setDirtyCanvas(){}},canvas:{}};
        await import('/extensions/promptmanager/prompt_manager.js');
        class Node {
-            constructor(){this.widgets=['text','category','tags','search_text'].map(name=>({name,type:'text',value:'',options:{},inputEl:document.createElement('textarea')}));this.inputs=['clip','prepend_text','append_text'].map(name=>({name,link:null}));this.properties={};this.size=[550,700];}
+            constructor(){this.widgets=[...['text','category','tags','search_text'].map(name=>({name,type:'text',value:'',options:{},inputEl:document.createElement('textarea')})),{name:'save_to_library',type:'toggle',value:true,options:{}}];this.inputs=[...['clip','prepend_text','append_text'].map(name=>({name,type:name==='clip'?'CLIP':'STRING',link:null})),...['text','category','tags','search_text'].map(name=>({name,type:'STRING',link:null,widget:{name}})),{name:'save_to_library',type:'BOOLEAN',link:null,widget:{name:'save_to_library'}}];this.properties={};this.size=[550,700];}
+            findInputByType(type){const index=this.inputs.findIndex(input=>input.type===type&&input.link==null);return index<0?undefined:{index,slot:this.inputs[index]};}
            addWidget(type,name,value,callback,options){const widget={type,name,value,callback,options};this.widgets.push(widget);return widget;}
            addDOMWidget(name,type,element){const host=document.createElement('div');host.style.height='650px';host.className='fixture-dom-widget';host.append(element);document.body.append(host);return {element};}
            setSize(size){this.size=size;}setDirtyCanvas(){}
@@ -40,6 +41,32 @@ test.beforeEach(async({page,browserName})=>{
 });
 test.afterEach(async({page,browserName})=>{await saveCoverage(page,browserName);expect(page.focusedErrors).toEqual([]);});

+test(`${variant} Save to library switch saves its value and loads older workflows on (#90)`, async ({page}) => {
+    const toggle=page.getByRole('checkbox',{name:'Save to library',exact:true});
+    await expect(toggle).toBeChecked();
+    expect(await page.evaluate(()=>node.widgets.map(widget=>widget.name))).toEqual(['text','category','tags','search_text','prepend_text','append_text','save_to_library']);
+    // The native switch is drawn in the toolbar only: the host keeps it hidden and zero-height, like the text fallbacks
+    expect(await page.evaluate(()=>{const widget=node.widgets.find(item=>item.name==='save_to_library');return {type:widget.type,hidden:widget.hidden,size:widget.computeSize()};})).toEqual({type:'hidden',hidden:true,size:[0,-4]});
+    expect(await page.evaluate(()=>node.widgets.find(item=>item.name==='text').computeSize())).toEqual([0,-4]);
+    await toggle.uncheck();
+    await expect(page.locator('.pm-focused > .pm-editor-status[role=status]')).toHaveText('Save to library is off: runs of this node are not added to the library.');
+    const saved=await page.evaluate(()=>node.serialize());
+    expect(saved.widgets_values[6]).toBe(false);
+    await page.evaluate(saved=>node.configure(saved),saved);
+    await expect(toggle).not.toBeChecked();
+    await page.getByLabel('Main prompt',{exact:true}).fill('Typed while off');
+    await expect(page.locator('.pm-focused > .pm-editor-status[role=status]')).toHaveText('Save to library is off: runs of this node are not added to the library.');
+    // A workflow saved before the switch held the editor's own slot ('') at its index
+    await page.evaluate(()=>node.configure({widgets_values:['Old text','','','','','',''],properties:{}}));
+    await expect(toggle).toBeChecked();
+    expect(await page.evaluate(()=>node.widgets.find(widget=>widget.name==='save_to_library').value)).toBe(true);
+    await toggle.check();
+    await page.getByLabel('Main prompt',{exact:true}).fill('Typed while on');
+    await expect(page.locator('.pm-focused > .pm-editor-status[role=status]')).toHaveText('Main prompt is saved when this node runs.');
+    await page.evaluate(()=>{node.inputs.find(input=>input.name==='save_to_library').link=9;node.onConnectionsChange?.();});
+    await expect(toggle).toBeDisabled();
+});
+
 test(`${variant} library autocompletes filters and searches without changing editor metadata`, async ({page}) => {
    const requests=[];
    await page.route('**/prompt_manager/categories',route=>route.fulfill({json:{success:true,categories:['Portrait']}}));
@@ -246,13 +273,39 @@ test(`${variant} restores workflow values and disclosures and protects connected
    await page.evaluate(()=>{const saved=node.serialize();node.configure(saved);});
    await expect(page.getByLabel('Category',{exact:true})).toBeVisible();
    await expect(page.getByLabel('Category',{exact:true})).toHaveValue('Saved category');
-    await page.evaluate(()=>{node.inputs.push({name:'text',link:9});node.onConnectionsChange();});
+    await page.evaluate(()=>{node.inputs.find(input=>input.name==='text').link=9;node.onConnectionsChange();});
    await expect(page.getByRole('textbox',{name:'Main prompt',exact:true})).toBeHidden();
-    await expect(page.getByText('Text is supplied by an upstream connection.',{exact:true})).toBeVisible();
+    await expect(page.getByText('Main prompt comes from a link. Your typed text is kept for when you disconnect it.',{exact:true})).toBeVisible();
    await page.evaluate(()=>{node.inputs.find(input=>input.name==='text').link=null;node.onConnectionsChange();});
    await expect(page.getByRole('textbox',{name:'Main prompt',exact:true})).toHaveValue('Saved draft');
 });

+test(`${variant} offers text as a link socket, keeps typed text while linked and through a reload (#343)`,async({page})=>{
+    const sockets=()=>page.evaluate(()=>Object.fromEntries(node.inputs.map(input=>[input.name,input.widget?.name??null])));
+    // The hidden text widget no longer owns the input, so the host draws it as a socket; the other widget inputs are unchanged.
+    expect(await sockets()).toEqual({clip:null,prepend_text:null,append_text:null,text:null,category:'category',tags:'tags',search_text:'search_text',save_to_library:'save_to_library'});
+    expect(await page.evaluate(()=>node.findInputByType('STRING').slot.name)).toBe('text');
+    expect(await page.evaluate(()=>node.findInputByType('CLIP').slot.name)).toBe('clip');
+    const main=page.getByRole('textbox',{name:'Main prompt',exact:true});
+    await main.fill('Typed main');
+    await page.evaluate(()=>{node.inputs.find(input=>input.name==='text').link=21;node.onConnectionsChange();});
+    await expect(main).toBeHidden();
+    const note=page.getByText('Main prompt comes from a link. Your typed text is kept for when you disconnect it.',{exact:true});
+    await expect(note).toBeVisible();
+    await expect(page.locator('[data-composed-preview]')).toHaveText('[text supplied by connection]');
+    // A second STRING link dropped on the editor falls back to the frontend's own choice.
+    expect(await page.evaluate(()=>node.findInputByType('STRING').slot.name)).toBe('prepend_text');
+    // An older saved workflow brings the widget binding back with its inputs: configure exposes the socket again.
+    const saved=await page.evaluate(()=>{const saved=node.serialize();node.inputs.find(input=>input.name==='text').widget={name:'text'};node.configure(saved);return saved;});
+    expect(saved.widgets_values[0]).toBe('Typed main');
+    expect((await sockets()).text).toBeNull();
+    await expect(note).toBeVisible();
+    await page.evaluate(()=>{node.inputs.find(input=>input.name==='text').link=null;node.onConnectionsChange();});
+    await expect(main).toBeVisible();
+    await expect(main).toHaveValue('Typed main');
+    await expect(note).toBeHidden();
+});
+
 test(`${variant} searches quoted tags with Enter and explicitly loads metadata`, async ({page}) => {
    let requested;
    await page.route('**/prompt_manager/search?**', async route => {
@@ -0,0 +1,78 @@
+"""Empty a browser-test media folder without waiting for the disk (#384).
+
+A reset used to ``shutil.rmtree`` the output and input folders the last
+fixture wrote. Unlinking a file whose pages are still being written back
+waits for that write, so on a slow CI disk a reset stalled in ``rmtree``.
+``replace_folder`` renames the old folder into ``<parent>/reset-trash`` (one
+metadata change) and makes a new empty one; a background thread deletes the
+trash, and ``close_trash`` stops that thread and removes what is left before
+the server's temp root goes.
+"""
+
+from __future__ import annotations
+
+import queue
+import shutil
+import threading
+import uuid
+from pathlib import Path
+
+TRASH_NAME = "reset-trash"
+
+
+class _Trash:
+    def __init__(self, directory: Path) -> None:
+        self.directory = directory
+        self._queue: "queue.SimpleQueue[Path | None]" = queue.SimpleQueue()
+        self._thread = threading.Thread(
+            target=self._work, name="pm-reset-trash", daemon=True
+        )
+        self._thread.start()
+
+    def _work(self) -> None:
+        while (folder := self._queue.get()) is not None:
+            shutil.rmtree(folder, ignore_errors=True)
+
+    def discard(self, folder: Path) -> None:
+        self.directory.mkdir(exist_ok=True)
+        moved = self.directory / f"{folder.name}-{uuid.uuid4().hex}"
+        folder.rename(moved)
+        self._queue.put(moved)
+
+    def close(self) -> None:
+        self._queue.put(None)
+        self._thread.join()
+        shutil.rmtree(self.directory, ignore_errors=True)
+
+
+_trashes: dict[Path, _Trash] = {}
+# Trash folders whose server has cleaned up: a reset still running then
+# deletes in place instead of starting a thread nobody would stop.
+_closed: set[Path] = set()
+_lock = threading.Lock()
+
+
+def replace_folder(folder: Path) -> None:
+    """Make ``folder`` an empty folder; its old content is deleted later."""
+    folder = Path(folder)
+    if folder.exists():
+        directory = folder.parent / TRASH_NAME
+        with _lock:
+            trash = _trashes.get(directory)
+            if trash is None and directory not in _closed:
+                trash = _trashes[directory] = _Trash(directory)
+            if trash is not None:
+                trash.discard(folder)
+        if folder.exists():
+            shutil.rmtree(folder)
+    folder.mkdir()
+
+
+def close_trash(parent: Path) -> None:
+    """Stop deleting under ``parent``'s trash and remove it (blocking)."""
+    directory = Path(parent) / TRASH_NAME
+    with _lock:
+        _closed.add(directory)
+        trash = _trashes.pop(directory, None)
+    if trash is not None:
+        trash.close()
@@ -286,7 +286,8 @@ const continuationText=page=>page.locator('.infinite-continuation > p').first().
 async function searchOf(page,term) {
    const before=await countText(page);
    await page.locator('#search').fill(term);
-    await expect.poll(()=>countText(page)).not.toBe(before);
+    // Production's caption reads "Loading images…" until the search's listing answers (#391); the concept's is instant.
+    await expect.poll(async()=>{const text=await countText(page);return text!==before&&text!=='Loading images…';}).toBe(true);
    await expect.poll(()=>page.locator(CARDS).count()).toBeLessThan(FIXTURE_IMAGES);
    await settle(page);
    const result={count:await countText(page),continuation:await continuationText(page),cards:await page.locator(`${CARDS} .image-open`).evaluateAll(nodes=>nodes.map(node=>node.getAttribute('aria-label')))};
@@ -228,7 +228,8 @@ async function productionSendOf(page,context) {
 async function tagOf(page) {
    const before=await page.locator('#result-count').textContent();
    await panelOf(page).locator('.detail-inner > .tags').last().getByRole('button',{name:'cinematic',exact:true}).click();
-    await expect.poll(()=>page.locator('#result-count').textContent()).not.toBe(before);
+    // Production's caption reads "Loading images…" until the tag's listing answers (#391); the concept's search is instant.
+    await expect.poll(async()=>{const text=await page.locator('#result-count').textContent();return text!==before&&text!=='Loading images…';}).toBe(true);
    await settle(page);
    return {count:await page.locator('#result-count').textContent(),
        cards:await page.locator(`${CARDS} .image-open`).evaluateAll(nodes=>nodes.map(node=>node.getAttribute('aria-label')))};
@@ -328,6 +329,25 @@ test('a recipe-linked image without recipe metadata shows its positive prompt me
    await expect(panelOf(page).locator('.detail-footer button')).toHaveText(['Send to ComfyUI','Prompt history']);
 });

