docs(audit): share review-only cleanup assessment (#334)

* refactor(thumbnails): one resolver for where previews live on disk (#320)

Add py/api/preview_store.py: the store of a source, a preview's path,
URL parts to disk, containment (owns), a write generation and the lock
around every preview's final rename. Every preview reader, writer and
remover now asks it instead of joining <source>/thumbnails by hand:
serve, on-demand, capture (its path resolved when the write starts),
the after-scan queue, the thumbnail plans and job payloads, clear, the
temp sweep, History covers, the auto-tag listing and the owned-preview
lookups.

Source mode only: every path is the one built before, so nothing
changes on disk or on the wire. A structural test keeps new
thumbnails joins out of the backend.

* refactor(thumbnails): keep the after-scan queue's store rule and pin the write lock (#320)

A planned target keeps the plan's own containment rule (inside the
store, as the thumbnail job writes it); captures keep the serve rule.
The structural test also covers PREVIEW_FOLDER joins and the
repo-root modules; the write-lock test asserts the lock instead of
waiting on a timer; new tests cover nested roots in the after-scan
queue and a legacy upper-case preview served through the resolver.

* feat(thumbnails): keep previews in one folder, set from config.json (#320)

thumbnails.location in config.json can now name one folder for every
source's previews: <folder>/<source key>/<rel>_thumb<ext>. A source key is
a readable slug plus a short hash of the source's identity, stored in the
folder's marker (.promptmanager-thumbnails.json) with the install that
made it. Serving, on-demand and capture writes, listings, clear, delete,
duplicates, the temp sweep and History covers all follow it; a leftover in
<source>/thumbnails is never served and other text under thumbnails/ is
refused.

A missing, unplugged or foreign folder is unavailable (a probe checks it
every 5 s within 2 s; a stalled or failing store call flips it at once):
originals are served, nothing is written anywhere, the folder is never
re-created, and generate, convert and clear answer 409
location-unavailable. A bad config value is unavailable too, never a
fall-back to the sources.

No UI yet: POST /settings refuses thumbnail_location (409
location-needs-move); GET /settings reports it with its path, the
thumbnail status without one. Sources inside or around the folder and a
library move into it are refused.

* fix(thumbnails): never follow a marker or a link out of the thumbnail folder (#320)

Marker keys are data, not paths: only a single <slug>-<hex> folder name
is ever joined onto the thumbnail folder; anything else is dropped and
logged. Every preview write and delete passes one ownership check (below a
key folder, lexically and resolved, no link, junction or reparse point on
the way); make_parent refuses anything else and writes nothing while the
folder lacks this install's marker (an unmounted mount point). Clear never
descends into a junction.

The configured location is in force before any request (unchecked folder
mode is unavailable), and a startup check that fails leaves it invalid,
never the sources. Older listings that run on the event loop no longer
touch the store in folder mode. A leftover under another case of
thumbnails/ on a case-insensitive disk is refused too.

* test(memory): let the musl test fake os.confstr on Windows (#523)

The portability run on main fails since #523: Windows has no
os.confstr, so patching it without create=True raises before the test
runs.

* feat(thumbnails): move thumbnails between the sources and one folder (#320)

POST /images/thumbnails/plan reviews a move (what is copied, removed and
left, free space, too-long Windows paths, sources no longer listed) and
hands out a token; POST /jobs/thumbnails {mode: move} runs it as a
thumbnails job: hold automatic previews, copy and check every preview on
the job pool, switch with one config commit that records the old copies,
then remove them. Per-file errors still switch; a folder-wide error, a
cancel before the switch or a crash leaves nothing changed (a journal is
undone at the next start); old copies that could not go are removed by a
finishing job at the next start. Leaving a folder removes the previews of
this install's sources that are no longer listed (Q320-8).

Recreate folder and Use this folder answer an unavailable folder; the
Thumbnail maintenance scope prune removes the thumbnails of removed
sources.

* feat(system): choose where thumbnails are kept and move them (#320)

System › Sources & scans gains the Thumbnail location row (D196): Inside
each source or One folder, the folder path, the status line and Review
move…, whose review (D197) lists what is copied, removed and left before
Move thumbnails starts; a refused folder is explained under the field, a
folder of your own asks for a confirmation first. Activity shows a move
and a prune with their own tiles and step line (D198). An unavailable
folder shows a notice on Overview and Sources & scans with Recreate folder
or Use this folder (D199). Thumbnail maintenance offers Remove thumbnails
of removed sources in folder mode (D200), and Move library's review says
where the thumbnails stay (D201).

Closes #320

* fix(thumbnails): keep a move's own previews and never walk out of a store (#320)

A cleanup that waited from an earlier move never names a key folder the
new move just filled, so moving back keeps the previews. Removing empty
folders walks top-down and never into a link or junction. Any error
while copying undoes the copies; once the switch is committed, a journal
that cannot be removed no longer undoes it. Hand-edited cleanup entries
and marker keys never name a folder outside the stores; removal stops at
interpreter exit. The path field carries aria-invalid with its reason,
and a review that went stale reviews again.

* test(thumbnails): cover the prune scope, the Overview notice and the space refusal (#320)

The frontend coverage gate counted the new branches of thumbnail
maintenance, the Activity views, the notices' Change location and the
api-client's space refusal as uncovered; page and unit tests now drive
them.

* fix(thumbnails): report removals that fail and explain the quiet excepts (#320)

An old thumbnail the finishing move cannot remove (held open on Windows)
is now an error row of the job with its path, and logged; a failed copy's
temp that cannot go is logged with its path. Every except that only
passes says why, and the thread runners say their caller re-raises.

* fix(thumbnails): never plan or delete through a linked key folder (#320)

Review finding P1 on #591: in folder mode a source key folder that is a
link or junction to a folder outside was still handed to the planner, so
Convert outdated could remove an older-format file outside the thumbnail
folder. ensure_store now refuses a linked store before any planning, and
each removal of an old preview passes may_write at the moment it runs.

* fix(thumbnails): the temp sweep never walks into a link (#320)

Review finding P2 on #591: Clear thumbnails and the startup sweep removed
crashed-write temps with a plain os.walk, which on Windows walks into a
junction even without followlinks. The sweeper now skips a folder that is
a link, junction or reparse point (the top one too), and each temp passes
may_write before it is removed.

* fix(thumbnails): lock the folder marker across processes (#320)

Review finding P2 on #591: two installs sharing one thumbnail folder could
each read the marker, add a key and replace it, so the last writer
dropped the other's key. write_marker now re-reads, changes and replaces
the marker under a lock file made with O_CREAT | O_EXCL beside it (atomic
on shares, unlike flock); a lock older than 30 s, left by a writer that
died, is taken over, and a wait past 1.5 s fails as a TimeoutError like
an unreachable folder. Tested with three processes adding keys at once.

* test(thumbnails): cover the space refusal, Overview's Use this folder and the prune review (#320)

The frontend coverage floors of activity-kinds, system-overview and
thumbnail-review: a disk without the space shows the review but cannot
move (a fixture route fakes the free space), Use this folder on Overview
reloads the host values, the prune review's text and rows are pure
functions with unit tests, and Overview takes the System drafts it is
always mounted with.

* fix(thumbnails): never copy through a linked folder; refuse a target inside the folder in use (#320)

Moving back to Inside each source followed an existing linked folder in the
destination and could replace a file outside the source (Codex P1). A target
nested inside the thumbnail folder in use was accepted, and the old-copy
cleanup then removed the previews just copied there (Codex P2).

Every copy now checks the whole destination chain for links, also when the
folders exist, and the move refuses a folder inside the one in use with
location-inside-current. The cancelled branches no longer mix explicit and
implicit returns (code-quality note).

* fix(system): one full stop in the move-back review (#320)

* fix(thumbnails): a folder check answers for the folder as it is now (#320)

Probe.check() joined a check already running, or a finished one nobody had
collected. A folder deleted right after configure() woke the probe therefore
stayed available until the next probe, which failed the Overview notice spec in
the merge queue. It now waits for a running check and starts a new one, still
never two at once, and a stuck check still times out. The spec also asserts the
fixture's removal took effect.

.github/workflows/portability.yml

@@ -1,9 +1,9 @@
-name: Windows and macOS
+name: Windows
 
 permissions:
   contents: read
 
-# Non-blocking portability runs (#420): never on pull requests or in the merge queue, and no context
+# Non-blocking Windows runs (#420; macOS dropped from CI in #571): never on pull requests or in the merge queue, and no context
 # here is a required check. A red run is fixed at its cause before the workspace cutover (#334).
 on:
   push:
@@ -25,10 +25,7 @@ env:
 # run counts (tests/vendor/ci-workflow.test.mjs recomputes it, #493).
 # Measured 2026-10-29 on main runs 40935337099 (dd247e3), 40938407252 (dd247e3), 40941240624 (dd247e3):
 #   slowest leg: 7m24s (py3.12 windows) / 7m31s (py3.13 windows) / 7m32s (py3.14 windows) -> 15 min
-#     (windows 4m56s-7m32s, macos 4m39s-6m14s)
-#   native-trash (#499) has no green main runs yet: its probe, run 40949370943 (2026-10-29), took
-#     about 1 minute per macOS leg, so ceil(1.5 x 2) + 3 gives it 6 minutes (step 4). Recalibrate
-#     after three green runs.
+#     (windows 4m56s-7m32s)
 #   native-trash-linux (#543) has no green main runs yet: it installs the dev requirements and runs
 #     one test module, about 1 minute by the same estimate, so ceil(1.5 x 2) + 3 gives it 6 minutes.
 #     Recalibrate after three green runs.
@@ -40,7 +37,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [windows-latest, macos-latest]
+        os: [windows-latest]
         python-version: ["3.12", "3.13", "3.14"]
 
     steps:
@@ -60,7 +57,7 @@ jobs:
 
       # The runner's TEMP is on C:, the OS disk, where a flush took about 6 ms
       # and a test database's create-to-delete about 111 ms; on the D: work
-      # disk the same took 0.5 ms and 23 ms (macOS: 19 ms). Tests write their
+      # disk the same took 0.5 ms and 23 ms. Tests write their
       # databases under TEMP, so it moves to a folder on D: (measured in #487,
       # run 40915866444). The runner's TEMP was an 8.3 short name
       # (C:\Users\RUNNER~1\...), so the new one is spelled by its short name too
@@ -83,31 +80,6 @@ jobs:
           PM_TEST_SLOWEST: "40"
         run: python -m tests.run_suite -v
 
-  # The real Trash on both macOS CPUs (#499 design §10.2). It runs apart from the suite, so a red
-  # suite never skips the native proof.
-  native-trash:
-    name: native trash on ${{ matrix.os }}
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 6
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [macos-latest, macos-15-intel]
-
-    steps:
-      - uses: actions/checkout@v7
-
-      - name: Set up Python
-        uses: actions/setup-python@v7
-        with:
-          python-version: "3.12"
-
-      - name: Native trash proof
-        timeout-minutes: 4
-        env:
-          PM_NATIVE_TRASH: macos
-        run: python -m unittest tests.test_trash_macos_native tests.test_trash_macos -v
-
   # The same tests as the fake mount table, on a real ext4 mount used as the output root (#543). A
   # runner can mount with sudo; the tests run as the normal user, so owner and mode checks are real.
   native-trash-linux:

.github/workflows/test.yml

@@ -28,7 +28,7 @@ env:
 #   py matrix, slowest py3.10 on windows-latest: 12m43s / 15m54s / 14m53s -> 27 min
 #     (ubuntu 5m27s-6m27s, macos 6m14s-8m30s, windows 11m42s-15m54s)
 #     3.10 and 3.11 left the matrix and 3.14 joined it in #356; re-measure after three green main runs.
-#     Windows and macOS moved to portability.yml (#420), which has its own measured limit (#493);
+#     Windows moved to portability.yml (#420; macOS left CI in #571), which has its own measured limit (#493);
 #     this Linux-only matrix keeps 27 minutes until it is re-measured.
 #   real ComfyUI compatibility: 13m32s / 8m55s / 11m46s -> 24 min
 #   coverage gate (85%): 7m26s / 7m22s / 7m54s -> 15 min
@@ -39,7 +39,7 @@ env:
 # Pull requests run a fast subset (#420): Python 3.12 on ubuntu-latest, coverage, lint and frontend
 # modules. The merge queue (merge_group), pushes to main and manual runs add Python 3.13 and 3.14 on
 # Linux and the real ComfyUI job. "all tests" is the required gate that holds the queue to that set.
-# Windows and macOS run in portability.yml (push to main, nightly, on demand) and never gate a merge.
+# Windows runs in portability.yml (push to main, nightly, on demand) and never gate a merge.
 jobs:
   test:
     name: py${{ matrix.python-version }} on ${{ matrix.os }}

.github/workflows/viewerjs-check.yml

@@ -41,9 +41,13 @@ concurrency:
 # 7.3m-12.2m), because --shard splits by test count and the slow concept specs sort into shard 1. The page
 # workflows now run in three shards per browser with the limits unchanged; the per-shard times are
 # re-measured after three green main runs.
+# #563: coverage shards reached their 18-minute step limit three times on 2026-10-31 with no failing
+# test (PR #560 shard 2/3: 814 passed in 17.9m; queue run 41206495451 shard 1/3: 827 passed; PR #564
+# shard 2/3 twice), against recent green shards of 11m-17m. Coverage now runs in four shards with the
+# limits unchanged; the per-shard times are re-measured after three green main runs.
 jobs:
   frontend-coverage:
-    name: frontend coverage (shard ${{ matrix.shard }}/3)
+    name: frontend coverage (shard ${{ matrix.shard }}/4)
     runs-on: ubuntu-latest
     # Layout comparisons depend on the fonts each browser falls back to, so browser jobs run in the
     # same pinned Playwright image as local runs (tag = @playwright/test in tools/vendor/package-lock.json;
@@ -59,7 +63,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        shard: [1, 2, 3]
+        shard: [1, 2, 3, 4]
     steps:
       - uses: actions/checkout@v7
       # The image's own Python 3.12 and Node 24: setup-python/setup-node install the runner's toolcache
@@ -88,13 +92,13 @@ jobs:
       - run: npm ci --prefix tools/vendor --ignore-scripts
       # Shard 1 also runs the node units and the viewer suite, so the vendor pins and the tooling tests
       # run on the lightest shard instead.
-      - if: matrix.shard == 3
+      - if: matrix.shard == 4
         run: npm run --prefix tools/vendor check
-      - if: matrix.shard == 3
+      - if: matrix.shard == 4
         run: npm run --prefix tools/vendor test
-      - name: Page workflows with coverage, shard ${{ matrix.shard }}/3
+      - name: Page workflows with coverage, shard ${{ matrix.shard }}/4
         timeout-minutes: 18
-        run: npm run --prefix tools/vendor test:coverage:shard -- ${{ matrix.shard }}/3
+        run: npm run --prefix tools/vendor test:coverage:shard -- ${{ matrix.shard }}/4
       - name: Upload raw coverage
         uses: actions/upload-artifact@v7
         with:
@@ -136,13 +140,13 @@ jobs:
         with:
           pattern: coverage-raw-*
           path: ${{ runner.temp }}/coverage-raw
-      # coverage:merge only checks that raw files exist; merging two of three shards would report
+      # coverage:merge only checks that raw files exist; merging three of four shards would report
       # partial coverage, so a missing or empty shard artifact fails here.
       - name: Verify every shard's raw coverage arrived
         shell: bash
         env:
           STAGED_RAW: ${{ runner.temp }}/coverage-raw
-          EXPECTED_SHARDS: 3
+          EXPECTED_SHARDS: 4
         run: |
           found=0
           for shard in $(seq 1 "$EXPECTED_SHARDS"); do

README.md

@@ -167,6 +167,8 @@ Searches your library by text, category, tags and minimum rating, then outputs t
 
 ![Prompt Search List node producing three images](assets/readme/node-search.webp)
 
+To get the images of a Search List batch linked to their prompts, wire the Search List output into a Prompt Manager Text node, not straight into CLIP Text Encode. Wired straight in, the images stay unlinked: the search text is never saved as a prompt.
+
 ## Install
 
 **Requirements:** ComfyUI and Python 3.12 or newer. `watchdog` and `Pillow` are the only dependencies of their own; the rest comes with ComfyUI.
@@ -236,12 +238,12 @@ The documentation for those pages is in [README-legacy.md](README-legacy.md).
 
 | Layer | What runs |
 | --- | --- |
-| Python | Over 200 test files on Linux, Windows and macOS with Python 3.12 to 3.14, with an 85% coverage gate |
+| Python | Over 200 test files on Linux and Windows with Python 3.12 to 3.14, with an 85% coverage gate |
 | Frontend | About 100 unit test files, with coverage floors per file |
 | Browser | Over 60 Playwright spec files in Chromium, Firefox, WebKit and touch emulation |
 | Real ComfyUI | A pinned CPU ComfyUI, started in Classic and Nodes 2.0, running real workflows |
 
-Linux runs on every pull request and in the merge queue. Windows and macOS run on every push to main and nightly. To run the tests yourself, see [TESTING.md](TESTING.md).
+Linux runs on every pull request and in the merge queue. Windows runs on every push to main and nightly. macOS is not tested; it should work, but support is best-effort. To run the tests yourself, see [TESTING.md](TESTING.md).
 
 ## License
 

TESTING.md

@@ -74,14 +74,14 @@ V8 files it writes under `coverage/js/raw`:
 
 ```sh
 PM_TEST_WORKERS=8 npm run --prefix tools/vendor test:coverage            # whole run, one report
-npm run --prefix tools/vendor test:coverage:shard -- 1/3                 # node units, viewer suite, workflows 1/3
-npm run --prefix tools/vendor test:coverage:shard -- 2/3                 # workflows 2/3 (likewise 3/3)
+npm run --prefix tools/vendor test:coverage:shard -- 1/4                 # node units, viewer suite, workflows 1/4
+npm run --prefix tools/vendor test:coverage:shard -- 2/4                 # workflows 2/4 (likewise 3/4, 4/4)
 npm run --prefix tools/vendor coverage:merge                             # report and baseline check of every raw file
 npm run --prefix tools/vendor test:workflows -- --project webkit --shard 2/2
 ```
 
 `coverage:merge` refuses an empty raw directory; it does not count shards, so run
-every shard first (CI's merge job checks all three arrived). Measured on a 32-CPU
+every shard first (CI's merge job checks all four arrived). Measured on a 32-CPU
 machine in the pinned image (2026-10-21): `test:coverage` takes about 5 minutes
 with 8 workers and 24 minutes with 1; all four projects, 8 workers, each test 3
 times (6132 tests), 24 minutes. A CI-sized run (`docker run --cpus=4`,
@@ -189,14 +189,14 @@ check, so run it before pushing a new or deleted frontend file instead of
 waiting for the `frontend coverage` jobs.
 
 The `viewerjs` check runs on every PR, including backend-only changes. It is an
-aggregate job. It requires the three `frontend coverage (shard N/3)` jobs and
+aggregate job. It requires the four `frontend coverage (shard N/4)` jobs and
 `frontend coverage (merge)` to succeed on every event. The four
 `page workflows (firefox|webkit, shard N/2)` jobs run only in the merge queue,
 on `main` and on `workflow_dispatch` (see "Pull requests and the merge queue").
 `viewerjs` requires them to be skipped on a pull request and to succeed
 everywhere else. Any other failed, cancelled or skipped job fails it. Every browser job runs with `PM_TEST_WORKERS: 3` (the public
-runners have 4 vCPUs). Each coverage shard runs `test:coverage:shard -- N/3`
-(shard 1 also runs the node units and the viewer suite, shard 3 the vendor pins
+runners have 4 vCPUs). Each coverage shard runs `test:coverage:shard -- N/4`
+(shard 1 also runs the node units and the viewer suite, shard 4 the vendor pins
 and tooling tests) and uploads its raw V8 files as `coverage-raw-N` (kept 3
 days). The merge job downloads them, fails unless all three arrived with raw
 files and without clashing names, then runs `coverage:merge` (report plus
@@ -261,7 +261,7 @@ the process exits non-zero.
   job fails anyway and the dump is what matters.
 - `PM_TEST_SLOWEST=N` (off by default) lists the N slowest tests after the
   summary, each timed from its `start:` line to the next one like the hang
-  limit. The Windows and macOS jobs (`portability.yml`) set it to 40, so every
+  limit. The Windows jobs (`portability.yml`) set it to 40, so every
   run shows where its time went (#487). The list prints only when the run
   ends: a job GitHub cancels or a watchdog exit prints none, so read the
   timestamps between `start:` lines instead.
@@ -327,7 +327,7 @@ Python 3.13/3.14, real ComfyUI and Firefox/WebKit failures first show up in the
 merge queue, on the merge-group commit rather than the
 pushed one. Find that run with `gh run list --event merge_group --workflow test.yml`
 (or `viewerjs-check.yml`) and match its head branch
-(`gh-readonly-queue/main/pr-<N>-...`). Windows and macOS failures show up only
+(`gh-readonly-queue/main/pr-<N>-...`). Windows failures show up only
 after the merge, in `gh run list --workflow portability.yml`.
 
 Start fixing as soon as a failed log shows the cause, but push the fix only after
@@ -345,11 +345,16 @@ and the time left. The steps, in order:
    monitor's callbacks (Needs review recorder, preview queue, Images listing
    listener).
 2. `ImageMonitor.stop_monitoring` works against one 5 s deadline. Closing the
-   image handler joins the image worker; watchdog's `observer.stop()` (not
-   bounded here) and the observer join get what is left, which can be 0 s.
-3. `close_auto_thumbnails(final=True)` stops the preview worker (30 s) and
-   kills ffmpeg.
-4. `PromptTracker.shutdown` stops the prompt cleanup thread (2 s).
+   image handler joins the image worker; watchdog's `observer.stop()` and the
+   observer join get what is left, which can be 0 s. `stop()` joins watchdog's
+   emitters without a limit, so it runs on a daemon thread and is waited for
+   only until the deadline; a later stop waits for that same call (#561).
+3. `close_auto_thumbnails(final=True)` stops the preview worker (30 s),
+   kills ffmpeg and shuts the interactive image pool down.
+4. `shutdown_job_pool` (`utils/parallel.py`) cancels the long-lived job pool's
+   queued items and joins its threads (5 s; part `workers`, only when a job
+   used the pool, #523).
+5. `PromptTracker.shutdown` stops the prompt cleanup thread (2 s).
 
 A failing step, or a second Ctrl+C, is logged with its traceback and does not
 skip the later steps. A clean run logs one INFO line to PromptManager's log:
@@ -361,6 +366,15 @@ stored, with the parts not reached False, and the `atexit` callback is
 removed: the later steps are skipped, no summary line is logged, and a later
 call returns that result and runs nothing.
 
+The observer is started from a short-lived daemon thread, so every thread it
+creates is a daemon (a thread inherits that flag from the thread that creates
+it). watchdog 7 on Windows starts a plain `threading.Thread` per watch for its
+`ReadDirectoryChangesW` reader; created from ComfyUI's main thread it would not
+be a daemon, and the interpreter waits for every such thread before it runs any
+`atexit` callback, so the teardown would never start (#561).
+`tests/test_package_exit.py` runs a child whose observer does both (a plain
+reader thread, a `stop()` that never returns) and requires its exit.
+
 ComfyUI never runs aiohttp's `on_cleanup` hooks, because it never calls
 `runner.cleanup()`. So `atexit` is the live host's path. It runs on Ctrl+C
 (`main.py` catches `KeyboardInterrupt` and returns) and on a normal exit.
@@ -445,12 +459,44 @@ A hot SQLite read that returns many rows aggregates them into one step
 (`json_group_array`) instead of stepping once per row, so it does not wait for
 the GIL once per row while ComfyUI generates (#354, `get_image_link_matches`).
 
+A metadata read never decodes pixels (#523). Pillow's `PngImageFile.text` loads
+every pixel to reach text chunks after IDAT; the scan (`_extract_comfyui_metadata`)
+and the image monitor (`ComfyUIMetadataExtractor.extract_metadata`) read PNG text
+through `utils/png_text.py`, which runs Pillow's own chunk handlers after the
+first IDAT and seeks over pixel data. The legacy `.text` read is the floor:
+`tests/test_png_text.py` compares both readers on every image under
+`tests/fixtures`, a curated corpus (text after IDAT, zTXt, iTXt, split IDAT, bad
+checksums, truncations, oversized text, APNG) and a seeded fuzz, and asserts that
+neither reader decodes pixels by patching `ImageFile.load`. The only reads that
+differ are files whose pixel data is undecodable or cut short: legacy found
+nothing, the walk keeps the text before the pixels. Animated PNGs still use
+`.text`.
+
+Image work runs on PromptManager's own threads (#523). glibc keeps each thread's
+malloc arena at its high-water mark, so image buffers spread over the default
+executor's threads stay resident. Interactive image work (view previews behind their
+gate, workspace card facts, both inspector routes) runs on the API's fixed
+`pm-image` pool (`IMAGE_POOL_SIZE` 3, `_run_image`, `_map_image`; card facts already
+cached answer without a trip; while the gate's 3 preview writes hold every thread, a
+card or inspector read waits for one of them, by design of the merged pool; after the
+package teardown the pool is not recreated and late calls use the default executor). Jobs (scan metadata and file facts, thumbnail and
+convert jobs, the legacy gallery generation, capture previews) run through
+`map_parallel` on one long-lived `pm-worker` pool of Worker threads, reused between
+jobs; a new Worker threads value replaces it (the teardown also joins a replaced pool
+still finishing), and a call made from a job thread runs inline. After a scan, thumbnail or convert job, or the legacy gallery generation,
+`release_free_memory` (`utils/native_memory.py`) calls glibc's `malloc_trim(0)` once;
+it does nothing on Windows, macOS and musl and never raises. No allocator setting
+changes. `tests/test_image_pools.py` asserts the thread of each read and write and the
+trim; `tests/test_utils_parallel.py` the pool's reuse, resize, nesting and shutdown.
+`tools/perf/memory_drive.py` (manual, Linux, never in CI) measures RSS, heap, threads
+and arenas under the #523 load against the disposable browser test server.
+
 The `perf budget` job in `.github/workflows/test.yml` is the reference
 measurement: `ubuntu-latest`, one Python, no coverage, only the wall-clock tests.
 It runs on every push to `main` and on `workflow_dispatch`, never on pull
 requests, because shared-runner timing must not block a merge. Dispatch it on a
 branch to measure before merging.
-Shared Windows and macOS runners do not run them; the structural tests cover
+Shared Windows runners do not run them; the structural tests cover
 portability. Run it locally with
 `PROMPTMANAGER_PERF_BUDGET=1 python -m unittest tests.test_api_workspace_images.TestWorkspaceImages.test_filter_budget`
 and quote the printed p95 in the PR body.
@@ -646,10 +692,10 @@ Before changing paths, SQLite, streams, restore or cleanup:
   ordinary busy timeout; cross-thread handoffs wait on events with generous
   ceilings, never a short wall clock (#242).
 - Run native Windows CI early for these changes. Pull requests and the merge
-  queue run only Linux, so start Windows and macOS on the branch with
+  queue run only Linux, so start Windows on the branch with
   `gh workflow run portability.yml --ref <branch>`.
-  Include a Windows impact and evidence note in the PR. All six Windows/macOS
-  combinations in that run, every Linux leg and every applicable
+  Include a Windows impact and evidence note in the PR. All three Windows
+  legs in that run, every Linux leg and every applicable
   exact-head check must pass before merge. Portable `ntpath`/`PureWindowsPath`
   controls do not establish native filesystem, locking or cleanup success.
 
@@ -664,11 +710,11 @@ what runs:
 | `py3.13 on ubuntu-latest`, `py3.14 on ubuntu-latest` | not created | run |
 | `real ComfyUI compatibility` | skipped | runs |
 | `coverage gate (85%)`, `black and flake8`, `frontend modules`, `bandit (high severity)` | run | run |
-| `frontend coverage (shard N/3)`, `frontend coverage (merge)` (vendor pins and tooling tests on shard 3) | run | run |
+| `frontend coverage (shard N/4)`, `frontend coverage (merge)` (vendor pins and tooling tests on shard 4) | run | run |
 | `page workflows (firefox\|webkit, shard N/2)` | skipped | run |
 | `all tests`, `viewerjs` (gates) | run | run |
 | `perf budget` | skipped | push and dispatch only (not in the queue) |
-| `py3.12-3.14 on windows-latest/macos-latest` (`portability.yml`) | not run | push to `main`, nightly, `workflow_dispatch` only; never required |
+| `py3.12-3.14 on windows-latest` (`portability.yml`) | not run | push to `main`, nightly, `workflow_dispatch` only; never required |
 
 GitHub has one required set for pull requests and the queue. A job skipped by
 its `if:` reports Success. A dropped matrix leg never reports, so it would stay
@@ -681,8 +727,9 @@ guarantee:
 So a merge group cannot turn green unless all three Linux Python legs, real
 ComfyUI and the four browser shards passed.
 
-Windows and macOS (Python 3.12-3.14) are out of the blocking path for now
-(maintainer, 2026-10-28). They run in `portability.yml` on every push to `main`,
+Windows (Python 3.12-3.14) is out of the blocking path for now
+(maintainer, 2026-10-28). macOS is not tested in CI (maintainer, 2026-10-31, #571);
+its code stays and support is best-effort. They run in `portability.yml` on every push to `main`,
 nightly and on demand, and no context there is required. A red portability run
 is still a failure: fix it at its cause, not by rerunning, and have every one
 green before the workspace cutover (#334). `tests/vendor/ci-workflow.test.mjs` pins the
@@ -1407,6 +1454,8 @@ is shorter than the row it reserves.
 Each Overview card is the count of the page it names: the shell's Library, Images and Tags sidebar counts, one source,
 so a card and its badge cannot differ. `/prompt_manager/stats` is for the legacy page and counts raw rows. A visit re-reads
 the three unless a read is in flight. An unread or failed card shows a dash; Retry re-reads only the failed counts.
+System › Overview's Images metric reads the same shell count (#555), so it, the Overview card and the Images badge show
+one number; its Statistics dialog labels the legacy row counts as "Database records".
 Tests: `tests/js/workspace-state.test.js`, `tests/browser/workspace.spec.mjs`, `tests/comfyui/workspace.spec.mjs`.
 
 ### Images page controls and recorded deviations (#249 PR C)
@@ -1837,7 +1886,8 @@ Inspect plan keeps D60–D66 (plan D60 → D83, D61 → D84, D65 → D88, D68
   engines in the mock's order with legacy labels and sizes (`WD14 SwinV2 · ~400
   MB`, `WD14 ViT · ~400 MB`, `GGUF JoyCaption (Recommended) · ~4.5 GB` in the
   mock's Ollama slot, `HuggingFace JoyCaption · ~16 GB`); the instructions start
-  from the server's `default_prompt`.
+  from the chosen engine's default saved instructions (#431, D204; before, the
+  server's `default_prompt`).
 - **D91** (plan D68, ruling T3-bulk): a **Suggestions** number field (1–100) for
   every model, prefilled from `autotag.defaults.suggestion_limit` (10); a model
   change keeps it.
@@ -2549,8 +2599,8 @@ files to the system trash. **No code path unlinks or overwrites a media file.**
   ("Moving files to the Recycle Bin isn't available on Windows: files larger than the bin's
   capacity would be deleted permanently."). Library-only removal works everywhere. Tests use `tests/fake_trash.py`; the
   browser test server installs it, so no test touches a real trash. The native proof,
-  `tests/test_trash_macos_native.py`, runs only with `PM_NATIVE_TRASH=macos` in
-  portability.yml's `native-trash` job (`macos-latest` and `macos-15-intel`): the startup
+  `tests/test_trash_macos_native.py`, runs only with `PM_NATIVE_TRASH=macos` on a Mac, by hand
+  (CI dropped its `native-trash` macOS job in #571; it last passed on `macos-latest` and `macos-15-intel`): the startup
   volume, a name clash, fresh APFS and FAT32 disk images, an image used as an output root,
   a read-only image and an unwritable folder (design and probe:
   `docs/egm/499-macos-trash/`, local).
@@ -2929,7 +2979,8 @@ change: ComfyUI needs a restart.
 A Pair save, by a run or the node's Save pair button, writes the category and tags to the positive prompt only when that
 save creates the prompt row (maintainer ruling). An existing prompt never changes on a run: empty, cleared or set by a person, including one first seen as
 another pair's negative. The negative stays empty, the saved pair keeps its own metadata, and `save_prompt_pair` writes
-no prompt metadata unless called with `fill_new_positive`. No backfill; optional repair is #550.
+no prompt metadata unless called with `fill_new_positive`. No backfill on a run; the opt-in repair for prompts older
+Pair runs saved is System › Maintenance › "Pair category and tags" (#550, "Pair category and tags repair" below).
 Tests: `tests/test_prompt_pair_node.py`, `tests/test_api_pairs.py`, `tests/comfyui/pair-node.spec.mjs`. A Python change: ComfyUI needs a restart.
 
 ### Delete… on the archived shelf (#492)
@@ -3844,8 +3895,8 @@ workspace never asks; previews are a cache the server keeps:
 - `GET /images/serve/thumbnails/<rel>_thumb<ext>` for a missing preview is refused as
   text first (traversal, a backslash, a drive or stream colon, empty or dot segments, so
   `D:/x`, `\\server\share` and a leading `/` never reach a joined path), then admitted
-  on the event loop (`_PreviewGate`): 3 previews are written at once on the API's own
-  `pm-preview` pool (never the default executor), one flight runs per file (the history
+  on the event loop (`_PreviewGate`): 3 previews are written at once on the API's
+  interactive `pm-image` pool (never the default executor; #523), one flight runs per file (the history
   route shares the flight key and the admission), and at most 64 requests wait; one
   more gets its fallback at once without listing a folder. Inside the admission the
   preview maps back to its media file under the same root (exact names, then one folder
@@ -3878,7 +3929,7 @@ workspace never asks; previews are a cache the server keeps:
   `exclusive` job runs (`_auto_thumbnail_blocker`), checked when a write starts (after
   its slot) and again just before its rename.
 - Shutdown is bounded and logged: the worker stops at a file boundary, ffmpeg is
-  killed, an idle worker leaves (the next output starts a fresh one), the view pool
+  killed, an idle worker leaves (the next output starts a fresh one), the image pool
   shuts down, and after the app's cleanup a late monitor event
   starts nothing. A package reload stops the workers the previous import left.
 - Cards and strips load previews only: Images in every layout and size, Library cards,
@@ -4006,7 +4057,11 @@ the per-section hand-off panel, was retired by S12 (#329): every section is nati
   "Save preferences" is `aria-disabled` (opacity .55, `not-allowed`) while clean or
   saving; a setting the last save could not save gets a red outline. CSS under D92.
 - **D93** (Overview): real values. The metrics are the Library's eligible positives
-  and active saved negatives and the indexed `generated_images` rows (Q2). "Database
+  and active saved negatives and the Images count (#555, amending Q2's indexed
+  `generated_images` rows): the shell's Images sidebar count, the Images page's own
+  total, which also lists files no row links, as the concept's `images.length` is
+  both. A visit re-reads it unless a read is in flight; "–" until read or after a
+  failed read. `images.indexed` stays in the API and is not shown. "Database
   integrity" is "Not checked" until a check ran this session, then "N issues" (checks
   that found issues, even beside a check that could not run), "Passed" or "Incomplete".
   The review row is "N ambiguous image links" (the Needs review queue's pending count,
@@ -4044,10 +4099,11 @@ the per-section hand-off panel, was retired by S12 (#329): every section is nati
 - **D96** (Statistics; amended by D153): "Usage statistics" without the sample note: the
   concept's "Runs by category" table without its Avg. rating column (Category / Runs)
   with the real runs of eligible parents per category ("Uncategorized"), then a second
-  table "Library totals" (Total / Count: Prompts, Tags, Images from the legacy
-  statistics; no Rated images). The API still reports `average_rating` and
+  table "Database records" (Total / Count: Prompt records, Tags on prompts, Image
+  records: the raw row counts of the legacy statistics, labelled as rows so they never
+  read as the Library or Images page counts, #555; no Rated images). The API still reports `average_rating` and
   `rated_images`; the workspace does not show them.
-  The Overview row says "Runs by category, with library totals." because
+  The Overview row says "Runs by category, with database record counts." because
   that is what the dialog shows (the concept's own dialog shows only "Runs by
   category"); per-prompt run counts, prompt tags and dated runs are recorded, but no
   table of them exists yet. A failed read toasts "Statistics could not
@@ -4253,6 +4309,12 @@ the per-section hand-off panel, was retired by S12 (#329): every section is nati
   primary stays the concept's plain button; the plan it opens has the primary.
   `duplicates dialog matches the concept` and `duplicates comparison detects mutations`
   (system-maintenance-concept.spec) pin the mapping.
+- **D192** (Maintenance, #550, beyond the concept): Database adds "Pair category and
+  tags" after "Unused prompt components", a plain Review plan row (no danger mark: it
+  deletes nothing) with the line "Fill an empty category or tags on prompts older Pair
+  node runs saved, from their saved pairs. Only empty fields of never-edited prompts."
+  `system-maintenance-concept.spec.mjs` maps it (`mapPairRow`) as a copy of Optimize
+  database's row.
 - **D102** (Maintenance, S7, Q5, #222): Metadata cache clears only the browser entries
   Prompt Manager owns as a cache (`web/js/cache-ownership.js`). The inventory of every
   storage writer has none (see "Browser cache ownership" below), so the row's line adds
@@ -4350,6 +4412,23 @@ the per-section hand-off panel, was retired by S12 (#329): every section is nati
   choice. The host's checks still refuse a linked field or a changed workflow, and the
   sender also refuses if the destination's `revision` (node object plus graph version)
   moved since discovery; it is undefined on an older tab, which skips the comparison. A host error reads as a refusal, not "may have applied".
+- **D191** (#542, beyond the concept; maintainer 2026-10-31, Q542-1 A to 5 A): a window with two or more
+  eligible nodes adds a last Destination node option "All N eligible nodes" (`ALL_NODES` in
+  `prompt-sender.mjs`), never selected for you (D173). Eligible is D173's filter; the nodes it leaves out
+  stay counted in the discovery sentence. One window only. Preview stays optional (D175): Preview changes
+  shows one `section.prompt-sender-node` per node, headed "#<id> <title>", in send order (node id,
+  numeric). Apply previews every node first and writes nothing if any refuses ("#<id> <title>: <reason>
+  Nothing was sent."). Then it sends one node after another. Only the first node of a pass taken in that
+  click keeps its ticket; every other node, and every node of a held Preview (host tickets expire after
+  30 s), takes a fresh ticket that is refused unless its Before texts and composition equal the reviewed
+  ones. That fresh preview checks the discovered revision until something has been posted, and not after,
+  since our own write may move the graph version. Refusals are best effort: "Sent to 2 of 3 nodes in
+  <window>. #12 <title>: <host's refusal>."; Apply stays available and a retry sends to every node again
+  (rewriting the same text). A lost reply stops the run, names that node as unknown and lists the nodes
+  not sent. Closing the dialog stops after the current node. The review sections are labelled by their
+  `h4` node heading. Unit tests in `tests/js/prompt-sender.test.js`, a fake three-node host in
+  `tests/browser/prompt-inspector.spec.mjs`, real Classic and Nodes 2.0 widgets in
+  `tests/comfyui/prompt-sender.spec.mjs`.
 - **D106** (Integrations, S10, Q8): the send bridge always asks for the ComfyUI window
   and node, and the nodes always follow ComfyUI's own renderer, so "Default send
   destination" offers only "Ask each time" and "Host compatibility" only "Follow host
@@ -4535,9 +4614,9 @@ the per-section hand-off panel, was retired by S12 (#329): every section is nati
   engine and policy (read-only) and opens "Review tag output images" in the concept's
   record-changing review (its `maintenancePlan` shell): `h3` "Tag output images", the
   `dl.meta-grid` Model, Existing tags, Images, Already auto-tagged, Images to tag
-  ("about N"), Time, Settings ("General <g> · Character <c>" or "Template of N
-  characters", then " · up to L tags per image" with the preview's saved
-  `suggestion_limit`) and Backup, the estimate sentence ("Nothing is written until you
+  ("about N"), Time, Settings ("General <g> · Character <c>", then " · up to L tags
+  per image" with the preview's saved `suggestion_limit`; for a language model, since
+  D205, an "Instructions" row and "Up to L tags per image") and Backup, the estimate sentence ("Nothing is written until you
   start. The number to tag is an estimate: images changed since they were tagged are
   tagged again, and missing files are skipped. Activity reports what was tagged.") in the
   `p.small`, the D55 backup box and Cancel / "Start tagging", which starts the
@@ -4559,6 +4638,71 @@ the per-section hand-off panel, was retired by S12 (#329): every section is nati
   Cancel-only review matches the concept review shell` (system-tagging-concept.spec) and
   the batch tests of workspace-system-tagging.spec; the mutation check renames each grid
   label in turn.
+- **D202** (Auto-tagging, #431, beyond the concept): a "Skipped tags" block
+  (`.setting-block`, `data-setting="tag-skipped"`, `data-key="autotag_skipped_tags"`)
+  follows "Suggestions per image": the label and description in the concept's
+  setting-row tokens ("Suggested tags that contain one of these words are hidden.
+  Words are separated by spaces, _ or -; other characters such as ( ) belong to the
+  word."), an "Add a word or words" input (`#tag-skipped-input`) with Add (Enter adds
+  too), the entries as removable chips in the Tag image dialog's D83 chip markup (each
+  with its count, title "Hides N tags", or muted "none" with "Hides no known tag"), and
+  a `role="status"` preview line: "**Hides N tags from suggestions**: <up to 12>[ and K
+  more]. Tags already on images are not changed." ("Checked against library tags only;
+  no WD14 label list is downloaded." before the last sentence without a label list;
+  "No tags are skipped." for an empty list; "Checking…" while waiting; "The preview
+  could not be read." on failure). The client refuses an entry with "Enter a word.",
+  "No commas or line breaks.", "At most 50 characters.", "Already in the list." or "The
+  list is full (200)." under the input. The Tag image dialog's chip hint adds "N skipped
+  tags were not suggested." when the server hid any (the static mock's copy). Pinned by
+  the comparison's mapping (system-tagging-concept.spec: the block's tokens are the
+  concept row's), `skipped tags add, preview, remove, save and reload (D202)`, `skipped
+  tags preview checks library tags only …` (workspace-system-tagging.spec) and
+  `suggestions omit skipped tags and say how many were hidden` (workspace-tagging.spec).
+- **D203** (Auto-tagging, #431, beyond the concept): "Saved instructions" replaces the
+  concept's "LLM tag template" field (the mock's state 2): a `.setting-block`
+  (`data-setting="tag-instructions"`, `data-key="autotag_instructions"`) with the label,
+  "Instructions for the language-model engines. Built-in can’t be changed; duplicate it
+  to make your own. N of 20 saved · Built‑in is not counted.", a `role="listbox"` list
+  (Built-in first with a "Read-only" chip, then the saved entries; "Default for GGUF" /
+  "Default for HuggingFace" chips), "+ New" ("New instructions", "(2)" if taken),
+  "Duplicate" ("<name> copy"), "Delete" (`.danger`, disabled for Built-in), "At most 20
+  saved instructions." at the cap, and the editor beside the list (under it below 700px):
+  "Name" ("N of 60") and "Text" ("N of 4,000 characters"), read-only for Built-in with
+  "Built-in instructions can’t be changed. Duplicate them to make your own.", else the
+  entry's problem ("The name “X” is already used.", "The text must not be empty."…).
+  Then two concept select rows, "Default for GGUF JoyCaption" and "Default for
+  HuggingFace JoyCaption" ("The Tag image dialog and batches start from this.",
+  `data-key="autotag_default_instructions"`), and the note a deleted default leaves
+  ("GGUF now uses Built-in."; nothing is written until Save preferences). Pinned by the
+  comparison's mapping (system-tagging-concept.spec: the block in the concept row's
+  tokens, the two rows on the concept's select row) and `saved instructions: new, edit,
+  per-engine default, delete, save and reload (D203)`, `a refused instructions save names
+  the entry and highlights the block (D203)` (workspace-system-tagging.spec).
+- **D204** (Tag image and Auto-tag selected dialogs, #431, beyond the concept): for a
+  language-model engine a "Saved instructions" select (`#image-tag-instructions-pick`,
+  `#bulk-tag-instructions-pick`) sits above "Tagging instructions" (the mock's state 3),
+  on the concept's select field: Built-in, then the saved entries (`GET /autotag/models`
+  `instructions`, full text), the engine's default marked "<name> · default". It starts
+  at that default; a pick replaces the text. The text stays editable for the run: while
+  it differs from the picked entry the select shows a disabled "Edited for this run" and
+  a muted line under the textarea reads "Edits apply to this run only. Manage saved
+  instructions in System › Auto-tagging." Choosing an entry again replaces the edit.
+  Switching between GGUF and HF starts from the new engine's default and drops an edit;
+  WD14 hides both. A preset (Preview tagging review, the bulk review) shows the entry
+  with its text, else "Edited for this run". When the read fails the select holds only
+  Built-in with the client's copy (`BUILTIN_INSTRUCTIONS`, pinned equal to
+  `DEFAULT_TAG_TEMPLATE` by workspace-image-tagging-state.test). Request bodies are
+  unchanged (`options.instructions` is the textarea's text); there is no "Save as new".
+  The workspace no longer reads `default_prompt`. Pinned by the tagging comparison's
+  mapping (tagging-canonical-comparison.mjs: the select before the instructions),
+  `the saved instructions picker fills, edits one-off and resets per engine (D204)`
+  (workspace-tagging.spec) and `Auto-tag selected picks saved instructions and sends the
+  text shown (D204)` (workspace-tagging-bulk.spec).
+- **D205** (Auto-tagging, #431; amends D134): for a language-model engine the batch
+  review adds a read-only "Instructions" row with the drafted engine default's name
+  before "Settings", which reads "Up to L tags per image"; the batch and Preview tagging
+  review send that entry's text. WD14 is unchanged. Pinned by `the batch review names the
+  language model's default instructions (D205)` (workspace-system-tagging.spec).
 - **D158** (Sources, #247 D-Q4): the concept has no switch for prompts from workflows
   without a PromptManager node; the maintainer chose a visible switch over a config key.
   A `.setting-row` in the concept's toggle markup follows "Watch for new outputs":
@@ -4790,6 +4934,47 @@ replaced the database since the review; the plan is dropped). The job:
    prompt ids only), logs the backup by its file name, and prunes safety backups to the
    newest 10. With no backup the log and the status line say "No safety backup".
 
+#### Pair category and tags repair (#550)
+
+`pair_metadata` ("Pair category and tags", D192; `database/pair_metadata_repair.py`) fills
+the empty category and the empty tag set of prompts that Pair node runs before #546
+saved, from their saved pairs. It is reviewed and applied like the operations above and
+follows the safety backup policy like them (no forced backup). Rules
+(`docs/egm/post-3.4.1/550-design.md`):
+
+- Considered: prompts the Pair node created as a positive: their earliest pair (lowest
+  id, either role, archived included) has them as the positive and its `created_at` is
+  within 2 s of theirs. A prompt first saved by the PromptManager node, or first as a
+  negative, is out of scope and not counted.
+- Sources: the prompt's non-archived pairs where it is the positive; pairs with a blank
+  category or no tags are ignored for that field. Category values are trimmed and
+  case-sensitive, tag sets compared by tag id; a field fills when exactly one value is
+  left. A whitespace-only category counts as empty.
+- Kept, per field, in this order: archived prompt, edited prompt (`updated_at` not within
+  2 s of `created_at`; NULL or unreadable counts as edited), pairs that disagree, a tag
+  set over 20 tags. A prompt can fill one field and keep the other.
+- The plan lists protected rows first, then fills, then a "Record" row, within the 50
+  detail rows; at most 20,000 prompts per plan ("review again for the rest").
+- The fingerprint covers each considered prompt's computed result (values, tag ids and
+  names, source pair ids), never a pair's title, notes, rating, run count or use
+  stamps, so a Pair run between review and apply still applies.
+- The apply's writes are guarded (`category` still blank, no `prompt_tags` row) and a
+  guard that hits nothing rolls the whole transaction back as `plan-changed`. It never
+  writes `prompt_pairs`, `prompt_pair_tags`, `updated_at`, a tag or Library state.
+- The job lists 200 changed rows ("Prompt 12: category “night”; tags a, b"); its
+  Download report lists every one (`truncated: false`, `Job.record_counted(complete=True)`).
+  Protected lists one row per kept prompt in the review's wording and order ("Prompt 7:
+  kept, pairs disagree on category: Adult, asian"), also complete in the report.
+- Activity shows a row with no path as a record: its detail as plain text, never an open
+  or locate action, and the filter reads the detail. A maintenance job of records (every
+  operation but Missing-file links) says "No records in this group.", "No listed record
+  matches this filter." and "Filter records…" (`groupCopy`); file jobs keep "files".
+
+Tests: `tests/test_maintenance_pair_metadata.py`, `tests/test_api_maintenance_pair_metadata.py`,
+`tests/test_jobs.py`, `tests/js/workspace-system-maintenance.test.js`,
+`tests/browser/workspace-system-maintenance.spec.mjs` (hook `/__test__/system/pair-metadata`).
+A Python change: ComfyUI needs a restart.
+
 The legacy restore (`POST /prompt_manager/restore`) takes a backup of any size the disks
 have room for, so a real library's safety backup restores: the upload, its staged copy
 and the swap (the upload twice in the temporary folder, once more plus the current
@@ -5144,16 +5329,16 @@ server-side tagging configuration, `autotag.defaults` in config.json: `model_typ
 (`wd14-swinv2`, `wd14-vit`, `gguf`, `hf`), `existing` (`skip`, `merge`,
 `replace_after_review`), `general_threshold` and `character_threshold` (0–1 in
 steps of 0.05, #369),
-`template` (non-blank, at most 4,000 characters and 16 KiB) and `suggestion_limit`
-(1–100). They are host drafts (`autotag_model_type`, `autotag_existing`,
-`autotag_general_threshold`, `autotag_character_threshold`, `autotag_template`,
-`autotag_suggestion_limit`) saved by the one Save row through `POST
+`suggestion_limit` (1–100), and since #431 `skipped_tags`, `instructions` and
+`default_instructions` (below). They are host drafts (`autotag_model_type`, `autotag_existing`,
+`autotag_general_threshold`, `autotag_character_threshold`, `autotag_suggestion_limit`,
+`autotag_skipped_tags`, `autotag_instructions`, `autotag_default_instructions`) saved by the one Save row through `POST
 /prompt_manager/settings` with `expected_revision`; a bad value is refused with a 400
 naming the setting by its row label ("General-tag confidence must be between 0 and
 1."), nothing is written, the Save row shows that sentence (`invalid-setting`, set by
 `settingRefusal` in system.mjs only for a save that carried `autotag_*` keys; every
 other section's plain 400 keeps the generic status) and the control is highlighted.
-The template's limit counts code points, as Python's `len` does. A hand-edited bad value
+Instruction text limits count code points, as Python's `len` does. A hand-edited bad value
 falls back to its default on load, one key at a time. Every page shows the thresholds in
 steps of 0.05 (the System rows, the Tag image dialogs, the legacy sliders), so a saved
 threshold off that grid is refused ("General-tag confidence must be a multiple of
@@ -5164,8 +5349,70 @@ stored exactly on the grid (#369). A per-request threshold keeps its own check:
 `validate_options` and starts the `autotag` job titled "Tag output images (legacy page)";
 the legacy `/autotag/single` only requires a number. `GET /autotag/models` reports the
 saved values (`wd14_general_threshold`, `wd14_character_threshold`, `suggestion_limit`,
-`default_prompt`, `model_type`, `existing`), so the Tag image and Auto-tag selected
-dialogs start from them; a preset (the bulk review, Preview tagging review) wins.
+`default_prompt`, `model_type`, `existing`, and since #431 `instructions` and
+`default_instructions`), so the Tag image and Auto-tag selected dialogs start from them;
+a preset (the bulk review, Preview tagging review) wins.
+
+**Saved instructions** (#431, D203, D205): `autotag.defaults.instructions` holds the
+saved entries `[{id, name, text}]` in order (at most 20; `id` 12 lowercase hex made by
+the client, unique, `builtin` reserved; `name` trimmed, 1–60 characters, no control
+character, unique case-folded, not "Built-in"; `text` as `validate_template`), and
+`autotag.defaults.default_instructions` is `{gguf, hf}`, each `builtin` or a saved id.
+Built-in (`{id: "builtin", name: "Built-in", text: DEFAULT_TAG_TEMPLATE}`) is never
+stored; readers put it first (`AutotagConfig.all_instructions`), so a later release's
+built-in text reaches everyone who uses it. Refusals (400, the Save row shows them and
+highlights the editor): "Saved instructions: at most 20 entries besides Built-in.",
+"Saved instructions: entry N has an invalid id.", "… repeats the id of entry M.", "…
+needs a name.", "… name must be at most 60 characters.", "… name must not contain a line
+break.", "… name “X” is already used.", "Saved instructions: the name “Built-in” is
+reserved.", "Saved instructions: entry N text must be …", "Default for GGUF JoyCaption
+must be one of the saved instructions." (and HuggingFace). A save carrying either key
+without `expected_revision` is refused ("Reload the page and try again."); a save
+carrying one is paired with the other from the running configuration and both are
+written, plus the old `template` key as the GGUF default's text (deleted when that
+default is Built-in), so an older build reads that default as its one template. `POST`
+with `autotag_template` is refused ("LLM tag template was replaced by Saved instructions.
+Reload the page."); `GET` keeps returning it (the GGUF default's text, read-only) for one
+release and adds `autotag_builtin_instructions` (Built-in's text, read-only). Load: each
+key alone (a damaged list → Built-in only, a default naming nothing → Built-in, each with
+one warning), then the in-memory migration of the old `template`: with no `instructions`
+key, a template other than Built-in becomes "Custom template" (id = first 12 hex of its
+SHA-256), the default of both engines unless `default_instructions` is stored; with the
+key, a template matching no entry (edited on an older build) is appended as "Custom
+template (n)" with one INFO line (a full list: one WARNING, nothing imported). Nothing is
+written at load; the next save that carries either key writes the list.
+`AutotagConfig.default_instructions_text(engine)` feeds the legacy batch and single
+blank-prompt fallbacks (by the request's engine) and `default_prompt`. Tests:
+`tests/test_saved_instructions.py`, `tests/test_saved_instructions_routes.py`,
+`tests/js/workspace-system-instructions.test.js`.
+
+**Skipped tags** (#431, D202): `autotag.defaults.skipped_tags`, host draft
+`autotag_skipped_tags`, a list of at most 200 entries, each trimmed, 1–50 code points,
+no comma or control character, at least one word, no two with the same words (refused
+with "Skipped tags: at most 200 entries.", "Skipped tags: entry N is empty.", "… must be
+at most 50 characters.", "… must not contain a comma or a line break.", "… repeats entry
+M."); a save carrying it without `expected_revision` is refused ("Reload the page and try
+again."). A damaged saved list falls back to none with one warning. Words are the
+NFC, case-folded text split on runs of space, `_` and `-` (`tag_words`); an entry hides
+a suggested tag whose words contain the entry's words consecutively (`SkipMatcher`:
+`blurry` hides `very_blurry` and `blurry_background`, not `unblurry`; `(fate)` hides
+`saber_(fate)`, `fate` does not). `generate_tag_suggestions(skip=)` drops a match after
+the name check and before the dedupe and the limit, so skipped tags use up no slot
+(WD14 fills from lower scores; a language model may return fewer). Every path filters:
+`/image-annotations/suggest` (compiled per request; the answer adds `skipped`, the
+number of distinct names it hid), `/autotag/single`, and the `image-tags` (Auto-tag
+selected) and `autotag` (System batch, legacy `/autotag/start`) jobs, which snapshot the
+list at their start and log "Skipped tags: N entries" or "Skipped tags: none"; a save
+during a run does not change it. Hand-typed and stored tags are never filtered; the
+language models' hard-coded exclude list (`_parse_tags`) runs first. `POST
+/prompt_manager/autotag/skipped-tags/preview {entries}` (validated as a save) answers
+`count`, `sample` (12, library tags first, each part sorted case-folded),
+`sample_limit`, `per_entry [{entry, count}]` and `sources {library, wd14}` over the
+library's tags plus the category 0/4 names of each downloaded WD14 `selected_tags.csv`
+(read as UTF-8, cached by mtime and size; a missing list is skipped). It loads no model,
+opens no image, writes nothing and is `409 busy` while an exclusive job runs. Tests:
+`tests/test_skipped_tags.py`, `tests/test_skipped_tags_routes.py`, the settings and
+config tests, `tests/js/workspace-system-skipped-tags.test.js`.
 
 `GET /prompt_manager/autotag/models` reads the disk in the executor, never loads or
 downloads a model and carries no absolute path: per engine `name`, `label`,
@@ -5413,7 +5660,7 @@ list stay unscoped: any row's control proves them.
 | Worker threads | `admin.html:437–445` | S4 Sources | covered | `sources` · slider · "Worker threads" | worker range max is cpu_count (workspace-system-sources.spec.mjs) |
 | LoraManager badge, enable, path, trigger words, CivitAI key, clear key | `admin.html:448–490`; `admin.js:1052–1156` | S10 Integrations | covered | `integrations` · switch · "LoraManager integration" | LoRA rows show detected / enabled / cache-loaded separately (workspace-system-integrations.spec.mjs) |
 | LoRA data import with progress | `admin.html:492–498,517–541`; `admin.js:1157` | S10 Integrations | covered | `integrations` · button · "Review import" | Review import shows replacement, blocked items and network effects with the backup box; Start opens the job (D107) (workspace-system-integrations.spec.mjs) |
-| Statistics | `admin.html:159`; `admin.js:1627` | S2 Overview | covered | `overview` · button · "Explore" | statistics dialog lists runs by category and library totals (workspace-system.spec.mjs) |
+| Statistics | `admin.html:159`; `admin.js:1627` | S2 Overview | covered | `overview` · button · "Explore" | statistics dialog lists runs by category and database record counts (workspace-system.spec.mjs) |
 | Export components JSON `/export` | `admin.html:163`; `admin.js:1607`; `py/api/prompts.py:238` | S9 Backup & export | covered | `backups` · button · "Export all prompts JSON" | Export JSON downloads /library/export; secondary buttons download all prompts (/export) and /pairs/export (D103) (workspace-system-backups.spec.mjs) |
 | Saved pairs export | `py/api/pairs.py:84` | S9 Backup & export | covered | `backups` · button · "Export saved pairs JSON" | Export JSON downloads /library/export; secondary buttons download all prompts (/export) and /pairs/export (D103) (workspace-system-backups.spec.mjs) |
 | Library export | `py/api/library.py:223` | S9 Backup & export | covered | `backups` · button · "Export JSON" | Export JSON downloads /library/export; secondary buttons download all prompts (/export) and /pairs/export (D103) (workspace-system-backups.spec.mjs) |
@@ -5652,6 +5899,73 @@ are closed before `os.replace`; renames stay inside one folder; folder identity
 folder are refused. The browser test server closes its own log handlers before its temp
 root (which now holds the logs) is removed.
 
+### Thumbnail location contract (#320)
+
+Previews live in each source's `thumbnails/` (the default) or in one folder, `<folder>/<source key>/…`. Every reader,
+writer and remover asks `py/api/preview_store.py`; `tests/test_preview_store.py` fails on a `thumbnails` path join
+anywhere else. The setting is `thumbnails.location` in config.json, and only the Move thumbnails job writes it: POST
+`/settings` answers 409 `location-needs-move`.
+
+- **Keys and marker.** A key is a slug plus a hash of the source's identity. The folder's
+  `.promptmanager-thumbnails.json` stores each key with its identity and install. Only a single `<slug>-<hex>` name
+  is ever joined onto the folder, and anything else in a marker is dropped. Every write and delete passes
+  `preview_store.may_write`: below a key folder, with no link, junction or reparse point on the way
+  (`tests/test_preview_store_folder.py`, including tampered markers).
+- **Unavailable.** A folder is unavailable when it is missing, is a link, holds no marker or holds another
+  folder's marker. A probe checks it every 5 s, and a store call that fails or stalls marks it at once. While it is
+  unavailable:
+  - originals are served and nothing is written anywhere;
+  - generate, convert, clear and prune answer 409 `location-unavailable`;
+  - the folder is never made again except by Recreate folder.
+
+  The configured location is in force before any request. A bad value is `invalid`, never a fall-back to the
+  sources.
+- **Move thumbnails.** The job is a `thumbnails` job with `scope.mode` `move` (`tests/test_thumbnail_move.py`). It
+  runs in this order:
+  1. The review answers `POST /images/thumbnails/plan`; not enough space answers 507.
+  2. A token starts the job.
+  3. Automatic previews are held.
+  4. Copies run on the job pool in chunks of 2 or 4 files, each with its size checked and its mtime rounded up to
+     2 s.
+  5. One config commit makes the switch and records the old stores under `cleanup`. The job cannot be cancelled
+     from here.
+  6. The old copies are removed.
+
+  If it fails or is cancelled before the switch, nothing changes. A crash leaves
+  `<data>/data/thumbnail-move.json`, which the next start undoes. Old copies still held open are removed by the
+  next start's "Move thumbnails (finishing)" job. Leaving a folder also removes the previews of this install's
+  sources that are no longer listed (Q320-8).
+- **Remove thumbnails of removed sources** (`scope.mode` `prune`). It is offered in Thumbnail maintenance only in
+  folder mode, and it touches only this install's keys.
+- **Page tests.** `tests/browser/workspace-thumbnail-location.spec.mjs` covers the row, both moves, the in-place
+  refusal, the confirmation, the notice with Recreate and with Use this folder. The legacy gallery runs once in
+  folder mode (`workflows.spec.mjs`). The hooks are `tests/browser/thumbnail_location_fixture.py`.
+
+Beyond the concept, against the approved static mock `docs/egm/post-3.4.1/320-mock`:
+
+- D196: the Thumbnail location row in System › Sources & scans, after Thumbnail generation.
+  - The status line is "Now: inside each source." or "Now: one folder, <path>.". It does not show the mock's
+    "(3 sources, 8,512 thumbnails)" counts, because counting means walking every preview on each view. It says
+    "Using the default folder next to your library." and names old copies that wait to be removed.
+- D197: the Move thumbnails review uses the shared review.
+  - A grid value may be a lead sentence with a list (`[lead, items]`).
+  - Sources no longer listed appear under "Removed after the move", where the mock has a "Not moved" row
+    (maintainer answer to Q320-8: remove).
+  - The Free space line is "<size> free", without naming the disk.
+- D198: Activity's view of `mode: move` and `mode: prune`.
+  - Tiles for a move: Moved, Already there, Left in place, Errors. Tiles for a prune: Removed, Left in place,
+    Errors.
+  - The step line under the bar is `#job-phase`.
+  - Cancel shows only until the switch.
+- D199: the unavailable notice on Overview and Sources & scans.
+  - Recreate folder appears for a missing folder, after a confirmation.
+  - Use this folder appears for another folder's marker.
+  - Change location focuses the row; on Overview it opens Sources & scans.
+- D200: Thumbnail maintenance's "Remove thumbnails of removed sources" scope, with the plan line and a grid of
+  key folders.
+- D201: Move library's review adds "Thumbnails: Stay in <path>. Move them in System › Sources & scans." in folder
+  mode.
+
 ### Backup and restore contract (#249 System S8)
 
 A restore is staged, then published (`database/restore_stage.py`). The upload is

__init__.py

@@ -92,10 +92,21 @@ try:
     routes = config.routes
     api = PromptManagerAPI()
     api.add_routes(routes)
-    # Temp files of preview writes a crash interrupted (#317), off the
-    # import path: the walk may cover a large thumbnails folder.
+
+    # The thumbnail location's startup check (#320), then the temp files of
+    # preview writes a crash interrupted (#317), off the import path: the
+    # walk may cover a large thumbnails folder.
+    # #320: the configured thumbnail location is in force before any request
+    # (no I/O); the thread below checks it.
+    api.use_preview_location()
+
+    def _preview_startup():
+        api.start_preview_location()
+        api.recover_thumbnail_move()  # an interrupted move, before the sweep
+        api.sweep_thumbnail_temps()
+
     threading.Thread(
-        target=api.sweep_thumbnail_temps,
+        target=_preview_startup,
         name="PromptManagerPreviewTempSweep",
         daemon=True,
     ).start()
@@ -108,6 +119,8 @@ try:
         # Build each output root's Images listing once the server's loop runs,
         # so the first open does not wait for the walk (#348).
         host_app.on_startup.append(api.warm_gallery_listings)
+        # #320: old thumbnails a move left to remove, once it is checked.
+        host_app.on_startup.append(api.finish_thumbnail_move)
     if host_app is not None and hasattr(host_app, "on_shutdown"):
         # Open Needs review change streams end before the server waits on them.
         host_app.on_shutdown.append(api.close_review_events)
@@ -280,11 +293,11 @@ def _teardown_logger():
 
 
 def _stop_background_work():
-    """Stop the image monitor, the preview worker and the prompt cleanup
-    thread against one TEARDOWN_SECONDS deadline, once.
+    """Stop the image monitor, the preview worker, the job worker threads
+    and the prompt cleanup thread against one TEARDOWN_SECONDS deadline, once.
 
-    Returns ``{"monitor", "thumbnails", "tracker"}`` booleans (True: it
-    stopped), leaving out parts that never started. Later calls return a
+    Returns ``{"monitor", "thumbnails", "workers", "tracker"}`` booleans
+    (True: it stopped), leaving out parts that never started. Later calls return a
     copy of the first result. A Ctrl+C inside a step is logged and the
     step is False; one between steps is re-raised after the result (parts
     not reached are False) is stored and the ``atexit`` entry removed.
@@ -298,11 +311,14 @@ def _stop_background_work():
             api,
             _global_prompt_tracker,
         )
+        from .utils import parallel
+
         # A part whose global is set has started; False until its step says
         # otherwise, so an interrupt between steps leaves an honest result.
         started = (
             ("monitor", monitor),
             ("thumbnails", thumbnails),
+            ("workers", parallel.job_pool_started() or None),
             ("tracker", tracker),
         )
         result = {name: False for name, part in started if part is not None}
@@ -345,6 +361,16 @@ def _stop_background_work():
                 result["thumbnails"] = _teardown_step(
                     "the preview worker", close_previews, logger
                 )
+            if "workers" in result:
+
+                def stop_workers():
+                    from .utils.parallel import JOB_POOL_JOIN_SECONDS
+
+                    return parallel.shutdown_job_pool(left(JOB_POOL_JOIN_SECONDS))
+
+                result["workers"] = _teardown_step(
+                    "the job worker threads", stop_workers, logger
+                )
             if tracker is not None:
 
                 def stop_tracker():
@@ -435,12 +461,12 @@ except Exception as e:
 
 __all__ = ["NODE_CLASS_MAPPINGS", "NODE_DISPLAY_NAME_MAPPINGS", "WEB_DIRECTORY"]
 
-# Print startup message with loaded tools
-print()
-print(f"\033[94m[ComfyUI-PromptManager] Version:\033[0m {get_version()}")
-for node_key, display_name in NODE_DISPLAY_NAME_MAPPINGS.items():
-    # ASCII only: a Windows console using a legacy code page cannot print emoji,
-    # and a UnicodeEncodeError here would abort loading the whole node.
-    print(f"  \033[94mLoaded:\033[0m {display_name}")
-print(f"\033[94mTotal: {len(NODE_CLASS_MAPPINGS)} tools loaded\033[0m")
-print()
+# One startup line, printed at import on purpose: it is the package's banner on
+# stdout, as ComfyUI's other custom nodes print theirs. Not a log record: the
+# console log handler hides INFO by default, so a logger would drop it. ASCII
+# only: a Windows console using a legacy code page cannot print emoji, and a
+# UnicodeEncodeError here would abort loading the node.
+print(
+    f"\033[94m[ComfyUI-PromptManager] Version:\033[0m {get_version()}"
+    f" - {len(NODE_CLASS_MAPPINGS)} tools loaded"
+)

database/health.py

@@ -199,6 +199,23 @@ def link_states(rows, roots, readable):
     check's ``missing_files`` and the maintenance missing-link plan both
     judge links this way, so their counts agree.
     """
+    for row, owner, state in _placed_links(rows, roots, readable):
+        if state is None:
+            state = "present" if os.path.exists(row[1]) else "missing"
+        yield row, owner, state
+
+
+def held_links(rows, roots, readable):
+    """``(row, owner, state)`` for each link ``link_states`` holds back
+    (``unavailable`` or ``outside``), without looking at any file (#586)."""
+    for row, owner, state in _placed_links(rows, roots, readable):
+        if state is not None:
+            yield row, owner, state
+
+
+def _placed_links(rows, roots, readable):
+    """``link_states`` before any file is looked at: state None means the
+    link lies under a readable source."""
     prefixes = [_root_prefix(root) for root in roots]
     for row in rows:
         owner = _image_owner(row[1], row[3], prefixes)
@@ -206,10 +223,8 @@ def link_states(rows, roots, readable):
             yield row, None, "outside"
         elif not readable[owner]:
             yield row, owner, "unavailable"
-        elif os.path.exists(row[1]):
-            yield row, owner, "present"
         else:
-            yield row, owner, "missing"
+            yield row, owner, None
 
 
 def _unavailable_line(unavailable, *, partial):

database/library_move.py

@@ -78,6 +78,10 @@ MESSAGES = {
     ),
     "same-folder": "The new folder is the node folder itself.",
     "target-invalid": "The new folder cannot hold the library.",
+    "data-dir-served": (
+        "The new folder is inside Prompt Manager's thumbnail folder. Nothing was "
+        "moved."
+    ),
     "target-has-library": (
         "The new folder already holds a Prompt Manager library. Nothing was moved."
     ),

database/maintenance.py

@@ -2,7 +2,8 @@
 
 Four operations, each the native owner of a legacy ``/maintenance`` one and
 built on the same queries, so a preview counts what the legacy cleanup would
-change:
+change (``workflow_storage`` and #550's ``pair_metadata``, which fills old
+Pair prompts' empty category and tags, live in their own modules):
 
 - ``duplicate_prompts``: prompts whose text is equal ignoring case and outer
   spaces (``DUPLICATE_PROMPTS_SQL``, legacy ``cleanup_duplicates``); each
@@ -42,7 +43,7 @@ from dataclasses import dataclass, field
 from pathlib import Path
 
 from .execution_contexts import LIVE_HINT_CTES
-from .health import BATCH_ROWS, link_states, readable_roots, readonly_uri
+from .health import BATCH_ROWS, held_links, link_states, readable_roots, readonly_uri
 from .image_removal_schema import TABLE as MARKS_TABLE
 from .image_removal_schema import clear_marks, has_marks_table
 from .pairs import PairDependencyError
@@ -60,6 +61,9 @@ MAINTENANCE_OPERATIONS = (
     "missing_links",
     # Applied as its own batched job (database/workflow_storage.py).
     "workflow_storage",
+    # #550: fill old Pair prompts' empty category and tags
+    # (database/pair_metadata_repair.py).
+    "pair_metadata",
 )
 MAX_DETAILS = 50  # detail rows a plan lists
 MAX_RESULT_ROWS = 200  # changed records an apply describes (the job lists 200)
@@ -126,6 +130,16 @@ _UNLINKED_PROTECTIONS_SQL = (
     + "), 0) FROM prompts p WHERE NOT EXISTS "
     "(SELECT 1 FROM generated_images gi WHERE gi.prompt_id = p.id)"
 )
+# Each prompt no image links to, with which protections keep it (#586); the
+# ones with none are filtered out in Python, so each predicate runs once.
+_UNLINKED_KEPT_SQL = (
+    "WITH "
+    + LIVE_HINT_CTES
+    + " SELECT p.id, "
+    + ", ".join(f"({predicate})" for predicate, _many, _one in PROTECTIONS)
+    + " FROM prompts p WHERE NOT EXISTS "
+    "(SELECT 1 FROM generated_images gi WHERE gi.prompt_id = p.id) ORDER BY p.id"
+)
 
 # Duplicate prompt groups, as the legacy cleanup finds them (case-insensitive
 # text; GROUP_CONCAT order is sorted by created_at afterwards).
@@ -155,6 +169,14 @@ _PROMPT_STATE_SQL = (
     "ORDER BY id",
 )
 
+# Why the missing-link cleanup holds a link back: (one, many) (#586).
+HELD_LINK_REASONS = {
+    "unavailable": (
+        "link under an unavailable source",
+        "links under unavailable sources",
+    ),
+    "outside": ("link outside the image sources", "links outside the image sources"),
+}
 NO_FILES_DELETED = "No image file is deleted."
 LINKS_ONLY = "Database links only; no image file is deleted."
 UNUSED_DETAIL = "No image, saved pair, Library state or recorded run uses it"
@@ -168,6 +190,7 @@ CONFLICT_REASONS = {
         "groups have their own Library titles",
     ),
 }
+PAIRED_DETAIL = "Kept: belongs to a saved pair"
 CONFLICT_DETAILS = {
     "collision": "Kept: two copies link the same image",
     "title": "Kept: a copy has its own Library title",
@@ -409,6 +432,35 @@ def _source_name(root, index):
     return os.path.basename(str(root).rstrip("\\/")) or f"Source {index + 1}"
 
 
+def _kept_duplicates(paired, conflicted):
+    """``{prompt_id, reasons}`` for each prompt of a group kept whole (#586).
+
+    The reasons are the review's details without "Kept: ".
+    """
+    held = [(ids, PAIRED_DETAIL) for ids in paired] + [
+        (ids, CONFLICT_DETAILS[reason]) for ids, reason in conflicted
+    ]
+    return [
+        {"prompt_id": prompt_id, "reasons": [detail.removeprefix("Kept: ")]}
+        for ids, detail in held
+        for prompt_id in ids
+    ]
+
+
+def _kept_unused(conn):
+    """``{prompt_id, reasons}`` for each prompt the unused prune keeps (#586).
+
+    The reasons are the review's, one per protection that applies, in the
+    order the plan names them.
+    """
+    kept = []
+    for row in conn.execute(_UNLINKED_KEPT_SQL):
+        reasons = [one for flag, (_p, _m, one) in zip(row[1:], PROTECTIONS) if flag]
+        if reasons:
+            kept.append({"prompt_id": row[0], "reasons": reasons})
+    return kept
+
+
 class MaintenanceOperations:
     """Mixin for PromptDatabase: maintenance previews and their apply."""
 
@@ -533,6 +585,10 @@ class MaintenanceOperations:
                 lambda conn: (self._link_rows(conn), _mark_rows(conn)),
             )
             return self._plan_missing_links(rows, roots, _stale_marks(marks, roots))
+        if operation == "pair_metadata":
+            from .pair_metadata_repair import plan_pair_metadata
+
+            return _read_snapshot(self.model.db_path, plan_pair_metadata)
         reader = (
             self._plan_duplicate_prompts
             if operation == "duplicate_prompts"
@@ -584,7 +640,7 @@ class MaintenanceOperations:
             + [
                 {
                     "label": _excerpt(texts.get(group[0])),
-                    "detail": "Kept: belongs to a saved pair",
+                    "detail": PAIRED_DETAIL,
                 }
                 for group in paired
             ]
@@ -662,6 +718,24 @@ class MaintenanceOperations:
             ],
         )
 
+    def kept_links(self, roots):
+        """``{image_path, owner, reason}`` for each link the missing-link
+        cleanup holds back under ``roots`` (blocking, reads only, no file
+        opened); ``owner`` indexes ``roots`` (None outside every source).
+
+        ``reason`` is the review's (``HELD_LINK_REASONS``), one link each.
+        """
+        roots = [str(root) for root in roots]
+        rows = _read_snapshot(self.model.db_path, self._link_rows)
+        return [
+            {
+                "image_path": row[1],
+                "owner": owner,
+                "reason": HELD_LINK_REASONS[state][0],
+            }
+            for row, owner, state in held_links(rows, roots, readable_roots(roots))
+        ]
+
     @staticmethod
     def _links_fingerprint(candidates, stale=()):
         fingerprint = _Fingerprint("missing_links")
@@ -681,23 +755,11 @@ class MaintenanceOperations:
                 unavailable += 1
             elif state == "outside":
                 outside += 1
-        reasons = []
-        if unavailable:
-            reasons.append(
-                _plural(
-                    unavailable,
-                    "link under an unavailable source",
-                    "links under unavailable sources",
-                )
-            )
-        if outside:
-            reasons.append(
-                _plural(
-                    outside,
-                    "link outside the image sources",
-                    "links outside the image sources",
-                )
-            )
+        reasons = [
+            _plural(count, *HELD_LINK_REASONS[state])
+            for state, count in (("unavailable", unavailable), ("outside", outside))
+            if count
+        ]
         count = len(candidates)
         parts = []
         if count:
@@ -800,7 +862,11 @@ class MaintenanceOperations:
         records changed and up to ``MAX_RESULT_ROWS`` descriptions of them
         (``{prompt_id[, kept_id]}`` or ``{image_path}``). ``marks`` are a
         missing-links plan's stale removal marks; that apply also returns
-        ``marks``, how many it forgot.
+        ``marks``, how many it forgot. ``pair_metadata`` returns every filled
+        prompt, uncapped (its job keeps the complete record, #550). The
+        prompt operations also return ``kept``: every prompt the plan keeps,
+        ``{prompt_id, reasons}`` in the review's wording (#550, #586); the
+        links a missing-links plan keeps are read by ``kept_links``.
         """
         if operation not in MAINTENANCE_OPERATIONS or operation == "workflow_storage":
             raise ValueError(f"Unknown maintenance operation {operation!r}")
@@ -815,6 +881,10 @@ class MaintenanceOperations:
             "unused_components": self._apply_unused_components,
         }
         with self._pair_transaction() as conn:
+            if operation == "pair_metadata":
+                from .pair_metadata_repair import apply_pair_metadata
+
+                return apply_pair_metadata(conn, fingerprint, targets)
             if operation == "missing_links":
                 return self._apply_missing_links(
                     conn, fingerprint, targets, roots, list(marks)
@@ -822,10 +892,11 @@ class MaintenanceOperations:
             return appliers[operation](conn, fingerprint, targets, roots)
 
     def _apply_duplicate_prompts(self, conn, fingerprint, targets, _roots):
-        groups, _paired, _conflicted, current = self._duplicates_fingerprint(conn)
+        groups, paired, conflicted, current = self._duplicates_fingerprint(conn)
         if current != fingerprint or groups != targets:
             raise PlanChanged("duplicate_prompts")
         changed, rows = 0, []
+        kept = _kept_duplicates(paired, conflicted)
         for sorted_ids in groups:
             removed, _moved = self._merge_duplicate_group(conn, sorted_ids, strict=True)
             changed += removed
@@ -833,7 +904,7 @@ class MaintenanceOperations:
                 {"prompt_id": duplicate_id, "kept_id": sorted_ids[0]}
                 for duplicate_id in sorted_ids[1:]
             )
-        return {"changed": changed, "rows": rows[:MAX_RESULT_ROWS]}
+        return {"changed": changed, "rows": rows[:MAX_RESULT_ROWS], "kept": kept}
 
     def _apply_unused_components(self, conn, fingerprint, targets, _roots):
         ids, current = self._unused_fingerprint(conn)
@@ -845,7 +916,7 @@ class MaintenanceOperations:
             {"prompt_id": prompt_id, "text": _excerpt(texts.get(prompt_id))}
             for prompt_id in ids[:MAX_RESULT_ROWS]
         ]
-        return {"changed": changed, "rows": rows}
+        return {"changed": changed, "rows": rows, "kept": _kept_unused(conn)}
 
     def _apply_missing_links(self, conn, fingerprint, targets, roots, marks):
         rows = []

database/pair_metadata_repair.py

@@ -0,0 +1,452 @@
+"""Pair category and tags repair (#550): the ``pair_metadata`` maintenance plan.
+
+Before #546 a Pair node run saved its category and tags on the saved pair
+only; the positive prompt it created stayed Uncategorized and untagged. This
+plan fills the **empty** category and the **empty** tag set of those prompts
+from their saved pairs (``docs/egm/post-3.4.1/550-design.md``):
+
+- Considered: prompts the Pair node created as a positive (their earliest
+  pair, in either role, has them as the positive and its ``created_at`` is
+  within ``PAIR_CREATED_TOLERANCE`` of theirs) whose category is blank
+  and/or that have no tags.
+- Sources: the prompt's non-archived pairs where it is the positive. Pairs
+  with a blank category or no tags are ignored for that field. A field fills
+  when exactly one value remains (category: trimmed, case-sensitive; tags:
+  the tag-id set).
+- Kept (protected), in this order: archived prompt, edited prompt
+  (``updated_at`` not within the tolerance of ``created_at``), pairs that
+  disagree, a tag set over ``MAX_LIBRARY_TAGS``.
+
+The apply runs in the caller's ``BEGIN IMMEDIATE`` transaction, recomputes
+the fingerprint, then writes guarded statements (the field must still be
+empty) that never touch a pair, a negative or ``updated_at``. A guard that
+hits nothing raises ``PlanChanged`` so the whole transaction rolls back.
+"""
+
+import datetime
+
+from . import maintenance as _maintenance
+from .library_commands import MAX_LIBRARY_TAGS
+from .maintenance import (
+    MAX_DETAILS,
+    MaintenanceDraft,
+    PlanChanged,
+    _excerpt,
+    _Fingerprint,
+    _marks,
+    _plural,
+)
+
+OPERATION = "pair_metadata"
+# Seconds: the Pair save stamps its new prompt and its pair with separate
+# utc_now_iso() calls in one transaction (microseconds apart).
+PAIR_CREATED_TOLERANCE = 2.0
+# Fill prompts one plan applies; the rest are applied by the next review.
+# Bounds the complete record a job keeps in memory (about 100 bytes a row).
+MAX_PLAN_FILLS = 20000
+DETAIL_VALUES = 3
+DETAIL_TAGS = 5
+MEDIA_LABEL = "No image file or saved pair is changed."
+EMPTY_LABEL = "No Pair prompts are missing a category or tags"
+RECORD_NOTE = (
+    "The job's report lists every filled field. Download it to keep it: "
+    "Activity forgets jobs after a restart."
+)
+# Protected classes in precedence order: (key, detail, reason one, many).
+EDITED_DETAIL = (
+    "Kept: edited after it was saved; its empty category or tags may be intentional"
+)
+PROTECTED = (
+    (
+        "archived",
+        "Kept: archived in the Library",
+        "archived in the Library",
+        "archived in the Library",
+    ),
+    (
+        "edited",
+        EDITED_DETAIL,
+        "edited after it was saved",
+        "edited after they were saved",
+    ),
+    ("conflict", None, "where pairs disagree", "where pairs disagree"),
+    (
+        "too-many-tags",
+        f"Kept: its pair has more than {MAX_LIBRARY_TAGS} tags",
+        f"whose pair has more than {MAX_LIBRARY_TAGS} tags",
+        f"whose pair has more than {MAX_LIBRARY_TAGS} tags",
+    ),
+)
+_PROTECTED_ORDER = [key for key, *_rest in PROTECTED]
+# Detail rows: what the user can act on (a conflict) first.
+DETAIL_ORDER = ("conflict", "edited", "archived", "too-many-tags")
+
+_CANDIDATES_SQL = """
+    SELECT p.id, p.hash, p.text, p.created_at, p.updated_at,
+           COALESCE(TRIM(p.category), '') = '' AS blank_category,
+           NOT EXISTS (SELECT 1 FROM prompt_tags pt WHERE pt.prompt_id = p.id)
+               AS untagged,
+           EXISTS (SELECT 1 FROM prompt_archive pa WHERE pa.prompt_id = p.id)
+               AS archived,
+           (SELECT CASE WHEN pp.positive_prompt_id = p.id
+                        THEN pp.created_at END
+              FROM prompt_pairs pp
+             WHERE pp.positive_prompt_id = p.id OR pp.negative_prompt_id = p.id
+             ORDER BY pp.id LIMIT 1) AS first_pair_at
+      FROM prompts p
+     WHERE EXISTS (SELECT 1 FROM prompt_pairs pp WHERE pp.positive_prompt_id = p.id)
+       AND (COALESCE(TRIM(p.category), '') = ''
+            OR NOT EXISTS (SELECT 1 FROM prompt_tags pt WHERE pt.prompt_id = p.id))
+     ORDER BY p.id
+"""
+_SOURCES_SQL = (
+    "SELECT id, positive_prompt_id, TRIM(COALESCE(category, '')) FROM prompt_pairs "
+    "WHERE archived = 0 AND positive_prompt_id IN ({marks}) ORDER BY id"
+)
+_PAIR_TAGS_SQL = (
+    "SELECT ppt.pair_id, t.id, t.name FROM prompt_pair_tags ppt "
+    "JOIN tags t ON t.id = ppt.tag_id WHERE ppt.pair_id IN ({marks}) "
+    "ORDER BY ppt.pair_id, t.id"
+)
+
+
+def parse_stamp(value):
+    """A stored timestamp as an aware UTC datetime, or None when unreadable."""
+    if not isinstance(value, str) or not value.strip():
+        return None
+    try:
+        stamp = datetime.datetime.fromisoformat(value.strip())
+    except ValueError:
+        return None
+    if stamp.tzinfo is None:
+        stamp = stamp.replace(tzinfo=datetime.timezone.utc)
+    return stamp
+
+
+def _close(first, second):
+    """Whether two stored stamps parse and lie within the tolerance."""
+    a, b = parse_stamp(first), parse_stamp(second)
+    if a is None or b is None:
+        return False
+    return abs((a - b).total_seconds()) <= PAIR_CREATED_TOLERANCE
+
+
+def _batches(ids):
+    size = _maintenance.ID_BATCH
+    for start in range(0, len(ids), size):
+        yield ids[start : start + size]
+
+
+def _sources(conn, ids):
+    """``{prompt_id: [(pair_id, category, ((tag_id, name), ...)), ...]}``."""
+    pairs = {}
+    for batch in _batches(ids):
+        for pair_id, prompt_id, category in conn.execute(
+            _SOURCES_SQL.format(marks=_marks(batch)), batch
+        ):
+            pairs.setdefault(prompt_id, []).append([pair_id, category, []])
+    by_pair = {pair[0]: pair for group in pairs.values() for pair in group}
+    pair_ids = sorted(by_pair)
+    for batch in _batches(pair_ids):
+        for pair_id, tag_id, name in conn.execute(
+            _PAIR_TAGS_SQL.format(marks=_marks(batch)), batch
+        ):
+            by_pair[pair_id][2].append((tag_id, name))
+    return {
+        prompt_id: [(pid, category, tuple(tags)) for pid, category, tags in group]
+        for prompt_id, group in pairs.items()
+    }
+
+
+def _field(values, guard):
+    """``(class, value)`` of one field from its distinct values, or None."""
+    if not values:
+        return None
+    if guard:
+        return (guard, None)
+    if len(values) > 1:
+        return ("conflict", sorted(values))
+    return ("fill", next(iter(values)))
+
+
+def _classify(row, sources):
+    """The result of one considered prompt, or None when nothing applies."""
+    guard = None
+    if row["archived"]:
+        guard = "archived"
+    elif not _close(row["updated_at"], row["created_at"]):
+        guard = "edited"
+    category = tags = None
+    tag_pair = None
+    if row["blank_category"]:
+        category = _field({c for _p, c, _t in sources if c}, guard)
+    if row["untagged"]:
+        sets = {}
+        for pair_id, _category, pair_tags in sources:
+            if pair_tags:
+                sets.setdefault(frozenset(pair_tags), pair_id)
+        tags = _field(set(sets), guard)
+        if tags and tags[0] == "fill":
+            tag_pair = sets[tags[1]]
+            if len(tags[1]) > MAX_LIBRARY_TAGS:
+                tags = ("too-many-tags", None)
+            else:
+                tags = ("fill", tuple(sorted(tags[1])))
+        elif tags and tags[0] == "conflict":
+            tags = ("conflict", [sorted(s) for s in sorted(sets, key=sorted)])
+    if category is None and tags is None:
+        return None
+    return {
+        "id": row["id"],
+        "hash": row["hash"],
+        "text": row["text"],
+        "category": category,
+        "tags": tags,
+        "tag_pair": tag_pair if tags and tags[0] == "fill" else None,
+        "pairs": [pair_id for pair_id, _c, _t in sources],
+    }
+
+
+def _state(conn):
+    """``(results, fingerprint)``: every considered prompt's result, by id."""
+    considered = []
+    for row in conn.execute(_CANDIDATES_SQL):
+        row = dict(
+            zip(
+                (
+                    "id",
+                    "hash",
+                    "text",
+                    "created_at",
+                    "updated_at",
+                    "blank_category",
+                    "untagged",
+                    "archived",
+                    "first_pair_at",
+                ),
+                tuple(row),
+            )
+        )
+        if _close(row["created_at"], row["first_pair_at"]):
+            considered.append(row)
+    sources = _sources(conn, [row["id"] for row in considered])
+    fingerprint = _Fingerprint(OPERATION)
+    results = []
+    for row in considered:
+        result = _classify(row, sources.get(row["id"], []))
+        if result is None:
+            continue
+        results.append(result)
+        fingerprint.add(
+            [
+                result["id"],
+                result["hash"],
+                result["category"],
+                result["tags"],
+                result["tag_pair"],
+                result["pairs"],
+            ]
+        )
+    return results, fingerprint.hexdigest()
+
+
+def _fills(result):
+    return (
+        bool(result["category"] and result["category"][0] == "fill"),
+        bool(result["tags"] and result["tags"][0] == "fill"),
+    )
+
+
+def _targets(results):
+    targets = []
+    for result in results:
+        category, tags = _fills(result)
+        if category or tags:
+            targets.append([result["id"], category, tags])
+    return targets[:MAX_PLAN_FILLS]
+
+
+def _protected_classes(result):
+    """The protected classes of a result's fields, in precedence order."""
+    found = {
+        field[0]
+        for field in (result["category"], result["tags"])
+        if field and field[0] != "fill"
+    }
+    return [key for key in _PROTECTED_ORDER if key in found]
+
+
+def _more(values, limit):
+    shown = ", ".join(values[:limit])
+    return shown + (", …" if len(values) > limit else "")
+
+
+def _fill_detail(result):
+    parts = []
+    category, tags = _fills(result)
+    if category:
+        parts.append(f"category “{result['category'][1]}”")
+    if tags:
+        names = sorted(name for _id, name in result["tags"][1])
+        noun = "tag" if len(names) == 1 else "tags"
+        parts.append(f"{len(names)} {noun}: {_more(names, DETAIL_TAGS)}")
+    pairs = [str(pair_id) for pair_id in result["pairs"]]
+    label = "pair" if len(pairs) == 1 else "pairs"
+    return f"Fills {' and '.join(parts)} ({label} {_more(pairs, DETAIL_VALUES)})"
+
+
+def _protected_detail(result, key):
+    if key != "conflict":
+        return next(detail for k, detail, *_r in PROTECTED if k == key)
+    if result["category"] and result["category"][0] == "conflict":
+        values = result["category"][1]
+        return f"Kept: pairs disagree on category: {_more(values, DETAIL_VALUES)}"
+    return "Kept: pairs disagree on tags"
+
+
+def _kept(results):
+    """One row per kept prompt, its review reasons without "Kept: " (#550)."""
+    rows = []
+    for result in results:
+        classes = set(_protected_classes(result))
+        if classes:
+            rows.append(
+                {
+                    "prompt_id": result["id"],
+                    "reasons": [
+                        _protected_detail(result, key).removeprefix("Kept: ")
+                        for key in DETAIL_ORDER
+                        if key in classes
+                    ],
+                }
+            )
+    return rows
+
+
+def _details(results, targets):
+    rows = []
+    for key in DETAIL_ORDER:
+        for result in results:
+            if key in _protected_classes(result):
+                rows.append(
+                    {
+                        "label": _excerpt(result["text"]),
+                        "detail": _protected_detail(result, key),
+                    }
+                )
+    planned = {target[0] for target in targets}
+    for result in results:
+        if result["id"] in planned:
+            rows.append(
+                {"label": _excerpt(result["text"]), "detail": _fill_detail(result)}
+            )
+    if not targets:
+        return rows[:MAX_DETAILS]
+    return rows[: MAX_DETAILS - 1] + [{"label": "Record", "detail": RECORD_NOTE}]
+
+
+def _scope_label(targets, total):
+    if not targets:
+        return EMPTY_LABEL
+    categories = sum(1 for _id, category, _tags in targets if category)
+    tag_sets = sum(1 for _id, _category, tags in targets if tags)
+    label = (
+        f"{_plural(len(targets), 'prompt')} to fill: "
+        f"{_plural(categories, 'category', 'categories')}, "
+        f"{_plural(tag_sets, 'tag set')}"
+    )
+    if total > len(targets):
+        label += (
+            f" (the first {len(targets):,} of {total:,}; review again for the rest)"
+        )
+    return label
+
+
+def plan_pair_metadata(conn):
+    """The reviewed ``pair_metadata`` plan on ``conn``'s snapshot."""
+    results, fingerprint = _state(conn)
+    targets = _targets(results)
+    total = sum(1 for result in results if any(_fills(result)))
+    counts = {key: 0 for key in _PROTECTED_ORDER}
+    held = 0
+    for result in results:
+        classes = _protected_classes(result)
+        held += bool(classes)
+        for key in classes:
+            counts[key] += 1
+    reasons = [
+        f"{counts[key]:,} {one if counts[key] == 1 else many}"
+        for key, _detail, one, many in PROTECTED
+        if counts[key]
+    ]
+    return MaintenanceDraft(
+        operation=OPERATION,
+        fingerprint=fingerprint,
+        targets=targets,
+        scope={"count": len(targets), "label": _scope_label(targets, total)},
+        protected={"count": held, "reasons": reasons},
+        media={"deletes_files": False, "label": MEDIA_LABEL},
+        details=_details(results, targets),
+    )
+
+
+def _fill_categories(conn, fills):
+    """Set each blank category; raises PlanChanged when one is no longer blank."""
+    cursor = conn.executemany(
+        "UPDATE prompts SET category = ? WHERE id = ? "
+        "AND COALESCE(TRIM(category), '') = ''",
+        fills,
+    )
+    if cursor.rowcount != len(fills):
+        raise PlanChanged(OPERATION)
+
+
+def _fill_tags(conn, fills, expected):
+    """Copy each source pair's tags onto its untagged prompt."""
+    cursor = conn.executemany(
+        "INSERT INTO prompt_tags(prompt_id, tag_id) "
+        "SELECT ?, ppt.tag_id FROM prompt_pair_tags ppt "
+        "JOIN tags t ON t.id = ppt.tag_id WHERE ppt.pair_id = ? "
+        "AND NOT EXISTS (SELECT 1 FROM prompt_tags WHERE prompt_id = ?)",
+        fills,
+    )
+    if cursor.rowcount != expected:
+        raise PlanChanged(OPERATION)
+
+
+def apply_pair_metadata(conn, fingerprint, targets):
+    """Apply the reviewed fills on ``conn`` (inside BEGIN IMMEDIATE).
+
+    Returns ``{changed, categories, tag_sets, rows, kept}``; ``rows`` lists
+    every filled prompt (``{prompt_id, category?, tags?}``) and ``kept`` every
+    prompt the plan keeps (``{prompt_id, reasons}``, in the review's wording
+    and order), both never capped.
+    """
+    results, current = _state(conn)
+    if current != fingerprint or _targets(results) != targets:
+        raise PlanChanged(OPERATION)
+    by_id = {result["id"]: result for result in results}
+    categories, tags, rows = [], [], []
+    tag_count = 0
+    for prompt_id, fill_category, fill_tags in targets:
+        result = by_id[prompt_id]
+        row = {"prompt_id": prompt_id}
+        if fill_category:
+            row["category"] = result["category"][1]
+            categories.append((row["category"], prompt_id))
+        if fill_tags:
+            row["tags"] = sorted(name for _id, name in result["tags"][1])
+            tags.append((prompt_id, result["tag_pair"], prompt_id))
+            tag_count += len(result["tags"][1])
+        rows.append(row)
+    if categories:
+        _fill_categories(conn, categories)
+    if tags:
+        _fill_tags(conn, tags, tag_count)
+    return {
+        "changed": len(rows),
+        "categories": len(categories),
+        "tag_sets": len(tags),
+        "rows": rows,
+        "kept": _kept(results),
+    }

database/workflow_storage.py

@@ -112,20 +112,22 @@ QUERY_PLAN_STATEMENTS = {
 
 
 def _rewrite_row(conn, image_id, row, verified, checked):
-    """Store the row's inline texts as documents; returns (changed, protected, size).
+    """Store the row's inline texts as documents; returns (changed, kept, size).
+
+    ``kept`` names the columns whose value stays inline (not text).
 
     ``verified`` maps document ids already read back in this batch to their
     text, and ``checked`` holds the reused ids ``store_text`` already
     checked, so a document shared by many rows is decompressed once.
     """
-    changes, replaced = {}, []
-    protected = size = 0
+    changes, replaced, kept = {}, [], []
+    size = 0
     for index, (column, reference) in enumerate(TEXT_COLUMNS):
         value, current = row[index], row[index + len(TEXT_COLUMNS)]
         if value is None:
             continue
         if not storable(value):
-            protected += 1
+            kept.append(column)
             continue
         document_id = store_text(conn, value, checked)
         if document_id not in verified:
@@ -143,7 +145,7 @@ def _rewrite_row(conn, image_id, row, verified, checked):
             [*changes.values(), image_id],
         )
     release_documents(conn, replaced)
-    return bool(changes), protected, size
+    return bool(changes), kept, size
 
 
 def migrate_batch(
@@ -160,9 +162,10 @@ def migrate_batch(
     savepoint: a row that cannot be rewritten (``_row_error``) is rolled
     back alone, stays inline and is listed in ``errors``; anything else rolls
     the whole batch back and propagates. Returns ``{last_id, rows,
-    protected, errors, done}``: the last row looked at, rows rewritten,
-    inline values kept (not text), the ids kept by an error and whether
-    there was nothing left to look at.
+    protected, kept, errors, done}``: the last row looked at, rows
+    rewritten, inline values kept (not text) and each of them as ``(image
+    id, column)`` (#586), the ids kept by an error and whether there was
+    nothing left to look at.
     """
     if conn.in_transaction:
         raise RuntimeError("The migration needs its own transaction")
@@ -174,6 +177,7 @@ def migrate_batch(
             "last_id": after_id,
             "rows": 0,
             "protected": 0,
+            "kept": [],
             "errors": [],
             "done": not ids,
         }
@@ -182,7 +186,7 @@ def migrate_batch(
             conn.execute("SAVEPOINT workflow_row")
             try:
                 row = conn.execute(ROW_SQL, (image_id,)).fetchone()
-                changed, protected, row_size = _rewrite_row(
+                changed, kept, row_size = _rewrite_row(
                     conn, image_id, row, verified, checked
                 )
             except Exception as error:
@@ -194,11 +198,12 @@ def migrate_batch(
                 checked.clear()
                 logger.warning(f"Image record {image_id} kept inline: {error}")
                 result["errors"].append(image_id)
-                changed, protected, row_size = False, 0, 0
+                changed, kept, row_size = False, [], 0
             else:
                 conn.execute("RELEASE workflow_row")
             result["rows"] += int(changed)
-            result["protected"] += protected
+            result["protected"] += len(kept)
+            result["kept"].extend((image_id, column) for column in kept)
             result["last_id"] = image_id
             size += row_size
             if size >= max_bytes or _clock() - started >= max_seconds:

docs/egm/review-and-clean/report.md

@@ -0,0 +1,409 @@
+# Review and clean: review-only audit
+
+Date: 2026-11-01. Baseline: `main` at `7e11d9cae266b74e0820799eb0d74ab493e66026` (version **3.4.1**).
+
+**REVIEW ONLY — DO NOT MERGE. Keep this PR in draft.** The maintainer approved sharing this audit for additional review; this branch contains no cleanup implementation.
+
+All measurements and source-line references describe commit `7e11d9cae266b74e0820799eb0d74ab493e66026`, not the latest main. Main subsequently gained #592 (thumbnail location) at `043403d09e0ac199123d7da88c5a6c3e33c8bc46`; that addition is outside this audit snapshot. The documentation branch starts from that newer main so its only diff is this report.
+
+## Recommendation
+
+Proceed with a small cleanup of proven dead helpers, test-only scaffolding and unused assets, preceded by the risk-focused tests below. Keep the legacy pages for now. Two legacy jobs still need a retirement decision: prompt sorting by use, and managing the underlying records used only as negative components. Do not build replacements as part of this audit.
+
+The most consequential code findings are inconsistent Windows UNC handling in SQLite readers, a write-only prompt registry that grows with executions, and model unloading on the server event loop. These are independent of deleting the old pages. The first and third need narrow regression tests and fixes; removal of the registry needs an explicit compatibility decision.
+
+The audit changed no production source, tests, workflows, protected assets or configuration. This review branch publishes only the report at the maintainer's request. No cleanup, service restart or release is included. Raw logs, scripts, databases, archives and machine-specific files remain outside Git. This is a review-only exception to the normal policy that EGM reports stay local.
+
+## Expected payoff
+
+These are measured projections, not completed reductions. No projected reduction has been implemented.
+
+| Work | Before → proposed after | Reduction / limits |
+| --- | --- | --- |
+| Legacy UI retirement | 121,845 → **111,707 runtime lines** | **10,138 lines / 8.3%**, across 16 files. Requires parity approval; replacement bookmark shims may reduce the net saving. |
+| Small dead-helper cleanup | About **150 runtime lines removed**, plus obsolete tests | Modest: the measured helper/class spans total 149 lines before adjacent fields, comments and test changes. |
+| Development-file package exclusions | **17,348,582 → 6,766,947 bytes ZIP** | **61.0% smaller** in a local preview excluding `tests/`, `tools/`, `docs/` and `.github/`; 1,028 → 362 archived files. Runtime completeness still needs installation testing. |
+| Unused image artifacts | **1,737,407 bytes removed** from the current tree | Three files. This does not shrink existing Git history. |
+
+Line counts include comments and whitespace. Package savings concern the Registry packaging path, not Git clones or history. Both ZIPs were local audit previews; neither is included in this branch or published to the Registry.
+
+The strongest return is packaging exclusions, targeted correctness fixes and eventual legacy retirement: retiring the old UI removes two large controllers and their supporting code. The first helper-removal batch has a small numerical payoff. Defer broad file splitting and cosmetic reorganization until there is a demonstrated maintenance benefit. With Python coverage at 95.10% and frontend line coverage at 90.55%, prioritize safety invariants over percentage increases.
+
+## 1. Scope, method and limits
+
+Read the audit brief, local `CLAUDE.md` and `AGENTS.md`, [README.md](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/README.md), [pyproject.toml](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/pyproject.toml), the redesign plan, the testing contract's execution/safety/portability/parity sections, the available directory contracts, and relevant EGM designs and drift records. The EGM records for #444, #447, #550, #523 and #556 distinguish approved redesign changes from actual gaps. `openspec/AGENTS.md` does not exist at this head; no substitute spec was invented.
+
+The review scans the tracked tree and takes deeper passes through registration, HTTP routes, prompt/image identity, backup/restore, library movement, deletion, model lifecycle, and the legacy/workspace UI entry points. It is not a claim that every line of the roughly 122,000 runtime source lines received a separate manual review.
+
+Raw audit evidence was retained locally and is not part of this branch. The observations, results and limitations needed for review are summarized here. Inventory uses `git ls-files`; generated environments, the copied local briefs and audit artifacts do not enter the counts. Vulture 60%/80% output and coverage were treated as leads. Candidate decisions also checked browser script tags/imports, node schemas, route registration, dynamic `getattr`, SQL/config names, shutdown hooks, packaging and tool/test callers. Names inside comments, a same-named unrelated test helper, or a same-named local JS function do not constitute a caller.
+
+Disposable probes exercised the findings without editing production code: 1,000 unique registry registrations and forced expiry; SQLite URI construction for a non-local UNC authority; unload call/thread identity; invalid save-request shapes; and native-Library eligibility of a negative-only record. Results appear with the corresponding findings. These were audit probes, not committed regression tests or proof of a fix.
+
+### Baseline measurements
+
+| Measurement | Before / current audit head |
+| --- | ---: |
+| Tracked files | 1,028 |
+| Runtime `.py`, `.js`, `.mjs`, `.css`, `.html` files outside protected directories | 295 |
+| Lines in those runtime files | 121,845 |
+| Test/tooling source files in the same language set | 532 |
+| Test/tooling source lines | 214,122 |
+| Runtime files over 800 lines | 34 |
+| Runtime Python functions over 50 lines | 212 |
+| Python test files | 238 |
+| Frontend unit-test files | 103 |
+| Tooling unit-test files | 17 |
+| Page-workflow spec files | 67 |
+| Real-host spec files | 14 |
+| Frontend files with coverage baselines | 123 |
+
+The runtime count includes the 1,703-line generated `workspace/concept.css` mirror; it is not a hand-editing candidate. Protected sources and the approved concept are counted separately in `inventory.json`. Line totals are physical lines, including whitespace/comments, with no claim that minified/vendor code and handwritten code have the same cost. No removal has happened, so before and after are currently identical.
+
+Largest runtime files, in lines:
+
+| File | Lines | Review implication |
+| --- | ---: | --- |
+| [py/api/images.py](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/api/images.py) | 4,315 | Several real seams: listing/cursors, file access, thumbnails, inspection. |
+| [web/js/admin.js](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/web/js/admin.js) | 3,102 | Legacy; retire after parity, avoid an interim cosmetic rewrite. |
+| [web/js/gallery.js](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/web/js/gallery.js) | 3,053 | Legacy; same. |
+| [database/operations.py](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/database/operations.py) | 2,854 | Prompt/tag/link operations share a large facade. |
+| [utils/prompt_pair_resolver.py](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/utils/prompt_pair_resolver.py) | 2,749 | Complex resolver with differential contracts; split only with a demonstrated seam and parity evidence. |
+| [py/api/admin.py](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/api/admin.py) | 1,893 | Both live scan/maintenance machinery and legacy routes remain. |
+| [utils/image_monitor.py](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/utils/image_monitor.py) | 1,539 | Metadata-first attribution, queue fallback and shutdown behavior are coupled. |
+| [py/api/autotag_routes.py](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/api/autotag_routes.py) | 1,534 | Native and compatibility routes plus model/stream/job policies. |
+
+Counts and function spans were computed from the tracked files at the audit commit. Only the summarized results are published here.
+
+### Baseline checks
+
+| Check | Result | Evidence |
+| --- | --- | --- |
+| Python 3.12.9, `python -m coverage run -m tests.run_suite -q` | **PASS: 6,104 tests, 75 skips; 335.479 s** | `python-baseline.log` |
+| `coverage combine`; `coverage report --fail-under=85` | **PASS: 95.10% combined**; 38,237 statements, 12,364 branches | `python-coverage.txt`, `python-coverage.json` |
+| Frontend units, Node 24.22.2 | **PASS: 1,444 tests** | Frontend baseline log |
+| Viewer fixture suite in pinned image | **PASS: 18 passed, 2 skipped** | Frontend baseline log |
+| Full Chromium + touch workflows and combined frontend gate | **PASS: 2,473 passed, 1 skipped (23.7 min); 123-file coverage gate passed** | `frontend-baseline.log` |
+| Tooling tests with the project Python selected | **PASS: 124 tests** | `tooling-baseline.log` |
+| Viewer.js, Toolkit and concept stylesheet verification | **PASS**: Viewer.js 1.15.2, Toolkit 0.2.0, stylesheet 30,447 bytes | `vendor-check.log` |
+| `black --check .` | **PASS: 452 files unchanged** | `black.log` |
+| `flake8 .` | **PASS** | `flake8.log` |
+| Frontend source/baseline membership | **PASS: 123 files** | `frontend-baseline-structure.log` |
+| Existing System parity-table validation | **PASS: 54 rows, no structural/test-reference errors** | `system-parity.json` |
+| Tracked-file distribution preview | **1,028 files; 32,088,917 bytes uncompressed / 17,348,582-byte ZIP**; includes tests/tooling/docs | `distribution-preview.json`, `tracked-bundle-preview.zip` |
+| Standard sdist/wheel build, from a clean tracked snapshot | **FAIL: setuptools rejects multiple top-level packages**; separate from Registry packaging | `tracked-package-build.log` |
+| Native Windows, other Python versions, Firefox/WebKit, real ComfyUI and cross-pack matrix | **Not run in this audit**; retain CI/managed-host gates | See verification plan |
+
+Combined frontend coverage is **90.55% lines/statements, 93.52% functions and 92.61% branches** (37,918 measured lines, 18,664 branches). The source/baseline membership check also passes. The table above records the final results; raw reports are not committed.
+
+The Python measurement is on macOS. The browser run uses `mcr.microsoft.com/playwright:v1.64.1-noble`, ARM64, limited to four CPUs and four workers, under the browser-suite lock. Its image digest is `sha256:47b510dd9230bf0b9bfc9b20102241e577ea7a99334ab4c3ca19f19770e9b8ea`. It runs Chromium/touch only, not the full browser matrix. The Python environment is confined to this worktree's ignored `venv/`.
+
+Initial setup attempts were invalid and are retained rather than hidden. A global disposable data-directory override defeated fixture isolation: the initial Python run had 19 failures/55 errors, and browser workers shared a database (`the live database changed while the seed ran`). That browser run was stopped. Removing the override restored the suites' own disposable fixtures. The first tooling attempt selected a Python without watchdog; setting `PM_TEST_PYTHON` fixed that prerequisite. An initial `.venv` also fell outside the repository's `venv/` lint/coverage exclusions; it was replaced with `venv/`. These are setup corrections, not source fixes or reruns of a failing CI head. The invalid attempts are retained in the local audit evidence separately from the corrected baseline. No watchdog limit was raised, no test weakened, and no live state was involved.
+
+## 2. Quality findings
+
+### F01 — HIGH: several retained SQLite readers reject Windows UNC libraries
+
+Locations: [database/models.py:1202](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/database/models.py#L1202) and `:1310`; [database/restore_stage.py:117](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/database/restore_stage.py#L117); [database/library_move.py:321](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/database/library_move.py#L321); [utils/history_read_fence.py:57](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/utils/history_read_fence.py#L57); [py/api/backup_restore.py:189](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/api/backup_restore.py#L189); [py/api/admin.py:402](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/api/admin.py#L402).
+
+These readers independently build a SQLite URI with `Path(...).as_uri()`. On Windows a network path becomes `file://server/share/...`; the normal SQLite build rejects that non-local URI authority. The project already implements the compatible empty-authority form in [database/health.py:98](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/database/health.py#L98) (`readonly_uri`), with portable and native-control tests at [tests/test_database_health.py:337](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/tests/test_database_health.py#L337) and `:363`.
+
+Cost: a library may be opened by ordinary filesystem-path connections yet fail backup verification/download, staging, Move library verification, or fenced history reads. Safety-backed operations can be refused before writing. This is a recovery/availability defect, not evidence of observed data loss.
+
+Evidence: the probe produces `file://server/share/prompts.db?mode=ro` and SQLite's `invalid uri authority: server`; the shared helper produces `file:////server/share/prompts.db?mode=ro`. **No native Windows share was exercised here.**
+
+Proposed fix: use one low-level SQLite read-only URI helper at every retained call site, retaining each caller's timeout, `trusted_schema`, snapshot and closure policies. Start with failing URI-boundary tests, then native Windows backup/restore/history controls on a disposable share. Do not infer native success from a `PureWindowsPath` assertion. Avoid a new dependency cycle by putting the helper below models/health, or preserving an appropriate facade.
+
+### F02 — HIGH: the prompt metadata registry retains each execution indefinitely
+
+Locations: [utils/comfyui_integration.py:89](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/utils/comfyui_integration.py#L89), `:128`, `:178`; writers at `prompt_manager.py:263`, `prompt_manager_text.py:234`, `prompt_manager_pair.py:177`; construction in `prompt_manager_base.py:89`.
+
+Each executed node invents a time-based ID and adds full text/metadata to both a thread-local dictionary and the process-global dictionary. Production code writes this registry but never calls its reader or cleanup method. Even explicit `cleanup_old_prompts` removes only global entries. It does not bound or clear the execution thread's dictionary.
+
+Evidence: 1,000 unique registrations leave 1,000 entries in both stores; after forcing every global entry to expire, global count is zero while the thread-local count remains 1,000. The current 91.95% combined coverage for this file exercises lookup behavior but has no bounded-growth invariant. ComfyUI saves metadata from node inputs; the old SaveImage patch is deliberately absent (#75).
+
+Proposed fix: determine whether the registry has a supported external consumer. If not, remove the obsolete registry and its node-side writes, preserving the tests that SaveImage is untouched and outputs/history still carry the proper text. If an external contract exists, add an explicit bounded lifecycle to both stores with deterministic long-run tests. Do not simply delete the tested reader and leave production writes accumulating. This is an **UNSURE removal candidate**, despite its write-only internal use.
+
+### F03 — MEDIUM: Unload blocks ComfyUI's event loop
+
+Locations: [py/api/autotag_routes.py:1403](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/api/autotag_routes.py#L1403)–`:1426`; [py/autotag.py:911](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/autotag.py#L911); consumer [web/js/workspace/system-tagging.mjs:53](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/web/js/workspace/system-tagging.mjs#L53).
+
+`unload_autotag_model` takes the model gate but calls `service.unload_model()` synchronously. That operation destroys the model, runs `gc.collect()` and may empty CUDA caches. It can stall unrelated UI/API/queue work. The existing image-tag job already calls the same operation through `await model_gate.run(...)` ([py/api/image_tag_jobs.py:614](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/api/image_tag_jobs.py#L614)).
+
+Evidence: the audit probe records identical event-loop and unload thread IDs. [tests/test_api_autotag.py:734](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/tests/test_api_autotag.py#L734) tests success/failure/counts, not event-loop responsiveness or cancellation while the worker is still unloading.
+
+Proposed fix: run unload through the existing model-gate executor mechanism; hold the gate until the worker is finished even if the request is cancelled. Add an event-gated fake unload that proves an unrelated loop callback can complete while unload waits, and that another model user remains refused until release. No model download is needed to test this.
+
+### F04 — MEDIUM: malformed save requests escape validation as server errors
+
+Location: [py/api/prompts.py:727](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/api/prompts.py#L727)–`:745`.
+
+The handler calls `.get()` and `.strip()` before validating the JSON object and field types. `[]`, `{"text":123}`, and `{"text":"fixture","category":123}` all return a 500 envelope with an AttributeError logged, instead of a bounded 400 validation refusal. The save route is still registered and must remain compatible with existing consumers.
+
+Evidence: all three outcomes are reproduced in `probes.log`. Existing invalid-rating coverage does not cover these shapes. The 96.39% combined coverage for this file therefore does not establish its input contract.
+
+Proposed fix: validate shape/types with the existing bounded JSON-body helper before normalization; add table-driven route tests proving 400 responses, unchanged database rows, and unchanged behavior for valid legacy payloads. This intentionally changes invalid-input responses, so it is a bug fix requiring approval, not a behavior-neutral refactor.
+
+### F05 — MEDIUM: image API responsibilities are too interwoven for safe retirement
+
+Location: [py/api/images.py:1455](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/api/images.py#L1455)–`:4315` (also the helpers/cache structures above its mixin).
+
+One 4,315-line file combines route wiring, legacy and workspace listing, signed cursors, source scopes, file containment, thumbnails/video subprocesses, favorites, inspection and prompt lookup. Other mixins import helpers from it. Removing legacy paths without identifying those dependencies risks deleting shared workspace/node behavior.
+
+Proposed fix: after caller-led removal, extract only useful seams—thumbnail generation, media access/containment, and workspace listing/formatting—keeping the current mixin/helper facade while callers transition. Add behavior tests for retained boundaries before moving them. Do not split to satisfy a line target or rewrite the resolver alongside it.
+
+### F06 — MEDIUM: a second configuration writer survives only for tests
+
+Locations: [py/config.py:81](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/config.py#L81) (`write_private_json`), `:1059` (`save_to_file`); contrast [py/config_store.py:81](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/config_store.py#L81) and `:157`.
+
+This unused production path truncates the existing file before JSON serialization, bypasses the commit lock/revision contract, loses unknown sections, and logs failures instead of returning them. Only tests call it. Keeping it makes it easy for future code to bypass the safe `ConfigStore` writer.
+
+Proposed fix: remove the **TEST-ONLY** save method and its private writer together, replacing fixture setup through existing disposable fixture helpers where needed. Remove their own tests only with their implementation; retain `ConfigStore` atomicity, unknown-key preservation and permission tests. Do not remove the live `load_from_file` reader or change old configuration formats.
+
+### F07 — LOW: instructions and status documentation disagree with the implementation
+
+Locations/evidence:
+
+- `CLAUDE.md:30` says 3.3.x; [pyproject.toml:4](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/pyproject.toml#L4) says 3.4.1.
+- `CLAUDE.md:1` and `AGENTS.md:2` refer to absent `openspec/AGENTS.md`.
+- `AGENTS.md:84` still says macOS runs in portability CI; `portability.yml:40` runs Windows only. [README.md:18](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/README.md#L18) also says the Python suite runs on all three OSes, contradicting its own final testing section.
+- `AGENTS.md:126` says three coverage shards/two other-browser shards; current `viewerjs-check.yml:66` and `:206` use **four** and **three**. `CLAUDE.md:158` also still says two other-browser shards. [TESTING.md](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/TESTING.md) retains some old three-/four-shard and two-/three-shard prose together.
+- [docs/application-redesign.md:73](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/docs/application-redesign.md#L73) names Python 3.10–3.13 and macOS CI, and `:78` asks for PR screenshots. The actual floor is Python 3.12 and the maintainer prohibits PR image uploads.
+- The redesign plan describes history under #209 as pending although the chronological Library exists; default entry points already changed under #525.
+- `CLAUDE.md`'s general HTML-refresh rule needs the [TESTING.md:7561](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/TESTING.md#L7561) exception: `workspace.html` is server-cached and needs a ComfyUI restart when edited.
+- Several EGM line anchors and run-counting descriptions predate the cached-runtime receipt work; they are context, not authority for deleting code.
+
+Proposed fix: reconcile README, TESTING, redesign status and the two local briefs from current code/workflows; preserve the test parsers' required sections. Keep the managed OpenSpec block intact while recording the missing-file situation locally or recovering its authoritative source after a maintainer ruling. Do not regenerate the protected concept or add screenshots. Keep local briefs untracked.
+
+### F08 — LOW: two automation jobs are outside the timeout contract
+
+Locations: [.github/workflows/publish.yml:15](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/.github/workflows/publish.yml#L15), [.github/workflows/viewerjs-update.yml:21](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/.github/workflows/viewerjs-update.yml#L21); guard coverage at [tests/vendor/ci-workflow.test.mjs:279](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/tests/vendor/ci-workflow.test.mjs#L279).
+
+These jobs declare no `timeout-minutes`. The current guard enumerates the four test/quality/portability workflows, so tooling green does not enforce the repository's broader “every CI job” rule. A stalled publish/update can hold a runner much longer than intended.
+
+Proposed fix: first obtain the required three green-main duration measurements, then add limits and comments and extend the guard to all workflows. Do not invent durations or change a limit to hide a failure. Do not dispatch the publishing workflow for this audit.
+
+### F09 — MEDIUM: the packaging path has no exclusions for development content
+
+Location: [pyproject.toml:9](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/pyproject.toml#L9)–`:11`, [.github/workflows/publish.yml:4](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/.github/workflows/publish.yml#L4)–`:9`.
+
+There is no `.comfyignore` or export-ignore manifest. The inspected [publish action](https://raw.githubusercontent.com/Comfy-Org/publish-node-action/v1/action.yml) runs `comfy node publish`; the current [upstream packager](https://raw.githubusercontent.com/Comfy-Org/comfy-cli/main/comfy_cli/file_utils.py) includes tracked files when no exclusion specification is present. On that basis, a future clean-checkout publish would include the development tree. This is an inference from the current upstream source, not inspection of an already published Registry artifact.
+
+The local tracked-file preview confirms 1,028 files / 32,088,917 uncompressed bytes: `tests/` alone contributes 549 files / 11,739,034 bytes, `docs/` 73 / 8,727,000, and `tools/` 36 / 239,782. These costs are separate from working runtime dependencies. See `distribution-preview.json`; the ZIP is only a local audit artifact and was not uploaded.
+
+Proposed fix: add reviewed `.comfyignore` exclusions and a non-publishing archive-content check, preserving all runtime Python/web assets, semantics JSON, required licenses and install metadata. Verify the exact supported CLI version and archive before release. No publishing command was run. The action's unpinned CLI installation also makes its future packaging behavior version-dependent.
+
+Separately, `uv build` fails from a clean tracked snapshot because setuptools discovers multiple top-level packages. That does not establish a Registry failure; wheel support is a separate scope decision. Do not casually edit [pyproject.toml](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/pyproject.toml): **any change to that file on main matches the publish trigger**, even with the same version. No packaging metadata was edited here.
+
+### Checks that did not establish a defect
+
+- The reviewed dynamic SQL identifiers/orders were local constants or whitelists; no exploitable SQL injection was demonstrated. `library._ORDERS`, pair/tag sort maps and fixed history ordering are safe exceptions to the blanket `order_by_clause` prose. Do not mechanically force unrelated sort domains through one function.
+- The several Python/browser resolvers are necessary ports for local, non-uploaded inspection; differential tests enforce agreement. They are not duplicate metadata inspectors to delete based on filenames.
+- Prompt hashes ultimately use `utils.hashing.generate_prompt_hash`; no second live prompt-hash algorithm was found in the reviewed paths.
+- The restore fingerprint deliberately does not cover every older-row tag/favorite edit; the safety backup retains them. That limitation is already recorded in TESTING and is not a newly discovered data-loss bug.
+- npm installation emitted four moderate-severity advisory notices. A later **offline** audit of the correct `tools/vendor` package returned no advisory entries; that does not disprove the install notice or provide a trustworthy fresh advisory assessment. No dependency versions or vendor pins were changed. Keep this discrepancy as an unassessed tooling-dependency item, not a claim of four exploitable runtime vulnerabilities.
+
+## 3. Dead-code candidate decisions
+
+`DEAD` below means no reachable caller found after the entry-point checks, and removal is proposed for the implementation pass. **Nothing in this table has been removed yet.** Counts/spans are recorded in `candidate-spans.json` and the tracked-file/name/line search results in `reference-audit.json`; the vulture reports include rejected false positives as well as leads.
+
+| Candidate | Label | Evidence and disposition |
+| --- | --- | --- |
+| [database/annotations.py:294](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/database/annotations.py#L294), `_current_set` | DEAD | Only the definition occurs as a symbol; the similarly named test describes a result, not a call. Current annotation paths construct their own result. Remove the six-line helper. |
+| [py/api/autotag_routes.py:946](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/api/autotag_routes.py#L946), `_gated_runner` | DEAD | No member caller, callback registration or dynamic method selection. [tests/test_jobs.py](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/tests/test_jobs.py) defines an unrelated local helper with this name. Remove nine lines; retain `model_gate.run`. |
+| [py/api/thumbnail_jobs.py:92](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/api/thumbnail_jobs.py#L92), `from_query` parameter | DEAD | The value is never read; one internal call supplies it. Remove the keyword/argument only, preserving body/query behavior. Do not remove `thumbnail_options`. |
+| `image_meta_data.png` | DEAD | No tracked text, test fixture, page, tooling or packaging reference; not under `WEB_DIRECTORY` or a static media root. Remove unused 86,639-byte artifact. |
+| `test_metadata_file.png` | DEAD | Same checks; not used by the PNG/metadata tests. Remove unused 1,616,051-byte artifact. |
+| `images/pm-lora-results.png` | DEAD | Unlike the ten other `images/` assets, it is not linked by [README-legacy.md](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/README-legacy.md) or any tracked caller. Remove 34,717 bytes. |
+| [py/api/__init__.py:478](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/api/__init__.py#L478), `_acquire_long_job`; `_LongJobGuard` and `_long_jobs` field | TEST-ONLY | Only tests/doc examples use this old lock. Production admissions use `JobRegistry`. Remove this test-only cluster and its tests/assertions. **Keep `_long_job_busy_response`**, which several live admin paths call. |
+| [py/api/__init__.py:1080](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/api/__init__.py#L1080), `_parse_comfyui_prompt` | TEST-ONLY | Only [tests/test_api_core.py](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/tests/test_api_core.py) calls the wrapper. Remove wrapper; move any distinct parser assertions to retained `utils/file_prompt.parse_comfyui_prompt` tests rather than losing legacy-data-reader coverage. Keep the actual parser. |
+| [py/config.py:1059](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/config.py#L1059), `save_to_file`, and its sole helper `write_private_json` | TEST-ONLY | Calls are confined to `test_config.py` / `test_thumbnail_settings.py`; live writers use ConfigStore. See F06. |
+| [utils/hashing.py:129](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/utils/hashing.py#L129), `is_duplicate_prompt` | TEST-ONLY | Only `test_hashing.py` and its own module examples refer to it. Remove wrapper/tests/docs; retain the shared hash, text/key functions and SQL registrations. |
+| [utils/validators.py:300](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/utils/validators.py#L300), `parse_tags_string` | TEST-ONLY | Only `test_validators.py` calls it. Not in `utils.__all__`; not an API/config parser. Remove with its own tests. |
+| `prompt_manager_base.py:436`, `search_prompts_api`; `:440`, `get_recent_prompts_api`; `:458`, `get_gallery_status` | TEST-ONLY | Only node-contract tests call them; none is a ComfyUI `FUNCTION`, route or JS callback. Remove if no supported direct-Python consumer is claimed; keep actual `_search_prompts`, DB reads and monitor/tracker status methods. |
+| [database/review_changes.py:50](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/database/review_changes.py#L50), `observer_count` | TEST-ONLY | Keep: it lets lifecycle tests prove observer unsubscribe/leak behavior without inspecting internals. Explicit testing seam, not a user feature. |
+| [py/api/duplicate_files.py:110](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/api/duplicate_files.py#L110), `query_plan_sql` | TEST-ONLY | Keep: exposes the real query shape for structural database/performance tests. Removing it only to shrink code would weaken useful assertions. |
+| [py/api/thumbnail_encode.py:229](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/api/thumbnail_encode.py#L229), `reset_encoders`; [utils/video_metadata.py:52](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/utils/video_metadata.py#L52), `reset_missing_notice` | TEST-ONLY | Keep: deterministic test/fixture reset seams prevent state leakage across suites. |
+| [utils/execution_contexts.py:87](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/utils/execution_contexts.py#L87), `context_digest` | TEST-ONLY | Candidate for removal with its focused tests; do not remove live snapshot/content digests, persisted encodings or schema validators. Low priority until its historical API intent is checked. |
+| [py/lora_utils.py:408](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/lora_utils.py#L408), `get_civitai_image_urls` | TEST-ONLY | Candidate for removal with its extraction tests; the live allow-listed download planner is separate and stays. Confirm direct-Python bridge consumers before deleting this public helper. |
+| [utils/prompt_graph.py:298](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/utils/prompt_graph.py#L298), `positive_prompt_nodes` | TEST-ONLY | Keep pending an explicit public-helper decision. It is a conservative graph projection used by attribution tests, while runtime counting uses `run_prompt_nodes` / component projections. Do not delete the latter or weaken attribution assertions. |
+| [utils/prompt_inspector.py:466](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/utils/prompt_inspector.py#L466), `read_inspection_metadata`; `:769`, `inspect_prompt_roles` | TEST-ONLY | **Keep**: explicitly documented compatibility projections over the current reader/resolver. The brief protects legacy-data readers; these tiny facades cost little and must not be confused with old HTML inspectors. |
+| DB convenience methods including `get_prompts_by_category`, `get_top_rated_prompts`, `delete_prompts_by_category`, `get_image_paths_matching`, `list_library_images`, older context/output reads | TEST-ONLY | Keep in this pass: compatibility/data-reader or destructive-operation surfaces need a stronger contract review. The facade documentation names several; low call counts do not authorize dropping old data access. |
+| `PromptModel.restore_from_file`, migrations/schema helpers, inline/document workflow readers | TEST-ONLY where applicable | Keep regardless of call count: required recovery, upgrade and old-data compatibility. `reset_schema_cache` is also a necessary test isolation seam. |
+| [utils/prompt_tracker.py:440](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/utils/prompt_tracker.py#L440), `extend_prompt_timeout`'s `additional_seconds` | UNSURE | Public compatibility parameter is explicitly documented as unused; current behavior resets a timestamp. Keep the signature and do not invent new timeout semantics during cleanup. |
+| Entire [utils/comfyui_integration.py](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/utils/comfyui_integration.py) registry and its node writes | UNSURE | Reachable writes, test-only reads, no automatic cleanup; F02. Resolve the external-consumer question before removal. |
+| Existing HTTP routes with no workspace caller, including old search, pair, scan, restore and image endpoints | UNSURE | Public HTTP consumers and node/bridge clients may exist. Keep until each route's consumer contract is checked; do not call them dead from frontend absence. |
+
+### Legacy-only UI inventory
+
+All 16 files below are currently reachable from registered HTML entry points and therefore **LEGACY-ONLY**, not DEAD. Together they account for **10,138 physical lines**. This is a candidate retirement envelope, not a promised net deletion: bookmark shims and retained tests may remain.
+
+- Pages: [web/admin.html](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/web/admin.html) (997), [web/gallery.html](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/web/gallery.html) (624), [web/metadata.html](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/web/metadata.html) (431).
+- Controllers: [web/js/admin.js](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/web/js/admin.js) (3,102), `gallery.js` (3,053), `tags-page.js` (1,146).
+- Modules loaded only by those pages/controllers: `data-actions.js` (51), `html-escape.js` (42), `image-helpers.js` (162), `list-state.js` (64), `prompt-list-sort.js` (64), `scan-progress.js` (121), `sse-stream.js` (154), `tag-autocomplete.js` (61), `view-router.js` (27), `theme-bridge.js` (39).
+
+[web/comfy/prompt_manager.js](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/web/comfy/prompt_manager.js) has a same-named local `escapeHtml` method but does not load the `html-escape.js` module. Conversely, **keep** `api-client.js`, `gallery-settings.js`, `png-metadata.js`, `comfy-metadata.js`, `cache-ownership.js`, node editors, prompt-library/bridge adapters, and `workspace-entry.js`: the workspace and/or canvas still use them. Keep [web/index.html](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/web/index.html)'s compatibility redirect. Never hand-edit `web/lib/`, `web/js/shared/`, `reference/`, the concept or its generated stylesheet mirror.
+
+Rejected static false positives include `RETURN_TYPES`, `FUNCTION`, `OUTPUT_IS_LIST`, `IS_CHANGED`, `NODE_CLASS_MAPPINGS`, decorator-registered handlers, dynamically selected health checks, SQL/schema constants imported from tests or validators, and context-manager/redirect-handler signature arguments. Unused signature arguments do not authorize breaking those interfaces.
+
+## 4. Legacy parity and retirement gate
+
+The approved concept and later rulings allow consolidation and some explicit removals. This table evaluates jobs, not whether every old button has a clone. “Covered” identifies an actual native destination and a declared test; it does not certify behavior on a running user host. “Blocked” means no equivalent job was demonstrated and no specific removal ruling was found. The complete System table is reproduced below.
+
+### Browsing, editing, metadata and page lifetime
+
+| Legacy capability / current evidence | Workspace destination | Proof / retirement status |
+| --- | --- | --- |
+| Dashboard recent/search list; text/category/tag filtering | Prompt library toolbar and Refine | `workspace-library.spec.mjs`: “search, category and tag filters preserve their constraints and return standalone positives”. Covered. |
+| Folder filtering of prompts | Prompt library → Refine → Folder | `workspace-library-filters.spec.mjs`: “Refine offers Folder, Tags and Tag match; a folder narrows the shelf to prompts with images there”. Covered (#444). |
+| Multiple tags AND/OR; untagged prompts | Library Tag match; Tags → Untagged prompts | `workspace-library-filters.spec.mjs`: “Tag match Any shows every prompt carrying one of the tags; changing only the match applies it”; vocabulary/state tests cover untagged. Covered. |
+| Newest/oldest and A–Z prompt sorting | Library sort | `workspace-library-state.test.js`, `workspace-library.spec.mjs` toolbar/sort cases. Covered for these orders. |
+| **Recently Used, Most Used, Z–A prompt sorting** (`prompt-list-sort.js:16`–`:22`) | **None**; native `library.mjs:39` and `library-state.mjs:13` allow only newest/name/oldest | **BLOCKER B1.** No equivalent was found. Preserve legacy. Decide whether each job is required or intentionally retired; do not implement it in this pass. Ratings sorts are a separate approved removal. |
+| Add prompt; category/tags/notes editing; duplicate rejection | New prompt / Edit metadata | `workspace-library-editor.spec.mjs`: “editor modes persist through reload with selected saved negative”; editor recovery cases. Covered for eligible parents and saved-pair metadata. |
+| Change existing prompt text in place | Create text revision | Same editor test proves a new positive/pair is created and old text remains. Consolidated with **different deliberate semantics**; include that difference in retirement approval rather than claiming identical mutation. Keep underlying legacy text-update API until consumer audit. |
+| **Manage the actual prompt-level category/tags/notes/text of a record used only as a negative component** | **No native component-management surface demonstrated**; pair metadata belongs to the pair | **BLOCKER B2 / contract decision.** `library.py:12` and `:449` exclude pure-negative records; `workspace-library.spec.mjs:47` asserts the grouping intentionally. Probe: old component is readable, absent from native parents, native detail is null. Grouping itself is approved; retiring management of that record's own metadata needs an explicit decision. No replacement screen in this pass. |
+| Prompt rating/minimum rating/Highest or Lowest Rated | No native rating controls | **Approved removal**, D153 / #447, [TESTING.md:3085](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/TESTING.md#L3085); keep stored ratings and the node/API contracts that still use them. Do not replace ratings with favorites in the data model. |
+| Select prompts; bulk category and tags | Prompt library selection bar | `workspace-library-selection.spec.mjs`: “Set category writes the selected prompts on the server, reloads the shelf and clears the selection”; “Add tags adds prompt tags to the selected prompts, suggests the vocabulary and reloads the shelf”. Covered. |
+| Confirm/retry prompt deletion | Library Delete… / archived shelf / Delete prompt… | `workspace-library-delete.spec.mjs`: “Delete… reviews the selection, deletes the unpaired, archives the paired and keeps the protected”; paired permanent-delete cases. Covered, with approved reference-safe archive/delete rules. |
+| View a prompt's images / filmstrip | Its Library history gallery and shared viewer | `workspace-library.spec.mjs`: “history displays the selected full negative beneath its positive and filters one shared physical gallery”. Covered. |
+| Tag list search; alphabetical and count sorts | Tags & categories toolbar | `workspace-vocabulary-state.test.js`, `workspace-vocabulary.spec.mjs`, #444 tag-sort cases. Covered; TAG_SORTS includes both directions and most/fewest prompts. |
+| Rename/delete/merge tags and browse associated prompts | Tags & categories | `workspace-vocabulary.spec.mjs`: “rename and merge persist and collapse duplicate links”, “delete tag confirms real impact and removes only the vocabulary name”, “prompt counts equal Library Browse results”. Covered. |
+| Gallery colliding filenames, source/folder/media filters, filename search | Images | `workspace-images.spec.mjs`: “native Images keeps colliding filenames distinct and inspects the selected source”; source/folder/media filter and filename-search tests. Covered. |
+| Grid/list, thumbnail size, continuous browsing | Images Grid/List/Masonry, thumbnail size, append + Load more | `workspace-images.spec.mjs`: “layout changes retain selection and use one collection in Grid, List and Masonry”; “continuous loading appends without replacing cards or losing selected details”. Covered. Manual columns/page-size/paged mode have an explicit simplified/approved-removal record, not a replacement control. |
+| Video playback; autoplay/mute/loop; mixed-media navigation | Shared viewer + Appearance | `workspace-system.spec.mjs`: “video defaults reach the viewer”; Images/video viewer cases; `workspace-inspect.spec.mjs`: “local video plays inline and in the viewer with real tags”. Covered. |
+| Slideshow, zoom/rotate/flip/fullscreen, keyboard/touch navigation | Shared media viewer | `tests/vendor` viewer fixture suite and [tests/browser/workspace-viewer-keys.spec.mjs](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/tests/browser/workspace-viewer-keys.spec.mjs) / `workspace-viewer-mode.spec.mjs`; viewer key and teardown tests. Keep the actual viewer tests when legacy controller tests go away. |
+| Metadata sidebar, full positive/negative text, settings, raw workflow, downloads | Shared current-file inspector/viewer | `full-inspector.spec.mjs`, `prompt-inspector.spec.mjs`, `workspace-history.spec.mjs`; the same file/prompt inspection contract is used throughout. Covered. |
+| Local PNG chooser/drag-and-drop, workflow download, copy individual prompts | Inspect a file | `workspace-inspect.spec.mjs`: “chooser opens the shared full inspector without a second read”, “drop accepts exactly one File and never navigates”, “local inspection makes no content request or storage write”; inspector download tests. Covered; local video extends it. |
+| Metadata COPY ALL summary | Shared inspector → Copy settings summary | `workspace-inspect.spec.mjs`: “Copy settings summary copies the same legacy summary in Images and Inspect”; no-clipboard fallback case. Covered (#249 L3 / D117). |
+| Per-image manual/automatic tags; batch generate/review/save | Images selection/tag dialog, Needs review, System tagging | `workspace-tagging-bulk.spec.mjs`, image-tagging/review specs, and native System table below. Covered with the approved image-owned tag model. Do not delete annotation/review persistence with old UI code. |
+| Add a prompt with category/tags/notes from the gallery (`gallery.js:2383`, `:2591`) | Images → New prompt / shared editor | `workspace-library-editor.spec.mjs`: “new from Images cancel preserves browse” also saves on its second open and checks navigation to the saved history; “editor modes persist through reload with selected saved negative” covers metadata persistence. Covered. The legacy form is a blank editor, not an automatic metadata import. Keep `/save` for existing consumers. |
+| Protect a prompt from cleanup; deliberately unprotect it | New native parents are retained by Library state; explicit `__protected__` tags remain editable through metadata/tag controls | Maintenance and `workspace-library-delete.spec.mjs` protected-record cases; [TESTING.md:2870](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/TESTING.md#L2870) / `:2924` records how to unprotect and the intentionally stronger deletion rule. Consolidated, with the default/explicit-delete semantics included in retirement approval rather than cloning the checkbox. |
+| Scan/duplicate job progress, reconnect, cancellation | Activity and shared review/job UI | `workspace-activity.spec.mjs`, System sources/maintenance tests. Covered; jobs remain session-only and lost jobs are shown honestly. |
+| Old static URLs and `admin#/tags/<tags>?mode=or` bookmarks | Plain-page mappings proposed below; deep filter URLs unresolved | **Approval gate.** Current URLs intentionally remain usable under #525. Hash fragments never reach the HTTP handler, so a blanket server redirect cannot preserve tag bookmarks. |
+| Bootstrap failure fallback and no-JS links | Current inline `workspace-boot-failure` links point to the legacy pages | **Retirement dependency**, not dead markup. `workspace.spec.mjs` tests module-fetch and startup-throw failures. Replace the fallback with a working reload/canvas/help path before removing its destinations. |
+
+### System parity: complete current inventory
+
+Source: [TESTING.md:5619](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/TESTING.md#L5619)–`:5708`. Its validator currently reports **54 rows: 48 covered, 4 kept in legacy, 2 approved removals**, with no missing declared-test references. S13 already removed many old System controls after coverage was approved. Those historical anchors do not imply the controls are still in the current HTML.
+
+| Capability | Legacy reference (historical) | Native destination/control | Current disposition | Declared proof |
+| --- | --- | --- | --- | --- |
+| Image scan directories add/remove | `admin.html:377–390`; `admin.js:200,1273–1323` | S4 Sources; `sources` · button · "+ Add source" | covered | Add source validates on the server, then marks the host draft dirty; Save persists (workspace-system-sources.spec.mjs) |
+| Currently monitoring list + Refresh | `admin.html:392–400`; `admin.js:1032` | S4 Sources; `sources` · button · "Refresh" | covered | watching only with a live observer; restart pending otherwise (workspace-system-sources.spec.mjs) |
+| Monitoring enabled | `py/config.py:212,248` | S4 Sources; `sources` · switch · "Watch for new outputs" | covered | Watch for new outputs saves monitoring_enabled; a restart applies it (workspace-system-sources.spec.mjs) |
+| Search results auto-hide `result_timeout` | `admin.html:407–412` | S3 Appearance; `appearance` · spinbutton · "Node search auto-hide (seconds)" | covered | host fields round-trip through /settings with revision (workspace-system.spec.mjs) |
+| Web UI display mode | `admin.html:414–422` | S3 Appearance; `appearance` · combobox · "Open from ComfyUI" | covered | host fields round-trip through /settings with revision (workspace-system.spec.mjs) |
+| Infinite scrolling default | `admin.html:424–430`; `admin.js:689–727` | Legacy prompt list (README continuous browsing); read-only in the report; — | kept in legacy | shouldLoadMore asks for the next page only near the bottom with pages left (list-state.test.js) |
+| Worker threads | `admin.html:437–445` | S4 Sources; `sources` · slider · "Worker threads" | covered | worker range max is cpu_count (workspace-system-sources.spec.mjs) |
+| LoraManager badge, enable, path, trigger words, CivitAI key, clear key | `admin.html:448–490`; `admin.js:1052–1156` | S10 Integrations; `integrations` · switch · "LoraManager integration" | covered | LoRA rows show detected / enabled / cache-loaded separately (workspace-system-integrations.spec.mjs) |
+| LoRA data import with progress | `admin.html:492–498,517–541`; `admin.js:1157` | S10 Integrations; `integrations` · button · "Review import" | covered | Review import shows replacement, blocked items and network effects with the backup box; Start opens the job (D107) (workspace-system-integrations.spec.mjs) |
+| Statistics | `admin.html:159`; `admin.js:1627` | S2 Overview; `overview` · button · "Explore" | covered | statistics dialog lists runs by category and database record counts (workspace-system.spec.mjs) |
+| Export components JSON `/export` | `admin.html:163`; `admin.js:1607`; [py/api/prompts.py:238](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/api/prompts.py#L238) | S9 Backup & export; `backups` · button · "Export all prompts JSON" | covered | Export JSON downloads /library/export; secondary buttons download all prompts (/export) and /pairs/export (D103) (workspace-system-backups.spec.mjs) |
+| Saved pairs export | [py/api/pairs.py:84](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/api/pairs.py#L84) | S9 Backup & export; `backups` · button · "Export saved pairs JSON" | covered | Export JSON downloads /library/export; secondary buttons download all prompts (/export) and /pairs/export (D103) (workspace-system-backups.spec.mjs) |
+| Library export | [py/api/library.py:223](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/api/library.py#L223) | S9 Backup & export; `backups` · button · "Export JSON" | covered | Export JSON downloads /library/export; secondary buttons download all prompts (/export) and /pairs/export (D103) (workspace-system-backups.spec.mjs) |
+| Diagnostics run | `admin.html:171,659`; `admin.js:1984` | S12 Diagnostics; `diagnostics` · button · "Run checks" | covered | Run checks opens the shared Health report (workspace-system-diagnostics.spec.mjs) |
+| Synthetic image-link test | `admin.html:662`; `admin.js:2101` | S12 Diagnostics; `diagnostics` · button · "Create test link…" | covered | Create test link confirms first and names the prompt (workspace-system-diagnostics.spec.mjs) |
+| Maintenance cleanup_duplicates, vacuum, cleanup_orphaned_images, prune_orphaned_prompts | `admin.html:692–748`; `admin.js:1834` | S6/S7 Maintenance; `maintenance` · button · "Review plan" · in "Duplicate prompt text" | covered | Apply reviewed operation closes, toasts, opens the job in Activity (workspace-system-maintenance.spec.mjs) |
+| Maintenance check_hash_duplicates, check_consistency | `admin.html:692–748`; `admin.js:1834` | S2 Health report (Maintenance notice, D123); `maintenance` · button · "Run health checks" | covered | Run health checks opens Health report and updates metric 4 (workspace-system.spec.mjs) |
+| Maintenance statistics (database info) | `admin.html:692–748`; `admin.js:1834` | S12 Diagnostics; `diagnostics` · term · "Database" | covered | meta-grid shows real database and source status, the pinned Viewer.js version and the host renderers (workspace-system-diagnostics.spec.mjs) |
+| Maintenance select all / clear all / run | `admin.html:754–762`; `admin.js:1822–1833` | S7 per-operation review; `maintenance` · button · "Review plan" | covered | plan dialog shows the server's scope, protected, backup policy and media lines with the backup box (D100); Cancel writes nothing (workspace-system-maintenance.spec.mjs) |
+| Prompt cleanup `/cleanup` | [py/api/admin.py:620](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/api/admin.py#L620) | S6/S7 Maintenance; `maintenance` · button · "Review plan" · in "Duplicate prompt text" | covered | test_duplicate_prompts_plan_counts_the_legacy_groups (test_maintenance_plans.py) |
+| Database backup | `admin.html:179,824`; `admin.js:2139,2454` | S9 Backup & export; `backups` · button · "Back up" | covered | Back up downloads through the api client and revokes the object URL (D103) (workspace-system-backups.spec.mjs) |
+| Restore from file | `admin.html:183,616–642`; `admin.js:2177–2248` | S8/S9 Backup & export; `backups` · button · "Review restore…" | covered | Review restore stages the chosen file and shows the real summary with the backup box (D105) (workspace-system-backups.spec.mjs) |
+| Metadata scan with progress, cancel, pill | `admin.html:187,805–865`; `admin.js:2336–2500` | S4 Sources; `sources` · button · "Review scan" | covered | Review scan opens the shared Review metadata scan with all sources (workspace-system-sources.spec.mjs) |
+| Rescan-required notice + dismiss | `admin.html:1367–1410`; `admin.js:991–1011` | S4 Sources; `sources` · button · "Later" | covered | notice Later persists the 3.2.0 dismissal (pm_update_notice_dismissed) without scanning (workspace-system-sources.spec.mjs) |
+| View logs with level and limit | `admin.html:195,885–907,974`; `admin.js:2579–2641` | S12 Logs; `diagnostics` · combobox · "Level" | covered | level filter is minimum-level over all six choices (workspace-system-diagnostics.spec.mjs) |
+| Log statistics | `admin.html:921–941`; `admin.js:2512` | S12 Logs; `diagnostics` · status · "Log statistics" | covered | log statistics show entries, errors, warnings, files and size (workspace-system-diagnostics.spec.mjs) |
+| Log files list and download | `admin.html:910,982–985`; `admin.js:2545,2642,2679` | S12 Logs; `diagnostics` · button · "Download log" | covered | each listed file downloads by its returned name and a link has no Download (workspace-system-diagnostics.spec.mjs) |
+| Clear/truncate logs | `admin.html:915`; `admin.js:2704` | S12 Logs; `diagnostics` · button · "Clear all logs…" | covered | Clear all logs states both counts, confirms first and reads everything again (workspace-system-diagnostics.spec.mjs) |
+| Rotated-log cleanup (new, #329) | — | S12 Logs; `diagnostics` · button · "Review log cleanup" | covered | Review log cleanup lists only rotated copies and keeps the rest (workspace-system-diagnostics.spec.mjs) |
+| Set log level (incl. CRITICAL), console logging | `admin.html:948–966`; `admin.js:2530,2729` | S12 Logs; `diagnostics` · combobox · "Runtime log level" | covered | runtime level (including CRITICAL) and console logging save and say they apply until the server restarts (workspace-system-diagnostics.spec.mjs) |
+| Log file_logging / max_file_size / backup_count / buffer_size | `py/api/logging_routes.py:56,285–299` | S12 Logs (read-only); `diagnostics` · group · "Log files & retention" | covered | each listed file downloads by its returned name and a link has no Download (workspace-system-diagnostics.spec.mjs) |
+| Auto-tag model list with status | `admin.html:1095–1148`; `admin.js:3641` | S11 Auto-tagging; `tagging` · combobox · "Tagging model" | covered | model options are the four real engines with size and the description shows live status (workspace-system-tagging.spec.mjs) |
+| Auto-tag model download | `admin.html:1413–1438`; `admin.js:3680–3747`; `gallery.js:3412` | S11 Auto-tagging; `tagging` · button · "Download" | covered | Download starts the job and Activity shows it without Cancel (workspace-system-tagging.spec.mjs) |
+| Unload model | `gallery.js:3480` | S11 Auto-tagging; `tagging` · button · "Unload" | covered | Unload is enabled only while a model is loaded, and a held gate's refusal names the operation (workspace-system-tagging.spec.mjs) |
+| Tag template, WD14 thresholds, already-tagged mode | `admin.html:1150–1198`; `admin.js:3748` | S11 Auto-tagging; `tagging` · combobox · "Existing tags" | covered | defaults save through Save preferences and the Tag image dialog uses them (workspace-system-tagging.spec.mjs) |
+| Batch auto-tag output images | `admin.html:191,1210,1279–1318`; `admin.js:3748–3840` | S11 Auto-tagging; `tagging` · button · "Review" | covered | Tag output images reviews the images, tags each one and never a prompt (#379) (workspace-system-tagging.spec.mjs) |
+| Batch review loop | `admin.html:1206,1218–1364`; `admin.js:3841–4172` | S11 + image-tagging plan; `tagging` · button · "Preview tagging review" | covered | Preview tagging review opens the Tag image dialog for the selected image (workspace-system-tagging.spec.mjs) |
+| Gallery per-image auto-tag / review | `gallery.html:601,605`; `gallery.js:3506,3674–3753` | Image-tagging plan (selection bar); — | covered | Auto-tag selected with Apply automatically runs a job with the chosen model, thresholds and suggestion count (workspace-tagging-bulk.spec.mjs) |
+| Gallery thumbnail generation | `gallery.js:1852,1967` | S5/S7; `sources` · button · "Review options" · in "Thumbnail generation" | covered | Start closes the dialog, toasts, and opens the job in Activity (workspace-system-sources.spec.mjs) |
+| Clear server thumbnails | `gallery.js:2175–2192` | S7 Maintenance; `maintenance` · button · "Review options" · in "Thumbnail cache" | covered | Thumbnail cache opens the S5 dialog (workspace-system-maintenance.spec.mjs) |
+| Browser cache clear | `gallery.js:2194–2207` | S7 Maintenance; `maintenance` · button · "Review plan" · in "Metadata cache" | covered | Metadata cache reviews and clears only owned browser entries when there are some (D102) (workspace-system-maintenance.spec.mjs) |
+| Refresh file listing | `gallery.js:2209` | S4 Sources; `sources` · button · "Refresh" · in "Refresh files" | covered | Refresh files calls /gallery/rescan and toasts its counts (workspace-system-sources.spec.mjs) |
+| Duplicate image scan, review, delete | `gallery.js:2234–2577` | S6/S7 Maintenance; `maintenance` · button · "Find duplicates" | covered | Find duplicates starts a job; its view links Review groups; Keep radios build a duplicate_files plan (D101) (workspace-system-maintenance.spec.mjs) |
+| Default view mode, image quality | `gallery-settings.js:26–27` | S3 Appearance; `appearance` · combobox · "Default layout" | covered | defaults apply to a new visit but not to the current view or a saved view (workspace-system.spec.mjs) |
+| Auto-load metadata, cache metadata, show file paths | `gallery-settings.js:31–33` | S3 Appearance; `appearance` · switch · "Load metadata on selection" | covered | metadata off shows an explicit load and loads once on request (workspace-system.spec.mjs) |
+| Video autoplay, mute, loop | `gallery-settings.js:40–42` | S3 Appearance; `appearance` · switch · "Autoplay videos" | covered | video defaults reach the viewer (workspace-system.spec.mjs) |
+| Image info on cards; sidebar collapsed | `gallery-settings.js:30,34` | S3 Appearance; `appearance` · switch · "Show image details on cards" | covered | added rows reach their consumers (workspace-system.spec.mjs) |
+| Reset gallery settings | `gallery.js:1813` | S3 Appearance; `appearance` · button · "Reset" | covered | reset restores defaults without touching other keys (workspace-system.spec.mjs) |
+| Lazy loading | `gallery-settings.js:25` | Legacy gallery (native always lazy); — | kept in legacy | a legacy gallery Save keeps the workspace keys and every other stored key (gallery-settings.test.js) |
+| Results per page / grid columns / paged mode | `gallery-settings.js:28–29,35` | README continuous browsing; — | approved removal | numeric strings from <select> values are accepted and columns are clamped (gallery-settings.test.js) |
+| Startup thumbnail prompt | `gallery-settings.js:38–39`; `gallery.js:2578` | README; Overview thumbnail row; — | approved removal | thumbnail row reflects the status endpoint (workspace-system.spec.mjs) |
+| Client debug output `debugMode` | `gallery-settings.js:36` | Legacy gallery (S12-10); — | kept in legacy | a legacy gallery Save keeps the workspace keys and every other stored key (gallery-settings.test.js) |
+| API timeout `apiTimeout` | `gallery-settings.js:37` | Legacy gallery (S12-10; read by no request); — | kept in legacy | defaults are a complete, sane settings object (gallery-settings.test.js) |
+| config.json-only keys | `py/config.py:212–234,722–739`; [py/api/diagnostics_report.py:185](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/py/api/diagnostics_report.py#L185) | S12 report (read-only); `diagnostics` · button · "Download diagnostic report" | covered | test_report_lists_config_only_keys (test_api_diagnostics_report.py) |
+
+The four kept-in-legacy settings are presentation/debug preferences, not four missing maintenance tools: legacy infinite-scroll default, lazy-loading toggle, debug output and an API-timeout value read by no request. The native app always uses continuous browsing/lazy loading. Include disposition of these old controls/keys in the retirement approval; keep existing stored preferences readable and preserve unrelated keys. Do not invent new native settings to reproduce inert controls.
+
+### Bookmark proposal (not approved)
+
+1. Keep the old HTTP entry points long term, even after their HTML/controllers retire.
+2. Plain `/admin` → workspace Library; plain `/gallery` → Images; `/gallery.html` → Inspect. Preserve any reverse-proxy mount prefix.
+3. Serve a tiny `/admin` compatibility shim for fragments, because the server cannot see `#/tags`. Bare `#/tags` can map to workspace Tags. Selected-tag AND/OR bookmarks require a separately approved mapping or explicit retirement of their filter semantics; until that decision, keep their legacy path functional.
+4. Do not drop unknown query/hash state silently or redirect a tag bookmark to unfiltered Images. Add tests for direct visits, proxy prefixes, Back navigation and fragment handling.
+5. Replace/remove every old link, including the static boot-failure/noscript fallback and README links, before deleting page files. `workspace.html` edits require a host restart because its response is cached.
+
+### Backend retirement boundary
+
+Retirement is not permission to delete every route old controllers called. The workspace still uses `/export`, backup/restore, prompt/pair/tag operations, settings, scans, thumbnails, logs, shared file serving and the model routes. The node library and bridge also call the HTTP surface independently. Keep schemas, migrations, restore/old-data readers, public node names/input order and root node modules. Review each apparently unused route as a separate contract decision after the frontend is gone.
+
+## 5. Coverage work, ranked by risk
+
+The aggregate gate is already strong. The useful additions are the following behavioral invariants, not a general percentage chase.
+
+| Priority | Retained boundary / evidence | Test work before refactoring |
+| --- | --- | --- |
+| 1 | UNC-backed backup, restore, Move library, history fence (F01) | Assert each reader uses the valid URI; then native Windows share round trips, old-schema restore, handle closure and rollback/no-write-on-failure. `history_read_fence.py` is 98.39% covered yet misses this whole platform contract. |
+| 1 | Backup/restore cancellation/adoption and library-move copy failures | `backup_restore.py` is 88.19% combined (78.79% branches); relevant gaps include `:506`, `:558`–`:563`, `:576`–`:577`, `:956`–`:970`. Exercise a cancelled worker that fails, post-publish cleanup failures that must not report an unperformed restore, and stage/handle retirement. In `library_move.py:517`–`:519` and `:538`–`:539`, fail a real copy operation and prove source/old library remain usable and only owned temps are cleaned. |
+| 1 | Delete/trash and removed-image recovery | Keep original bytes and reference-protection assertions; prove file/stream release before cleanup on Windows. The local macOS run measures [utils/trash.py](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/utils/trash.py) at 29.15% because Linux/BSD branches are skipped; do not treat that as missing Linux tests or lower a floor. Preserve `test_trash_freedesktop.py`, mount-root and route-audit coverage. This audit did not mount a filesystem or exercise native Windows locking. |
+| 2 | Prompt/image linking, cached run counts and metadata | Retain conservative ambiguous/unlinked results, FIFO cleanup, saved negative roles, document/inline-reader parity and Python/browser differential tests. Add a bounded-growth test before changing F02; do not replace the registry-reader tests without proving saved image metadata, run counting and history remain correct. |
+| 3 | API shape/type/oversize boundaries | F04's three cases must fail before the fix, then return 400 and preserve storage. Retain envelope/error-redaction tests; audit the other `.json()`-then-normalize handlers using the same case matrix. |
+| 3 | Model unload responsiveness and cancellation | Event-gated worker tests for F03; success/failure-only fake service tests are insufficient. Keep model-gate refusal/release tests. |
+| 4 | Shared code whose legacy tests would disappear | Before deleting legacy specs, move distinct shared PNG/Comfy metadata parsing, API-client/proxy-prefix behavior, gallerySettings unknown-key preservation, Viewer lifecycle, backup/restore and data-safety assertions into native/shared tests. Remove tests only for code actually removed. |
+
+Existing frontend floors are only 47% lines for admin, 54% for gallery and 57% for tags-page; these are legacy-specific baselines, not permission to give extracted new modules low coverage. New files need at least 80% lines and all retained per-file floors remain. Removing a measured file must remove its obsolete baseline entry and pass `coverage:baseline-check`; retained shared modules still enter combined coverage.
+
+## 6. Repository organization and distribution
+
+- Remove the three unreferenced image artifacts listed as DEAD: **1,737,407 bytes** in the current tree. Deleting them does not shrink old Git history, and no history rewrite is proposed.
+- Keep [README-legacy.md](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/README-legacy.md): README links it for the still-shipped old UI and the upgrade/rollback history, and TESTING links its database-path compatibility section. Do not remove old-data/recovery instructions just because the old controls retire. Later split the useful historical upgrade notes from page-only instructions, updating every link.
+- Ten of the eleven `images/` files are live documentation assets. Keep them while the legacy README points to them; do not move them for cosmetic root cleanup. `assets/readme/` is the current README's live image set.
+- Keep root node files exactly where ComfyUI imports them. Do not introduce a `src/` migration or rename a node/input during cleanup.
+- `docs/` is broadly ignored, including the audit and local plans. Existing tracked concept/design/docs remain tracked; new required tests/spec references in that tree must be explicitly accounted for. Local `EGM.md`, CLAUDE and AGENTS stay excluded. No needed currently tracked runtime file was found hidden by an ignore rule.
+- TESTING is 7,562 lines / 585,548 bytes. It combines execution commands, a safety contract, machine-parsed parity tables and a large decision/deviation ledger. A later organization commit can split reference material by feature while leaving a short testing entry point, stable links and parser inputs. Update `legacy-coverage.mjs` and its meaningful tests in the same change if tables move. Do not blindly move headings the guard parses.
+- Defer large facade splits until actual removals show the durable seams. [database/operations.py](https://github.com/ComfyAssets/ComfyUI_PromptManager/blob/7e11d9cae266b74e0820799eb0d74ab493e66026/database/operations.py) can eventually keep the public facade while delegating prompt search, vocabulary and image links. Avoid copying database logic into the API or creating divergent Toolkit controls.
+- The local tracked-bundle preview includes tests, tooling, docs and screenshots (F09); upstream packaging-source inspection explains why the absence of `.comfyignore` matters. Add a non-publishing artifact-content check and exclusions for the next approved release. No standard Python artifact was produced because the clean-snapshot build failed. Do not make an opportunistic version/build-metadata change or upload the local audit ZIPs.
+
+## 7. Proposed PR order — approval required
+
+These are proposed future implementation batches, not work included in this review-only PR. Use issue-linked implementation branches once the maintainer supplies an existing issue or approves creating/updating one. No issue will be posted as an incidental audit action. This review branch uses #334 as the related cutover context and does not close it or any other issue. Each PR needs exact-head checks, bot-review handling, Windows impact/evidence and a `Manual check:` line. Keep required checks/coverage thresholds unchanged.
+
+| Order | Proposed scope and logical commits | Validation / manual tier |
+| --- | --- | --- |
+| 1 — tests and small dead-code cleanup | About 4–6 commits: (1) add distinct retained data-safety coverage that does not just mirror implementation; (2) remove `_current_set`, `_gated_runner` and the unused keyword; (3) remove the old lock/scaffolding and safe test-only wrappers with their own tests; (4) remove the unused config writer while preserving ConfigStore behavior; (5) remove the three unreferenced assets; (6) reconcile root docs/local briefs. Defer public/compatibility helpers marked keep/UNSURE. | Targeted Python/Node tests, full Python suite and both coverage gates, baseline check, vendor/tooling checks, black/flake8 and pre-push. Legacy pages stay. **Manual check: none** for the behavior-neutral portion. |
+| 2 — narrow recovery/lifecycle fixes, before large refactors | About 4–6 commits, tests before each fix: UNC-safe SQLite reads and native controls; off-loop model unload/cancellation; invalid save-body refusals. These are explicit bug fixes, not a claim of byte-for-byte unchanged failure behavior. The registry only joins if its external-contract question is resolved and host tests prove removal safe. | Native Windows run is mandatory for UNC/handles. Managed Classic/Nodes 2.0 execution/reload tests for node-side changes. **Manual check: quick** for model unload/host behavior; upgrade to **required** if the real dependency behavior cannot be proved with the managed test host, and then keep that work out of a batch until tested. Python changes need a maintainer restart later. |
+| 3 — maintainability/organization only if still useful | About 3–5 commits: tests protecting the chosen seam; extract retained image/thumbnail/media helpers behind stable facades; remove genuinely redundant private helpers; split testing reference material with stable links/guards; define an artifact-content check without publishing. Avoid moving root node modules or touching pyproject/vendor/concept pins. Do not refactor legacy controllers destined for deletion. | Retained behavior/persistence/failure/cleanup tests and coverage on every new source file (80%+ for JS). **Manual check: none** unless host-facing behavior is involved; then isolate/validate it. |
+| Separate retirement stage — blocked | Only after parity-table approval and B1/B2/bookmark/fallback decisions. Small commits: links/compatibility entry points; old pages; controllers and proven legacy-only helper modules; application-owned obsolete CSS if any; route/query review last. No protected CSS/vendor edits. Keep database recovery/compatibility code. | Native workspace/shared tests replace distinct legacy coverage first; remove only obsolete tests, rerun baseline check and full frontend gate, and use the CI browser/real-host matrix. **Manual check: required**: targeted maintainer upgrade, bookmarked URL and real-host check. This stage is its own PR(s) and cannot join an untested cleanup batch. |
+
+If multiple approved PRs are ready together, follow the brief's combined-branch/one-commit-per-PR queue policy. Do not consume additional queue runs merely to parallelize cosmetic cleanup. Do not push a fix while the preceding head's CI still runs. No merging, publication or running-install modification is part of the current authorization.
+
+## 8. Open decisions and unresolved evidence
+
+1. **The maintainer approved sharing the audit for further review. Review the proposed implementation batches before starting cleanup.** Public compatibility helpers marked keep/UNSURE and all legacy pages remain unless separately approved.
+2. **B1:** preserve Recently Used / Most Used / reverse-alphabetical prompt browsing via separate work, or explicitly retire those jobs. Recommendation: keep the legacy page until a ruling; do not quietly remove them.
+3. **B2:** decide what users should do with prompt-level metadata on pure-negative component records. Recommendation: retain existing management access until that data contract is settled. Positive-parent grouping and pair metadata are already intentional; they do not themselves answer this question.
+4. **Registry:** identify any supported external consumer. Recommendation: remove the write-only registry only if there is none; otherwise bound both stores. Its public-looking method names and regression assertions merit an explicit decision.
+5. Approve bookmark mappings and the bootstrap-failure fallback before retirement. Deep tag-filter fragments cannot be preserved by a plain server redirect.
+6. Standard wheel support and the exact previously published Registry archive remain unverified. The local preview establishes development-file inclusion for the current tracked-file packaging path; `.comfyignore` and an artifact guard are proposed for approval, with no release or pyproject change. npm's initial notices and later offline result do not establish a current vulnerability verdict.
+7. The audit has no native Windows run, full Firefox/WebKit run, managed real-host matrix, live user test or fresh exact-head CI observation. Those are implementation/retirement verification gates, not results claimed here. No Windows claim is based solely on the macOS pass or the URI probe.
+
+The next action is additional review of this report. **Keep this PR in draft; do not mark ready, enqueue or merge it. Implementation belongs in separately approved branches.**

py/api/__init__.py

@@ -11,6 +11,7 @@ Split into domain-specific mixins for maintainability:
 - JobRoutesMixin: the session job registry behind Activity (py/api/jobs.py)
 - ImageTagJobsMixin: bulk Add tags / Auto-tag as image-tags jobs
 - ThumbnailJobsMixin: thumbnail plan, thumbnail job and the gallery stream on it
+- ThumbnailLocationMixin: the thumbnail location check and payloads (#320)
 - ThumbnailConvertMixin: Convert outdated thumbnails (#317), a thumbnail job mode
 - AutoThumbnailMixin: previews made on first view, on capture and after a scan
 - ReviewRoutesMixin: the Needs review queue, item detail and decisions
@@ -60,6 +61,11 @@ from .settings_routes import SettingsRoutesMixin
 from .job_routes import JobRoutesMixin
 from .image_tag_jobs import ImageTagJobsMixin
 from .thumbnail_jobs import ThumbnailJobsMixin
+from .thumbnail_location import ThumbnailLocationMixin
+from .thumbnail_move import ThumbnailMoveMixin
+from .thumbnail_move_plan import ThumbnailMovePlanMixin
+from .thumbnail_move_recovery import ThumbnailMoveRecoveryMixin
+from .thumbnail_prune import ThumbnailPruneMixin
 from .thumbnail_convert import ThumbnailConvertMixin
 from .thumbnail_auto import AutoThumbnailMixin
 from .system import SystemRoutesMixin
@@ -85,6 +91,8 @@ try:
     from ...database.operations import PromptDatabase
     from ...utils.file_prompt import parse_comfyui_prompt
     from ...utils.logging_config import get_logger
+    from ...utils.native_memory import release_free_memory
+    from ...utils.png_text import png_text
     from ...utils.video_metadata import is_video_path, read_video_metadata
 except ImportError:
     import sys
@@ -95,6 +103,8 @@ except ImportError:
     from database.operations import PromptDatabase
     from utils.file_prompt import parse_comfyui_prompt
     from utils.logging_config import get_logger
+    from utils.native_memory import release_free_memory
+    from utils.png_text import png_text
     from utils.video_metadata import is_video_path, read_video_metadata
 
 
@@ -334,6 +344,11 @@ class PromptManagerAPI(
     JobRoutesMixin,
     ImageTagJobsMixin,
     ThumbnailJobsMixin,
+    ThumbnailLocationMixin,
+    ThumbnailMovePlanMixin,
+    ThumbnailMoveMixin,
+    ThumbnailMoveRecoveryMixin,
+    ThumbnailPruneMixin,
     ThumbnailConvertMixin,
     AutoThumbnailMixin,
     SystemRoutesMixin,
@@ -526,6 +541,14 @@ class PromptManagerAPI(
             return await loop.run_in_executor(None, call)
         return await loop.run_in_executor(None, func, *args)
 
+    async def _release_job_memory(self):
+        """After a scan or thumbnail job: glibc's free heap pages go back to
+        the OS once (``malloc_trim(0)``; nothing elsewhere, #523)."""
+        try:
+            await self._run_in_executor(release_free_memory)
+        except Exception:  # best effort: the job's result already stands
+            self.logger.debug("Releasing free memory failed", exc_info=True)
+
     def _root_listing(self, root) -> RootListing:
         """The shared listing record of one output root (created empty)."""
         return self._root_listings.setdefault(str(root), RootListing())
@@ -704,6 +727,7 @@ class PromptManagerAPI(
         # ── Register domain-specific routes from mixins ───────────────
 
         self._register_pair_routes(routes)
+        self._register_thumbnail_move_routes(routes)
         self._register_library_routes(routes)
         self._register_library_delete_routes(routes)
         self._register_vocabulary_routes(routes)
@@ -840,20 +864,11 @@ class PromptManagerAPI(
                         f"{url_quote(rel_path.as_posix(), safe='/')}"
                     )
 
-                    # Any preview the file owns, the current format first (#317)
-                    from . import thumbnail_settings
-                    from .prompts import thumbnail_url_for
+                    # Any preview the file owns, the current format first
+                    # (#317); no store I/O here in folder mode (#320).
+                    from .images import listing_thumbnail_url
 
-                    existing = thumbnail_settings.existing_thumbnail(
-                        output_path, rel_path
-                    )
-                    thumbnail_url = None
-                    if existing is not None:
-                        thumb_rel = (
-                            thumbnail_settings.thumbnail_stem_rel(rel_path)
-                            + existing.suffix
-                        )
-                        thumbnail_url = thumbnail_url_for(thumb_rel, existing)
+                    thumbnail_url = listing_thumbnail_url(output_path, rel_path)
                     if thumbnail_url:
                         image["thumbnail_url"] = thumbnail_url
                     break  # Found matching root, stop searching
@@ -1048,6 +1063,8 @@ class PromptManagerAPI(
     def _extract_comfyui_metadata(self, image_path):
         """Embedded ComfyUI metadata of an image (PNG text chunks) or a video.
 
+        PNG text is read without decoding the pixels (``utils.png_text``, #523).
+
         Videos go through ffprobe (see utils/video_metadata). Unreadable files
         are a warning, not an error: a scan over a large output tree meets
         truncated and foreign files, and it carries on past them.
@@ -1056,7 +1073,7 @@ class PromptManagerAPI(
             return read_video_metadata(image_path)
         try:
             with Image.open(image_path) as img:
-                return dict(getattr(img, "text", None) or {})
+                return png_text(img)
         except Exception as e:
             self.logger.warning(
                 f"Unreadable image {os.path.basename(str(image_path))}: {e}"

py/api/admin.py

@@ -1454,6 +1454,7 @@ class AdminRoutesMixin:
             verb = "cancelled" if state == "cancelled" else "finished"
             job.log_line(f"Scan {verb} · {_plural(job.processed, 'file')} processed")
         job.finish(state)
+        await self._release_job_memory()
         if state == "finished":
             # After the scan, so the guarded thumbnail job is admitted (#249).
             await self._hand_off_scan_thumbnails(job, output_dirs)
@@ -1668,9 +1669,10 @@ class AdminRoutesMixin:
     def _extract_batch_metadata_sync(self, file_batch):
         """Extract metadata from a batch of files in one executor call.
 
-        Files are read on ``PromptManagerConfig.WORKER_THREADS`` threads:
-        Pillow decodes the whole image to reach trailing text chunks and
-        releases the GIL while doing so.
+        Files are read on the long-lived job pool of
+        ``PromptManagerConfig.WORKER_THREADS`` threads (#523).
+        PNG text is read chunk by chunk without decoding pixels (#523); file
+        reads and ffprobe release the GIL.
         """
         from ..config import PromptManagerConfig
 

py/api/annotation_suggest.py

@@ -102,11 +102,14 @@ def model_refusal(status: dict, model_type: str, model_name: str):
     return None
 
 
-def run_suggestions(service, capture_path: str, model_type: str, options: dict):
+def run_suggestions(
+    service, capture_path: str, model_type: str, options: dict, skip=None
+):
     """Blocking: load (or swap to) *model_type*, then suggest for the capture.
 
     The caller holds the model gate for the whole call; nothing is ever
-    downloaded (``load_model`` refuses a model that is not on disk).
+    downloaded (``load_model`` refuses a model that is not on disk). ``skip``
+    is the request's or job's compiled Skipped tags (#431).
     """
     if not service.is_model_loaded() or service.get_loaded_model_type() != model_type:
         service.load_model(model_type, options["use_gpu"])
@@ -116,6 +119,7 @@ def run_suggestions(service, capture_path: str, model_type: str, options: dict):
         prompt=options.get("instructions"),
         general_threshold=options.get("general_threshold"),
         character_threshold=options.get("character_threshold"),
+        skip=skip,
     )
 
 

py/api/annotations.py

@@ -35,6 +35,7 @@ from .media_target import media_target as _target
 from .images import _unavailable_link, _verified_title
 from .prompts import bad_request
 from .. import model_gate
+from ..tagging_defaults import SkipMatcher
 
 try:
     from ...database.annotations import (
@@ -640,6 +641,8 @@ class AnnotationRoutesMixin:
             owner = model_gate.new_owner("image-annotations")
             if not model_gate.try_acquire(owner):
                 return model_busy_response()
+            # #431: the Skipped tags as they are when the request is accepted.
+            skip = SkipMatcher(AutotagConfig.SKIPPED_TAGS).counting()
             try:
                 # From here the pin is the gate's to end: the worker ends it,
                 # or ``on_skipped`` does when the worker never starts.
@@ -653,6 +656,7 @@ class AnnotationRoutesMixin:
                     capture,
                     model_type,
                     options,
+                    skip,
                     on_skipped=functools.partial(store.release_use, token),
                 )
             except MissingBackendPackages as exc:
@@ -677,6 +681,8 @@ class AnnotationRoutesMixin:
                 "model_type": model_type,
                 "options": options,
                 "suggestions": suggestion_rows(pairs),
+                # How many distinct suggestions the Skipped tags hid (#431).
+                "skipped": len(skip.hidden),
             },
             headers={"Cache-Control": "no-store"},
         )
@@ -732,10 +738,10 @@ def _byte_range(request: web.Request, size: int):
     return start, stop
 
 
-def _pinned_suggestions(store, token, service, capture, model_type, options):
+def _pinned_suggestions(store, token, service, capture, model_type, options, skip=None):
     """Worker thread: infer on the capture, then end its pin (even on error)."""
     try:
-        return run_suggestions(service, capture.path, model_type, options)
+        return run_suggestions(service, capture.path, model_type, options, skip)
     finally:
         store.release_use(token)
 

py/api/autotag_routes.py

@@ -19,8 +19,8 @@ from .jobs import (
 )
 
 from .maintenance import disk_plan
-from .prompts import thumbnail_url_for
-from . import thumbnail_settings
+from .images import listing_thumbnail_url
+from . import preview_store
 from .. import model_gate
 
 try:
@@ -40,6 +40,12 @@ BATCH_PREVIEW_BODY_MAX = 1024
 APPLY_BODY_MAX = 64 * 1024  # POST /autotag/apply: one image and its tags
 _HEX64 = re.compile(r"[0-9a-f]{64}")
 BATCH_JOB_BODY_MAX = 32 * 1024
+# Skipped tags preview (#431): 200 entries of 50 characters, with room for JSON.
+SKIPPED_PREVIEW_BODY_MAX = 64 * 1024
+SKIPPED_PREVIEW_LEASE = "Skipped tags preview"
+SKIPPED_PREVIEW_SAMPLE = 12
+# WD14 label lists the preview found missing or unreadable (logged once each).
+_MISSING_LABEL_LISTS = set()
 REVIEW_REQUIRED = (
     "Replacing tags needs a review of each image. Use Preview tagging review, "
     "or choose Skip or Merge for a batch run."
@@ -72,6 +78,12 @@ MODEL_DOWNLOAD_BODY_MAX = 1024
 _download_titles = {}
 
 
+def _instruction_engine(model_type: str) -> str:
+    """The language-model engine whose default instructions ``model_type``
+    reads: itself, or GGUF for a WD14 engine (which takes none)."""
+    return model_type if model_type in ("gguf", "hf") else "gguf"
+
+
 def _holder_label(holder: Optional[str]) -> str:
     if not holder:
         return ANOTHER_OPERATION
@@ -247,6 +259,10 @@ class AutotagRoutesMixin:
         async def preview_autotag_batch_route(request):
             return await self.preview_autotag_batch(request)
 
+        @routes.post("/prompt_manager/autotag/skipped-tags/preview")
+        async def preview_skipped_tags_route(request):
+            return await self.preview_skipped_tags(request)
+
         @routes.post("/prompt_manager/autotag/start")
         async def start_autotag_route(request):
             return await self.start_autotag(request)
@@ -284,7 +300,15 @@ class AutotagRoutesMixin:
                     "success": True,
                     "models": public_models(status, loaded_type),
                     # The saved tagging defaults (#328, System › Auto-tagging).
-                    "default_prompt": AutotagConfig.TEMPLATE,
+                    # The saved engine's default instructions (GGUF for a
+                    # WD14 engine); kept one release for cached pages (#431).
+                    "default_prompt": AutotagConfig.default_instructions_text(
+                        _instruction_engine(AutotagConfig.MODEL_TYPE)
+                    ),
+                    # #431: Built-in first, with every text, and each
+                    # language-model engine's default.
+                    "instructions": AutotagConfig.all_instructions(),
+                    "default_instructions": dict(AutotagConfig.DEFAULT_INSTRUCTIONS),
                     "model_loaded": loaded,
                     "loaded_model_type": loaded_type,
                     "wd14_general_threshold": AutotagConfig.GENERAL_THRESHOLD,
@@ -539,7 +563,10 @@ class AutotagRoutesMixin:
         else:
             prompt = params.get("prompt")
             template = prompt if isinstance(prompt, str) and prompt.strip() else None
-            options = {"instructions": template or AutotagConfig.TEMPLATE}
+            options = {
+                "instructions": template
+                or AutotagConfig.default_instructions_text(model_type)
+            }
         try:
             _model, options = validate_options(
                 model_type,
@@ -699,6 +726,86 @@ class AutotagRoutesMixin:
             return None, "existing must be one of " + ", ".join(EXISTING_POLICIES)
         return MODELS[model_type], None
 
+    async def preview_skipped_tags(self, request):
+        """Which known tags a Skipped tags list would hide (#431); no write.
+
+        ``{entries}`` is checked as a save checks it (the same 400 sentence).
+        The known tags are the library's plus the general and character names
+        of each downloaded WD14 label list; no model is loaded and no image is
+        opened. Refused (409 ``busy``) while an exclusive job runs.
+        """
+        from ..tagging_defaults import validate_skipped_tags
+
+        data, error = await self._batch_body(
+            request, ("entries",), SKIPPED_PREVIEW_BODY_MAX
+        )
+        if error is not None:
+            return error
+        try:
+            entries = validate_skipped_tags(data["entries"])
+        except ValueError as exc:
+            return web.json_response({"success": False, "error": str(exc)}, status=400)
+        try:
+            async with self._jobs.lease(SKIPPED_PREVIEW_LEASE):
+                result = await self._run_in_executor(self._skipped_preview, entries)
+        except JobBusy as busy:
+            return busy_response(busy)
+        except Exception:
+            self.logger.exception("The Skipped tags preview failed")
+            return web.json_response(
+                {"success": False, "error": _INTERNAL_ERROR}, status=500
+            )
+        return web.json_response({"success": True, **result})
+
+    def _skipped_preview(self, entries):
+        """Worker thread: the preview's counts over the known tags."""
+        from ..autotag import MODELS, get_autotag_service
+        from ..tagging_defaults import (
+            WD14_MODEL_TYPES,
+            SkipMatcher,
+            wd14_label_names,
+        )
+
+        library = self.db.get_all_tags()
+        known = {}  # case-folded -> (0 library / 1 label list, spelling)
+        for name in library:
+            known.setdefault(name.casefold(), (0, name))
+        lists = []
+        models_dir = getattr(get_autotag_service(), "models_dir", None)
+        for model_type in sorted(WD14_MODEL_TYPES, key=lambda t: MODELS[t]["name"]):
+            if models_dir is None:
+                break
+            path = Path(models_dir) / MODELS[model_type]["subdir"] / "selected_tags.csv"
+            try:
+                names = wd14_label_names(path)
+            except (OSError, ValueError) as exc:
+                if path not in _MISSING_LABEL_LISTS:  # logged once per list
+                    _MISSING_LABEL_LISTS.add(path)
+                    self.logger.debug(f"No WD14 label list for {model_type}: {exc}")
+                continue
+            _MISSING_LABEL_LISTS.discard(path)
+            lists.append(MODELS[model_type]["name"])
+            for name in names:
+                known.setdefault(name.casefold(), (1, name))
+        matchers = [(entry, SkipMatcher([entry])) for entry in entries]
+        whole = SkipMatcher(entries)
+        hidden = [item for item in known.values() if whole.matches(item[1])]
+        hidden.sort(key=lambda item: (item[0], item[1].casefold()))
+        per_entry = [
+            {
+                "entry": entry,
+                "count": sum(1 for _, name in hidden if matcher.matches(name)),
+            }
+            for entry, matcher in matchers
+        ]
+        return {
+            "count": len(hidden),
+            "sample": [name for _, name in hidden[:SKIPPED_PREVIEW_SAMPLE]],
+            "sample_limit": SKIPPED_PREVIEW_SAMPLE,
+            "per_entry": per_entry,
+            "sources": {"library": len(library), "wd14": lists},
+        }
+
     async def preview_autotag_batch(self, request):
         """Review Tag output images: counts, model, backup and disk; no write.
 
@@ -1002,7 +1109,10 @@ class AutotagRoutesMixin:
         else:
             prompt = data.get("prompt")
             template = prompt if isinstance(prompt, str) and prompt.strip() else None
-            options = {"instructions": template or AutotagConfig.TEMPLATE}
+            options = {
+                "instructions": template
+                or AutotagConfig.default_instructions_text(model_type)
+            }
         use_gpu = data.get("use_gpu", True)
         options["use_gpu"] = use_gpu if isinstance(use_gpu, bool) else True
         return validate_options(
@@ -1096,6 +1206,8 @@ class AutotagRoutesMixin:
 
     async def _suggest_single(self, target, model_type, options, base):
         from ..autotag import MODELS, MissingBackendPackages, get_autotag_service
+        from ..config import AutotagConfig
+        from ..tagging_defaults import SkipMatcher
         from .annotation_suggest import model_refusal
         from .annotations import _pinned_suggestions, _settled, _submit
 
@@ -1112,6 +1224,8 @@ class AutotagRoutesMixin:
         owner = model_gate.new_owner("legacy-single")
         if not model_gate.try_acquire(owner):
             return model_busy_response()
+        # #431: the legacy review hides the Skipped tags too (19A).
+        skip = SkipMatcher(AutotagConfig.SKIPPED_TAGS)
         store = self._capture_store()
         try:
             epoch = await self._run_in_executor(self.db.get_execution_epoch)
@@ -1151,6 +1265,7 @@ class AutotagRoutesMixin:
                     capture,
                     model_type,
                     options,
+                    skip,
                     on_skipped=functools.partial(store.release_use, capture.token),
                 )
             except MissingBackendPackages as exc:
@@ -1371,23 +1486,21 @@ class AutotagRoutesMixin:
             files = await self._run_in_executor(
                 self._without_removed, output_path, files
             )
-            has_thumbnails = (output_path / "thumbnails").is_dir()
+            location = preview_store.current()
+            if location.mode == preview_store.FOLDER_MODE:
+                has_thumbnails = location.available  # no store I/O here (#320)
+            else:
+                store = preview_store.store_dir(output_path)
+                has_thumbnails = store is not None and store.is_dir()
 
             images = []
             for image_path in files:
                 rel_path = image_path.relative_to(output_path)
                 thumbnail_url = None
                 if has_thumbnails:
-                    # Any preview the file owns, the current format first (#317)
-                    existing = thumbnail_settings.existing_thumbnail(
-                        output_path, rel_path
-                    )
-                    if existing is not None:
-                        thumb_rel = (
-                            thumbnail_settings.thumbnail_stem_rel(rel_path)
-                            + existing.suffix
-                        )
-                        thumbnail_url = thumbnail_url_for(thumb_rel, existing)
+                    # Any preview the file owns, the current format first
+                    # (#317); in folder mode without store I/O (#320).
+                    thumbnail_url = listing_thumbnail_url(output_path, rel_path)
                 images.append(
                     {
                         "filename": image_path.name,

py/api/duplicate_files.py

@@ -65,6 +65,7 @@ from .duplicate_review import (  # noqa: F401 (CHANGED, OUTSIDE_SOURCE: public)
     NOT_ATTEMPTED,
     OUTSIDE_SOURCE,
     RECORDS_FAILED,
+    REVIEW_KEPT_DETAILS,
     ROW_DETAILS,
     SAME_FILE,
     SOURCES_CHANGED,
@@ -434,6 +435,7 @@ class DuplicateFilesMixin:
             {
                 "targets": review["targets"],
                 "kept": review["kept"],
+                "held": review["held"],
                 "protected": review["public"]["protected"]["count"],
             },
         )
@@ -446,7 +448,7 @@ class DuplicateFilesMixin:
         job hashes each file again right before it unlinks it.
         """
         listed = self._listed_sources()
-        targets, kept, protected = [], [], {}
+        targets, kept, protected, held = [], [], {}, []
         for group, keepers in selection.values():
             removals = [r for r in group["files"] if r not in keepers]
             for record in removals:
@@ -467,6 +469,7 @@ class DuplicateFilesMixin:
                     problem = _bound_problem(record, group, keeper)
                 if problem:
                     protected[problem] = protected.get(problem, 0) + 1
+                    held.append(self._copy_row(record, REVIEW_KEPT_DETAILS[problem]))
                     continue
                 reviewed.append(self._target(group, record, keeper))
             if reviewed:
@@ -488,6 +491,7 @@ class DuplicateFilesMixin:
         return {
             "targets": targets,
             "kept": kept,
+            "held": held,
             "fingerprint": _fingerprint(targets),
             "public": _public_plan(targets, protected, records),
         }
@@ -584,6 +588,13 @@ class DuplicateFilesMixin:
 
     async def _remove_duplicates(self, job, db, plan, backup):
         targets = plan.payload["targets"]
+        # #586: every copy the review protected, with its reason, and the
+        # whole group in the report.
+        held = plan.payload["held"]
+        job.record_counted("kept", len(held), held, complete=True)
+        if held:
+            copies = _plural(len(held), "copy", "copies")
+            job.log_line(f"Kept {copies} the review protected")
         for row in plan.payload["kept"]:
             job.record("kept", row, f"= {row['root']}/{row['path']} · {KEPT_COPY}")
         job.update(total=len(targets), status_line="Removing duplicate files")

py/api/duplicate_review.py

@@ -70,6 +70,18 @@ PROTECTED_REASONS = {
         "files kept: their kept copy changed or is gone",
     ),
 }
+# The job's row for a copy the review protected (#586): the review's reason.
+REVIEW_KEPT_DETAILS = {
+    MAYBE_SAME: "Kept: may be the same file reached through another mount or share",
+    NO_FILE_ID: "Kept: can't confirm this is a separate file on this drive",
+    SAME: "Kept: the same file as its kept copy",
+    OUTSIDE_SOURCE: "Kept: not inside a configured source",
+    LINK: "Kept: a link, not a regular file",
+    CHANGED_CONTENT: "Kept: changed since the search",
+    GONE: "Kept: no longer exists",
+    UNREADABLE: "Kept: could not be read",
+    KEEPER: "Kept: its kept copy changed or is gone",
+}
 # Job outcome rows (never an OS error text).
 CHANGED = "The file changed since the review; it was kept."
 KEEPER_CHANGED = "The kept copy changed or is gone; this file was kept."

py/api/history.py

@@ -843,7 +843,10 @@ class HistoryRoutesMixin:
                 raise
 
         async def execute():
-            pending = asyncio.create_task(self._run_in_executor(project))
+            # An inspection reads the file's header and text: the
+            # interactive image pool (#523); media stays on the default.
+            run = self._run_image if kind == "inspection" else self._run_in_executor
+            pending = asyncio.create_task(run(project))
             try:
                 return await asyncio.shield(pending)
             except asyncio.CancelledError:

py/api/history_current.py

@@ -15,10 +15,10 @@ from typing import BinaryIO
 
 from aiohttp import web
 
-from . import thumbnail_settings
+from . import preview_store, thumbnail_settings
 from .images import _canonical, _public_path, SERVABLE_EXTENSIONS, VIDEO_EXTENSIONS
 from .images import in_trash_below_roots
-from .images import existing_media_thumbnail, media_thumbnail_rel
+from .images import existing_media_thumbnail, media_preview_path
 
 try:
     from ...utils.execution_outputs import (
@@ -244,19 +244,36 @@ def resolve_current_candidate(
         return _unavailable("temporary_unavailable", error=True)
 
 
+def _target_authorized(target, namespace, scope, store_root=None) -> bool:
+    """A preview in the thumbnail folder (#320, folder mode) is authorized by
+    the store of its source (``preview_store.owns``: inside the key folder,
+    no link); everything else by the output namespace and the roots."""
+    if (
+        store_root is not None
+        and preview_store.current().mode == preview_store.FOLDER_MODE
+    ):
+        return preview_store.owns(store_root, target)
+    return _authorized(target, namespace, scope)
+
+
 def _open_current_target(
-    target: Path, namespace: Path, scope: CurrentOutputScope, preview: bool = False
+    target: Path,
+    namespace: Path,
+    scope: CurrentOutputScope,
+    preview: bool = False,
+    store_root: Path | None = None,
 ) -> BinaryIO:
     """Open only the canonical target and verify authority against the actual handle.
 