+// #391: a tag chip replaces the collection; until its listing answers the caption says it is loading, never that the
+// filter matched nothing ("0 of 0 images" was painted before the response and read by a fast reader).
+test('a tag chip collection reads as loading, not empty, until its listing answers (#391)',async({page})=>{
+    await page.setViewportSize({width:1600,height:1100});
+    await openProductionPanel(page,'dark');
+    let release,arrived;
+    const held=new Promise(resolve=>{release=resolve;}),reached=new Promise(resolve=>{arrived=resolve;});
+    await page.route(url=>url.pathname==='/prompt_manager/images/output'&&url.searchParams.get('tags')==='cinematic',
+        async route=>{arrived();await held;await route.continue();},{times:1});
+    const count=page.locator('#result-count');
+    await panelOf(page).locator('.detail-inner > .tags').last().getByRole('button',{name:'cinematic',exact:true}).click();
+    await reached;
+    await expect(count).toHaveText('Loading images…');
+    await expect(page.locator(CARDS)).toHaveCount(0);
+    release();
+    await expect(count).toHaveText(countCopy('8 of 8 images · 2 positive prompts'));
+    await expect(page.locator(CARDS)).toHaveCount(8);
+});
+
 // Task C3 (D88, #249 PR C): the concept's chip row is the image's own tags (`i.tags`, app.js a402). With those names
 // saved as the file's current image tags, production draws the row from them (Tags filter buttons in the panel, plain
 // in the viewer, the linked positive's equal tags not repeated) and still equals the concept, in both sizes.
@@ -0,0 +1,182 @@
+// #328: the legacy admin and gallery auto-tag batch and review keep working beside System › Auto-tagging. Since #330
+// the pages download and unload models only through System (legacy-system-links.spec.mjs); a batch never downloads
+// one. The fixture's fake download (`/__test__/tagging/download`) is held so nothing is ever fetched.
+import { startCoverage, saveCoverage } from '../../tools/vendor/browser-coverage.mjs';
+import { test, expect } from './fixtures.mjs';
+
+async function post(request, url, data) {
+    await expect(await request.post(url, data === undefined ? {} : { data })).toBeOK();
+}
+
+async function downloads(request) {
+    const response = await request.get('/prompt_manager/jobs');
+    await expect(response).toBeOK();
+    return (await response.json()).jobs.filter(job => job.kind === 'model_download');
+}
+
+test.beforeEach(async ({ page, request, browserName }) => {
+    await startCoverage(page, browserName);
+    // The 3.2.0 update notice would cover the admin page's toolbar.
+    await page.addInitScript(() => { localStorage.setItem('pm_update_notice_dismissed', '3.2.0'); });
+    await post(request, '/__test__/jobs/restart');
+    await post(request, '/__test__/tagging/reset');
+    await post(request, '/__test__/tagging/models', { unavailable: ['wd14-vit'] });
+    await post(request, '/__test__/tagging/download', { mode: 'hold' });
+});
+
+test.afterEach(async ({ page, request, browserName }) => {
+    await saveCoverage(page, browserName);
+    // Releases a download a failed test left held, and puts the raising default back.
+    await post(request, '/__test__/tagging/reset');
+    await post(request, '/__test__/jobs/restart');
+});
+
+// (wd14-vit is not downloaded in these tests: beforeEach marks it so the download tests can offer it.)
+// The gallery's batch reader keyed on `data.status` values the server never sends, so its modal never moved or
+// closed (#328 Problem 5). It now reads `type` frames as the admin page does.
+async function watchProgress(page) {
+    await page.evaluate(() => {
+        window.progressSeen = [];
+        const node = document.getElementById('autoTagProgressPercent');
+        // Each change from its own record: frames that land in one task share one
+        // callback, and the node's text by then is only the last of them.
+        new MutationObserver(records => {
+            for (const record of records) {
+                if (record.type === 'characterData') window.progressSeen.push(record.target.data);
+                for (const added of record.addedNodes) window.progressSeen.push(added.textContent);
+            }
+        }).observe(node, { childList: true, characterData: true, subtree: true });
+    });
+}
+
+async function runGalleryBatch(page) {
+    await page.locator('#autoTagBtn').click();
+    await page.locator('input[name="autoTagModel"][value="wd14-swinv2"]').check();
+    await watchProgress(page);
+    const done = page.waitForResponse(response => response.url().includes('/prompt_manager/autotag/start'));
+    await page.locator('#startAutoTagBtn').click();
+    await done;
+    await expect(page.locator('#autoTagProgressModal')).toBeHidden();
+    // #379: the batch counts images, never prompts.
+    await expect(page.getByText(/^Auto tagging complete! Tagged \d+ images?\.$/)).toBeVisible();
+}
+
+const CLOSE_NOTE = 'Closing this window stops tagging. Tags already added are kept. Prompt Manager\'s Activity page shows the '
+    + 'time left.';
+
+async function serverJobs(request) {
+    const response = await request.get('/prompt_manager/jobs');
+    await expect(response).toBeOK();
+    return (await response.json()).jobs;
+}
+
+async function runNativeBatch(request) {
+    const started = await request.post('/prompt_manager/jobs/autotag', { data: { model_type: 'wd14-swinv2', existing: 'skip',
+        options: { general_threshold: 0.35, character_threshold: 0.85 } } });
+    expect(started.status()).toBe(202);
+    const { job } = await started.json();
+    await expect.poll(async () => (await serverJobs(request)).find(item => item.id === job.id)?.state).toBe('finished');
+}
+
+test('gallery batch modal counts progress and closes on complete', async ({ page, request }) => {
+    await page.goto('/prompt_manager/gallery');
+    await runGalleryBatch(page);
+    const seen = await page.evaluate(() => window.progressSeen);
+    // The phase frames (model 5%, listing 8%) then the per-image frames (from 10%) move the bar.
+    expect(seen).toContain('8%');
+    expect(seen.some(value => parseInt(value, 10) >= 10)).toBe(true);
+    await expect(page.locator('#autoTagCloseNote')).toHaveText(CLOSE_NOTE);
+    // The batch ran as the autotag job of the legacy page.
+    expect((await serverJobs(request)).filter(job => job.kind === 'autotag').map(job => [job.title, job.state]))
+        .toEqual([['Tag output images (legacy page)', 'finished']]);
+    expect((await downloads(request)).length).toBe(0);
+});
+
+test('admin batch copy names images, not prompts (#379)', async ({ page }) => {
+    await page.goto('/prompt_manager/admin');
+    await page.locator('#autoTagBtn').click();
+    await expect(page.locator('input[name="autoTagMode"][value="skip"] + span')).toHaveText('Skip images already auto-tagged');
+    await expect(page.getByText('"auto-scanned" is not counted as a real tag')).toHaveCount(0);
+    await expect(page.locator('#autoTagCloseNote')).toHaveText(CLOSE_NOTE);
+    await expect(page.locator('#retagConfirmModal h3')).toHaveText('Image Already Auto-tagged');
+    await expect(page.locator('#retagConfirmModal')).toContainText('A tagging model already tagged this image. Generate new tags?');
+});
+
+test('admin review opens the first image', async ({ page }) => {
+    await page.goto('/prompt_manager/admin');
+    await page.locator('#autoTagBtn').click();
+    await page.locator('input[name="autoTagModel"][value="wd14-swinv2"]').check();
+    await page.locator('#startReviewBtn').click();
+    // #379: no image is auto-tagged yet (prompt tags no longer count), so the review opens on the first image.
+    await expect(page.locator('#retagConfirmModal')).toBeHidden();
+    await expect(page.locator('#autoTagReviewModal')).toBeVisible();
+    await expect(page.locator('#reviewImageName')).not.toHaveText(/^(image_name\.png|Unknown|)$/);
+    await expect(page.getByText('Failed to start review mode')).toHaveCount(0);
+});
+
+/** The admin review lists every row, videos too: Skip any image that is not one until the confirmation shows. */
+async function untilAutoTagged(page, confirm) {
+    // Each image's skip check answers before its confirmation or its error shows.
+    const failed = page.locator('#reviewTagsVisible .text-pm-error');
+    for (let tries = 0; tries < 5; tries++) {
+        await expect.poll(async () => (await confirm.isVisible()) || (await failed.count()) > 0).toBe(true);
+        if (await confirm.isVisible()) return;
+        const answered = page.waitForResponse(item => item.url().endsWith('/prompt_manager/autotag/single'));
+        await page.locator('#skipReviewBtn').click();
+        await answered;
+    }
+    await expect(confirm).toBeVisible();
+}
+
+// #379: the admin review asks before re-tagging an image a model already tagged, and Apply & Next writes that image's
+// tags (its bytes, never its prompt).
+test('admin review: an auto-tagged image asks first; Re-tag then Apply & Next tags the image', async ({ page, request }) => {
+    await runNativeBatch(request);
+    await page.goto('/prompt_manager/admin');
+    await page.locator('#autoTagBtn').click();
+    await page.locator('input[name="autoTagModel"][value="wd14-swinv2"]').check();
+    await page.locator('#startReviewBtn').click();
+    const confirm = page.locator('#retagConfirmModal');
+    await untilAutoTagged(page, confirm);
+    await expect(confirm.locator('#retagExistingTags span').first()).toHaveText('sandstone');
+    await page.locator('#retagConfirmBtn').click();
+    await expect(page.locator('#autoTagReviewModal')).toBeVisible();
+    await expect(page.locator('#reviewTagsVisible .tag-chip').first()).toContainText('sandstone');
+    const applied = page.waitForRequest(item => item.url().endsWith('/prompt_manager/autotag/apply'));
+    const answer = page.waitForResponse(item => item.url().endsWith('/prompt_manager/autotag/apply'));
+    await page.locator('#applyReviewBtn').click();
+    const body = (await applied).postDataJSON();
+    expect(body.prompt_id).toBeUndefined();
+    expect(body.sha256).toMatch(/^[0-9a-f]{64}$/);
+    expect((await answer).status()).toBe(200);
+});
+
+test('admin review: Skip All Tagged passes every auto-tagged image', async ({ page, request }) => {
+    await runNativeBatch(request);
+    await page.goto('/prompt_manager/admin');
+    await page.locator('#autoTagBtn').click();
+    await page.locator('input[name="autoTagModel"][value="wd14-swinv2"]').check();
+    await page.locator('#startReviewBtn').click();
+    const confirm = page.locator('#retagConfirmModal');
+    await untilAutoTagged(page, confirm);
+    await page.locator('#retagSkipAllBtn').click();
+    await expect(page.locator('#retagConfirmModal')).toBeHidden();
+    await expect(page.getByText('Review complete!')).toBeVisible();
+});
+
+test('gallery review: Apply & Next tags the image by its path and bytes', async ({ page }) => {
+    await page.goto('/prompt_manager/gallery');
+    await page.locator('#autoTagBtn').click();
+    await page.locator('input[name="autoTagModel"][value="wd14-swinv2"]').check();
+    const suggested = page.waitForRequest(item => item.url().endsWith('/prompt_manager/autotag/single'));
+    await page.locator('#startReviewBtn').click();
+    expect((await suggested).postDataJSON().existing).toBe('merge');
+    await expect(page.locator('#reviewTagsContainer .tag-chip').first()).toContainText('sandstone');
+    const applied = page.waitForRequest(item => item.url().endsWith('/prompt_manager/autotag/apply'));
+    const answer = page.waitForResponse(item => item.url().endsWith('/prompt_manager/autotag/apply'));
+    await page.locator('#applyReviewBtn').click();
+    const body = (await applied).postDataJSON();
+    expect(Object.keys(body).sort()).toEqual(['path', 'root_index', 'sha256', 'tags'].filter(key => key in body).sort());
+    expect(body.prompt_id).toBeUndefined();
+    expect((await answer).status()).toBe(200);
+});
@@ -0,0 +1,286 @@
+// System S13 (#330): the legacy admin and gallery pages open native System for their System tools. Each replaced
+// control is a plain link (`workspace#/system/<id>`, a new tab), and the legacy flows S13 keeps still work.
+import { startCoverage, saveCoverage } from '../../tools/vendor/browser-coverage.mjs';
+import { test, expect } from './fixtures.mjs';
+
+const PAGES = Object.freeze({ admin: '/prompt_manager/admin', gallery: '/prompt_manager/gallery' });
+const LABELS = Object.freeze({
+    overview: 'Overview',
+    appearance: 'Appearance',
+    sources: 'Sources & scans',
+    integrations: 'Integrations',
+    tagging: 'Auto-tagging',
+    maintenance: 'Maintenance',
+    backups: 'Backup & export',
+    diagnostics: 'Diagnostics & logs',
+});
+
+async function openPageOptions(page) {
+    await page.locator('#pageOptionsBtn').click();
+    await expect(page.locator('#settingsModal')).toBeVisible();
+}
+
+/** The auto-tag modal with its model rows read from /autotag/models. */
+async function openAutoTag(page) {
+    const read = page.waitForResponse(item => item.url().endsWith('/prompt_manager/autotag/models'));
+    await page.locator('#autoTagBtn').click();
+    await read;
+    await expect(page.locator('#autoTagModal')).toBeVisible();
+}
+
+const notDownloaded = (page, request) => post(request, '/__test__/tagging/models', { unavailable: ['gguf'] });
+const modelLoaded = (page, request) => post(request, '/__test__/tagging/loaded', { model: 'wd14-vit' });
+
+// One row per System link of the design's §2 map: the page, the control's label, how to find it, the section it opens
+// and what a test must arrange before the control shows.
+const LINKS = Object.freeze([
+    { page: 'admin', label: 'Settings', locate: page => page.locator('#settingsBtn'), section: 'overview' },
+    { page: 'admin', label: 'Maintenance', locate: page => page.locator('#maintenanceBtn'), section: 'maintenance' },
+    { page: 'admin', label: 'Backup DB', locate: page => page.locator('#backupBtn'), section: 'backups' },
+    { page: 'admin', label: 'Restore DB', locate: page => page.locator('#restoreBtn'), section: 'backups' },
+    { page: 'gallery', label: 'Settings', locate: page => page.locator('#settingsBtn'), section: 'appearance' },
+    { page: 'admin', label: 'Manage in System (model row)', arrange: notDownloaded, reveal: openAutoTag,
+        locate: page => page.locator('#ggufModelStatus a'), section: 'tagging' },
+    { page: 'gallery', label: 'Manage in System (model row)', arrange: notDownloaded, reveal: openAutoTag,
+        locate: page => page.locator('#ggufModelStatus a'), section: 'tagging' },
+    { page: 'gallery', label: 'Manage in System (Unload Model)', arrange: modelLoaded, reveal: openAutoTag,
+        locate: page => page.locator('#unloadModelBtn'), section: 'tagging' },
+    { page: 'gallery', label: 'Page options Maintenance', reveal: openPageOptions,
+        locate: page => page.locator('#pageOptionsMaintenanceLink'), section: 'maintenance' },
+    { page: 'gallery', label: 'Page options Sources & scans', reveal: openPageOptions,
+        locate: page => page.locator('#pageOptionsSourcesLink'), section: 'sources' },
+    { page: 'admin', label: 'Diagnostics', locate: page => page.locator('#diagnosticsBtn'), section: 'diagnostics' },
+    { page: 'admin', label: 'View Logs', locate: page => page.locator('#logsBtn'), section: 'diagnostics' },
+]);
+
+async function post(request, url, data) {
+    await expect(await request.post(url, data === undefined ? {} : { data })).toBeOK();
+}
+
+test.beforeEach(async ({ page, request, browserName }) => {
+    await startCoverage(page, browserName);
+    await post(request, '/__test__/reset');
+    await post(request, '/__test__/system/reset');
+    await post(request, '/__test__/tagging/reset');
+    // The 3.2.0 update notice would cover the admin page's toolbar.
+    await page.addInitScript(() => { localStorage.setItem('pm_update_notice_dismissed', '3.2.0'); });
+    page.legacyErrors = [];
+    page.on('pageerror', error => page.legacyErrors.push(error.message));
+});
+
+test.afterEach(async ({ page, request, browserName }) => {
+    await saveCoverage(page, browserName);
+    await post(request, '/__test__/tagging/reset');
+    await post(request, '/__test__/system/reset');
+    expect(page.legacyErrors).toEqual([]);
+});
+
+/** Opens the legacy page with the link showing; returns the link. */
+async function openLink(page, request, link) {
+    if (link.arrange) await link.arrange(page, request);
+    await page.goto(PAGES[link.page]);
+    if (link.reveal) await link.reveal(page);
+    const control = link.locate(page);
+    await expect(control).toBeVisible();
+    return control;
+}
+
+// Each row opens its section in a new tab and sends no request from the legacy page (the design's `a System link sends
+// no request from the legacy page`, checked per row so one slow page never times out the whole table).
+for (const link of LINKS) {
+    test(`legacy ${link.page} ${link.label} opens System ${link.section}`, async ({ page, context, request }) => {
+        // The gallery's thumbnail startup check (K9) reads its status on a timer of its own; it is off here.
+        await page.addInitScript(() => {
+            localStorage.setItem('gallerySettings', JSON.stringify({ checkThumbnailsAtStartup: false }));
+        });
+        const control = await openLink(page, request, link);
+        const legacyUrl = page.url();
+        await expect(control).toHaveAttribute('href', `workspace#/system/${link.section}`);
+        await expect(control).toHaveAttribute('target', '_blank');
+        await expect(control).toHaveAttribute('rel', 'noopener');
+        // The page's own start-up reads (list, film strips, settings) finish first; then the click must add none.
+        // Lazy thumbnails may still load whenever the layout changes; they are not the click's.
+        await page.waitForLoadState('networkidle');
+        const sent = [];
+        const record = item => { if (item.resourceType() !== 'image') sent.push(`${item.method()} ${item.url()}`); };
+        page.on('request', record);
+        const opened = context.waitForEvent('page');
+        await control.click();
+        const system = await opened;
+        await expect(system).toHaveURL(new RegExp(`/prompt_manager/workspace#/system/${link.section}$`));
+        page.off('request', record);
+        expect(sent, 'a System link sends no request from the legacy page').toEqual([]);
+        // System's page heading is "System"; the open section is the pressed button of its section switcher.
+        const main = system.locator('#workspace-main');
+        await expect(main.getByRole('heading', { level: 1, name: 'System', exact: true })).toBeVisible();
+        await expect(main.getByRole('group', { name: 'System sections', exact: true })
+            .getByRole('button', { name: LABELS[link.section], exact: true })).toHaveAttribute('aria-pressed', 'true');
+        expect(page.url()).toBe(legacyUrl);
+        await system.close();
+    });
+}
+
+test('kept admin flows still work', async ({ page, context }) => {
+    await page.goto(PAGES.admin);
+    const texts = page.locator('#resultsList .prompt-text');
+    await expect(texts.first()).toBeVisible();
+
+    // K1: sorting reorders the list.
+    for (const [value, order] of [['text_asc', 1], ['text_desc', -1]]) {
+        const listed = page.waitForResponse(item => /\/prompt_manager\/(recent|search)\?/.test(item.url()) && item.url().includes(`sort=${value}`));
+        await page.locator('#sortBy').selectOption(value);
+        await listed;
+        await expect.poll(async () => {
+            const shown = await texts.allTextContents();
+            // The server sorts case-insensitively (SQLite NOCASE), not by locale.
+            const key = text => text.toLowerCase();
+            const sorted = [...shown].sort((a, b) => order * (key(a) < key(b) ? -1 : key(a) > key(b) ? 1 : 0));
+            return shown.length > 1 && shown.join('\n') === sorted.join('\n');
+        }).toBe(true);
+    }
+    // K3: Add Prompt saves a prompt the list then shows.
+    await page.locator('#addPromptBtn').click();
+    await page.locator('#addPromptText').fill('Kept flow lighthouse');
+    const saved = page.waitForResponse(item => item.request().method() === 'POST' && item.url().endsWith('/prompt_manager/save'));
+    await page.locator('#saveNewPromptBtn').click();
+    expect((await saved).ok()).toBe(true);
+    await expect(page.locator('#addPromptModal')).toBeHidden();
+    await expect(texts.filter({ hasText: 'Kept flow lighthouse' })).toBeVisible();
+
+    // K1: a search narrows the list, and a selection enables the bulk buttons.
+    const all = await texts.allTextContents();
+    const word = all[0].trim().split(/\s+/)[0];
+    const searched = page.waitForResponse(item => item.url().includes('/prompt_manager/search?') && item.url().includes('text='));
+    await page.locator('#searchText').fill(word);
+    await page.locator('#searchBtn').click();
+    await searched;
+    await expect.poll(async () => {
+        const shown = await texts.allTextContents();
+        return shown.length > 0 && shown.length < all.length && shown.every(text => text.toLowerCase().includes(word.toLowerCase()));
+    }).toBe(true);
+    await expect(page.locator('#bulkDeleteBtn')).toBeDisabled();
+    await page.locator('#resultsList .prompt-checkbox').first().check();
+    for (const id of ['#bulkDeleteBtn', '#bulkTagBtn', '#bulkCategoryBtn']) await expect(page.locator(id)).toBeEnabled();
+
+    // K4: Stats reads the statistics again; Export downloads the prompts.
+    const stats = page.waitForResponse(item => item.url().endsWith('/prompt_manager/stats') && item.ok());
+    await page.locator('#statsBtn').click();
+    await stats;
+    await expect(page.getByText('Stats refreshed successfully!')).toBeVisible();
+    const download = page.waitForEvent('download');
+    await page.locator('#exportBtn').click();
+    expect((await download).suggestedFilename()).toMatch(/^prompts-\d{4}-\d{2}-\d{2}\.json$/);
+
+    // K5: Scan Images opens its dialog (with the quick backup) without starting a scan.
+    await page.locator('#scanBtn').click();
+    await expect(page.locator('#scanModal')).toBeVisible();
+    await expect(page.locator('#quickBackupBtn')).toBeVisible();
+    await page.locator('#cancelScan').click();
+    await expect(page.locator('#scanModal')).toBeHidden();
+
+    // K7: Metadata and Gallery open their pages in a new tab.
+    for (const [id, path] of [['#metadataBtn', '/prompt_manager/gallery.html'], ['#galleryBtn', '/prompt_manager/gallery']]) {
+        const opened = context.waitForEvent('page');
+        await page.locator(id).click();
+        const tab = await opened;
+        await tab.waitForLoadState('domcontentloaded');
+        expect(new URL(tab.url()).pathname).toBe(path);
+        await tab.close();
+    }
+});
+
+test('Page options keeps the page-only settings admin', async ({ page, request }) => {
+    const before = (await (await request.get('/prompt_manager/settings')).json()).settings;
+    await page.goto(PAGES.admin);
+    await expect(page.locator('#resultsList .prompt-text').first()).toBeVisible();
+    await page.locator('#pageOptionsBtn').click();
+    const dialog = page.locator('#settingsModal');
+    await expect(dialog).toBeVisible();
+    await expect(dialog.locator('h3')).toHaveText('Page options');
+    // Exactly the page-only setting (G5): the list's Infinite Scrolling default.
+    expect(await dialog.locator('input, select, textarea').evaluateAll(fields => fields.map(field => field.id)))
+        .toEqual(['infiniteScrollDefault']);
+    await expect(page.locator('#infiniteScrollDefault')).not.toBeChecked();
+    await page.locator('#infiniteScrollDefault').check();
+    const saved = page.waitForRequest(item => item.method() === 'POST' && item.url().endsWith('/prompt_manager/settings'));
+    await page.locator('#saveSettings').click();
+    expect((await saved).postDataJSON()).toEqual({ infinite_scroll: true });
+    await expect(dialog).toBeHidden();
+    // The list header follows the saved default at once; nothing else changed.
+    await expect(page.locator('#infiniteScrollSession')).toBeChecked();
+    const after = (await (await request.get('/prompt_manager/settings')).json()).settings;
+    expect(after).toEqual({ ...before, infinite_scroll: true });
+    await page.reload();
+    // The dialog shows the saved default once the page has read it (the header follows it first).
+    await expect(page.locator('#infiniteScrollSession')).toBeChecked();
+    await page.locator('#pageOptionsBtn').click();
+    await expect(page.locator('#infiniteScrollDefault')).toBeChecked();
+});
+
+test('Page options keeps the page-only settings gallery', async ({ page }) => {
+    // Native Appearance keys and the startup prompt's own keys are in the shared object before the page opens.
+    const stored = { imageQuality: 'high', showImageInfo: false, videoMute: false,
+        autoLoadMetadata: false, workspaceLayout: 'masonry', thumbnailPromptDismissed: 'sig', thumbnailsGenerated: true,
+        checkThumbnailsAtStartup: false, defaultViewMode: 'list' };
+    await page.addInitScript(value => {
+        if (!sessionStorage.getItem('seeded')) {
+            sessionStorage.setItem('seeded', '1');
+            localStorage.setItem('gallerySettings', value);
+        }
+    }, JSON.stringify(stored));
+    const listed = page.waitForResponse(item => item.url().includes('/prompt_manager/images/output?'));
+    await page.goto(PAGES.gallery);
+    await listed;
+    // With no Page options control, a stored default view still opens the page in it.
+    await expect(page.locator('#listViewBtn')).toHaveClass(/bg-pm-accent/);
+    await openPageOptions(page);
+    const dialog = page.locator('#settingsModal');
+    await expect(dialog.locator('h3')).toHaveText('Page options');
+    // Exactly the page-only settings (G5); the default view is System › Appearance's Default layout.
+    expect(await dialog.locator('input, select, textarea').evaluateAll(fields => fields.map(field => field.id))).toEqual([
+        'checkThumbnailsAtStartup', 'lazyLoadingToggle', 'defaultLimitSelect', 'gridColumnsSelect',
+        'infiniteScrollToggle', 'debugModeToggle', 'apiTimeoutInput']);
+    await expect(dialog.getByText('Default View Mode')).toHaveCount(0);
+    await page.locator('#defaultLimitSelect').selectOption('50');
+    await page.locator('#debugModeToggle').check();
+    await page.locator('#saveSettingsBtn').click();
+    await expect(dialog).toBeHidden();
+    const read = () => page.evaluate(() => JSON.parse(localStorage.getItem('gallerySettings')));
+    let saved = await read();
+    expect(saved).toMatchObject({ ...stored, defaultLimit: 50, debugMode: true });
+
+    // Reset puts back only the page options' defaults; the Appearance, startup-prompt and default-view keys stay.
+    await openPageOptions(page);
+    page.once('dialog', dialog => dialog.accept());
+    await page.locator('#resetSettingsBtn').click();
+    await expect(page.getByText('Page options reset to defaults')).toBeVisible();
+    await expect(page.locator('#defaultLimitSelect')).toHaveValue('100');
+    saved = await read();
+    expect(saved).toMatchObject({ defaultViewMode: 'list', imageQuality: 'high', showImageInfo: false, videoMute: false,
+        autoLoadMetadata: false, workspaceLayout: 'masonry', thumbnailPromptDismissed: 'sig', thumbnailsGenerated: true,
+        defaultLimit: 100, debugMode: false, checkThumbnailsAtStartup: true, lazyLoading: true, gridColumns: 8,
+        infiniteScroll: false, apiTimeout: 30 });
+});
+
+test('the legacy auto-tag modal stays open after Manage in System', async ({ page, context, request }) => {
+    for (const legacy of ['admin', 'gallery']) {
+        await post(request, '/__test__/tagging/models', { unavailable: ['gguf'] });
+        await page.goto(PAGES[legacy]);
+        await openAutoTag(page);
+        const link = page.locator('#ggufModelStatus').getByRole('link', { name: 'Manage in System', exact: true });
+        await expect(link).toHaveAttribute('title', 'Opens System › Auto-tagging in a new tab');
+        // A downloaded model keeps its status text.
+        await expect(page.locator('#wd14VitModelStatus')).toHaveText('\u2713 Downloaded');
+        const opened = context.waitForEvent('page');
+        await link.click();
+        const system = await opened;
+        await expect(system).toHaveURL(/#\/system\/tagging$/);
+        await expect(page.locator('#autoTagModal')).toBeVisible();
+        await system.close();
+        // Downloaded in System meanwhile: reopening the modal reads the models again (CUJ 4).
+        await post(request, '/__test__/tagging/models', { unavailable: [] });
+        await page.goto(PAGES[legacy]);
+        await openAutoTag(page);
+        await expect(page.locator('#ggufModelStatus')).toHaveText('\u2713 Downloaded');
+    }
+});
@@ -17,7 +17,8 @@ test.beforeEach(async({page,browserName})=>{
        window.fixtureApp={registerExtension(extension){this.extension=extension;},ui:{settings},graph:{_nodes:[],setDirtyCanvas(){}},canvas:{},graphToPrompt:async()=>({})};
        await import('/extensions/promptmanager/prompt_manager.js');
        class Node {
-            constructor(){this.id=1;this.type='PromptManagerPair';this.widgets=['text','negative_text','category','tags','search_text'].map(name=>({name,type:'text',value:'',options:{},inputEl:document.createElement('textarea')}));this.inputs=['clip','prepend_text','append_text'].map(name=>({name,link:null}));this.properties={};this.size=[1100,700];}
+            constructor(){this.id=1;this.type='PromptManagerPair';this.widgets=[...['text','negative_text','category','tags','search_text'].map(name=>({name,type:'text',value:'',options:{},inputEl:document.createElement('textarea')})),{name:'save_to_library',type:'toggle',value:true,options:{}}];this.inputs=[...['clip','prepend_text','append_text'].map(name=>({name,type:name==='clip'?'CLIP':'STRING',link:null})),...['text','negative_text','category','tags','search_text'].map(name=>({name,type:'STRING',link:null,widget:{name}})),{name:'save_to_library',type:'BOOLEAN',link:null,widget:{name:'save_to_library'}}];this.properties={};this.size=[1100,700];}
+            findInputByType(type){const index=this.inputs.findIndex(input=>input.type===type&&input.link==null);return index<0?undefined:{index,slot:this.inputs[index]};}
            addWidget(type,name,value,callback,options){const widget={type,name,value,callback,options};this.widgets.push(widget);return widget;}
            addDOMWidget(name,type,element){const host=document.createElement('div');host.style.cssText='height:700px;width:1100px;max-width:100%';host.className='fixture-dom-widget';host.append(element);document.body.append(host);return {element};}
            setSize(size){this.size=size;}setDirtyCanvas(){}
@@ -33,6 +34,18 @@ test.afterEach(async({page,browserName})=>{await saveCoverage(page,browserName);
 async function selectPair(page){await page.getByRole('button',{name:'Recent',exact:true}).click();await page.locator('.pm-editor-result').click();}
 async function draft(page,positive='Draft positive',negative='Draft negative'){await page.getByRole('textbox',{name:'Positive prompt',exact:true}).fill(positive);await page.getByRole('textbox',{name:'Negative prompt',exact:true}).fill(negative);}

+test('paired editor Save to library switch keeps the widget order and loads older workflows on (#90)',async({page})=>{
+    await expect(page.locator('.pm-pair')).toBeVisible();
+    const toggle=page.getByRole('checkbox',{name:'Save to library',exact:true});
+    await expect(toggle).toBeChecked();
+    expect(await page.evaluate(()=>node.widgets.map(widget=>widget.name))).toEqual(['text','negative_text','category','tags','search_text','prepend_text','append_text','save_to_library']);
+    await toggle.uncheck();
+    expect(await page.evaluate(()=>node.serialize().widgets_values[7])).toBe(false);
+    await expect(page.locator('.pm-pair > .pm-editor-status[role=status]').last()).toHaveText('Save to library is off: runs of this node are not added to the library.');
+    await page.evaluate(()=>node.configure({widgets_values:['P','N','','','','','',''],properties:{}}));
+    await expect(toggle).toBeChecked();
+});
+
 test('paired editor previews both texts before explicitly replacing both',async({page})=>{
    await expect(page.locator('.pm-pair')).toBeVisible();
    await draft(page);
@@ -123,6 +136,46 @@ test('a superseded library response never replaces the latest pair selection',as
    await expect(page.locator('.pm-editor-result')).not.toContainText('Stale positive');
 });

+test('paired editor offers positive and negative link sockets and keeps both typed texts (#343)',async({page})=>{
+    await draft(page,'Typed positive','Typed negative');
+    expect(await page.evaluate(()=>node.inputs.filter(input=>!input.widget).map(input=>input.name))).toEqual(['clip','prepend_text','append_text','text','negative_text']);
+    const target=()=>page.evaluate(()=>node.findInputByType('STRING').slot.name);
+    expect(await target()).toBe('text');
+    const positive=page.getByRole('textbox',{name:'Positive prompt',exact:true}),negative=page.getByRole('textbox',{name:'Negative prompt',exact:true});
+    const positiveNote=page.getByText('Positive prompt comes from a link. Your typed text is kept for when you disconnect it.',{exact:true});
+    const negativeNote=page.getByText('Negative prompt comes from a link. Your typed text is kept for when you disconnect it.',{exact:true});
+    const link=(name,value)=>page.evaluate(({name,value})=>{node.inputs.find(input=>input.name===name).link=value;node.onConnectionsChange();},{name,value});
+    for(const [linked,next] of [[['text'],'negative_text'],[['negative_text'],'text'],[['text','negative_text'],'prepend_text'],[[],'text']]){
+        for(const name of ['text','negative_text'])await link(name,linked.includes(name)?30:null);
+        expect(await target()).toBe(next);
+        await expect(positive).toBeVisible({visible:!linked.includes('text')});
+        await expect(negative).toBeVisible({visible:!linked.includes('negative_text')});
+        await expect(positiveNote).toBeVisible({visible:linked.includes('text')});
+        await expect(negativeNote).toBeVisible({visible:linked.includes('negative_text')});
+        const saved=await page.evaluate(()=>{const saved=node.serialize();for(const input of node.inputs)if(['text','negative_text'].includes(input.name))input.widget={name:input.name};node.configure(saved);return saved.widgets_values.slice(0,2);});
+        expect(saved).toEqual(['Typed positive','Typed negative']);
+        expect(await page.evaluate(()=>node.inputs.filter(input=>input.widget&&['text','negative_text'].includes(input.name)).length)).toBe(0);
+    }
+    await expect(positive).toHaveValue('Typed positive');await expect(negative).toHaveValue('Typed negative');
+});
+
+test('a link dropped on either prompt box, or its note, fills that box (#343 review M1)',async({page})=>{
+    const keys=await page.evaluate(()=>[...document.querySelectorAll('.pm-pair .lg-node-widget [data-slot-key]')].map(key=>key.dataset.slotKey));
+    // Nodes 2.0 resolves a drop through the nearest .lg-node-widget and its slot key: positive box and note, negative box and note.
+    expect(keys).toEqual(['1-in-3','1-in-3','1-in-4','1-in-4']);
+    const at=(name,connecting=true)=>page.evaluate(({name,connecting})=>{
+        fixtureApp.canvas={linkConnector:{state:{connectingTo:connecting?'input':undefined}},ds:{convertOffsetToCanvas:point=>point},canvas:{getBoundingClientRect:()=>({left:0,top:0})}};
+        const box=[...document.querySelectorAll('.pm-pair .lg-node-widget')].find(element=>element.getClientRects().length&&element.textContent.includes(name)).getBoundingClientRect();
+        return node.getInputOnPos([box.left+box.width/2,box.top+box.height/2])?.name??null;
+    },{name,connecting});
+    expect(await at('Negative prompt')).toBe('negative_text');
+    expect(await at('Positive prompt')).toBe('text');
+    expect(await at('Negative prompt',false)).toBeNull();
+    await page.evaluate(()=>{node.inputs.find(input=>input.name==='negative_text').link=4;node.onConnectionsChange();});
+    expect(await at('Negative prompt comes from a link')).toBe('negative_text');
+    expect(await page.evaluate(()=>{fixtureApp.canvas={};return node.getInputOnPos([1,1])??null;})).toBeNull();
+});
+
 test('queue hook synchronizes both editors, preserves links and forwards branch execution arguments',async({page})=>{
    await draft(page);
    const args=await page.evaluate(async()=>{
@@ -0,0 +1,279 @@
+"""Prove the scratch-seeded resets leave the state the old resets left (#384).
+
+Run by hand on Linux (the browser server's platform):
+
+    python -m tests.browser.reset_equivalence
+
+It starts the browser server three times: twice seeding on the live database
+as before #384 (``PM_TEST_SEED_ON_LIVE=1``) and once with the scratch seeder.
+Each server gets the same sequence: every reset kind of ``/__test__/reset``
+and ``/__test__/concept/reset``, with other fixtures' resets and API writes
+between them. After every reset it reads every table's rows (by rowid), the
+output and input file trees (size, SHA-256, mtime) and the response body.
+
+Values that differ between the two old runs are wall-clock values (created_at,
+an unpinned concept "now", file mtimes); they are masked. Everything else must
+be equal between the old runs and the new one. Exit status 0 means equal.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import sqlite3
+import subprocess
+import sys
+import tempfile
+import time
+import urllib.request
+from pathlib import Path
+
+REPO_ROOT = Path(__file__).resolve().parents[2]
+READY_TIMEOUT_S = 60
+CLOCK = "<clock>"
+
+RESETS = [
+    ("/__test__/reset", {}),
+    ("/__test__/reset", {"extra_images": 2}),
+    ("/__test__/reset", {"extra_images": 108}),
+    ("/__test__/reset", {"include_video": True}),
+    ("/__test__/reset", {"prompt_inspector": True}),
+    ("/__test__/reset", {"native_library": True}),
+    ("/__test__/reset", {"native_library": True, "extra_prompts": 125}),
+    ("/__test__/reset", {"native_library": True, "extra_variants": 41}),
+    ("/__test__/reset", {"workspace_visual": True}),
+    ("/__test__/reset", {"full_inspector": True}),
+    (
+        "/__test__/reset",
+        {"full_inspector": True, "include_video": True, "extra_images": 2},
+    ),
+    ("/__test__/reset", {"chronological_history": True}),
+    ("/__test__/reset", {"chronological_history": True, "history_runs": 85}),
+    ("/__test__/concept/reset", {}),
+    ("/__test__/concept/reset", {"extra_images": 100}),
+    ("/__test__/concept/reset", {"seedless_images": 2, "short_seedless": True}),
+    ("/__test__/concept/reset", {"now": 1_780_000_000}),
+]
+# Writes by other fixtures and the API between resets; the resets must keep or
+# replace them exactly as before.
+DIRTY = [
+    ("/__test__/tagging/reset", {}),
+    ("/__test__/system/reset", None),
+    (
+        "/__test__/saved-views/raw",
+        {"page": "images", "name": "dirty", "state": "{}"},
+    ),
+]
+
+
+class Server:
+    def __init__(self, on_live: bool) -> None:
+        self.tmp = tempfile.TemporaryDirectory(prefix="pm-equivalence-")
+        env = {**os.environ, "TMPDIR": self.tmp.name}
+        env.update(TEMP=self.tmp.name, TMP=self.tmp.name)
+        env.pop("PM_TEST_SEED_ON_LIVE", None)
+        if on_live:
+            env["PM_TEST_SEED_ON_LIVE"] = "1"
+        self.process = subprocess.Popen(
+            [
+                sys.executable,
+                "-m",
+                "tests.browser.server",
+                "--port",
+                "0",
+                "--exit-on-stdin-eof",
+            ],
+            cwd=REPO_ROOT,
+            env=env,
+            stdin=subprocess.PIPE,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.DEVNULL,
+        )
+        line = self.process.stdout.readline().decode()
+        if not line.startswith("PM_TEST_SERVER_PORT="):
+            raise RuntimeError(f"no port line: {line!r}")
+        self.base = f"http://127.0.0.1:{int(line.split('=', 1)[1])}"
+        deadline = time.monotonic() + READY_TIMEOUT_S
+        while True:
+            try:
+                self.post_json("GET", "/prompt_manager/test", None)
+                break
+            except OSError:
+                if time.monotonic() > deadline or self.process.poll() is not None:
+                    raise
+                time.sleep(0.1)
+        (self.root,) = Path(self.tmp.name).glob("pm-browser-*")
+
+    def post_json(self, method: str, path: str, data) -> dict:
+        body = None if data is None else json.dumps(data).encode()
+        request = urllib.request.Request(
+            self.base + path,
+            data=body if method == "POST" else None,
+            method=method,
+            headers={"Content-Type": "application/json"} if body else {},
+        )
+        with urllib.request.urlopen(request, timeout=120) as response:  # nosec B310
+            text = response.read().decode()
+        try:
+            return json.loads(text)
+        except ValueError:
+            return {"text": text[:200]}
+
+    def stop(self) -> None:
+        self.process.stdin.close()
+        self.process.wait(timeout=READY_TIMEOUT_S)
+        self.process.stdout.close()
+        self.tmp.cleanup()
+
+
+def read_tables(path: Path) -> dict:
+    conn = sqlite3.connect(path.as_uri() + "?mode=ro", uri=True)
+    try:
+        tables = {}
+        names = [
+            row[0]
+            for row in conn.execute(
+                "SELECT name FROM sqlite_master WHERE type='table' ORDER BY name"
+            )
+        ]
+        for name in names:
+            quoted = '"' + name.replace('"', '""') + '"'
+            columns = [row[1] for row in conn.execute(f"PRAGMA table_info({quoted})")]
+            try:
+                cursor = conn.execute(f"SELECT rowid, * FROM {quoted} ORDER BY rowid")
+                columns = ["rowid", *columns]
+            except sqlite3.OperationalError:
+                cursor = conn.execute(f"SELECT * FROM {quoted} ORDER BY 1")
+            rows = [
+                [value.hex() if isinstance(value, bytes) else value for value in row]
+                for row in cursor
+            ]
+            tables[name] = {"columns": columns, "rows": rows}
+        return tables
+    finally:
+        conn.close()
+
+
+def read_files(root: Path) -> dict:
+    files = {}
+    for top in ("output", "input"):
+        for path in sorted((root / top).rglob("*")):
+            if path.is_file():
+                stat = path.stat()
+                files[path.relative_to(root).as_posix()] = [
+                    stat.st_size,
+                    hashlib.sha256(path.read_bytes()).hexdigest(),
+                    stat.st_mtime_ns,
+                ]
+    return files
+
+
+def flatten(value, prefix="") -> dict:
+    if isinstance(value, dict):
+        out = {}
+        for key, item in value.items():
+            out.update(flatten(item, f"{prefix}/{key}"))
+        return out
+    if isinstance(value, list):
+        out = {f"{prefix}#len": len(value)}
+        for index, item in enumerate(value):
+            out.update(flatten(item, f"{prefix}[{index}]"))
+        return out
+    return {prefix: value}
+
+
+def snapshot(server: Server, response: dict) -> dict:
+    flat = {}
+    for table, data in read_tables(server.root / "browser.db").items():
+        flat[f"table {table}#rows"] = len(data["rows"])
+        for index, row in enumerate(data["rows"]):
+            for column, value in zip(data["columns"], row):
+                flat[f"table {table}[{index}].{column}"] = value
+    for name, (size, digest, mtime) in read_files(server.root).items():
+        flat[f"file {name}"] = [size, digest]
+        flat[f"file {name}#mtime"] = mtime
+    flat["files#count"] = sum(
+        1 for key in flat if key.startswith("file ") and "#" not in key
+    )
+    for key, value in flatten(response).items():
+        flat[f"response{key}"] = value
+    # Each server has its own temp root and a random storage epoch; name them
+    # instead of masking every column that carries them.
+    epoch = flat.get("table execution_history_metadata[0].storage_epoch")
+    names = [(str(server.root), "<root>")]
+    if isinstance(epoch, str) and epoch:
+        names.append((epoch, "<epoch>"))
+    for key, value in flat.items():
+        if isinstance(value, str):
+            for text, name in names:
+                value = value.replace(text, name)
+            flat[key] = value
+    return flat
+
+
+def run(on_live: bool) -> list[dict]:
+    server = Server(on_live)
+    try:
+        states = []
+        for index, (path, data) in enumerate(RESETS * 2):
+            dirty_path, dirty_data = DIRTY[index % len(DIRTY)]
+            server.post_json("POST", dirty_path, dirty_data)
+            started = time.monotonic()
+            response = server.post_json("POST", path, data)
+            elapsed = time.monotonic() - started
+            print(f"  {'old' if on_live else 'new'} {path} {data}: {elapsed:.2f}s")
+            states.append(snapshot(server, response))
+        return states
+    finally:
+        server.stop()
+
+
+def column_key(key: str) -> str:
+    """``table t[3].created_at`` -> ``table t.created_at`` (mask whole columns)."""
+    if key.startswith("table ") and "[" in key:
+        head, _, tail = key.partition("[")
+        return head + tail.partition("]")[2]
+    return key
+
+
+def main() -> int:
+    old_a, old_b, new = run(True), run(True), run(False)
+    failures = 0
+    masked_all = set()
+    for step, (path, data) in enumerate(RESETS * 2):
+        a, b, n = old_a[step], old_b[step], new[step]
+        masked = {
+            column_key(key)
+            for key in set(a) | set(b)
+            if a.get(key, CLOCK) != b.get(key, CLOCK)
+        }
+        masked_all |= masked
+        keys = set(a) | set(n)
+        diffs = [
+            key
+            for key in sorted(keys)
+            if column_key(key) not in masked
+            and a.get(key, "<missing>") != n.get(key, "<missing>")
+        ]
+        tables = len(
+            {k.split("[")[0].split("#")[0] for k in a if k.startswith("table ")}
+        )
+        status = "EQUAL" if not diffs else f"DIFFERENT ({len(diffs)} values)"
+        print(
+            f"{status}: {path} {json.dumps(data)}: {tables} tables, "
+            f"{a['files#count']} files, {len(keys)} values, "
+            f"{len(masked)} masked columns"
+        )
+        for key in diffs[:20]:
+            old, now = a.get(key, "<missing>"), n.get(key, "<missing>")
+            print(f"    {key}: old {old!r} new {now!r}")
+        failures += bool(diffs)
+    print("masked (differ between the two old runs):")
+    for key in sorted(masked_all):
+        print(f"    {key}")
+    return 1 if failures else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
@@ -3,6 +3,7 @@
 import argparse
 import asyncio
 import json
+import logging
 import os
 import shutil
 import socket
@@ -18,10 +19,15 @@ from aiohttp.web_runner import GracefulExit
 from PIL import Image
 from PIL.PngImagePlugin import PngInfo

+from tests.browser.folder_trash import close_trash, replace_folder
 from tests.browser.request_hold import register_request_holds
 from tests.browser import slow_reset_watch
+from tests.browser.fast_reset import SEED_ON_LIVE_ENV, ScratchSeeder
 from tests.browser.workspace_activity_fixture import register_activity_commands
 from tests.browser.workspace_system_fixture import register_system_commands
+from tests.browser.workspace_integrations_fixture import (
+    register_integrations_commands,
+)
 from tests.browser.workspace_concept_fixture import (
    MAX_EXTRA_IMAGES as CONCEPT_MAX_EXTRA_IMAGES,
    MAX_SEEDLESS_IMAGES as CONCEPT_MAX_SEEDLESS_IMAGES,
@@ -41,6 +47,10 @@ from tests.browser.workspace_library_editor_fixture import (
 from tests.browser.workspace_vocabulary_fixture import register_vocabulary_commands
 from tests.browser.workspace_tagging_fixture import register_tagging_commands
 from tests.browser.workspace_review_fixture import register_review_commands
+from tests.browser.workspace_diagnostics_fixture import (
+    register_diagnostics_commands,
+    repoint_logs,
+)

 CANONICAL_ROOT = Path(__file__).resolve().parents[2]
 CANONICAL_ASSETS = {
@@ -68,6 +78,8 @@ class TestModel:
    # Scored names the concept comparisons answer instead of the fixed list
    # (``/__test__/tagging/suggestions``); None keeps the fixed list.
    suggestions: list | None = None
+    # The engine's model table (``py/autotag.py`` MODELS), set at startup.
+    models_config: dict = {}

    def get_models_status(self) -> dict:
        return {
@@ -75,7 +87,7 @@ class TestModel:
                "downloaded": name not in self.unavailable,
                "loaded": self.loaded == name,
            }
-            for name in ("gguf", "hf", "wd14-vit", "wd14-convnext", "wd14-swinv2")
+            for name in self.models_config
        }

    def is_model_loaded(self) -> bool:
@@ -162,7 +174,20 @@ def register_reveal_stub(routes, api, root: Path):
    return types.SimpleNamespace(reset=reset)


+def isolate_lora_manager_settings(root: Path) -> Path:
+    """LoraManager's settings lookup reads an empty folder under ``root`` (#355).
+
+    The server's temporary root is removed when it exits, and with it this
+    folder: no page test reads the developer's real LoraManager settings.
+    """
+    folder = root / "lora-manager-settings"
+    folder.mkdir(exist_ok=True)
+    os.environ["LORA_MANAGER_SETTINGS_DIR"] = str(folder)
+    return folder
+
+
 def create_app(root: Path) -> web.Application:
+    isolate_lora_manager_settings(root)
    os.environ["PROMPT_MANAGER_CONFIG_PATH"] = str(root / "config.json")
    os.chdir(root)
    app = web.Application()
@@ -180,6 +205,8 @@ def create_app(root: Path) -> web.Application:
        directory.mkdir()
        setattr(folder_paths, f"get_{name}_directory", lambda path=directory: str(path))
    sys.modules["folder_paths"] = folder_paths
+    # S12: the logger writes into this server's root before any record is written.
+    repoint_logs(root)

    from py.config import GalleryConfig, PromptManagerConfig

@@ -190,6 +217,7 @@ def create_app(root: Path) -> web.Application:
    from py import autotag
    from utils.hashing import generate_prompt_hash

+    TestModel.models_config = autotag.MODELS
    model = TestModel()
    autotag.get_autotag_service = lambda: model
    api = PromptManagerAPI()
@@ -202,8 +230,14 @@ def create_app(root: Path) -> web.Application:
    reveal_stub = register_reveal_stub(routes, api, root)
    register_activity_commands(app, routes, api)
    register_system_commands(app, routes, api, root)
+    register_integrations_commands(app, routes, api, root)
+    reset_logs = register_diagnostics_commands(app, routes, api, root)
    request_holds = register_request_holds(app, routes)
    slow_reset_watch.install(app, api)
+    # Resets seed a scratch copy and publish it in one commit (#384).
+    seeder = ScratchSeeder(
+        api, root / "reset-scratch", on_live=os.environ.get(SEED_ON_LIVE_ENV) == "1"
+    )

    async def canonical_asset(request: web.Request) -> web.Response:
        filename, content_type = CANONICAL_ASSETS[request.path]
@@ -217,6 +251,7 @@ def create_app(root: Path) -> web.Application:
        routes.get(path)(canonical_asset)

    def seed(
+        target,
        extra_images: int = 0,
        include_video: bool = False,
        prompt_inspector: bool = False,
@@ -224,7 +259,7 @@ def create_app(root: Path) -> web.Application:
        extra_prompts: int = 0,
        extra_variants: int = 0,
    ) -> None:
-        with api.db.model.get_connection() as conn:
+        with target.db.model.get_connection() as conn:
            for table in (
                "saved_views",
                "image_favorites",
@@ -233,6 +268,7 @@ def create_app(root: Path) -> web.Application:
                "media_image_tags",
                "media_annotation_bytes",
                "media_annotation_files",
+                "image_categories",
                "image_prompt_pairs",
                "prompt_pair_tags",
                "prompt_pairs",
@@ -243,8 +279,7 @@ def create_app(root: Path) -> web.Application:
            ):
                conn.execute(f"DELETE FROM {table}")
        for name in ("output", "input"):
-            shutil.rmtree(root / name)
-            (root / name).mkdir()
+            replace_folder(root / name)
        for index, (directory, text, tag) in enumerate(
            [
                ("output", "Cat portrait", "cats"),
@@ -287,28 +322,30 @@ def create_app(root: Path) -> web.Application:
                    image.save(image_path, pnginfo=info)
            stamp = time.time() - index * 10
            os.utime(image_path, (stamp, stamp))
-            pid = api.db.save_prompt(
+            pid = target.db.save_prompt(
                text, tags=[tag], prompt_hash=generate_prompt_hash(text)
            )
-            api.db.link_image_to_prompt(pid, str(image_path))
+            target.db.link_image_to_prompt(pid, str(image_path))
            if index == 0:
                video_prompt_id = pid
                for number in range(extra_images):
                    extra = root / directory / "bulk" / f"{number:04}.png"
                    extra.parent.mkdir(exist_ok=True)
                    shutil.copyfile(image_path, extra)
-                    api.db.link_image_to_prompt(pid, str(extra))
+                    target.db.link_image_to_prompt(pid, str(extra))
        if native_library:
-            positive = api.db.get_prompt_by_hash(generate_prompt_hash("Cat portrait"))
+            positive = target.db.get_prompt_by_hash(
+                generate_prompt_hash("Cat portrait")
+            )
            positive_id = positive["id"]
-            api.db.update_prompt_metadata(
+            target.db.update_prompt_metadata(
                positive_id, category="Animals", tags=["cats", "studio"]
            )
            variants = []
            for index, negative in enumerate(
                ["blurry, watermark", "low quality", "low contrast", ""]
            ):
-                pair_id = api.db.save_prompt_pair(
+                pair_id = target.db.save_prompt_pair(
                    "Cat portrait",
                    negative,
                    title=f"Portrait variant {index + 1}",
@@ -316,28 +353,30 @@ def create_app(root: Path) -> web.Application:
                    tags=["studio"] if index == 0 else ["outdoors"],
                )
                variants.append(pair_id)
-            with api.db.model.get_connection() as conn:
+            with target.db.model.get_connection() as conn:
                images = conn.execute(
                    "SELECT id FROM generated_images WHERE prompt_id=? ORDER BY id",
                    (positive_id,),
                ).fetchall()
            for index, image in enumerate(images[:2]):
-                api.db.link_image_to_pair(
+                target.db.link_image_to_pair(
                    variants[index], image["id"], {"source": "fixture", "anchor": index}
                )
-            api.db.link_image_to_pair(
+            target.db.link_image_to_pair(
                variants[0], images[0]["id"], {"source": "fixture second evidence"}
            )
-            api.db.record_prompt_pair_use(variants[0], times=3)
+            target.db.record_prompt_pair_use(variants[0], times=3)
            for number in range(extra_variants):
-                api.db.save_prompt_pair("Cat portrait", f"Negative extra {number:04}")
+                target.db.save_prompt_pair(
+                    "Cat portrait", f"Negative extra {number:04}"
+                )
            legacy = root / "output" / "legacy-unassigned.png"
            shutil.copyfile(root / "output" / "shared" / "same.png", legacy)
-            api.db.link_image_to_prompt(positive_id, str(legacy))
-            api.db.save_prompt("Dog landscape", category="Animals", tags=["dogs"])
-            api.db.save_prompt_pair("Dual role portrait", "Cat portrait")
+            target.db.link_image_to_prompt(positive_id, str(legacy))
+            target.db.save_prompt("Dog landscape", category="Animals", tags=["dogs"])
+            target.db.save_prompt_pair("Dual role portrait", "Cat portrait")
            for number in range(extra_prompts):
-                api.db.save_prompt(
+                target.db.save_prompt(
                    f"Library extra {number:04}", category="Bulk", tags=["bulk"]
                )
        if prompt_inspector:
@@ -355,15 +394,20 @@ def create_app(root: Path) -> web.Application:
                with Image.new("RGB", (64, 64), (100, 80, 120)) as image:
                    image.save(root / "output" / name, pnginfo=info)
                os.utime(root / "output" / name, (time.time() - 100, time.time() - 100))
-        api._generate_gallery_thumbnails_sync(api._get_all_output_dirs(), (150, 150))
+        from py.api.thumbnail_settings import ThumbnailSettings
+
+        # 150 px previews in the default format (#317 thumbnail settings).
+        target._generate_gallery_thumbnails_sync(
+            target._get_all_output_dirs(), ThumbnailSettings("webp", 80, 150)
+        )
        if include_video:
            # Seed after thumbnail generation to exercise a real unthumbnailed video.
            video = root / "output" / "clip.webm"
            shutil.copyfile(
                Path(__file__).resolve().parents[1] / "fixtures" / "tiny.webm", video
            )
-            api.db.link_image_to_prompt(video_prompt_id, str(video))
-        api.invalidate_gallery_cache()
+            target.db.link_image_to_prompt(video_prompt_id, str(video))
+        target.invalidate_gallery_cache()

    history_fixture = None

@@ -389,6 +433,7 @@ def create_app(root: Path) -> web.Application:
        # No preview queued by the last test may land in the new fixture.
        await api._run_in_executor(api.close_auto_thumbnails)
        library_editor_commands.reset()
+        await api._run_in_executor(reset_logs)
        data = await request.json() if request.can_read_body else {}
        if not isinstance(data, dict):
            raise web.HTTPBadRequest()
@@ -408,7 +453,10 @@ def create_app(root: Path) -> web.Application:
            raise web.HTTPBadRequest()
        if chronological_history:
            manifest = await api._run_in_executor(
-                lambda: seed_workspace_history(api, root, history_runs=history_runs)
+                seeder.run,
+                lambda target: seed_workspace_history(
+                    target, root, history_runs=history_runs
+                ),
            )
            history_fixture = manifest
            return web.json_response({"success": True, **manifest})
@@ -466,25 +514,31 @@ def create_app(root: Path) -> web.Application:
            raise web.HTTPBadRequest()
        if workspace_visual:
            history_fixture = None
-            await api._run_in_executor(seed_workspace_visual, api, root)
+            await api._run_in_executor(
+                seeder.run, lambda target: seed_workspace_visual(target, root)
+            )
            return web.json_response({"success": True})
        if full_inspector:
            history_fixture = None
            await api._run_in_executor(
-                lambda: seed_workspace_inspector(
-                    api, root, extra_images=extra, include_video=include_video
-                )
+                seeder.run,
+                lambda target: seed_workspace_inspector(
+                    target, root, extra_images=extra, include_video=include_video
+                ),
            )
            return web.json_response({"success": True})
        history_fixture = None
        await api._run_in_executor(
-            seed,
-            extra,
-            include_video,
-            prompt_inspector,
-            native_library,
-            extra_prompts,
-            extra_variants,
+            seeder.run,
+            lambda target: seed(
+                target,
+                extra,
+                include_video,
+                prompt_inspector,
+                native_library,
+                extra_prompts,
+                extra_variants,
+            ),
        )
        return web.json_response({"success": True})

@@ -524,14 +578,15 @@ def create_app(root: Path) -> web.Application:
        reveal_stub.reset()
        history_fixture = None
        manifest = await api._run_in_executor(
-            lambda: seed_workspace_concept(
-                api,
+            seeder.run,
+            lambda target: seed_workspace_concept(
+                target,
                root,
                extra_images=data.get("extra_images", 0),
                seedless_images=data.get("seedless_images", 0),
                short_seedless=data.get("short_seedless", False),
                now=data.get("now"),
-            )
+            ),
        )
        return web.json_response({"success": True, **manifest})

@@ -599,9 +654,12 @@ def create_app(root: Path) -> web.Application:
    async def cleanup(application: web.Application) -> None:
        # A scan of an ambiguous fixture file captures it for Needs review.
        api.close_annotation_captures()
+        seeder.close()
        api.db.close_all()
+        # Old media folders still waiting for deletion go before the temp root.
+        close_trash(root)

-    seed()
+    seed(api)
    # Open Needs review change streams end first, as on the real host.
    app.on_shutdown.append(api.close_review_events)
    app.on_cleanup.append(cleanup)
@@ -656,6 +714,18 @@ def exit_when_stdin_closes(loop: asyncio.AbstractEventLoop) -> threading.Thread:
    return thread


+def close_owned_log_files() -> None:
+    """Close Prompt Manager's own log handlers before the temp root goes.
+
+    The logs live in the library's data folder (#249 S6b), which for this
+    server is <root>/user/__promptmanager; Windows cannot remove a file
+    this process still has open.
+    """
+    for handler in logging.getLogger("prompt_manager").handlers[:]:
+        if getattr(handler, "_prompt_manager_owned", False) is True:
+            handler.close()
+
+
 def main(argv: list[str] | None = None) -> None:
    parser = argparse.ArgumentParser()
    parser.add_argument(
@@ -680,6 +750,7 @@ def main(argv: list[str] | None = None) -> None:
        finally:
            # create_app works inside the root; Windows cannot remove a process's cwd.
            os.chdir(original_cwd)
+            close_owned_log_files()