-    A *preview* (a file under ``thumbnails/``) may also be JPEG XL (#317)."""
+    A *preview* (a file under ``thumbnails/``) may also be JPEG XL (#317); in
+    folder mode it is authorized by the store of *store_root* (#320)."""
     if _canonical(target) != target:
         raise CurrentLocationUnavailable("not_authorized", stale=True)
     if in_trash_below_roots(target, [namespace]):
         # Also at the open: the cover chooses its preview after the candidate
         # check, and a preview can be a link into a trash folder (#543).
         raise CurrentLocationUnavailable("missing")
-    if not _authorized(target, namespace, scope):
+    if not _target_authorized(target, namespace, scope, store_root):
         raise CurrentLocationUnavailable("not_authorized")
     suffix = target.suffix.lower()
     if suffix not in SERVABLE_EXTENSIONS and not (
@@ -289,7 +306,7 @@ def _open_current_target(
         if (
             _canonical(target) != target
             or (observed.st_dev, observed.st_ino) != (current.st_dev, current.st_ino)
-            or not _authorized(target, namespace, scope)
+            or not _target_authorized(target, namespace, scope, store_root)
         ):
             raise CurrentLocationUnavailable("not_authorized", stale=True)
         return os.fdopen(fd, "rb")
@@ -326,12 +343,10 @@ class _OpenedCurrentMedia:
 
 
 def _preview_writable(root: Path, preview: Path) -> bool:
-    """A preview may be written: ``thumbnails`` and every link segment of the
-    preview's folder resolve inside *root* (the serve route's rule, #249)."""
-    folder = root / "thumbnails"
-    return _canonical(folder).is_relative_to(_canonical(root)) and _canonical(
-        preview
-    ).is_relative_to(_canonical(folder))
+    """A preview may be written: the store of *root* and every link segment
+    of the preview's folder resolve inside it (the serve route's rule, #249;
+    ``preview_store.owns``)."""
+    return preview_store.owns(root, preview)
 
 
 def _is_jxl(path) -> bool:
@@ -381,8 +396,12 @@ def _cover_target(resolved, ensure_preview, placeholder, accepts_jxl):
         return _canonical(preview)
     if preview is not None:
         return _canonical(preview)
-    preview = resolved.gallery_root / media_thumbnail_rel(relative)
-    if ensure_preview is not None and _preview_writable(resolved.gallery_root, preview):
+    preview = media_preview_path(resolved.gallery_root, relative, create=True)
+    if (
+        ensure_preview is not None
+        and preview is not None
+        and _preview_writable(resolved.gallery_root, preview)
+    ):
         ensure_preview(target, preview, is_video)
     if is_video and placeholder is not None:
         return _placeholder_media(placeholder)
@@ -418,7 +437,13 @@ def _prepare_current_media(
             return chosen
         if chosen is not None:
             target, is_preview = chosen, True
-    handle = _open_current_target(target, resolved.namespace, scope, is_preview)
+    handle = _open_current_target(
+        target,
+        resolved.namespace,
+        scope,
+        is_preview,
+        resolved.gallery_root if is_preview else None,
+    )
     try:
         return _OpenedCurrentMedia(
             handle,

py/api/image_tag_jobs.py

@@ -39,6 +39,7 @@ from typing import NamedTuple
 from aiohttp import web
 
 from .. import model_gate
+from ..tagging_defaults import SkipMatcher
 from .admin import _plural, _time_left
 from .annotation_suggest import (
     OptionError,
@@ -170,6 +171,8 @@ class _Run:
     owner: object
     service: object = None
     roots: dict = field(default_factory=dict)
+    # The job's Skipped tags, compiled once at its start (#431).
+    skip: object = None
 
 
 @dataclass(frozen=True)
@@ -183,6 +186,9 @@ class _Spec:
     options: dict | None = None
     # A listing filter the start resolves into ``targets`` (#392).
     filter: dict | None = None
+    # The Skipped tags when the job was requested (#431); a later save does
+    # not change a running job.
+    skip: tuple = ()
 
     @property
     def title(self) -> str:
@@ -238,7 +244,11 @@ def _parse_auto(targets, data):
         )
     except OptionError as exc:
         return None, bad_request(str(exc))
-    return _Spec("auto", targets, model_type=model_type, options=options), None
+    skip = tuple(AutotagConfig.SKIPPED_TAGS)
+    return (
+        _Spec("auto", targets, model_type=model_type, options=options, skip=skip),
+        None,
+    )
 
 
 def parse_image_tag_request(data: dict):
@@ -329,6 +339,8 @@ class AutotagRun:
     keep_in_memory: bool
     backup_on: bool
     owner: object
+    # The Skipped tags when the job was started (#431).
+    skip: tuple = ()
 
 
 @dataclass(frozen=True)
@@ -400,6 +412,14 @@ def _load_model(service, model_type: str, use_gpu: bool) -> None:
         raise RuntimeError(f"{model_type} could not be loaded")
 
 
+def _skipped_tags_line(entries: tuple) -> str:
+    """The job log's one line about the Skipped tags it runs with (#431)."""
+    if not entries:
+        return "Skipped tags: none"
+    count = len(entries)
+    return f"Skipped tags: {count} {'entry' if count == 1 else 'entries'}"
+
+
 def _refusal(status: int, code: str, message: str) -> Refusal:
     response = web.json_response(
         {"success": False, "code": code, "error": message}, status=status
@@ -507,6 +527,7 @@ class ImageTagJobsMixin:
         released when the task ends, also before its runner ever starts.
         """
         from ..autotag import MODELS, get_autotag_service
+        from ..config import AutotagConfig
 
         backup_on = self._safety_backup_policy() == "on"
         status = await self._run_in_executor(get_autotag_service().get_models_status)
@@ -529,7 +550,13 @@ class ImageTagJobsMixin:
             response = model_busy_response()
             return None, Refusal(409, "model-busy", MODEL_BUSY_ERROR, response)
         run = AutotagRun(
-            model_type, existing, options, keep_in_memory, backup_on, owner
+            model_type,
+            existing,
+            options,
+            keep_in_memory,
+            backup_on,
+            owner,
+            skip=tuple(AutotagConfig.SKIPPED_TAGS),
         )
         admitted = False
         try:
@@ -598,7 +625,9 @@ class ImageTagJobsMixin:
             return _batch_cancelled(job)
         job.publish({"type": "phase", "phase": "model"})
         job.update(status_line="Loading the tagging model")
-        spec = _Spec("auto", (), model_type=run.model_type, options=run.options)
+        spec = _Spec(
+            "auto", (), model_type=run.model_type, options=run.options, skip=run.skip
+        )
         service = await self._prepare_tagging_model(job, spec, run.owner)
         if service is None:
             return "failed"
@@ -624,6 +653,7 @@ class ImageTagJobsMixin:
             f"Tagging started · {job.scope.get('label') or run.model_type} · "
             f"{_plural(total, 'image')} · {policy}"
         )
+        job.log_line(_skipped_tags_line(spec.skip))
         if job.cancelled:
             return _batch_cancelled(job)
         remaining = await self._autotag_prepass(job, targets, run.existing == "skip")
@@ -633,7 +663,9 @@ class ImageTagJobsMixin:
         spec = dataclasses.replace(
             spec, targets=tuple(item.target for item in remaining)
         )
-        loop_run = _Run(job, spec, epoch, run.owner, service)
+        loop_run = _Run(
+            job, spec, epoch, run.owner, service, skip=SkipMatcher(spec.skip)
+        )
         if not await self._tag_each_file(loop_run, done_before=done):
             job.update(status_line=STORAGE_RESTORED)
             job.log_line(f"Tagging stopped · {STORAGE_RESTORED}")
@@ -739,6 +771,9 @@ class ImageTagJobsMixin:
             started += f" · {spec.model_type}"
         job.log_line(started)
         run = _Run(job, spec, epoch, owner)
+        if spec.mode == "auto":
+            job.log_line(_skipped_tags_line(spec.skip))
+            run.skip = SkipMatcher(spec.skip)
         try:
             if spec.mode == "auto":
                 run.service = await self._prepare_tagging_model(job, spec, owner)
@@ -894,6 +929,7 @@ class ImageTagJobsMixin:
                 capture,
                 spec.model_type,
                 spec.options,
+                run.skip,
                 on_skipped=functools.partial(store.release_use, capture.token),
             )
         except Exception:

py/api/images.py

@@ -34,7 +34,8 @@ from .gallery_listing import (
     WalkOutcome,
     walk_root,
 )
-from . import thumbnail_settings
+from . import preview_store, thumbnail_settings
+from .thumbnail_location import location_refusal
 from .thumbnail_encode import (
     PREVIEW_HELD,
     EncoderClosed,
@@ -1068,13 +1069,24 @@ def _iter_media_files(output_path, max_files):
 
 
 def media_thumbnail_rel(rel_path, settings=None):
-    """``thumbnails/<rel>_thumb<ext>`` (POSIX) for the media file *rel_path*:
-    the name the preview gets when it is written now (#317), images and
-    videos alike (``writer_settings``' extension)."""
+    """``thumbnails/<rel>_thumb<ext>`` (POSIX URL text) for the media file
+    *rel_path*: the name the preview gets when it is written now (#317),
+    images and videos alike (``writer_settings``' extension). Where it is on
+    disk is ``media_preview_path``."""
     settings = settings or writer_settings()
     return thumbnail_settings.thumbnail_rel(rel_path, settings.extension)
 
 
+def media_preview_path(output_path, rel_path, settings=None, *, create=False):
+    """Where the preview of *rel_path* is written now (``preview_store``);
+    *create* for a writer (a new source gets its key). None when nothing
+    may be written (the thumbnail folder is unavailable)."""
+    settings = settings or writer_settings()
+    return preview_store.preview_path(
+        output_path, rel_path, settings.extension, create=create
+    )
+
+
 def existing_media_thumbnail(output_path, rel_path):
     """The existing preview *rel_path* owns that a listing or cover shows
     (the format written now first, then older ones), or None. The Images
@@ -1084,6 +1096,27 @@ def existing_media_thumbnail(output_path, rel_path):
     )
 
 
+def listing_thumbnail_url(output_path, rel_path):
+    """The thumbnail URL of an older listing (``_enrich_images``, the
+    auto-tag scan), or None. These run on the event loop: in folder mode
+    (#320) the store is never touched there, so the URL names the preview
+    as it is written now and the serve route finds or makes it off the loop
+    (None while the thumbnail folder is unavailable)."""
+    from .prompts import thumbnail_url_for
+
+    location = preview_store.current()
+    if location.mode == preview_store.FOLDER_MODE:
+        if not location.available:
+            return None
+        quoted = urllib.parse.quote(media_thumbnail_rel(rel_path), safe="/")
+        return f"/prompt_manager/images/serve/{quoted}"
+    existing = thumbnail_settings.existing_thumbnail(output_path, rel_path)
+    if existing is None:
+        return None
+    thumb_rel = thumbnail_settings.thumbnail_stem_rel(rel_path) + existing.suffix
+    return thumbnail_url_for(thumb_rel, existing)
+
+
 def media_thumbnail(output_path, rel_path, root_index, *, root_scope=None):
     """``(thumbnail_url, ready)`` for *rel_path* under *output_path* (a few
     blocking stats). The Images listing, the Needs review queue cards and the
@@ -2798,13 +2831,56 @@ class ImageRoutesMixin:
                     output_dirs[0], filepath, int(root_param), len(outputs)
                 )
 
+            # Preview text is mapped by the resolver (#320); any other text,
+            # ``Thumbnails/...`` media on a case-sensitive disk included,
+            # keeps the plain join.
+            preview_parts = (
+                tuple(filepath.split("/"))
+                if preview_store.is_preview_text(filepath)
+                else None
+            )
+            location = preview_store.current()
+            if location.mode == preview_store.FOLDER_MODE:
+                if preview_parts is None and await self._run_image(
+                    self._in_source_thumbnails, output_dirs, filepath
+                ):
+                    # Previews live in the thumbnail folder: anything else
+                    # under a source's thumbnails/ is a leftover (#320), in
+                    # any case on a case-insensitive disk.
+                    return _forbidden()
+                if preview_parts is not None:
+                    # Store I/O never runs on the event loop (a share may
+                    # stall): the lookup runs on the image pool.
+                    found = await self._run_image(
+                        self._find_preview, output_dirs, preview_parts, location
+                    )
+                    if found == "forbidden":
+                        return _forbidden()
+                    if found is not None:
+                        return self._file_response(found)
             for output_path in output_dirs:
-                image_path = output_path / filepath
+                if (
+                    preview_parts is not None
+                    and location.mode == preview_store.FOLDER_MODE
+                ):
+                    break  # looked up above
+                if preview_parts is None:
+                    image_path = output_path / filepath
+                else:
+                    image_path = preview_store.request_path(output_path, preview_parts)
+                    if image_path is None:
+                        continue
                 if not image_path.exists():
                     continue
-                # A symlink that points outside the root is a hard deny, not
-                # a fall-through to the next root.
-                if not _is_within(image_path, output_path):
+                # A symlink that points outside the root (a preview: outside
+                # the folder holding its store) is a hard deny, not a
+                # fall-through to the next root.
+                container = (
+                    output_path
+                    if preview_parts is None
+                    else preview_store.store_container(output_path)
+                )
+                if not _is_within(image_path, container):
                     return _forbidden()
                 if in_trash_below_roots(image_path, output_dirs):
                     return _file_not_found()
@@ -2830,6 +2906,48 @@ class ImageRoutesMixin:
                 {"success": False, "error": _safe_error(e)}, status=500
             )
 
+    @staticmethod
+    def _in_source_thumbnails(output_dirs, filepath):
+        """Whether *filepath* lies in a source's ``thumbnails`` folder: its
+        first part is ``thumbnails`` exactly, or another case of it that is
+        the same folder (a case-insensitive disk). ``Thumbnails/`` media on
+        a case-sensitive disk is another folder and stays served."""
+        first = filepath.split("/", 1)[0]
+        if first == "thumbnails":
+            return True
+        if first.casefold() != "thumbnails":
+            return False
+        for output_path in output_dirs:
+            spelled = output_path / first
+            cache = preview_store.source_folder(output_path)
+            try:
+                if spelled.is_dir() and cache.is_dir() and spelled.samefile(cache):
+                    return True
+            except OSError:
+                continue
+        return False
+
+    @staticmethod
+    def _find_preview(output_dirs, parts, location):
+        """The preview file *parts* names in folder mode, ``"forbidden"``
+        (it resolves out of its store or through a link) or None (blocking;
+        the first root whose store holds it, in ``_select_root`` order)."""
+        for output_path in output_dirs:
+            image_path = preview_store.request_path(output_path, parts, location)
+            if image_path is None:
+                continue
+            try:
+                with preview_store.store_io():
+                    if not os.path.lexists(image_path):
+                        continue
+                    if not preview_store.owns(output_path, image_path, location):
+                        return "forbidden"
+                    if image_path.is_file():
+                        return image_path
+            except OSError:
+                return None
+        return None
+
     def _is_recorded_media(self, path) -> bool:
         """Whether the database records ``path`` as a linked image.
 
@@ -2956,6 +3074,9 @@ class ImageRoutesMixin:
         data, error = await _json_body_or_error(request)
         if error is not None:
             return error
+        refused = location_refusal()
+        if refused is not None:
+            return refused
         return await self._run_held(
             THUMBNAILS_JOB_KIND,
             THUMBNAIL_GENERATION_TITLE,
@@ -2975,6 +3096,7 @@ class ImageRoutesMixin:
             result = await self._run_in_executor(
                 self._generate_gallery_thumbnails_sync, output_dirs
             )
+            await self._release_job_memory()
             return web.json_response(result)
 
         except Exception as e:
@@ -2987,6 +3109,7 @@ class ImageRoutesMixin:
         """Blocking thumbnail generation loop (run in executor)."""
         settings = writer_settings(settings)
         start = _time.monotonic()
+        thumbnails_dir = preview_store.given_store(output_path, thumbnails_dir)
         plan = self._plan_thumbnails(output_path, thumbnails_dir, settings=settings)
         payload = self._execute_thumbnail_plan(plan, settings, start)
         payload["thumbnails_path"] = _public_path(thumbnails_dir)
@@ -2999,7 +3122,8 @@ class ImageRoutesMixin:
         start = _time.monotonic()
         plan = self._plan_gallery_thumbnails(output_dirs, settings=settings)
         payload = self._execute_thumbnail_plan(plan, settings, start)
-        payload["thumbnails_path"] = _public_path(output_dirs[0] / "thumbnails")
+        store = preview_store.store_dir(output_dirs[0])
+        payload["thumbnails_path"] = None if store is None else _public_path(store)
         return payload
 
     def _execute_thumbnail_plan(self, plan: dict, settings, start: float) -> dict:
@@ -3042,9 +3166,12 @@ class ImageRoutesMixin:
             if stop is not None and stop():
                 break
             root = Path(root)
+            store = preview_store.ensure_store(root)
+            if store is None:
+                continue  # the thumbnail folder is unavailable
             plan = self._plan_thumbnails(
                 root,
-                root / "thumbnails",
+                store,
                 mode=mode,
                 stop=stop,
                 settings=settings,
@@ -3083,6 +3210,8 @@ class ImageRoutesMixin:
                     "format": writer_settings().format,
                     # Files whose automatic preview failed this session (#249).
                     "failed": self._auto_thumbnail_failures(),
+                    # #320: where previews live (no path here, D6A).
+                    "location": self._thumbnail_location_payload(with_path=False),
                     "collection_id": hashlib.sha256(collection.encode()).hexdigest()[
                         :16
                     ],
@@ -3128,9 +3257,11 @@ class ImageRoutesMixin:
         """
         settings = writer_settings(settings)
         output_path = Path(output_path)
-        thumbnails_dir = Path(thumbnails_dir)
+        thumbnails_dir = preview_store.given_store(output_path, thumbnails_dir)
         plan = {key: 0 for key in _PLAN_COUNTS}
         plan.update(targets=[], fresh_files=[])
+        if thumbnails_dir is None:
+            return plan  # the thumbnail folder is unavailable
         folders = {}
         removed = self._removal_check_under(output_path)
         for src in _iter_media_files(output_path, MAX_GALLERY_FILES):
@@ -3220,6 +3351,9 @@ class ImageRoutesMixin:
             "dir": src.parent.name,
             "type": "video" if is_video else "image",
         }
+        # Taken when the write starts: a thumbnail location switched since
+        # then drops the write at its rename (#320).
+        guard = preview_store.write_guard(guard)
         dst = Path(dst)
         if dst.suffix != settings.extension:
             dst = dst.with_suffix(settings.extension)
@@ -3230,7 +3364,7 @@ class ImageRoutesMixin:
                 return {**result, "action": "error", "error": "File no longer exists"}
             if not rebuild and _thumbnail_is_fresh(src, dst):
                 return {**result, "action": "skipped", "path": str(dst)}
-            dst.parent.mkdir(parents=True, exist_ok=True)
+            preview_store.make_parent(dst)
             if is_video:
                 made = self._generate_video_thumbnail(
                     src,
@@ -3435,8 +3569,12 @@ class ImageRoutesMixin:
 
         Invalid thumbnail directories return 400; unavailable gallery roots
         return 404, and unexpected filesystem failures return 500. Holds the
-        registry as guarded work, like generation.
+        registry as guarded work, like generation. Refused (409) while the
+        thumbnail folder is unavailable (#320).
         """
+        refused = location_refusal()
+        if refused is not None:
+            return refused
         return await self._run_held(
             THUMBNAILS_JOB_KIND,
             THUMBNAIL_CLEAR_TITLE,
@@ -3500,8 +3638,12 @@ class ImageRoutesMixin:
             self.logger.debug(f"No roots to sweep for preview temp files: {exc}")
             return 0
         for output_path in output_dirs:
-            folder = Path(output_path) / "thumbnails"
-            if folder.is_symlink() or not folder.is_dir():
+            folder = preview_store.store_dir(output_path)
+            if (
+                folder is None
+                or preview_store.store_is_link(folder)
+                or not folder.is_dir()
+            ):
                 continue
             removed += sweep_stray_temps(folder)[0]
         if removed:
@@ -3519,13 +3661,16 @@ class ImageRoutesMixin:
         directories = []
         for output_path in output_dirs:
             output_path = Path(output_path)
-            thumbnails_dir = output_path / "thumbnails"
+            thumbnails_dir = preview_store.store_dir(output_path)
+            if thumbnails_dir is None:
+                continue
             if not thumbnails_dir.exists() and not thumbnails_dir.is_symlink():
                 continue
+            container = preview_store.store_container(output_path)
             if (
-                thumbnails_dir.is_symlink()
-                or not _is_within(thumbnails_dir, output_path)
-                or _canonical(thumbnails_dir) == _canonical(output_path)
+                preview_store.store_is_link(thumbnails_dir)
+                or not _is_within(thumbnails_dir, container)
+                or _canonical(thumbnails_dir) == _canonical(container)
             ):
                 raise ValueError(
                     "Safety check failed: invalid thumbnails directory path"
@@ -3540,7 +3685,15 @@ class ImageRoutesMixin:
             temps, temp_bytes = sweep_stray_temps(thumbnails_dir, min_age=0)
             cleared_count += temps
             cleared_size += temp_bytes
-            for root, _dirs, files in os.walk(thumbnails_dir):
+            folder_mode = preview_store.current().mode == preview_store.FOLDER_MODE
+            for root, dirs, files in os.walk(thumbnails_dir):
+                if folder_mode:
+                    # Never into a junction or reparse point (#320).
+                    dirs[:] = [
+                        d
+                        for d in dirs
+                        if not preview_store.store_is_link(Path(root) / d)
+                    ]
                 for name in files:
                     path = Path(root) / name
                     if (
@@ -3548,6 +3701,7 @@ class ImageRoutesMixin:
                         or path.suffix.lower()
                         not in thumbnail_settings.THUMBNAIL_EXTENSIONS
                         or path.is_symlink()
+                        or not preview_store.may_write(path)
                     ):
                         continue
                     try:
@@ -3997,7 +4151,8 @@ class ImageRoutesMixin:
                     **observed,
                 )
 
-            body = await self._run_in_executor(inspect)
+            # Header and text reads: the interactive image pool (#523).
+            body = await self._run_image(inspect)
             if body is None:
                 return web.json_response(
                     {
@@ -4210,6 +4365,22 @@ class ImageRoutesMixin:
         # (which Windows refuses on open files) is not held up by it.
         return _CardFacts(width, height, *self._card_parse(path, records))
 
+    def _cached_card_facts(self, entry: tuple) -> _CardFacts | None:
+        path, mtime, root, index = entry[:4]
+        return self._workspace_card_cache.get((index, str(root)), {}).get((path, mtime))
+
+    def _card_facts_of(self, entries: list, *, parse: bool) -> list[_CardFacts]:
+        """Card facts of *entries*, in order; files not cached yet are read on
+        the interactive image pool (#523), cached ones answer here."""
+        found = [self._cached_card_facts(entry) for entry in entries]
+        missing = [i for i, facts in enumerate(found) if facts is None]
+        read = self._map_image(
+            lambda i: self._card_facts(entries[i], parse=parse), missing
+        )
+        for i, facts in zip(missing, read):
+            found[i] = facts
+        return found
+
     def _card_facts(self, entry: tuple, *, parse: bool) -> _CardFacts:
         """One listed image's card facts, read once per ``(path, mtime)``.
 
@@ -4218,11 +4389,11 @@ class ImageRoutesMixin:
         and drops the rest, and a roots change drops them all. Only files of
         the current scan are stored, so the cache is bounded by the listing.
         """
-        path, mtime, root, index = entry[:4]
-        root_key, key = (index, str(root)), (path, mtime)
-        cached = self._workspace_card_cache.get(root_key, {}).get(key)
+        cached = self._cached_card_facts(entry)
         if cached is not None:
             return cached
+        path, mtime, root, index = entry[:4]
+        root_key, key = (index, str(root)), (path, mtime)
         facts = self._read_card_facts(path, parse=parse)
         if facts is None:
             # Not stored: a locked or half-written file may read next time.
@@ -4248,15 +4419,17 @@ class ImageRoutesMixin:
             if linked
             else {}
         )
+        # Videos: the card reads no video metadata. Library previews show
+        # no card facts, so they skip the parse (``parse=linked``).
+        stills = [image for image in images if not image["is_video"]]
+        read = self._card_facts_of(
+            [entries[(image["root_index"], image["path"])] for image in stills],
+            parse=linked,
+        )
+        facts_of = {id(image): facts for image, facts in zip(stills, read)}
         for image in images:
             entry = entries[(image["root_index"], image["path"])]
-            # Videos: the card reads no video metadata. Library previews show
-            # no card facts, so they skip the parse (``parse=linked``).
-            facts = (
-                _NO_CARD_FACTS
-                if image["is_video"]
-                else self._card_facts(entry, parse=linked)
-            )
+            facts = facts_of.get(id(image), _NO_CARD_FACTS)
             image["width"], image["height"] = facts.width, facts.height
             if not linked:
                 continue

py/api/jobs.py

@@ -204,6 +204,8 @@ class Job:
         self.total = 0
         self.counters = dict.fromkeys(groups, 0)
         self.outcomes = {group: [] for group in groups}
+        # Groups whose report lists every row, beyond MAX_OUTCOME_ROWS (#550).
+        self.complete = {}
         self.log = []
         self._cancel_requested = False
         self.last_event = None
@@ -286,42 +288,48 @@ class Job:
         index = row.get("root_index")
         if isinstance(index, bool) or not isinstance(index, int) or index < 0:
             index = None
+        shaped = {
+            "path": path,
+            "root": str(row.get("root") or ""),
+            "root_index": index,
+            "detail": str(row.get("detail") or ""),
+        }
+        if group in self.complete:  # a group kept whole for the report (#586)
+            self.complete[group].append(dict(shaped))
         if len(rows) < MAX_OUTCOME_ROWS:
-            rows.append(
-                {
-                    "path": path,
-                    "root": str(row.get("root") or ""),
-                    "root_index": index,
-                    "detail": str(row.get("detail") or ""),
-                }
-            )
+            rows.append(shaped)
         self.log_line(log_line)
 
-    def record_counted(self, group, count, rows=()):
+    def record_counted(self, group, count, rows=(), *, complete=False):
         """Count ``count`` outcomes in ``group`` at once, listing ``rows``.
 
         For outcomes that need no log line each (a thumbnail job's already
         fresh previews): the counter is exact, ``rows`` (``record``'s row
         shape) are listed up to MAX_OUTCOME_ROWS, and nothing is logged.
+        ``complete`` also keeps every row for the report (#550: a record of
+        each change that must not be cut short; the caller bounds it).
         """
         if group not in self.counters:
             raise ValueError(f"Unknown outcome group {group!r} for {self.kind}")
         self.counters[group] += max(0, int(count))
         listed = self.outcomes[group]
+        kept = self.complete.setdefault(group, []) if complete else None
         for row in rows:
-            if len(listed) >= MAX_OUTCOME_ROWS:
+            if kept is None and len(listed) >= MAX_OUTCOME_ROWS:
                 break
             index = row.get("root_index")
             if isinstance(index, bool) or not isinstance(index, int) or index < 0:
                 index = None
-            listed.append(
-                {
-                    "path": _relative_path(row.get("path")),
-                    "root": str(row.get("root") or ""),
-                    "root_index": index,
-                    "detail": str(row.get("detail") or ""),
-                }
-            )
+            shaped = {
+                "path": _relative_path(row.get("path")),
+                "root": str(row.get("root") or ""),
+                "root_index": index,
+                "detail": str(row.get("detail") or ""),
+            }
+            if kept is not None:
+                kept.append(shaped)
+            if len(listed) < MAX_OUTCOME_ROWS:
+                listed.append(dict(shaped))
 
     def finish(self, state="finished"):
         """End the job in ``state`` and release every subscriber.
@@ -406,8 +414,9 @@ class Job:
         """The downloadable report: the summary, every outcome group and the log.
 
         Each group carries its exact count, its listed rows (at most
-        MAX_OUTCOME_ROWS) and whether the list is cut short. Rows and log lines
-        already hold root-relative paths only.
+        MAX_OUTCOME_ROWS, or every row of a ``complete`` group) and whether
+        the list is cut short. Rows and log lines already hold root-relative
+        paths only.
         """
         summary = self.summary()
         summary.pop("listed", None)
@@ -417,16 +426,21 @@ class Job:
             "generated_at": self._clock(),
             "job": summary,
             "outcomes": {
-                group: {
-                    "count": self.counters.get(group, len(rows)),
-                    "rows": [dict(row) for row in rows],
-                    "truncated": self.counters.get(group, len(rows)) > len(rows),
-                }
+                group: self._report_group(group, rows)
                 for group, rows in self.outcomes.items()
             },
             "log": list(self.log),
         }
 
+    def _report_group(self, group, listed):
+        rows = self.complete.get(group, listed)
+        count = self.counters.get(group, len(rows))
+        return {
+            "count": count,
+            "rows": [dict(row) for row in rows],
+            "truncated": count > len(rows),
+        }
+
     def report_filename(self):
         """The download name: prompt-manager-KIND-YYYYMMDD-HHMM.json (local time)."""
         stamp = time.strftime("%Y%m%d-%H%M", time.localtime(self._clock()))

py/api/library_location.py

@@ -50,6 +50,7 @@ _REFUSAL_STATUS = {
     "not-movable": 400,
     "same-folder": 400,
     "target-invalid": 400,
+    "data-dir-served": 400,
     "target-has-library": 409,
     "target-conflict": 409,
     "insufficient-space": 507,
@@ -74,6 +75,24 @@ def _failure(message, status, code):
     )
 
 
+def _thumbnail_folder():
+    """The thumbnail folder in use, or None (previews inside each source)."""
+    from . import preview_store
+
+    setting = preview_store.setting()
+    return setting.path if setting.mode == preview_store.FOLDER_MODE else None
+
+
+def _inside_thumbnail_folder(path):
+    """Whether *path* lies in the thumbnail folder in use (#320)."""
+    from . import preview_store
+
+    setting = preview_store.setting()
+    if setting.mode != preview_store.FOLDER_MODE or not setting.path:
+        return False
+    return ll._inside_any(path, [setting.path])
+
+
 def _plural(count, one, many=None):
     return f"{count:,} {one if count == 1 else (many or one + 's')}"
 
@@ -225,6 +244,8 @@ class LibraryLocationRoutesMixin:
             ),
             "problem": location.problem or self._node_folder_risk(location),
             "size_bytes": size,
+            # #320 D201: thumbnails kept in one folder stay there (D8A).
+            "thumbnails_folder": _thumbnail_folder(),
         }
 
     # The node folder (tests point it at a temp tree).
@@ -272,6 +293,8 @@ class LibraryLocationRoutesMixin:
     def _plan_library_move(self):
         """The checked plan (blocking); raises MoveFailed."""
         plan = lm.plan_move(self._live_location())
+        if _inside_thumbnail_folder(plan.target_dir):
+            raise lm.MoveFailed("data-dir-served")
         if lm.space_problem(plan) is not None:
             raise lm.MoveFailed("insufficient-space")
         return plan

py/api/log_cleanup.py

@@ -68,6 +68,23 @@ def _count(count, singular, plural):
     return f"{count} {singular if count == 1 else plural}"
 
 
+# Each kept entry's row in the job (#586), in the review's "Kept: ..." words.
+KEPT_DETAILS = {
+    "active": "Kept: the active log",
+    "link": "Kept: a link",
+    "other": "Kept: another file",
+}
+
+
+def _kept_files(rows):
+    """``{name, kind}`` of each entry the cleanup keeps, in folder order."""
+    return [
+        {"name": row["name"], "kind": row["kind"]}
+        for row in rows
+        if row["kind"] in KEPT_DETAILS
+    ]
+
+
 def _protected_reasons(rows):
     """The plan's Protected reasons: what the cleanup keeps, zero counts left out."""
     active = sum(1 for row in rows if row["kind"] == "active")
@@ -129,7 +146,7 @@ class LogCleanupMixin:
             token = store.issue(
                 ROTATED_LOGS,
                 json.dumps(files, sort_keys=True),
-                {"files": files, "protected": protected},
+                {"files": files, "protected": protected, "kept": _kept_files(rows)},
                 (),
             )
         except ScopeTooLarge:
@@ -198,7 +215,11 @@ class LogCleanupMixin:
             job.record(
                 "errors", {"path": name, "detail": detail}, f"! {name} · {detail}"
             )
-        job.record_counted("protected", plan.payload["protected"])
+        kept = [
+            {"path": row["name"], "detail": KEPT_DETAILS[row["kind"]]}
+            for row in plan.payload["kept"]
+        ]
+        job.record_counted("protected", len(kept), kept, complete=True)
         removed, failed = len(result["removed"]), len(result["failed"])
         line = f"Deleted {_count(removed, 'rotated log copy', 'rotated log copies')}"
         if failed:

py/api/lora_integration.py

@@ -44,6 +44,7 @@ _FILES_CHANGED = (
     "The LoRA metadata files changed during the scan; the previous imports "
     "were kept. Run the scan again."
 )
+_LORA_SCAN_FAILED = "The LoRA import failed. Check the server log for details."
 _IMPORTS_CHANGED = (
     "The imported LoRA prompts changed during the scan; the previous imports "
     "were kept. Run the scan again."
@@ -407,10 +408,21 @@ class LoraIntegrationMixin:
             return
         if isinstance(error, PlanChanged):
             message = _IMPORTS_CHANGED
-        elif isinstance(error, (LoraFilesChanged, LoraSettingsUnusable)):
+        elif isinstance(
+            error,
+            (
+                LoraFilesChanged,
+                LoraSettingsUnusable,
+                EmptyReplacement,
+                PairDependencyError,
+            ),
+        ):
             message = str(error)
-        else:
+        elif isinstance(error, OSError):
+            # Reduced to its reason and the file's basename.
             message = self._public_error(error)
+        else:
+            message = _LORA_SCAN_FAILED
         if isinstance(
             error,
             (

py/api/maintenance.py

@@ -1,8 +1,9 @@
 """Maintenance routes: reviewed, read-only plans (#249 System S6).
 
 ``POST /prompt_manager/maintenance/preview {operation, options:{}}`` reviews
-one operation (``duplicate_prompts``, ``optimize``, ``unused_components`` or
-``missing_links``; ``database/maintenance.py``; ``duplicate_files``,
+one operation (``duplicate_prompts``, ``optimize``, ``unused_components``,
+``missing_links`` or ``pair_metadata``, #550; ``database/maintenance.py``;
+``duplicate_files``,
 ``py/api/duplicate_files.py``; ``rotated_logs``, the rotated log copies,
 ``py/api/log_cleanup.py``, which has its own apply job) off the event loop and
 answers a ``Plan``: ``{success, token, operation, expires_at, scope:{count,
@@ -97,7 +98,11 @@ MAINTENANCE_TITLES = {
     "unused_components": "Unused prompt components",
     "missing_links": "Missing-file links",
     "workflow_storage": "Store each workflow once",
+    # #550, beyond the concept: fills old Pair prompts' empty category and tags.
+    "pair_metadata": "Pair category and tags",
 }
+# Operations whose job keeps every changed row for its report (#550).
+COMPLETE_RECORD = frozenset({"pair_metadata"})
 _OPERATION_ERROR = "operation must be one of: " + ", ".join(PREVIEW_OPERATIONS)
 MAINTENANCE_GROUPS = ("changed", "protected", "errors")
 MAX_TOKEN_LENGTH = 128
@@ -281,9 +286,27 @@ def short_space_message(short):
     )
 
 
-def _changed_line(operation, count, marks=0):
+def _pair_metadata_line(result):
+    count = result["changed"]
+    noun = (
+        "prompt from its saved pairs"
+        if count == 1
+        else "prompts from their saved pairs"
+    )
+    categories = result.get("categories", 0)
+    tag_sets = result.get("tag_sets", 0)
+    return (
+        f"Filled {count:,} {noun} "
+        f"({categories:,} {'category' if categories == 1 else 'categories'}, "
+        f"{tag_sets:,} {'tag set' if tag_sets == 1 else 'tag sets'})"
+    )
+
+
+def _changed_line(operation, count, marks=0, result=None):
     if operation == "optimize":
         return "Optimized the database"
+    if operation == "pair_metadata":
+        return _pair_metadata_line(result or {"changed": count})
     if operation == "duplicate_prompts":
         noun = "duplicate prompt" if count == 1 else "duplicate prompts"
         return f"Merged {count:,} {noun}"
@@ -668,13 +691,67 @@ class MaintenanceRoutesMixin:
         rows = await self._run_in_executor(
             self._maintenance_rows, plan.operation, result["rows"]
         )
-        job.record_counted("changed", result["changed"], rows)
-        job.record_counted("protected", payload["protected"])
-        line = _changed_line(plan.operation, result["changed"], result.get("marks", 0))
+        job.record_counted(
+            "changed",
+            result["changed"],
+            rows,
+            complete=plan.operation in COMPLETE_RECORD,
+        )
+        kept = await self._run_in_executor(self._kept_rows, db, plan, result)
+        if kept is None:
+            job.record_counted("protected", payload["protected"])  # none kept
+        else:
+            # #550, #586: each kept record with its reason, like the changed
+            # ones, and every one of them in the report.
+            job.record_counted("protected", len(kept), kept, complete=True)
+        line = _changed_line(
+            plan.operation, result["changed"], result.get("marks", 0), result
+        )
         job.log_line(line)
         job.update(progress=100, status_line=f"{line} · {backup_note(backup)}")
         return None
 
+    def _kept_rows(self, db, plan, result):
+        """Outcome rows for the records the apply kept (blocking), or None.
+
+        Prompts are records (no path); a missing-links plan's kept links
+        name their file, relative to its output root, so Activity can open
+        and locate it (#586); one under a source that is gone keeps its path
+        under that source's label. None for an operation that keeps nothing
+        (Optimize).
+        """
+        if plan.operation == "missing_links":
+            roots = _scan_roots(self._get_all_output_dirs())
+            judged = plan.payload["roots"]
+            rows = []
+            for item in db.kept_links(judged):
+                path, label, index = _scan_location(item["image_path"], roots)
+                if index is None and item["owner"] is not None:
+                    # A source that is gone is not listed: name the file
+                    # under it, with no listing index to open it by.
+                    source = judged[item["owner"]]
+                    where = [(os.path.abspath(source), self._public_path(source), None)]
+                    path, label, index = _scan_location(item["image_path"], where)
+                rows.append(
+                    {
+                        "path": path,
+                        "root": label,
+                        "root_index": index,
+                        "detail": f"Kept: {item['reason']}",
+                    }
+                )
+            return rows
+        if "kept" not in result:
+            return None
+        return [
+            {
+                "path": "",
+                "detail": f"Prompt {item['prompt_id']}: kept, "
+                + "; ".join(item["reasons"]),
+            }
+            for item in result["kept"]
+        ]
+
     def _maintenance_rows(self, operation, described):
         """Outcome rows for the changed records (root-relative paths only)."""
         if operation == "missing_links":
@@ -691,6 +768,8 @@ class MaintenanceRoutesMixin:
                     }
                 )
             return rows
+        if operation == "pair_metadata":
+            return [{"path": "", "detail": _filled_detail(item)} for item in described]
         if operation == "duplicate_prompts":
             return [
                 {
@@ -708,6 +787,16 @@ class MaintenanceRoutesMixin:
         ]
 
 
+def _filled_detail(item):
+    """``Prompt 12: category “portrait”; tags a, b``: one filled prompt (#550)."""
+    parts = []
+    if "category" in item:
+        parts.append(f"category “{item['category']}”")
+    if item.get("tags"):
+        parts.append("tags " + ", ".join(item["tags"]))
+    return f"Prompt {item['prompt_id']}: " + "; ".join(parts)
+
+
 def backup_note(backup):
     """The status line's backup part: the file name, or that there is none."""
     return f"Safety backup {backup}" if backup else NO_BACKUP

py/api/preview_location.py

@@ -0,0 +1,728 @@
+"""The thumbnail location setting (#320): parsing, validation, source keys
+and the thumbnail folder's marker.
+
+``preview_store`` holds the runtime state and maps paths; this module holds
+the rules it applies. Nothing here keeps state.
+
+Schema (config.json ``thumbnails.location``)::
+
+    {"mode": "folder", "path": "D:\\\\Thumbs", "id": "<uuid4>",
+     "install": "<uuid4>", "cleanup": []}
+
+The default (and a missing key) is ``{"mode": "source"}``: previews inside
+each source. An invalid value never falls back to the sources: it parses as
+a folder location with problem ``invalid``, so nothing is written anywhere.
+
+Layout in folder mode: ``<folder>/<source key>/<rel dir>/<stem>_thumb<ext>``.
+A source key is a readable slug plus a short hash of the source's identity
+(``output-3f9a2c1b``), assigned once and stored in the marker
+``.promptmanager-thumbnails.json`` with the identity it belongs to.
+"""
+
+import errno
+import hashlib
+import json
+import logging
+import ntpath
+import os
+import posixpath
+import re
+import stat as stat_module
+import threading
+import time
+import unicodedata
+import uuid
+from contextlib import contextmanager
+from dataclasses import dataclass, field
+
+try:
+    from ...utils import library_location
+except ImportError:  # tests import the package top-level
+    from utils import library_location
+
+logger = logging.getLogger("prompt_manager.thumbnails")
+
+SOURCE_MODE = "source"
+FOLDER_MODE = "folder"
+MARKER_NAME = ".promptmanager-thumbnails.json"
+MARKER_VERSION = 1
+# Beside the marker while one process re-reads, changes and replaces it.
+MARKER_LOCK_NAME = ".promptmanager-thumbnails.lock"
+MARKER_LOCK_TIMEOUT = 1.5  # a writer waits this long (under preview_store.IO_BUDGET)
+MARKER_LOCK_STALE = 30.0  # a lock this old was left by a writer that died
+MARKER_LOCK_POLL = 0.02
+# A source key: one folder name, a slug and a 8-16 hex hash (``source_key``).
+KEY_PATTERN = re.compile(r"^[a-z0-9_-]{1,24}-[0-9a-f]{8,16}$")
+# A marker is a few keys; anything larger is not ours.
+MAX_MARKER_BYTES = 4 * 2**20
+# OS metadata files a folder may hold and still count as empty.
+OS_METADATA = frozenset({"thumbs.db", "desktop.ini", ".ds_store"})
+KEY_HASH_LENGTHS = (8, 12, 16)
+SLUG_LENGTH = 24
+# Folder + the longest key (24 + 1 + 16) + this margin must fit (Windows).
+WINDOWS_FOLDER_LIMIT = 247
+LONGEST_KEY = SLUG_LENGTH + 1 + KEY_HASH_LENGTHS[-1]
+PATH_MARGIN = 40
+# A validation stat on a share that does not answer in time is unavailable.
+VALIDATION_TIMEOUT = 5.0
+FILE_ATTRIBUTE_REPARSE_POINT = 0x400
+
+_RESERVED = re.compile(r"^(con|prn|aux|nul|com[1-9]|lpt[1-9])(\..*)?$", re.IGNORECASE)
+_BAD_CHARS = re.compile(r'[<>:"|?*\x00-\x1f]')
+
+# Problem codes, their HTTP status and the text the UI shows (no path).
+MESSAGES = {
+    "location-not-absolute": (
+        400,
+        "Enter a full folder path, such as D:\\Thumbnails or /mnt/fast/thumbnails.",
+    ),
+    "location-device-path": (
+        400,
+        "Enter the folder as a drive letter or \\\\server\\share path, "
+        "without \\\\?\\.",
+    ),
+    "location-invalid-name": (
+        400,
+        "This folder name can't be used on Windows. Choose another name.",
+    ),
+    "location-too-broad": (
+        400,
+        "Choose a folder inside a drive or share, not the drive itself.",
+    ),
+    "location-served": (
+        400,
+        "Choose a folder outside your image sources and ComfyUI's output, input "
+        "and temp folders.",
+    ),
+    "location-node-folder": (
+        400,
+        "Choose a folder outside the Prompt Manager node folder.",
+    ),
+    "location-contains-source": (
+        400,
+        "This folder contains an image source. Choose a folder beside it instead.",
+    ),
+    "location-same": (400, "Thumbnails are already stored here."),
+    "location-inside-current": (
+        400,
+        "This folder is inside the thumbnail folder in use. Choose a folder "
+        "outside it.",
+    ),
+    "location-parent-missing": (
+        400,
+        "The folder that would hold it doesn't exist. Check the path and that its "
+        "drive is connected.",
+    ),
+    "location-unavailable": (
+        409,
+        "This folder can't be reached right now. Check that its drive or share is "
+        "connected.",
+    ),
+    "location-not-empty": (
+        409,
+        "This folder already holds other files. Choose an empty folder or one "
+        "Prompt Manager used before.",
+    ),
+    "location-not-writable": (
+        409,
+        "Prompt Manager can't write to this folder. Check its permissions.",
+    ),
+    "location-path-too-long": (
+        400,
+        "This path is too long for Windows. Choose a shorter folder path.",
+    ),
+    "insufficient-space": (
+        507,
+        "There is not enough space for the thumbnails. Free some space or choose "
+        "another folder.",
+    ),
+    "location-needs-move": (
+        409,
+        "Use Move thumbnails in System › Sources & scans.",
+    ),
+}
+HOLDS_THUMBNAILS_REASON = "This folder holds Prompt Manager's thumbnails."
+
+
+def message(code):
+    """``(status, text)`` of a problem code."""
+    return MESSAGES[code]
+
+
+# ── parsing ──────────────────────────────────────────────────────────
+
+
+@dataclass(frozen=True)
+class ParsedLocation:
+    """A ``thumbnails.location`` value, checked as data (no filesystem)."""
+
+    mode: str = SOURCE_MODE
+    path: str | None = None
+    id: str | None = None
+    install: str | None = None
+    cleanup: tuple = field(default_factory=tuple)
+    problem: str | None = None
+
+    def to_config(self):
+        """The config.json form (``invalid`` values are never written)."""
+        if self.mode == SOURCE_MODE:
+            value = {"mode": SOURCE_MODE}
+        else:
+            value = {"mode": FOLDER_MODE, "path": self.path, "id": self.id}
+        if self.install:
+            value["install"] = self.install
+        value["cleanup"] = list(self.cleanup)
+        return value
+
+
+def _cleanup(value):
+    if not isinstance(value, list):
+        return ()
+    return tuple(item for item in value if isinstance(item, dict))
+
+
+def parse_location(value, *, flavor=os.path):
+    """The location a ``thumbnails.location`` value names.
+
+    Missing: inside each source. Anything else that is not a well-formed
+    location (an unknown mode, a relative path, a missing id) becomes a
+    folder location with problem ``invalid``: never a silent fall-back.
+    """
+    if value is None:
+        return ParsedLocation()
+    if not isinstance(value, dict):
+        return ParsedLocation(mode=FOLDER_MODE, problem="invalid")
+    mode = value.get("mode", SOURCE_MODE)
+    install = value.get("install") if isinstance(value.get("install"), str) else None
+    cleanup = _cleanup(value.get("cleanup"))
+    if mode == SOURCE_MODE:
+        return ParsedLocation(install=install, cleanup=cleanup)
+    if mode != FOLDER_MODE:
+        return ParsedLocation(mode=FOLDER_MODE, problem="invalid", cleanup=cleanup)
+    path, marker_id = value.get("path"), value.get("id")
+    if (
+        not isinstance(path, str)
+        or form_problem(path, flavor=flavor) is not None
+        or not isinstance(marker_id, str)
+        or not marker_id.strip()
+    ):
+        return ParsedLocation(
+            mode=FOLDER_MODE,
+            path=path if isinstance(path, str) else None,
+            problem="invalid",
+            cleanup=cleanup,
+        )
+    return ParsedLocation(
+        mode=FOLDER_MODE,
+        path=flavor.abspath(path),
+        id=marker_id,
+        install=install,
+        cleanup=cleanup,
+    )
+
+
+# ── form (text only) ─────────────────────────────────────────────────
+
+
+def _is_windows(flavor):
+    return flavor is ntpath or getattr(flavor, "__name__", "") == "ntpath"
+
+
+def form_problem(path, *, flavor=os.path):
+    """The text-only problem of *path*, or None (no filesystem access).
+
+    ``\\\\?\\`` and ``\\\\.\\`` prefixes, relative, drive-relative (``C:x``)
+    and root-relative (``\\x``) spellings, and names Windows cannot hold
+    (checked on every OS: the folder may be moved to Windows).
+    """
+    if not isinstance(path, str) or not path.strip() or path != path.lstrip():
+        return "location-not-absolute"
+    if path.replace("/", "\\").startswith(("\\\\?\\", "\\\\.\\")):
+        return "location-device-path"
+    if _is_windows(flavor):
+        drive, rest = ntpath.splitdrive(path)
+        if not drive or not rest.startswith(("\\", "/")):
+            return "location-not-absolute"
+    elif not posixpath.isabs(path):
+        return "location-not-absolute"
+    drive, rest = flavor.splitdrive(path)
+    for part in re.split(r"[\\/]+", rest):
+        if not part:
+            continue
+        if (
+            _RESERVED.match(part)
+            or part.endswith((".", " "))
+            or _BAD_CHARS.search(part)
+        ):
+            return "location-invalid-name"
+    return None
+
+
+def is_too_broad(path, *, home=None, flavor=os.path):
+    """A filesystem or share root, or the home folder itself."""
+    normalized = flavor.normpath(path)
+    drive, rest = flavor.splitdrive(normalized)
+    if rest in ("", "\\", "/"):
+        return True
+    home = home if home is not None else os.path.expanduser("~")
+    return bool(home) and flavor.normcase(normalized) == flavor.normcase(
+        flavor.normpath(home)
+    )
+
+
+def too_long_for_windows(path, long_paths=None):
+    """Folder + the longest key + a margin over the folder limit (Windows
+    without long paths; *long_paths* injects the registry answer)."""
+    if long_paths is None:
+        long_paths = long_paths_enabled()
+    if long_paths:
+        return False
+    return len(path) + 1 + LONGEST_KEY + PATH_MARGIN > WINDOWS_FOLDER_LIMIT
+
+
+def long_paths_enabled():
+    """``LongPathsEnabled`` on Windows (True on other systems)."""
+    if os.name != "nt":
+        return True
+    try:
+        import winreg
+
+        with winreg.OpenKey(
+            winreg.HKEY_LOCAL_MACHINE,
+            r"SYSTEM\CurrentControlSet\Control\FileSystem",
+        ) as key:
+            return winreg.QueryValueEx(key, "LongPathsEnabled")[0] == 1
+    except OSError:
+        return False
+
+
+# ── links ────────────────────────────────────────────────────────────
+
+
+def is_link_like(path):
+    """A symlink, a junction or any reparse point (one lstat), or missing.
+
+    Raises OSError other than "not found" (an unreachable share).
+    """
+    try:
+        info = os.lstat(path)
+    except FileNotFoundError:
+        return False
+    if stat_module.S_ISLNK(info.st_mode):
+        return True
+    attributes = getattr(info, "st_file_attributes", 0)
+    if attributes & FILE_ATTRIBUTE_REPARSE_POINT:
+        return True
+    is_junction = getattr(os.path, "isjunction", None)
+    return bool(is_junction and is_junction(path))
+
+
+# ── source keys ──────────────────────────────────────────────────────
+
+
+def slug(name):
+    """``NFKD`` to ASCII, lower case, runs outside ``[a-z0-9_]`` as ``-``,
+    trimmed and cut to 24 characters; empty becomes ``source``."""
+    text = unicodedata.normalize("NFKD", str(name))
+    text = text.encode("ascii", "ignore").decode("ascii").lower()
+    text = re.sub(r"[^a-z0-9_]+", "-", text).strip("-")
+    text = text[:SLUG_LENGTH].strip("-")
+    return text or "source"
+
+
+def source_key(spelling, identity, taken):
+    """The key of a source: ``slug(basename) + "-" + sha256(identity)[:n]``.
+
+    *taken* maps existing keys to their identity; a key taken by another
+    identity grows its hash to 12, then 16 characters.
+    """
+    base = slug(ntpath.basename(str(spelling).rstrip("\\/")))
+    digest = hashlib.sha256(str(identity).encode("utf-8")).hexdigest()
+    for length in KEY_HASH_LENGTHS:
+        key = f"{base}-{digest[:length]}"
+        owner = taken.get(key)
+        if owner is None or owner == identity:
+            return key
+    raise ValueError("no free source key")
+
+
+def file_identity(path):
+    """``[st_dev, st_ino]`` of an existing folder, or None (no file ids)."""
+    try:
+        info = os.stat(path)
+    except (OSError, ValueError):
+        return None
+    if not info.st_ino:
+        return None
+    return [info.st_dev, info.st_ino]
+
+
+def find_key(keys, spelling, identity, dev_ino):
+    """The marker key of a source: the same configured spelling, then the
+    same identity text, then the same file id; or None."""
+    keys = {k: v for k, v in keys.items() if valid_key(k) and isinstance(v, dict)}
+    for key, entry in keys.items():
+        if entry.get("path") == spelling:
+            return key
+    for key, entry in keys.items():
+        if entry.get("identity") == identity:
+            return key
+    if dev_ino:
+        for key, entry in keys.items():
+            if entry.get("dev_ino") == list(dev_ino):
+                return key
+    return None
+
+
+# ── the marker ───────────────────────────────────────────────────────
+
+
+def marker_path(folder):
+    return os.path.join(folder, MARKER_NAME)
+
+
+def read_marker(folder):
+    """The marker in *folder* as a dict, or None (absent or unreadable as
+    ours). OSError other than "not found" propagates (an unreachable share)."""
+    try:
+        with open(marker_path(folder), "r", encoding="utf-8") as handle:
+            text = handle.read(MAX_MARKER_BYTES + 1)
+    except FileNotFoundError:
+        return None
+    except (ValueError, UnicodeDecodeError):
+        return None
+    if len(text) > MAX_MARKER_BYTES:
+        return None
+    try:
+        data = json.loads(text)
+    except ValueError:
+        return None
+    if not isinstance(data, dict) or not isinstance(data.get("id"), str):
+        return None
+    data["keys"] = valid_keys(data.get("keys"))
+    return data
+
+
+def valid_key(key):
+    """Whether *key* can name a source's folder: one folder name of the
+    ``source_key`` form, never a separator, ``..`` or a drive."""
+    return isinstance(key, str) and KEY_PATTERN.fullmatch(key) is not None
+
+
+def valid_keys(keys):
+    """The marker's keys that are safe to join onto the folder; a hand-edited
+    or foreign entry that is not is dropped (and logged), never followed."""
+    if not isinstance(keys, dict):
+        return {}
+    kept = {}
+    for key, entry in keys.items():
+        if valid_key(key) and isinstance(entry, dict):
+            kept[key] = entry
+        else:
+            logger.warning(
+                "Ignoring a thumbnail folder marker entry that is not a source " "key"
+            )
+    return kept
+
+
+@contextmanager
+def _marker_lock(folder):
+    """Hold the folder's marker lock: a file made with ``O_CREAT | O_EXCL``
+    (atomic on local disks and SMB/NFS shares, unlike ``flock``), so installs
+    sharing the folder change the marker one at a time. A lock older than
+    MARKER_LOCK_STALE was left by a writer that died and is taken over;
+    waiting longer than MARKER_LOCK_TIMEOUT raises TimeoutError."""
+    lock = os.path.join(folder, MARKER_LOCK_NAME)
+    deadline = time.monotonic() + MARKER_LOCK_TIMEOUT
+    while True:
+        try:
+            handle = os.open(lock, os.O_CREAT | os.O_EXCL | os.O_WRONLY, 0o644)
+        except FileExistsError:
+            _break_stale_lock(lock)
+            if time.monotonic() >= deadline:
+                raise TimeoutError(
+                    errno.ETIMEDOUT, "the thumbnail folder marker is locked", lock
+                )
+            time.sleep(MARKER_LOCK_POLL)
+            continue
+        try:
+            os.write(handle, f"{os.getpid()}\n".encode("ascii"))
+        finally:
+            os.close(handle)  # closed before any unlink (Windows)
+        break
+    try:
+        yield
+    finally:
+        try:
+            os.unlink(lock)
+        except FileNotFoundError:
+            pass  # taken over as stale by another writer: nothing to release
+
+
+def _break_stale_lock(lock):
+    """Remove *lock* when it is older than MARKER_LOCK_STALE (its writer
+    died); a lock that changed since it was looked at is left alone."""
+    try:
+        before = os.stat(lock)
+    except FileNotFoundError:
+        return
+    if time.time() - before.st_mtime < MARKER_LOCK_STALE:
+        return
+    logger.warning(f"Taking over a stale thumbnail folder lock: {lock}")
+    try:
+        after = os.stat(lock)
+        if (after.st_ino, after.st_mtime_ns) == (before.st_ino, before.st_mtime_ns):
+            os.unlink(lock)
+    except FileNotFoundError:
+        pass  # another writer took it over first
+
+
+def write_marker(folder, mutate):
+    """Re-read the marker, apply ``mutate(marker)`` and write it atomically
+    (a temp sibling renamed over it), all under the folder's marker lock so a
+    second install sharing the folder never drops this one's change (and
+    the other way round). Callers hold ``preview_store.write_lock`` (threads
+    of this process). Returns the marker written; TimeoutError when another
+    writer holds the lock too long."""
+    with _marker_lock(folder):
+        return _write_marker_locked(folder, mutate)
+
+
+def _write_marker_locked(folder, mutate):
+    current = read_marker(folder) or {}
+    marker = {
+        "version": MARKER_VERSION,
+        "id": current.get("id"),
+        "created_by_pm": bool(current.get("created_by_pm", False)),
+        "keys": dict(current.get("keys") or {}),
+    }
+    mutate(marker)
+    if not marker.get("id"):
+        raise ValueError("a marker needs an id")
+    target = marker_path(folder)
+    temp = os.path.join(
+        folder, f".{MARKER_NAME}.{os.getpid()}-{threading.get_ident()}.tmp"
+    )
+    try:
+        with open(temp, "w", encoding="utf-8") as handle:
+            json.dump(marker, handle, indent=2, sort_keys=True)
+            handle.flush()
+            os.fsync(handle.fileno())
+        os.replace(temp, target)
+    finally:
+        try:
+            os.unlink(temp)
+        except OSError:
+            pass  # gone with the rename; a leftover is swept with the temps
+    return marker
+
+
+def new_id():
+    return str(uuid.uuid4())
+
+
+def init_folder(folder, *, created_by_pm=False):
+    """The marker id of *folder*: an existing marker is adopted; a folder
+    without one gets a new marker (new id, no keys)."""
+    existing = read_marker(folder)
+    if existing is not None:
+        return existing["id"]
+
+    def create(marker):
+        if not marker.get("id"):
+            marker["id"] = new_id()
+            marker["created_by_pm"] = created_by_pm
+
+    return write_marker(folder, create)["id"]
+
+
+def folder_state(path, expected_id):
+    """``(available, problem, marker)`` of a configured thumbnail folder.
+
+    Available: the folder exists, is a directory and not a link, junction or
+    reparse point, and holds our marker with *expected_id*. Raises OSError
+    when the folder cannot be reached (an I/O error other than not found).
+    """
+    try:
+        info = os.lstat(path)
+    except FileNotFoundError:
+        return False, "missing", None
+    except OSError as error:
+        if error.errno in (errno.ENOENT, errno.ENOTDIR):
+            return False, "missing", None
+        raise
+    if is_link_like(path):
+        return False, "invalid", None
+    if not stat_module.S_ISDIR(info.st_mode):
+        return False, "invalid", None
+    marker = read_marker(path)
+    if marker is None:
+        return False, "missing", None
+    if marker["id"] != expected_id:
+        return False, "marker-mismatch", marker
+    return True, None, marker
+
+
+def holds_only_metadata(path):
+    """Whether an existing folder is empty but for OS metadata files."""
+    with os.scandir(path) as entries:
+        for entry in entries:
+            name = entry.name.lower()
+            if name in OS_METADATA or name.startswith("._"):
+                continue
+            return False
+    return True
+
+
+# ── validation ───────────────────────────────────────────────────────
+
+
+@dataclass(frozen=True)
+class Context:
+    """What a location is checked against (gathered by the caller)."""
+
+    roots: tuple = ()  # every image source of every root list
+    contained: tuple = ()  # ComfyUI output/input/temp and the library folder
+    node_folder: str | None = None
+    default_path: str | None = None
+    current_path: str | None = None  # the folder in use (folder mode)
+    home: str | None = None
+    flavor: object = os.path
+    long_paths: bool | None = None
+    environ: object = None
+    # ComfyUI's folder_paths module (None: none; unset: imported).
+    folder_paths: object = library_location._UNSET
+
+
+def _timed(func, timeout):
+    """``func()`` on a daemon thread; raises TimeoutError past *timeout*.
+    A stuck call is left to finish on its own thread."""
+    result = {}
+    done = threading.Event()
+
+    def run():
+        try:
+            result["value"] = func()
+        except BaseException as error:  # _timed() re-raises it in the caller
+            result["error"] = error
+        finally:
+            done.set()
+
+    threading.Thread(target=run, name="pm-preview-stat", daemon=True).start()
+    if not done.wait(timeout):
+        raise TimeoutError("the folder did not answer in time")
+    if "error" in result:
+        raise result["error"]
+    return result.get("value")
+
+
+def _inside(path, folders):
+    return library_location._inside_any(path, folders)
+
+
+def _same(first, second):
+    return library_location.same_folder(first, second) or os.path.normcase(
+        os.path.realpath(first)
+    ) == os.path.normcase(os.path.realpath(second))
+
+
+def _served(path, context):
+    environ = os.environ if context.environ is None else context.environ
+    return (
+        library_location.data_dir_problem(
+            path,
+            folder_paths=context.folder_paths,
+            environ=environ,
+            gallery_roots=list(context.roots),
+        )
+        == "data-dir-served"
+    )
+
+
+def _probe_write(path):
+    """Create and delete a probe file in *path*; False when refused."""
+    probe = os.path.join(path, f".pm-probe-{uuid.uuid4().hex[:8]}.tmp")
+    try:
+        with open(probe, "wb") as handle:
+            handle.write(b"")
+    except OSError:
+        return False
+    try:
+        os.unlink(probe)
+    except OSError:
+        return False
+    return True
+
+
+def location_problem(path, *, purpose, context, timeout=VALIDATION_TIMEOUT):
+    """Why *path* cannot be the thumbnail folder, as a code, or None.
+
+    *purpose*: ``move`` (every rule), ``startup`` (no ``same``, ``empty``,
+    ``writable`` or parent rules: availability covers them) or ``recreate``
+    (the folder is missing and is made again).
+    """
+    flavor = context.flavor
+    code = form_problem(path, flavor=flavor)
+    if code is not None:
+        return code
+    path = flavor.abspath(path)
+    default = bool(context.default_path) and flavor.normcase(path) == flavor.normcase(
+        flavor.abspath(context.default_path)
+    )
+    if is_too_broad(path, home=context.home, flavor=flavor):
+        return "location-too-broad"
+    try:
+        return _timed(
+            lambda: _filesystem_problem(path, purpose, context, default), timeout
+        )
+    except (TimeoutError, OSError):
+        return "location-unavailable"
+
+
+def _filesystem_problem(path, purpose, context, default):
+    if _served(path, context):
+        return "location-served"
+    if context.node_folder and not default and _inside(path, [context.node_folder]):
+        return "location-node-folder"
+    inner = list(context.roots) + list(context.contained)
+    if any(folder and _inside(folder, [path]) for folder in inner):
+        if not default:
+            return "location-contains-source"
+    if (
+        purpose == "move"
+        and context.current_path
+        and (
+            os.path.normcase(path) == os.path.normcase(context.current_path)
+            or (os.path.isdir(path) and _same(path, context.current_path))
+        )
+    ):
+        return "location-same"
+    if (
+        purpose == "move"
+        and context.current_path
+        and _inside(path, [context.current_path])
+    ):
+        # The old key folders are removed after the move, and with them a
+        # target nested inside one of them.
+        return "location-inside-current"
+    # Windows, or a test injecting its limit (``long_paths=False``).
+    if os.name == "nt" or context.long_paths is False:
+        if too_long_for_windows(path, context.long_paths):
+            return "location-path-too-long"
+    if purpose == "startup":
+        return None
+    if is_link_like(path):
+        # Never through a link: the folder itself must be a real folder.
+        return "location-not-empty"
+    exists = os.path.isdir(path)
+    if not exists:
+        if os.path.lexists(path):
+            return "location-not-empty"
+        if not default and not os.path.isdir(os.path.dirname(path)):
+            return "location-parent-missing"
+        return None
+    if read_marker(path) is None and not holds_only_metadata(path):
+        return "location-not-empty"
+    if not _probe_write(path):
+        return "location-not-writable"
+    return None