 if __name__ == "__main__":
@@ -0,0 +1,329 @@
+import { startCoverage, saveCoverage } from '../../tools/vendor/browser-coverage.mjs';
+import { test, expect } from './fixtures.mjs';
+import { SIZES, THEMES, seedConcept, openConcept, openProduction, diffInventory, mutate } from './concept-inventory.mjs';
+
+// #249 System S9 Task 25: System › Backup & export (app.js renderSystem 691–693), its "Restore preview" (`restore`,
+// 1472–1476) and its "Import & inspect" (`import`, 1483–1487) against the immutable concept, on the concept-shaped
+// fixture. Each concept measurement is mapped only by the recorded deviations (D103, D104, D105; the Import dialog's
+// D15 and D55), each commented where it applies; after that the difference must be empty, and a mutated label, row,
+// danger mark or token must be noticed.
+test.use({ locale: 'en-US', timezoneId: 'UTC' });
+
+test.beforeEach(async ({ page, request, browserName }) => {
+    await startCoverage(page, browserName);
+    await seedConcept(request);
+    await expect(await request.post('/__test__/system/reset')).toBeOK();
+    await expect(await request.post('/__test__/jobs/restart')).toBeOK();
+    page.conceptErrors = [];
+    page.on('pageerror', error => page.conceptErrors.push(error.message));
+});
+
+test.afterEach(async ({ page, request, browserName }) => {
+    await saveCoverage(page, browserName);
+    await request.post('/__test__/jobs/restart');
+    await request.post('/__test__/system/reset');
+    expect(page.conceptErrors).toEqual([]);
+});
+
+const PREVIEW_URL = '/prompt_manager/restore/preview';
+
+/** Runs in the page: the section's surfaces under `mainSelector`, their text, controls, geometry and tokens. */
+function measureBackups(mainSelector) {
+    const layout = document.querySelector(`${mainSelector} .settings-layout`);
+    const css = (node, ...keys) => node ? Object.fromEntries(keys.map(key => [key, getComputedStyle(node)[key]])) : null;
+    const name = node => [node.localName, ...[...node.classList].sort()].join('.');
+    const text = node => node?.textContent.trim() ?? null;
+    const button = node => ({ text: text(node), className: node.className,
+        ...css(node, 'backgroundColor', 'color', 'fontSize', 'paddingTop', 'paddingLeft', 'borderTopColor') });
+    const base = layout.getBoundingClientRect();
+    const box = node => {
+        const rect = node.getBoundingClientRect();
+        return { left: Math.round(rect.left - base.left), top: Math.round(rect.top - base.top), width: Math.round(rect.width) };
+    };
+    const control = row => {
+        const select = row.querySelector(':scope > select');
+        if (select) return { kind: 'select', id: select.id, options: [...select.options].map(option => [option.textContent, option.disabled]),
+            selected: select.selectedOptions[0]?.textContent ?? null, disabled: select.disabled };
+        const toggle = row.querySelector(':scope > * input[type="checkbox"]');
+        return toggle ? { kind: 'switch', id: toggle.id, wrapper: name(toggle.parentElement), checked: toggle.checked,
+            disabled: toggle.disabled, ...css(toggle.parentElement, 'width', 'height') } : null;
+    };
+    const columns = layout.querySelector(':scope > .two-col');
+    const surfaces = [...columns.querySelectorAll(':scope > section.surface')];
+    const policy = layout.querySelector(':scope > section.surface');
+    const chip = policy.querySelector(':scope > h2 > .chip');
+    const row = policy.querySelector('.setting-row');
+    const status = surfaces[0].querySelector(':scope > p.small');
+    const warning = policy.querySelector(':scope > .warning-note');
+    return {
+        layout: [...layout.children].map(name),
+        columns: { ...css(columns, 'display', 'gridTemplateColumns', 'columnGap'), box: box(columns) },
+        surfaces: surfaces.map(surface => ({ tree: [...surface.children].map(name), heading: text(surface.querySelector(':scope > h2')),
+            intro: text(surface.querySelector(':scope > p:not(.small)')), box: box(surface),
+            actions: [...surface.querySelectorAll(':scope > .row-actions')].map(group => ({ tree: [...group.children].map(name),
+                ...css(group, 'display', 'columnGap', 'flexWrap', 'marginTop'),
+                buttons: [...group.children].map(button) })) })),
+        status: { text: text(status), ...css(status, 'fontSize', 'color', 'marginTop') },
+        surface: css(surfaces[0], 'paddingTop', 'paddingLeft', 'backgroundColor', 'borderTopWidth', 'borderTopColor', 'borderTopLeftRadius'),
+        h2: css(surfaces[0].querySelector('h2'), 'fontSize', 'fontWeight', 'color', 'marginBottom'),
+        intro: css(surfaces[0].querySelector(':scope > p'), 'fontSize', 'color', 'lineHeight'),
+        // Its place below the columns (the concept's `.surface + .surface` 18px), whatever the columns' height.
+        policy: { tree: [...policy.children].map(name), heading: text(policy.querySelector(':scope > h2')),
+            box: { left: box(policy).left, width: box(policy).width,
+                gap: Math.round(policy.getBoundingClientRect().top - columns.getBoundingClientRect().bottom) },
+            chip: { text: text(chip), className: chip.className, ...css(chip, 'color', 'fontSize', 'borderTopColor', 'backgroundColor') },
+            rows: [...policy.querySelectorAll(':scope > .setting-row')].map(item => ({ tree: [...item.children].map(name),
+                text: [...item.firstElementChild.children].map(node => [name(node), text(node), node.localName === 'label' ? node.htmlFor : null]),
+                control: control(item) })),
+            warning: { text: text(warning), ...css(warning, 'fontSize', 'color', 'marginTop', 'marginBottom') } },
+        row: css(row, 'display', 'alignItems', 'justifyContent', 'columnGap', 'paddingTop', 'paddingBottom', 'borderTopWidth', 'borderTopColor',
+            'marginTop'),
+        label: css(row.querySelector('label'), 'fontSize', 'fontWeight', 'color'),
+        description: css(row.querySelector('p'), 'fontSize', 'color', 'marginTop', 'maxWidth'),
+        select: css(policy.querySelector('.setting-row > select'), 'fontSize', 'minWidth', 'maxWidth', 'backgroundColor', 'color',
+            'borderTopColor'),
+        pageScroll: document.documentElement.scrollWidth > document.documentElement.clientWidth,
+    };
+}
+
+const SCHEDULE_REASON = 'Daily and Weekly are not available yet: back up with Back up whenever you choose.';
+const SAFETY_DESCRIPTION = 'Keep a verified copy of the database on disk before maintenance, cleanups and LoRA imports change ' +
+    'records. A restore always keeps one.';
+
+/**
+ * D103: "Back up" (the concept's "Simulate backup"), the status line from /backup/status, "Export JSON" (its "Export
+ * sample JSON") and the two secondary exports in a second `.row-actions.spaced` with the concept's plain buttons.
+ * D104: the toggle's line says what the policy does, the schedule's reason replaces the prototype's proposal line,
+ * Daily and Weekly are disabled, and the warning note is truthful. The fixture has no backup yet.
+ */
+function mapBackupsConcept(reference) {
+    const [database, portable] = reference.surfaces;
+    const [backup, restore] = database.actions[0].buttons;
+    const [exportButton, importButton] = portable.actions[0].buttons;
+    const secondary = ['Export all prompts JSON', 'Export saved pairs JSON'].map(label => ({ ...exportButton, text: label }));
+    return {
+        ...reference,
+        surfaces: [
+            { ...database, actions: [{ ...database.actions[0], buttons: [{ ...backup, text: 'Back up' }, restore] }] },
+            { ...portable, tree: [...portable.tree, 'div.row-actions.spaced'],
+                actions: [{ ...portable.actions[0], buttons: [{ ...exportButton, text: 'Export JSON' }, importButton] },
+                    { ...portable.actions[0], tree: ['button', 'button'], buttons: secondary }] },
+        ],
+        status: { ...reference.status, text: 'No backup recorded.' },
+        policy: { ...reference.policy,
+            rows: reference.policy.rows.map(item => (item.control.kind !== 'select'
+                // D104 (M2): what the safety-backup policy really does.
+                ? { ...item, text: item.text.map(([node, value, target]) => [node, node === 'p' ? SAFETY_DESCRIPTION : value, target]) }
+                : { ...item,
+                    text: item.text.map(([node, value, target]) => [node, node === 'p' ? SCHEDULE_REASON : value, target]),
+                    control: { ...item.control, options: item.control.options.map(([label]) => [label, label !== 'Manual only']) } })),
+            warning: { ...reference.policy.warning, text: 'Restores are staged, migrated and validated before replacing live data.' } },
+    };
+}
+
+async function conceptBackups(page, theme) {
+    await openConcept(page, 'system', theme);
+    await page.locator('#main .section-nav').getByRole('button', { name: 'Backup & export', exact: true }).click();
+    await expect(page.locator('#main .settings-layout > .two-col > section.surface')).toHaveCount(2);
+    await page.mouse.move(0, 0);
+    return page.evaluate(measureBackups, '#main');
+}
+
+async function productionBackups(page, theme, status = 'No backup recorded.') {
+    await openProduction(page, 'system/backups', theme);
+    await expect(page.locator('#workspace-main .settings-layout > .two-col > section.surface')).toHaveCount(2);
+    // The status line and the policy row are their own reads: compare once both answered.
+    await expect(page.locator('#workspace-main #backup-status')).toHaveText(status);
+    await expect(page.locator('#workspace-main #backup-before')).toBeEnabled();
+    await page.mouse.move(0, 0);
+    return page.evaluate(measureBackups, '#workspace-main');
+}
+
+for (const theme of THEMES) for (const [width, height] of SIZES) {
+    test(`backup & export matches the concept ${theme} ${width}x${height}`, async ({ page }, testInfo) => {
+        await page.setViewportSize({ width, height });
+        const concept = await conceptBackups(page, theme);
+        await page.screenshot({ path: testInfo.outputPath(`concept-backups-${theme}-${width}.png`), fullPage: true });
+        const production = await productionBackups(page, theme);
+        await page.screenshot({ path: testInfo.outputPath(`production-backups-${theme}-${width}.png`), fullPage: true });
+        expect(diffInventory(mapBackupsConcept(concept), production)).toEqual([]);
+        expect(production.pageScroll).toBe(false);
+    });
+}
+
+/** Runs in the page: the open dialog's title, body tree, grid, note, backup box and actions with the concept's tokens. */
+function measureDialog() {
+    const dialog = document.querySelector('dialog#modal[open]');
+    const css = (node, ...keys) => node ? Object.fromEntries(keys.map(key => [key, getComputedStyle(node)[key]])) : null;
+    const name = node => [node.localName, ...[...node.classList].sort()].join('.');
+    const text = node => node?.textContent.trim() ?? null;
+    const body = dialog.querySelector('#modal-body');
+    const grid = body.querySelector(':scope > dl.meta-grid');
+    const note = body.querySelector(':scope > p.small');
+    const actions = body.querySelector(':scope > .dialog-actions');
+    const list = body.querySelector(':scope > .operation-list');
+    return {
+        title: text(dialog.querySelector('#modal-title')),
+        tree: [...body.children].map(name),
+        grid: grid && { rows: [...grid.children].map(row => [text(row.querySelector('dt')), text(row.querySelector('dd'))]),
+            ...css(grid, 'display', 'gridTemplateColumns', 'columnGap', 'rowGap'),
+            dt: css(grid.querySelector('dt'), 'fontSize', 'color', 'textTransform'), dd: css(grid.querySelector('dd'), 'fontSize', 'color') },
+        note: note && { text: text(note), ...css(note, 'fontSize', 'color') },
+        backup: body.querySelector(':scope > .notice') && { tree: [...body.querySelector(':scope > .notice').children].map(name),
+            text: [...body.querySelectorAll(':scope > .notice > div:first-child > *')].map(node => [node.localName, text(node)]),
+            buttons: [...body.querySelectorAll(':scope > .notice button')].map(text) },
+        list: list && { ...css(list, 'display', 'rowGap'),
+            rows: [...list.children].map(row => ({ tree: [...row.children].map(name), title: text(row.querySelector('h3')),
+                description: text(row.querySelector('p')), buttons: [...row.querySelectorAll('button')].map(text),
+                ...css(row, 'display', 'alignItems', 'paddingTop', 'borderTopColor') })) },
+        actions: actions && { tree: [...actions.children].map(name), ...css(actions, 'display', 'justifyContent', 'columnGap', 'marginTop'),
+            buttons: [...actions.children].map(item => ({ text: text(item), className: item.className,
+                ...css(item, 'backgroundColor', 'color', 'fontSize', 'paddingTop', 'paddingLeft', 'borderTopColor') })) },
+    };
+}
+
+const RESTORE_BACKUP_BOX = Object.freeze({ tree: ['div', 'div.row-actions'], text: [['h3', 'Back up the database first (recommended)'],
+    ['p', 'Downloads a copy of the prompts database before the restore replaces it.']], buttons: ['Back up now'] });
+
+/**
+ * D105: the server's review in the concept's "Restore preview": no sample note; the four rows with the review's values,
+ * then "In the backup" and "In the library now"; the hold line in the concept's dialog `p.small` (its Import dialog's
+ * intro, `small`); the D55 backup box before the actions; "Restore" (the concept's "Simulate restore", still danger).
+ */
+function mapRestoreConcept(reference, small, rows) {
+    const [cancel, restore] = reference.actions.buttons;
+    return {
+        ...reference,
+        tree: ['dl.meta-grid', 'p.small', 'div.notice', 'div.dialog-actions'],
+        grid: { ...reference.grid, rows },
+        note: { ...small, text: 'Restore replaces the whole library with this backup and runs alone in Activity. ' +
+            'Nothing changes until you restore. This review holds for 15 minutes.' },
+        backup: RESTORE_BACKUP_BOX,
+        actions: { ...reference.actions, buttons: [cancel, { ...restore, text: 'Restore' }] },
+    };
+}
+
+/** D15 and D55, as on Images: Rescan for "Scan an output folder", then "Scan for metadata"; no portable recipe import. */
+function mapImportConcept(reference) {
+    return { ...reference,
+        note: { ...reference.note, text: 'Image inspection and output scanning have different effects. Choose the workflow you want.' },
+        list: { ...reference.list, rows: reference.list.rows.filter(row => row.title !== 'Import portable recipes').flatMap(row =>
+            row.title === 'Scan an output folder'
+                ? [{ ...row, description: 'Find files added or removed in the output folders.', buttons: ['Rescan'] },
+                    { ...row, title: 'Scan for metadata' }] : [row]) } };
+}
+
+async function conceptDialog(page, theme, action, title) {
+    await conceptBackups(page, theme);
+    await page.locator(`#main .settings-layout [data-action="${action}"]`).click();
+    await expect(page.locator('dialog#modal[open] #modal-title')).toHaveText(title);
+    await page.mouse.move(0, 0);
+    return page.evaluate(measureDialog);
+}
+
+/** Production's restore review of a fresh backup of this server's library; the review's own answer too. */
+async function productionRestore(page, request, theme) {
+    const copy = await request.get('/prompt_manager/backup');
+    await expect(copy).toBeOK();
+    // That copy is this session's download now.
+    await productionBackups(page, theme, /^Downloaded backup · .+ · verified\.$/);
+    const chooser = page.waitForEvent('filechooser');
+    const answer = page.waitForResponse(response => response.url().endsWith(PREVIEW_URL));
+    await page.locator('#workspace-main').getByRole('button', { name: 'Review restore…', exact: true }).click();
+    await (await chooser).setFiles({ name: 'prompts_backup_20261025_093000.db', mimeType: 'application/octet-stream',
+        buffer: await copy.body() });
+    const preview = await (await answer).json();
+    await expect(page.locator('dialog#modal[open] #modal-title')).toHaveText('Restore preview');
+    await page.mouse.move(0, 0);
+    return { preview, production: await page.evaluate(measureDialog) };
+}
+
+const counts = summary => `${summary.prompts} ${summary.prompts === 1 ? 'prompt' : 'prompts'} · ${summary.image_links} ` +
+    `${summary.image_links === 1 ? 'image link' : 'image links'} · ${summary.pairs} ${summary.pairs === 1 ? 'saved pair' : 'saved pairs'}` +
+    ` · ${summary.runs} ${summary.runs === 1 ? 'run' : 'runs'}`;
+
+function restoreRows(preview, snapshot) {
+    return [['Snapshot', snapshot], ['Integrity', 'Verified'], ['Migration', 'Current schema'],
+        ['Safety backup', `Created before replacing (${preview.safety_backup.destination_label})`],
+        ['In the backup', counts(preview.summary)], ['In the library now', counts(preview.live)]];
+}
+
+for (const theme of THEMES) for (const [width, height] of SIZES) {
+    test(`restore preview and import dialogs match the concept ${theme} ${width}x${height}`, async ({ page, request }, testInfo) => {
+        await page.setViewportSize({ width, height });
+        // The concept's own dialog `p.small` (its Import dialog's intro) is the reference for the review's note.
+        const conceptImport = await conceptDialog(page, theme, 'import', 'Import & inspect');
+        await page.screenshot({ path: testInfo.outputPath(`concept-import-${theme}-${width}.png`) });
+        const conceptRestore = await conceptDialog(page, theme, 'restore', 'Restore preview');
+        expect(conceptRestore.tree).toEqual(['p.demo-note', 'dl.meta-grid', 'div.dialog-actions']);
+        await page.screenshot({ path: testInfo.outputPath(`concept-restore-${theme}-${width}.png`) });
+        const { preview, production } = await productionRestore(page, request, theme);
+        await page.screenshot({ path: testInfo.outputPath(`production-restore-${theme}-${width}.png`) });
+        const snapshot = production.grid.rows[0][1];
+        expect(snapshot).toMatch(/^prompts_backup_20261025_093000.db · (\d+ KB|\d+\.\d MB) · .+$/);
+        const { text: _intro, ...small } = conceptImport.note;
+        expect(diffInventory(mapRestoreConcept(conceptRestore, small, restoreRows(preview, snapshot)), production)).toEqual([]);
+        await page.keyboard.press('Escape');
+        await expect(page.locator('dialog#modal[open]')).toHaveCount(0);
+        await page.locator('#workspace-main').getByRole('button', { name: 'Import / inspect file', exact: true }).click();
+        await expect(page.locator('dialog#modal[open] #modal-title')).toHaveText('Import & inspect');
+        await page.mouse.move(0, 0);
+        await page.screenshot({ path: testInfo.outputPath(`production-import-${theme}-${width}.png`) });
+        expect(diffInventory(mapImportConcept(conceptImport), await page.evaluate(measureDialog))).toEqual([]);
+    });
+}
+
+test('backup & export comparison detects mutations', async ({ page, request }) => {
+    await page.setViewportSize({ width: 1600, height: 1100 });
+    const concept = await conceptBackups(page, 'dark');
+    const expected = mapBackupsConcept(concept);
+    await productionBackups(page, 'dark');
+    const measure = () => page.evaluate(measureBackups, '#workspace-main');
+    const paths = async () => diffInventory(expected, await measure()).map(item => item.path);
+    expect(await paths()).toEqual([]);
+    // Unmapped, the section differs exactly on the D103 and D104 paths (the added row's own paths, then the rest).
+    const unmapped = diffInventory(concept, await measure()).map(item => item.path).sort();
+    const added = 'surfaces.1.actions.1.';
+    expect(unmapped.some(path => path.startsWith(added))).toBe(true);
+    expect(unmapped.filter(path => !path.startsWith(added))).toEqual([
+        'policy.rows.0.text.1.1', 'policy.rows.1.control.options.1.1', 'policy.rows.1.control.options.2.1', 'policy.rows.1.text.1.1',
+        'policy.warning.text',
+        'status.text', 'surfaces.0.actions.0.buttons.0.text', 'surfaces.1.actions.0.buttons.0.text', 'surfaces.1.actions.length',
+        'surfaces.1.tree.3', 'surfaces.1.tree.length']);
+    // A renamed label, a removed row, a lost danger mark and a swapped token are noticed.
+    await page.evaluate(() => { document.querySelector('#workspace-main .setting-row label').textContent = 'Safety backup'; });
+    expect(await paths()).toEqual(['policy.rows.0.text.0.1']);
+    await page.evaluate(() => { document.querySelector('#workspace-main .setting-row label').textContent = 'Create a safety backup before maintenance'; });
+    const undoRow = await mutate(page, { remove: ['#workspace-main .settings-layout > section.surface > .setting-row:last-of-type'] });
+    expect(await paths()).toEqual(expect.arrayContaining(['policy.rows.length', 'policy.tree.length']));
+    await undoRow();
+    await page.evaluate(() => { document.querySelector('#workspace-main button.danger').classList.remove('danger'); });
+    expect(await paths()).toEqual(expect.arrayContaining(['surfaces.0.actions.0.buttons.1.className']));
+    await page.evaluate(() => { document.querySelector('#workspace-main .two-col .row-actions > button:nth-child(2)').classList.add('danger'); });
+    const undoToken = await mutate(page, { css: '#workspace-main .settings-layout { --line: rgb(255, 0, 0); }' });
+    expect(await paths()).toEqual(expect.arrayContaining(['row.borderTopColor']));
+    await undoToken();
+    const undoChip = await mutate(page, { css: '#workspace-main .chip.blue { color: rgb(255, 0, 0); }' });
+    expect(await paths()).toEqual(['policy.chip.color']);
+    await undoChip();
+    expect(await paths()).toEqual([]);
+
+    // The restore review: a renamed term, a lost danger mark and the grid's token are noticed.
+    const conceptImport = await conceptDialog(page, 'dark', 'import', 'Import & inspect');
+    const conceptRestore = await conceptDialog(page, 'dark', 'restore', 'Restore preview');
+    const { preview, production } = await productionRestore(page, request, 'dark');
+    const { text: _intro, ...small } = conceptImport.note;
+    const expectedRestore = mapRestoreConcept(conceptRestore, small, restoreRows(preview, production.grid.rows[0][1]));
+    const restorePaths = async () => diffInventory(expectedRestore, await page.evaluate(measureDialog)).map(item => item.path);
+    expect(await restorePaths()).toEqual([]);
+    await page.evaluate(() => { document.querySelector('dialog#modal[open] dl.meta-grid dt').textContent = 'Backup'; });
+    expect(await restorePaths()).toEqual(['grid.rows.0.0']);
+    await page.evaluate(() => { document.querySelector('dialog#modal[open] dl.meta-grid dt').textContent = 'Snapshot'; });
+    await page.evaluate(() => { document.querySelector('dialog#modal[open] .dialog-actions .danger').classList.remove('danger'); });
+    expect(await restorePaths()).toEqual(expect.arrayContaining(['actions.buttons.1.className']));
+    await page.evaluate(() => { document.querySelector('dialog#modal[open] .dialog-actions button:last-child').classList.add('danger'); });
+    const undoGrid = await mutate(page, { css: 'dialog#modal dl.meta-grid { column-gap: 3px; }' });
+    expect(await restorePaths()).toEqual(expect.arrayContaining(['grid.columnGap']));
+    await undoGrid();
+    expect(await restorePaths()).toEqual([]);
+});
@@ -172,8 +172,8 @@ function mapOverviewConcept(reference, overview) {
        // D93: the real pending count; Review metadata opens Needs review (the concept's go-review).
        '3 ambiguous image links': row => ({ ...row,
            title: `${number(overview.needs_review.pending)} ambiguous image link${overview.needs_review.pending === 1 ? '' : 's'}` }),
-        // D93: no backup has been recorded (verified backups arrive with S8).
-        'Backup status': row => ({ ...row, description: 'No retained backup record.' }),
+        // D93 (S9): what GET /backup/status reports; the fixture has no backup yet.
+        'Backup status': row => ({ ...row, description: 'No backup recorded.' }),
        // D93: there is no paging, so the shared settings are grid and density.
        'One display configuration': row => ({ ...row, description: 'Grid and density settings are shared across views.' }),
        // D93: the real sources, not samples.
@@ -181,6 +181,17 @@ function mapOverviewConcept(reference, overview) {
        // D96: the dialog shows runs and ratings by category and library totals, not prompt, tag or date usage.
        Statistics: row => ({ ...row, description: 'Runs and ratings by category, with library totals.' }),
    };
+    const surfaces = reference.columns.surfaces.map(surface => ({ ...surface,
+        rows: surface.rows.map(row => (rows[row.title] ?? (value => value))(row)) }));
+    // D129: "Library location" after Backup status, in the backup row's own markup; the fixture's database is configured
+    // explicitly (config.json), so it does not move and its action is Details.
+    const [health] = surfaces;
+    const backup = health.rows.find(row => row.title === 'Backup status');
+    const location = { ...backup, title: 'Library location',
+        description: `${overview.location.path} · The database path set in config.json.`,
+        action: { ...backup.action, text: 'Details' } };
+    surfaces[0] = { ...health, tree: [...health.tree, 'div.operation'],
+        rows: [...health.rows.slice(0, 2), location, ...health.rows.slice(2)] };
    return {
        ...reference,
        // D92: no "Sample configuration" chip.
@@ -188,8 +199,7 @@ function mapOverviewConcept(reference, overview) {
        // D122: the concept's literal label is its prototype action name ("system-tab sections").
        nav: { ...reference.nav, label: 'System sections' },
        metrics: { ...reference.metrics, items: reference.metrics.items.map(item => ({ ...item, value: relabel[item.label] })) },
-        columns: { ...reference.columns, surfaces: reference.columns.surfaces.map(surface => ({ ...surface,
-            rows: surface.rows.map(row => (rows[row.title] ?? (value => value))(row)) })) },
+        columns: { ...reference.columns, surfaces },
        save: { ...reference.save,
            // D92: truthful status copy, and "Save preferences" is aria-disabled (dimmed) while nothing is unsaved.
            status: { ...reference.save.status, text: 'No unsaved changes.' },
@@ -209,6 +219,9 @@ async function productionOverview(page, theme) {
    await expect(page.locator('#workspace-main .summary-metrics')).toBeVisible();
    // The thumbnail row is its own read (I2): compare once it answered.
    await expect(page.locator('#workspace-main .operation h3').filter({ hasText: 'thumbnails' })).toHaveText('No missing thumbnails');
+    // So is the backup row (S9).
+    await expect(page.locator('#workspace-main .operation').filter({ has: page.locator('h3', { hasText: 'Backup status' }) })
+        .locator('p')).toHaveText('No backup recorded.');
    await page.mouse.move(0, 0);
    return page.evaluate(measureSystem, '#workspace-main');
 }
@@ -232,13 +245,21 @@ for (const theme of THEMES) for (const [width, height] of SIZES) {

 // The recorded differences, by path: D93 the review row (its real count), the backup row, the
 // preferences row and the sources row, and metric 4; D96 the statistics row; D92 the chip, the status and the dimmed
-// Save; D122 the nav label. (The fixture's first three metrics are the concept's own counts.)
+// Save; D122 the nav label; D129 the inserted "Library location" row, which shifts the thumbnail row to the fourth place
+// (row 2 takes its title, text and action; row 3 and the surface's fifth child are new). (The fixture's first three
+// metrics are the concept's own counts.)
+const D129_ROW_ACTION = ['backgroundColor', 'borderTopColor', 'borderTopLeftRadius', 'borderTopWidth', 'className', 'color',
+    'cursor', 'fontSize', 'opacity', 'paddingLeft', 'paddingTop', 'text'].map(key => `columns.surfaces.0.rows.3.action.${key}`);
 const UNMAPPED_PATHS = [
    'columns.surfaces.0.rows.0.title', 'columns.surfaces.0.rows.1.description',
+    'columns.surfaces.0.rows.2.action.text', 'columns.surfaces.0.rows.2.description', 'columns.surfaces.0.rows.2.title',
+    ...D129_ROW_ACTION, 'columns.surfaces.0.rows.3.description', 'columns.surfaces.0.rows.3.title',
+    'columns.surfaces.0.rows.3.tree.0', 'columns.surfaces.0.rows.3.tree.1', 'columns.surfaces.0.rows.3.tree.length',
+    'columns.surfaces.0.rows.length', 'columns.surfaces.0.tree.4', 'columns.surfaces.0.tree.length',
    'columns.surfaces.1.rows.0.description', 'columns.surfaces.1.rows.1.title', 'columns.surfaces.1.rows.2.description',
    'heading.actions.0', 'heading.actions.length', 'metrics.items.3.value', 'nav.label',
    'save.button.cursor', 'save.button.opacity', 'save.status.text',
-];
+].sort();

 test('system comparison detects mutations', async ({ page, request }) => {
    await page.setViewportSize({ width: 1600, height: 1100 });
@@ -464,6 +485,8 @@ function mapAppearanceConcept(reference, settings) {
        control: { ...toggleRow.control, id, checked } }));
    return {
        ...reference,
+        // #317: the server's thumbnail settings follow in their own surface ("Thumbnails", README: retained in Appearance).
+        layout: [reference.layout[0], 'section.surface', ...reference.layout.slice(1)],
        // D97: two added toggles and the "Reset display defaults" operation close the surface.
        surface: { ...reference.surface, tree: [...reference.surface.tree, 'div.setting-row', 'div.setting-row', 'div.operation'] },
        rows: [...reference.rows.map(row => row.control?.id === 'timeout'
@@ -512,7 +535,8 @@ test('appearance comparison detects mutations', async ({ page, request }) => {
    // Unmapped, the concept differs only where D97 and the real timeout are recorded.
    expect(diffInventory(concept, production).map(item => item.path.split('.').slice(0, 2).join('.'))
        .filter((path, index, all) => all.indexOf(path) === index).sort())
-        .toEqual(['operations.0', 'operations.length', 'rows.11', 'rows.12', 'rows.13', 'rows.length', 'surface.tree'].sort());
+        .toEqual(['layout.1', 'layout.2', 'layout.length', 'operations.0', 'operations.length', 'rows.11', 'rows.12', 'rows.13',
+            'rows.length', 'surface.tree'].sort());
    const measure = () => page.evaluate(measureAppearance, '#workspace-main');
    const paths = async () => diffInventory(expected, await measure()).map(item => item.path);
    // A removed row.
@@ -824,13 +848,16 @@ function measureThumbnailReview() {

 /**
 * D99: the planned counts line (`p.small[role=status]`) before the actions, from the server's plan for the chosen
- * options, and the primary "Start" (the concept's "Simulate thumbnail job").
+ * options, and the primary "Start" (the concept's "Simulate thumbnail job"). D131 (#317): the Quality and Preview size
+ * limit fields give way to a second `p.small` naming the server's thumbnail settings, and Scope gains "Convert
+ * outdated (removes older formats)".
 */
 function mapThumbnailConcept(reference, plan) {
    const [cancel, start] = reference.actions.buttons;
-    const tree = [...reference.tree];
-    tree.splice(tree.indexOf('div.dialog-actions'), 0, 'p.small');
-    return { ...reference, tree,
+    const [scope] = reference.fields;
+    const tree = ['div.field', 'p.small', 'p.small', 'div.dialog-actions'];
+    const fields = [{ ...scope, control: { ...scope.control, options: [...scope.control.options, 'Convert outdated (removes older formats)'] } }];
+    return { ...reference, tree, fields,
        plan: { ...reference.plan, role: 'status',
            text: `${number(plan.targets)} ${plan.targets === 1 ? 'preview' : 'previews'} to generate · ${number(plan.fresh)} already up to date.` },
        actions: { ...reference.actions, buttons: [cancel, { ...start, text: 'Start' }] } };
@@ -856,12 +883,12 @@ async function productionThumbnailReview(page, theme, entry) {
        await page.locator('#workspace-main').getByRole('button', { name: 'Review thumbnails', exact: true }).click();
    }
    await expect(page.locator('dialog#modal[open] #modal-title')).toHaveText('Thumbnail maintenance');
-    await expect(page.locator('dialog#modal[open] #modal-body > p.small')).toHaveText(/ already up to date\.$/);
+    await expect(page.locator('dialog#modal[open] #modal-body > p.small').first()).toHaveText(/ already up to date\.$/);
    await page.mouse.move(0, 0);
    return page.evaluate(measureThumbnailReview);
 }

-const thumbnailPlan = request => serverJson(request, '/prompt_manager/images/thumbnails/plan?mode=missing&size=512&quality=medium');
+const thumbnailPlan = request => serverJson(request, '/prompt_manager/images/thumbnails/plan?mode=missing');

 for (const entry of ['sources', 'overview']) for (const theme of THEMES) for (const [width, height] of SIZES) {
    test(`thumbnail dialog matches the concept from ${entry} ${theme} ${width}x${height}`, async ({ page, request }, testInfo) => {
@@ -884,22 +911,106 @@ test('thumbnail dialog comparison detects mutations', async ({ page, request })
    const expected = mapThumbnailConcept(concept, plan);
    const production = await productionThumbnailReview(page, 'dark', 'sources');
    expect(diffInventory(expected, production)).toEqual([]);
-    // Unmapped, the concept differs only where D99 is recorded.
-    expect(diffInventory(concept, production).map(item => item.path).sort())
-        .toEqual(['actions.buttons.1.text', 'plan.role', 'plan.text', 'tree.3', 'tree.4', 'tree.length']);
+    // Unmapped, the concept differs only where D99 and D131 are recorded.
+    expect(diffInventory(concept, production).map(item => item.path.split('.').slice(0, 2).join('.'))
+        .filter((path, index, all) => all.indexOf(path) === index).sort())
+        .toEqual(['actions.buttons', 'fields.0', 'fields.1', 'fields.2', 'fields.length', 'plan.role', 'plan.text', 'tree.1', 'tree.2']
+            .sort());
    const paths = async () => diffInventory(expected, await page.evaluate(measureThumbnailReview)).map(item => item.path);
    // A changed option label, a swapped option order, a swapped action order and a changed style.
-    await page.evaluate(() => { document.querySelector('#thumb-quality option').textContent = 'Medium'; });
-    expect(await paths()).toEqual(['fields.1.control.options.0']);
-    await page.evaluate(() => { document.querySelector('#thumb-quality option').textContent = 'Medium · optimized'; });
+    await page.evaluate(() => { document.querySelector('#thumb-mode option').textContent = 'Missing only'; });
+    expect(await paths()).toEqual(['fields.0.control.options.0']);
+    await page.evaluate(() => { document.querySelector('#thumb-mode option').textContent = 'Missing thumbnails only'; });
    await page.evaluate(() => { const select = document.querySelector('#thumb-mode'); select.prepend(select.lastElementChild); });
    expect(await paths()).toEqual(expect.arrayContaining(['fields.0.control.options.0', 'fields.0.control.options.1']));
-    await page.evaluate(() => { const select = document.querySelector('#thumb-mode'); select.prepend(select.lastElementChild); select.selectedIndex = 0; });
+    await page.evaluate(() => { const select = document.querySelector('#thumb-mode'); select.append(select.firstElementChild); select.selectedIndex = 0; });
    await page.evaluate(() => { const actions = document.querySelector('dialog#modal[open] .dialog-actions'); actions.prepend(actions.lastElementChild); });
    expect(await paths()).toEqual(expect.arrayContaining(['actions.buttons.0.text', 'actions.buttons.1.text']));
    await page.evaluate(() => { const actions = document.querySelector('dialog#modal[open] .dialog-actions'); actions.prepend(actions.lastElementChild); });
-    const undoStyle = await mutate(page, { css: 'dialog#modal #thumb-limit { border-color: rgb(255, 0, 0); } dialog#modal #modal-body > p.small { color: rgb(255, 0, 0); }' });
-    expect(await paths()).toEqual(expect.arrayContaining(['fields.2.control.borderTopColor', 'plan.color']));
+    const undoStyle = await mutate(page, { css: 'dialog#modal #thumb-mode { border-color: rgb(255, 0, 0); } dialog#modal #modal-body > p.small { color: rgb(255, 0, 0); }' });
+    expect(await paths()).toEqual(expect.arrayContaining(['fields.0.control.borderTopColor', 'plan.color']));
    await undoStyle();
    expect(diffInventory(expected, await page.evaluate(measureThumbnailReview))).toEqual([]);
 });
+
+/**
+ * Runs in the page: one `.notice` (the concept's markup: `div > h2 + p`, then `.row-actions` buttons) with its tokens and
+ * geometry, and its left edge against `edgeSelector` (the content it lines up with).
+ */
+function measureNoticeOf([selector, edgeSelector]) {
+    const notice = document.querySelector(selector);
+    const css = (node, ...keys) => node ? Object.fromEntries(keys.map(key => [key, getComputedStyle(node)[key]])) : null;
+    const name = node => [node.localName, ...[...node.classList].sort()].join('.');
+    const text = node => node?.textContent.trim() ?? null;
+    const button = node => ({ text: text(node), className: node.className,
+        ...css(node, 'backgroundColor', 'color', 'fontSize', 'paddingTop', 'paddingLeft', 'borderTopColor', 'borderTopLeftRadius') });
+    const edge = document.querySelector(edgeSelector);
+    return {
+        tree: [...notice.children].map(name),
+        text: [...notice.querySelectorAll(':scope > div:not(.row-actions) > *')].map(node => [node.localName, text(node)]),
+        actions: [...notice.querySelectorAll(':scope > .row-actions > button')].map(button),
+        frame: css(notice, 'display', 'alignItems', 'justifyContent', 'columnGap', 'borderTopWidth', 'borderTopColor',
+            'borderTopLeftRadius', 'backgroundColor', 'paddingTop', 'paddingLeft', 'marginBottom', 'flexDirection'),
+        h2: css(notice.querySelector('h2'), 'fontSize', 'fontWeight', 'color'),
+        p: css(notice.querySelector('p'), 'fontSize', 'color', 'marginTop'),
+        rowActions: css(notice.querySelector(':scope > .row-actions'), 'display', 'columnGap', 'flexShrink'),
+        alignedWith: Math.round(notice.getBoundingClientRect().left - edge.getBoundingClientRect().left),
+        pageScroll: document.documentElement.scrollWidth > document.documentElement.clientWidth,
+    };
+}
+
+/** D129: the concept's Sources notice as the library notice: its own copy and actions, no bottom margin (main's padding). */
+function mapLibraryNotice(reference) {
+    return {
+        ...reference,
+        text: [['h2', 'Your library is inside the node folder'], ['p', 'Your library is stored inside the node folder, where an '
+            + 'update or reinstall can delete it. Move it to ComfyUI\'s user folder: it is copied and verified first, and nothing '
+            + 'is deleted.']],
+        actions: reference.actions.map((action, index) => ({ ...action, text: ['Keep it here', 'Move library'][index] })),
+        frame: { ...reference.frame, marginBottom: '0px' },
+    };
+}
+
+async function conceptNotice(page, theme) {
+    await openConcept(page, 'system', theme);
+    await page.locator('#main .section-nav').getByRole('button', { name: 'Sources & scans', exact: true }).click();
+    await expect(page.locator('#main .settings-layout > .notice')).toBeVisible();
+    await page.mouse.move(0, 0);
+    return page.evaluate(measureNoticeOf, ['#main .settings-layout > .notice', '#main .heading']);
+}
+
+async function productionNotice(page, theme) {
+    await openProduction(page, 'system/overview', theme);
+    await expect(page.locator('#library-banner > .notice')).toBeVisible();
+    await expect(page.locator('#workspace-main .summary-metrics')).toBeVisible();
+    await page.mouse.move(0, 0);
+    return page.evaluate(measureNoticeOf, ['#library-banner > .notice', '#workspace-main .heading']);
+}
+
+for (const theme of THEMES) for (const [width, height] of SIZES) {
+    test(`library notice matches the concept notice ${theme} ${width}x${height}`, async ({ page, request }, testInfo) => {
+        await page.setViewportSize({ width, height });
+        await expect(await request.post('/__test__/system/library', { data: { state: 'node_folder' } })).toBeOK();
+        const concept = await conceptNotice(page, theme);
+        const production = await productionNotice(page, theme);
+        await page.screenshot({ path: testInfo.outputPath(`production-library-notice-${theme}-${width}.png`), fullPage: true });
+        expect(diffInventory(mapLibraryNotice(concept), production)).toEqual([]);
+        expect(production.alignedWith).toBe(0);
+        expect(production.pageScroll).toBe(false);
+    });
+}
+
+test('library notice comparison detects mutations', async ({ page, request }) => {
+    await page.setViewportSize({ width: 1600, height: 1100 });
+    await expect(await request.post('/__test__/system/library', { data: { state: 'node_folder' } })).toBeOK();
+    const expected = mapLibraryNotice(await conceptNotice(page, 'dark'));
+    await productionNotice(page, 'dark');
+    const paths = async () => diffInventory(expected,
+        await page.evaluate(measureNoticeOf, ['#library-banner > .notice', '#workspace-main .heading'])).map(item => item.path);
+    expect(await paths()).toEqual([]);
+    const undoToken = await mutate(page, { css: '#library-banner { --soft-blue: rgb(255, 0, 0); }' });
+    expect(await paths()).toEqual(['frame.backgroundColor']);
+    await undoToken();
+    await page.evaluate(() => { document.querySelector('#library-banner .notice h2').textContent = 'Library'; });
+    expect(await paths()).toEqual(['text.0.1']);
+});
@@ -0,0 +1,396 @@
+import { startCoverage, saveCoverage } from '../../tools/vendor/browser-coverage.mjs';
+import { test, expect } from './fixtures.mjs';
+import { SIZES, THEMES, seedConcept, openConcept, openProduction, diffInventory, mutate, measureReview, mapPlanConcept }
+    from './concept-inventory.mjs';
+
+// #249 System S12 Task 7 (#329): System › Diagnostics & logs (app.js renderSystem 694–695) and its log cleanup review
+// (the concept's `maintenancePlan("rotated logs")`, 953–958) against the immutable concept, on the concept-shaped
+// fixture with the logger writing into this server's own root and seeded with the concept's sample (four lines, a
+// 1.4 MB active log, three rotated copies, console logging off). Each concept measurement is mapped only by the recorded
+// deviations (D109, D110, and D100 for the review), each commented where it applies; after that the difference must be
+// empty, and a removed term, a renamed button, a reordered option, a primary Refresh, a squeezed select or a swapped
+// token must be noticed.
+test.use({ locale: 'en-US', timezoneId: 'UTC' });
+
+test.beforeEach(async ({ page, request, browserName }) => {
+    await startCoverage(page, browserName);
+    await seedConcept(request);
+    await expect(await request.post('/__test__/system/reset')).toBeOK();
+    await expect(await request.post('/__test__/jobs/restart')).toBeOK();
+    await expect(await request.post('/__test__/logs/reset')).toBeOK();
+    await expect(await request.post('/__test__/logs/seed', { data: { mode: 'concept' } })).toBeOK();
+    page.conceptErrors = [];
+    page.on('pageerror', error => page.conceptErrors.push(error.message));
+});
+
+test.afterEach(async ({ page, request, browserName }) => {
+    await saveCoverage(page, browserName);
+    await request.post('/__test__/jobs/restart');
+    await request.post('/__test__/logs/reset');
+    await request.post('/__test__/system/reset');
+    expect(page.conceptErrors).toEqual([]);
+});
+
+const REPORT_URL = '/prompt_manager/system/diagnostics';
+const PREVIEW_URL = '/prompt_manager/maintenance/preview';
+const LINE_FORMAT = /^\d\d:\d\d:\d\d [A-Z]+ +\S/;
+
+/** Runs in the page: Diagnostics & logs under `mainSelector`: every surface's text, controls, geometry and tokens. */
+function measureDiagnostics([mainSelector, lineFormat]) {
+    const format = new RegExp(lineFormat);
+    const layout = document.querySelector(`${mainSelector} .settings-layout`);
+    const css = (node, ...keys) => node ? Object.fromEntries(keys.map(key => [key, getComputedStyle(node)[key]])) : null;
+    const tokens = (node, ...names) => Object.fromEntries(names.map(key => [key, getComputedStyle(node).getPropertyValue(key).trim()]));
+    const name = node => [node.localName, ...[...node.classList].sort()].join('.');
+    const text = node => node?.textContent.trim() ?? null;
+    const button = node => ({ text: text(node), className: node.className });
+    const control = row => {
+        const select = row.querySelector(':scope > select');
+        if (select) return { kind: 'select', id: select.id, options: [...select.options].map(option => option.textContent),
+            selected: select.selectedOptions[0]?.textContent ?? null, disabled: select.disabled };
+        const toggle = row.querySelector(':scope > * input[type="checkbox"]');
+        return toggle ? { kind: 'switch', id: toggle.id, wrapper: name(toggle.parentElement), checked: toggle.checked,
+            disabled: toggle.disabled } : null;
+    };
+    const operations = parent => [...parent.querySelectorAll(':scope > .operation')].map(row => ({ tree: [...row.children].map(name),
+        title: text(row.querySelector('h3')), description: text(row.querySelector('p')),
+        actions: [...row.querySelectorAll('.row-actions > button')].map(button) }));
+    const toolbarItem = node => ({ name: name(node), text: node.localName === 'select' || node.localName === 'input' ? null : text(node),
+        for: node.localName === 'label' ? node.htmlFor : null, id: node.id || null,
+        options: node.localName === 'select' ? [...node.options].map(option => option.textContent) : null,
+        // The chosen option, so a wrong default level is noticed.
+        selected: node.localName === 'select' ? node.selectedOptions[0]?.textContent ?? null : null,
+        input: node.localName === 'input' ? [node.type, node.min, node.max, node.value] : null,
+        className: node.localName === 'button' ? node.className : null });
+    const surfaces = [...layout.querySelectorAll(':scope > section.surface')];
+    const pre = layout.querySelector('pre');
+    const lines = (pre?.textContent ?? '').split('\n').filter(Boolean);
+    const details = layout.querySelector('details');
+    const firstRow = layout.querySelector('.setting-row');
+    const toolbar = layout.querySelector('.toolbar');
+    return {
+        layout: [...layout.children].map(name),
+        surfaces: surfaces.map(surface => {
+            const heading = surface.querySelector(':scope > .panel-heading');
+            const grid = surface.querySelector(':scope > .meta-grid');
+            return {
+                tree: [...surface.children].map(name),
+                heading: text(surface.querySelector(':scope > h2, :scope > .panel-heading > h2')),
+                panelHeading: heading && [...heading.children].map(node => [name(node), text(node)]),
+                grid: grid && [...grid.children].map(entry => [name(entry), text(entry.querySelector('dt')), text(entry.querySelector('dd'))]),
+                buttons: [...surface.querySelectorAll(':scope > button')].map(button),
+                toolbar: surface.querySelector(':scope > .toolbar') && [...surface.querySelector(':scope > .toolbar').children].map(toolbarItem),
+                pre: surface.querySelector(':scope > pre') && { tabIndex: pre.tabIndex, tree: [...pre.children].map(name), lines,
+                    format: lines.every(line => format.test(line)) },
+                notes: [...surface.querySelectorAll(':scope > p')].map(node => [name(node), text(node), node.getAttribute('role'),
+                    node.getAttribute('aria-label')]),
+                rows: [...surface.querySelectorAll(':scope > .setting-row')].map(row => ({ tree: [...row.children].map(name),
+                    text: [...row.firstElementChild.children].map(node => [name(node), text(node), node.localName === 'label' ? node.htmlFor : null]),
+                    control: control(row) })),
+                details: surface.querySelector(':scope > details') && {
+                    summary: text(details.querySelector(':scope > summary')), tree: [...details.children].map(name),
+                    notes: [...details.querySelectorAll(':scope > p')].map(node => [name(node), text(node)]),
+                    buttons: [...details.querySelectorAll(':scope > button')].map(button),
+                    files: [...details.querySelectorAll(':scope > .operation-list > .operation')].map(row => ({
+                        title: text(row.querySelector('h3')), detail: text(row.querySelector('p')), actions: [...row.querySelectorAll('.row-actions > button')].map(item =>
+                            [text(item), item.getAttribute('aria-label')]) })),
+                    operations: operations(details) },
+                operations: operations(surface),
+            };
+        }),
+        tokens: tokens(surfaces[0], '--line', '--panel', '--accent'),
+        surface: css(surfaces[1], 'paddingTop', 'paddingLeft', 'backgroundColor', 'borderTopWidth', 'borderTopColor', 'borderTopLeftRadius',
+            'marginTop'),
+        grid: css(layout.querySelector('.meta-grid'), 'display', 'gridTemplateColumns', 'columnGap', 'rowGap'),
+        toolbar: css(toolbar, 'display', 'flexWrap', 'alignItems', 'columnGap', 'rowGap', 'marginBottom'),
+        pre: css(pre, 'fontFamily', 'fontSize', 'backgroundColor', 'borderTopColor', 'borderTopLeftRadius', 'paddingTop', 'overflowX'),
+        row: css(firstRow, 'display', 'alignItems', 'justifyContent', 'columnGap', 'paddingTop', 'paddingBottom', 'borderTopWidth',
+            'borderTopColor'),
+        label: css(firstRow.querySelector('label'), 'fontSize', 'fontWeight', 'color'),
+        description: css(firstRow.querySelector('p'), 'fontSize', 'color', 'marginTop'),
+        select: css(firstRow.querySelector('select'), 'fontSize', 'minWidth', 'maxWidth', 'backgroundColor', 'color', 'borderTopColor'),
+        summary: css(details.querySelector('summary'), 'fontSize', 'fontWeight', 'color', 'cursor'),
+        small: css(details.querySelector(':scope > p.small'), 'fontSize', 'color'),
+        // Whether each select is as wide as the browser lays out a copy holding only its chosen option, i.e. it shows
+        // that option whole (the browser's own select sizing, arrow included).
+        selectsFit: [...layout.querySelectorAll('select')].map(select => {
+            const copy = select.cloneNode(false);
+            copy.removeAttribute('id');
+            copy.append(new Option(select.selectedOptions[0]?.textContent ?? ''));
+            Object.assign(copy.style, { position: 'absolute', visibility: 'hidden', width: 'max-content', minWidth: '0',
+                maxWidth: 'none', flex: 'none' });
+            select.parentElement.append(copy);
+            const needed = copy.getBoundingClientRect().width;
+            copy.remove();
+            return select.getBoundingClientRect().width + 0.5 >= needed;
+        }),
+        pageScroll: document.documentElement.scrollWidth > document.documentElement.clientWidth,
+    };
+}
+
+const plural = (count, one, many = `${one}s`) => `${count.toLocaleString('en-US')} ${count === 1 ? one : many}`;
+/** The server's size label (1 KB = 1024 bytes), as the section prints it. */
+function sizeText(bytes) {
+    if (bytes < 1024) return plural(bytes, 'byte');
+    if (bytes < 2 ** 20) return `${(bytes / 2 ** 10).toFixed(1)} KB`;
+    if (bytes < 2 ** 30) return `${(bytes / 2 ** 20).toFixed(1)} MB`;
+    return `${(bytes / 2 ** 30).toFixed(1)} GB`;
+}
+
+const KINDS = Object.freeze({ active: 'Active log', rotated: 'Rotated copy', other: 'Other file' });
+const RENDERER_NONE = 'No ComfyUI window is open in this browser, so its renderer is not known.';
+const COPY = Object.freeze({
+    testLink: 'Write a placeholder image record to check that linking works.',
+    runtimeLevel: 'How much the server writes to the log. Applied until the server restarts.',
+    console: 'Print Prompt Manager’s warnings and errors in the ComfyUI console (everything at DEBUG). Applied until the server restarts.',
+    clear: 'Empty the active log and delete its rotated copies.',
+    retention: 'Rotates at 10 MB · keeps 5 rotated copies · file logging on · memory buffer 1,000 entries',
+});
+
+/**
+ * The concept's Diagnostics & logs with the recorded deviations applied, for the server's `report` and the seeded
+ * `files` (`/logs/files`). The concept's own sample values the fixture reproduces stay as they are: the four log lines,
+ * the Viewer.js line, "prompt_manager.log · 1.4 MB · rotated copies: 3", INFO and console logging off.
+ */
+function mapDiagnosticsConcept(reference, { report, files, stats }) {
+    const [diagnostics, logs] = reference.surfaces;
+    const [levelLabel, level, refresh, download] = logs.toolbar;
+    const [runtime, consoleRow] = logs.rows;
+    const database = report.checks.database;
+    const { configured, watching, unavailable } = report.sources;
+    const sources = configured === 0 ? `ComfyUI output folder · ${watching ? 'watching' : 'manual scan'}`
+        : unavailable > 0 ? `${plural(configured, 'source')} · ${unavailable} not available`
+            : `${plural(configured, 'source')} · ${watching} watching`;
+    const errors = (stats.level_counts.ERROR ?? 0) + (stats.level_counts.CRITICAL ?? 0);
+    return {
+        ...reference,
+        surfaces: [
+            { ...diagnostics,
+                // D110: the Test image link operation follows the concept's Image-link diagnostics.
+                tree: [...diagnostics.tree, 'div.operation'],
+                // D110: live values. Database and Sources from `GET /system/diagnostics`, Host renderers is D106's
+                // renderer line (no ComfyUI window in this browser); the pinned Viewer.js line is the concept's own.
+                grid: diagnostics.grid.map(([entry, term, value]) => [entry, term, {
+                    Database: `Readable · ${sizeText(report.database_info.database_size_bytes)} · ${plural(database.image_count, 'image')}`,
+                    Sources: sources,
+                    'Host renderers': RENDERER_NONE }[term] ?? value]),
+                // D110: the buttons drop the concept's "sample".
+                buttons: diagnostics.buttons.map(item => ({ ...item, text: item.text.replace('Download sample diagnostic report',
+                    'Download diagnostic report') })),
+                operations: [
+                    // D110: "Inspect" opens the read-only Inspect a file page.
+                    ...diagnostics.operations.map(row => ({ ...row, actions: row.actions.map(item => ({ ...item, text: 'Inspect' })) })),
+                    // D110: the legacy synthetic link (S12-11), enabled: the fixture has a most recent prompt.
+                    { ...diagnostics.operations[0], title: 'Test image link', description: COPY.testLink,
+                        actions: [{ ...diagnostics.operations[0].actions[0], text: 'Create test link…' }] },
+                ] },
+            { ...logs,
+                // D109: the statistics line follows the viewer.
+                tree: [logs.tree[0], logs.tree[1], logs.tree[2], 'p.small', ...logs.tree.slice(3)],
+                toolbar: [
+                    levelLabel,
+                    // D109: all six minimum levels (the concept has three).
+                    { ...level, options: ['All levels', 'DEBUG', 'INFO', 'WARNING', 'ERROR', 'CRITICAL'] },
+                    // D109: the added Lines control, 1–500, default 100.
+                    { name: 'label.small', text: 'Lines', for: 'log-limit', id: null, options: null, selected: null, input: null,
+                        className: null },
+                    { name: 'input', text: null, for: null, id: 'log-limit', options: null, selected: null,
+                        input: ['number', '1', '500', '100'], className: null },
+                    refresh,
+                    // D109: the active log, not a sample.
+                    { ...download, text: 'Download log' },
+                ],
+                // D109: "Log statistics" (errors are ERROR + CRITICAL).
+                notes: [['p.small', `${plural(stats.buffer_count, 'entry', 'entries')} in memory · ${plural(errors, 'error')} · `
+                    + `${plural(stats.level_counts.WARNING ?? 0, 'warning')} · ${plural(stats.log_files_count, 'file')} · `
+                    + `${sizeText(stats.total_log_size)} on disk`, 'status', 'Log statistics']],
+                rows: [
+                    // D109: CRITICAL after the concept's levels; the value lasts until the server restarts.
+                    { ...runtime, text: [runtime.text[0], ['p', COPY.runtimeLevel, null]],
+                        control: { ...runtime.control, options: [...runtime.control.options, 'CRITICAL'] } },
+                    // D109: what the console setting does and that it lasts until the server restarts (off, as the
+                    // concept's sample, by the fixture's seed).
+                    { ...consoleRow, text: [consoleRow.text[0], ['p', COPY.console, null]] },
+                ],
+                details: { ...logs.details,
+                    // D109: the retention line, the files and Clear all logs follow the concept's line and review.
+                    tree: [...logs.details.tree, 'p.small', 'div.operation-list', 'div.operation'],
+                    notes: [...logs.details.notes, ['p.small', COPY.retention]],
+                    files: files.map(row => ({ title: row.filename, detail: `${sizeText(row.size)} · ${row.modified.slice(0, 16)
+                        .replace('T', ' ')} · ${KINDS[row.kind]}`, actions: [['Download', `Download ${row.filename}`]] })),
+                    operations: [{ tree: ['div', 'div.row-actions'], title: 'Clear all logs', description: COPY.clear,
+                        actions: [{ text: 'Clear all logs…', className: 'danger' }] }] } },
+        ],
+    };
+}
+
+async function conceptDiagnostics(page, theme) {
+    await openConcept(page, 'system', theme);
+    await page.locator('#main .section-nav').getByRole('button', { name: 'Diagnostics & logs', exact: true }).click();
+    await expect(page.locator('#main .settings-layout > section.surface')).toHaveCount(2);
+    await page.mouse.move(0, 0);
+    return page.evaluate(measureDiagnostics, ['#main', LINE_FORMAT.source]);
+}
+
+/** Production's section once every read answered, with the server's report, files and statistics it shows. */
+async function productionDiagnostics(page, request, theme) {
+    await openProduction(page, 'system/diagnostics', theme);
+    const main = page.locator('#workspace-main');
+    await expect(main.locator('.settings-layout > section.surface')).toHaveCount(2);
+    await expect(main.locator('.meta-grid dd')).not.toContainText(['Loading…']);
+    await expect(main.locator('.meta-grid dd').last()).toHaveText(RENDERER_NONE);
+    await expect(main.locator('#log-lines')).not.toHaveText('Loading…');
+    await expect(main.locator('#log-stats')).not.toHaveText('Loading…');
+    await expect(main.locator('details > p.small')).not.toContainText(['Loading…']);
+    await expect(main.locator('#runtime-level')).toBeEnabled();
+    await expect(main.locator('.operation').filter({ hasText: 'Create test link…' }).locator('button')).not.toHaveAttribute('aria-disabled', 'true');
+    await page.mouse.move(0, 0);
+    const production = await page.evaluate(measureDiagnostics, ['#workspace-main', LINE_FORMAT.source]);
+    const read = async url => (await request.get(url)).json();
+    const report = await read(REPORT_URL);
+    const { files } = await read('/prompt_manager/logs/files');
+    const { stats } = await read('/prompt_manager/logs/stats');
+    return { production, report, files, stats };
+}
+
+for (const theme of THEMES) for (const [width, height] of SIZES) {
+    test(`diagnostics and logs match the concept ${theme} ${width}x${height}`, async ({ page, request }, testInfo) => {
+        await page.setViewportSize({ width, height });
+        const concept = await conceptDiagnostics(page, theme);
+        await page.screenshot({ path: testInfo.outputPath(`concept-diagnostics-${theme}-${width}.png`), fullPage: true });
+        const { production, ...live } = await productionDiagnostics(page, request, theme);
+        await page.screenshot({ path: testInfo.outputPath(`production-diagnostics-${theme}-${width}.png`), fullPage: true });
+        expect(diffInventory(mapDiagnosticsConcept(concept, live), production)).toEqual([]);
+        expect(production.surfaces[1].pre.format).toBe(true);
+        expect(production.pageScroll).toBe(false);
+    });
+}
+
+// Below the concept's smallest size: on a 320px phone the Level and Runtime log level selects still show their whole
+// option, without page scroll.
+for (const theme of THEMES) test(`diagnostics selects fit at 320 wide ${theme}`, async ({ page, request }) => {
+    await page.setViewportSize({ width: 320, height: 700 });
+    const { production } = await productionDiagnostics(page, request, theme);
+    expect(production.selectsFit).toEqual([true, true]);
+    expect(production.pageScroll).toBe(false);
+});
+
+/**
+ * D100 with D109's rule for this plan: the server's `rotated_logs` plan in the concept's dialog, "Rotated log copies"
+ * as its `h3`, the plan's grid values (its Backup row says none is needed), "Listed files (N)", the hold line, no D55
+ * backup box (nothing in the library changes) and "Apply reviewed operation".
+ */
+function mapCleanupConcept(reference, plan) {
+    const mapped = mapPlanConcept(reference, 'Rotated log copies', plan);
+    return {
+        ...mapped,
+        // D109: no backup box for a plan that changes no library record.
+        tree: mapped.tree.filter(item => item !== 'div.notice'),
+        grid: { ...mapped.grid, rows: mapped.grid.rows.map(([term, value]) =>
+            [term, term === 'Backup' ? 'Not needed: no library record changes' : value]) },
+        backup: null,
+        // D109: the plan lists files, not records.
+        details: { ...mapped.details, summary: `Listed files (${plan.details.length})` },
+    };
+}
+
+async function conceptCleanup(page, theme) {
+    await conceptDiagnostics(page, theme);
+    await page.locator('#main details > summary').click();
+    await page.locator('#main [data-plan="rotated logs"]').click();
+    await expect(page.locator('dialog#modal[open] #modal-title')).toHaveText('Review maintenance plan');
+    await page.mouse.move(0, 0);
+    return page.evaluate(measureReview);
+}
+
+async function productionCleanup(page, request, theme) {
+    await productionDiagnostics(page, request, theme);
+    await page.locator('#workspace-main details > summary').click();
+    const answer = page.waitForResponse(response => response.url().endsWith(PREVIEW_URL));
+    await page.locator('#workspace-main').getByRole('button', { name: 'Review log cleanup', exact: true }).click();
+    const plan = await (await answer).json();
+    await expect(page.locator('dialog#modal[open] #modal-body > h3')).toHaveText('Rotated log copies');
+    await page.mouse.move(0, 0);
+    return { plan, production: await page.evaluate(measureReview) };
+}
+
+for (const theme of THEMES) for (const [width, height] of SIZES) {
+    test(`log cleanup review matches the concept ${theme} ${width}x${height}`, async ({ page, request }, testInfo) => {
+        await page.setViewportSize({ width, height });
+        const concept = await conceptCleanup(page, theme);
+        expect(concept.heading.text).toBe('rotated logs');
+        expect(concept.tree).toEqual(['p.demo-note', 'h3', 'dl.meta-grid', 'p.small', 'div.dialog-actions']);
+        await page.screenshot({ path: testInfo.outputPath(`concept-log-cleanup-${theme}-${width}.png`) });
+        const { plan, production } = await productionCleanup(page, request, theme);
+        expect(plan.operation).toBe('rotated_logs');
+        await page.screenshot({ path: testInfo.outputPath(`production-log-cleanup-${theme}-${width}.png`) });
+        expect(diffInventory(mapCleanupConcept(concept, plan), production)).toEqual([]);
+    });
+}
+
+// Every path where production differs from the unmapped concept: D110's live values (Viewer.js is the concept's own),
+// renamed buttons and added operation, and D109's toolbar, statistics line, runtime rows and log files.
+const DEVIATED_PATHS = [
+    'surfaces.0.buttons.0', 'surfaces.0.grid.0', 'surfaces.0.grid.1', 'surfaces.0.grid.3', 'surfaces.0.operations.0',
+    'surfaces.0.operations.1', 'surfaces.0.operations.length', 'surfaces.0.tree.4', 'surfaces.0.tree.length',
+    'surfaces.1.details.files', 'surfaces.1.details.notes', 'surfaces.1.details.operations', 'surfaces.1.details.tree',
+    'surfaces.1.notes.0', 'surfaces.1.notes.length', 'surfaces.1.rows.0', 'surfaces.1.rows.1', 'surfaces.1.toolbar.1',
+    'surfaces.1.toolbar.2', 'surfaces.1.toolbar.3', 'surfaces.1.toolbar.4', 'surfaces.1.toolbar.5', 'surfaces.1.toolbar.length',
+    'surfaces.1.tree.3', 'surfaces.1.tree.5', 'surfaces.1.tree.6', 'surfaces.1.tree.length'].sort();
+
+test('diagnostics comparison detects mutations', async ({ page, request }) => {
+    await page.setViewportSize({ width: 1600, height: 1100 });
+    const concept = await conceptDiagnostics(page, 'dark');
+    const { production, ...live } = await productionDiagnostics(page, request, 'dark');
+    const expected = mapDiagnosticsConcept(concept, live);
+    expect(diffInventory(expected, production)).toEqual([]);
+    // Unmapped, the section differs only where D109 and D110 are recorded.
+    expect(diffInventory(concept, production).map(item => item.path.split('.').slice(0, 4).join('.'))
+        .filter((path, index, all) => all.indexOf(path) === index).sort()).toEqual(DEVIATED_PATHS);
+    const measure = () => page.evaluate(measureDiagnostics, ['#workspace-main', LINE_FORMAT.source]);
+    const paths = async () => diffInventory(expected, await measure()).map(item => item.path);
+    // A removed term.
+    const undoTerm = await mutate(page, { remove: ['#workspace-main .meta-grid > div:nth-child(2)'] });
+    expect(await paths()).toEqual(expect.arrayContaining(['surfaces.0.grid.length']));
+    await undoTerm();
+    // A renamed button.
+    await page.evaluate(() => { document.querySelector('#workspace-main section.surface > button').textContent = 'Download report'; });
+    expect(await paths()).toEqual(['surfaces.0.buttons.0.text']);
+    await page.evaluate(() => { document.querySelector('#workspace-main section.surface > button').textContent = 'Download diagnostic report'; });
+    // A reordered level option.
+    await page.evaluate(() => { const select = document.querySelector('#workspace-main #log-level'); select.append(select.options[1]); });
+    expect(await paths()).toEqual(expect.arrayContaining(['surfaces.1.toolbar.1.options.1']));
+    await page.evaluate(() => { const select = document.querySelector('#workspace-main #log-level'); select.insertBefore(select.options[5], select.options[1]); });
+    // A wrong default level.
+    await page.evaluate(() => { document.querySelector('#workspace-main #log-level').value = 'INFO'; });
+    expect(await paths()).toEqual(['surfaces.1.toolbar.1.selected']);
+    await page.evaluate(() => { document.querySelector('#workspace-main #log-level').value = ''; });
+    // A primary Refresh.
+    await page.evaluate(() => { document.querySelectorAll('#workspace-main .toolbar > button')[0].classList.add('ca-primary'); });
+    expect(await paths()).toEqual(expect.arrayContaining(['surfaces.1.toolbar.4.className']));
+    await page.evaluate(() => { document.querySelectorAll('#workspace-main .toolbar > button')[0].classList.remove('ca-primary'); });
+    // A select squeezed until its chosen option is cut.
+    const undoSqueeze = await mutate(page, { css: '#workspace-main #runtime-level { max-width: 30px !important; min-width: 0 !important; }' });
+    expect(await paths()).toEqual(expect.arrayContaining(['selectsFit.1']));
+    await undoSqueeze();
+    // A swapped token.
+    const undoToken = await mutate(page, { css: '#workspace-main .settings-layout { --line: rgb(255, 0, 0); }' });
+    expect(await paths()).toEqual(expect.arrayContaining(['tokens.--line', 'row.borderTopColor']));
+    await undoToken();
+    expect(diffInventory(expected, await measure())).toEqual([]);