py/api/preview_store.py

@@ -0,0 +1,706 @@
+"""Where previews live on disk (#320): the one resolver.
+
+Every mapping between an image source (a "root"), one of its media files and
+that file's preview on disk goes through this module. URL text stays in
+``thumbnail_settings`` (``thumbnail_rel``: ``thumbnails/<rel>_thumb<ext>``,
+the shape the serve route, ``inspection-state.mjs`` and ``admin.js`` share);
+this module answers where such a preview is on disk.
+
+The store of a source is where its previews live. With the default location
+(mode ``source``, "Inside each source") it is ``<source>/thumbnails``, exactly
+the folder every caller joined by hand before, so nothing moves.
+
+Writes and the switch: every preview writer takes ``write_guard`` when it
+starts (it records the location's ``generation``); the final rename runs
+under ``write_lock`` and only when the generation is unchanged and no hold
+applies (``thumbnail_encode.replace_unless_held``). Changing the location
+bumps the generation under the same lock, so no write that began before can
+land in the old store afterwards. Nothing reads or commits config while
+``write_lock`` is held. The hold check runs under it too, so hold checks take
+no lock (the job registry's ``running()`` is a lock-free snapshot) and
+``bump_generation`` is never called with a registry or config lock held.
+
+All functions are blocking: call them off the event loop.
+"""
+
+import errno
+import logging
+import os
+import threading
+import time
+from contextlib import contextmanager
+from dataclasses import dataclass, replace
+from pathlib import Path
+
+from . import preview_location, thumbnail_settings
+
+try:
+    from ...utils.media_folders import PREVIEW_FOLDER
+except ImportError:  # tests import the package top-level
+    from utils.media_folders import PREVIEW_FOLDER
+
+logger = logging.getLogger("prompt_manager.thumbnails")
+
+SOURCE_MODE = preview_location.SOURCE_MODE
+FOLDER_MODE = preview_location.FOLDER_MODE
+# The probe checks the folder this often, and a check (or a store call)
+# taking longer than the budget marks it unreachable.
+PROBE_INTERVAL = 5.0
+IO_BUDGET = 2.0
+PROBE_THREAD = "pm-preview-probe"
+
+
+@dataclass(frozen=True)
+class Location:
+    """One snapshot of the thumbnail location (take one per request or job)."""
+
+    mode: str = SOURCE_MODE
+    path: str | None = None
+    available: bool = True
+    problem: str | None = None
+    generation: int = 0
+
+
+write_lock = threading.Lock()
+_generation = 0
+# The runtime location: the parsed setting, availability and the marker keys
+# last read. Swapped as a whole; readers take one snapshot.
+_state_lock = threading.Lock()
+_parsed = preview_location.ParsedLocation()
+_available = True
+_problem = None
+_keys = {}
+_key_cache = {}
+_clock = time.monotonic
+
+
+def current():
+    """The thumbnail location now."""
+    with _state_lock:
+        parsed, available, problem, generation_now = (
+            _parsed,
+            _available,
+            _problem,
+            _generation,
+        )
+    if parsed.mode == SOURCE_MODE:
+        return Location(generation=generation_now)
+    return Location(FOLDER_MODE, parsed.path, available, problem, generation_now)
+
+
+def setting():
+    """The parsed setting in use (``preview_location.ParsedLocation``)."""
+    return _parsed
+
+
+def generation():
+    return _generation
+
+
+def bump_generation():
+    """Invalidate every write that started before (under ``write_lock``)."""
+    global _generation
+    with write_lock:
+        _generation += 1
+        return _generation
+
+
+def _canonical(path):
+    """Resolved and case-folded, so paths compare on every OS."""
+    return Path(os.path.normcase(os.path.realpath(str(path))))
+
+
+def _within(path, folder):
+    return _canonical(path).is_relative_to(_canonical(folder))
+
+
+# ── the setting and availability ─────────────────────────────────────
+
+
+def configure(value, *, context=None, check=True):
+    """Use the ``thumbnails.location`` *value* (config.json) from now on.
+
+    A folder location is validated against *context* (``startup`` rules: a
+    problem other than an unreachable folder makes it ``invalid``), then
+    checked once; the probe keeps checking it. Swapped under ``write_lock``
+    with a generation bump, so no write that started before lands.
+    """
+    global _parsed, _available, _problem, _generation
+    parsed = preview_location.parse_location(value)
+    problem = parsed.problem
+    if parsed.mode == FOLDER_MODE and problem is None and context is not None:
+        code = preview_location.location_problem(
+            parsed.path, purpose="startup", context=context
+        )
+        if code == "location-unavailable":
+            problem = "unreachable"
+        elif code is not None:
+            problem = "invalid"
+            parsed = preview_location.ParsedLocation(
+                mode=FOLDER_MODE,
+                path=parsed.path,
+                id=parsed.id,
+                install=parsed.install,
+                cleanup=parsed.cleanup,
+                problem="invalid",
+            )
+    with write_lock:
+        with _state_lock:
+            _parsed = parsed
+            _available = parsed.mode == SOURCE_MODE
+            _problem = problem if parsed.mode == FOLDER_MODE else None
+            _keys.clear()
+            _key_cache.clear()
+        _generation += 1
+    if parsed.mode == FOLDER_MODE:
+        if check and parsed.problem is None:
+            refresh()
+        _probe.start()
+    else:
+        _probe.stop()
+    return current()
+
+
+def refresh():
+    """Check the folder now (bounded by IO_BUDGET); returns availability."""
+    parsed = _parsed
+    if parsed.mode != FOLDER_MODE or parsed.problem is not None:
+        return parsed.mode == SOURCE_MODE
+    try:
+        available, problem, marker = _probe.check(parsed.path, parsed.id)
+    except (OSError, TimeoutError, RuntimeError):
+        available, problem, marker = False, "unreachable", None
+    _set_state(parsed, available, problem, marker)
+    return available
+
+
+def _set_keys(parsed, marker):
+    """Take the keys of a marker just written (availability unchanged)."""
+    with _state_lock:
+        if _parsed is not parsed:
+            return
+        keys = dict((marker or {}).get("keys") or {})
+        if keys != _keys:
+            _keys.clear()
+            _keys.update(keys)
+            _key_cache.clear()
+
+
+def set_cleanup(entries):
+    """The setting's ``cleanup`` after a removal was committed."""
+    global _parsed
+    with _state_lock:
+        _parsed = replace(_parsed, cleanup=tuple(entries))
+
+
+def mark_invalid():
+    """The setting cannot be used (a startup check that failed): folder
+    mode stays in force, unavailable, so nothing is written anywhere."""
+    global _parsed, _available, _problem
+    with _state_lock:
+        if _parsed.mode != FOLDER_MODE:
+            _parsed = preview_location.ParsedLocation(
+                mode=FOLDER_MODE, problem="invalid"
+            )
+        else:
+            _parsed = replace(_parsed, problem="invalid")
+        _available, _problem = False, "invalid"
+
+
+def _set_state(parsed, available, problem, marker):
+    global _available, _problem
+    with _state_lock:
+        if _parsed is not parsed:
+            return  # the setting changed meanwhile
+        _available, _problem = available, problem
+        keys = dict((marker or {}).get("keys") or {})
+        if keys != _keys:
+            _keys.clear()
+            _keys.update(keys)
+            _key_cache.clear()
+
+
+def note_failure():
+    """A store call failed or stalled: unreachable until the probe finds the
+    folder again (requests do no store I/O meanwhile)."""
+    global _available, _problem
+    if _parsed.mode != FOLDER_MODE:
+        return
+    with _state_lock:
+        _available, _problem = False, "unreachable"
+    _probe.wake()
+
+
+@contextmanager
+def store_io():
+    """Around a store call in folder mode: an I/O error (other than a file
+    that is not there) or a call over IO_BUDGET marks the folder
+    unreachable."""
+    if _parsed.mode != FOLDER_MODE:
+        yield
+        return
+    started = _clock()
+    try:
+        yield
+    except OSError as error:
+        if not isinstance(error, (FileNotFoundError, NotADirectoryError)):
+            note_failure()
+        raise
+    finally:
+        if _clock() - started > IO_BUDGET:
+            note_failure()
+
+
+class _Probe:
+    """The background check of the thumbnail folder (one thread, one check
+    at a time; a stuck check is left to finish on its own thread)."""
+
+    def __init__(self):
+        self._lock = threading.Lock()
+        self._wake = threading.Event()
+        self._stop = threading.Event()
+        self._thread = None
+        self._checking = None
+
+    def check(self, path, expected_id):
+        """``folder_state`` within IO_BUDGET; raises TimeoutError.
+
+        The answer comes from a check that started after this call: one
+        already running may have looked before what the caller just did, so
+        it is waited for (never run twice at once; a stuck one times out here)
+        and followed by a new one."""
+        key = (path, expected_id)
+        with self._lock:
+            earlier = self._running(key)
+            pending = None if earlier else self._start_check(path, expected_id)
+        if earlier:
+            self._wait(earlier)
+            with self._lock:
+                # One another caller started meanwhile is new enough to join.
+                pending = self._running(key) or self._start_check(path, expected_id)
+        self._wait(pending)
+        with self._lock:
+            if self._checking is pending:
+                self._checking = None
+        if "error" in pending[2]:
+            raise pending[2]["error"]
+        return pending[2]["value"]
+
+    def _running(self, key):
+        """The check of *key* still running (lock held), else None."""
+        pending = self._checking
+        if pending is None or pending[0] != key or pending[1].is_set():
+            return None
+        return pending
+
+    @staticmethod
+    def _wait(pending):
+        if not pending[1].wait(IO_BUDGET):
+            raise TimeoutError("the thumbnail folder did not answer in time")
+
+    def _start_check(self, path, expected_id):
+        """Start one check on its own thread (lock held)."""
+        result = {}
+        done = threading.Event()
+
+        def run():
+            try:
+                result["value"] = preview_location.folder_state(path, expected_id)
+            except BaseException as error:  # check() re-raises it in the caller
+                result["error"] = error
+            finally:
+                done.set()
+
+        pending = ((path, expected_id), done, result)
+        self._checking = pending
+        threading.Thread(target=run, name=PROBE_THREAD + "-check", daemon=True).start()
+        return pending
+
+    def start(self):
+        with self._lock:
+            if self._thread is not None and self._thread.is_alive():
+                return
+            # Each thread has its own stop: a stopped one never resumes.
+            stop = self._stop = threading.Event()
+            thread = threading.Thread(
+                target=self._run, args=(stop,), name=PROBE_THREAD, daemon=True
+            )
+            try:
+                thread.start()
+            except RuntimeError:
+                return  # refused at interpreter exit: no probe
+            self._thread = thread
+
+    def _run(self, stop):
+        while not stop.is_set():
+            self._wake.wait(PROBE_INTERVAL)
+            self._wake.clear()
+            if stop.is_set():
+                return
+            try:
+                refresh()
+            except Exception:  # one failed check never stops the probe
+                logger.debug("Thumbnail folder check failed", exc_info=True)
+
+    def wake(self):
+        self._wake.set()
+
+    def stop(self, timeout=2.0):
+        """Stop the probe; True when its thread ended."""
+        with self._lock:
+            thread, self._thread = self._thread, None
+        self._stop.set()
+        self._wake.set()
+        if thread is None or thread is threading.current_thread():
+            return True
+        thread.join(timeout)
+        return not thread.is_alive()
+
+
+_probe = _Probe()
+
+
+def stop_probe(timeout=2.0):
+    """Stop the folder probe (the package teardown, tests)."""
+    return _probe.stop(timeout)
+
+
+# ── stores ───────────────────────────────────────────────────────────
+
+
+def source_folder(root):
+    """``<source>/thumbnails``: the store in source mode, a leftover in
+    folder mode."""
+    return Path(root) / PREVIEW_FOLDER
+
+
+def store_container(root, location=None):
+    """The folder a store of *root* must stay inside: the source itself, or
+    the thumbnail folder in folder mode."""
+    location = location or current()
+    if location.mode == FOLDER_MODE:
+        return Path(location.path) if location.path else None
+    return Path(root)
+
+
+def _identity(root):
+    return os.path.normcase(os.path.realpath(str(root)))
+
+
+def _lookup_key(root):
+    spelling = str(root)
+    with _state_lock:
+        if spelling in _key_cache:
+            return _key_cache[spelling]
+        keys = dict(_keys)
+    key = preview_location.find_key(
+        keys,
+        spelling,
+        _identity(root),
+        preview_location.file_identity(root),
+    )
+    if key is not None:
+        with _state_lock:
+            _key_cache[spelling] = key
+    return key
+
+
+def store_dir(root, location=None):
+    """The store of *root*: ``<source>/thumbnails``, or in folder mode
+    ``<folder>/<key>`` (None while the folder is unavailable or before the
+    source has a key: a reader then finds no preview)."""
+    location = location or current()
+    if location.mode == SOURCE_MODE:
+        return Path(root) / PREVIEW_FOLDER
+    if not location.available or not location.path:
+        return None
+    key = _lookup_key(root)
+    return None if key is None else _key_folder(location.path, key)
+
+
+def _key_folder(folder, key):
+    """``<folder>/<key>``, only for a key that is one folder name directly
+    below the thumbnail folder (a marker is data, never a path)."""
+    if not preview_location.valid_key(key):
+        return None
+    store = Path(folder) / key
+    if store.parent != Path(folder) or store.name != key:
+        return None
+    return store
+
+
+def ensure_store(root, location=None, *, create=False):
+    """``store_dir`` for a writer: in folder mode a source without a key gets
+    one (recorded in the marker); with *create* its key folder is made (never
+    the thumbnail folder itself). None while the folder is unavailable, and
+    for a key folder that is a link, junction or reparse point: nothing is
+    planned, written or removed through it."""
+    location = location or current()
+    store = store_dir(root, location)
+    if location.mode == SOURCE_MODE or (store is None and not location.available):
+        return store
+    if store is None:
+        store = _assign_key(root, location)
+        if store is None:
+            return None
+    try:
+        with store_io():
+            linked = preview_location.is_link_like(store)
+    except OSError:
+        return None
+    if linked:
+        logger.warning(f"Skipping the thumbnail folder {store}: it is a link")
+        return None
+    if create:
+        try:
+            with store_io():
+                os.mkdir(store)
+        except FileExistsError:
+            pass  # already there: another writer made the key folder
+        except OSError:
+            return None
+    return store
+
+
+def _assign_key(root, location):
+    parsed = _parsed
+    if location.path != parsed.path:
+        return None
+    spelling = str(root)
+    identity = _identity(root)
+    dev_ino = preview_location.file_identity(root)
+    assigned = {}
+
+    def add(marker):
+        if marker.get("id") != parsed.id:
+            raise ValueError("another folder's marker")  # marker-mismatch
+        keys = marker["keys"]
+        key = preview_location.find_key(keys, spelling, identity, dev_ino)
+        if key is None:
+            taken = {k: v.get("identity") for k, v in keys.items()}
+            key = preview_location.source_key(spelling, identity, taken)
+            keys[key] = {
+                "path": spelling,
+                "identity": identity,
+                "dev_ino": dev_ino,
+                "install": parsed.install,
+            }
+        assigned["key"] = key
+
+    try:
+        with write_lock, store_io():
+            marker = preview_location.write_marker(location.path, add)
+    except (OSError, ValueError):
+        return None
+    _set_keys(parsed, marker)
+    return _key_folder(location.path, assigned["key"])
+
+
+def may_write(path, location=None):
+    """The one ownership check every preview write and delete passes.
+
+    Source mode: True (the callers' own root rules apply, as before). Folder
+    mode: *path* lies below a source key folder of the thumbnail folder,
+    lexically and resolved, and no link, junction or reparse point sits
+    anywhere from the key folder down to it (the file itself included).
+    """
+    location = location or current()
+    if location.mode == SOURCE_MODE:
+        return True
+    if not location.path:
+        return False
+    folder = Path(os.path.abspath(location.path))
+    path = Path(os.path.abspath(path))
+    try:
+        relative = path.relative_to(folder)
+    except ValueError:
+        return False
+    if len(relative.parts) < 2 or ".." in relative.parts:
+        return False
+    store = _key_folder(folder, relative.parts[0])
+    if store is None or not _within(path, folder):
+        return False
+    try:
+        return _no_link_below(store, path)
+    except OSError:
+        note_failure()
+        return False
+
+
+def make_parent(dst, location=None):
+    """Make the folders a preview *dst* is written into. In folder mode only
+    folders below the thumbnail folder are made, never the folder itself,
+    and only while it holds this install's marker (an unplugged drive or an
+    unmounted mount point raises FileNotFoundError); a *dst* that does not
+    pass ``may_write`` raises PermissionError."""
+    location = location or current()
+    dst = Path(dst)
+    if location.mode == SOURCE_MODE or not location.path:
+        if location.mode != SOURCE_MODE:
+            raise FileNotFoundError(errno.ENOENT, "thumbnail folder unavailable")
+        dst.parent.mkdir(parents=True, exist_ok=True)
+        return
+    folder = Path(os.path.abspath(location.path))
+    with store_io():
+        if not location.available or not folder.is_dir():
+            raise FileNotFoundError(errno.ENOENT, "thumbnail folder unavailable")
+        marker = preview_location.read_marker(str(folder))
+        if marker is None or marker.get("id") != _parsed.id:
+            note_failure()
+            raise FileNotFoundError(errno.ENOENT, "thumbnail folder unavailable")
+        if not may_write(dst, location):
+            raise PermissionError(errno.EACCES, "outside the thumbnail folder")
+        current_folder = folder
+        for part in Path(os.path.abspath(dst.parent)).relative_to(folder).parts:
+            current_folder = current_folder / part
+            try:
+                os.mkdir(current_folder)
+            except FileExistsError:
+                pass  # already there: another writer made this folder
+            if preview_location.is_link_like(current_folder):
+                raise PermissionError(errno.EACCES, "a link in the thumbnail folder")
+
+
+def store_is_link(store, location=None):
+    """Whether a store folder is a link (a junction or reparse point too in
+    folder mode): it is skipped by sweeps and refused by clears."""
+    location = location or current()
+    if location.mode == SOURCE_MODE:
+        return Path(store).is_symlink()
+    return preview_location.is_link_like(store)
+
+
+def given_store(root, store):
+    """A caller's explicit store argument: the default spelling
+    (``<root>/thumbnails``) means the resolver's store; another folder (only
+    tests pass one) is used as given."""
+    store = Path(store)
+    if store == Path(root) / PREVIEW_FOLDER:
+        return store_dir(root)
+    return store
+
+
+def preview_path(root, media_rel, ext=None, location=None, *, create=False):
+    """Where the preview of *media_rel* (relative to *root*) is, or is to be
+    written (*create*: a writer, which gives a new source its key), in *ext*
+    (the extension written now when None)."""
+    if create:
+        store = ensure_store(root, location)
+    else:
+        store = store_dir(root, location)
+    if store is None:
+        return None
+    if ext is None:
+        from .thumbnail_encode import writer_settings
+
+        ext = writer_settings().extension
+    return store / (thumbnail_settings.preview_stem(media_rel) + ext)
+
+
+def request_path(root, parts, location=None):
+    """The disk path of the URL parts ``("thumbnails", ...)``, or None when
+    *parts* is not under an exact ``thumbnails`` first part or the store has
+    no place for it. The text is checked before (``is_preview_text``)."""
+    parts = tuple(parts)
+    if len(parts) < 2 or parts[0] != PREVIEW_FOLDER:
+        return None
+    store = store_dir(root, location)
+    if store is None:
+        return None
+    return store.joinpath(*parts[1:])
+
+
+def _no_link_below(store, path):
+    """No folder from *store* down to *path* (and *store* itself) is a link,
+    junction or reparse point (lexical walk, one lstat each)."""
+    store = Path(os.path.abspath(store))
+    path = Path(os.path.abspath(path))
+    try:
+        relative = path.relative_to(store)
+    except ValueError:
+        return False
+    current = store
+    for part in ("",) + relative.parts:
+        current = current / part if part else current
+        if preview_location.is_link_like(current):
+            return False
+    return True
+
+
+def owns(root, path, location=None):
+    """Whether *path* lies inside the store of *root*, resolved: the store
+    stays inside its container and no link takes *path* out of the store.
+    In folder mode no link, junction or reparse point may sit anywhere from
+    the store down to *path*."""
+    location = location or current()
+    store = store_dir(root, location)
+    if store is None:
+        return False
+    container = store_container(root, location)
+    if not (_within(store, container) and _within(path, store)):
+        return False
+    if location.mode == SOURCE_MODE:
+        return True
+    return may_write(path, location)
+
+
+# ── preview text ─────────────────────────────────────────────────────
+
+
+def is_preview_text(filepath):
+    """URL text naming a preview: ``thumbnails/<...>/<name>_thumb<ext>``.
+
+    Text only, before any join: no backslash, drive or stream colon, and no
+    empty, ``.`` or ``..`` segment; ``thumbnails`` exactly as the first part
+    and nowhere else among the folders; the extension, in any case, one a
+    preview may carry (``X_thumb.JPG`` of an older release included).
+    """
+    if not filepath or "\\" in filepath or ":" in filepath:
+        return False
+    parts = filepath.split("/")
+    if len(parts) < 2 or parts[0] != PREVIEW_FOLDER:
+        return False
+    if any(part in ("", ".", "..") for part in parts):
+        return False
+    if PREVIEW_FOLDER in parts[1:-1]:
+        return False
+    stem, extension = os.path.splitext(parts[-1])
+    return (
+        stem.endswith(thumbnail_settings.THUMB_SUFFIX)
+        and len(stem) > len(thumbnail_settings.THUMB_SUFFIX)
+        and extension.lower() in thumbnail_settings.THUMBNAIL_EXTENSIONS
+    )
+
+
+# ── writes ───────────────────────────────────────────────────────────
+
+
+class _WriteGuard:
+    """``guard()`` for one preview write: true while the location has not
+    changed since the write started and *hold* (if any) allows it."""
+
+    __slots__ = ("generation", "_hold")
+
+    def __init__(self, hold=None):
+        self.generation = _generation
+        self._hold = hold
+
+    def __call__(self):
+        if self.generation != _generation:
+            return False
+        return self._hold is None or bool(self._hold())
+
+
+def write_guard(hold=None):
+    """Take when a preview write starts; hand to its final rename."""
+    if isinstance(hold, _WriteGuard):
+        return hold
+    return _WriteGuard(hold)
+
+
+@contextmanager
+def committed(guard=None):
+    """Around a preview's final rename: holds ``write_lock`` and yields
+    whether the write may land (``guard()``, re-checked under the lock)."""
+    with write_lock:
+        yield guard is None or bool(guard())

py/api/settings_routes.py

@@ -30,6 +30,7 @@ from . import thumbnail_settings
 from .admin import _current_image_monitor
 from .job_routes import busy_response
 from .jobs import THUMBNAILS_JOB_KIND, JobBusy
+from .thumbnail_location import needs_move_response
 
 try:
     from ...utils.validators import validate_result_timeout, validate_worker_threads
@@ -54,9 +55,25 @@ _SETTINGS_FILE_KEYS = {
     "AUTOTAG_EXISTING": ("autotag", "defaults", "existing"),
     "AUTOTAG_GENERAL_THRESHOLD": ("autotag", "defaults", "general_threshold"),
     "AUTOTAG_CHARACTER_THRESHOLD": ("autotag", "defaults", "character_threshold"),
-    "AUTOTAG_TEMPLATE": ("autotag", "defaults", "template"),
     "AUTOTAG_SUGGESTION_LIMIT": ("autotag", "defaults", "suggestion_limit"),
+    "AUTOTAG_SKIPPED_TAGS": ("autotag", "defaults", "skipped_tags"),
+    # #431: the saved instructions and each engine's default, always written
+    # together (server-side pairing).
+    "AUTOTAG_INSTRUCTIONS": ("autotag", "defaults", "instructions"),
+    "AUTOTAG_DEFAULT_INSTRUCTIONS": ("autotag", "defaults", "default_instructions"),
 }
+# The old single template: written only as the GGUF default's mirror for a
+# downgrade (#431 B1.1), deleted when that default is Built-in.
+_TEMPLATE_MIRROR_KEY = ("autotag", "defaults", "template")
+TEMPLATE_REPLACED_ERROR = (
+    "LLM tag template was replaced by Saved instructions. Reload the page."
+)
+# Whole-list settings (#431): a save without ``expected_revision`` would merge
+# a stale copy over a list changed elsewhere, so it is refused.
+_REVISION_REQUIRED = frozenset(
+    {"autotag_skipped_tags", "autotag_instructions", "autotag_default_instructions"}
+)
+REVISION_REQUIRED_ERROR = "Reload the page and try again."
 # The thumbnail settings a running Convert outdated job fixes (#317).
 _THUMBNAIL_SETTINGS = ("THUMBNAIL_FORMAT", "THUMBNAIL_QUALITY", "THUMBNAIL_EDGE")
 # Attributes that live on GalleryConfig; the others on PromptManagerConfig.
@@ -137,13 +154,20 @@ def _settings_mutation(updates, new_roots):
     """The config commit for a settings save: only the submitted keys change.
 
     Every other section and key (integrations and the CivitAI key, database,
-    unknown sections) is kept as it is on disk.
+    unknown sections) is kept as it is on disk. A save of the instructions
+    also writes the old ``template`` key as the GGUF default's mirror.
     """
 
     def mutate(config):
         for name, value in updates.items():
             *sections, key = _SETTINGS_FILE_KEYS[name]
-            _set_nested(config, sections, key, value)
+            _set_nested(config, sections, key, _jsonable(value))
+        if "AUTOTAG_INSTRUCTIONS" in updates:
+            *sections, key = _TEMPLATE_MIRROR_KEY
+            mirror = _mirror_text(
+                updates["AUTOTAG_INSTRUCTIONS"], updates["AUTOTAG_DEFAULT_INSTRUCTIONS"]
+            )
+            _set_nested(config, sections, key, _DELETE if mirror is None else mirror)
         if new_roots is not None:
             gallery = _section(config, "gallery")
             monitoring = _section(gallery, "monitoring")
@@ -155,10 +179,37 @@ def _settings_mutation(updates, new_roots):
     return mutate
 
 
+# ``_set_nested``'s value that removes the key instead of setting it.
+_DELETE = object()
+
+
+def _jsonable(value):
+    """A runtime value as config.json holds it (tuples become lists)."""
+    if isinstance(value, (list, tuple)):
+        return [_jsonable(item) for item in value]
+    if isinstance(value, dict):
+        return {key: _jsonable(item) for key, item in value.items()}
+    return value
+
+
+def _mirror_text(entries, defaults):
+    """The GGUF default's text, or None when it is Built-in (#431 B1.1)."""
+    from ..tagging_defaults import BUILTIN_INSTRUCTIONS_ID
+
+    for item in entries:
+        if item["id"] == defaults["gguf"] != BUILTIN_INSTRUCTIONS_ID:
+            return item["text"]
+    return None
+
+
 def _set_nested(config, sections, key, value):
-    """``config[s1][s2]...[key] = value``, each section a fresh dict."""
+    """``config[s1][s2]...[key] = value``, each section a fresh dict;
+    ``_DELETE`` removes the key."""
     if not sections:
-        config[key] = value
+        if value is _DELETE:
+            config.pop(key, None)
+        else:
+            config[key] = value
         return
     merged = _section(config, sections[0])
     _set_nested(merged, sections[1:], key, value)
@@ -176,7 +227,7 @@ def _validate_autotag_settings(data):
         MAX_SUGGESTION_LIMIT,
         MODEL_TYPES,
         validate_saved_threshold,
-        validate_template,
+        validate_skipped_tags,
     )
 
     updates = {}
@@ -205,12 +256,7 @@ def _validate_autotag_settings(data):
                 raise ValueError(f"{error}.") from None
             updates[key.upper()] = value
     if "autotag_template" in data:
-        try:
-            updates["AUTOTAG_TEMPLATE"] = validate_template(
-                data["autotag_template"], "LLM tag template"
-            )
-        except ValueError as error:
-            raise ValueError(f"{error}.") from None
+        raise ValueError(TEMPLATE_REPLACED_ERROR)
     if "autotag_suggestion_limit" in data:
         value = data["autotag_suggestion_limit"]
         if type(value) is not int or not 1 <= value <= MAX_SUGGESTION_LIMIT:
@@ -219,9 +265,41 @@ def _validate_autotag_settings(data):
                 f"{MAX_SUGGESTION_LIMIT}."
             )
         updates["AUTOTAG_SUGGESTION_LIMIT"] = value
+    if "autotag_skipped_tags" in data:
+        updates["AUTOTAG_SKIPPED_TAGS"] = tuple(
+            validate_skipped_tags(data["autotag_skipped_tags"])
+        )
+    updates.update(_validate_instruction_settings(data))
     return updates
 
 
+def _validate_instruction_settings(data):
+    """Server-side pairing (#431): a save that carries either instruction key
+    gets the other from the running configuration (which holds the migrated
+    list), the defaults are checked against the merged list, and both are
+    written. Empty when the save carries neither."""
+    from ..config import AutotagConfig
+    from ..tagging_defaults import (
+        validate_default_instructions,
+        validate_instructions,
+    )
+
+    if not {"autotag_instructions", "autotag_default_instructions"} & set(data):
+        return {}
+    if "autotag_instructions" in data:
+        entries = validate_instructions(data["autotag_instructions"])
+    else:
+        entries = [dict(item) for item in AutotagConfig.INSTRUCTIONS]
+    defaults = data.get(
+        "autotag_default_instructions", dict(AutotagConfig.DEFAULT_INSTRUCTIONS)
+    )
+    defaults = validate_default_instructions(defaults, entries)
+    return {
+        "AUTOTAG_INSTRUCTIONS": tuple(entries),
+        "AUTOTAG_DEFAULT_INSTRUCTIONS": defaults,
+    }
+
+
 async def _read_json(request):
     """Parse a JSON object body through the package's capped reader."""
     from . import _read_json_body
@@ -249,6 +327,7 @@ class SettingsRoutesMixin:
         """Get current settings."""
         try:
             from ..config import AutotagConfig, PromptManagerConfig, GalleryConfig
+            from ..tagging_defaults import DEFAULT_TAG_TEMPLATE
 
             root_paths = [
                 self._public_path(d) for d in GalleryConfig.MONITORING_DIRECTORIES
@@ -264,6 +343,12 @@ class SettingsRoutesMixin:
                     "sources": source_status,
                     "monitor": monitor,
                     "thumbnail_encoders": encoders,
+                    # #320: the full path only here (D6A).
+                    "thumbnail_location": await self._run_in_executor(
+                        functools.partial(
+                            self._thumbnail_location_payload, with_path=True
+                        )
+                    ),
                     "settings": {
                         "monitoring_enabled": GalleryConfig.MONITORING_ENABLED,
                         "save_foreign_runs": GalleryConfig.SAVE_FOREIGN_RUNS,
@@ -281,8 +366,21 @@ class SettingsRoutesMixin:
                         "autotag_character_threshold": (
                             AutotagConfig.CHARACTER_THRESHOLD
                         ),
-                        "autotag_template": AutotagConfig.TEMPLATE,
+                        # Read-only for one release (#431): a page cached
+                        # from before the upgrade still renders.
+                        "autotag_template": AutotagConfig.default_instructions_text(
+                            "gguf"
+                        ),
+                        "autotag_instructions": [
+                            dict(item) for item in AutotagConfig.INSTRUCTIONS
+                        ],
+                        "autotag_default_instructions": dict(
+                            AutotagConfig.DEFAULT_INSTRUCTIONS
+                        ),
+                        # Built-in's text, which System shows read-only.
+                        "autotag_builtin_instructions": DEFAULT_TAG_TEMPLATE,
                         "autotag_suggestion_limit": AutotagConfig.SUGGESTION_LIMIT,
+                        "autotag_skipped_tags": list(AutotagConfig.SKIPPED_TAGS),
                         "cpu_count": PromptManagerConfig.max_worker_threads(),
                         "gallery_root_paths": root_paths,
                         "gallery_root_path": root_paths[0] if root_paths else "",
@@ -377,12 +475,19 @@ class SettingsRoutesMixin:
             if error_response is not None:
                 return error_response
 
+            if "thumbnail_location" in data:
+                # #320: only the Move thumbnails job changes the location.
+                return needs_move_response()
             expected_revision = data.get("expected_revision")
             if expected_revision is not None and not isinstance(expected_revision, str):
                 return web.json_response(
                     {"success": False, "error": "expected_revision must be a string"},
                     status=400,
                 )
+            if expected_revision is None and _REVISION_REQUIRED & set(data):
+                return web.json_response(
+                    {"success": False, "error": REVISION_REQUIRED_ERROR}, status=400
+                )
             try:
                 updates = self._validate_settings(data)
             except ValueError as ve:
@@ -481,7 +586,8 @@ class SettingsRoutesMixin:
             for key in _THUMBNAIL_SETTINGS
         )
         job = self._jobs.active(THUMBNAILS_JOB_KIND) if changed else None
-        if job is None or job.scope.get("mode") != "convert":
+        # A move copies previews of the current settings (#320).
+        if job is None or job.scope.get("mode") not in ("convert", "move"):
             return None
         return web.json_response(
             {
@@ -511,6 +617,12 @@ class SettingsRoutesMixin:
             if name in _AUTOTAG_SETTINGS:
                 setattr(AutotagConfig, name[len(_AUTOTAG_PREFIX) :], value)
                 continue
+        if "AUTOTAG_INSTRUCTIONS" in updates:
+            # What config.json now holds as the old key (the mirror).
+            AutotagConfig._LEGACY_TEMPLATE = AutotagConfig.mirror_template()
+        for name, value in updates.items():
+            if name in _AUTOTAG_SETTINGS:
+                continue
             owner = GalleryConfig if name in _GALLERY_SETTINGS else PromptManagerConfig
             setattr(owner, name, value)
         restart_fields = []

py/api/sources.py

@@ -30,6 +30,8 @@ import ntpath
 import os
 import re
 
+from .preview_location import HOLDS_THUMBNAILS_REASON
+
 logger = logging.getLogger("prompt_manager.api")
 
 MAX_SOURCE_PATH = 4096  # characters
@@ -114,7 +116,26 @@ def source_problem(text):
     code = source_form_error(text)
     if code is not None:
         return code, FORM_REASONS[code]
-    return GalleryConfig.gallery_root_problem(text)
+    code, reason = GalleryConfig.gallery_root_problem(text)
+    if code is None and _holds_thumbnails(GalleryConfig.resolve_gallery_root(text)):
+        return "holds-thumbnails", HOLDS_THUMBNAILS_REASON
+    return code, reason
+
+
+def _holds_thumbnails(path):
+    """Whether *path* is inside or around the thumbnail folder in use (#320):
+    a source there would list Prompt Manager's own previews."""
+    from . import preview_store
+
+    try:
+        from ...utils.library_location import _inside_any
+    except ImportError:  # tests import the package top-level
+        from utils.library_location import _inside_any
+
+    setting = preview_store.setting()
+    if setting.mode != preview_store.FOLDER_MODE or not setting.path:
+        return False
+    return _inside_any(path, [setting.path]) or _inside_any(setting.path, [path])
 
 
 def public_spelling(text):

py/api/thumbnail_auto.py

@@ -8,7 +8,8 @@ previews behind those URLs are made here, in three ways:
 - **On first view.** ``GET /prompt_manager/images/serve/thumbnails/<rel>_thumb
   <ext>`` for a preview that does not exist yet is admitted on the event loop
   (``_PreviewGate``): at most ``ON_DEMAND_LIMIT`` previews are written at once,
-  on this API's own small pool (never the default executor), one flight runs
+  on this API's interactive image pool (``IMAGE_POOL_SIZE`` threads, shared
+  with card facts and inspector reads; never the default executor), one flight runs
   per file, and the requests waiting are capped (``MAX_WAITING``); past the
   cap a request gets its fallback at once. Inside the admission the preview is
   mapped back to its media file under the same root (the request text is
@@ -24,7 +25,8 @@ previews behind those URLs are made here, in three ways:
 - **On capture.** The image monitor hands every new output it settles to
   ``queue_capture_thumbnail``, which queues its preview for one background
   worker thread (``AutoThumbnailer``). Each wake takes at most Worker threads
-  (``WORKER_THREADS``) files and writes them on that many threads; enqueuing
+  (``WORKER_THREADS``) files and writes them on the long-lived job pool
+  (``utils.parallel``, shared with scans and thumbnail jobs); enqueuing
   is O(1), so the monitor and ComfyUI's queue never wait. A file already
   queued is not queued again, the queue is bounded (``MAX_QUEUED``) and a
   preview left out is made on its first view instead.
@@ -49,7 +51,7 @@ write starts (after its slot) and again just before its rename.
 
 Shutdown: ``close_auto_thumbnails`` stops the worker at a file boundary,
 kills a running ffmpeg, waits a bounded time (and logs when the wait ran
-out) and shuts the view pool down; after the app's cleanup
+out) and shuts the image pool down; after the app's cleanup
 (``final=True``) nothing starts a worker again. Importing this module again
 (a package reload) stops the workers the previous import left.
 """
@@ -60,12 +62,12 @@ import functools
 import io
 import os
 import threading
-from concurrent.futures import ThreadPoolExecutor
+from concurrent.futures import CancelledError, ThreadPoolExecutor
 from pathlib import Path
 
 from aiohttp import web
 
-from . import thumbnail_settings
+from . import preview_store, thumbnail_settings
 from .images import (
     in_trash_below_roots,
     MEDIA_EXTENSIONS,
@@ -76,7 +78,7 @@ from .images import (
     _thumbnail_is_fresh,
     _video_placeholder_image,
     _worker_threads,
-    media_thumbnail_rel,
+    media_preview_path,
 )
 from .jobs import (
     DUPLICATE_CLEANUP_JOB_KIND,
@@ -104,8 +106,11 @@ PLACEHOLDER_SIZE = (thumbnail_settings.DEFAULT_EDGE, thumbnail_settings.DEFAULT_
 PLACEHOLDER_QUALITY = 85
 # Source extensions in the order a shared preview name looks for them (R2).
 _SOURCE_ORDER = thumbnail_settings.IMAGE_SOURCE_ORDER + tuple(sorted(VIDEO_EXTENSIONS))
-# Previews views may write at once (the size of the view pool).
-ON_DEMAND_LIMIT = 3
+# Threads of the interactive image pool (#523): view previews, card facts and
+# inspector reads. Fixed, so image buffers stay in a few threads' arenas.
+IMAGE_POOL_SIZE = 3
+# Previews views may write at once (the whole image pool).
+ON_DEMAND_LIMIT = IMAGE_POOL_SIZE
 # View requests that may wait on the gate; one more gets its fallback at once.
 MAX_WAITING = 64
 # How long a pool thread waits for the capture worker's flight of the same file.
@@ -124,7 +129,7 @@ AUTO_REFUSED_KINDS = frozenset(
     {RESTORE_JOB_KIND, DUPLICATE_CLEANUP_JOB_KIND, SOURCE_CHANGE_JOB_KIND}
 )
 WORKER_NAME = "PromptManagerThumbnailWorker"
-POOL_PREFIX = "pm-preview"
+POOL_PREFIX = "pm-image"
 # Identifies this import's workers: a reload stops the ones it did not start.
 _MODULE_TOKEN = object()
 
@@ -153,6 +158,36 @@ def _dst_key(dst):
     return flight_key(Path(dst).parent, (Path(dst).name,))
 
 
+class DeferredPreview:
+    """The preview of *rel* under *root*, resolved when its write starts
+    (#320): a queued capture follows the thumbnail location at write time,
+    not the one when it was queued."""
+
+    __slots__ = ("root", "rel", "strict")
+
+    def __init__(self, root, rel, *, strict=True):
+        self.root = Path(root)
+        self.rel = Path(rel)
+        # A capture refuses a store linked out of its container (the serve
+        # route's rule); a planned target keeps the plan's rule: inside the
+        # store, as the thumbnail job writes it.
+        self.strict = strict
+
+    def resolve(self):
+        """The preview's path now, or None when nothing may be written."""
+        dst = media_preview_path(self.root, self.rel, create=True)
+        if dst is None:
+            return None
+        if self.strict:
+            return dst if preview_store.owns(self.root, dst) else None
+        store = preview_store.store_dir(self.root)
+        return dst if _is_within(dst, store) else None
+
+
+def _resolved(dst):
+    return dst.resolve() if isinstance(dst, DeferredPreview) else Path(dst)
+
+
 @functools.lru_cache(maxsize=1)
 def video_placeholder_jpeg():
     """The placeholder frame as JPEG bytes (a video whose preview is missing)."""
@@ -210,10 +245,19 @@ def _candidates(parts):
 def _current_preview(root, parts):
     """The preview *parts* names, in the format written now (#317): a request
     for an older name (``_thumb.png`` before a conversion) is answered with
-    the current file."""
+    the current file. None when the store of *root* has no place for it."""
     _folder, base, _wanted = _candidates(parts)
     name = base + thumbnail_settings.THUMB_SUFFIX + writer_settings().extension
-    return Path(root).joinpath(*parts[:-1], name)
+    return preview_store.request_path(root, (*parts[:-1], name))
+
+
+def _request_key(root, parts):
+    """The flight key of the preview *parts* under *root*: the key of its
+    disk path (so the serve and history routes share one flight)."""
+    path = preview_store.request_path(root, parts)
+    if path is None:
+        return flight_key(root, parts)
+    return _dst_key(path)
 
 
 def _quick_source(root, parts):
@@ -254,12 +298,14 @@ def _thumbnail_source(root, parts):
     if in_trash_below_roots(found, [root]):
         return None
     rel = Path(*folder_parts, found.name)
-    dst = root / media_thumbnail_rel(rel)
+    dst = media_preview_path(root, rel, create=True)
+    if dst is None:
+        # Nowhere to write (the thumbnail folder is unavailable): the
+        # original is served and nothing is written.
+        return found, None, found.suffix.lower() in VIDEO_EXTENSIONS
     if dst != _current_preview(root, parts):
         return None
-    if not _is_within(root / "thumbnails", root) or not _is_within(
-        dst, root / "thumbnails"
-    ):
+    if not preview_store.owns(root, dst):
         dst = None
     return found, dst, found.suffix.lower() in VIDEO_EXTENSIONS
 
@@ -279,6 +325,21 @@ def _scan_folder(folder, base, extensions):
     return None
 
 
+def _deferred(roots, src, dst):
+    """The ``DeferredPreview`` of a planned ``(src, dst)``: the root whose
+    store the plan wrote *dst* into (nested roots plan one each); *dst* as
+    planned when none matches."""
+    src = Path(src)
+    for root in roots:
+        root = Path(root)
+        if not src.is_relative_to(root):
+            continue
+        rel = src.relative_to(root)
+        if media_preview_path(root, rel) == Path(dst):
+            return DeferredPreview(root, rel, strict=False)
+    return dst
+
+
 def _stop_stale_workers():
     """Stop capture workers a previous import of this module started."""
     for thread in threading.enumerate():
@@ -294,7 +355,7 @@ class AutoThumbnailer:
     ``generate(src, dst, is_video, *, stop, guard, track)`` writes one
     preview and returns ``_generate_one``'s result dict; ``may_write()``
     says whether automatic previews may be written now. Views call
-    ``ensure`` on the view pool, the monitor calls ``enqueue`` from its
+    ``ensure`` on the image pool, the monitor calls ``enqueue`` from its
     thread.
     """
 
@@ -420,16 +481,23 @@ class AutoThumbnailer:
 
     def enqueue(self, src, dst, is_video):
         """Queue *dst*'s preview for the worker; False when already queued,
-        full, closed or its worker is refused at interpreter exit. Never
-        blocks on a write."""
-        key = _dst_key(dst)
+        full, closed, nowhere to write it or its worker is refused at
+        interpreter exit. Never blocks on a write. *dst* may be a
+        ``DeferredPreview``: its path is resolved again when the write
+        starts."""
+        now = _resolved(dst)
+        if now is None:
+            return False
+        key = _dst_key(now)
+        if not isinstance(dst, DeferredPreview):
+            dst = now
         with self._changed:
             if self._closed or key in self._queued:
                 return False
             if len(self._queue) >= self._max_queued:
                 return False
             self._queued.add(key)
-            self._queue.append((key, Path(src), Path(dst), bool(is_video)))
+            self._queue.append((key, Path(src), dst, bool(is_video)))
             self._busy = True
             started = True
             if self._start_worker and not self._worker_running:
@@ -491,12 +559,15 @@ class AutoThumbnailer:
                     self._worker_running = False
                     self._changed.notify_all()
                     return
-                take = min(len(self._queue), max(1, int(self._workers() or 1)))
+                workers = max(1, int(self._workers() or 1))
+                take = min(len(self._queue), workers)
                 batch = [self._queue.popleft() for _ in range(take)]
                 self._batch = len(batch)
                 self._changed.notify_all()
             try:
-                map_parallel(self._write_queued, batch, len(batch))
+                # The job pool's size is the setting; a smaller batch uses
+                # fewer of its threads (#523: one long-lived pool).
+                map_parallel(self._write_queued, batch, workers)
             finally:
                 with self._changed:
                     self._batch = 0
@@ -506,6 +577,9 @@ class AutoThumbnailer:
     def _write_queued(self, item):
         _key, src, dst, is_video = item
         try:
+            dst = _resolved(dst)
+            if dst is None:
+                return  # nowhere to write it now: made on its first view
             self.ensure(src, dst, is_video)
         except Exception:  # one file never stops the worker
             self._logger.warning(
@@ -567,7 +641,7 @@ class _PreviewGate:
     """Admission of view requests on the event loop (#249 I2).
 
     Waiters are coroutines: at most ``limit`` previews are written at once
-    on the view pool, one flight runs per key, and past ``MAX_WAITING``
+    on the image pool, one flight runs per key, and past ``MAX_WAITING``
     waiting requests ``run`` answers ``OVER`` at once.
     """
 
@@ -622,13 +696,17 @@ class _PreviewGate:
                 flight.set_result(result)
 
 
+def _on_image_thread():
+    return threading.current_thread().name.startswith(POOL_PREFIX + "_")
+
+
 class AutoThumbnailMixin:
     """Automatic previews on the API: views, the monitor's queue, scans."""
 
     _auto_thumbnailer = None
     _auto_thumbnails_shut = False
     _preview_gate_obj = None
-    _preview_pool_obj = None
+    _image_pool_obj = None
     _auto_thumbnailer_lock = threading.Lock()
 
     def _auto_thumbnails(self):
@@ -651,7 +729,7 @@ class AutoThumbnailMixin:
             self._auto_thumbnails_shut = True
 
     def close_auto_thumbnails(self, final=False, timeout=None):
-        """Stop the capture worker and the view pool, and forget them.
+        """Stop the capture worker and the image pool, and forget them.
 
         Bounded by ``timeout`` (see AutoThumbnailer.close). ``final`` (the
         package teardown) also keeps a late monitor event from starting a
@@ -662,7 +740,7 @@ class AutoThumbnailMixin:
             if final:
                 self._auto_thumbnails_shut = True
             thumbnailer, self._auto_thumbnailer = self._auto_thumbnailer, None
-            pool, self._preview_pool_obj = self._preview_pool_obj, None
+            pool, self._image_pool_obj = self._image_pool_obj, None
             self._preview_gate_obj = None
         closed = True
         if thumbnailer is not None:
@@ -671,6 +749,8 @@ class AutoThumbnailMixin:
             pool.shutdown(wait=False, cancel_futures=True)
         if final:
             shutdown_encoders()  # kill JPEG XL / ffmpeg encoders still running
+            # The thumbnail folder's probe (#320), bounded like the rest.
+            closed = preview_store.stop_probe() and closed
         return closed
 
     def _auto_thumbnail_failures(self):
@@ -695,6 +775,9 @@ class AutoThumbnailMixin:
                 return job
             if job.kind == THUMBNAILS_JOB_KIND and job.title == THUMBNAIL_CLEAR_TITLE:
                 return job
+            # Move thumbnails holds automatic previews for its whole run (D2A).
+            if job.kind == THUMBNAILS_JOB_KIND and job.scope.get("mode") == "move":
+                return job
         return None
 
     # ── the view admission ────────────────────────────────────────────
@@ -706,16 +789,67 @@ class AutoThumbnailMixin:
             gate = self._preview_gate_obj = _PreviewGate(ON_DEMAND_LIMIT, self.logger)
         return gate
 
-    def _preview_pool(self):
-        with AutoThumbnailMixin._auto_thumbnailer_lock:
-            if self._preview_pool_obj is None:
-                self._preview_pool_obj = ThreadPoolExecutor(
-                    ON_DEMAND_LIMIT, thread_name_prefix=POOL_PREFIX
-                )
-            return self._preview_pool_obj
+    def _image_pool(self):
+        """The interactive image pool (#523): IMAGE_POOL_SIZE threads for view
+        previews (behind their gate), card facts and inspector reads, so
+        image buffers never spread over the default executor's threads.
 
-    def _preview_pool_threads(self):
-        pool = self._preview_pool_obj
+        None after the package teardown (``close_auto_thumbnails(final=True)``):
+        a late request then runs on the default executor (``run_in_executor``
+        with None) and starts no thread the teardown no longer stops.
+        """
+        with AutoThumbnailMixin._auto_thumbnailer_lock:
+            if self._image_pool_obj is None and not self._auto_thumbnails_shut:
+                self._image_pool_obj = ThreadPoolExecutor(
+                    IMAGE_POOL_SIZE, thread_name_prefix=POOL_PREFIX
+                )
+            return self._image_pool_obj
+
+    async def _run_image(self, func, *args, **kwargs):
+        """``_run_in_executor`` for interactive image work: the image pool.
+
+        After the teardown, or with the pool shut down in between (a test
+        reset), the call runs on the default executor as before.
+        """
+        call = functools.partial(func, *args, **kwargs)
+        loop = asyncio.get_running_loop()
+        try:
+            future = loop.run_in_executor(self._image_pool(), call)
+        except RuntimeError:  # submit refused: the pool was shut down
+            future = loop.run_in_executor(None, call)
+        return await future
+
+    def _map_image(self, func, items):
+        """``func`` over *items* on the image pool, in order (blocking).
+
+        Called from an image pool thread, after the teardown, or with the
+        pool shut down in between (its queued items are cancelled), the
+        items it did not run run on the calling thread.
+        """
+        items = list(items)
+        pool = None if not items or _on_image_thread() else self._image_pool()
+        if pool is None:
+            return [func(item) for item in items]
+        futures = []
+        try:
+            for item in items:
+                futures.append(pool.submit(func, item))
+        except RuntimeError:
+            pass  # shut down in between: the rest run here
+        results = []
+        for index, item in enumerate(items):
+            future = futures[index] if index < len(futures) else None
+            if future is None or future.cancelled():
+                results.append(func(item))
+                continue
+            try:
+                results.append(future.result())
+            except CancelledError:  # cancelled while this caller waited
+                results.append(func(item))
+        return results
+
+    def _image_pool_threads(self):
+        pool = self._image_pool_obj
         return [] if pool is None else list(getattr(pool, "_threads", ()))
 
     def _video_placeholder_bytes(self):
@@ -730,7 +864,7 @@ class AutoThumbnailMixin:
         return await self._preview_gate().run(
             flight_key(Path(dst).parent, (Path(dst).name,)),
             functools.partial(self._ensure_view, src, dst, is_video),
-            self._preview_pool(),
+            self._image_pool(),
         )
 
     def _ensure_view(self, src, dst, is_video):
@@ -774,17 +908,17 @@ class AutoThumbnailMixin:
         The flight answers only the outcome (a history flight may be the one
         joined); the file it previews is derived here: the preview path is
         the request's own, and a fallback looks its source up again on the
-        view pool (bounded by it, never the default executor).
+        image pool (bounded by it, never the default executor).
         """
         if _has_traversal(filepath) or not _is_preview_request(filepath):
             return None
         parts = tuple(filepath.split("/"))
         gate = self._preview_gate()
-        pool = self._preview_pool()
+        pool = self._image_pool()
         for root in output_dirs:
             root = Path(root)
             outcome = await gate.run(
-                flight_key(root, parts),
+                _request_key(root, parts),
                 functools.partial(self._preview_on_demand, root, parts),
                 pool,
             )
@@ -797,7 +931,7 @@ class AutoThumbnailMixin:
                     continue
                 return self._preview_response(BUSY, quick[0], None, quick[1])
             dst = _current_preview(root, parts)
-            if outcome == READY:
+            if outcome == READY and dst is not None:
                 return self._file_response(dst)
             located = await gate.loop.run_in_executor(
                 pool, _thumbnail_source, root, parts
@@ -820,17 +954,31 @@ class AutoThumbnailMixin:
         """
         if self._auto_thumbnails_shut:
             return "skipped"
-        located = self._capture_target(image_path)
+        located = self._capture_source(image_path)
         if located is None:
             return "skipped"
-        src, dst, is_video = located
+        src, root, rel, is_video = located
+        dst = DeferredPreview(root, rel).resolve()
+        if dst is None:
+            return "skipped"
         if _thumbnail_is_fresh(src, dst):
             return "fresh"
-        if self._auto_thumbnails().enqueue(src, dst, is_video):
+        if self._auto_thumbnails().enqueue(src, DeferredPreview(root, rel), is_video):
             return "queued"
         return "skipped"
 
     def _capture_target(self, image_path):
+        """``(src, dst, is_video)`` of a new output's preview now, or None."""
+        located = self._capture_source(image_path)
+        if located is None:
+            return None
+        src, root, rel, is_video = located
+        dst = DeferredPreview(root, rel).resolve()
+        return None if dst is None else (src, dst, is_video)
+
+    def _capture_source(self, image_path):
+        """``(src, root, rel, is_video)`` of a media file under a current
+        root (not a preview, a link or in a trash folder), or None."""
         path = Path(os.path.abspath(str(image_path)))
         if path.suffix.lower() not in MEDIA_EXTENSIONS or not _regular_file(path):
             return None
@@ -843,12 +991,7 @@ class AutoThumbnailMixin:
             rel = Path(os.path.relpath(path, root))
             if "thumbnails" in rel.parts[:-1] or in_trash_below_roots(path, [root]):
                 return None
-            dst = root / media_thumbnail_rel(rel)
-            if not _is_within(root / "thumbnails", root) or not _is_within(
-                dst, root / "thumbnails"
-            ):
-                return None
-            return path, dst, path.suffix.lower() in VIDEO_EXTENSIONS
+            return path, root, rel, path.suffix.lower() in VIDEO_EXTENSIONS
         return None
 
     # ── after a scan ──────────────────────────────────────────────────
@@ -890,7 +1033,7 @@ class AutoThumbnailMixin:
             return "none"
         thumbnailer = self._auto_thumbnails()
         for src, dst, is_video in plan["targets"]:
-            thumbnailer.enqueue(src, dst, is_video)
+            thumbnailer.enqueue(src, _deferred(output_dirs, src, dst), is_video)
         self.logger.info(f"{missing:,} previews missing after the scan; queued")
         return "queued"
 

py/api/thumbnail_convert.py

@@ -44,7 +44,7 @@ import os
 import time
 from pathlib import Path
 
-from . import thumbnail_settings
+from . import preview_store, thumbnail_settings
 from .thumbnail_encode import ThumbnailVerifyError, verify_thumbnail, writer_settings
 from .admin import _plural, _scan_location, _scan_roots, _scan_status_line
 from .images import _thumbnail_is_fresh, _worker_threads, _thumbnail_batch_size
@@ -153,6 +153,7 @@ class ThumbnailConvertMixin:
             job.log_line("Conversion failed · internal error")
             state = "failed"
         job.finish(state)
+        await self._release_job_memory()
 
     async def _convert_job_body(self, job, options):
         output_dirs = await self._run_in_executor(self._get_all_output_dirs)
@@ -392,6 +393,12 @@ class ThumbnailConvertMixin:
         removed, with no bytes (another run or a sibling removed it)."""
         removed, kept = 0, []
         for path, size in old:
+            if not preview_store.may_write(path):
+                # Folder mode: never a file outside a key folder, or one
+                # reached through a link (checked at the moment of the delete).
+                self.logger.warning(f"Not removing {path}: outside the thumbnails")
+                kept.append(path)
+                continue
             try:
                 os.remove(path)
             except FileNotFoundError:

py/api/thumbnail_encode.py

@@ -46,7 +46,7 @@ from pathlib import Path
 
 from PIL import Image
 
-from . import thumbnail_settings
+from . import preview_location, preview_store, thumbnail_settings
 
 try:
     from ...utils.logging_config import get_logger
@@ -101,14 +101,20 @@ def temp_sibling(dst, tag="part"):
 
 
 def replace_unless_held(tmp, dst, guard=None):
-    """Rename *tmp* over *dst*, unless ``guard()`` is false (PreviewWriteHeld)."""
-    if guard is not None and not guard():
-        raise PreviewWriteHeld(PREVIEW_HELD)
-    os.replace(tmp, dst)
+    """Rename *tmp* over *dst*, unless ``guard()`` is false (PreviewWriteHeld).
+
+    The check and the rename run under ``preview_store.write_lock`` (#320): a
+    guard from ``preview_store.write_guard`` also refuses a write that started
+    before the thumbnail location changed."""
+    with preview_store.committed(guard) as allowed:
+        if not allowed:
+            raise PreviewWriteHeld(PREVIEW_HELD)
+        os.replace(tmp, dst)
 
 
 # ``temp_sibling``'s names: ``.<stem>.<tag>-<pid>-<thread id><ext>``.
 _TEMP_NAME = re.compile(r"^\..+\.(?:part|src)-(\d+)-\d+\.[A-Za-z0-9]+$")
+_MOVE_TEMP_NAME = re.compile(r"\.pm-move-[0-9a-f]{8}\.tmp$")
 # A temp at least this old (seconds) outlived its write: no encode runs longer.
 STRAY_TEMP_AGE = 4 * ENCODE_TIMEOUT
 # When this process started (this module's import): a temp carrying its PID
@@ -120,7 +126,10 @@ def sweep_stray_temps(folder, min_age=None):
     """Remove the temp files a crashed write left under *folder* (a preview
     folder, walked without following links); returns ``(count, bytes)``.
 
-    Only ``temp_sibling`` names are touched, never a link. With *min_age*
+    Only ``temp_sibling`` names are touched, never a link: a folder that is a
+    link, junction or reparse point is not walked into (Windows walks into a
+    junction even without ``followlinks``), and each file passes
+    ``preview_store.may_write`` before it goes. With *min_age*
     (seconds, the startup sweep) a temp younger than that, or one this
     process wrote since it started (it may still be writing it), is left;
     ``min_age=0`` (the clear, which holds every preview write) removes them
@@ -130,19 +139,39 @@ def sweep_stray_temps(folder, min_age=None):
     now = time.time()
     own = str(os.getpid())
     count = size = 0
-    for root, _dirs, files in os.walk(folder):
+    try:
+        if preview_location.is_link_like(folder):
+            return count, size
+    except OSError as exc:
+        logger.debug(f"Not sweeping {folder}: {exc}")
+        return count, size
+    for root, dirs, files in os.walk(folder):
+        dirs[:] = [d for d in dirs if not _link_like(Path(root) / d)]
         for name in files:
             match = _TEMP_NAME.match(name)
-            if match is None:
+            # A move's copy temp (#320): ``<name>.pm-move-<8 hex>.tmp``.
+            move_temp = match is None and _MOVE_TEMP_NAME.search(name)
+            if match is None and not move_temp:
                 continue
             path = Path(root) / name
             try:
                 stat = path.lstat()
-                if path.is_symlink() or not path.is_file():
+                if (
+                    path.is_symlink()
+                    or not path.is_file()
+                    or _link_like(path)
+                    or not preview_store.may_write(path)
+                ):
                     continue
                 if min_age and (
                     now - stat.st_mtime < min_age
-                    or (match.group(1) == own and stat.st_mtime >= PROCESS_STARTED)
+                    or move_temp
+                    and stat.st_mtime >= PROCESS_STARTED
+                    or (
+                        match is not None
+                        and match.group(1) == own
+                        and stat.st_mtime >= PROCESS_STARTED
+                    )
                 ):
                     continue
                 path.unlink()
@@ -154,6 +183,14 @@ def sweep_stray_temps(folder, min_age=None):
     return count, size
 
 
+def _link_like(path):
+    """``is_link_like``, with a path that cannot be checked counted as one."""
+    try:
+        return preview_location.is_link_like(path)
+    except OSError:
+        return True
+
+
 def _unlink_quietly(path):
     try:
         Path(path).unlink()

py/api/thumbnail_jobs.py

@@ -49,6 +49,7 @@ from .images import (
     _worker_threads,
 )
 from .job_routes import busy_response
+from .thumbnail_location import location_refusal
 from .jobs import THUMBNAIL_GROUP_NAMES, THUMBNAILS_JOB_KIND, JobBusy
 from .thumbnail_convert import CONVERT_JOB_TITLE
 from .thumbnail_encode import writer_settings
@@ -131,7 +132,10 @@ class ThumbnailJobsMixin:
     """The thumbnail plan, the thumbnail job and the legacy stream on it."""
 
     async def get_thumbnail_plan(self, request):
-        """What a thumbnail run would do (read-only; capped like a run)."""
+        """What a thumbnail run would do (read-only; capped like a run).
+        ``mode=prune`` lists the removed sources' thumbnails (#320)."""
+        if request.query.get("mode") == "prune":
+            return await self.get_prune_plan()
         options, error = thumbnail_options(request.query, from_query=True)
         if error:
             return _invalid(error)
@@ -179,15 +183,39 @@ class ThumbnailJobsMixin:
                 )
             except (ValueError, UnicodeDecodeError):
                 return _invalid(_OPTIONS_ERROR)
+        if isinstance(body, dict) and body.get("mode") in ("move", "prune"):
+            return await self._start_location_job(body)
         options, error = thumbnail_options(body)
         if error:
             return _invalid(error)
+        refused = location_refusal()
+        if refused is not None:
+            return refused
         try:
             job = self._start_thumbnail_job(options)
         except JobBusy as busy:
             return busy_response(busy)
         return web.json_response({"success": True, "job": job.summary()}, status=202)
 
+    async def _start_location_job(self, body):
+        """Move thumbnails or Remove thumbnails of removed sources (#320)."""
+        if body["mode"] == "prune":
+            refused = location_refusal()
+            if refused is not None:
+                return refused
+        try:
+            if body["mode"] == "move":
+                started = self.start_thumbnail_move(body)
+            else:
+                started = self.start_thumbnail_prune()
+        except JobBusy as busy:
+            return busy_response(busy)
+        if isinstance(started, web.Response):
+            return started
+        return web.json_response(
+            {"success": True, "job": started.summary()}, status=202
+        )
+
     def _start_thumbnail_job(self, options):
         """Register the thumbnail job synchronously; raises JobBusy.
 