+
+    // The log cleanup review: a changed grid term, a backup box that came back and a grid token are noticed.
+    const conceptReview = await conceptCleanup(page, 'dark');
+    const { plan } = await productionCleanup(page, request, 'dark');
+    const expectedReview = mapCleanupConcept(conceptReview, plan);
+    const reviewPaths = async () => diffInventory(expectedReview, await page.evaluate(measureReview)).map(item => item.path);
+    expect(await reviewPaths()).toEqual([]);
+    await page.evaluate(() => { document.querySelectorAll('dialog#modal[open] dl.meta-grid dt')[2].textContent = 'Safety'; });
+    expect(await reviewPaths()).toEqual(['grid.rows.2.0']);
+    await page.evaluate(() => { document.querySelectorAll('dialog#modal[open] dl.meta-grid dt')[2].textContent = 'Backup'; });
+    const undoGrid = await mutate(page, { css: 'dialog#modal dl.meta-grid { column-gap: 3px; }' });
+    expect(await reviewPaths()).toEqual(expect.arrayContaining(['grid.columnGap']));
+    await undoGrid();
+    expect(await reviewPaths()).toEqual([]);
+});
+
@@ -0,0 +1,344 @@
+import { startCoverage, saveCoverage } from '../../tools/vendor/browser-coverage.mjs';
+import { test, expect } from './fixtures.mjs';
+import { SIZES, THEMES, seedConcept, openConcept, openProduction, diffInventory, mutate } from './concept-inventory.mjs';
+
+// #249 System S10 Task 28: System › Integrations (app.js renderSystem 682–684) and the LoRA import review against the
+// immutable concept, on the concept-shaped fixture with a fake LoraManager install. Each concept measurement is mapped
+// only by the recorded deviations (D106, D107, D114), each commented where it applies; after that the difference must
+// be empty, and a mutated label, option, row or token must be noticed. The concept starts its sample import without a
+// review, so the import review is compared with the concept's own record-changing review, `maintenancePlan`
+// (953–958), whose shell, grid, note and actions it shares.
+test.use({ locale: 'en-US', timezoneId: 'UTC' });
+
+test.beforeEach(async ({ page, request, browserName }) => {
+    await startCoverage(page, browserName);
+    await seedConcept(request);
+    await expect(await request.post('/__test__/system/reset')).toBeOK();
+    await expect(await request.post('/__test__/integrations/reset')).toBeOK();
+    await expect(await request.post('/__test__/jobs/restart')).toBeOK();
+    page.conceptErrors = [];
+    page.on('pageerror', error => page.conceptErrors.push(error.message));
+});
+
+test.afterEach(async ({ page, request, browserName }) => {
+    await saveCoverage(page, browserName);
+    await request.post('/__test__/jobs/restart');
+    await request.post('/__test__/integrations/reset');
+    await request.post('/__test__/system/reset');
+    expect(page.conceptErrors).toEqual([]);
+});
+
+const PREVIEW_URL = '/prompt_manager/lora/import/preview';
+
+/** Runs in the page: Integrations' surfaces under `mainSelector`, every row's text and control, geometry and tokens. */
+function measureIntegrations(mainSelector) {
+    const layout = document.querySelector(`${mainSelector} .settings-layout`);
+    const css = (node, ...keys) => node ? Object.fromEntries(keys.map(key => [key, getComputedStyle(node)[key]])) : null;
+    const name = node => [node.localName, ...[...node.classList].sort()].join('.');
+    const text = node => node?.textContent.trim() ?? null;
+    const control = row => {
+        const select = row.querySelector(':scope > select');
+        if (select) return { kind: 'select', id: select.id, options: [...select.options].map(option => [option.textContent, option.disabled]),
+            selected: select.selectedOptions[0]?.textContent ?? null, disabled: select.disabled };
+        const input = row.querySelector(':scope > input');
+        if (input) return { kind: `input.${input.type}`, id: input.id, value: input.value, readOnly: input.readOnly };
+        const toggle = row.querySelector(':scope > * input[type="checkbox"]');
+        return toggle ? { kind: 'switch', id: toggle.id, wrapper: name(toggle.parentElement), checked: toggle.checked,
+            disabled: toggle.disabled, ...css(toggle.parentElement, 'width', 'height') } : null;
+    };
+    const surfaces = [...layout.querySelectorAll(':scope > section.surface')];
+    const firstRow = surfaces[0].querySelector('.setting-row');
+    const note = layout.querySelector('.setting-row p.small');
+    return {
+        layout: [...layout.children].map(name),
+        surfaces: surfaces.map(surface => ({ tree: [...surface.children].map(name), heading: text(surface.querySelector(':scope > h2')),
+            intro: text(surface.querySelector(':scope > p')),
+            rows: [...surface.querySelectorAll(':scope > .setting-row')].map(row => ({ tree: [...row.children].map(name),
+                text: [...row.firstElementChild.children].map(node => [name(node), text(node), node.localName === 'label' ? node.htmlFor : null]),
+                control: control(row) })),
+            operations: [...surface.querySelectorAll(':scope > .operation')].map(row => ({ tree: [...row.children].map(name),
+                title: text(row.querySelector('h3')), description: text(row.querySelector('p')),
+                actions: [...row.querySelectorAll('.row-actions > button')].map(item => [text(item), item.className]) })) })),
+        surface: css(surfaces[1], 'paddingTop', 'paddingLeft', 'backgroundColor', 'borderTopWidth', 'borderTopColor', 'borderTopLeftRadius',
+            'marginTop'),
+        row: css(firstRow, 'display', 'alignItems', 'justifyContent', 'columnGap', 'paddingTop', 'paddingBottom', 'borderTopWidth',
+            'borderTopColor', 'marginTop'),
+        label: css(firstRow.querySelector('label'), 'fontSize', 'fontWeight', 'color'),
+        description: css(firstRow.querySelector('p'), 'fontSize', 'color', 'marginTop', 'maxWidth'),
+        select: css(firstRow.querySelector('select'), 'fontSize', 'minWidth', 'maxWidth', 'backgroundColor', 'color', 'borderTopColor'),
+        password: css(layout.querySelector('.setting-row input[type="password"]'), 'fontSize', 'minWidth', 'maxWidth', 'backgroundColor',
+            'color', 'borderTopColor'),
+        // The concept's `.small` text (its Save row status); production's row notes use the same class.
+        small: css(layout.querySelector('#settings-status'), 'fontSize', 'color'),
+        note: note && css(note, 'fontSize', 'color'),
+        // Whether each select is as wide as the browser lays out a copy holding only its chosen option, i.e. it shows
+        // that option whole (the browser's own select sizing, arrow included).
+        selectsFit: [...layout.querySelectorAll('.setting-row > select')].map(select => {
+            const copy = select.cloneNode(false);
+            copy.removeAttribute('id');
+            copy.append(new Option(select.selectedOptions[0]?.textContent ?? ''));
+            Object.assign(copy.style, { position: 'absolute', visibility: 'hidden', width: 'max-content', minWidth: '0',
+                maxWidth: 'none', flex: 'none' });
+            select.parentElement.append(copy);
+            const needed = copy.getBoundingClientRect().width;
+            copy.remove();
+            return select.getBoundingClientRect().width + 0.5 >= needed;
+        }),
+        pageScroll: document.documentElement.scrollWidth > document.documentElement.clientWidth,
+    };
+}
+
+const SEND_REASON = 'Sending always asks for the ComfyUI window and node, so “Ask each time” is the only option.';
+const RENDERER_REASON = 'Prompt Manager nodes always follow ComfyUI’s own renderer setting.';
+const RENDERER_NONE = 'No ComfyUI window is open in this browser, so its renderer is not known.';
+const RETURN_REASON = 'Not available: sending applies the text in ComfyUI and keeps this page open.';
+const PATH_DESCRIPTION = 'Found automatically in ComfyUI’s custom_nodes folders; read-only, as on the existing settings page.';
+
+/**
+ * The concept's Integrations with the recorded deviations applied, for the fixture's LoraManager (detected, disabled,
+ * no key, trigger words off and not loaded).
+ */
+function mapIntegrationsConcept(reference) {
+    const [comfy, lora] = reference.surfaces;
+    const small = text => ['p.small', text, null];
+    const firstOnly = row => ({ ...row, control: { ...row.control, options: row.control.options.map(([label], index) => [label, index > 0]) } });
+    const [send, renderer, back] = comfy.rows;
+    const [enable, triggers, key] = lora.rows;
+    return {
+        ...reference,
+        surfaces: [
+            { ...comfy, rows: [
+                // D106: only "Ask each time" can be chosen, and the row says why.
+                { ...firstOnly(send), text: [...send.text, small(SEND_REASON)] },
+                // D106: only "Follow host renderer" can be chosen; the reason, then the detected renderer.
+                { ...firstOnly(renderer), text: [...renderer.text, small(RENDERER_REASON), small(RENDERER_NONE)] },
+                // D106: Return to canvas is not available: off, disabled and saying why.
+                { ...back, text: [...back.text, small(RETURN_REASON)], control: { ...back.control, checked: false, disabled: true } },
+            ] },
+            { ...lora,
+                // D106: the LoraManager path row (legacy, read-only) follows the integration toggle.
+                tree: [lora.tree[0], lora.tree[1], 'div.setting-row', 'div.setting-row', 'div.setting-row', 'div.setting-row', 'div.operation'],
+                rows: [
+                    // The real detection replaces the concept's sample line; the integration is off in the fixture.
+                    { ...enable, text: [enable.text[0], ['p', 'Detected: custom_nodes/ComfyUI-Lora-Manager.', null]],
+                        control: { ...enable.control, checked: false } },
+                    { tree: ['div', 'input'],
+                        text: [['label', 'LoraManager path', 'lora-path'], ['p', PATH_DESCRIPTION, null]],
+                        control: { kind: 'input.text', id: 'lora-path', value: 'custom_nodes/ComfyUI-Lora-Manager', readOnly: true } },
+                    // The trigger cache is a separate fact from the setting: its own line.
+                    { ...triggers, text: [...triggers.text, small('Trigger words are not loaded.')], control: { ...triggers.control, checked: false } },
+                    // D114: no prototype warning; the saved-key line under it.
+                    // (No key is saved in the fixture, so "Clear saved key" is not offered.)
+                    { ...key, text: [key.text[0], ['p', 'Credentials stay in the server configuration.', null], small('No key saved.')],
+                        control: { ...key.control, value: '' } },
+                ],
+                // D107: the import is reviewed first ("Review import"; the concept's button only simulated a job).
+                operations: lora.operations.map(operation => ({ ...operation, actions: [['Review import', '']] })) },
+        ],
+        // D106: both selects show their whole chosen option at every width (at 390 the concept cuts "Follow host
+        // renderer"; production lets the two selects grow to 160px and never shrink for the reason lines).
+        selectsFit: reference.selectsFit.map(() => true),
+        select: reference.select.maxWidth === '120px' ? { ...reference.select, maxWidth: '160px' } : reference.select,
+        // The D106/D114 row notes are `p.small` inside the row text, so they read as its description (`.setting-row p`).
+        note: { fontSize: reference.description.fontSize, color: reference.description.color },
+    };
+}
+
+async function conceptIntegrations(page, theme) {
+    await openConcept(page, 'system', theme);
+    await page.locator('#main .section-nav').getByRole('button', { name: 'Integrations', exact: true }).click();
+    await expect(page.locator('#main .settings-layout > section.surface')).toHaveCount(2);
+    await page.mouse.move(0, 0);
+    return page.evaluate(measureIntegrations, '#main');
+}
+
+async function productionIntegrations(page, theme) {
+    await openProduction(page, 'system/integrations', theme);
+    // Compare once the LoRA state and the renderer check answered.
+    await expect(page.locator('#workspace-main #lora-path')).toHaveValue('custom_nodes/ComfyUI-Lora-Manager');
+    await expect(page.locator('#workspace-main #renderer-status')).toHaveText(RENDERER_NONE);
+    await page.mouse.move(0, 0);
+    return page.evaluate(measureIntegrations, '#workspace-main');
+}
+
+const fakeLoraManager = async (request, data = {}) =>
+    expect(await request.post('/__test__/integrations/lora-manager', { data })).toBeOK();
+
+for (const theme of THEMES) for (const [width, height] of SIZES) {
+    test(`integrations matches the concept ${theme} ${width}x${height}`, async ({ page, request }, testInfo) => {
+        await page.setViewportSize({ width, height });
+        await fakeLoraManager(request);
+        const concept = await conceptIntegrations(page, theme);
+        await page.screenshot({ path: testInfo.outputPath(`concept-integrations-${theme}-${width}.png`), fullPage: true });
+        const production = await productionIntegrations(page, theme);
+        await page.screenshot({ path: testInfo.outputPath(`production-integrations-${theme}-${width}.png`), fullPage: true });
+        expect(diffInventory(mapIntegrationsConcept(concept), production)).toEqual([]);
+        expect(production.pageScroll).toBe(false);
+    });
+}
+
+// D106 below the concept's smallest size: on a 320px phone both selects still show their whole option, without page
+// scroll (S10 re-review N9).
+for (const theme of THEMES) test(`integrations selects fit at 320 wide ${theme}`, async ({ page, request }) => {
+    await page.setViewportSize({ width: 320, height: 700 });
+    await fakeLoraManager(request);
+    const production = await productionIntegrations(page, theme);
+    expect(production.selectsFit).toEqual([true, true]);
+    expect(production.pageScroll).toBe(false);
+});
+
+test('integrations comparison detects mutations', async ({ page, request }) => {
+    await page.setViewportSize({ width: 1600, height: 1100 });
+    await fakeLoraManager(request);
+    const concept = await conceptIntegrations(page, 'dark');
+    const expected = mapIntegrationsConcept(concept);
+    const production = await productionIntegrations(page, 'dark');
+    expect(diffInventory(expected, production)).toEqual([]);
+    // Unmapped, the section differs only where D106, D107 and D114 are recorded.
+    expect(diffInventory(concept, production).map(item => item.path.split('.').slice(0, 4).join('.'))
+        .filter((path, index, all) => all.indexOf(path) === index).sort()).toEqual([
+        'note', 'note.color', 'note.fontSize', 'surfaces.0.rows.0', 'surfaces.0.rows.1', 'surfaces.0.rows.2', 'surfaces.1.operations.0',
+        'surfaces.1.rows.0', 'surfaces.1.rows.1', 'surfaces.1.rows.2', 'surfaces.1.rows.3', 'surfaces.1.rows.length',
+        'surfaces.1.tree.5', 'surfaces.1.tree.6', 'surfaces.1.tree.length'].sort());
+    const measure = () => page.evaluate(measureIntegrations, '#workspace-main');
+    const paths = async () => diffInventory(expected, await measure()).map(item => item.path);
+    // A removed row.
+    const undoRow = await mutate(page, { remove: ['#workspace-main section.surface:nth-of-type(2) > .setting-row:nth-of-type(3)'] });
+    expect(await paths()).toEqual(expect.arrayContaining(['surfaces.1.rows.length', 'surfaces.1.tree.length']));
+    await undoRow();
+    // A changed label and a changed option.
+    await page.evaluate(() => { document.querySelector('#workspace-main label[for="renderer"]').textContent = 'Renderer'; });
+    expect(await paths()).toEqual(['surfaces.0.rows.1.text.0.1']);
+    await page.evaluate(() => { document.querySelector('#workspace-main label[for="renderer"]').textContent = 'Host compatibility'; });
+    await page.evaluate(() => { document.querySelector('#workspace-main #send-destination option').textContent = 'Always ask'; });
+    expect(await paths()).toEqual(expect.arrayContaining(['surfaces.0.rows.0.control.options.0.0']));
+    await page.evaluate(() => { document.querySelector('#workspace-main #send-destination option').textContent = 'Ask each time'; });
+    // An unsupported option that became selectable.
+    await page.evaluate(() => { document.querySelectorAll('#workspace-main #renderer option')[1].disabled = false; });
+    expect(await paths()).toEqual(['surfaces.0.rows.1.control.options.1.1']);
+    await page.evaluate(() => { document.querySelectorAll('#workspace-main #renderer option')[1].disabled = true; });
+    // A select squeezed until its chosen option is cut (S10 review M3).
+    const undoSqueeze = await mutate(page, { css: '#workspace-main #renderer { max-width: 70px !important; }' });
+    expect(await paths()).toEqual(['selectsFit.1']);
+    await undoSqueeze();
+    // A swapped token.
+    const undoToken = await mutate(page, { css: '#workspace-main .settings-layout { --line: rgb(255, 0, 0); }' });
+    expect(await paths()).toEqual(expect.arrayContaining(['row.borderTopColor']));
+    await undoToken();
+    expect(diffInventory(expected, await measure())).toEqual([]);
+});
+
+/** Runs in the page: the open review dialog: its title, body and the concept's tokens. */
+function measureReview() {
+    const dialog = document.querySelector('dialog#modal[open]');
+    const css = (node, ...keys) => node ? Object.fromEntries(keys.map(key => [key, getComputedStyle(node)[key]])) : null;
+    const name = node => [node.localName, ...[...node.classList].sort()].join('.');
+    const text = node => node?.textContent.trim() ?? null;
+    const body = dialog.querySelector('#modal-body');
+    const grid = body.querySelector(':scope > dl.meta-grid');
+    const note = [...body.querySelectorAll(':scope > p.small')].at(-1);
+    const actions = body.querySelector(':scope > .dialog-actions');
+    return {
+        title: text(dialog.querySelector('#modal-title')),
+        tree: [...body.children].map(name),
+        heading: { text: text(body.querySelector(':scope > h3')),
+            ...css(body.querySelector(':scope > h3'), 'fontSize', 'fontWeight', 'color', 'marginBottom') },
+        grid: { rows: [...grid.children].map(row => [text(row.querySelector('dt')), text(row.querySelector('dd'))]),
+            ...css(grid, 'display', 'gridTemplateColumns', 'columnGap', 'rowGap'),
+            dt: css(grid.querySelector('dt'), 'fontSize', 'color', 'textTransform'), dd: css(grid.querySelector('dd'), 'fontSize', 'color') },
+        details: body.querySelector(':scope > details') && { summary: text(body.querySelector(':scope > details > summary')),
+            tree: [...body.querySelector(':scope > details').children].map(name) },
+        backup: body.querySelector(':scope > .notice') && { tree: [...body.querySelector(':scope > .notice').children].map(name),
+            text: [...body.querySelectorAll(':scope > .notice > div:first-child > *')].map(node => [node.localName, text(node)]),
+            buttons: [...body.querySelectorAll(':scope > .notice button')].map(text) },
+        note: { text: text(note), ...css(note, 'fontSize', 'color', 'marginTop') },
+        actions: { tree: [...actions.children].map(name), ...css(actions, 'display', 'justifyContent', 'columnGap', 'marginTop'),
+            buttons: [...actions.children].map(item => ({ text: text(item), className: item.className,
+                ...css(item, 'backgroundColor', 'color', 'fontSize', 'paddingTop', 'paddingLeft', 'borderTopColor') })) },
+    };
+}
+
+/**
+ * D107: the server's import plan in the concept's review: "Review LoRA import" with "LoRA reference data" as its `h3`,
+ * the concept's four rows with the plan's values plus Found and Network, the LoRAs it found (`details`), the hold
+ * line with the cache sentence in the concept's `p.small`, the D55 backup box, and Cancel / "Start import".
+ */
+function mapImportConcept(reference, plan) {
+    const [cancel, start] = reference.actions.buttons;
+    return {
+        ...reference,
+        title: 'Review LoRA import',
+        tree: ['h3', 'dl.meta-grid', 'details', 'p.small', 'div.notice', 'div.dialog-actions'],
+        heading: { ...reference.heading, text: 'LoRA reference data' },
+        grid: { ...reference.grid, rows: [['LoraManager', 'environment settings · alongside storage · library default'],
+            ['Scope', plan.scope.label], ['Found', '2 metadata files · 2 LoRAs · 0 with local images'],
+            ['Protected', 'Nothing is protected'], ['Network', 'Downloads up to 2 example images from CivitAI'],
+            ['Backup', `Create and verify before changes (${plan.backup.destination_label})`],
+            ['Media on disk', 'No files are removed; image links are replaced']] },
+        details: { summary: 'LoRAs found (2)', tree: ['summary', 'pre'] },
+        backup: { tree: ['div', 'div.row-actions'], text: [['h3', 'Back up the database first (recommended)'],
+            ['p', 'Downloads a copy of the prompts database before this operation changes any records.']], buttons: ['Back up now'] },
+        note: { ...reference.note, text: 'Nothing changes until you apply. This review holds for 15 minutes. '
+            + 'Example images downloaded before a failure stay in the image cache.' },
+        actions: { ...reference.actions, buttons: [cancel, { ...start, text: 'Start import' }] },
+    };
+}
+
+async function conceptReview(page, theme) {
+    await openConcept(page, 'system', theme);
+    await page.locator('#main .section-nav').getByRole('button', { name: 'Maintenance', exact: true }).click();
+    await page.locator('#main [data-plan="duplicate prompts"]').click();
+    await expect(page.locator('dialog#modal[open] #modal-title')).toHaveText('Review maintenance plan');
+    await page.mouse.move(0, 0);
+    return page.evaluate(measureReview);
+}
+
+async function productionReview(page, request, theme) {
+    await openProduction(page, 'system/integrations', theme);
+    await expect(page.locator('#workspace-main #lora-path')).toHaveValue('custom_nodes/ComfyUI-Lora-Manager');
+    // The renderer line above settles first: its new text moves the rows below (a click must not land mid-shift).
+    await expect(page.locator('#workspace-main #renderer-status')).toHaveText(RENDERER_NONE);
+    // The import reviews what is enabled: save the integration on first.
+    await page.locator('#workspace-main #lora-enable').check();
+    await page.getByRole('button', { name: 'Save preferences', exact: true }).click();
+    await expect(page.locator('#settings-status')).toHaveText('Saved to the server configuration.');
+    const answer = page.waitForResponse(response => response.url().endsWith(PREVIEW_URL));
+    await page.locator('#workspace-main').getByRole('button', { name: 'Review import', exact: true }).click();
+    const plan = await (await answer).json();
+    await expect(page.locator('dialog#modal[open] #modal-title')).toHaveText('Review LoRA import');
+    await page.mouse.move(0, 0);
+    return { plan, production: await page.evaluate(measureReview) };
+}
+
+for (const theme of THEMES) for (const [width, height] of SIZES) {
+    test(`LoRA import review matches the concept ${theme} ${width}x${height}`, async ({ page, request }, testInfo) => {
+        await page.setViewportSize({ width, height });
+        await fakeLoraManager(request, { loras: 2, civitai: true, preview: false });
+        const concept = await conceptReview(page, theme);
+        expect(concept.tree).toEqual(['p.demo-note', 'h3', 'dl.meta-grid', 'p.small', 'div.dialog-actions']);
+        await page.screenshot({ path: testInfo.outputPath(`concept-plan-review-${theme}-${width}.png`) });
+        const { plan, production } = await productionReview(page, request, theme);
+        await page.screenshot({ path: testInfo.outputPath(`production-lora-review-${theme}-${width}.png`) });
+        expect(diffInventory(mapImportConcept(concept, plan), production)).toEqual([]);
+    });
+}
+
+test('LoRA import review comparison detects mutations', async ({ page, request }) => {
+    await page.setViewportSize({ width: 1600, height: 1100 });
+    await fakeLoraManager(request, { loras: 2, civitai: true, preview: false });
+    const concept = await conceptReview(page, 'dark');
+    const { plan } = await productionReview(page, request, 'dark');
+    const expected = mapImportConcept(concept, plan);
+    const paths = async () => diffInventory(expected, await page.evaluate(measureReview)).map(item => item.path);
+    expect(await paths()).toEqual([]);
+    await page.evaluate(() => { document.querySelectorAll('dialog#modal[open] dl.meta-grid dt')[4].textContent = 'Downloads'; });
+    expect(await paths()).toEqual(['grid.rows.4.0']);
+    await page.evaluate(() => { document.querySelectorAll('dialog#modal[open] dl.meta-grid dt')[4].textContent = 'Network'; });
+    const undoGrid = await mutate(page, { css: 'dialog#modal dl.meta-grid { column-gap: 3px; }' });
+    expect(await paths()).toEqual(expect.arrayContaining(['grid.columnGap']));
+    await undoGrid();
+    const undoBox = await mutate(page, { remove: ['dialog#modal[open] #modal-body > .notice'] });
+    expect(await paths()).toEqual(expect.arrayContaining(['backup', 'tree.length']));
+    await undoBox();
+    expect(await paths()).toEqual([]);
+});
@@ -0,0 +1,266 @@
+import { startCoverage, saveCoverage } from '../../tools/vendor/browser-coverage.mjs';
+import { test, expect } from './fixtures.mjs';
+import { SIZES, THEMES, seedConcept, openConcept, openProduction, diffInventory, mutate, measureReview, mapPlanConcept }
+    from './concept-inventory.mjs';
+
+// #249 System S7 Task 20: System › Maintenance (app.js renderSystem 688–690), its plan dialog (`maintenancePlan`,
+// 953–958) for each operation and its duplicates dialog (`duplicates`, 1457–1461) against the immutable concept, on
+// the concept-shaped real fixture. Each concept measurement is mapped only by the recorded deviations (D100, D101,
+// D102; the health report is D95, compared in system-concept.spec), each commented where it applies; after that the
+// difference must be empty, and a mutated label, row or token must be noticed.
+test.use({ locale: 'en-US', timezoneId: 'UTC' });
+
+test.beforeEach(async ({ page, request, browserName }) => {
+    await startCoverage(page, browserName);
+    await seedConcept(request);
+    await expect(await request.post('/__test__/system/reset')).toBeOK();
+    await expect(await request.post('/__test__/jobs/restart')).toBeOK();
+    page.conceptErrors = [];
+    page.on('pageerror', error => page.conceptErrors.push(error.message));
+});
+
+test.afterEach(async ({ page, request, browserName }) => {
+    await saveCoverage(page, browserName);
+    await request.post('/__test__/jobs/restart');
+    await request.post('/__test__/system/reset');
+    expect(page.conceptErrors).toEqual([]);
+});
+
+const PREVIEW_URL = '/prompt_manager/maintenance/preview';
+
+/** Runs in the page: Maintenance's notice and surfaces under `mainSelector`, with the concept's geometry and tokens. */
+function measureMaintenance(mainSelector) {
+    const layout = document.querySelector(`${mainSelector} .settings-layout`);
+    const css = (node, ...keys) => node ? Object.fromEntries(keys.map(key => [key, getComputedStyle(node)[key]])) : null;
+    const name = node => [node.localName, ...[...node.classList].sort()].join('.');
+    const text = node => node?.textContent.trim() ?? null;
+    const button = node => ({ text: text(node), className: node.className,
+        ...css(node, 'backgroundColor', 'color', 'fontSize', 'paddingTop', 'paddingLeft', 'borderTopColor', 'opacity', 'cursor') });
+    const box = node => {
+        const rect = node.getBoundingClientRect(), base = layout.getBoundingClientRect();
+        return { left: Math.round(rect.left - base.left), width: Math.round(rect.width) };
+    };
+    const notice = layout.querySelector(':scope > .notice');
+    const surfaces = [...layout.querySelectorAll(':scope > section.surface')];
+    const operation = surfaces[0].querySelector('.operation');
+    return {
+        layout: [...layout.children].map(name),
+        notice: { tree: [...notice.children].map(name), text: [...notice.querySelectorAll(':scope > div > *')].map(node => [node.localName, text(node)]),
+            run: button(notice.querySelector(':scope > button')),
+            ...css(notice, 'display', 'alignItems', 'justifyContent', 'columnGap', 'borderTopColor', 'backgroundColor', 'paddingTop', 'marginBottom') },
+        surfaces: surfaces.map(surface => ({ tree: [...surface.children].map(name), heading: text(surface.querySelector(':scope > h2')),
+            box: box(surface),
+            rows: [...surface.querySelectorAll(':scope > .operation')].map(row => ({ tree: [...row.children].map(name),
+                title: text(row.querySelector('h3')), description: text(row.querySelector('p')),
+                actions: [...row.querySelectorAll('.row-actions > button')].map(button) })) })),
+        surface: css(surfaces[0], 'paddingTop', 'paddingLeft', 'backgroundColor', 'borderTopWidth', 'borderTopColor', 'borderTopLeftRadius', 'marginTop'),
+        h2: css(surfaces[0].querySelector('h2'), 'fontSize', 'fontWeight', 'color', 'marginBottom'),
+        operation: css(operation, 'display', 'alignItems', 'justifyContent', 'columnGap', 'paddingTop', 'paddingBottom',
+            'borderTopWidth', 'borderTopColor'),
+        h3: css(operation.querySelector('h3'), 'fontSize', 'fontWeight', 'color'),
+        p: css(operation.querySelector('p'), 'fontSize', 'color', 'marginTop'),
+        actions: css(operation.querySelector('.row-actions'), 'display', 'columnGap', 'flexShrink'),
+        pageScroll: document.documentElement.scrollWidth > document.documentElement.clientWidth,
+    };
+}
+
+/** D102: the Metadata cache row says why its review is unavailable and its button is aria-disabled (D93's dimmed style). */
+function mapMaintenanceConcept(reference) {
+    return {
+        ...reference,
+        surfaces: reference.surfaces.map(surface => ({ ...surface, rows: surface.rows.map(row => row.title !== 'Metadata cache' ? row : {
+            ...row, description: `${row.description} Nothing is cached in this browser.`,
+            actions: row.actions.map(action => ({ ...action, opacity: '0.55', cursor: 'not-allowed' })) }) })),
+    };
+}
+
+async function conceptMaintenance(page, theme) {
+    await openConcept(page, 'system', theme);
+    await page.locator('#main .section-nav').getByRole('button', { name: 'Maintenance', exact: true }).click();
+    await expect(page.locator('#main .settings-layout > section.surface')).toHaveCount(2);
+    await page.mouse.move(0, 0);
+    return page.evaluate(measureMaintenance, '#main');
+}
+
+async function productionMaintenance(page, theme) {
+    await openProduction(page, 'system/maintenance', theme);
+    await expect(page.locator('#workspace-main .settings-layout > section.surface')).toHaveCount(2);
+    // The Metadata cache row reads this browser's storage once: compare after it answered.
+    await expect(page.locator('#workspace-main .operation').filter({ hasText: 'Metadata cache' }).locator('p'))
+        .toHaveText(/Nothing is cached in this browser\.$/);
+    await page.mouse.move(0, 0);
+    return page.evaluate(measureMaintenance, '#workspace-main');
+}
+
+for (const theme of THEMES) for (const [width, height] of SIZES) {
+    test(`maintenance matches the concept ${theme} ${width}x${height}`, async ({ page }, testInfo) => {
+        await page.setViewportSize({ width, height });
+        const concept = await conceptMaintenance(page, theme);
+        await page.screenshot({ path: testInfo.outputPath(`concept-maintenance-${theme}-${width}.png`), fullPage: true });
+        const production = await productionMaintenance(page, theme);
+        await page.screenshot({ path: testInfo.outputPath(`production-maintenance-${theme}-${width}.png`), fullPage: true });
+        expect(diffInventory(mapMaintenanceConcept(concept), production)).toEqual([]);
+        expect(production.pageScroll).toBe(false);
+    });
+}
+
+// The concept's plan names (`data-plan`) and production's operation, row and button for each.
+const PLANS = Object.freeze([
+    ['duplicate prompts', 'duplicate_prompts', 'Duplicate prompt text'],
+    ['database optimization', 'optimize', 'Optimize database'],
+    ['unused prompt components', 'unused_components', 'Unused prompt components'],
+    ['missing-file links', 'missing_links', 'Missing-file links'],
+]);
+
+async function conceptPlan(page, theme, name) {
+    await conceptMaintenance(page, theme);
+    await page.locator(`#main [data-plan="${name}"]`).click();
+    await expect(page.locator('dialog#modal[open] #modal-title')).toHaveText('Review maintenance plan');
+    await page.mouse.move(0, 0);
+    return page.evaluate(measureReview);
+}
+
+/** Production's plan dialog for the row `title`, with the server's answer its review read. */
+async function productionPlan(page, title) {
+    const answer = page.waitForResponse(response => response.url().endsWith(PREVIEW_URL));
+    await page.locator('#workspace-main .operation').filter({ has: page.locator('h3', { hasText: title }) })
+        .getByRole('button', { name: 'Review plan', exact: true }).click();
+    const plan = await (await answer).json();
+    await expect(page.locator('dialog#modal[open] #modal-body > h3')).toHaveText(title);
+    await page.mouse.move(0, 0);
+    return { plan, production: await page.evaluate(measureReview) };
+}
+
+for (const theme of THEMES) for (const [width, height] of SIZES) {
+    test(`plan dialogs match the concept ${theme} ${width}x${height}`, async ({ page, request }, testInfo) => {
+        await page.setViewportSize({ width, height });
+        // Something to merge, and a missing-file link, so no plan is empty.
+        await expect(await request.post('/__test__/system/duplicate-prompts')).toBeOK();
+        await expect(await request.post('/__test__/system/missing-file')).toBeOK();
+        const concepts = [];
+        for (const [name] of PLANS) {
+            concepts.push(await conceptPlan(page, theme, name));
+            await page.screenshot({ path: testInfo.outputPath(`concept-plan-${name.replace(/\W+/g, '-')}-${theme}-${width}.png`) });
+        }
+        expect(concepts[0].tree).toEqual(['p.demo-note', 'h3', 'dl.meta-grid', 'p.small', 'div.dialog-actions']);
+        await productionMaintenance(page, theme);
+        for (const [index, [, operation, title]] of PLANS.entries()) {
+            const { plan, production } = await productionPlan(page, title);
+            expect(plan.operation).toBe(operation);
+            await page.screenshot({ path: testInfo.outputPath(`production-plan-${operation}-${theme}-${width}.png`) });
+            expect(diffInventory(mapPlanConcept(concepts[index], title, plan), production)).toEqual([]);
+            await page.keyboard.press('Escape');
+            await expect(page.locator('dialog#modal[open]')).toHaveCount(0);
+        }
+    });
+}
+
+/**
+ * D101: the real group in the concept's markup: the status line (the concept's sample note's place), a group's
+ * `p.small` and `.compare-grid` in one wrapper, a "Keep <source>/<path>" radio per copy, the oldest checked, and the
+ * production note in the concept's `p.small`.
+ */
+function mapDuplicatesConcept(reference) {
+    const items = reference.compare.items.map((item, index) => ({ ...item,
+        label: `Keep output/s7-dupes/group_00_${index ? 'b' : 'a'}.png` }));
+    return {
+        ...reference,
+        tree: ['p.small', 'div.duplicate-groups', 'p.small', 'div.dialog-actions'],
+        compare: { ...reference.compare, items },
+        note: { ...reference.note, text: 'Removing a copy deletes its file from disk; its database links move to the kept copy. '
+            + 'History keeps the removed paths in its run records. Nothing is deleted until you review and apply the cleanup.' },
+    };
+}
+
+async function conceptDuplicates(page, theme) {
+    await conceptMaintenance(page, theme);
+    await page.locator('#main').getByRole('button', { name: 'Find duplicates', exact: true }).click();
+    await expect(page.locator('dialog#modal[open] #modal-title')).toHaveText('Review duplicate image files');
+    await page.mouse.move(0, 0);
+    return page.evaluate(measureReview);
+}
+
+async function productionDuplicates(page, theme) {
+    await productionMaintenance(page, theme);
+    await page.locator('#workspace-main').getByRole('button', { name: 'Find duplicates', exact: true }).click();
+    await page.locator('#workspace-main').getByRole('button', { name: 'Review groups', exact: true }).click();
+    await expect(page.locator('dialog#modal[open] .compare-item img')).toHaveCount(2);
+    await page.locator('dialog#modal[open] .compare-item img').evaluateAll(images => Promise.all(images.map(image => image.decode())));
+    await page.mouse.move(0, 0);
+    return page.evaluate(measureReview);
+}
+
+for (const theme of THEMES) for (const [width, height] of SIZES) {
+    test(`duplicates dialog matches the concept ${theme} ${width}x${height}`, async ({ page, request }, testInfo) => {
+        await page.setViewportSize({ width, height });
+        await expect(await request.post('/__test__/system/duplicate-files', { data: { groups: 1, trio: false } })).toBeOK();
+        const concept = await conceptDuplicates(page, theme);
+        expect(concept.tree).toEqual(['p.demo-note', 'div.compare-grid', 'p.small', 'div.dialog-actions']);
+        await page.screenshot({ path: testInfo.outputPath(`concept-duplicates-${theme}-${width}.png`) });
+        const production = await productionDuplicates(page, theme);
+        await page.screenshot({ path: testInfo.outputPath(`production-duplicates-${theme}-${width}.png`) });
+        expect(diffInventory(mapDuplicatesConcept(concept), production)).toEqual([]);
+    });
+}
+
+test('maintenance comparison detects mutations', async ({ page, request }) => {
+    await page.setViewportSize({ width: 1600, height: 1100 });
+    const concept = await conceptMaintenance(page, 'dark');
+    const expected = mapMaintenanceConcept(concept);
+    const production = await productionMaintenance(page, 'dark');
+    expect(diffInventory(expected, production)).toEqual([]);
+    // Unmapped, the section differs only on the D102 row.
+    expect(diffInventory(concept, production).map(item => item.path).sort()).toEqual([
+        'surfaces.1.rows.3.actions.0.cursor', 'surfaces.1.rows.3.actions.0.opacity', 'surfaces.1.rows.3.description']);
+    const measure = () => page.evaluate(measureMaintenance, '#workspace-main');
+    const paths = async () => diffInventory(expected, await measure()).map(item => item.path);
+    // A removed row, a changed label, a lost danger mark and a swapped token.
+    const undoRow = await mutate(page, { remove: ['#workspace-main section.surface:nth-of-type(1) > .operation:nth-of-type(2)'] });
+    expect(await paths()).toEqual(expect.arrayContaining(['surfaces.0.rows.length', 'surfaces.0.tree.length']));
+    await undoRow();
+    await page.evaluate(() => { document.querySelector('#workspace-main section.surface h3').textContent = 'Integrity checks'; });
+    expect(await paths()).toEqual(['surfaces.0.rows.0.title']);
+    await page.evaluate(() => { document.querySelector('#workspace-main section.surface h3').textContent = 'Integrity & relationship checks'; });
+    await page.evaluate(() => { document.querySelector('#workspace-main button.danger').classList.remove('danger'); });
+    expect(await paths()).toEqual(expect.arrayContaining(['surfaces.0.rows.3.actions.0.className']));
+    await page.evaluate(() => { document.querySelectorAll('#workspace-main section.surface')[0].querySelectorAll('.row-actions > button')[3].classList.add('danger'); });
+    const undoToken = await mutate(page, { css: '#workspace-main .settings-layout { --line: rgb(255, 0, 0); }' });
+    expect(await paths()).toEqual(expect.arrayContaining(['operation.borderTopColor']));
+    await undoToken();
+    expect(diffInventory(expected, await measure())).toEqual([]);
+
+    // The plan dialog: a changed grid term and the duplicates dialog's grid token are noticed.
+    await expect(await request.post('/__test__/system/duplicate-prompts')).toBeOK();
+    const conceptPlanDialog = await conceptPlan(page, 'dark', 'duplicate prompts');
+    await productionMaintenance(page, 'dark');
+    const { plan } = await productionPlan(page, 'Duplicate prompt text');
+    const expectedPlan = mapPlanConcept(conceptPlanDialog, 'Duplicate prompt text', plan);
+    const planPaths = async () => diffInventory(expectedPlan, await page.evaluate(measureReview)).map(item => item.path);
+    expect(await planPaths()).toEqual([]);
+    await page.evaluate(() => { document.querySelector('dialog#modal[open] dl.meta-grid dt').textContent = 'Impact'; });
+    expect(await planPaths()).toEqual(['grid.rows.0.0']);
+    await page.evaluate(() => { document.querySelector('dialog#modal[open] dl.meta-grid dt').textContent = 'Scope'; });
+    const undoGrid = await mutate(page, { css: 'dialog#modal dl.meta-grid { column-gap: 3px; }' });
+    expect(await planPaths()).toEqual(expect.arrayContaining(['grid.columnGap']));
+    await undoGrid();
+    expect(await planPaths()).toEqual([]);
+});
+
+test('duplicates comparison detects mutations', async ({ page, request }) => {
+    await page.setViewportSize({ width: 1600, height: 1100 });
+    await expect(await request.post('/__test__/system/duplicate-files', { data: { groups: 1, trio: false } })).toBeOK();
+    const expected = mapDuplicatesConcept(await conceptDuplicates(page, 'dark'));
+    await productionDuplicates(page, 'dark');
+    const paths = async () => diffInventory(expected, await page.evaluate(measureReview)).map(item => item.path);
+    expect(await paths()).toEqual([]);
+    const undoToken = await mutate(page, { css: 'dialog#modal .compare-item { background: rgb(255, 0, 0); }' });
+    expect(await paths()).toEqual(['compare.item.backgroundColor']);
+    await undoToken();
+    await page.evaluate(() => { document.querySelector('dialog#modal[open] .dialog-actions button:last-child').classList.add('ca-primary'); });
+    expect(await paths()).toEqual(expect.arrayContaining(['actions.buttons.1.className']));
+    await page.evaluate(() => { document.querySelector('dialog#modal[open] .dialog-actions button:last-child').classList.remove('ca-primary'); });
+    const undoItem = await mutate(page, { remove: ['dialog#modal[open] .compare-item:last-child'] });
+    expect(await paths()).toEqual(expect.arrayContaining(['compare.items.length']));
+    await undoItem();
+    expect(await paths()).toEqual([]);
+});
@@ -0,0 +1,418 @@
+import { startCoverage, saveCoverage } from '../../tools/vendor/browser-coverage.mjs';
+import { test, expect } from './fixtures.mjs';
+import { SIZES, THEMES, seedConcept, openConcept, openProduction, diffInventory, mutate } from './concept-inventory.mjs';
+
+// #328 System S11 Task 8: System › Auto-tagging (app.js renderSystem 685–686) and the Tag output images review against
+// the immutable concept, on the concept-shaped fixture with the fake tagging model (every engine downloaded, none
+// loaded). Each concept measurement is mapped only by the recorded deviations (D132, D133, D134), each commented where
+// it applies; after that the difference must be empty, and a mutated label, option, order, class, select width or
+// token must be noticed. The concept has no batch review, so the Tag output images review is compared with the
+// concept's own record-changing review, `maintenancePlan` (953–958), whose shell, grid, note and actions it shares.
+test.use({ locale: 'en-US', timezoneId: 'UTC' });
+
+test.beforeEach(async ({ page, request, browserName }) => {
+    await startCoverage(page, browserName);
+    // The tagging reset restores the fake model (nothing loaded, every engine on disk) and the saved tagging defaults;
+    // the concept fixture then replaces its rows and files.
+    await expect(await request.post('/__test__/tagging/reset', { data: {} })).toBeOK();
+    await seedConcept(request);
+    await expect(await request.post('/__test__/system/reset')).toBeOK();
+    await expect(await request.post('/__test__/jobs/restart')).toBeOK();
+    page.conceptErrors = [];
+    page.on('pageerror', error => page.conceptErrors.push(error.message));
+});
+
+test.afterEach(async ({ page, request, browserName }) => {
+    await saveCoverage(page, browserName);
+    await request.post('/__test__/jobs/restart');
+    await request.post('/__test__/system/reset');
+    await request.post('/__test__/tagging/reset', { data: {} });
+    expect(page.conceptErrors).toEqual([]);
+});
+
+const PREVIEW_URL = '/prompt_manager/autotag/batch/preview';
+const MODEL_OPTIONS = ['WD14 SwinV2 · ~400 MB', 'WD14 ViT · ~400 MB', 'GGUF JoyCaption · ~4.5 GB', 'HuggingFace JoyCaption · ~16 GB'];
+const SUGGESTIONS = 'From 1 to 100: the most suggestions Generate shows for one image.';
+const BATCH = 'Tag each output image from its own pixels with the model above. Prompts are not changed. Review the scope first.';
+
+/** Runs in the page: Auto-tagging's surface under `mainSelector`: rows, field, actions, operation, geometry and tokens. */
+function measureTagging(mainSelector) {
+    const layout = document.querySelector(`${mainSelector} .settings-layout`);
+    const css = (node, ...keys) => node ? Object.fromEntries(keys.map(key => [key, getComputedStyle(node)[key]])) : null;
+    const name = node => [node.localName, ...[...node.classList].sort()].join('.');
+    const text = node => node?.textContent.trim() ?? null;
+    const control = row => {
+        const select = row.querySelector(':scope > select');
+        if (select) return { kind: 'select', id: select.id, options: [...select.options].map(option => [option.textContent, option.disabled]),
+            selected: select.selectedOptions[0]?.textContent ?? null, disabled: select.disabled };
+        const input = row.querySelector(':scope > input');
+        return input ? { kind: `input.${input.type}`, id: input.id, value: input.value, disabled: input.disabled } : null;
+    };
+    const surface = layout.querySelector(':scope > section.surface');
+    const firstRow = surface.querySelector('.setting-row');
+    const field = surface.querySelector(':scope > .field');
+    const actions = surface.querySelector(':scope > .row-actions');
+    return {
+        layout: [...layout.children].map(name),
+        tree: [...surface.children].map(name),
+        heading: text(surface.querySelector(':scope > h2')),
+        intro: text(surface.querySelector(':scope > p')),
+        // Per row: whether it may wrap, and whether its control sits under the text (a wrapped row) or beside it.
+        rows: [...surface.querySelectorAll(':scope > .setting-row')].map(row => ({ tree: [...row.children].map(name),
+            text: [...row.firstElementChild.children].map(node => [name(node), text(node), node.localName === 'label' ? node.htmlFor : null]),
+            control: control(row), flexWrap: getComputedStyle(row).flexWrap,
+            controlBelow: row.lastElementChild.getBoundingClientRect().top >= row.firstElementChild.getBoundingClientRect().bottom - 0.5 })),
+        field: { tree: [...field.children].map(name), label: [text(field.querySelector('label')), field.querySelector('label').htmlFor],
+            textarea: { id: field.querySelector('textarea').id, value: field.querySelector('textarea').value,
+                ...css(field.querySelector('textarea'), 'fontSize', 'minHeight', 'backgroundColor', 'color', 'borderTopColor') },
+            ...css(field, 'display', 'rowGap', 'fontSize', 'marginTop', 'marginBottom') },
+        actions: { buttons: [...actions.children].map(item => [text(item), item.className]),
+            ...css(actions, 'display', 'flexWrap', 'columnGap', 'justifyContent'),
+            primary: css(actions.querySelector('.ca-primary'), 'backgroundColor', 'color', 'fontSize', 'paddingTop', 'paddingLeft'),
+            plain: css(actions.querySelector('button:not(.ca-primary)'), 'backgroundColor', 'color', 'fontSize', 'borderTopColor') },
+        operations: [...surface.querySelectorAll(':scope > .operation')].map(row => ({ tree: [...row.children].map(name),
+            title: text(row.querySelector('h3')), description: text(row.querySelector('p')),
+            actions: [...row.querySelectorAll('.row-actions > button')].map(item => [text(item), item.className]) })),
+        surface: css(surface, 'paddingTop', 'paddingLeft', 'backgroundColor', 'borderTopWidth', 'borderTopColor', 'borderTopLeftRadius'),
+        row: css(firstRow, 'display', 'alignItems', 'justifyContent', 'columnGap', 'paddingTop', 'paddingBottom', 'borderTopWidth',
+            'borderTopColor', 'marginTop'),
+        label: css(firstRow.querySelector('label'), 'fontSize', 'fontWeight', 'color'),
+        description: css(firstRow.querySelector('p'), 'fontSize', 'color', 'marginTop', 'maxWidth'),
+        select: css(firstRow.querySelector('select'), 'fontSize', 'minWidth', 'backgroundColor', 'color', 'borderTopColor'),
+        number: css(surface.querySelector('.setting-row input[type="number"]'), 'fontSize', 'minWidth', 'maxWidth', 'backgroundColor',
+            'color', 'borderTopColor'),
+        // Whether each select is as wide as the browser lays out a copy holding only its chosen option, i.e. it shows
+        // that option whole (the browser's own select sizing, arrow included).
+        selectsFit: [...surface.querySelectorAll('.setting-row > select')].map(select => {
+            const copy = select.cloneNode(false);
+            copy.removeAttribute('id');
+            copy.append(new Option(select.selectedOptions[0]?.textContent ?? ''));
+            // Important inline values: the phone cap is an !important rule (concept.css), which a plain inline style loses to.
+            for (const [key, value] of [['position', 'absolute'], ['visibility', 'hidden'], ['width', 'max-content'], ['min-width', '0'],
+                ['max-width', 'none'], ['flex', 'none']]) copy.style.setProperty(key, value, 'important');
+            select.parentElement.append(copy);
+            const needed = copy.getBoundingClientRect().width;
+            copy.remove();
+            return select.getBoundingClientRect().width + 0.5 >= needed;
+        }),
+        pageScroll: document.documentElement.scrollWidth > document.documentElement.clientWidth,
+    };
+}
+
+/**
+ * The concept's Auto-tagging with the recorded deviations applied, for the fixture (all engines on disk, none loaded).
+ * `phone` is a viewport at the concept's 700px breakpoint or below.
+ */
+function mapTaggingConcept(reference, { template, phone }) {
+    const [model, existing, general, character] = reference.rows;
+    const [preview] = reference.actions.buttons;
+    return {
+        ...reference,
+        // D133 adds a row after the thresholds; D134 adds the operation after the actions.
+        tree: [...reference.tree.slice(0, 6), 'div.setting-row', ...reference.tree.slice(6), 'div.operation'],
+        rows: [
+            // D132 (OQ5, OQ6): the four real engines with their download size, and the chosen one's live status.
+            { ...model, text: [model.text[0], ['p', 'Downloaded. Not loaded.', null]],
+                control: { ...model.control, options: MODEL_OPTIONS.map(label => [label, false]), selected: MODEL_OPTIONS[0] },
+                // D132: at phone width the row wraps, so the engine select sits whole under its text.
+                ...(phone ? { flexWrap: 'wrap', controlBelow: true } : {}) },
+            existing, general, character,
+            // D133: the persisted suggestion count, on the concept's number row.
+            { ...general, text: [['label', 'Suggestions per image', 'tag-suggestions'], ['p', SUGGESTIONS, null]],
+                control: { ...general.control, id: 'tag-suggestions', value: '10' } },
+        ],
+        // The saved template (the server's default until one is saved) replaces the concept's sample text.
+        field: { ...reference.field, textarea: { ...reference.field.textarea, value: template } },
+        // D132: Download (for an engine already on disk, "Download again") and Unload replace the two simulated jobs.
+        actions: { ...reference.actions, buttons: [preview, ['Download again', ''], ['Unload', '']] },
+        // D134: the prompt-tag batch, reviewed first.
+        operations: [{ tree: ['div', 'div.row-actions'], title: 'Tag output images', description: BATCH, actions: [['Review', '']] }],
+        // D132 (#398): every select shows its whole chosen option at every width (at 390 the concept's 120px cap cuts
+        // them; production lets each grow past it).
+        selectsFit: reference.selectsFit.map(() => true),
+    };
+}
+
+async function conceptTagging(page, theme) {
+    await openConcept(page, 'system', theme);
+    await page.locator('#main .section-nav').getByRole('button', { name: 'Auto-tagging', exact: true }).click();
+    await expect(page.locator('#main #tag-template')).toBeVisible();
+    await page.mouse.move(0, 0);
+    return page.evaluate(measureTagging, '#main');
+}
+
+async function productionTagging(page, theme) {
+    await openProduction(page, 'system/tagging', theme);
+    // Compare once the settings and the model status answered.
+    await expect(page.locator('#workspace-main #tag-model')).toBeEnabled();
+    await expect(page.locator('#workspace-main .setting-row').first().locator('p')).toHaveText('Downloaded. Not loaded.');
+    await page.mouse.move(0, 0);
+    return page.evaluate(measureTagging, '#workspace-main');
+}
+
+async function savedTemplate(request, page) {
+    const response = await request.get('/prompt_manager/settings');
+    await expect(response).toBeOK();
+    return { template: (await response.json()).settings.autotag_template, phone: page.viewportSize().width <= 700 };
+}
+
+for (const theme of THEMES) for (const [width, height] of SIZES) {
+    test(`auto-tagging matches the concept ${theme} ${width}x${height}`, async ({ page, request }, testInfo) => {
+        await page.setViewportSize({ width, height });
+        const concept = await conceptTagging(page, theme);
+        await page.screenshot({ path: testInfo.outputPath(`concept-tagging-${theme}-${width}.png`), fullPage: true });
+        const production = await productionTagging(page, theme);
+        await page.screenshot({ path: testInfo.outputPath(`production-tagging-${theme}-${width}.png`), fullPage: true });
+        expect(diffInventory(mapTaggingConcept(concept, await savedTemplate(request, page)), production)).toEqual([]);
+        expect(production.pageScroll).toBe(false);
+    });
+}
+
+// D132 (#398) at phone width and below the concept's smallest size: every option of every select, once chosen, shows
+// whole, with no page scroll.
+for (const theme of THEMES) for (const width of [390, 320]) {
+    test(`auto-tagging selects fit every option at ${width} wide ${theme}`, async ({ page }, testInfo) => {
+        await page.setViewportSize({ width, height: 844 });
+        await productionTagging(page, theme);
+        await page.locator('#workspace-main #tag-existing').selectOption('replace_after_review');
+        await page.locator('#workspace-main section.surface').screenshot({ path: testInfo.outputPath(`production-tagging-selects-${theme}-${width}.png`) });
+        const selects = page.locator('#workspace-main section.surface > .setting-row > select');
+        await expect(selects).toHaveCount(2);
+        for (let index = 0; index < 2; index += 1) {
+            const select = selects.nth(index);
+            const values = await select.evaluate(node => [...node.options].map(option => option.value));
+            for (const value of values) {
+                await select.selectOption(value);
+                const measured = await page.evaluate(measureTagging, '#workspace-main');
+                expect(measured.selectsFit, `${await select.getAttribute('id')}=${value}`).toEqual([true, true]);
+                expect(measured.pageScroll, value).toBe(false);
+            }
+        }
+    });
+}
+
+test('auto-tagging comparison detects mutations', async ({ page, request }) => {
+    await page.setViewportSize({ width: 1600, height: 1100 });
+    const concept = await conceptTagging(page, 'dark');
+    const saved = await savedTemplate(request, page);
+    const expected = mapTaggingConcept(concept, saved);
+    const production = await productionTagging(page, 'dark');
+    expect(diffInventory(expected, production)).toEqual([]);
+    // Unmapped, the section differs only where D132, D133 and D134 are recorded (and the saved template's text).
+    expect(diffInventory(concept, production).map(item => item.path.split('.').slice(0, 3).join('.'))
+        .filter((path, index, all) => all.indexOf(path) === index).sort()).toEqual([
+        'actions.buttons.1', 'actions.buttons.2', 'field.textarea.value', 'operations.0.actions', 'operations.0.description',
+        'operations.0.title', 'operations.0.tree', 'operations.length', 'rows.0.control', 'rows.0.text', 'rows.4.control', 'rows.4.controlBelow',
+        'rows.4.flexWrap', 'rows.4.text', 'rows.4.tree', 'rows.length', 'tree.6', 'tree.7', 'tree.8', 'tree.9', 'tree.length'].sort());
+    const measure = () => page.evaluate(measureTagging, '#workspace-main');
+    const paths = async () => diffInventory(expected, await measure()).map(item => item.path);
+    // A removed row.
+    const undoRow = await mutate(page, { remove: ['#workspace-main section.surface > .setting-row:nth-of-type(2)'] });
+    expect(await paths()).toEqual(expect.arrayContaining(['rows.length', 'tree.length']));
+    await undoRow();
+    // A renamed label.
+    await page.evaluate(() => { document.querySelector('#workspace-main label[for="tag-existing"]').textContent = 'Existing'; });
+    expect(await paths()).toEqual(['rows.1.text.0.1']);
+    await page.evaluate(() => { document.querySelector('#workspace-main label[for="tag-existing"]').textContent = 'Existing tags'; });
+    // A reordered option.
+    await page.evaluate(() => { const select = document.querySelector('#workspace-main #tag-existing'); select.append(select.options[0]); });
+    expect(await paths()).toEqual(expect.arrayContaining(['rows.1.control.options.0.0']));
+    await page.evaluate(() => { const select = document.querySelector('#workspace-main #tag-existing'); select.prepend(select.options[2]); });
+    // ca-primary moved to another action.
+    await page.evaluate(() => {
+        const [first, second] = document.querySelectorAll('#workspace-main section.surface > .row-actions > button');
+        first.classList.remove('ca-primary');
+        second.classList.add('ca-primary');
+    });
+    expect(await paths()).toEqual(expect.arrayContaining(['actions.buttons.0.1', 'actions.buttons.1.1']));
+    await page.evaluate(() => {
+        const [first, second] = document.querySelectorAll('#workspace-main section.surface > .row-actions > button');
+        second.classList.remove('ca-primary');
+        first.classList.add('ca-primary');
+    });
+    // A select squeezed until its chosen option is cut.
+    const undoSqueeze = await mutate(page, { css: '#workspace-main #tag-model { max-width: 60px !important; min-width: 0 !important; }' });
+    expect(await paths()).toEqual(expect.arrayContaining(['selectsFit.0']));
+    await undoSqueeze();
+    const undoSqueezeExisting = await mutate(page, { css: '#workspace-main #tag-existing { max-width: 60px !important; min-width: 0 !important; }' });
+    expect(await paths()).toEqual(expect.arrayContaining(['selectsFit.1']));
+    await undoSqueezeExisting();
+    // A row that wraps where the concept's does not.
+    const undoWrap = await mutate(page, { css: '#workspace-main .setting-row:has(> #tag-existing) { flex-wrap: wrap; }' });
+    expect(await paths()).toEqual(['rows.1.flexWrap']);
+    await undoWrap();
+    // A swapped token.
+    const undoToken = await mutate(page, { css: '#workspace-main .settings-layout { --line: rgb(255, 0, 0); }' });
+    expect(await paths()).toEqual(expect.arrayContaining(['row.borderTopColor']));
+    await undoToken();
+    expect(diffInventory(expected, await measure())).toEqual([]);
+});
+
+// D132 at phone width: only the engine row wraps; Existing tags grows beside its text instead (#398).
+test('auto-tagging at 390 wraps only the engine row', async ({ page, request }) => {
+    await page.setViewportSize({ width: 390, height: 844 });
+    const concept = await conceptTagging(page, 'dark');
+    const production = await productionTagging(page, 'dark');
+    expect(diffInventory(mapTaggingConcept(concept, await savedTemplate(request, page)), production)).toEqual([]);
+    expect(production.rows.map(row => row.flexWrap)).toEqual(['wrap', 'nowrap', 'nowrap', 'nowrap', 'nowrap']);
+    expect(production.selectsFit).toEqual([true, true]);
+});
+
+/** Runs in the page: the open review dialog: its title, body and the concept's tokens. */
+function measureReview() {
+    const dialog = document.querySelector('dialog#modal[open]');
+    const css = (node, ...keys) => node ? Object.fromEntries(keys.map(key => [key, getComputedStyle(node)[key]])) : null;
+    const name = node => [node.localName, ...[...node.classList].sort()].join('.');
+    const text = node => node?.textContent.trim() ?? null;
+    const body = dialog.querySelector('#modal-body');
+    const grid = body.querySelector(':scope > dl.meta-grid');
+    const note = [...body.querySelectorAll(':scope > p.small')].at(-1);
+    const actions = body.querySelector(':scope > .dialog-actions');
+    return {
+        title: text(dialog.querySelector('#modal-title')),
+        tree: [...body.children].map(name),
+        heading: { text: text(body.querySelector(':scope > h3')),
+            ...css(body.querySelector(':scope > h3'), 'fontSize', 'fontWeight', 'color', 'marginBottom') },
+        grid: { rows: [...grid.children].map(row => [text(row.querySelector('dt')), text(row.querySelector('dd'))]),
+            ...css(grid, 'display', 'gridTemplateColumns', 'columnGap', 'rowGap'),
+            dt: css(grid.querySelector('dt'), 'fontSize', 'color', 'textTransform'), dd: css(grid.querySelector('dd'), 'fontSize', 'color') },
+        backup: body.querySelector(':scope > .notice') && { tree: [...body.querySelector(':scope > .notice').children].map(name),
+            text: [...body.querySelectorAll(':scope > .notice > div:first-child > *')].map(node => [node.localName, text(node)]),
+            buttons: [...body.querySelectorAll(':scope > .notice button')].map(text) },
+        note: { text: text(note), ...css(note, 'fontSize', 'color', 'marginTop') },
+        actions: { tree: [...actions.children].map(name), ...css(actions, 'display', 'justifyContent', 'columnGap', 'marginTop'),
+            buttons: [...actions.children].map(item => ({ text: text(item), className: item.className,
+                ...css(item, 'backgroundColor', 'color', 'fontSize', 'paddingTop', 'paddingLeft', 'borderTopColor') })) },
+    };
+}
+
+const number = value => value.toLocaleString('en-US');
+/** DEC11 (#379): the Time row the preview's estimate reads as (WD14 on the test server's processor). */
+function timeRow(plan) {
+    const minutes = Math.max(1, Math.ceil(plan.estimate_seconds / 60));
+    const text = minutes < 90 ? `about ${minutes} min`
+        : `about ${Math.floor(minutes / 60)} h${minutes % 60 ? ` ${minutes % 60} min` : ''}`;
+    return `${text} on a processor; a graphics card can be faster.`;
+}
+
+/**
+ * D134 (#379): the server's batch preview in the concept's review: "Review tag output images" with "Tag output images"
+ * as its `h3`, the model, policy, image counts, time estimate and settings in the concept's `dl.meta-grid` (Backup in
+ * the concept's wording), the estimate sentence in the concept's `p.small`, the D55 backup box and Cancel / "Start
+ * tagging".
+ */
+function mapBatchConcept(reference, plan) {
+    const [cancel, start] = reference.actions.buttons;
+    return {
+        ...reference,
+        title: 'Review tag output images',
+        tree: ['h3', 'dl.meta-grid', 'p.small', 'div.notice', 'div.dialog-actions'],
+        heading: { ...reference.heading, text: 'Tag output images' },
+        grid: { ...reference.grid, rows: [['Model', 'WD14 SwinV2 · ~400 MB'], ['Existing tags', 'Merge with existing'],
+            ['Images', number(plan.images)], ['Already auto-tagged', number(plan.already_tagged)],
+            ['Images to tag', `about ${number(plan.to_tag)}`], ['Time', timeRow(plan)],
+            ['Settings', `General 0.35 · Character 0.85 · up to ${number(plan.suggestion_limit)} tags per image`],
+            ['Backup', 'Create and verify before changes']] },
+        backup: { tree: ['div', 'div.row-actions'], text: [['h3', 'Back up the database first (recommended)'],
+            ['p', 'Downloads a copy of the prompts database before this operation changes any records.']], buttons: ['Back up now'] },
+        note: { ...reference.note, text: 'Nothing is written until you start. The number to tag is an estimate: images changed '
+            + 'since they were tagged are tagged again, and missing files are skipped. Activity reports what was tagged.' },
+        actions: { ...reference.actions, buttons: [cancel, { ...start, text: 'Start tagging' }] },
+    };
+}
+
+async function conceptReview(page, theme) {
+    await openConcept(page, 'system', theme);
+    await page.locator('#main .section-nav').getByRole('button', { name: 'Maintenance', exact: true }).click();
+    await page.locator('#main [data-plan="duplicate prompts"]').click();
+    await expect(page.locator('dialog#modal[open] #modal-title')).toHaveText('Review maintenance plan');
+    await page.mouse.move(0, 0);
+    return page.evaluate(measureReview);
+}
+
+async function productionReview(page, theme) {
+    await productionTagging(page, theme);
+    // Merge reviews every listed still image (#379): a batch with work, the full review the concept's shell is compared
+    // with.
+    await page.locator('#workspace-main #tag-existing').selectOption('merge');
+    const answer = page.waitForResponse(response => response.url().endsWith(PREVIEW_URL));
+    await page.locator('#workspace-main .operation').getByRole('button', { name: 'Review', exact: true }).click();
+    const plan = await (await answer).json();
+    await expect(page.locator('dialog#modal[open] #modal-title')).toHaveText('Review tag output images');
+    await page.mouse.move(0, 0);
+    return { plan, production: await page.evaluate(measureReview) };
+}
+
+for (const theme of THEMES) for (const [width, height] of SIZES) {
+    test(`tag output images review matches the concept ${theme} ${width}x${height}`, async ({ page }, testInfo) => {
+        await page.setViewportSize({ width, height });
+        const concept = await conceptReview(page, theme);
+        expect(concept.tree).toEqual(['p.demo-note', 'h3', 'dl.meta-grid', 'p.small', 'div.dialog-actions']);
+        await page.screenshot({ path: testInfo.outputPath(`concept-plan-review-${theme}-${width}.png`) });
+        const { plan, production } = await productionReview(page, theme);
+        // Under Merge every listed still image is tagged again: the batch has work to review.
+        expect(plan.to_tag).toBeGreaterThan(0);
+        expect(plan.estimate_device).toBe('cpu');
+        await page.screenshot({ path: testInfo.outputPath(`production-tagging-review-${theme}-${width}.png`) });
+        expect(diffInventory(mapBatchConcept(concept, plan), production)).toEqual([]);
+    });
+}
+
+/**
+ * D134 (CUJ 5): Replace after review never runs as a batch: the same review shell with the counts, the reason as its
+ * `p.small`, no backup box and only Cancel (the shared close-only review Integrations also uses).
+ */
+function mapCancelOnlyConcept(reference, plan) {
+    const [cancel] = reference.actions.buttons;
+    const mapped = mapBatchConcept(reference, plan);
+    return {
+        ...mapped,
+        tree: ['h3', 'dl.meta-grid', 'p.small', 'div.dialog-actions'],
+        grid: { ...mapped.grid, rows: mapped.grid.rows.map(([term, value]) => [term, term === 'Existing tags' ? 'Replace after review' : value]) },
+        backup: null,
+        note: { ...reference.note, text: 'Replacing tags needs a review of each image. Use Preview tagging review, or choose Skip or '
+            + 'Merge for a batch run.' },
+        actions: { ...reference.actions, tree: [reference.actions.tree[0]], buttons: [cancel] },
+    };
+}
+
+test('the Cancel-only review matches the concept review shell', async ({ page }) => {
+    await page.setViewportSize({ width: 1600, height: 1100 });
+    const concept = await conceptReview(page, 'dark');
+    await productionTagging(page, 'dark');
+    await page.locator('#workspace-main #tag-existing').selectOption('replace_after_review');
+    const answer = page.waitForResponse(response => response.url().endsWith(PREVIEW_URL));
+    await page.locator('#workspace-main .operation').getByRole('button', { name: 'Review', exact: true }).click();
+    const plan = await (await answer).json();
+    expect(plan.review_required).toBe(true);
+    await expect(page.locator('dialog#modal[open] #modal-title')).toHaveText('Review tag output images');
+    await page.mouse.move(0, 0);
+    expect(diffInventory(mapCancelOnlyConcept(concept, plan), await page.evaluate(measureReview))).toEqual([]);
+});
+
+test('tag output images review comparison detects mutations', async ({ page }) => {
+    await page.setViewportSize({ width: 1600, height: 1100 });
+    const concept = await conceptReview(page, 'dark');
+    const { plan } = await productionReview(page, 'dark');
+    const expected = mapBatchConcept(concept, plan);
+    const paths = async () => diffInventory(expected, await page.evaluate(measureReview)).map(item => item.path);
+    expect(await paths()).toEqual([]);
+    // Every label of the grid is compared (#379's rows included): a changed one is named by its row.
+    for (const [index, [term]] of expected.grid.rows.entries()) {
+        await page.evaluate(([at, label]) => {
+            document.querySelectorAll('dialog#modal[open] dl.meta-grid dt')[at].textContent = label;
+        }, [index, `${term}!`]);
+        expect(await paths()).toEqual([`grid.rows.${index}.0`]);
+        await page.evaluate(([at, label]) => {
+            document.querySelectorAll('dialog#modal[open] dl.meta-grid dt')[at].textContent = label;
+        }, [index, term]);
+    }
+    expect(await paths()).toEqual([]);
+    const undoGrid = await mutate(page, { css: 'dialog#modal dl.meta-grid { column-gap: 3px; }' });
+    expect(await paths()).toEqual(expect.arrayContaining(['grid.columnGap']));
+    await undoGrid();
+    const undoBox = await mutate(page, { remove: ['dialog#modal[open] #modal-body > .notice'] });
+    expect(await paths()).toEqual(expect.arrayContaining(['backup', 'tree.length']));
+    await undoBox();
+    expect(await paths()).toEqual([]);
+});
@@ -236,7 +236,7 @@ test('paired Tag dialog captures', async ({ page, request }, testInfo) => {
    await expect(await request.post('/__test__/tagging/models', { data: { unavailable: ['wd14-swinv2'] } })).toBeOK();
    await openTagDialog(page, 'production', 'dark');
    await generateWith(page, 'production').catch(() => {});
-    await expect(status()).toHaveText('WD14 SwinV2 is not downloaded. Download it from the legacy Auto-tag page.');
+    await expect(status()).toHaveText('WD14 SwinV2 is not downloaded. Download it in System › Auto-tagging.');
    await shot('production-unavailable');
    await expect(await request.post('/__test__/tagging/models', { data: { unavailable: [] } })).toBeOK();