@@ -226,6 +254,7 @@ class ThumbnailJobsMixin:
             )
             state = "failed"
         job.finish(state)
+        await self._release_job_memory()
 
     async def _thumbnail_job_body(self, job, options):
         """Plan, then generate in worker batches; returns the final state.
@@ -458,8 +487,12 @@ class ThumbnailJobsMixin:
         or attaches to the running thumbnail job, and streams its frames. A
         legacy hold (the blocking generate or clear) or a record-changing
         job refuses it with the stream's error frame. The job goes on when
-        the client goes away.
+        the client goes away. Refused (409) while the thumbnail folder is
+        unavailable (#320).
         """
+        refused = location_refusal()
+        if refused is not None:
+            return refused
         response = web.StreamResponse(
             status=200,
             headers={
@@ -506,8 +539,12 @@ class ThumbnailJobsMixin:
         the way.
         """
         running = self._jobs.active(THUMBNAILS_JOB_KIND)
-        if running is not None and running.scope.get("mode") == "convert":
-            return None, False, running  # no legacy frames to follow (#317)
+        if running is not None and running.scope.get("mode") in (
+            "convert",
+            "move",
+            "prune",
+        ):
+            return None, False, running  # no legacy frames to follow (#317, #320)
         if running is not None and running.cancellable:
             return running, False, None
         busy = self._jobs.blocker(THUMBNAILS_JOB_KIND, admission="guarded")

py/api/thumbnail_location.py

@@ -0,0 +1,162 @@
+"""The thumbnail location on the API (#320): startup, the settings payload
+and the refusals while the thumbnail folder is unavailable.
+
+The setting itself is config.json ``thumbnails.location``
+(``preview_location``); the runtime state is ``preview_store``. POST
+``/settings`` never changes it (409 ``location-needs-move``): the Move
+thumbnails job is its only writer.
+"""
+
+import os
+
+from aiohttp import web
+
+from . import preview_location, preview_store
+
+try:
+    from ...utils import library_location
+except ImportError:  # tests import the package top-level
+    from utils import library_location
+
+# The node folder (its web/ is served and a reinstall wipes it).
+NODE_FOLDER = os.path.dirname(
+    os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+)
+
+
+def default_path():
+    """``<data folder>/data/thumbnails`` (D7B), or None when unknown."""
+    try:
+        return library_location.cache_dir("thumbnails")
+    except Exception:  # no data folder can be decided: no default
+        return None
+
+
+def location_refusal(location=None):
+    """The 409 ``location-unavailable`` response while the thumbnail folder
+    is unavailable, else None (thumbnail generate, convert, clear, prune)."""
+    location = location or preview_store.current()
+    if location.mode != preview_store.FOLDER_MODE or location.available:
+        return None
+    status, text = preview_location.message("location-unavailable")
+    return web.json_response(
+        {"success": False, "code": "location-unavailable", "error": text},
+        status=status,
+    )
+
+
+def needs_move_response():
+    status, text = preview_location.message("location-needs-move")
+    return web.json_response(
+        {"success": False, "code": "location-needs-move", "error": text},
+        status=status,
+    )
+
+
+class ThumbnailLocationMixin:
+    """Startup check and payloads of the thumbnail location."""
+
+    def _all_source_roots(self):
+        """Every image source of every root list: the Images roots, the
+        configured sources and the extra gallery roots (as strings)."""
+        from ..config import GalleryConfig, _extra_gallery_roots
+
+        roots = [str(root) for root in self._get_all_output_dirs()]
+        roots += [str(root) for root in GalleryConfig.MONITORING_DIRECTORIES]
+        roots += list(_extra_gallery_roots())
+        return tuple(dict.fromkeys(root for root in roots if root))
+
+    def _thumbnail_location_context(self):
+        """What a thumbnail folder is validated against (blocking)."""
+        contained = []
+        try:
+            import folder_paths
+
+            for name in (
+                "get_output_directory",
+                "get_input_directory",
+                "get_temp_directory",
+            ):
+                getter = getattr(folder_paths, name, None)
+                folder = getter() if getter is not None else None
+                if folder:
+                    contained.append(str(folder))
+        except ImportError:
+            pass  # folder_paths exists only inside ComfyUI (tests run without it)
+        try:
+            contained.append(library_location.config_location()[1])
+        except Exception:  # no data folder can be decided
+            self.logger.debug("No library folder for the thumbnail check")
+        setting = preview_store.setting()
+        return preview_location.Context(
+            roots=self._all_source_roots(),
+            contained=tuple(contained),
+            node_folder=NODE_FOLDER,
+            default_path=default_path(),
+            current_path=(
+                setting.path if setting.mode == preview_store.FOLDER_MODE else None
+            ),
+        )
+
+    def use_preview_location(self):
+        """Put the configured location in force at once, unchecked (the
+        package's import, before any request): folder mode is unavailable
+        until ``start_preview_location`` has checked it, so nothing is ever
+        written to the sources meanwhile. No filesystem access."""
+        from ..config import PromptManagerConfig
+
+        try:
+            return preview_store.configure(
+                PromptManagerConfig.THUMBNAIL_LOCATION, check=False
+            )
+        except Exception:
+            self.logger.warning("The thumbnail location is unusable", exc_info=True)
+            preview_store.mark_invalid()
+            return preview_store.current()
+
+    def start_preview_location(self):
+        """Parse and check the configured location once (startup thread);
+        the probe takes over. Never raises; a check that fails leaves a
+        folder location unavailable (``invalid``), never the sources."""
+        from ..config import PromptManagerConfig
+
+        try:
+            value = PromptManagerConfig.THUMBNAIL_LOCATION
+            parsed = preview_location.parse_location(value)
+            context = None
+            if parsed.mode == preview_store.FOLDER_MODE:
+                context = self._thumbnail_location_context()
+            location = preview_store.configure(value, context=context)
+        except Exception:
+            self.logger.warning("The thumbnail location check failed", exc_info=True)
+            if (
+                preview_location.parse_location(
+                    PromptManagerConfig.THUMBNAIL_LOCATION
+                ).mode
+                == preview_store.FOLDER_MODE
+            ):
+                preview_store.mark_invalid()
+            return preview_store.current()
+        if location.mode == preview_store.FOLDER_MODE and not location.available:
+            self.logger.warning(
+                "The thumbnail folder is unavailable "
+                f"({location.problem or 'checking'}): originals are shown and "
+                "no thumbnails are written until it is back"
+            )
+        return location
+
+    def _thumbnail_location_payload(self, *, with_path):
+        """``{mode, available, problem}`` plus, for the settings GET only,
+        ``path`` and ``default_path`` (D6A)."""
+        location = preview_store.current()
+        payload = {
+            "mode": location.mode,
+            "available": location.available,
+            "problem": location.problem,
+        }
+        if with_path:
+            payload["path"] = location.path
+            payload["default_path"] = default_path()
+            # Old copies a move still has to remove (#320 Part 3).
+            payload["cleanup_pending"] = len(preview_store.setting().cleanup)
+        return payload

py/api/thumbnail_move.py

@@ -0,0 +1,579 @@
+"""Move thumbnails (#320 Part 3): the reviewed job that changes where previews
+live, the removal of old copies after it, recovery at startup and the
+"Remove thumbnails of removed sources" scope (Part 5).
+
+Kind ``thumbnails`` with ``mode: "move"`` (D1A): admission ``guarded``, so
+scans, deletes, tagging, source changes and every other thumbnail job wait
+for it, while the monitor's Needs review recording runs beside it.
+Automatic previews are held for the whole job (D2A, ``_auto_thumbnail_blocker``).
+
+Phases: review (``POST /images/thumbnails/plan``, no writes but the
+validation probe), start (a plan token), hold (generation bump, journal,
+target folder), copy (cancellable at every file boundary, on the job pool
+in small chunks, D3A), switch (one config commit sets the location and
+records the old stores under ``cleanup``; not cancellable from here),
+remove old copies, end. Per-file errors switch anyway (D10A); a folder-wide
+error or a cancel before the switch removes what the job wrote and changes
+nothing. The move is the only writer of the setting (D4B).
+
+Moving away from a thumbnail folder also removes the previews of this
+install's sources that are no longer listed (Q320-8: remove).
+"""
+
+import functools
+import os
+import time
+from pathlib import Path
+
+from aiohttp import web
+
+from . import preview_location, preview_store
+from . import thumbnail_move_files as files
+from .jobs import THUMBNAILS_JOB_KIND
+from .thumbnail_move_plan import (
+    MOVE_GROUPS,
+    MOVE_TITLE,
+    PLAN_TTL,
+    _number,
+    _plural,
+    _remove,
+    _roots_revision,
+    _volume,
+    _is_network,
+    _write_json,
+)
+from . import thumbnail_move_plan as move_plan
+
+try:
+    from ...utils import exit_signal
+    from ...utils.parallel import map_parallel
+except ImportError:  # tests import the package top-level
+    from utils import exit_signal
+    from utils.parallel import map_parallel
+
+
+class ThumbnailMoveMixin:
+    """Start and run the move job; the removal of old copies."""
+
+    # ── start ─────────────────────────────────────────────────────────
+
+    def _take_move_plan(self, body):
+        """The plan a start names, or ``(status, code)``."""
+        token = body.get("token")
+        plan = (self._move_plans or {}).get(token) if isinstance(token, str) else None
+        if plan is None or time.monotonic() - plan.created > PLAN_TTL:
+            return 409, "plan-stale"
+        roots = [str(root) for root in self._get_all_output_dirs()]
+        if _roots_revision(roots) != plan.revision:
+            return 409, "plan-stale"
+        if preview_store.setting() != plan.old:
+            return 409, "plan-stale"
+        if plan.confirm_required and body.get("confirmed") is not True:
+            return 400, "confirmation-required"
+        return plan
+
+    def start_thumbnail_move(self, body):
+        """Start the move job (sync, on the loop); raises JobBusy. Returns
+        the job or a refusal response."""
+        if not self._move_recovered:
+            blocker = self._jobs.active(THUMBNAILS_JOB_KIND)
+            return web.json_response(
+                {
+                    "success": False,
+                    "code": "busy",
+                    "error": "Prompt Manager is still checking an earlier move. "
+                    "Try again in a moment.",
+                    "running": None if blocker is None else {"id": blocker.id},
+                },
+                status=409,
+            )
+        taken = self._take_move_plan(body)
+        if isinstance(taken, tuple):
+            status, code = taken
+            text = {
+                "plan-stale": "The review is out of date. Review the move again.",
+                "confirmation-required": "Confirm that Prompt Manager may "
+                "create its folders there.",
+            }[code]
+            return web.json_response(
+                {"success": False, "code": code, "error": text}, status=status
+            )
+        plan = taken
+        self._move_plans.pop(plan.token, None)
+        return self._jobs.start(
+            THUMBNAILS_JOB_KIND,
+            MOVE_TITLE,
+            admission="guarded",
+            cancellable=True,
+            scope={
+                "mode": "move",
+                "from": plan.old.mode,
+                "to": plan.target["mode"],
+                "to_path": plan.target["path"],
+            },
+            groups=MOVE_GROUPS,
+            runner=functools.partial(self._run_thumbnail_move, plan=plan),
+        )
+
+    # ── the job ───────────────────────────────────────────────────────
+
+    async def _run_thumbnail_move(self, job, *, plan):
+        state = {"written": [], "created": [], "created_folder": False}
+        try:
+            await self._run_in_executor(self._move_hold, job, plan, state)
+        except (OSError, ValueError) as error:
+            await self._run_in_executor(self._move_rollback, plan, state)
+            self._end_move(
+                job, "failed", "The new folder could not be made; nothing changed."
+            )
+            self.logger.warning(f"Move thumbnails could not start: {error}")
+            return
+        left = [
+            {
+                "path": "/".join(item),
+                "root": s.label,
+                "detail": "Not a thumbnail; left in place",
+            }
+            for s in plan.sources
+            if s.scan is not None
+            for item in s.scan.left
+        ]
+        if left:
+            job.record_counted("left", len(left), left)
+        items = [
+            (source, item)
+            for source in plan.sources
+            if source.scan is not None
+            for item in source.scan.copy
+        ]
+        total = len(items)
+        job.update(total=total, processed=0, progress=0)
+        chunk = await self._run_in_executor(self._move_chunk, plan)
+        workers = self._move_workers()
+        done = 0
+        for start in range(0, total, chunk):
+            if job.cancelled:
+                await self._move_cancelled(job, plan, state)
+                return
+            batch = items[start : start + chunk]
+            try:
+                results = await self._run_in_executor(
+                    map_parallel,
+                    functools.partial(self._move_copy_one, state=state),
+                    batch,
+                    workers,
+                )
+            except exit_signal.ExitRequested:
+                return  # exiting: the next start undoes the copies (journal)
+            except files.FolderGone as error:
+                self.logger.warning(f"Move thumbnails stopped: {error}")
+                await self._run_in_executor(self._move_rollback, plan, state)
+                self._end_move(
+                    job,
+                    "failed",
+                    "The new folder could not be reached or is full; nothing changed.",
+                )
+                return
+            except Exception:
+                # Anything else before the switch: undo, never half a move.
+                self.logger.exception("Move thumbnails failed while copying")
+                await self._run_in_executor(self._move_rollback, plan, state)
+                self._end_move(job, "failed", "The copy failed; nothing changed.")
+                return
+            for (source, item), (outcome, detail) in zip(batch, results):
+                row = {
+                    "path": "/".join(item[0]),
+                    "root": source.label,
+                    "detail": detail,
+                }
+                job.record(
+                    "moved" if outcome == "moved" else outcome,
+                    row,
+                    f"{outcome}: {source.label} · {'/'.join(item[0])}",
+                )
+            done += len(batch)
+            label = batch[-1][0].label
+            job.update(
+                processed=done,
+                progress=int(done * 90 / total) if total else 90,
+                status_line=(
+                    f"Copying {_number(done)} of {_number(total)} previews · {label}"
+                ),
+            )
+            job.publish({"type": "progress", "summary": job.summary()})
+        if job.cancelled:
+            await self._move_cancelled(job, plan, state)
+            return
+        # The switch: not cancellable from here (an exit still stops between
+        # files and leaves the cleanup to the next start).
+        job.cancellable = False
+        job.update(status_line="Switching to the new location", progress=92)
+        job.publish({"type": "progress", "summary": job.summary()})
+        try:
+            await self._run_in_executor(self._move_switch, plan)
+        except Exception:
+            self.logger.exception("Move thumbnails could not switch")
+            await self._run_in_executor(self._move_rollback, plan, state)
+            self._end_move(
+                job, "failed", "The setting could not be saved; nothing changed."
+            )
+            return
+        await self._remove_old_copies(job, plan)
+        moved = job.counters.get("moved", 0) + job.counters.get("skipped", 0)
+        errors = job.counters.get("errors", 0)
+        where = plan.target["path"] or "inside each source"
+        parts = [f"{_number(moved)} moved"]
+        if errors:
+            parts.append(_plural(errors, "error"))
+        parts.append(
+            "old copies removed"
+            if not job.scope.get("cleanup_left")
+            else "some old copies are removed at the next start"
+        )
+        self._end_move(
+            job, "finished", f"Thumbnails moved to {where}: " + " · ".join(parts) + "."
+        )
+
+    def _end_move(self, job, state, line):
+        job.update(status_line=line, progress=100)
+        job.log_line(line)
+        job.publish({"type": "complete", "summary": job.summary()})
+        job.finish(state)
+
+    def _move_workers(self):
+        from .images import _worker_threads
+
+        return max(1, int(_worker_threads() or 1))
+
+    def _move_chunk(self, plan):
+        """2 files at a time across volumes or to/from a share, else 4, never
+        more than Worker threads (D3A: the pool keeps its size)."""
+        sides = [plan.target["path"] or ""] + [s.old_store or "" for s in plan.sources]
+        sides += [s.new_store for s in plan.sources]
+        network = any(_is_network(side) for side in sides if side)
+        volumes = {_volume(side) for side in sides if side}
+        size = 2 if network or len(volumes) > 1 else 4
+        return max(1, min(size, self._move_workers()))
+
+    def _move_hold(self, job, plan, state):
+        """Phase 3: bump the generation, write the journal, make the target."""
+        preview_store.bump_generation()
+        if plan.to_folder:
+            folder = plan.target["path"]
+            if not os.path.isdir(folder):
+                if plan.target_default:
+                    os.makedirs(folder, exist_ok=True)
+                else:
+                    os.mkdir(folder)
+                state["created_folder"] = True
+            plan.target_id = preview_location.init_folder(
+                folder, created_by_pm=state["created_folder"]
+            )
+            install = plan.install
+
+            def add_keys(marker):
+                for source in plan.sources:
+                    if source.key and source.key not in marker["keys"]:
+                        marker["keys"][source.key] = {
+                            "path": source.root,
+                            "identity": os.path.normcase(os.path.realpath(source.root)),
+                            "dev_ino": preview_location.file_identity(source.root),
+                            "install": install,
+                        }
+
+            with preview_store.write_lock:
+                preview_location.write_marker(folder, add_keys)
+        _write_json(
+            move_plan.journal_path(),
+            {
+                "state": "copying",
+                "from": plan.old.to_config(),
+                "to": plan.target,
+                "stores": [s.new_store for s in plan.sources],
+                # Stores that do not exist yet are made by this job only:
+                # after a crash everything in them goes (B4).
+                "created_dirs": [
+                    s.new_store for s in plan.sources if not os.path.isdir(s.new_store)
+                ],
+                "created_folder": state["created_folder"],
+                "install": plan.install,
+            },
+        )
+        job.log_line(
+            f"Move thumbnails started: {plan.old.path or 'inside each source'} → "
+            f"{plan.target['path'] or 'inside each source'}"
+        )
+
+    def _move_copy_one(self, pair, *, state):
+        """Copy one preview (a pool thread); ``(group, detail)``."""
+        source, (relative, size, mtime_ns) = pair
+        destination = Path(source.new_store).joinpath(*relative)
+        try:
+            if not os.path.isdir(destination.parent):
+                base = Path(source.new_store)
+                if not base.is_dir():
+                    if plan_parent_missing(base):
+                        raise files.FolderGone("the new folder is gone")
+                    created = []
+                    files._make_folders(base.parent, (base.name,), created)
+                    state["created"].extend(created)
+                created = []
+                files._make_folders(base, relative[:-1], created)
+                state["created"].extend(created)
+            # Also when the folders already exist (Codex P1 on #592).
+            files.refuse_links(source.new_store, relative[:-1])
+            outcome = files.copy_one(
+                Path(source.old_store).joinpath(*relative),
+                destination,
+                size,
+                mtime_ns,
+                state["created"],
+            )
+        except files.CopyFailed as error:
+            return "errors", str(error)
+        if outcome == "moved":
+            state["written"].append(str(destination))
+            return "moved", "Copied and checked"
+        return "skipped", "Already there"
+
+    async def _move_cancelled(self, job, plan, state):
+        if exit_signal.requested():
+            return  # the next start removes the partial copies (journal)
+        await self._run_in_executor(self._move_rollback, plan, state)
+        self._end_move(job, "cancelled", "Move cancelled: nothing changed.")
+
+    def _move_rollback(self, plan, state):
+        """Remove what this job wrote (files, folders it made, a folder and
+        marker it created) and the journal: nothing changed."""
+        for path in state["written"]:
+            files.remove_file(path)
+        for folder in reversed(state["created"]):
+            files.remove_empty_folders(folder)
+        if plan.to_folder and state.get("created_folder"):
+            folder = plan.target["path"]
+            try:
+                names = os.listdir(folder)
+            except OSError:
+                names = None
+            if names is not None and set(names) <= {preview_location.MARKER_NAME}:
+                _remove(preview_location.marker_path(folder))
+                files.remove_empty_folders(folder)
+        _remove(move_plan.journal_path())
+
+    def _move_switch(self, plan):
+        """Phase 5: one config commit sets the location and records the old
+        stores under ``cleanup``; the runtime follows under the write lock."""
+        from ..config import PromptManagerConfig
+        from ..config_store import get_config_store
+
+        entry = {
+            "from": plan.old.mode,
+            "folder": plan.old.path if plan.from_folder else None,
+            "stores": [s.old_store for s in plan.sources if s.old_store],
+            "drop_keys": self._old_keys_to_drop(plan),
+            "install": plan.install,
+        }
+        # An older entry never removes a store the move just filled (a move
+        # back while old copies still waited).
+        filled = {os.path.normcase(s.new_store) for s in plan.sources}
+        cleanup = []
+        for old_entry in plan.old.cleanup:
+            stores = [
+                store
+                for store in old_entry.get("stores") or []
+                if isinstance(store, str) and os.path.normcase(store) not in filled
+            ]
+            folder = old_entry.get("folder")
+            drop = [
+                key
+                for key in old_entry.get("drop_keys") or []
+                if not folder
+                or os.path.normcase(os.path.join(folder, key)) not in filled
+            ]
+            cleanup.append({**old_entry, "stores": stores, "drop_keys": drop})
+        cleanup.append(entry)
+        if plan.to_folder:
+            value = {
+                "mode": preview_store.FOLDER_MODE,
+                "path": plan.target["path"],
+                "id": plan.target_id,
+                "install": plan.install,
+                "cleanup": cleanup,
+            }
+        else:
+            value = {
+                "mode": preview_store.SOURCE_MODE,
+                "install": plan.install,
+                "cleanup": cleanup,
+            }
+
+        def mutate(config):
+            section = config.get("thumbnails")
+            if not isinstance(section, dict):
+                section = {}
+            section["location"] = value
+            config["thumbnails"] = section
+            return config
+
+        def publish(_config):
+            PromptManagerConfig.THUMBNAIL_LOCATION = value
+            preview_store.configure(value, check=False)
+
+        get_config_store().commit(mutate, expected_revision=None, publish=publish)
+        # The switch is made: what follows never undoes it.
+        try:
+            preview_store.refresh()
+            _remove(move_plan.journal_path())
+        except OSError as error:
+            self.logger.warning(
+                f"The thumbnail move journal stays until the next start: {error}"
+            )
+
+    def _old_keys_to_drop(self, plan):
+        if not plan.from_folder:
+            return []
+        keys = [s.old_store and os.path.basename(s.old_store) for s in plan.sources]
+        keys = [key for key in keys if key]
+        if plan.to_folder and os.path.normcase(plan.old.path or "") == os.path.normcase(
+            plan.target["path"] or ""
+        ):
+            return []
+        return keys + [key for key, _store, _scan in plan.unlisted]
+
+    async def _remove_old_copies(self, job, plan):
+        """Phase 6: run the cleanup the switch recorded (and earlier ones)."""
+        job.update(status_line="Removing old copies", progress=95)
+        job.publish({"type": "progress", "summary": job.summary()})
+        left = await self._run_in_executor(self._run_cleanup, job)
+        if left:
+            job.scope["cleanup_left"] = True
+
+    def _run_cleanup(self, job=None):
+        """Remove every recorded old store's previews, temps and empty
+        folders; keep in ``cleanup`` what could not go. Returns how many
+        entries are left (blocking)."""
+        setting = preview_store.setting()
+        remaining = []
+        for entry in setting.cleanup:
+            if not self._cleanup_entry(entry, job):
+                remaining.append(entry)
+        if list(setting.cleanup) != remaining:
+            self._commit_cleanup(remaining)
+        return len(remaining)
+
+    def _cleanup_entry(self, entry, job):
+        """One recorded removal; True when it is complete."""
+        folder = entry.get("folder")
+        stores = [
+            store for store in entry.get("stores") or [] if isinstance(store, str)
+        ]
+        if folder:
+            if not os.path.isdir(folder):
+                return False  # the old folder is not reachable: kept for later
+            folder_marker = preview_location.read_marker(folder) or {}
+            keys = folder_marker.get("keys") or {}
+            stores += [
+                os.path.join(folder, key)
+                for key in entry.get("drop_keys") or []
+                if preview_location.valid_key(key) and key in keys
+            ]
+        complete = True
+        for store in dict.fromkeys(stores):
+            if not self._remove_store(store, folder, job):
+                complete = False
+        if folder and complete:
+            drop = set(entry.get("drop_keys") or [])
+
+            def forget(marker):
+                for key in drop:
+                    marker["keys"].pop(key, None)
+
+            try:
+                with preview_store.write_lock:
+                    marker = preview_location.write_marker(folder, forget)
+            except (OSError, ValueError):
+                return False
+            if not marker["keys"] and marker.get("created_by_pm"):
+                names = set(os.listdir(folder))
+                rest = {n for n in names if not files.is_os_metadata(n)}
+                if rest <= {preview_location.MARKER_NAME}:
+                    _remove(preview_location.marker_path(folder))
+                    files.remove_empty_folders(folder)
+        return complete
+
+    def _remove_store(self, store, folder, job):
+        """Remove the previews and temps of one old store; True when done."""
+        store = Path(store)
+        if folder:
+            # A key folder directly in the old thumbnail folder, nothing else.
+            if not preview_location.valid_key(store.name) or os.path.normcase(
+                str(store.parent)
+            ) != os.path.normcase(str(folder)):
+                return True
+        elif store.name != "thumbnails":
+            return True  # a hand-edited entry never names another folder
+        if not store.exists():
+            return True
+        if preview_location.is_link_like(store):
+            return True  # never through a link; nothing of ours there
+        complete = True
+        removed = 0
+        for current, dirs, names in os.walk(store):
+            dirs[:] = [
+                d for d in dirs if not preview_location.is_link_like(Path(current) / d)
+            ]
+            for name in names:
+                path = Path(current) / name
+                if files.is_temp_name(name) or files._preview_parts(name):
+                    if preview_location.is_link_like(path):
+                        continue
+                    if exit_signal.requested():
+                        return False  # exiting: the next start finishes it
+                    if files.remove_file(path):
+                        removed += 1
+                    else:
+                        complete = False
+                        relative = path.relative_to(store).as_posix()
+                        self.logger.warning(
+                            f"Could not remove the old thumbnail {path}; it is "
+                            "removed at the next start"
+                        )
+                        if job is not None:
+                            # D10A: a removal that failed is an error the job lists.
+                            job.record(
+                                "errors",
+                                {
+                                    "path": relative,
+                                    "root": store.name,
+                                    "detail": "In use by another program; removed "
+                                    "at the next start",
+                                },
+                                f"In use by another program; removed at the next "
+                                f"start: {store.name}/{relative}",
+                            )
+        files.remove_empty_folders(store)
+        if job is not None and removed:
+            job.log_line(f"Removed {_number(removed)} old files from {store.name}")
+        return complete
+
+    def _commit_cleanup(self, remaining):
+        from ..config import PromptManagerConfig
+        from ..config_store import get_config_store
+
+        def mutate(config):
+            section = config.get("thumbnails")
+            if isinstance(section, dict) and isinstance(section.get("location"), dict):
+                section["location"]["cleanup"] = remaining
+            return config
+
+        def publish(config):
+            value = (config.get("thumbnails") or {}).get("location")
+            PromptManagerConfig.THUMBNAIL_LOCATION = value
+            preview_store.set_cleanup(remaining)
+
+        get_config_store().commit(mutate, expected_revision=None, publish=publish)
+
+
+def plan_parent_missing(store):
+    """A key folder's parent (the thumbnail folder) is gone mid-copy."""
+    return not Path(store).parent.is_dir()

py/api/thumbnail_move_files.py

@@ -0,0 +1,348 @@
+"""The file side of Move thumbnails (#320 Part 3): what is copied, how a
+copy is made and checked, and how old copies are removed.
+
+No job, HTTP or config code lives here; ``thumbnail_move`` drives it.
+
+Copy set (B5): each old store is walked with ``os.scandir``, never through a
+symlink, junction or reparse point (counted as "skipped link"). A regular
+file is
+
+- copied when it has the preview grammar (``<name>_thumb<ext>``, any written
+  or legacy extension) and its original still exists in the source;
+- removed with the old copies, not copied, when it is an orphan (no
+  original), lies under a trash folder, or is a temp sibling of a write
+  (``.<stem>.part-…``) or of a move (``….pm-move-<8 hex>.tmp``);
+- left in place otherwise ("Left in place"). OS metadata files (``Thumbs.db``,
+  ``desktop.ini``, ``.DS_Store``, ``._*``) are removed only when they alone
+  keep a preview folder from being removed.
+
+A copy goes to ``<name>.pm-move-<8 hex>.tmp`` beside its destination, its
+size is compared, its mtime is set to the source preview's rounded up to the
+next 2-second step (FAT/exFAT keep it fresh, a stale preview stays stale),
+then it is renamed into place. Every handle is closed before a rename or an
+unlink (Windows).
+"""
+
+import errno
+import logging
+import os
+import re
+import secrets
+import shutil
+import stat as stat_module
+import time
+from dataclasses import dataclass, field
+from pathlib import Path
+
+from . import preview_location, thumbnail_settings
+from .thumbnail_encode import _TEMP_NAME
+
+try:
+    from ...utils.media_folders import in_trash_folder
+except ImportError:  # tests import the package top-level
+    from utils.media_folders import in_trash_folder
+
+logger = logging.getLogger("prompt_manager.thumbnails")
+
+MOVE_TEMP = re.compile(r"\.pm-move-[0-9a-f]{8}\.tmp$")
+MOVE_TEMP_SUFFIX = ".pm-move-{token}.tmp"
+# The temp name adds this much to a destination path (".pm-move-xxxxxxxx.tmp").
+TEMP_EXTRA = 21
+WINDOWS_FILE_LIMIT = 259
+MTIME_STEP_NS = 2_000_000_000
+# A file another program holds open (Windows) is retried this often.
+REMOVE_RETRIES = (0.5, 1.0, 2.0)
+_WINDOWS_IN_USE = {32, 33}  # ERROR_SHARING_VIOLATION, ERROR_LOCK_VIOLATION
+
+
+def is_os_metadata(name):
+    folded = name.lower()
+    return folded in preview_location.OS_METADATA or folded.startswith("._")
+
+
+def is_temp_name(name):
+    return bool(_TEMP_NAME.match(name) or MOVE_TEMP.search(name))
+
+
+def _preview_parts(name):
+    """``(base, extension)`` of a preview file name, or None."""
+    stem, extension = os.path.splitext(name)
+    suffix = thumbnail_settings.THUMB_SUFFIX
+    if not stem.endswith(suffix) or len(stem) <= len(suffix):
+        return None
+    if extension.lower() not in thumbnail_settings.THUMBNAIL_EXTENSIONS:
+        return None
+    return stem[: -len(suffix)], extension
+
+
+def _has_original(root, rel_dir, base, extension):
+    """Whether a media file in ``<root>/<rel_dir>`` owns this preview."""
+    folder = Path(root).joinpath(*rel_dir)
+    try:
+        with os.scandir(folder) as entries:
+            for entry in entries:
+                stem, source_ext = os.path.splitext(entry.name)
+                if stem != base or not source_ext:
+                    continue
+                if not thumbnail_settings.owns(extension, source_ext):
+                    continue
+                if entry.is_file(follow_symlinks=False):
+                    return True
+    except OSError:
+        return False
+    return False
+
+
+@dataclass
+class StoreScan:
+    """One old store's files, sorted into what the move does with them."""
+
+    store: Path
+    copy: list = field(default_factory=list)  # (relative parts, size, mtime_ns)
+    orphans: list = field(default_factory=list)  # relative parts
+    temps: list = field(default_factory=list)
+    left: list = field(default_factory=list)
+    links: int = 0
+    bytes: int = 0
+
+    @property
+    def removable(self):
+        return [item[0] for item in self.copy] + self.orphans + self.temps
+
+
+def scan_store(store, root, *, stop=None):
+    """Sort the files of *store* (the previews of the source *root*).
+
+    A store that does not exist, or is itself a link, scans empty (a link
+    counts once).
+    """
+    store = Path(store)
+    scan = StoreScan(store)
+    try:
+        if preview_location.is_link_like(store):
+            scan.links += 1
+            return scan
+        if not store.is_dir():
+            return scan
+    except OSError:
+        return scan
+    _walk(scan, store, (), root, stop)
+    return scan
+
+
+def _walk(scan, folder, rel_dir, root, stop):
+    try:
+        with os.scandir(folder) as iterator:
+            entries = list(iterator)
+    except OSError:
+        return
+    for entry in entries:
+        if stop is not None and stop():
+            return
+        relative = rel_dir + (entry.name,)
+        path = Path(entry.path)
+        try:
+            if preview_location.is_link_like(path):
+                scan.links += 1
+                continue
+            info = entry.stat(follow_symlinks=False)
+        except OSError:
+            continue
+        if stat_module.S_ISDIR(info.st_mode):
+            _walk(scan, path, relative, root, stop)
+            continue
+        if not stat_module.S_ISREG(info.st_mode):
+            scan.left.append(relative)
+            continue
+        if is_temp_name(entry.name):
+            scan.temps.append(relative)
+            continue
+        if is_os_metadata(entry.name):
+            continue  # removed only when it alone keeps a folder (rmdir)
+        parts = _preview_parts(entry.name)
+        if parts is None:
+            scan.left.append(relative)
+            continue
+        if in_trash_folder("/".join(relative)) or not _has_original(
+            root, rel_dir, *parts
+        ):
+            scan.orphans.append(relative)
+            continue
+        scan.copy.append((relative, info.st_size, info.st_mtime_ns))
+        scan.bytes += info.st_size
+
+
+# ── copying ──────────────────────────────────────────────────────────
+
+
+def rounded_mtime_ns(mtime_ns):
+    """*mtime_ns* rounded up to the next 2-second step (FAT/exFAT)."""
+    return -(-mtime_ns // MTIME_STEP_NS) * MTIME_STEP_NS
+
+
+def too_long(path, long_paths=None):
+    """A destination (with its temp name) over Windows' file limit."""
+    if os.name != "nt" and long_paths is not False:
+        return False
+    if long_paths is None:
+        long_paths = preview_location.long_paths_enabled()
+    if long_paths:
+        return False
+    return len(str(path)) + TEMP_EXTRA > WINDOWS_FILE_LIMIT
+
+
+class CopyFailed(Exception):
+    """One preview could not be copied (a per-file error, D10A)."""
+
+
+class FolderGone(Exception):
+    """The destination cannot take writes any more (abort the move)."""
+
+
+def _make_folders(base, relative_dir, created):
+    """Make ``base/relative_dir`` one folder at a time (*base* must exist);
+    every folder made is added to *created*."""
+    current = Path(base)
+    for part in relative_dir:
+        current = current / part
+        try:
+            os.mkdir(current)
+            created.append(str(current))
+        except FileExistsError:
+            pass  # already there: made by an earlier copy into this folder
+        except OSError as error:
+            if error.errno in (errno.ENOSPC, errno.EDQUOT, errno.EROFS):
+                raise FolderGone(str(error)) from error
+            raise CopyFailed(
+                "Its folder could not be made; made again on view"
+            ) from error
+        if preview_location.is_link_like(current):
+            raise CopyFailed("a link in the destination")
+
+
+def refuse_links(base, relative_dir):
+    """Raise CopyFailed when *base* or an existing folder on the way to
+    ``base/relative_dir`` is a link (never copy through one)."""
+    current = Path(base)
+    for part in (None, *relative_dir):
+        if part is not None:
+            current = current / part
+        if preview_location.is_link_like(current):
+            raise CopyFailed("a link in the destination")
+
+
+def copy_one(source, destination, size, mtime_ns, created, *, long_paths=None):
+    """Copy one preview; returns ``"moved"`` or ``"skipped"`` (already
+    there). Raises CopyFailed (this file) or FolderGone (the destination)."""
+    destination = Path(destination)
+    if too_long(destination, long_paths):
+        raise CopyFailed("Path too long for Windows; the original is shown")
+    wanted = rounded_mtime_ns(mtime_ns)
+    try:
+        existing = os.stat(destination, follow_symlinks=False)
+    except FileNotFoundError:
+        existing = None
+    except OSError as error:
+        raise FolderGone(str(error)) from error
+    if (
+        existing is not None
+        and stat_module.S_ISREG(existing.st_mode)
+        and existing.st_size == size
+        and existing.st_mtime_ns == wanted
+    ):
+        return "skipped"
+    temp = destination.with_name(
+        destination.name + MOVE_TEMP_SUFFIX.format(token=secrets.token_hex(4))
+    )
+    try:
+        shutil.copyfile(source, temp)
+        if os.stat(temp).st_size != size:
+            raise CopyFailed("The copy did not match; made again on view")
+        os.utime(temp, ns=(wanted, wanted))
+        os.replace(temp, destination)
+    except CopyFailed:
+        _unlink(temp)
+        raise
+    except FileNotFoundError as error:
+        _unlink(temp)
+        if not Path(source).exists():
+            raise CopyFailed("Could not be read; made again on view") from error
+        raise FolderGone(str(error)) from error
+    except OSError as error:
+        _unlink(temp)
+        if error.errno in (errno.ENOSPC, errno.EDQUOT, errno.EROFS):
+            raise FolderGone(str(error)) from error
+        raise CopyFailed("Could not be copied; made again on view") from error
+    return "moved"
+
+
+def _unlink(path):
+    """Remove a copy's temp file after a failed copy; True when it is gone.
+
+    One that cannot go (a Windows lock, permissions) is logged with its path;
+    the next start's temp sweep removes it (``.pm-move-*.tmp``)."""
+    try:
+        os.unlink(path)
+        return True
+    except FileNotFoundError:
+        return True  # never written, or already renamed into place
+    except OSError as error:
+        logger.warning(f"Could not remove the move's temp file {path}: {error}")
+        return False
+
+
+# ── removing ─────────────────────────────────────────────────────────
+
+
+def _in_use(error):
+    return getattr(error, "winerror", None) in _WINDOWS_IN_USE
+
+
+def remove_file(path, *, sleep=time.sleep):
+    """Remove one file; a file another program holds open (Windows) is
+    retried 3 times. Returns True when it is gone."""
+    for wait in (0.0,) + REMOVE_RETRIES:
+        if wait:
+            sleep(wait)
+        try:
+            os.unlink(path)
+            return True
+        except FileNotFoundError:
+            return True
+        except OSError as error:
+            if not _in_use(error):
+                return False
+    return False
+
+
+def remove_empty_folders(top, *, keep_top=False):
+    """``rmdir`` the empty folders below *top* (and *top*), bottom-up, never
+    through a link. A folder holding only OS metadata files loses them first.
+    Returns the folders that could not be removed."""
+    top = Path(top)
+    left = []
+    if not top.is_dir() or preview_location.is_link_like(top):
+        return left
+    # Top-down, pruning every link, junction or reparse point, then bottom-up:
+    # never into a folder outside *top* (Windows junctions included).
+    folders = []
+    for folder, dirs, _files in os.walk(top):
+        folder = Path(folder)
+        dirs[:] = [d for d in dirs if not preview_location.is_link_like(folder / d)]
+        folders.append(folder)
+    for folder in reversed(folders):
+        if folder == top and keep_top:
+            continue
+        try:
+            names = os.listdir(folder)
+        except OSError:
+            left.append(folder)
+            continue
+        if names and all(is_os_metadata(name) for name in names):
+            for name in names:
+                remove_file(folder / name)
+        try:
+            os.rmdir(folder)
+        except OSError:
+            left.append(folder)
+    return left

py/api/thumbnail_move_plan.py

@@ -0,0 +1,492 @@
+"""Move thumbnails, the review (#320 Part 3 phase 1): what a move would copy,
+remove and leave, checked before anything is written."""
+
+import hashlib
+import json
+import os
+import secrets
+import shutil
+import time
+import uuid
+from dataclasses import dataclass, field
+from pathlib import Path
+
+from aiohttp import web
+
+from . import preview_location, preview_store
+from . import thumbnail_move_files as files
+from .job_routes import busy_response
+from .jobs import THUMBNAILS_JOB_KIND, JobBusy
+from .thumbnail_location import default_path
+
+try:
+    from ...utils import library_location
+except ImportError:  # tests import the package top-level
+    from utils import library_location
+
+MOVE_TITLE = "Move thumbnails"
+FINISHING_TITLE = "Move thumbnails (finishing)"
+PRUNE_TITLE = "Remove thumbnails of removed sources"
+MOVE_GROUPS = ("moved", "skipped", "left", "errors")
+PRUNE_GROUPS = ("removed", "left", "errors")
+PLAN_TTL = 600.0
+JOURNAL_NAME = "thumbnail-move.json"
+SPACE_MARGIN = 64 * 2**20
+SPACE_SHARE = 0.05
+LISTED = 5
+SENTENCE = (
+    "Every thumbnail is copied and checked before Prompt Manager switches. "
+    "Scans, deletes and tagging wait until it finishes; closing this page does "
+    "not stop it."
+)
+
+
+def _number(value):
+    return f"{value:,}"
+
+
+def _plural(count, one, many=None):
+    return f"{_number(count)} {one if count == 1 else (many or one + 's')}"
+
+
+def _size(value):
+    size = float(value)
+    for unit in ("B", "KB", "MB", "GB"):
+        if size < 1024 or unit == "GB":
+            return f"{size:.1f} {unit}" if unit != "B" else f"{int(size)} B"
+        size /= 1024
+    return f"{size:.1f} GB"
+
+
+def _refusal(code, status=None, **extra):
+    known_status, text = preview_location.MESSAGES.get(code, (400, code))
+    return web.json_response(
+        {"success": False, "code": code, "error": text, **extra},
+        status=status or known_status,
+    )
+
+
+def journal_path():
+    """``<data folder>/data/thumbnail-move.json`` (only while a move copies)."""
+    return library_location.cache_dir(JOURNAL_NAME)
+
+
+def _read_json(path):
+    try:
+        with open(path, "r", encoding="utf-8") as handle:
+            data = json.load(handle)
+    except (OSError, ValueError):
+        return None
+    return data if isinstance(data, dict) else None
+
+
+def _write_json(path, data):
+    os.makedirs(os.path.dirname(path), exist_ok=True)
+    temp = f"{path}.{os.getpid()}.tmp"
+    with open(temp, "w", encoding="utf-8") as handle:
+        json.dump(data, handle, indent=2)
+        handle.flush()
+        os.fsync(handle.fileno())
+    os.replace(temp, path)
+
+
+def _remove(path):
+    try:
+        os.unlink(path)
+    except FileNotFoundError:
+        pass  # already gone: removing it is the goal
+
+
+def _is_network(path):
+    text = str(path)
+    if text.startswith(("\\\\", "//")):
+        return True
+    if os.name == "nt":
+        try:
+            import ctypes
+
+            drive = os.path.splitdrive(os.path.abspath(text))[0] + "\\"
+            return ctypes.windll.kernel32.GetDriveTypeW(drive) == 4  # DRIVE_REMOTE
+        except (AttributeError, OSError):
+            return False
+    return False
+
+
+def _volume(path):
+    current = Path(os.path.abspath(path))
+    while not current.exists() and current.parent != current:
+        current = current.parent
+    try:
+        return os.stat(current).st_dev
+    except OSError:
+        return None
+
+
+def _free(path):
+    current = Path(os.path.abspath(path))
+    while not current.exists() and current.parent != current:
+        current = current.parent
+    try:
+        return shutil.disk_usage(current).free
+    except OSError:
+        return None
+
+
+# ── the plan ─────────────────────────────────────────────────────────
+
+
+@dataclass
+class SourcePlan:
+    """One listed source: its old store, its new store and what moves."""
+
+    root: str
+    label: str
+    key: str | None
+    old_store: str | None
+    new_store: str
+    scan: files.StoreScan | None
+    available: bool = True
+    too_long: list = field(default_factory=list)
+
+
+@dataclass
+class MovePlan:
+    """A reviewed move: from, to, the sources and the removals."""
+
+    token: str
+    created: float
+    revision: str
+    old: preview_location.ParsedLocation
+    target: dict  # {"mode", "path"}
+    target_id: str | None
+    target_exists: bool
+    target_default: bool
+    install: str
+    sources: list
+    unlisted: list  # (key, store path, scan)
+    needs_bytes: int
+    confirm_required: bool
+
+    @property
+    def to_folder(self):
+        return self.target["mode"] == preview_store.FOLDER_MODE
+
+    @property
+    def from_folder(self):
+        return self.old.mode == preview_store.FOLDER_MODE
+
+
+def _roots_revision(roots):
+    text = json.dumps(sorted(str(root) for root in roots))
+    return hashlib.sha256(text.encode("utf-8")).hexdigest()[:16]
+
+
+class ThumbnailMovePlanMixin:
+    """The move's review and its routes."""
+
+    _move_plans = None
+
+    # ── routes ────────────────────────────────────────────────────────
+
+    def _register_thumbnail_move_routes(self, routes):
+        @routes.post("/prompt_manager/images/thumbnails/plan")
+        async def thumbnail_move_plan_route(request):
+            return await self.plan_thumbnail_move(request)
+
+        @routes.post("/prompt_manager/images/thumbnails/location/recreate")
+        async def thumbnail_location_recreate_route(request):
+            return await self.recreate_thumbnail_folder(request)
+
+        @routes.post("/prompt_manager/images/thumbnails/location/adopt")
+        async def thumbnail_location_adopt_route(request):
+            return await self.adopt_thumbnail_folder(request)
+
+    # ── review ────────────────────────────────────────────────────────
+
+    async def plan_thumbnail_move(self, request):
+        try:
+            body = await request.json()
+        except (ValueError, UnicodeDecodeError):
+            body = None
+        if not isinstance(body, dict) or body.get("mode") != "move":
+            return web.json_response(
+                {
+                    "success": False,
+                    "code": "invalid-request",
+                    "error": "mode must be move",
+                },
+                status=400,
+            )
+        target = body.get("location")
+        if not isinstance(target, dict) or target.get("mode") not in (
+            preview_store.SOURCE_MODE,
+            preview_store.FOLDER_MODE,
+        ):
+            return web.json_response(
+                {
+                    "success": False,
+                    "code": "invalid-request",
+                    "error": "location must name a mode",
+                },
+                status=400,
+            )
+        blocker = self._jobs.blocker(THUMBNAILS_JOB_KIND, admission="guarded")
+        if blocker is not None:
+            return busy_response(JobBusy(blocker))
+        try:
+            outcome = await self._run_in_executor(self._build_move_plan, target)
+        except Exception:
+            self.logger.exception("The thumbnail move could not be planned")
+            return web.json_response(
+                {
+                    "success": False,
+                    "code": None,
+                    "error": "The move could not be planned",
+                },
+                status=500,
+            )
+        if isinstance(outcome, str):
+            return _refusal(outcome)
+        plan, payload = outcome
+        if payload.get("insufficient"):
+            return _refusal(
+                "insufficient-space",
+                status=507,
+                error_detail=payload["insufficient"],
+                plan=payload,
+            )
+        self._store_move_plan(plan)
+        return web.json_response({"success": True, **payload})
+
+    def _store_move_plan(self, plan):
+        if self._move_plans is None:
+            self._move_plans = {}
+        now = time.monotonic()
+        self._move_plans = {
+            token: kept
+            for token, kept in self._move_plans.items()
+            if now - kept.created < PLAN_TTL
+        }
+        self._move_plans[plan.token] = plan
+
+    def _build_move_plan(self, target):
+        """``(plan, payload)`` or a refusal code (blocking)."""
+        old = preview_store.setting()
+        location = preview_store.current()
+        install = old.install or str(uuid.uuid4())
+        target_path = None
+        default = default_path()
+        if target["mode"] == preview_store.FOLDER_MODE:
+            raw = target.get("path")
+            if not isinstance(raw, str):
+                return "location-not-absolute"
+            context = self._thumbnail_location_context()
+            code = preview_location.location_problem(
+                raw, purpose="move", context=context
+            )
+            if code is not None:
+                return code
+            target_path = os.path.abspath(raw)
+        elif old.mode == preview_store.SOURCE_MODE and not old.problem:
+            return "location-same"
+        target_default = bool(default) and os.path.normcase(
+            target_path or ""
+        ) == os.path.normcase(os.path.abspath(default))
+        target_exists = bool(target_path) and os.path.isdir(target_path)
+        target_marker = (
+            preview_location.read_marker(target_path) if target_exists else None
+        )
+        roots = [str(root) for root in self._get_all_output_dirs()]
+        labels = self._source_labels(roots)
+        old_keys = {}
+        if old.mode == preview_store.FOLDER_MODE and location.available:
+            marker = preview_location.read_marker(old.path) or {}
+            old_keys = marker.get("keys") or {}
+        new_keys = dict((target_marker or {}).get("keys") or {})
+        taken = {key: entry.get("identity") for key, entry in new_keys.items()}
+        sources = []
+        for root in roots:
+            identity = os.path.normcase(os.path.realpath(root))
+            dev_ino = preview_location.file_identity(root)
+            old_key = None
+            old_store = None
+            available = True
+            if old.mode == preview_store.SOURCE_MODE:
+                old_store = str(preview_store.source_folder(root))
+            elif location.available:
+                old_key = preview_location.find_key(old_keys, root, identity, dev_ino)
+                if old_key:
+                    old_store = os.path.join(old.path, old_key)
+            else:
+                available = False
+            key = None
+            if target_path:
+                key = old_key or preview_location.find_key(
+                    new_keys, root, identity, dev_ino
+                )
+                if key is None or taken.get(key, identity) != identity:
+                    key = preview_location.source_key(root, identity, taken)
+                taken[key] = identity
+                new_store = os.path.join(target_path, key)
+            else:
+                new_store = str(preview_store.source_folder(root))
+            scan = None
+            if old_store:
+                scan = files.scan_store(old_store, root)
+            plan = SourcePlan(
+                root, labels.get(root, root), key, old_store, new_store, scan, available
+            )
+            if scan is not None and target_path:
+                plan.too_long = [
+                    item[0]
+                    for item in scan.copy
+                    if files.too_long(Path(new_store).joinpath(*item[0]))
+                ]
+            sources.append(plan)
+        unlisted = self._unlisted_keys(old, location, old_keys, install)
+        needs = sum(source.scan.bytes for source in sources if source.scan is not None)
+        plan = MovePlan(
+            token=secrets.token_urlsafe(16),
+            created=time.monotonic(),
+            revision=_roots_revision(roots),
+            old=old,
+            target={"mode": target["mode"], "path": target_path},
+            target_id=(target_marker or {}).get("id"),
+            target_exists=target_exists,
+            target_default=target_default,
+            install=install,
+            sources=sources,
+            unlisted=unlisted,
+            needs_bytes=needs,
+            confirm_required=bool(target_path) and not target_default,
+        )
+        return plan, self._plan_payload(plan, location)
+
+    def _unlisted_keys(self, old, location, keys, install):
+        """This install's keys whose source no longer is in any root list
+        (``(key, store, scan)``), in the folder in use."""
+        if old.mode != preview_store.FOLDER_MODE or not location.available:
+            return []
+        listed = {
+            os.path.normcase(os.path.realpath(root))
+            for root in self._all_source_roots()
+        }
+        found = []
+        for key, entry in sorted(keys.items()):
+            if not preview_location.valid_key(key) or not isinstance(entry, dict):
+                continue  # a marker is data: never a path out of the folder
+            if entry.get("install") not in (install, None):
+                continue
+            if entry.get("identity") in listed:
+                continue
+            store = os.path.join(old.path, key)
+            found.append(
+                (key, store, files.scan_store(store, entry.get("path") or store))
+            )
+        return found
+
+    def _source_labels(self, roots):
+        from . import sources
+
+        labels = sources._comfyui_labels()
+        return {root: sources.source_label(root, labels) for root in roots}
+
+    def _plan_payload(self, plan, location):
+        sources = plan.sources
+        copies = sum(len(s.scan.copy) for s in sources if s.scan)
+        orphans = sum(len(s.scan.orphans) for s in sources if s.scan)
+        temps = sum(len(s.scan.temps) for s in sources if s.scan)
+        links = sum(s.scan.links for s in sources if s.scan)
+        left = [
+            f"{s.label} · {'/'.join(item)}"
+            for s in sources
+            if s.scan
+            for item in s.scan.left
+        ]
+        too_long = [
+            f"{s.label} · {'/'.join(item)}" for s in sources for item in s.too_long
+        ]
+        unlisted_count = sum(
+            len(scan.copy) + len(scan.orphans) for _k, _s, scan in plan.unlisted
+        )
+        free = None
+        insufficient = None
+        if plan.needs_bytes:
+            volumes = {}
+            for source in sources:
+                if source.scan is None or not source.scan.bytes:
+                    continue
+                volume = _volume(source.new_store)
+                entry = volumes.setdefault(volume, [source.new_store, 0])
+                entry[1] += source.scan.bytes
+            for where, needed in volumes.values():
+                available = _free(where)
+                if available is None:
+                    continue
+                free = available if free is None else min(free, available)
+                margin = max(SPACE_MARGIN, int(needed * SPACE_SHARE))
+                if needed + margin > available:
+                    insufficient = {
+                        "needed": needed + margin,
+                        "free": available,
+                        "text": (
+                            f"There is not enough space for the thumbnails: "
+                            f"{_size(available)} free, {_size(needed + margin)} "
+                            "needed. Free some space or choose another folder."
+                        ),
+                    }
+        payload = {
+            "mode": "move",
+            "from": {
+                "mode": plan.old.mode,
+                "path": plan.old.path,
+                "available": location.available,
+            },
+            "to": {
+                "mode": plan.target["mode"],
+                "path": plan.target["path"],
+                "exists": plan.target_exists,
+                "will_create": bool(plan.target["path"]) and not plan.target_exists,
+                "default": plan.target_default,
+            },
+            "sources": [
+                {
+                    "label": s.label,
+                    "key": s.key,
+                    "files": len(s.scan.copy) if s.scan else 0,
+                    "bytes": s.scan.bytes if s.scan else 0,
+                    "too_long": len(s.too_long),
+                    "links": s.scan.links if s.scan else 0,
+                    "orphans": len(s.scan.orphans) if s.scan else 0,
+                    "left_in_place": len(s.scan.left) if s.scan else 0,
+                    "available": s.available,
+                }
+                for s in sources
+            ],
+            "totals": {
+                "sources": len(sources),
+                "files": copies,
+                "bytes": plan.needs_bytes,
+                "orphans": orphans,
+                "temps": temps,
+                "links": links,
+                "left_in_place": len(left),
+                "too_long": len(too_long),
+                "unlisted_sources": len(plan.unlisted),
+                "unlisted_files": unlisted_count,
+            },
+            "too_long_listed": too_long[:LISTED],
+            "left_listed": left[:LISTED],
+            "unlisted": [
+                {"key": key, "files": len(scan.copy) + len(scan.orphans)}
+                for key, _store, scan in plan.unlisted
+            ],
+            "needs_bytes": plan.needs_bytes,
+            "free_bytes": free,
+            "confirm_required": plan.confirm_required,
+            "token": plan.token,
+            "sentence": SENTENCE,
+        }
+        if insufficient:
+            payload["insufficient"] = insufficient
+        return payload

py/api/thumbnail_move_recovery.py

@@ -0,0 +1,246 @@
+"""Move thumbnails after a restart and the unavailable folder's actions
+(#320 Parts 3 and 4): undo an interrupted copy, finish a removal that
+waited, Recreate folder and Use this folder."""
+
+import os
+import threading
+from pathlib import Path
+
+from aiohttp import web
+
+from . import preview_location, preview_store
+from . import thumbnail_move_files as files
+from .job_routes import busy_response
+from .jobs import THUMBNAILS_JOB_KIND, JobBusy
+from .thumbnail_move_plan import (
+    FINISHING_TITLE,
+    MOVE_GROUPS,
+    _read_json,
+    _refusal,
+    _remove,
+)
+from . import thumbnail_move_plan as move_plan
+
+
+class ThumbnailMoveRecoveryMixin:
+    """Startup recovery, the finishing job, Recreate and Use this folder."""
+
+    _move_recover_lock = threading.Lock()
+    # Per API: set once recover_thumbnail_move has run (a move waits for it).
+    _move_recovered = False
+
+    # ── startup ───────────────────────────────────────────────────────
+
+    def recover_thumbnail_move(self):
+        """Startup (B4): undo an interrupted copy, or forget a journal the
+        switch already made true. Idempotent; the move start waits for it."""
+        with self._move_recover_lock:
+            if self._move_recovered:
+                return
+            try:
+                self._recover_journal()
+            except Exception:
+                self.logger.warning(
+                    "The interrupted thumbnail move check failed", exc_info=True
+                )
+            self._move_recovered = True
+
+    def _recover_journal(self):
+        path = move_plan.journal_path()
+        journal = _read_json(path)
+        if journal is None:
+            return
+        setting = preview_store.setting()
+        target = journal.get("to") or {}
+        now = setting.path if setting.mode == preview_store.FOLDER_MODE else None
+        if setting.mode == target.get("mode") and (
+            now is None
+            or os.path.normcase(now) == os.path.normcase(target.get("path") or "")
+        ):
+            _remove(path)  # the switch happened; only the journal was left
+            return
+        for store in journal.get("stores") or []:
+            if not isinstance(store, str) or not os.path.isdir(store):
+                continue
+            for current, dirs, names in os.walk(store):
+                dirs[:] = [
+                    d
+                    for d in dirs
+                    if not preview_location.is_link_like(Path(current) / d)
+                ]
+                for name in names:
+                    if files.MOVE_TEMP.search(name):
+                        files.remove_file(Path(current) / name)
+        for folder in reversed(journal.get("created_dirs") or []):
+            if not isinstance(folder, str) or not os.path.isdir(folder):
+                continue
+            for current, dirs, names in os.walk(folder):
+                dirs[:] = [
+                    d
+                    for d in dirs
+                    if not preview_location.is_link_like(Path(current) / d)
+                ]
+                for name in names:
+                    if files._preview_parts(name) or files.is_temp_name(name):
+                        files.remove_file(Path(current) / name)
+            files.remove_empty_folders(folder)
+        folder = target.get("path")
+        if journal.get("created_folder") and folder and os.path.isdir(folder):
+            names = set(os.listdir(folder))
+            if names <= {preview_location.MARKER_NAME}:
+                _remove(preview_location.marker_path(folder))
+                files.remove_empty_folders(folder)
+        _remove(path)
+        self.logger.info("An interrupted thumbnail move was undone; nothing changed")
+
+    def _cleanup_reachable(self, entry):
+        folder = entry.get("folder")
+        if folder:
+            return os.path.isdir(folder)
+        return True
+
+    async def finish_thumbnail_move(self, _app=None):
+        """Startup: recover, then start "Move thumbnails (finishing)" when old
+        copies wait and every one is reachable (on the server's loop)."""
+        await self._run_in_executor(self.recover_thumbnail_move)
+        cleanup = list(preview_store.setting().cleanup)
+        if not cleanup:
+            return None
+        reachable = await self._run_in_executor(
+            lambda: all(self._cleanup_reachable(entry) for entry in cleanup)
+        )
+        if not reachable:
+            return None
+        try:
+            return self._jobs.start(
+                THUMBNAILS_JOB_KIND,
+                FINISHING_TITLE,
+                admission="guarded",
+                cancellable=False,
+                scope={"mode": "move", "phase": "remove"},
+                groups=MOVE_GROUPS,
+                runner=self._run_finishing,
+            )
+        except JobBusy:
+            return None
+
+    async def _run_finishing(self, job):
+        await self._remove_old_copies(job, None)
+        left = len(preview_store.setting().cleanup)
+        self._end_move(
+            job,
+            "finished",
+            (
+                "Old thumbnails removed."
+                if not left
+                else (
+                    "Some old thumbnails are still in use; they are removed at "
+                    "the next start."
+                )
+            ),
+        )
+
+    # ── Recreate and Use this folder (Part 4) ─────────────────────────
+
+    async def recreate_thumbnail_folder(self, _request):
+        blocker = self._jobs.blocker(THUMBNAILS_JOB_KIND, admission="guarded")
+        if blocker is not None:
+            return busy_response(JobBusy(blocker))
+        code = await self._run_in_executor(self._recreate_folder)
+        if code is not None:
+            status = (
+                409 if code in ("location-has-marker", "location-not-empty") else 400
+            )
+            if code == "location-has-marker":
+                return web.json_response(
+                    {
+                        "success": False,
+                        "code": code,
+                        "error": "The folder is back with its thumbnails. Nothing "
+                        "was recreated.",
+                    },
+                    status=status,
+                )
+            return _refusal(code, status=status)
+        return web.json_response(
+            {
+                "success": True,
+                "location": self._thumbnail_location_payload(with_path=True),
+            }
+        )
+
+    def _recreate_folder(self):
+        setting = preview_store.setting()
+        if setting.mode != preview_store.FOLDER_MODE or not setting.path:
+            return "location-same"
+        folder = setting.path
+        if os.path.isdir(folder):
+            if preview_location.read_marker(folder) is not None:
+                return "location-has-marker"
+            if not preview_location.holds_only_metadata(folder):
+                return "location-not-empty"
+        elif not os.path.isdir(os.path.dirname(folder)):
+            return "location-parent-missing"
+        else:
+            try:
+                os.mkdir(folder)
+            except OSError:
+                return "location-not-writable"
+        try:
+            marker_id = preview_location.init_folder(folder, created_by_pm=True)
+        except OSError:
+            return "location-not-writable"
+        return self._commit_location_id(marker_id)
+
+    async def adopt_thumbnail_folder(self, _request):
+        blocker = self._jobs.blocker(THUMBNAILS_JOB_KIND, admission="guarded")
+        if blocker is not None:
+            return busy_response(JobBusy(blocker))
+        code = await self._run_in_executor(self._adopt_folder)
+        if code is not None:
+            return _refusal(code)
+        return web.json_response(
+            {
+                "success": True,
+                "location": self._thumbnail_location_payload(with_path=True),
+            }
+        )
+
+    def _adopt_folder(self):
+        setting = preview_store.setting()
+        if setting.mode != preview_store.FOLDER_MODE or not setting.path:
+            return "location-same"
+        try:
+            marker = preview_location.read_marker(setting.path)
+        except OSError:
+            return "location-unavailable"
+        if marker is None:
+            return "location-unavailable"
+        return self._commit_location_id(marker["id"])
+
+    def _commit_location_id(self, marker_id):
+        from ..config import PromptManagerConfig
+        from ..config_store import get_config_store
+
+        value = dict(preview_store.setting().to_config())
+        value["id"] = marker_id
+
+        def mutate(config):
+            section = config.get("thumbnails")
+            if not isinstance(section, dict):
+                section = {}
+            section["location"] = value
+            config["thumbnails"] = section
+            return config
+
+        def publish(_config):
+            PromptManagerConfig.THUMBNAIL_LOCATION = value
+            preview_store.configure(value, check=False)
+
+        try:
+            get_config_store().commit(mutate, expected_revision=None, publish=publish)
+        except Exception:
+            self.logger.exception("The thumbnail folder could not be saved")
+            return "location-not-writable"
+        preview_store.refresh()
+        return None

py/api/thumbnail_prune.py

@@ -0,0 +1,175 @@
+"""Remove thumbnails of removed sources (#320 Part 5, D200): a Thumbnail
+maintenance scope, offered only in folder mode (31A).
+
+*Removed* means a key of this install in the thumbnail folder's marker whose
+identity matches no root in any root list. The job removes the
+preview-grammar files and temps of those key folders, ``rmdir``s the empty
+folders, drops the keys from the marker and lists anything else as "Left in
+place". Kind ``thumbnails``, ``mode: "prune"``.
+"""
+
+import functools
+import os
+from pathlib import Path
+
+from aiohttp import web
+
+from . import preview_location, preview_store
+from . import thumbnail_move_files as files
+from .jobs import THUMBNAILS_JOB_KIND
+from .thumbnail_location import location_refusal
+from .thumbnail_move_plan import _number, _plural, _size
+
+PRUNE_TITLE = "Remove thumbnails of removed sources"
+PRUNE_GROUPS = ("removed", "left", "errors")
+
+
+def _prune_line(count, files_count, size):
+    if not count:
+        return "No sources were removed: nothing to remove."
+    return (
+        f"{_plural(count, 'source')} no longer listed: "
+        f"{_plural(files_count, 'thumbnail')} ({_size(size)}) are removed."
+    )
+
+
+class ThumbnailPruneMixin:
+    """The prune plan and job."""
+
+    def _prune_targets(self):
+        """``[(key, store, scan)]`` of this install's unlisted keys (blocking)."""
+        setting = preview_store.setting()
+        location = preview_store.current()
+        if setting.mode != preview_store.FOLDER_MODE or not location.available:
+            return []
+        marker = preview_location.read_marker(setting.path) or {}
+        install = setting.install
+        return self._unlisted_keys(setting, location, marker.get("keys") or {}, install)
+
+    def _prune_payload(self, targets):
+        files_count = sum(
+            len(scan.copy) + len(scan.orphans) for _k, _s, scan in targets
+        )
+        size = sum(scan.bytes for _k, _s, scan in targets)
+        return {
+            "success": True,
+            "mode": "prune",
+            "sources": [
+                {
+                    "key": key,
+                    "files": len(scan.copy) + len(scan.orphans),
+                    "bytes": scan.bytes,
+                    "left_in_place": len(scan.left),
+                }
+                for key, _store, scan in targets
+            ],
+            "targets": files_count,
+            "bytes": size,
+            "line": _prune_line(len(targets), files_count, size),
+            "folder": preview_store.setting().path,
+        }
+
+    async def get_prune_plan(self):
+        refused = location_refusal()
+        if refused is not None:
+            return refused
+        if preview_store.current().mode != preview_store.FOLDER_MODE:
+            return web.json_response(
+                {
+                    "success": False,
+                    "code": "invalid-request",
+                    "error": "Thumbnails are kept inside each source: no removed "
+                    "source has thumbnails here.",
+                },
+                status=400,
+            )
+        targets = await self._run_in_executor(self._prune_targets)
+        return web.json_response(
+            self._prune_payload(targets), headers={"Cache-Control": "no-store"}
+        )
+
+    def start_thumbnail_prune(self):
+        """Start the prune job (sync, on the loop); raises JobBusy."""
+        return self._jobs.start(
+            THUMBNAILS_JOB_KIND,
+            PRUNE_TITLE,
+            admission="guarded",
+            cancellable=True,
+            scope={"mode": "prune"},
+            groups=PRUNE_GROUPS,
+            runner=self._run_thumbnail_prune,
+        )
+
+    async def _run_thumbnail_prune(self, job):
+        targets = await self._run_in_executor(self._prune_targets)
+        job.update(total=len(targets), processed=0)
+        setting = preview_store.setting()
+        for done, (key, store, scan) in enumerate(targets, 1):
+            if job.cancelled:
+                break
+            removed, failed = await self._run_in_executor(
+                functools.partial(self._prune_store, store)
+            )
+            job.record_counted(
+                "removed", removed, [{"path": key, "detail": "Thumbnails removed"}]
+            )
+            if failed:
+                job.record_counted("errors", failed)
+            if scan.left:
+                job.record_counted(
+                    "left",
+                    len(scan.left),
+                    [{"path": f"{key}/{'/'.join(item)}"} for item in scan.left],
+                )
+            await self._run_in_executor(
+                functools.partial(self._forget_key, setting.path, key, store)
+            )
+            job.update(
+                processed=done,
+                progress=int(done * 100 / len(targets)),
+                status_line=f"Removing thumbnails of {_number(done)} of "
+                f"{_number(len(targets))} removed sources",
+            )
+            job.publish({"type": "progress", "summary": job.summary()})
+        line = f"{_number(job.counters.get('removed', 0))} thumbnails removed"
+        if job.counters.get("errors"):
+            line += f" · {_plural(job.counters['errors'], 'error')}"
+        job.update(status_line=line, progress=100)
+        job.log_line(line)
+        job.finish("cancelled" if job.cancelled else "finished")
+
+    @staticmethod
+    def _prune_store(store):
+        """Remove the previews and temps of one key folder; ``(removed, failed)``."""
+        removed = failed = 0
+        store = Path(store)
+        if not store.is_dir() or preview_location.is_link_like(store):
+            return 0, 0
+        for current, dirs, names in os.walk(store):
+            dirs[:] = [
+                d for d in dirs if not preview_location.is_link_like(Path(current) / d)
+            ]
+            for name in names:
+                path = Path(current) / name
+                if not (files.is_temp_name(name) or files._preview_parts(name)):
+                    continue
+                if preview_location.is_link_like(path):
+                    continue
+                if files.remove_file(path):
+                    removed += 1
+                else:
+                    failed += 1
+        files.remove_empty_folders(store)
+        return removed, failed
+
+    @staticmethod
+    def _forget_key(folder, key, store):
+        """Drop *key* from the marker once its folder is gone."""
+        if os.path.exists(store):
+            return
+
+        def forget(marker):
+            marker["keys"].pop(key, None)
+
+        with preview_store.write_lock:
+            preview_location.write_marker(folder, forget)

py/api/thumbnail_settings.py

@@ -114,9 +114,16 @@ def validate_edge(value):
 # ── names ────────────────────────────────────────────────────────────
 