@@ -0,0 +1,54 @@
+// A restore the open workspace page has not noticed yet (#413).
+//
+// Specs that restore through the API while a page is open check what the page does with a restore it did not see:
+// its next write is refused as "Prompt storage was restored since this dialog opened". But the page's Activity store
+// reads the job list every 15 s (activity-store.mjs POLL_MS), and a read the server answers while the restore job runs
+// makes the page follow it: when it finishes, the page is shown again from the restored data (S9, index.mjs
+// onRestoreFinished), which closes any open dialog. On a slow runner a restore can take longer than the time left to
+// the next read (CI run 40646112668: the restore took 16 s), so whether the page saw it depended on timing.
+//
+// `armUnseenRestores(page)`, before the page loads, passes every job-list read of the page through one route, so it
+// knows which reads the server has not answered yet. `unseenRestore(page, restoring)` then closes the gate, waits
+// for those reads' answers (sent before the restore began, they cannot list it), runs `restoring()`, and only after
+// it has answered lets the held reads go on: they read the restore as already ended, as a tab that read its job list
+// just before and just after the restore does. A restore that is never seen running never reloads the page.
+const JOBS = '**/prompt_manager/jobs';
+const gates = new WeakMap();
+
+/** Route `page`'s job-list reads through the restore gate. Call before the page's first navigation. */
+export async function armUnseenRestores(page) {
+    const gate = { closed: null, inFlight: 0, idle: [] };
+    gates.set(page, gate);
+    await page.route(JOBS, async route => {
+        if (gate.closed) {
+            await gate.closed;
+            return route.fallback();
+        }
+        gate.inFlight += 1;
+        try {
+            const response = await route.fetch();
+            await route.fulfill({ response }).catch(() => {});
+        } catch {
+            await route.abort().catch(() => {});
+        } finally {
+            gate.inFlight -= 1;
+            if (gate.inFlight === 0) for (const resolve of gate.idle.splice(0)) resolve();
+        }
+    });
+}
+
+/** Run `restoring()` (an API restore) unseen by `page`'s Activity store; resolves with what it resolves with. */
+export async function unseenRestore(page, restoring) {
+    const gate = gates.get(page);
+    if (!gate) throw new Error('armUnseenRestores(page) must run before the page loads');
+    let open;
+    gate.closed = new Promise(resolve => { open = resolve; });
+    try {
+        // Reads already on their way were sent before the restore: their answers cannot list it.
+        if (gate.inFlight > 0) await new Promise(resolve => gate.idle.push(resolve));
+        return await restoring();
+    } finally {
+        gate.closed = null;
+        open();
+    }
+}
--- a/Show More
+++ b/Show More