 
+def preview_stem(rel_path):
+    """``<rel without extension>_thumb`` (POSIX): a preview's name inside the
+    store of its source (``preview_store``)."""
+    return f"{Path(rel_path).with_suffix('').as_posix()}{THUMB_SUFFIX}"
+
+
 def thumbnail_stem_rel(rel_path):
-    """``thumbnails/<rel without extension>_thumb`` (POSIX)."""
-    return f"thumbnails/{Path(rel_path).with_suffix('').as_posix()}{THUMB_SUFFIX}"
+    """``thumbnails/<rel without extension>_thumb`` (POSIX): URL text only.
+    Where the preview is on disk is ``preview_store``'s answer."""
+    return f"thumbnails/{preview_stem(rel_path)}"
 
 
 def thumbnail_rel(rel_path, extension=None):
@@ -207,9 +214,20 @@ def owned_in_folder(folder, stem, source_extension, preferred=None):
 
 
 def _owned(root, rel_path, preferred):
+    from . import preview_store
+
     rel_path = Path(rel_path)
-    stem = Path(root) / thumbnail_stem_rel(rel_path)
-    return owned_in_folder(stem.parent, stem.name, rel_path.suffix, preferred)
+    store = preview_store.store_dir(root)
+    if store is None:
+        return iter(())
+    stem = store / preview_stem(rel_path)
+    found = owned_in_folder(stem.parent, stem.name, rel_path.suffix, preferred)
+    if preview_store.current().mode == preview_store.SOURCE_MODE:
+        return found
+    # Folder mode: timed, so a stalled share marks the folder unreachable,
+    # and only previews no link takes out of the key folder (deletes use it).
+    with preview_store.store_io():
+        return iter([path for path in found if preview_store.may_write(path)])
 
 
 def owned_thumbnails(root, rel_path, preferred=None):

py/api/workflow_storage.py

@@ -59,6 +59,9 @@ REWRITE_FAILED = (
 )
 RECLAIM_FAILED = "Reclaim space failed; the database is unchanged."
 ROW_KEPT = "could not be rewritten; it keeps its inline text and reads as before"
+# A protected value's row (#586), in the review's "not text; kept as is".
+VALUE_KEPT = "stored value not text; kept as is"
+KEPT_COLUMNS = {"workflow_data": "workflow", "prompt_metadata": "prompt graph"}
 
 
 NOTHING_LEFT = "Every image record already stores its workflow once"
@@ -177,7 +180,19 @@ class WorkflowStorageRoutesMixin:
             protected += batch["protected"]
             errors += len(batch["errors"])
             job.record_counted("changed", batch["rows"])
-            job.record_counted("protected", batch["protected"])
+            job.record_counted(
+                "protected",
+                batch["protected"],
+                [
+                    {
+                        "path": "",
+                        "detail": f"Image record {image_id}: "
+                        f"{KEPT_COLUMNS.get(column, column)}, {VALUE_KEPT}",
+                    }
+                    for image_id, column in batch["kept"]
+                ],
+                complete=True,
+            )
             for image_id in batch["errors"]:
                 job.record(
                     "errors",

py/autotag.py

@@ -30,9 +30,9 @@ except ImportError:
 # The tag template and thresholds live with the saved tagging defaults
 # (#328), so config.py never imports PIL.
 try:
-    from .tagging_defaults import DEFAULT_TAG_TEMPLATE
+    from .tagging_defaults import DEFAULT_TAG_TEMPLATE, read_wd14_label_rows
 except ImportError:
-    from py.tagging_defaults import DEFAULT_TAG_TEMPLATE
+    from py.tagging_defaults import DEFAULT_TAG_TEMPLATE, read_wd14_label_rows
 
 try:
     from ..utils import exit_signal
@@ -559,7 +559,6 @@ class AutoTagService:
         # A missing onnxruntime is refused by load_model before this runs
         # (#424); a ModuleNotFoundError here becomes the same refusal.
         import onnxruntime as ort
-        import csv
 
         config = MODELS[model_type]
         model_dir = self.models_dir / config["subdir"]
@@ -576,12 +575,8 @@ class AutoTagService:
 
         session = ort.InferenceSession(str(model_path), providers=providers)
 
-        # Read tag list from CSV
-        tags_list = []
-        with open(tags_path, "r", encoding="utf-8") as f:
-            reader = csv.DictReader(f)
-            for row in reader:
-                tags_list.append(row)
+        # Read tag list from CSV (the reader the Skipped tags preview shares)
+        tags_list = read_wd14_label_rows(tags_path)
 
         self.logger.info(
             f"WD14 model loaded ({len(tags_list)} tags, "
@@ -992,6 +987,7 @@ class AutoTagService:
         prompt: Optional[str] = None,
         general_threshold: Optional[float] = None,
         character_threshold: Optional[float] = None,
+        skip: Any = None,
     ) -> List[Tuple[str, Optional[float]]]:
         """The top ``limit`` suggestions as ``(name, confidence)`` pairs.
 
@@ -1000,7 +996,9 @@ class AutoTagService:
         ``None``. Names are distinct case-insensitively (first one wins).
         A name Save would reject (over 50 characters, a control character
         such as a newline, a comma) is skipped before the dedupe and the
-        ``limit`` count. ``prompt`` is used for this call only;
+        ``limit`` count. A name ``skip`` matches (a ``SkipMatcher``, the
+        Skipped tags compiled for this request or job, #431) is dropped next,
+        so it uses up no slot. ``prompt`` is used for this call only;
         ``custom_prompt`` is never changed.
         """
         if type(limit) is not int or not 1 <= limit <= MAX_SUGGESTION_LIMIT:
@@ -1017,6 +1015,8 @@ class AutoTagService:
                 name = validate_vocabulary_tag_name(raw)
             except ValueError:
                 continue
+            if skip is not None and skip.matches(name):
+                continue
             key = name.casefold()
             if key in seen:
                 continue

py/config.py

@@ -30,6 +30,7 @@ routes = server_instance.routes
 # Extension info
 extension_uri = None  # Will be set in __init__.py
 
+import hashlib  # noqa: E402
 import os  # noqa: E402
 from typing import Any, Dict, List, Optional, Tuple  # noqa: E402
 
@@ -587,8 +588,15 @@ try:
         MODEL_TYPES,
         WD14_MODEL_TYPES,
         validate_saved_threshold,
+        validate_skipped_tags,
         validate_template,
         validate_threshold,
+        BUILTIN_INSTRUCTIONS_ID,
+        INSTRUCTION_ENGINES,
+        MAX_SAVED_INSTRUCTIONS,
+        builtin_instructions,
+        validate_default_instructions,
+        validate_instructions,
     )
 except ImportError:
     from py.tagging_defaults import (  # noqa: F401 - re-exported
@@ -600,8 +608,15 @@ except ImportError:
         MODEL_TYPES,
         WD14_MODEL_TYPES,
         validate_saved_threshold,
+        validate_skipped_tags,
         validate_template,
         validate_threshold,
+        BUILTIN_INSTRUCTIONS_ID,
+        INSTRUCTION_ENGINES,
+        MAX_SAVED_INSTRUCTIONS,
+        builtin_instructions,
+        validate_default_instructions,
+        validate_instructions,
     )
 
 
@@ -617,6 +632,31 @@ def _valid_existing(value: Any) -> str:
     return value
 
 
+def _valid_skipped_tags(value: Any) -> Tuple[str, ...]:
+    return tuple(validate_skipped_tags(value))
+
+
+def _reason(error: ValueError) -> str:
+    """A settings sentence as a load warning's reason ("entry 2 is empty")."""
+    text = str(error).rstrip(".")
+    for prefix in ("Skipped tags", "Saved instructions"):
+        if text.startswith(prefix):
+            return text.removeprefix(prefix).lstrip(": ")
+    return text
+
+
+def _text_id(text: str) -> str:
+    """A migrated entry's id: deterministic, so every load gives the same."""
+    return hashlib.sha256(text.encode("utf-8")).hexdigest()[:12]
+
+
+def _fallback_warning(key: str, error: ValueError, default: Any) -> str:
+    """The one load warning of a saved tagging default that fails its check."""
+    if key == "skipped_tags":
+        return f"autotag.defaults.skipped_tags {_reason(error)}; using no skipped tags"
+    return f"autotag.defaults.{key} {error}; using {default!r}"
+
+
 def _valid_suggestion_limit(value: Any) -> int:
     if type(value) is not int or not 1 <= value <= MAX_SUGGESTION_LIMIT:
         raise ValueError(f"must be an integer from 1 to {MAX_SUGGESTION_LIMIT}")
@@ -637,8 +677,18 @@ class AutotagConfig:
     EXISTING = "skip"
     GENERAL_THRESHOLD = 0.35
     CHARACTER_THRESHOLD = 0.85
-    TEMPLATE = DEFAULT_TAG_TEMPLATE
     SUGGESTION_LIMIT = DEFAULT_SUGGESTION_LIMIT
+    SKIPPED_TAGS: Tuple[str, ...] = ()
+    # #431: the saved instructions (Built-in is never stored) and the default
+    # of each language-model engine, by id.
+    INSTRUCTIONS: Tuple[Dict[str, str], ...] = ()
+    DEFAULT_INSTRUCTIONS: Dict[str, str] = {
+        "gguf": BUILTIN_INSTRUCTIONS_ID,
+        "hf": BUILTIN_INSTRUCTIONS_ID,
+    }
+    # The old single template as read at load (None when absent or invalid);
+    # only the migration reads it. Saves keep it as the GGUF default's mirror.
+    _LEGACY_TEMPLATE: Optional[str] = None
 
     # config.json key -> (attribute, validator, default)
     _KEYS = {
@@ -654,12 +704,13 @@ class AutotagConfig:
             lambda v: validate_saved_threshold("value", v),
             0.85,
         ),
-        "template": ("TEMPLATE", validate_template, DEFAULT_TAG_TEMPLATE),
         "suggestion_limit": (
             "SUGGESTION_LIMIT",
             _valid_suggestion_limit,
             DEFAULT_SUGGESTION_LIMIT,
         ),
+        # #431: words whose suggested tags are never offered.
+        "skipped_tags": ("SKIPPED_TAGS", _valid_skipped_tags, ()),
     }
 
     @classmethod
@@ -672,17 +723,142 @@ class AutotagConfig:
             type(value) is int and 1 <= value <= MAX_SUGGESTION_LIMIT
         )  # bool, float and str are rejected
 
+    @classmethod
+    def all_instructions(cls) -> List[Dict[str, str]]:
+        """Built-in first, then the saved entries (copies)."""
+        return [builtin_instructions()] + [dict(item) for item in cls.INSTRUCTIONS]
+
+    @classmethod
+    def default_instructions_text(cls, engine: str) -> str:
+        """The text of ``engine``'s (``gguf`` or ``hf``) default instructions."""
+        if engine not in INSTRUCTION_ENGINES:
+            raise ValueError(f"{engine} takes no instructions")
+        wanted = cls.DEFAULT_INSTRUCTIONS.get(engine, BUILTIN_INSTRUCTIONS_ID)
+        for item in cls.INSTRUCTIONS:
+            if item["id"] == wanted:
+                return item["text"]
+        return DEFAULT_TAG_TEMPLATE
+
+    @classmethod
+    def mirror_template(cls) -> Optional[str]:
+        """What an older build reads as its one template (#431 B1.1): the
+        GGUF default's text, or None (no key) when that default is Built-in."""
+        if cls.DEFAULT_INSTRUCTIONS.get("gguf") == BUILTIN_INSTRUCTIONS_ID:
+            return None
+        return cls.default_instructions_text("gguf")
+
     @classmethod
     def get_config(cls) -> Dict[str, Any]:
-        """The saved defaults; the template only when it is not the built-in
-        one, so a later built-in template still reaches who never set one."""
+        """The saved defaults; ``template`` only as the GGUF default's mirror."""
         defaults = {
             key: getattr(cls, attr) for key, (attr, _v, _d) in cls._KEYS.items()
         }
-        if defaults["template"] == DEFAULT_TAG_TEMPLATE:
-            del defaults["template"]
+        defaults["skipped_tags"] = list(defaults["skipped_tags"])
+        defaults["instructions"] = [dict(item) for item in cls.INSTRUCTIONS]
+        defaults["default_instructions"] = dict(cls.DEFAULT_INSTRUCTIONS)
+        mirror = cls.mirror_template()
+        if mirror is not None:
+            defaults["template"] = mirror
         return {"defaults": defaults}
 
+    @classmethod
+    def _load_instructions(cls, defaults: Dict[str, Any]) -> None:
+        """Each instruction key alone, then the cross-key default check, then
+        the in-memory migration of the old template (#431). Nothing is
+        written here, so the revision never changes at load."""
+        cls._LEGACY_TEMPLATE = None
+        if "template" in defaults:
+            try:
+                cls._LEGACY_TEMPLATE = validate_template(defaults["template"])
+            except ValueError as error:
+                config_logger.warning(
+                    f"autotag.defaults.template {error}; using the built-in one"
+                )
+        entries: List[Dict[str, str]] = []
+        damaged = False
+        if "instructions" in defaults:
+            try:
+                entries = validate_instructions(defaults["instructions"])
+            except ValueError as error:
+                damaged = True
+                config_logger.warning(
+                    f"autotag.defaults.instructions {_reason(error)}; "
+                    "using Built-in only"
+                )
+        chosen = {engine: BUILTIN_INSTRUCTIONS_ID for engine in INSTRUCTION_ENGINES}
+        stored = defaults.get("default_instructions")
+        if damaged:
+            # Both defaults fall back with the list (its one warning says so);
+            # the old template is migrated as on a first upgrade.
+            pass
+        elif "default_instructions" in defaults and (
+            not isinstance(stored, dict) or set(stored) != set(INSTRUCTION_ENGINES)
+        ):
+            config_logger.warning(
+                "autotag.defaults.default_instructions must name gguf and hf; "
+                "using Built-in"
+            )
+        elif isinstance(stored, dict):
+            ids = {item["id"] for item in entries}
+            for engine in INSTRUCTION_ENGINES:
+                value = stored[engine]
+                if isinstance(value, str) and (
+                    value == BUILTIN_INSTRUCTIONS_ID or value in ids
+                ):
+                    chosen[engine] = value
+                else:
+                    config_logger.warning(
+                        f"autotag.defaults.default_instructions.{engine} names no "
+                        "saved instructions; using Built-in"
+                    )
+        cls._migrate_template(
+            entries,
+            chosen,
+            first=damaged or "instructions" not in defaults,
+            keep_defaults=not damaged and "default_instructions" in defaults,
+        )
+        cls.INSTRUCTIONS = tuple(entries)
+        cls.DEFAULT_INSTRUCTIONS = chosen
+
+    @classmethod
+    def _migrate_template(cls, entries, chosen, *, first, keep_defaults) -> None:
+        """Bring a template saved by an older build in as a named entry."""
+        legacy = cls._LEGACY_TEMPLATE
+        if legacy is None or legacy == DEFAULT_TAG_TEMPLATE:
+            return
+        if first:
+            # The first upgrade: it becomes "Custom template", the default for
+            # both engines unless defaults are stored already (20A).
+            entries.append(
+                {"id": _text_id(legacy), "name": "Custom template", "text": legacy}
+            )
+            if not keep_defaults:
+                for engine in INSTRUCTION_ENGINES:
+                    chosen[engine] = entries[-1]["id"]
+            return
+        if any(item["text"] == legacy for item in entries):
+            return  # the mirror of a saved default
+        # Edited on an older build after an upgrade (B1.2): import it.
+        if len(entries) >= MAX_SAVED_INSTRUCTIONS:
+            config_logger.warning(
+                "The tagging template edited on an older version was not imported: "
+                f"the saved instructions are full ({MAX_SAVED_INSTRUCTIONS})"
+            )
+            return
+        names = {item["name"].casefold() for item in entries}
+        number = 2
+        while f"custom template ({number})" in names:
+            number += 1
+        name = f"Custom template ({number})"
+        ids = {item["id"] for item in entries}
+        new_id, n = _text_id(legacy), 2
+        while new_id in ids:
+            new_id, n = _text_id(f"{legacy}\n{n}"), n + 1
+        entries.append({"id": new_id, "name": name, "text": legacy})
+        config_logger.info(
+            "Imported the tagging template edited on an older version as " f"'{name}'"
+        )
+
     @classmethod
     def update_config(cls, new_config: Any) -> None:
         if not isinstance(new_config, dict):
@@ -698,12 +874,9 @@ class AutotagConfig:
             try:
                 setattr(cls, attr, validate(defaults[key]))
             except ValueError as error:
-                config_logger.warning(
-                    f"autotag.defaults.{key} {error}; using {default!r}"
-                    if key != "template"
-                    else f"autotag.defaults.template {error}; using the built-in one"
-                )
+                config_logger.warning(_fallback_warning(key, error, default))
                 setattr(cls, attr, default)
+        cls._load_instructions(defaults)
 
 
 class PromptManagerConfig:
@@ -767,6 +940,8 @@ class PromptManagerConfig:
     THUMBNAIL_QUALITY = 80
     THUMBNAIL_EDGE = 512
     THUMBNAIL_EDGE_RANGE = (128, 2048)
+    # #320 thumbnail location (config.json ``thumbnails.location``), as read.
+    THUMBNAIL_LOCATION = None
 
     @classmethod
     def max_worker_threads(cls) -> int:
@@ -828,6 +1003,12 @@ class PromptManagerConfig:
                 "format": cls.THUMBNAIL_FORMAT,
                 "quality": cls.THUMBNAIL_QUALITY,
                 "edge": cls.THUMBNAIL_EDGE,
+                # #320: as read; only the Move thumbnails job writes it.
+                **(
+                    {"location": cls.THUMBNAIL_LOCATION}
+                    if cls.THUMBNAIL_LOCATION is not None
+                    else {}
+                ),
             },
             "gallery": GalleryConfig.get_config(),
             "integrations": IntegrationConfig.get_config(),
@@ -1002,6 +1183,11 @@ class PromptManagerConfig:
         low, high = cls.THUMBNAIL_EDGE_RANGE
         if type(edge) is int and low <= edge <= high:
             cls.THUMBNAIL_EDGE = edge
+        # #320: kept as read (``preview_location.parse_location`` checks it;
+        # a bad value becomes an unavailable ``invalid`` location, never a
+        # silent fall-back to the sources).
+        if "location" in section:
+            cls.THUMBNAIL_LOCATION = section["location"]
 
 
 # Load configuration on import

py/tagging_defaults.py

@@ -4,8 +4,13 @@ Server-free on purpose: ``py.api`` must import without ComfyUI's ``server``
 module, which ``py/config.py`` needs; config re-exports all of this.
 """
 
+import csv
 import math
-from typing import Any
+import os
+import re
+import threading
+import unicodedata
+from typing import Any, Dict, Iterable, List, Set, Tuple
 
 # The tagging engines (``py/autotag.py`` MODELS) and the options they take.
 WD14_MODEL_TYPES = frozenset({"wd14-swinv2", "wd14-vit"})
@@ -88,3 +93,230 @@ def validate_template(value: Any, name: str = "instructions") -> str:
     if len(encoded) > MAX_INSTRUCTION_BYTES:
         raise ValueError(f"{name} {'are' if name == 'instructions' else 'is'} too long")
     return value
+
+
+# Skipped tags (#431): words whose suggested tags are never offered.
+MAX_SKIPPED_TAGS = 200
+MAX_SKIPPED_TAG_CHARS = 50
+_WORD_SEPARATORS = re.compile(r"[ _-]+")
+_FORBIDDEN_IN_ENTRY = re.compile(r"[,\x00-\x1f\x7f-\x9f\u2028\u2029]")
+
+
+def tag_words(text: str) -> Tuple[str, ...]:
+    """The words of a tag or a skipped entry: NFC, case-folded, split on runs
+    of space, ``_`` and ``-``. Every other character belongs to a word."""
+    folded = unicodedata.normalize("NFC", text).casefold()
+    return tuple(word for word in _WORD_SEPARATORS.split(folded) if word)
+
+
+def validate_skipped_tags(value: Any) -> List[str]:
+    """The Skipped tags list, each entry trimmed, or ValueError with the
+    sentence the System page shows (entries are numbered from 1)."""
+    if not isinstance(value, list):
+        raise ValueError("Skipped tags must be a list of words.")
+    if len(value) > MAX_SKIPPED_TAGS:
+        raise ValueError(f"Skipped tags: at most {MAX_SKIPPED_TAGS} entries.")
+    entries: List[str] = []
+    seen: Dict[Tuple[str, ...], int] = {}
+    for number, raw in enumerate(value, 1):
+        if not isinstance(raw, str):
+            raise ValueError(f"Skipped tags: entry {number} must be text.")
+        entry = raw.strip()
+        if not entry:
+            raise ValueError(f"Skipped tags: entry {number} is empty.")
+        if len(entry) > MAX_SKIPPED_TAG_CHARS:
+            raise ValueError(
+                f"Skipped tags: entry {number} must be at most "
+                f"{MAX_SKIPPED_TAG_CHARS} characters."
+            )
+        if _FORBIDDEN_IN_ENTRY.search(entry):
+            raise ValueError(
+                f"Skipped tags: entry {number} must not contain a comma "
+                "or a line break."
+            )
+        words = tag_words(entry)
+        if not words:
+            raise ValueError(f"Skipped tags: entry {number} is empty.")
+        if words in seen:
+            raise ValueError(
+                f"Skipped tags: entry {number} repeats entry {seen[words]}."
+            )
+        seen[words] = number
+        entries.append(entry)
+    return entries
+
+
+class SkipMatcher:
+    """Whether a suggested tag contains a skipped entry's words, consecutive
+    and whole (#431, 17B). Compiled once per request or job; the cost of a
+    check depends on the tag's words, not on the number of entries."""
+
+    def __init__(self, entries: Iterable[str] = ()):
+        self._entries = frozenset(filter(None, (tag_words(e) for e in entries)))
+        self._longest = max((len(words) for words in self._entries), default=0)
+
+    def __bool__(self) -> bool:
+        return bool(self._entries)
+
+    def matches(self, name: str) -> bool:
+        if not self._entries:
+            return False
+        words = tag_words(name)
+        for start in range(len(words)):
+            stop = min(len(words), start + self._longest)
+            for end in range(start + 1, stop + 1):
+                if words[start:end] in self._entries:
+                    return True
+        return False
+
+    def counting(self) -> "CountingSkip":
+        """A per-request view that also remembers which names it hid."""
+        return CountingSkip(self)
+
+
+class CountingSkip:
+    """A :class:`SkipMatcher` that records the distinct names it hid, so the
+    Tag image dialog can say how many skipped tags were not suggested."""
+
+    def __init__(self, matcher: SkipMatcher):
+        self._matcher = matcher
+        self.hidden: Set[str] = set()
+
+    def matches(self, name: str) -> bool:
+        if self._matcher.matches(name):
+            self.hidden.add(name.casefold())
+            return True
+        return False
+
+
+# A WD14 label list's tags the engine can suggest: general (0) and character (4).
+WD14_SUGGESTED_CATEGORIES = frozenset({"0", "4"})
+_label_cache: Dict[str, Tuple[Tuple[int, int], Tuple[str, ...]]] = {}
+_label_cache_lock = threading.Lock()
+
+
+def read_wd14_label_rows(path) -> List[Dict[str, str]]:
+    """Every row of a WD14 ``selected_tags.csv``, read as UTF-8 and closed
+    before returning (the handle never outlives the call, for Windows)."""
+    with open(path, "r", encoding="utf-8", newline="") as handle:
+        return list(csv.DictReader(handle))
+
+
+def wd14_label_names(path) -> Tuple[str, ...]:
+    """The names a WD14 label list can suggest (categories 0 and 4), cached
+    by ``(mtime_ns, size)``. OSError (missing) and ValueError (unreadable)
+    propagate; the caller skips that list."""
+    key = os.fspath(path)
+    stat = os.stat(key)
+    stamp = (stat.st_mtime_ns, stat.st_size)
+    with _label_cache_lock:
+        cached = _label_cache.get(key)
+    if cached is not None and cached[0] == stamp:
+        return cached[1]
+    try:
+        rows = read_wd14_label_rows(key)
+    except csv.Error as exc:  # a damaged list (a NUL byte, an oversized field)
+        raise ValueError(f"unreadable label list: {exc}") from None
+    names = tuple(
+        name
+        for row in rows
+        if row.get("category", "0") in WD14_SUGGESTED_CATEGORIES
+        and (name := (row.get("name") or "").strip())
+    )
+    with _label_cache_lock:
+        _label_cache[key] = (stamp, names)
+    return names
+
+
+# Saved instructions (#431): named language-model instructions with a default
+# per engine. Built-in is never stored; readers put it first.
+BUILTIN_INSTRUCTIONS_ID = "builtin"
+BUILTIN_INSTRUCTIONS_NAME = "Built-in"
+MAX_SAVED_INSTRUCTIONS = 20
+MAX_INSTRUCTION_NAME_CHARS = 60
+INSTRUCTION_ENGINES = ("gguf", "hf")
+ENGINE_LABELS = {"gguf": "GGUF JoyCaption", "hf": "HuggingFace JoyCaption"}
+_INSTRUCTION_ID = re.compile(r"[0-9a-f]{12}")
+_CONTROL = re.compile(r"[\x00-\x1f\x7f-\x9f

]")
+
+
+def builtin_instructions() -> Dict[str, str]:
+    """The read-only Built-in entry, always the shipped template."""
+    return {
+        "id": BUILTIN_INSTRUCTIONS_ID,
+        "name": BUILTIN_INSTRUCTIONS_NAME,
+        "text": DEFAULT_TAG_TEMPLATE,
+    }
+
+
+def _instruction_entry(raw: Any, number: int) -> Dict[str, str]:
+    prefix = f"Saved instructions: entry {number}"
+    if (
+        not isinstance(raw, dict)
+        or set(raw) != {"id", "name", "text"}
+        or not isinstance(raw["id"], str)
+        or _INSTRUCTION_ID.fullmatch(raw["id"]) is None
+    ):
+        raise ValueError(f"{prefix} has an invalid id.")
+    name = raw["name"].strip() if isinstance(raw["name"], str) else ""
+    if not name:
+        raise ValueError(f"{prefix} needs a name.")
+    if len(name) > MAX_INSTRUCTION_NAME_CHARS:
+        raise ValueError(
+            f"{prefix} name must be at most {MAX_INSTRUCTION_NAME_CHARS} characters."
+        )
+    if _CONTROL.search(name):
+        raise ValueError(f"{prefix} name must not contain a line break.")
+    if name.casefold() == BUILTIN_INSTRUCTIONS_NAME.casefold():
+        raise ValueError("Saved instructions: the name “Built-in” is reserved.")
+    try:
+        text = validate_template(raw["text"], f"{prefix} text")
+    except ValueError as error:
+        raise ValueError(f"{error}.") from None
+    return {"id": raw["id"], "name": name, "text": text}
+
+
+def validate_instructions(value: Any) -> List[Dict[str, str]]:
+    """The saved entries ``[{id, name, text}]`` in order (names trimmed), or
+    ValueError with the sentence System shows (Built-in is not counted)."""
+    if not isinstance(value, list):
+        raise ValueError("Saved instructions must be a list.")
+    if len(value) > MAX_SAVED_INSTRUCTIONS:
+        raise ValueError(
+            f"Saved instructions: at most {MAX_SAVED_INSTRUCTIONS} entries besides "
+            "Built-in."
+        )
+    entries: List[Dict[str, str]] = []
+    ids: Dict[str, int] = {}
+    names: Dict[str, int] = {}
+    for number, raw in enumerate(value, 1):
+        item = _instruction_entry(raw, number)
+        if item["id"] in ids:
+            raise ValueError(
+                f"Saved instructions: entry {number} repeats the id of entry "
+                f"{ids[item['id']]}."
+            )
+        key = item["name"].casefold()
+        if key in names:
+            raise ValueError(
+                f"Saved instructions: entry {number} name “{item['name']}” is "
+                "already used."
+            )
+        ids[item["id"]] = number
+        names[key] = number
+        entries.append(item)
+    return entries
+
+
+def validate_default_instructions(value: Any, entries) -> Dict[str, str]:
+    """``{gguf: id, hf: id}``, each Built-in or an id of ``entries``."""
+    if not isinstance(value, dict) or set(value) != set(INSTRUCTION_ENGINES):
+        raise ValueError("Default instructions must name GGUF and HuggingFace.")
+    ids = {BUILTIN_INSTRUCTIONS_ID} | {item["id"] for item in entries}
+    for engine in INSTRUCTION_ENGINES:
+        if not isinstance(value[engine], str) or value[engine] not in ids:
+            raise ValueError(
+                f"Default for {ENGINE_LABELS[engine]} must be one of the saved "
+                "instructions."
+            )
+    return {engine: value[engine] for engine in INSTRUCTION_ENGINES}

pyproject.toml

@@ -1,7 +1,7 @@
 [project]
 name = "promptmanager"
 description = "A powerful ComfyUI custom node that extends the standard text encoder with persistent prompt storage, advanced search capabilities, and an automatic image gallery system using SQLite."
-version = "3.4.0"
+version = "3.4.1"
 license = {file = "LICENSE"}
 requires-python = ">=3.12"
 dependencies = ["watchdog>=2.1.0", "Pillow>=8.0.0"]

requirements.txt

@@ -1,4 +1,4 @@
 # Runtime dependencies for PromptManager.
 # aiohttp, numpy and torch come from ComfyUI itself and are not listed here.
-watchdog>=2.1.0              # Output directory monitoring
+watchdog>=2.1.0               # Output directory monitoring
 Pillow>=8.0.0                # Image metadata extraction and thumbnails

tests/browser/prompt-inspector.spec.mjs

@@ -320,3 +320,44 @@ test('copy toast and fallback dialog',async({page})=>{
     await expect(fallback).toContainText('Automatic clipboard access requires a secure browser context.');
     await page.keyboard.press('Escape');await expect(fallback).toBeHidden();await expect(copy).toBeFocused();
 });
+
+// #542 D191: "All N eligible nodes" previews every node, sends one after another and names each refusal.
+test('All eligible nodes previews each node, sends in node id order and names a refusal',async({page,context},testInfo)=>{
+    const host=await context.newPage();await host.goto('/prompt_manager/workspace#/overview');
+    await host.evaluate(async()=>{
+        const {createBridgeHost}=await import('/prompt_manager/js/shared/toolkit/prompt-bridge.js');
+        const targets=['12','3','7'].map(id=>({id,label:id==='7'?'Edited in ComfyUI':'Prompt Manager (+/-)',type:'PromptManagerPair',roles:['positive','negative']}));
+        window.hostValues=Object.fromEntries(targets.map(target=>[target.id,{positive:`Existing ${target.id}`,negative:'Existing negative'}]));window.applied=[];
+        window.fixtureHost=createBridgeHost({origin:location.origin,namespace:'/',label:'Test ComfyUI',adapter:{
+            listTargets:()=>targets,
+            preview:(id,roles)=>{const target=targets.find(item=>item.id===id);return{preview:{target,fields:Object.entries(roles).map(([role,after])=>({role,before:window.hostValues[id][role],after}))},snapshot:{id,roles}};},
+            apply:({id,roles})=>{if(id==='7')throw new Error('Workflow or prompt changed. Preview again.');Object.assign(window.hostValues[id],roles);window.applied.push(id);return{targetId:id,values:roles};},
+        }});
+    });
+    try {
+        await page.goto(workspace);await select(page,'0:shared/same.png');await details(page).getByRole('button',{name:/^Send prompt pair to ComfyUI: /}).click();
+        const sender=dialog(page);const nodes=sender.getByRole('combobox',{name:'Destination node',exact:true});
+        await sender.getByRole('combobox',{name:'ComfyUI window',exact:true}).selectOption({label:'Test ComfyUI'});
+        await expect(nodes.locator('option')).toHaveText(['Choose a destination node','#12 Prompt Manager (+/-)','#3 Prompt Manager (+/-)','#7 Edited in ComfyUI','All 3 eligible nodes']);
+        await expect(nodes).toHaveValue('');
+        await nodes.selectOption({label:'All 3 eligible nodes'});
+        await expect(sender.getByRole('status')).toHaveText('Sending to all 3 eligible nodes in Test ComfyUI. Apply to send it, or preview the changes first.');
+        await page.screenshot({path:testInfo.outputPath('send-all-option.png')});
+        await sender.getByRole('button',{name:'Preview changes',exact:true}).click();
+        const reviews=sender.locator('section.prompt-sender-node');
+        await expect(reviews.locator('> h4')).toHaveText(['#3 Prompt Manager (+/-)','#7 Edited in ComfyUI','#12 Prompt Manager (+/-)']);
+        await expect(sender.getByRole('region',{name:'#12 Prompt Manager (+/-)',exact:true})).toContainText('Existing 12');
+        expect(await host.evaluate(()=>window.applied)).toEqual([]);
+        await sender.getByRole('button',{name:'Apply to ComfyUI',exact:true}).click();
+        await expect(sender.getByRole('alert')).toHaveText('Sent to 2 of 3 nodes in Test ComfyUI. #7 Edited in ComfyUI: Workflow or prompt changed. Preview again.');
+        expect(await host.evaluate(()=>window.applied)).toEqual(['3','12']);
+        expect(await host.evaluate(()=>window.hostValues['7'].positive)).toBe('Existing 7');
+        await page.screenshot({path:testInfo.outputPath('send-all-result.png')});
+        await page.setViewportSize({width:390,height:844});
+        await sender.getByRole('button',{name:'Preview changes',exact:true}).click();await expect(reviews).toHaveCount(3);
+        await reviews.last().scrollIntoViewIfNeeded();
+        expect(await page.evaluate(()=>document.querySelector('dialog.prompt-sender').scrollWidth<=document.querySelector('dialog.prompt-sender').clientWidth+1)).toBe(true);
+        await page.screenshot({path:testInfo.outputPath('send-all-mobile.png')});
+        const apply=sender.getByRole('button',{name:'Apply to ComfyUI',exact:true});await apply.focus();await expect(apply).toBeFocused();
+    } finally {await host.evaluate(()=>window.fixtureHost.dispose());await host.close();}
+});

tests/browser/server.py

@@ -22,6 +22,9 @@ from PIL.PngImagePlugin import PngInfo
 from tests.browser.folder_trash import close_trash, replace_folder
 from tests.browser.malloc_tuning import pin_mmap_threshold
 from tests.browser.request_hold import register_request_holds
+from tests.browser.thumbnail_location_fixture import (
+    register_thumbnail_location_commands,
+)
 from tests.browser import slow_reset_watch
 from tests.browser.fast_reset import SEED_ON_LIVE_ENV, ScratchSeeder
 from tests.browser.workspace_activity_fixture import register_activity_commands
@@ -85,6 +88,9 @@ class TestModel:
     suggestions: list | None = None
     # The engine's model table (``py/autotag.py`` MODELS), set at startup.
     models_config: dict = {}
+    # Where the WD14 label lists live (the Skipped tags preview, #431), set at
+    # startup; the tagging fixture writes or removes a small list there.
+    models_dir = None
 
     def get_models_status(self) -> dict:
         from py.autotag import package_fields
@@ -115,21 +121,26 @@ class TestModel:
         return ["generated", Path(image_path).parent.parent.name]
 
     def generate_tag_suggestions(
-        self, image_path: str, *, limit: int, **kwargs: object
+        self, image_path: str, *, limit: int, skip=None, **kwargs: object
     ) -> list[tuple[str, float | None]]:
-        """Fixed scored suggestions (WD14) or unscored ones (language models)."""
+        """Fixed scored suggestions (WD14) or unscored ones (language models),
+        without the ones ``skip`` hides before the limit, as the engine does
+        (#431)."""
         scored = self.loaded is not None and self.loaded.startswith("wd14")
         if self.suggestions is not None:
-            return [
+            pairs = [
                 (name, confidence if scored else None)
-                for name, confidence in self.suggestions[:limit]
+                for name, confidence in self.suggestions
             ]
-        names = ["sandstone", "desert", "arch", "sky", "rock", "dune", "canyon"]
-        names += [f"tag_{index:02d}" for index in range(100)]
-        return [
-            (name, round(0.98 - index * 0.008, 3) if scored else None)
-            for index, name in enumerate(names[:limit])
-        ]
+        else:
+            names = ["sandstone", "desert", "arch", "sky", "rock", "dune", "canyon"]
+            names += [f"tag_{index:02d}" for index in range(100)]
+            pairs = [
+                (name, round(0.98 - index * 0.008, 3) if scored else None)
+                for index, name in enumerate(names)
+            ]
+        kept = [pair for pair in pairs if skip is None or not skip.matches(pair[0])]
+        return kept[:limit]
 
     def download_model(self, model_type: str, progress_callback=None) -> bool:
         raise AssertionError("browser tests never download a model")
@@ -233,6 +244,7 @@ def create_app(root: Path) -> web.Application:
 
     TestModel.models_config = autotag.MODELS
     model = TestModel()
+    model.models_dir = root / "models"
     autotag.get_autotag_service = lambda: model
     api = PromptManagerAPI()
     api.add_routes(routes)
@@ -240,6 +252,7 @@ def create_app(root: Path) -> web.Application:
     library_editor_commands = register_library_editor_commands(routes, api, root)
     register_vocabulary_commands(routes, api, root)
     restore_sources = register_source_change_commands(routes, api)
+    reset_thumbnail_location = register_thumbnail_location_commands(routes, api, root)
     register_tagging_commands(routes, api, root, model, on_reset=restore_sources)
     register_review_commands(routes, api, root)
     register_collections_commands(routes, api, root)
@@ -451,6 +464,8 @@ def create_app(root: Path) -> web.Application:
         restore_sources()
         # No preview queued by the last test may land in the new fixture.
         await api._run_in_executor(api.close_auto_thumbnails)
+        # Previews inside each source again (#320).
+        await api._run_in_executor(reset_thumbnail_location)
         library_editor_commands.reset()
         await api._run_in_executor(reset_logs)
         data = await request.json() if request.can_read_body else {}
@@ -595,6 +610,7 @@ def create_app(root: Path) -> web.Application:
         history_commands.reset()
         library_editor_commands.reset()
         reveal_stub.reset()
+        await api._run_in_executor(reset_thumbnail_location)
         history_fixture = None
         manifest = await api._run_in_executor(
             seeder.run,

tests/browser/system-concept.spec.mjs

@@ -162,13 +162,15 @@ async function serverJson(request, url) {
 }
 
 const number = value => value.toLocaleString('en-US');
+// The sidebar's Images count (state.mjs), which System's Images metric shows (#555).
+const IMAGES_COUNT_URL = '/prompt_manager/images/output?mode=workspace&limit=1';
 
 /** The concept's shell and Overview with the recorded deviations applied, given the server's real overview. */
-function mapOverviewConcept(reference, overview) {
+function mapOverviewConcept(reference, overview, images) {
     // D165: the discreet legacy-pages line follows the settings layout.
     reference = { ...reference, tree: [...reference.tree, 'p.legacy-pages.small'] };
     const relabel = { 'Database integrity': 'Not checked', 'Positive prompts': number(overview.library.positive_prompts),
-        'Negative variants': number(overview.library.negative_variants), Images: number(overview.images.indexed) };
+        'Negative variants': number(overview.library.negative_variants), Images: number(images) };
     const rows = {
         // D93: the real pending count; Review metadata opens Needs review (the concept's go-review).
         '3 ambiguous image links': row => ({ ...row,
@@ -179,8 +181,9 @@ function mapOverviewConcept(reference, overview) {
         'One display configuration': row => ({ ...row, description: 'Grid and density settings are shared across views.' }),
         // D93: the real sources, not samples.
         '2 sample output sources': row => ({ ...row, title: `${number(overview.sources.effective)} output sources` }),
-        // D96: the dialog shows runs by category and library totals, not prompt, tag or date usage (D153: no ratings).
-        Statistics: row => ({ ...row, description: 'Runs by category, with library totals.' }),
+        // D96: the dialog shows runs by category and database record counts, not prompt, tag or date usage (D153: no
+        // ratings; #555: the counts are labelled as records, not as the Library or Images page counts).
+        Statistics: row => ({ ...row, description: 'Runs by category, with database record counts.' }),
     };
     const surfaces = reference.columns.surfaces.map(surface => ({ ...surface,
         rows: surface.rows.map(row => (rows[row.title] ?? (value => value))(row)) }));
@@ -218,6 +221,8 @@ async function conceptOverview(page, theme) {
 async function productionOverview(page, theme) {
     await openProduction(page, 'system/overview', theme);
     await expect(page.locator('#workspace-main .summary-metrics')).toBeVisible();
+    // #555: the Images metric is the shell's Images count: compare once it was read.
+    await expect(page.locator('#workspace-main .summary-metrics > .metric:nth-child(3) strong')).toHaveText(/^[\d,]+$/);
     // The thumbnail row is its own read (I2): compare once it answered.
     await expect(page.locator('#workspace-main .operation h3').filter({ hasText: 'thumbnails' })).toHaveText('No missing thumbnails');
     // So is the backup row (S9).
@@ -231,6 +236,7 @@ for (const theme of THEMES) for (const [width, height] of SIZES) {
     test(`system shell and overview match the concept ${theme} ${width}x${height}`, async ({ page, request }, testInfo) => {
         await page.setViewportSize({ width, height });
         const overview = await serverJson(request, '/prompt_manager/system/overview');
+        const images = (await serverJson(request, IMAGES_COUNT_URL)).total;
         // The fixture's thumbnails all exist, so the concept's "No missing thumbnails" is also the real title.
         expect((await serverJson(request, '/prompt_manager/images/thumbnails/status')).pending).toBe(0);
         const concept = await conceptOverview(page, theme);
@@ -239,7 +245,7 @@ for (const theme of THEMES) for (const [width, height] of SIZES) {
         await page.screenshot({ path: testInfo.outputPath(`concept-system-${theme}-${width}.png`), fullPage: true });
         const production = await productionOverview(page, theme);
         await page.screenshot({ path: testInfo.outputPath(`production-system-${theme}-${width}.png`), fullPage: true });
-        expect(diffInventory(mapOverviewConcept(concept, overview), production)).toEqual([]);
+        expect(diffInventory(mapOverviewConcept(concept, overview, images), production)).toEqual([]);
         expect(production.pageScroll).toBe(false);
     });
 }
@@ -265,8 +271,9 @@ const UNMAPPED_PATHS = [
 test('system comparison detects mutations', async ({ page, request }) => {
     await page.setViewportSize({ width: 1600, height: 1100 });
     const overview = await serverJson(request, '/prompt_manager/system/overview');
+    const images = (await serverJson(request, IMAGES_COUNT_URL)).total;
     const concept = await conceptOverview(page, 'dark');
-    const expected = mapOverviewConcept(concept, overview);
+    const expected = mapOverviewConcept(concept, overview, images);
     const production = await productionOverview(page, 'dark');
     expect(diffInventory(expected, production)).toEqual([]);
     // Unmapped, the concept differs exactly where a deviation is recorded, and nowhere else.
@@ -290,7 +297,7 @@ test('system comparison detects mutations', async ({ page, request }) => {
 });
 
 /**
- * D96: the concept's table, its rows the real ones; then "Library totals" in the same table markup. D153 (#447): the
+ * D96: the concept's table, its rows the real ones; then "Database records" (#555) in the same table markup. D153 (#447): the
  * concept's "Avg. rating" column and a "Rated images" total are not drawn.
  */
 function mapStatisticsConcept(reference, statistics) {
@@ -302,9 +309,10 @@ function mapStatisticsConcept(reference, statistics) {
         tables: [
             { ...runs, head: runs.head.filter(([, , text]) => text !== 'Avg. rating'),
                 rows: statistics.by_category.map(row => [row.category ?? 'Uncategorized', number(row.runs)]) },
-            { caption: 'Library totals', head: [['th', 'col', 'Total'], ['th', 'col', 'Count']],
-                rows: [['Prompts', number(statistics.totals.total_prompts)], ['Tags', number(statistics.totals.total_tags)],
-                    ['Images', number(statistics.totals.total_images)]] },
+            { caption: 'Database records', head: [['th', 'col', 'Total'], ['th', 'col', 'Count']],
+                rows: [['Prompt records', number(statistics.totals.total_prompts)],
+                    ['Tags on prompts', number(statistics.totals.total_tags)],
+                    ['Image records', number(statistics.totals.total_images)]] },
         ],
     };
 }
@@ -420,7 +428,7 @@ for (const theme of THEMES) test(`statistics and health dialogs match the concep
     expect(diffInventory(mapHealthConcept(concept.health), await page.evaluate(measureDialog)).map(item => item.path))
         .toEqual(['operations.rows.0.title']);
     await page.evaluate(() => { document.querySelector('#modal .operation h3').textContent = 'Integrity check'; });
-    // And a removed "Library totals" table and a changed caption in the statistics dialog.
+    // And a removed "Database records" table and a changed caption in the statistics dialog.
     await page.keyboard.press('Escape');
     await page.locator('#workspace-main .section-nav').getByRole('button', { name: 'Overview', exact: true }).click();
     await page.locator('#workspace-main').getByRole('button', { name: 'Explore', exact: true }).click();
@@ -648,9 +656,10 @@ function mapSourcesConcept(reference, { settings, sources }) {
             // D113: the range ends at the server's core count (the concept's fixed 16) and shows the real worker count.
             return [{ ...row, control: { ...row.control, max: String(settings.cpu_count), value: String(settings.worker_threads) } }];
         }),
-        // D158: the inserted row after the first setting row; D98: "Refresh files" closes the surface.
+        // D158: the inserted row after the first setting row; D196 (#320): the Thumbnail location block after
+        // "Thumbnail generation"; D98: "Refresh files" closes the surface.
         surface: { ...reference.surface, tree: [...reference.surface.tree.slice(0, rowAt + 1), 'div.setting-row',
-            ...reference.surface.tree.slice(rowAt + 1), 'div.operation'] },
+            ...reference.surface.tree.slice(rowAt + 1), 'div.setting-block', 'div.operation'] },
         operations: [...reference.operations, { ...reference.operations[0], title: REFRESH_FILES.title,
             description: REFRESH_FILES.description, actions: [{ ...reference.operations[0].actions[0], text: REFRESH_FILES.label }] }],
     };

tests/browser/system-maintenance-concept.spec.mjs

@@ -64,11 +64,31 @@ function measureMaintenance(mainSelector) {
     };
 }
 
-/** D102: the Metadata cache row says why its review is unavailable and its button is aria-disabled (D93's dimmed style). */
-function mapMaintenanceConcept(reference) {
+/**
+ * D192 (#550, beyond the concept): Database adds "Pair category and tags" after "Unused prompt components", shaped like
+ * the concept's plain Review plan row (Optimize database's).
+ */
+function mapPairRow(reference) {
     return {
         ...reference,
-        surfaces: reference.surfaces.map(surface => ({ ...surface, rows: surface.rows.map(row => row.title !== 'Metadata cache' ? row : {
+        surfaces: reference.surfaces.map(surface => {
+            const plain = surface.rows.find(row => row.title === 'Optimize database');
+            const at = surface.rows.findIndex(row => row.title === 'Unused prompt components');
+            if (!plain || at < 0) return surface;
+            return { ...surface, tree: [...surface.tree, 'div.operation'], rows: [...surface.rows.slice(0, at + 1),
+                { ...plain, title: 'Pair category and tags', description: 'Fill an empty category or tags on prompts older ' +
+                    'Pair node runs saved, from their saved pairs. Only empty fields of never-edited prompts.' },
+                ...surface.rows.slice(at + 1)] };
+        }),
+    };
+}
+
+/** D102: the Metadata cache row says why its review is unavailable and its button is aria-disabled (D93's dimmed style). */
+function mapMaintenanceConcept(reference) {
+    const mapped = mapPairRow(reference);
+    return {
+        ...mapped,
+        surfaces: mapped.surfaces.map(surface => ({ ...surface, rows: surface.rows.map(row => row.title !== 'Metadata cache' ? row : {
             ...row, description: `${row.description} Nothing is cached in this browser.`,
             actions: row.actions.map(action => ({ ...action, opacity: '0.55', cursor: 'not-allowed' })) }) })),
     };
@@ -209,8 +229,8 @@ test('maintenance comparison detects mutations', async ({ page, request }) => {
     const expected = mapMaintenanceConcept(concept);
     const production = await productionMaintenance(page, 'dark');
     expect(diffInventory(expected, production)).toEqual([]);
-    // Unmapped, the section differs only on the D102 row.
-    expect(diffInventory(concept, production).map(item => item.path).sort()).toEqual([
+    // Mapped only for the D192 row, the section differs only on the D102 row.
+    expect(diffInventory(mapPairRow(concept), production).map(item => item.path).sort()).toEqual([
         'surfaces.1.rows.3.actions.0.cursor', 'surfaces.1.rows.3.actions.0.opacity', 'surfaces.1.rows.3.description']);
     const measure = () => page.evaluate(measureMaintenance, '#workspace-main');
     const paths = async () => diffInventory(expected, await measure()).map(item => item.path);

tests/browser/system-tagging-concept.spec.mjs

@@ -33,6 +33,10 @@ test.afterEach(async ({ page, request, browserName }) => {
 const PREVIEW_URL = '/prompt_manager/autotag/batch/preview';
 const MODEL_OPTIONS = ['WD14 SwinV2 · ~400 MB', 'WD14 ViT · ~400 MB', 'GGUF JoyCaption · ~4.5 GB', 'HuggingFace JoyCaption · ~16 GB'];
 const SUGGESTIONS = 'From 1 to 100: the most suggestions Generate shows for one image.';
+const SKIPPED_DESCRIPTION = 'Suggested tags that contain one of these words are hidden. Words are separated by spaces, _ or -; '
+    + 'other characters such as ( ) belong to the word.';
+const DEFAULT_DESCRIPTION = 'The Tag image dialog and batches start from this.';
+const INSTRUCTIONS_DESCRIPTION = 'Instructions for the language-model engines. Built-in can’t be changed; duplicate it to make your own.';
 const BATCH = 'Tag each output image from its own pixels with the model above. Prompts are not changed. Review the scope first.';
 
 /** Runs in the page: Auto-tagging's surface under `mainSelector`: rows, field, actions, operation, geometry and tokens. */
@@ -62,7 +66,7 @@ function measureTagging(mainSelector) {
             text: [...row.firstElementChild.children].map(node => [name(node), text(node), node.localName === 'label' ? node.htmlFor : null]),
             control: control(row), flexWrap: getComputedStyle(row).flexWrap,
             controlBelow: row.lastElementChild.getBoundingClientRect().top >= row.firstElementChild.getBoundingClientRect().bottom - 0.5 })),
-        field: { tree: [...field.children].map(name), label: [text(field.querySelector('label')), field.querySelector('label').htmlFor],
+        field: field && { tree: [...field.children].map(name), label: [text(field.querySelector('label')), field.querySelector('label').htmlFor],
             textarea: { id: field.querySelector('textarea').id, value: field.querySelector('textarea').value,
                 ...css(field.querySelector('textarea'), 'fontSize', 'minHeight', 'backgroundColor', 'color', 'borderTopColor') },
             ...css(field, 'display', 'rowGap', 'fontSize', 'marginTop', 'marginBottom') },
@@ -70,6 +74,31 @@ function measureTagging(mainSelector) {
             ...css(actions, 'display', 'flexWrap', 'columnGap', 'justifyContent'),
             primary: css(actions.querySelector('.ca-primary'), 'backgroundColor', 'color', 'fontSize', 'paddingTop', 'paddingLeft'),
             plain: css(actions.querySelector('button:not(.ca-primary)'), 'backgroundColor', 'color', 'fontSize', 'borderTopColor') },
+        // D202 (#431): the Skipped tags block (the concept has none).
+        skipped: (block => block && { tree: [...block.children].map(name), key: block.dataset.key,
+            text: [...block.firstElementChild.children].map(node => [node.localName, text(node), node.localName === 'label' ? node.htmlFor : null]),
+            add: [...block.querySelector('.skip-add').children].map(node => [name(node), node.id, node.getAttribute('placeholder'), text(node)]),
+            preview: [text(block.querySelector('.skip-preview')), block.querySelector('.skip-preview').getAttribute('role')],
+            ...css(block, 'paddingTop', 'paddingBottom', 'borderTopWidth', 'borderTopColor'),
+            label: css(block.querySelector('label'), 'fontSize', 'fontWeight', 'color'),
+            description: css(block.querySelector('.setting-block-text p'), 'fontSize', 'color', 'marginTop'),
+            input: css(block.querySelector('input'), 'fontSize', 'backgroundColor', 'color', 'borderTopColor') })(
+            surface.querySelector(':scope > .setting-block[data-setting="tag-skipped"]')),
+        // D203 (#431): Saved instructions (the concept has a template field instead).
+        instructions: (block => block && { tree: [...block.children].map(name), key: block.dataset.key,
+            text: [...block.firstElementChild.children].map(node => [node.localName, text(node)]),
+            list: [...block.querySelectorAll('[role="option"]')].map(option => [text(option.firstElementChild),
+                [...option.querySelectorAll('.badges > .chip')].map(chip => [text(chip), chip.className]), option.getAttribute('aria-selected')]),
+            listRole: block.querySelector('.instruction-list').getAttribute('role'),
+            actions: [...block.querySelectorAll('.instruction-actions > button')].map(item => [text(item), item.className, item.disabled]),
+            editor: [...block.querySelectorAll('.instruction-editor .field')].map(item => [text(item.querySelector('label > span')),
+                item.querySelector('input, textarea').value, item.querySelector('input, textarea').readOnly]),
+            note: text(block.querySelector('#instruction-note')),
+            layout: getComputedStyle(block.querySelector('.instructions-layout')).gridTemplateColumns.split(' ').length,
+            ...css(block, 'paddingTop', 'paddingBottom', 'borderTopWidth', 'borderTopColor'),
+            label: css(block.querySelector('label'), 'fontSize', 'fontWeight', 'color'),
+            textarea: css(block.querySelector('textarea'), 'fontSize', 'backgroundColor', 'borderTopColor') })(
+            surface.querySelector(':scope > .setting-block[data-setting="tag-instructions"]')),
         operations: [...surface.querySelectorAll(':scope > .operation')].map(row => ({ tree: [...row.children].map(name),
             title: text(row.querySelector('h3')), description: text(row.querySelector('p')),
             actions: [...row.querySelectorAll('.row-actions > button')].map(item => [text(item), item.className]) })),
@@ -103,13 +132,21 @@ function measureTagging(mainSelector) {
  * The concept's Auto-tagging with the recorded deviations applied, for the fixture (all engines on disk, none loaded).
  * `phone` is a viewport at the concept's 700px breakpoint or below.
  */
-function mapTaggingConcept(reference, { template, phone }) {
+function mapTaggingConcept(reference, { builtin, saved, phone }) {
     const [model, existing, general, character] = reference.rows;
     const [preview] = reference.actions.buttons;
+    // D203: Built-in first, then the saved entries, in each default select.
+    const names = ['Built-in', ...saved.map(entry => entry.name)];
+    const defaultRow = (engine, long) => ({ ...existing,
+        text: [['label', `Default for ${long}`, `instruction-default-${engine}`], ['p', DEFAULT_DESCRIPTION, null]],
+        control: { ...existing.control, id: `instruction-default-${engine}`, options: names.map(label => [label, false]),
+            selected: names[1] } });
     return {
         ...reference,
-        // D133 adds a row after the thresholds; D134 adds the operation after the actions.
-        tree: [...reference.tree.slice(0, 6), 'div.setting-row', ...reference.tree.slice(6), 'div.operation'],
+        // D133 adds a row after the thresholds, D202 the Skipped tags block after it; D203 replaces the template field
+        // with Saved instructions, the two default rows and their note; D134 adds the operation after the actions.
+        tree: [...reference.tree.slice(0, 6), 'div.setting-row', 'div.setting-block', 'div.setting-block', 'div.setting-row',
+            'div.setting-row', 'p.instruction-reset.small', reference.tree[7], 'div.operation'],
         rows: [
             // D132 (OQ5, OQ6): the four real engines with their download size, and the chosen one's live status.
             { ...model, text: [model.text[0], ['p', 'Downloaded. Not loaded.', null]],
@@ -120,16 +157,49 @@ function mapTaggingConcept(reference, { template, phone }) {
             // D133: the persisted suggestion count, on the concept's number row.
             { ...general, text: [['label', 'Suggestions per image', 'tag-suggestions'], ['p', SUGGESTIONS, null]],
                 control: { ...general.control, id: 'tag-suggestions', value: '10' } },
+            // D203: the default of each language-model engine (the fixture's saved entry is both), on the concept's
+            // select row.
+            defaultRow('gguf', 'GGUF JoyCaption'), defaultRow('hf', 'HuggingFace JoyCaption'),
         ],
-        // The saved template (the server's default until one is saved) replaces the concept's sample text.
-        field: { ...reference.field, textarea: { ...reference.field.textarea, value: template } },
+        // D203: Saved instructions in the concept's setting-row tokens (as D202), Built-in selected and read-only.
+        instructions: { tree: ['div.setting-block-text', 'div.instructions-layout'], key: 'autotag_instructions',
+            text: [['label', 'Saved instructions'], ['p', `${INSTRUCTIONS_DESCRIPTION} ${saved.length} of 20 saved · Built\u2011in is not counted.`]],
+            list: [['Built-in', [['Read-only', 'chip']], 'true'],
+                ...saved.map((entry, index) => [entry.name, index === 0
+                    ? [['Default for GGUF', 'chip blue'], ['Default for HuggingFace', 'chip blue']] : [], 'false'])],
+            listRole: 'listbox',
+            actions: [['+ New', '', false], ['Duplicate', '', false], ['Delete', 'danger', true]],
+            editor: [['Name', 'Built-in', true], ['Text', builtin, true]],
+            note: 'Built-in instructions can’t be changed. Duplicate them to make your own.',
+            layout: phone ? 1 : 2,
+            paddingTop: reference.row.paddingTop, paddingBottom: reference.row.paddingBottom,
+            borderTopWidth: reference.row.borderTopWidth, borderTopColor: reference.row.borderTopColor,
+            label: reference.label,
+            textarea: { fontSize: reference.field.textarea.fontSize, backgroundColor: reference.field.textarea.backgroundColor,
+                borderTopColor: reference.field.textarea.borderTopColor } },
+        // D202 (#431): the Skipped tags block in the concept's setting-row tokens: its label and description as a row's,
+        // the row's padding and rule above, the concept's field input; an empty list says so.
+        skipped: { tree: ['div.setting-block-text', 'div.skip-add', 'p.skip-problem.small', 'div.skip-chips.tags', 'p.skip-preview.small'],
+            key: 'autotag_skipped_tags',
+            text: [['label', 'Skipped tags', 'tag-skipped-input'], ['p', SKIPPED_DESCRIPTION, null]],
+            add: [['input', 'tag-skipped-input', 'Add a word or words', ''], ['button', 'tag-skipped-add', null, 'Add']],
+            preview: ['No tags are skipped.', 'status'],
+            paddingTop: reference.row.paddingTop, paddingBottom: reference.row.paddingBottom,
+            borderTopWidth: reference.row.borderTopWidth, borderTopColor: reference.row.borderTopColor,
+            label: reference.label,
+            description: { fontSize: reference.description.fontSize, color: reference.description.color,
+                marginTop: reference.description.marginTop },
+            input: { fontSize: '12px', backgroundColor: reference.field.textarea.backgroundColor, color: reference.field.textarea.color,
+                borderTopColor: reference.field.textarea.borderTopColor } },
+        // D203: no template field.
+        field: null,
         // D132: Download (for an engine already on disk, "Download again") and Unload replace the two simulated jobs.
         actions: { ...reference.actions, buttons: [preview, ['Download again', ''], ['Unload', '']] },
         // D134: the prompt-tag batch, reviewed first.
         operations: [{ tree: ['div', 'div.row-actions'], title: 'Tag output images', description: BATCH, actions: [['Review', '']] }],
         // D132 (#398): every select shows its whole chosen option at every width (at 390 the concept's 120px cap cuts
         // them; production lets each grow past it).
-        selectsFit: reference.selectsFit.map(() => true),
+        selectsFit: [...reference.selectsFit, true, true].map(() => true),
     };
 }
 
@@ -153,7 +223,9 @@ async function productionTagging(page, theme) {
 async function savedTemplate(request, page) {
     const response = await request.get('/prompt_manager/settings');
     await expect(response).toBeOK();
-    return { template: (await response.json()).settings.autotag_template, phone: page.viewportSize().width <= 700 };
+    const { settings } = await response.json();
+    return { builtin: settings.autotag_builtin_instructions, saved: settings.autotag_instructions,
+        phone: page.viewportSize().width <= 700 };
 }
 
 for (const theme of THEMES) for (const [width, height] of SIZES) {
@@ -177,14 +249,15 @@ for (const theme of THEMES) for (const width of [390, 320]) {
         await page.locator('#workspace-main #tag-existing').selectOption('replace_after_review');
         await page.locator('#workspace-main section.surface').screenshot({ path: testInfo.outputPath(`production-tagging-selects-${theme}-${width}.png`) });
         const selects = page.locator('#workspace-main section.surface > .setting-row > select');
-        await expect(selects).toHaveCount(2);
-        for (let index = 0; index < 2; index += 1) {
+        // D203 adds the two per-engine default selects.
+        await expect(selects).toHaveCount(4);
+        for (let index = 0; index < 4; index += 1) {
             const select = selects.nth(index);
             const values = await select.evaluate(node => [...node.options].map(option => option.value));
             for (const value of values) {
                 await select.selectOption(value);
                 const measured = await page.evaluate(measureTagging, '#workspace-main');
-                expect(measured.selectsFit, `${await select.getAttribute('id')}=${value}`).toEqual([true, true]);
+                expect(measured.selectsFit, `${await select.getAttribute('id')}=${value}`).toEqual([true, true, true, true]);
                 expect(measured.pageScroll, value).toBe(false);
             }
         }
@@ -198,12 +271,16 @@ test('auto-tagging comparison detects mutations', async ({ page, request }) => {
     const expected = mapTaggingConcept(concept, saved);
     const production = await productionTagging(page, 'dark');
     expect(diffInventory(expected, production)).toEqual([]);
-    // Unmapped, the section differs only where D132, D133 and D134 are recorded (and the saved template's text).
-    expect(diffInventory(concept, production).map(item => item.path.split('.').slice(0, 3).join('.'))
+    // Unmapped, the section differs only where D132, D133, D134, D202 and D203 are recorded (and the saved template's text).
+    // (The concept has no Skipped tags block, so every path under it is one D202 difference.)
+    expect(diffInventory(concept, production).map(item => (/^(skipped|instructions|field)\b/.test(item.path) ? item.path.split('.')[0]
+        : item.path.split('.').slice(0, 3).join('.')))
         .filter((path, index, all) => all.indexOf(path) === index).sort()).toEqual([
-        'actions.buttons.1', 'actions.buttons.2', 'field.textarea.value', 'operations.0.actions', 'operations.0.description',
-        'operations.0.title', 'operations.0.tree', 'operations.length', 'rows.0.control', 'rows.0.text', 'rows.4.control', 'rows.4.controlBelow',
-        'rows.4.flexWrap', 'rows.4.text', 'rows.4.tree', 'rows.length', 'tree.6', 'tree.7', 'tree.8', 'tree.9', 'tree.length'].sort());
+        'actions.buttons.1', 'actions.buttons.2', 'field', 'instructions', 'operations.0.actions', 'operations.0.description',
+        'operations.0.title', 'operations.0.tree', 'operations.length', 'rows.0.control', 'rows.0.text',
+        ...[4, 5, 6].flatMap(row => ['control', 'controlBelow', 'flexWrap', 'text', 'tree'].map(key => `rows.${row}.${key}`)),
+        'rows.length', 'selectsFit.2', 'selectsFit.3', 'selectsFit.length', 'skipped',
+        ...Array.from({ length: 8 }, (_, index) => `tree.${index + 6}`), 'tree.length'].sort());
     const measure = () => page.evaluate(measureTagging, '#workspace-main');
     const paths = async () => diffInventory(expected, await measure()).map(item => item.path);
     // A removed row.
@@ -254,8 +331,8 @@ test('auto-tagging at 390 wraps only the engine row', async ({ page, request })
     const concept = await conceptTagging(page, 'dark');
     const production = await productionTagging(page, 'dark');
     expect(diffInventory(mapTaggingConcept(concept, await savedTemplate(request, page)), production)).toEqual([]);
-    expect(production.rows.map(row => row.flexWrap)).toEqual(['wrap', 'nowrap', 'nowrap', 'nowrap', 'nowrap']);
-    expect(production.selectsFit).toEqual([true, true]);
+    expect(production.rows.map(row => row.flexWrap)).toEqual(['wrap', 'nowrap', 'nowrap', 'nowrap', 'nowrap', 'nowrap', 'nowrap']);
+    expect(production.selectsFit).toEqual([true, true, true, true]);
 });
 
 /** Runs in the page: the open review dialog: its title, body and the concept's tokens. */

tests/browser/tagging-canonical-comparison.mjs

@@ -92,6 +92,8 @@ export function cardActionsInventory(card) {
     };
 }
 
+// #431: the fixture's saved "Describe the image" entry, the default of both engines (workspace_tagging_fixture.py).
+export const FIXTURE_INSTRUCTIONS_ID='d35c71be0a1e';
 // D84 (plan D61): the legacy engines' values, labels and sizes, GGUF JoyCaption in the concept's Ollama slot.
 const MODEL_LABELS=Object.freeze({'wd14-swinv2':['wd14-swinv2','WD14 SwinV2 · ~400 MB'],'wd14-vit':['wd14-vit','WD14 ViT · ~400 MB'],
     ollama:['gguf','GGUF JoyCaption (Recommended) · ~4.5 GB'],huggingface:['hf','HuggingFace JoyCaption · ~16 GB']});
@@ -106,17 +108,24 @@ const CONCEPT_LABELS=Object.freeze({'WD14 SwinV2 · fast classifier':'WD14 SwinV
  *   (`chip`: a concept `.chip` inventory, the heading's size chip) around the row's own text (12px) in the checked
  *   row's colours (accent border, `--soft-blue`);
  * - D84 (plan D61): the legacy engine labels and values, and the server's default instructions (`instructions`);
+ * - D204 (#431): a "Saved instructions" select (`picker`: its value and options) before the instructions, on the
+ *   concept's select field tokens;
  * - D91 (plan D68): a Suggestions count field after the model's own fields, on the concept's number field tokens
  *   (`numberField`: the concept's General confidence field) with the configured count (`limit`);
  * - D29: the prototype's "Sample suggestions from …" status reads "Suggestions from …".
  * The opened state is compared unmapped: both show the concept's on-screen "Generate suggestions with the selected
  * model before approving." (its renderTagModelOptions, a1062–1076, replaces the markup's sentence at once).
  */
-export function mapConceptTagging(reference,{instructions,limit=10,chip,numberField}) {
+export function mapConceptTagging(reference,{instructions,limit=10,chip,numberField,
+    picker={value:FIXTURE_INSTRUCTIONS_ID,options:[['builtin','Built-in'],[FIXTURE_INSTRUCTIONS_ID,`${instructions} · default`]]}}) {
     const [select,...own]=reference.modelPanel.fields;
+    // D204 (#431): a "Saved instructions" select on the concept's select field, before the instructions.
+    const pickField={...select,label:'Saved instructions',control:{...select.control,id:'image-tag-instructions-pick',
+        value:picker.value,options:picker.options}};
     const suggestionsField={...numberField,label:'Suggestions',control:{...numberField.control,id:'image-suggestion-limit',
         value:String(limit),min:'1',max:'100',step:'1'}};
-    const mappedOwn=own.map(field=>field.control.id==='image-tag-instructions'?{...field,control:{...field.control,value:instructions}}:field);
+    const mappedOwn=own.flatMap(field=>field.control.id==='image-tag-instructions'
+        ?[pickField,{...field,control:{...field.control,value:instructions}}]:[field]);
     const rows=reference.suggestions.rows.map(row=>({...row,
         control:row.control?.kind==='checkbox'&&row.control.checked?{kind:'remove',label:`Remove ${row.name}`}:row.control,
         borderTopLeftRadius:chip.borderTopLeftRadius}));

tests/browser/thumbnail_location_fixture.py

@@ -0,0 +1,170 @@
+"""The thumbnail location on the test server (#320), undone by every reset.
+
+Folder mode is reachable from config.json and tests only until the Move
+thumbnails job lands, so page tests set it here, inside the server's root:
+
+- ``POST /__test__/thumbnail-location`` ``{"mode": "folder"}`` (or
+  ``"source"``): previews live in ``<root>/thumbs/<key>`` from now on (a new
+  folder with Prompt Manager's marker).
+- ``GET /__test__/thumbnail-files``: the preview files in the thumbnail
+  folder and whether any source grew a ``thumbnails/`` folder.
+- ``POST /__test__/thumbnail-folder/remove``: the thumbnail folder goes, as
+  when its drive is unplugged; the server notices it on its next check.
+"""
+
+from __future__ import annotations
+
+import shutil
+from pathlib import Path
+from typing import TYPE_CHECKING, Callable
+
+from aiohttp import web
+
+if TYPE_CHECKING:
+    from py.api import PromptManagerAPI
+
+FOLDER_NAME = "thumbs"
+
+
+def register_thumbnail_location_commands(
+    routes: web.RouteTableDef, api: PromptManagerAPI, root: Path
+) -> Callable[[], None]:
+    """Register the commands; returns the reset every reset runs."""
+    from py.api import preview_location, preview_store
+    from py.api import thumbnail_location, thumbnail_move_plan
+    from py.config import PromptManagerConfig
+    from py.config_store import get_config_store
+
+    folder = root / FOLDER_NAME
+    default = root / "default-thumbs"
+    custom = root / "custom-thumbs"  # a folder a page types in
+    journal = root / "data" / "thumbnail-move.json"
+    # The move's journal and default folder live in this server's root, never
+    # in the checkout's data folder.
+    thumbnail_move_plan.journal_path = lambda: str(journal)
+    thumbnail_move_plan.default_path = lambda: str(default)
+    thumbnail_location.default_path = lambda: str(default)
+    api.recover_thumbnail_move()
+
+    def forget_config(config: dict) -> dict:
+        section = config.get("thumbnails")
+        if isinstance(section, dict):
+            section.pop("location", None)
+        return config
+
+    real_free = thumbnail_move_plan._free
+
+    def reset() -> None:
+        thumbnail_move_plan._free = real_free
+        preview_store.configure(None)
+        PromptManagerConfig.THUMBNAIL_LOCATION = None
+        store = get_config_store()
+        config, _revision = store.read()
+        if (
+            isinstance(config.get("thumbnails"), dict)
+            and "location" in config["thumbnails"]
+        ):
+            store.commit(forget_config, expected_revision=None)
+        for path in (folder, default, custom):
+            shutil.rmtree(path, ignore_errors=True)
+        journal.unlink(missing_ok=True)
+
+    def use(mode: str) -> dict:
+        reset()
+        if mode == "source":
+            return {"mode": "source"}
+        folder.mkdir()
+        marker_id = preview_location.init_folder(str(folder), created_by_pm=True)
+        location = preview_store.configure(
+            {
+                "mode": "folder",
+                "path": str(folder),
+                "id": marker_id,
+                "install": "browser-tests",
+            }
+        )
+        return {"mode": location.mode, "available": location.available}
+
+    @routes.post("/__test__/thumbnail-location")
+    async def set_location(request: web.Request) -> web.Response:
+        data = await request.json()
+        mode = data.get("mode") if isinstance(data, dict) else None
+        if mode not in ("source", "folder"):
+            raise web.HTTPBadRequest()
+        return web.json_response(await api._run_in_executor(use, mode))
+
+    def files() -> dict:
+        setting = preview_store.setting()
+        where = Path(setting.path) if setting.path else folder
+        previews = sorted(
+            path.relative_to(where).as_posix()
+            for path in where.rglob("*_thumb.*")
+            if path.is_file()
+        )
+        sources = [str(path) for path in api._get_all_output_dirs()]
+        return {
+            "folder": previews,
+            "folder_exists": folder.exists() or default.exists() or custom.exists(),
+            "custom_path": str(custom),
+            "source_thumbnails": any(
+                (Path(source) / "thumbnails").exists() for source in sources
+            ),
+        }
+
+    @routes.get("/__test__/thumbnail-files")
+    async def thumbnail_files(_request: web.Request) -> web.Response:
+        return web.json_response(await api._run_in_executor(files))
+
+    def remove() -> bool:
+        setting = preview_store.setting()
+        shutil.rmtree(setting.path or folder, ignore_errors=True)
+        return preview_store.refresh()
+
+    @routes.post("/__test__/thumbnail-folder/remove")
+    async def remove_folder(_request: web.Request) -> web.Response:
+        available = await api._run_in_executor(remove)
+        return web.json_response({"available": available})
+
+    def foreign() -> bool:
+        """Another install recreated the folder: its marker has another id."""
+        setting = preview_store.setting()
+
+        def other(marker: dict) -> None:
+            marker["id"] = "another-install"
+
+        preview_location.write_marker(setting.path, other)
+        return preview_store.refresh()
+
+    @routes.post("/__test__/thumbnail-folder/foreign")
+    async def foreign_folder(_request: web.Request) -> web.Response:
+        return web.json_response({"available": await api._run_in_executor(foreign)})
+
+    def unlisted() -> None:
+        """A source this install no longer lists left its thumbnails here."""
+        setting = preview_store.setting()
+
+        def add(marker: dict) -> None:
+            marker["keys"]["gone-0123abcd"] = {
+                "path": "/gone",
+                "identity": "/gone",
+                "install": setting.install,
+            }
+
+        preview_location.write_marker(setting.path, add)
+        gone = Path(setting.path) / "gone-0123abcd"
+        gone.mkdir()
+        (gone / "x_thumb.webp").write_bytes(b"preview")
+        preview_store.refresh()
+
+    @routes.post("/__test__/thumbnail-folder/unlisted")
+    async def unlisted_source(_request: web.Request) -> web.Response:
+        await api._run_in_executor(unlisted)
+        return web.json_response({"success": True})
+
+    @routes.post("/__test__/thumbnail-space/full")
+    async def space_full(_request: web.Request) -> web.Response:
+        """Every target disk reports 1 byte free until the next reset."""
+        thumbnail_move_plan._free = lambda _path: 1
+        return web.json_response({"success": True})
+
+    return reset

tests/browser/workflows.spec.mjs

@@ -261,3 +261,20 @@ test('prompt deletion requires confirmation and can retry after a network failur
         await expect(await request.get(url)).toBeOK();
     }
 });
+
+// #320: with previews in one folder, the legacy gallery still shows them, made
+// and served from that folder (the fixture's own previews inside the sources
+// are never served then).
+test('the legacy gallery shows thumbnails kept in one folder', async ({ page, request }) => {
+    await expect(await request.post('/__test__/thumbnail-location', { data: { mode: 'folder' } })).toBeOK();
+    const served = page.waitForResponse(response =>
+        response.url().includes('/prompt_manager/images/serve/thumbnails/') && response.status() === 200);
+    await page.goto('/prompt_manager/gallery');
+    await expect(page.locator('#galleryGrid .image-item')).toHaveCount(2);
+    const response = await served; // made in the folder before it was served
+    const name = decodeURIComponent(new URL(response.url()).pathname.split('/serve/thumbnails/')[1]);
+    const files = await (await request.get('/__test__/thumbnail-files')).json();
+    const stem = name.replace(/\.[^.]+$/, '');
+    expect(files.folder.some(file => /^[a-z0-9_-]+-[0-9a-f]{8}\//.test(file)
+        && file.slice(file.indexOf('/') + 1).replace(/\.[^.]+$/, '') === stem)).toBe(true);
+});

tests/browser/workspace-layout-tags-system.spec.mjs

@@ -156,8 +156,9 @@ test('at 390px the window fits the screen, actions stay reachable and the page s
     expect(frame.bottom-frame.top).toBeLessThan(844);
     expect(frame.bottom-frame.top).toBeGreaterThanOrEqual(280);
     expect(await page.evaluate(()=>document.documentElement.scrollWidth)).toBeLessThanOrEqual(390);
-    // The last row's actions can be scrolled to inside the window and fit its width.
-    const last=rows(page).last().getByRole('button',{name:'Rename / merge',exact:true});
+    // The first page's last row's actions can be scrolled to inside the window and fit its width.
+    // Pinned to row 100: reaching it loads the next page (D183), and last() would then follow row 200.
+    const last=rows(page).nth(99).getByRole('button',{name:'Rename / merge',exact:true});
     await last.scrollIntoViewIfNeeded();await expect(last).toBeInViewport();
     const [button]=await boxes(last);const [after]=await boxes(tagWindow(page));
     expect(button.right).toBeLessThanOrEqual(after.right);

tests/browser/workspace-system-backups.spec.mjs

@@ -284,6 +284,23 @@ test('a restore seen finishing elsewhere closes an open restore review and disca
     expect((await serverJson(request, '/__test__/system/backups')).stages).toBe(0);
 });
 
+// #583: in WebKit, while a page.route is armed, a file part of a FormData body is read only when the request goes on;
+// a garbage collection in between dropped the form once nothing referenced it, and the server got an empty file
+// ("Uploaded file is empty"). The page keeps the form until its upload is answered. The route holds the upload
+// through a collection; without the fix WebKit lost the file every time (0/10 in the pinned image). Chromium and
+// Firefox keep the body anyway, so there it only checks that a held upload still opens the review.
+test('a review upload survives a garbage collection while it is in flight', async ({ page, request }) => {
+    const bytes = await backupBytes(request);
+    await page.route(`**${PREVIEW_URL}`, async route => {
+        await page.requestGC();
+        await route.continue();
+    });
+    await openBackups(page);
+    expect((await chooseBackup(page, bytes)).status()).toBe(200);
+    await expect(dialog(page).locator('#modal-title')).toHaveText('Restore preview');
+    expect((await serverJson(request, '/__test__/system/backups')).stages).toBe(1);
+});
+
 test('invalid file shows the validator message; nothing is staged', async ({ page, request }) => {
     const before = await serverJson(request, '/__test__/system/digest');
     await openBackups(page);

tests/browser/workspace-system-maintenance.spec.mjs

@@ -64,7 +64,9 @@ test('the section shows the concept rows; Metadata cache follows Q5 (D102)', asy
             item.querySelector('.row-actions > button').textContent, item.querySelector('.row-actions > button').className]),
     ]))).toEqual([
         ['Database', [['Integrity & relationship checks', 'Check', ''], ['Duplicate prompt text', 'Review plan', ''],
-            ['Optimize database', 'Review plan', ''], ['Unused prompt components', 'Review plan', 'danger']]],
+            ['Optimize database', 'Review plan', ''], ['Unused prompt components', 'Review plan', 'danger'],
+            // D192 (#550): beyond the concept.
+            ['Pair category and tags', 'Review plan', '']]],
         ['Images & cache', [['Missing-file links', 'Review plan', 'danger'], ['Duplicate image files', 'Find duplicates', ''],
             ['Thumbnail cache', 'Review options', ''], ['Metadata cache', 'Review plan', '']]],
     ]);
@@ -177,6 +179,70 @@ test("plan dialog shows the server's scope, protected, backup policy and media l
         expect(await serverJson(request, '/__test__/system/digest')).toEqual(before);
     });
 
+test('D192: Pair category and tags reviews old Pair prompts, keeps an edited one and fills the other (#550)',
+    async ({ page, request }) => {
+        await expect(await request.post('/__test__/system/pair-metadata')).toBeOK();
+        const answers = [];
+        page.on('response', response => { if (response.url().endsWith(PREVIEW_URL)) answers.push(response.json()); });
+        await openMaintenance(page);
+        const pairRow = row(page, 'Pair category and tags');
+        await expect(pairRow.locator('p')).toHaveText('Fill an empty category or tags on prompts older Pair node runs saved, ' +
+            'from their saved pairs. Only empty fields of never-edited prompts.');
+        await pairRow.getByRole('button', { name: 'Review plan', exact: true }).click();
+        const plan = dialog(page);
+        await expect(plan.locator('#modal-body > h3')).toHaveText('Pair category and tags');
+        const answer = await answers[0];
+        expect(answer.operation).toBe('pair_metadata');
+        expect(await gridOf(page)).toEqual([
+            ['Scope', '1 prompt to fill: 1 category, 1 tag set'],
+            ['Protected', '1 edited after it was saved'],
+            ['Backup', `Create and verify before changes (${answer.backup.destination_label})`],
+            ['Media on disk', 'No image file or saved pair is changed.'],
+        ]);
+        await expect(plan.locator('details > summary')).toHaveText('Listed records (3)');
+        await plan.locator('details > summary').click();
+        // Protected rows come first, the Record row last.
+        const lines = (await plan.locator('details > pre').textContent()).split('\n');
+        expect(lines).toHaveLength(3);
+        expect(lines[0]).toBe('S550 harbor · Kept: edited after it was saved; its empty category or tags may be intentional');
+        expect(lines[1]).toMatch(/^S550 lantern · Fills category “night” and 2 tags: s550-glow, s550-warm \(pair \d+\)$/);
+        expect(lines[2]).toMatch(/^Record · The job's report lists every filled field\. Download it to keep it/);
+        await plan.getByRole('button', { name: 'Apply reviewed operation', exact: true }).click();
+        await expect(dialog(page)).toHaveCount(0);
+        await expect(page).toHaveURL(/#\/activity\/[0-9a-f]{32}$/);
+        const job = await ended(request, page.url().split('/').pop());
+        expect([job.title, job.state, job.counters.changed, job.counters.protected])
+            .toEqual(['Pair category and tags', 'finished', 1, 1]);
+        const main = page.locator('#workspace-main');
+        await expect(main.locator('h1')).toHaveText('Pair category and tags');
+        await expect(main.getByRole('button', { name: 'Download report', exact: true })).toBeVisible();
+        // #550 live test: the Changed group lists the path-less record rows as plain text, never an open action.
+        const results = main.getByRole('region', { name: 'Results', exact: true });
+        await results.locator('.outcome-list > button').filter({ hasText: 'Changed' }).click();
+        const records = results.locator('.outcome-files > .file-row');
+        await expect(records).toHaveCount(1);
+        await expect(records.first()).toHaveText(/^Prompt \d+: category “night”; tags s550-glow, s550-warm$/);
+        expect(await records.first().evaluate(node => node.localName)).toBe('div');
+        await expect(results.locator('.outcome-files button')).toHaveCount(0);
+        await expect(results.getByRole('searchbox', { name: 'Filter results' })).toHaveAttribute('placeholder', 'Filter records…');
+        // Protected lists each kept prompt with the review's reason (#550 live re-check).
+        await results.locator('.outcome-list > button').filter({ hasText: 'Protected' }).click();
+        await expect(records).toHaveCount(1);
+        await expect(records.first()).toHaveText(
+            /^Prompt \d+: kept, edited after it was saved; its empty category or tags may be intentional$/);
+        // An empty group says records, not files.
+        await results.locator('.outcome-list > button').filter({ hasText: 'Errors' }).click();
+        await expect(results.locator('.outcome-files > p.empty-state')).toHaveText('No records in this group.');
+        const library = await serverJson(request, '/prompt_manager/library');
+        const lantern = library.items.find(item => item.text === 'S550 lantern');
+        const harbor = library.items.find(item => item.text === 'S550 harbor');
+        const filled = (await serverJson(request, `/prompt_manager/library/${lantern.id}?archive=all`)).positive;
+        expect([filled.category, [...filled.tags].sort()]).toEqual(['night', ['s550-glow', 's550-warm']]);
+        expect((await serverJson(request, `/prompt_manager/library/${harbor.id}?archive=all`)).positive.category).toBeFalsy();
+        await page.goto(`${workspace}#/library`);
+        await expect(page.locator(`article[data-prompt-id="${lantern.id}"] .card-title > .chip`)).toHaveText('night');
+    });
+
 test('a plan with nothing to do shows only Close, never Apply', async ({ page, request }) => {
     const applies = [];
     page.on('request', item => { if (item.url().endsWith(APPLY_URL)) applies.push(item.url()); });

tests/browser/workspace-system-tagging.spec.mjs

@@ -112,13 +112,14 @@ test('model options are the four real engines with size and the description show
     await expect(status(page)).toHaveText('Unsaved changes.');
     // The other rows keep the concept's copy and the saved values (D133 adds Suggestions per image).
     expect(await surface(page).locator(':scope > .setting-row label').allTextContents()).toEqual(['Tagging model', 'Existing tags',
-        'General-tag confidence', 'Character-tag confidence', 'Suggestions per image']);
+        'General-tag confidence', 'Character-tag confidence', 'Suggestions per image', 'Default for GGUF JoyCaption',
+        'Default for HuggingFace JoyCaption']);
     await expect(page.locator('#tag-existing')).toHaveValue('skip');
     await expect(page.locator('#threshold-general')).toHaveValue('0.35');
     await expect(page.locator('#threshold-character')).toHaveValue('0.85');
     await expect(page.locator('#tag-suggestions')).toHaveValue('10');
-    const settings = await serverJson(request, SETTINGS_URL);
-    await expect(page.locator('#tag-template')).toHaveValue(settings.settings.autotag_template);
+    // D203 (#431): Saved instructions replace the template field.
+    await expect(page.locator('#tag-template')).toHaveCount(0);
     // Unload is offered only while a model is loaded (none is).
     await expect(actionOf(page, 'Unload')).toBeDisabled();
 });
@@ -418,3 +419,156 @@ test('a model that is not downloaded cannot be reviewed for a batch; the button
     await expect(dialog(page)).toHaveCount(0);
     expect(page.modelCalls.filter(call => call.includes('/batch/preview'))).toEqual([]);
 });
+
+// D202 (#431): Skipped tags: add (button and Enter), the preview over the library's tags and the WD14 label list, the
+// per-chip counts, remove, Save preferences and a reload; a list the server refuses highlights the block.
+const SKIPPED_PREVIEW = '/prompt_manager/autotag/skipped-tags/preview';
+const skippedBlock = page => surface(page).locator(':scope > .setting-block[data-setting="tag-skipped"]');
+const skippedInput = page => page.locator('#tag-skipped-input');
+const skippedChips = page => skippedBlock(page).locator('.skip-chips .chip.tag-suggestion');
+const skippedPreview = page => skippedBlock(page).locator('.skip-preview');
+
+test('skipped tags add, preview, remove, save and reload (D202)', async ({ page, request }) => {
+    await openTagging(page);
+    await expect(skippedBlock(page).locator('label')).toHaveText('Skipped tags');
+    await expect(skippedBlock(page)).toHaveAttribute('data-key', 'autotag_skipped_tags');
+    await expect(skippedPreview(page)).toHaveText('No tags are skipped.');
+    await expect(skippedPreview(page)).toHaveAttribute('role', 'status');
+    // The label list on disk (blurry, blurry_background, signature, …) and the library tags (warm_light, …).
+    let answer = page.waitForResponse(item => item.url().endsWith(SKIPPED_PREVIEW));
+    await skippedInput(page).fill('blurry');
+    await skippedInput(page).press('Enter');
+    expect((await answer).status()).toBe(200);
+    await expect(skippedInput(page)).toHaveValue('');
+    await expect(skippedPreview(page)).toHaveText('Hides 2 tags from suggestions: blurry, blurry_background. '
+        + 'Tags already on images are not changed.');
+    answer = page.waitForResponse(item => item.url().endsWith(SKIPPED_PREVIEW));
+    await skippedInput(page).fill('light');
+    await page.getByRole('button', { name: 'Add', exact: true }).click();
+    await answer;
+    await expect(skippedPreview(page)).toHaveText('Hides 3 tags from suggestions: warm_light, blurry, blurry_background. '
+        + 'Tags already on images are not changed.');
+    await expect(skippedChips(page)).toHaveText(['blurry2×', 'light1×']);
+    await expect(skippedChips(page).first()).toHaveAttribute('title', 'Hides 2 tags');
+    // An entry that hides nothing is muted; a duplicate is not added and the line under the input says so.
+    answer = page.waitForResponse(item => item.url().endsWith(SKIPPED_PREVIEW));
+    await skippedInput(page).fill('zebra');
+    await skippedInput(page).press('Enter');
+    await answer;
+    await expect(skippedChips(page).last()).toHaveClass(/\bnone\b/);
+    await expect(skippedChips(page).last()).toHaveAttribute('title', 'Hides no known tag');
+    await skippedInput(page).fill('Blurry');
+    await skippedInput(page).press('Enter');
+    await expect(page.locator('#tag-skipped-problem')).toHaveText('Already in the list.');
+    await expect(skippedInput(page)).toHaveAttribute('aria-invalid', 'true');
+    await skippedInput(page).fill('a, b');
+    await skippedInput(page).press('Enter');
+    await expect(page.locator('#tag-skipped-problem')).toHaveText('No commas or line breaks.');
+    // Remove zebra, then save.
+    await skippedChips(page).last().getByRole('button', { name: 'Remove zebra', exact: true }).click();
+    await expect(skippedChips(page)).toHaveCount(2);
+    await expect(status(page)).toHaveText('Unsaved changes.');
+    await save(page).click();
+    await expect(status(page)).toHaveText('Saved to the server configuration.');
+    expect((await serverJson(request, SETTINGS_URL)).settings.autotag_skipped_tags).toEqual(['blurry', 'light']);
+    await openTagging(page);
+    await expect(skippedChips(page)).toHaveText(['blurry2×', 'light1×']);
+    // Removing a chip and adding it back is no change.
+    await skippedChips(page).last().getByRole('button', { name: 'Remove light', exact: true }).click();
+    await expect(status(page)).toHaveText('Unsaved changes.');
+    await skippedInput(page).fill('light');
+    await skippedInput(page).press('Enter');
+    await expect(status(page)).toHaveText('No unsaved changes.');
+});
+
+test('skipped tags preview checks library tags only without a label list, and a refused save highlights it', async ({ page, request }) => {
+    await expect(await request.post('/__test__/tagging/defaults', { data: { general: 0.35, character: 0.85, limit: 10,
+        labels: false } })).toBeOK();
+    await openTagging(page);
+    const answer = page.waitForResponse(item => item.url().endsWith(SKIPPED_PREVIEW));
+    await skippedInput(page).fill('blurry');
+    await skippedInput(page).press('Enter');
+    await answer;
+    await expect(skippedPreview(page)).toHaveText('Hides 0 tags from suggestions. Checked against library tags only; no WD14 '
+        + 'label list is downloaded. Tags already on images are not changed.');
+    // The server is the authority: a list it refuses keeps the draft, says why and highlights the block.
+    await page.route(`**${SETTINGS_URL}`, route => (route.request().method() === 'POST'
+        ? route.fulfill({ status: 400, contentType: 'application/json',
+            body: JSON.stringify({ success: false, error: 'Skipped tags: entry 1 is empty.' }) })
+        : route.fallback()));
+    await save(page).click();
+    await expect(status(page)).toHaveText('Skipped tags: entry 1 is empty.');
+    await expect(skippedBlock(page)).toHaveAttribute('aria-invalid', 'true');
+    await page.unrouteAll({ behavior: 'ignoreErrors' });
+});
+
+// D203 (#431): Saved instructions: Built-in read-only, New, edit, per-engine defaults, Delete resets a default, Save
+// preferences and a reload; the server pairs the two keys. D205: the batch review names the engine's default.
+const instructionOption = (page, name) => page.locator('#instruction-list [role="option"]').filter({ has: page.locator(`span:text-is("${name}")`) });
+
+test('saved instructions: new, edit, per-engine default, delete, save and reload (D203)', async ({ page, request }) => {
+    await openTagging(page);
+    const settings = (await serverJson(request, SETTINGS_URL)).settings;
+    await expect(page.locator('#instructions-count')).toHaveText('1 of 20 saved · Built\u2011in is not counted.');
+    await expect(page.locator('#instruction-list [role="option"] > span:first-child')).toHaveText(['Built-in', 'Describe the image']);
+    await expect(page.locator('#instruction-name')).toHaveValue('Built-in');
+    await expect(page.locator('#instruction-text')).toHaveValue(settings.autotag_builtin_instructions);
+    await expect(page.locator('#instruction-text')).toHaveAttribute('readonly', '');
+    await expect(page.locator('#instruction-delete')).toBeDisabled();
+    await expect(page.locator('#instruction-default-gguf')).toHaveValue(settings.autotag_instructions[0].id);
+    // + New, then name and text it, and make it HuggingFace's default.
+    await page.locator('#instruction-new').click();
+    await expect(page.locator('#instruction-name')).toHaveValue('New instructions');
+    await expect(page.locator('#instruction-note')).toHaveText('The text must not be empty.');
+    await page.locator('#instruction-name').fill('Photo realism');
+    await page.locator('#instruction-text').fill('Tag camera angle and lighting.');
+    await expect(page.locator('#instruction-text').locator('xpath=..').locator('label .muted')).toHaveText('30 of 4,000 characters');
+    await page.locator('#instruction-default-hf').selectOption({ label: 'Photo realism' });
+    await expect(instructionOption(page, 'Photo realism').locator('.chip')).toHaveText(['Default for HuggingFace']);
+    await expect(status(page)).toHaveText('Unsaved changes.');
+    await save(page).click();
+    await expect(status(page)).toHaveText('Saved to the server configuration.');
+    let saved = (await serverJson(request, SETTINGS_URL)).settings;
+    expect(saved.autotag_instructions.map(entry => [entry.name, entry.text])).toEqual([['Describe the image', 'Describe the image'],
+        ['Photo realism', 'Tag camera angle and lighting.']]);
+    expect(saved.autotag_default_instructions.hf).toBe(saved.autotag_instructions[1].id);
+    // A reload shows the saved list; deleting GGUF's default resets it to Built-in and says so.
+    await openTagging(page);
+    await instructionOption(page, 'Describe the image').click();
+    await page.locator('#instruction-delete').click();
+    await expect(page.locator('#instruction-reset')).toHaveText('GGUF now uses Built-in.');
+    await expect(page.locator('#instruction-default-gguf')).toHaveValue('builtin');
+    await save(page).click();
+    await expect(status(page)).toHaveText('Saved to the server configuration.');
+    saved = (await serverJson(request, SETTINGS_URL)).settings;
+    expect(saved.autotag_instructions.map(entry => entry.name)).toEqual(['Photo realism']);
+    expect(saved.autotag_default_instructions.gguf).toBe('builtin');
+    expect(saved.autotag_template).toBe(saved.autotag_builtin_instructions);
+});
+
+test('a refused instructions save names the entry and highlights the block (D203)', async ({ page }) => {
+    await openTagging(page);
+    await page.locator('#instruction-duplicate').click();
+    await page.locator('#instruction-name').fill('describe the IMAGE');
+    await expect(page.locator('#instruction-note')).toHaveText('The name “describe the IMAGE” is already used.');
+    await save(page).click();
+    await expect(status(page)).toHaveText('Saved instructions: entry 2 name “describe the IMAGE” is already used.');
+    await expect(surface(page).locator('.setting-block[data-setting="tag-instructions"]')).toHaveAttribute('aria-invalid', 'true');
+});
+
+test('the batch review names the language model\'s default instructions (D205)', async ({ page }) => {
+    await openTagging(page);
+    await page.locator('#tag-model').selectOption('gguf');
+    await page.locator('#tag-existing').selectOption('merge');
+    const answer = page.waitForResponse(item => item.url().endsWith(PREVIEW_URL));
+    await reviewButton(page).click();
+    await answer;
+    await expect(dialog(page).locator('#modal-title')).toHaveText('Review tag output images');
+    const grid = await gridOf(page);
+    expect(grid.slice(-3)).toEqual([['Instructions', 'Describe the image'], ['Settings', 'Up to 10 tags per image'],
+        grid.at(-1)]);
+    // The batch sends the default's text.
+    const start = page.waitForRequest(item => item.url().endsWith('/prompt_manager/jobs/autotag'));
+    await dialog(page).getByRole('button', { name: 'Start tagging', exact: true }).click();
+    expect((await start).postDataJSON().options).toEqual({ instructions: 'Describe the image' });
+});

tests/browser/workspace-system.spec.mjs

@@ -8,6 +8,8 @@ import { readCoverageTable, parseControl, CONTROL_EXEMPTIONS } from '../../tools
 const workspace = '/prompt_manager/workspace';
 const OVERVIEW_URL = '/prompt_manager/system/overview';
 const THUMBNAILS_URL = '/prompt_manager/images/thumbnails/status';
+// The sidebar's Images count (state.mjs NAV_COUNT_SOURCES): the Images page's own total.
+const IMAGES_COUNT_URL = '/prompt_manager/images/output?mode=workspace&limit=1';
 const number = value => value.toLocaleString('en-US');
 
 test.beforeEach(async ({ page, request, browserName }) => {
@@ -55,6 +57,7 @@ test('overview shows real counts and Not checked', async ({ page, request }) =>
     page.on('request', item => { if (!['GET', 'HEAD', 'OPTIONS'].includes(item.method())) writes.push(item.url()); });
     const overview = await serverJson(request, OVERVIEW_URL);
     const thumbnails = await serverJson(request, THUMBNAILS_URL);
+    const images = (await serverJson(request, IMAGES_COUNT_URL)).total;
     // The concept fixture: six positives, their saved negatives and 24 linked images, all with thumbnails.
     expect([overview.library.positive_prompts, overview.images.indexed, thumbnails.pending]).toEqual([6, 24, 0]);
     // I2: the Overview never walks the sources for thumbnails; the row reads the status route itself.
@@ -66,7 +69,8 @@ test('overview shows real counts and Not checked', async ({ page, request }) =>
         [item.querySelector('strong').textContent, item.querySelector('span').textContent]))).toEqual([
         [number(overview.library.positive_prompts), 'Positive prompts'],
         [number(overview.library.negative_variants), 'Negative variants'],
-        [number(overview.images.indexed), 'Images'],
+        // #555: the Images page's own count, the same number as its sidebar badge.
+        [number(images), 'Images'],
         ['Not checked', 'Database integrity'],
     ]);
     expect(await rowsOf(layout, 'Library health')).toEqual([
@@ -79,11 +83,31 @@ test('overview shows real counts and Not checked', async ({ page, request }) =>
     expect(await rowsOf(layout, 'Workspace preferences')).toEqual([
         ['One display configuration', 'Grid and density settings are shared across views.', 'Appearance'],
         ['2 output sources', 'Monitoring and enrichment share one source list.', 'Manage sources'],
-        ['Statistics', 'Runs by category, with library totals.', 'Explore'],
+        ['Statistics', 'Runs by category, with database record counts.', 'Explore'],
     ]);
     expect(writes).toEqual([]);
 });
 
+test('#555: the Images metric is the sidebar Images count, not the indexed image rows', async ({ page, request }) => {
+    const overview = await serverJson(request, OVERVIEW_URL);
+    // The Images page lists files no row links (the demo library: 122 files, 110 rows); the listing says so.
+    const listed = overview.images.indexed + 12;
+    await page.route(`**${IMAGES_COUNT_URL}`, async route => {
+        const response = await route.fetch();
+        await route.fulfill({ response, json: { ...(await response.json()), total: listed } });
+    });
+    const layout = await openOverview(page);
+    const imagesMetric = layout.locator('.summary-metrics > .metric').filter({ has: page.locator('span', { hasText: /^Images$/ }) });
+    await expect(imagesMetric.locator('strong')).toHaveText(number(listed));
+    await expect(page.locator('#primary-nav a[data-route="images"] .nav-count')).toHaveText(number(listed));
+    // A failed count reads as a dash, never the row count.
+    await page.unroute(`**${IMAGES_COUNT_URL}`);
+    await page.route(`**${IMAGES_COUNT_URL}`, route => route.fulfill({ status: 503, json: { success: false, error: 'Unavailable' } }));
+    await page.goto(`${workspace}#/system/appearance`);
+    await page.locator('#workspace-main .section-nav').getByRole('button', { name: 'Overview', exact: true }).click();
+    await expect(imagesMetric.locator('strong')).toHaveText('–');
+});
+
 // D129 (#249 S6b): where the library lives. The hook makes the fixture's database read as a node-folder library; its
 // Move library is a stand-in that touches no file (workspace_system_fixture.py).
 const banner = page => page.locator('#library-banner');
@@ -364,7 +388,7 @@ test('View backups / Appearance / Manage sources switch sections', async ({ page
     }
 });
 
-test('statistics dialog lists runs by category and library totals', async ({ page, request }) => {
+test('statistics dialog lists runs by category and database record counts', async ({ page, request }) => {
     const statistics = await serverJson(request, '/prompt_manager/system/statistics');
     expect(statistics.by_category.length).toBeGreaterThan(1);
     const layout = await openOverview(page);
@@ -373,13 +397,14 @@ test('statistics dialog lists runs by category and library totals', async ({ pag
     const dialog = page.locator('dialog#modal[open]');
     await expect(dialog.locator('#modal-title')).toHaveText('Usage statistics');
     const tables = dialog.locator('#modal-body > table');
-    await expect(tables.locator('caption')).toHaveText(['Runs by category', 'Library totals']);
+    await expect(tables.locator('caption')).toHaveText(['Runs by category', 'Database records']);
     // D153 (#447): no rating column and no rated-images total.
     await expect(tables.first().locator('thead th')).toHaveText(['Category', 'Runs']);
     const cells = table => table.locator('tbody tr').evaluateAll(rows => rows.map(row => [...row.cells].map(cell => cell.textContent)));
     expect(await cells(tables.first())).toEqual(statistics.by_category.map(row => [row.category ?? 'Uncategorized', number(row.runs)]));
-    expect(await cells(tables.nth(1))).toEqual([['Prompts', number(statistics.totals.total_prompts)],
-        ['Tags', number(statistics.totals.total_tags)], ['Images', number(statistics.totals.total_images)]]);
+    // #555: raw rows of the legacy /stats, labelled as rows so they never read as the Library or Images page counts.
+    expect(await cells(tables.nth(1))).toEqual([['Prompt records', number(statistics.totals.total_prompts)],
+        ['Tags on prompts', number(statistics.totals.total_tags)], ['Image records', number(statistics.totals.total_images)]]);
     await page.keyboard.press('Escape');
     await expect(explore).toBeFocused();
     // A statistics read that fails says so; the Overview stays.

tests/browser/workspace-tagging-bulk.spec.mjs

@@ -341,3 +341,21 @@ test('a running scan makes the start report busy', async ({ page, request }) =>
         await request.post(`/__test__/jobs/${scan.job.id}/finish`, { data: { state: 'finished' } });
     }
 });
+
+// D204 (#431): Auto-tag selected has the same picker; the job sends the text the dialog shows.
+test('Auto-tag selected picks saved instructions and sends the text shown (D204)', async ({ page }) => {
+    await select(page, FIRST);
+    await barButton(page, 'Auto-tag selected').click();
+    await expect(title(page)).toHaveText('Auto-tag selected images');
+    const body = modal(page).locator('#modal-body');
+    await body.getByRole('combobox', { name: 'Tagging model', exact: true }).selectOption('gguf');
+    const pick = body.getByRole('combobox', { name: 'Saved instructions', exact: true });
+    await expect(pick).toHaveAttribute('id', 'bulk-tag-instructions-pick');
+    await expect(pick.locator('option')).toHaveText(['Built-in', 'Describe the image · default']);
+    const text = body.getByRole('textbox', { name: 'Tagging instructions', exact: true });
+    await text.fill('Bulk one-off.');
+    await expect(pick.locator('option:checked')).toHaveText('Edited for this run');
+    const started = jobStart(page);
+    await actionButtons(page).filter({ hasText: 'Start auto-tagging' }).click();
+    expect((await started).postDataJSON().options.instructions).toBe('Bulk one-off.');
+});

tests/browser/workspace-tagging.spec.mjs

@@ -4,7 +4,7 @@
 import { startCoverage, saveCoverage } from '../../tools/vendor/browser-coverage.mjs';
 import { test, expect } from './fixtures.mjs';
 import { saveImageTags } from './concept-inventory.mjs';
-import { taggingInventory } from './tagging-canonical-comparison.mjs';
+import { FIXTURE_INSTRUCTIONS_ID, taggingInventory } from './tagging-canonical-comparison.mjs';
 
 const images = '/prompt_manager/workspace#/images';
 const MODULE = '/prompt_manager/js/workspace/image-tagging.mjs';
@@ -849,3 +849,61 @@ test('a failed listing re-read after a save says so and keeps the cards (M2)', a
     await expect(page.locator('#gallery-continuation [aria-disabled="true"]')).toHaveCount(0);
     await page.unroute(failing);
 });
+
+// #431: the saved Skipped tags hide matching suggestions before the limit (WD14 fills it from lower scores), and the
+// chip hint says how many were not suggested.
+test('suggestions omit skipped tags and say how many were hidden', async ({ page, request }) => {
+    await expect(await request.post('/__test__/tagging/defaults', { data: { general: 0.35, character: 0.85, limit: 4,
+        skipped: ['desert', 'rock'] } })).toBeOK();
+    await openTag(page);
+    const answer = await (await generated(page)).json();
+    expect(answer.skipped).toBe(2);
+    await expect(chips(page).locator(':scope > span:first-child')).toHaveText(['sandstone', 'arch', 'sky', 'dune']);
+    await expect(dialog(page).locator('#tag-suggestions > p.small')).toHaveText(`${CHIP_HINT} 2 skipped tags were not suggested.`);
+});
+
+// D204 (#431): the Saved instructions select above Tagging instructions: the engine default, a pick, a one-off edit
+// ("Edited for this run" and the muted note), an engine switch resets, WD14 hides both; Generate sends the text shown.
+test('the saved instructions picker fills, edits one-off and resets per engine (D204)', async ({ page, request }) => {
+    const settings = await (await request.get('/prompt_manager/settings')).json();
+    const builtin = settings.settings.autotag_builtin_instructions;
+    await openTag(page);
+    const options = dialog(page).locator('#image-tag-model-options');
+    const pick = options.getByRole('combobox', { name: 'Saved instructions', exact: true });
+    const text = options.getByRole('textbox', { name: 'Tagging instructions', exact: true });
+    const note = options.locator('.instructions-edited');
+    await expect(pick).toHaveCount(0);
+    await model(page).selectOption('gguf');
+    await expect(pick.locator('option')).toHaveText(['Built-in', 'Describe the image · default']);
+    await expect(pick).toHaveAttribute('id', 'image-tag-instructions-pick');
+    await expect(text).toHaveValue('Describe the image');
+    await expect(note).toBeHidden();
+    // A keyboard pick (the select focused) keeps focus on the select the fields are re-rendered with.
+    await pick.focus();
+    await pick.selectOption('builtin');
+    await expect(text).toHaveValue(builtin);
+    await expect(pick).toBeFocused();
+    await text.fill('Only the sky.');
+    await expect(text).toHaveAttribute('aria-describedby', 'image-tag-instructions-pick-note');
+    await expect(pick.locator('option:checked')).toHaveText('Edited for this run');
+    await expect(pick.locator('option[value="edited"]')).toBeDisabled();
+    await expect(note).toHaveText('Edits apply to this run only. Manage saved instructions in System › Auto-tagging.');
+    await expect(text).toBeFocused();
+    // Generate sends the edited text; the saved entries are unchanged.
+    const sent = page.waitForRequest(item => item.url().endsWith('/image-annotations/suggest'));
+    await generate(page).click();
+    expect((await sent).postDataJSON().options.instructions).toBe('Only the sky.');
+    // Choosing an entry replaces the edit; switching engines starts from the new engine's default.
+    await pick.selectOption('builtin');
+    await expect(text).toHaveValue(builtin);
+    await expect(note).toBeHidden();
+    await text.fill('Edited again.');
+    await model(page).selectOption('hf');
+    await expect(text).toHaveValue('Describe the image');
+    await expect(pick).toHaveValue(FIXTURE_INSTRUCTIONS_ID);
+    await model(page).selectOption('wd14-vit');
+    await expect(pick).toHaveCount(0);
+    await expect(text).toHaveCount(0);
+    expect((await (await request.get('/prompt_manager/settings')).json()).settings.autotag_instructions)
+        .toEqual(settings.settings.autotag_instructions);
+});

tests/browser/workspace-thumbnail-location.spec.mjs

@@ -0,0 +1,213 @@
+import { startCoverage, saveCoverage } from '../../tools/vendor/browser-coverage.mjs';
+import { test, expect } from './fixtures.mjs';
+import { seedConcept } from './concept-inventory.mjs';
+
+// #320 Thumbnail location (D196–D201, the approved 320 mock) on the concept-shaped real fixture: the row in System ›
+// Sources & scans reviews and runs Move thumbnails both ways, the review refuses a folder in place, and an unplugged
+// thumbnail folder shows the notice whose Recreate folder brings it back. The hooks are thumbnail_location_fixture.py's.
+const workspace = '/prompt_manager/workspace';
+const NOTICE_KEY = 'pm_update_notice_dismissed';
+
+test.beforeEach(async ({ page, request, browserName }) => {
+    await startCoverage(page, browserName);
+    await seedConcept(request);
+    await expect(await request.post('/__test__/system/reset')).toBeOK();
+    await expect(await request.post('/__test__/thumbnail-location', { data: { mode: 'source' } })).toBeOK();
+    page.locationErrors = [];
+    page.on('pageerror', error => page.locationErrors.push(error.message));
+    await page.addInitScript(key => { if (location.protocol.startsWith('http')) localStorage.setItem(key, '3.2.0'); }, NOTICE_KEY);
+});
+
+test.afterEach(async ({ page, request, browserName }) => {
+    await saveCoverage(page, browserName);
+    await request.post('/__test__/thumbnail-location', { data: { mode: 'source' } });
+    expect(page.locationErrors).toEqual([]);
+});
+
+const block = page => page.locator('#location-block');
+const dialog = page => page.locator('dialog#modal[open]');
+
+async function files(request) {
+    const response = await request.get('/__test__/thumbnail-files');
+    await expect(response).toBeOK();
+    return response.json();
+}
+
+async function openSources(page) {
+    await page.goto(`${workspace}#/system/sources`);
+    await expect(block(page).locator('#location-status')).not.toHaveText('');
+}
+
+/** Review the row's choice and start the move; resolves once its job view says it finished. */
+async function moveFromRow(page) {
+    const planned = page.waitForResponse(response => response.url().endsWith('/images/thumbnails/plan')
+        && response.request().method() === 'POST');
+    await block(page).getByRole('button', { name: 'Review move…' }).click();
+    expect((await planned).status()).toBe(200);
+    await expect(dialog(page).locator('h2')).toHaveText('Move thumbnails');
+    await dialog(page).getByRole('button', { name: 'Move thumbnails' }).click();
+    await expect(page.locator('#workspace-main h1')).toHaveText('Move thumbnails');
+    await expect(page.locator('#workspace-main')).toContainText('Thumbnails moved to');
+}
+
+test('the row moves thumbnails into one folder and back', async ({ page, request }) => {
+    await openSources(page);
+    const row = block(page);
+    await expect(row.getByRole('radio', { name: /Inside each source/ })).toBeChecked();
+    await expect(row.locator('#location-status')).toHaveText('Now: inside each source.');
+    await expect(row.getByRole('button', { name: 'Review move…' })).toHaveAttribute('aria-disabled', 'true');
+    await expect(row.locator('#location-path')).toBeDisabled();
+
+    await row.getByRole('radio', { name: /One folder/ }).check();
+    await expect(row.locator('#location-path')).toBeEnabled();
+    await expect(row.locator('#location-path')).toHaveValue(/default-thumbs$/);
+    await expect(row.locator('#location-status')).toHaveText(/^Now: inside each source\. The suggested folder is next to your library/);
+    await expect(row.getByRole('button', { name: 'Review move…' })).toHaveAttribute('aria-disabled', 'false');
+    await moveFromRow(page);
+    await expect(page.locator('#job-phase')).toHaveText(/^Thumbnails are now read from the new location/);
+    const moved = await files(request);
+    expect(moved.folder.length).toBeGreaterThan(0);
+    expect(moved.folder.every(name => /^[a-z0-9_-]+-[0-9a-f]{8}\//.test(name))).toBe(true);
+    expect(moved.source_thumbnails).toBe(false);
+
+    // Images shows thumbnails served from the folder.
+    const served = page.waitForResponse(response => response.url().includes('/images/serve/thumbnails/')
+        && response.status() === 200);
+    await page.goto(`${workspace}#/images`);
+    await served;
+
+    await openSources(page);
+    await expect(block(page).locator('#location-status')).toHaveText(/^Now: one folder, .*default-thumbs\. Using the default folder/);
+    await block(page).getByRole('radio', { name: /Inside each source/ }).check();
+    await moveFromRow(page);
+    const back = await files(request);
+    expect(back.source_thumbnails).toBe(true);
+    expect(back.folder_exists).toBe(false);
+});
+
+test('a folder the server refuses is explained under the field', async ({ page }) => {
+    await openSources(page);
+    const row = block(page);
+    await row.getByRole('radio', { name: /One folder/ }).check();
+    await row.locator('#location-path').fill('thumbnails');
+    await row.getByRole('button', { name: 'Review move…' }).click();
+    await expect(row.locator('#location-problem')).toHaveText(
+        'Enter a full folder path, such as D:\\Thumbnails or /mnt/fast/thumbnails.');
+    await expect(row.locator('#location-path')).toHaveAttribute('aria-invalid', 'true');
+    await expect(row.locator('#location-path')).toHaveAttribute('aria-describedby', 'location-problem');
+    await expect(dialog(page)).toHaveCount(0);
+    await row.locator('#location-path').fill('/somewhere/else');
+    await expect(row.locator('#location-problem')).toHaveText('');
+});
+
+test('an unplugged folder shows the notice and Recreate folder brings it back', async ({ page, request }) => {
+    await expect(await request.post('/__test__/thumbnail-location', { data: { mode: 'folder' } })).toBeOK();
+    const removed = await request.post('/__test__/thumbnail-folder/remove');
+    expect((await removed.json()).available).toBe(false);
+    await openSources(page);
+    const notice = page.locator('#unavailable-notice');
+    await expect(notice.locator('h2')).toHaveText('The thumbnail folder is unavailable');
+    await expect(notice).toContainText('is missing. Originals are shown and no thumbnails are written until it is back.');
+    await expect(block(page).locator('#location-status')).toHaveText(/· unavailable\. Originals are shown\.$/);
+    await notice.getByRole('button', { name: 'Recreate folder' }).click();
+    await expect(dialog(page).locator('h2')).toHaveText('Recreate the thumbnail folder?');
+    const recreated = page.waitForResponse(response => response.url().endsWith('/location/recreate'));
+    await dialog(page).getByRole('button', { name: 'Recreate folder' }).click();
+    expect((await recreated).status()).toBe(200);
+    await expect(notice).toHaveCount(0);
+    await expect(block(page).locator('#location-status')).toHaveText(/^Now: one folder, .*thumbs\.$/);
+});
+
+test('a folder of your own needs the confirmation before it moves', async ({ page, request }) => {
+    const custom = (await files(request)).custom_path;
+    await openSources(page);
+    const row = block(page);
+    await row.getByRole('radio', { name: /One folder/ }).check();
+    await row.locator('#location-path').fill(custom);
+    await row.getByRole('button', { name: 'Review move…' }).click();
+    const review = dialog(page);
+    await expect(review.locator('dt')).toContainText(['From', 'To', 'Thumbnails', 'Free space', 'Removed after the move']);
+    await expect(review.locator('dd').nth(1)).toHaveText(`${custom} (new folder)`);
+    const move = review.getByRole('button', { name: 'Move thumbnails' });
+    await expect(move).toHaveAttribute('aria-disabled', 'true');
+    await review.getByRole('checkbox', { name: /may create its own folders/ }).check();
+    await expect(move).toHaveAttribute('aria-disabled', 'false');
+    await move.click();
+    await expect(page.locator('#workspace-main')).toContainText('Thumbnails moved to');
+    expect((await files(request)).folder.length).toBeGreaterThan(0);
+});
+
+test('another folder’s marker offers Use this folder', async ({ page, request }) => {
+    await expect(await request.post('/__test__/thumbnail-location', { data: { mode: 'folder' } })).toBeOK();
+    await expect(await request.post('/__test__/thumbnail-folder/foreign')).toBeOK();
+    await openSources(page);
+    const notice = page.locator('#unavailable-notice');
+    await expect(notice).toContainText('holds another thumbnail folder');
+    await notice.getByRole('button', { name: 'Use this folder' }).click();
+    await expect(notice).toHaveCount(0);
+    await expect(block(page).locator('#location-status')).toHaveText(/^Now: one folder, .*thumbs\.$/);
+});
+
+test('Overview shows the notice and Change location opens the row', async ({ page, request }) => {
+    await expect(await request.post('/__test__/thumbnail-location', { data: { mode: 'folder' } })).toBeOK();
+    const removed = await request.post('/__test__/thumbnail-folder/remove');
+    expect((await removed.json()).available).toBe(false);
+    await page.goto(`${workspace}#/system/overview`);
+    const notice = page.locator('#unavailable-notice');
+    await expect(notice.locator('h2')).toHaveText('The thumbnail folder is unavailable');
+    await notice.getByRole('button', { name: 'Change location' }).click();
+    await expect(page).toHaveURL(/#\/system\/sources$/);
+    const sourcesNotice = page.locator('#unavailable-notice');
+    await sourcesNotice.getByRole('button', { name: 'Change location' }).click();
+    await expect(block(page).getByRole('radio', { name: /One folder/ })).toBeChecked();
+    await expect(block(page).locator('#location-path')).toBeFocused();
+});
+
+test('Overview’s Use this folder takes the folder and the notice goes', async ({ page, request }) => {
+    await expect(await request.post('/__test__/thumbnail-location', { data: { mode: 'folder' } })).toBeOK();
+    await expect(await request.post('/__test__/thumbnail-folder/foreign')).toBeOK();
+    await page.goto(`${workspace}#/system/overview`);
+    const notice = page.locator('#unavailable-notice');
+    await expect(notice).toContainText('holds another thumbnail folder');
+    const adopted = page.waitForResponse(response => response.url().endsWith('/location/adopt'));
+    await notice.getByRole('button', { name: 'Use this folder' }).click();
+    expect((await adopted).status()).toBe(200);
+    await expect(notice).toHaveCount(0);
+});
+
+test('Thumbnail maintenance removes the thumbnails of removed sources in folder mode', async ({ page, request }) => {
+    await expect(await request.post('/__test__/thumbnail-location', { data: { mode: 'folder' } })).toBeOK();
+    await expect(await request.post('/__test__/thumbnail-folder/unlisted')).toBeOK();
+    await openSources(page);
+    const generation = page.locator('#workspace-main .operation').filter({ hasText: 'Thumbnail generation' });
+    await generation.getByRole('button', { name: 'Review options' }).click();
+    const scope = dialog(page).locator('#thumb-mode');
+    await expect(scope.locator('option')).toHaveText(['Missing thumbnails only', 'Rebuild all (explicit opt-in)',
+        'Convert outdated (removes older formats)', 'Remove thumbnails of removed sources']);
+    await scope.selectOption('prune');
+    await expect(dialog(page).locator('[role=status]')).toHaveText(
+        /^1 source no longer listed: 1 thumbnail \(.+\) are removed\.$/);
+    await expect(dialog(page).locator('dl.meta-grid dt')).toHaveText(['gone-0123abcd']);
+    await expect(dialog(page)).toContainText('If a source comes back, its thumbnails are made again as you browse.');
+    await scope.selectOption('missing');
+    await expect(dialog(page).locator('dl.meta-grid')).toBeHidden();
+    await scope.selectOption('prune');
+    await dialog(page).getByRole('button', { name: 'Start' }).click();
+    await expect(page.locator('#workspace-main h1')).toHaveText('Remove thumbnails of removed sources');
+    await expect(page.locator('#workspace-main')).toContainText('1 thumbnails removed');
+});
+
+test('a disk without the space shows the review but cannot move', async ({ page, request }) => {
+    await expect(await request.post('/__test__/thumbnail-space/full')).toBeOK();
+    await openSources(page);
+    const row = block(page);
+    await row.getByRole('radio', { name: /One folder/ }).check();
+    const planned = page.waitForResponse(response => response.url().endsWith('/images/thumbnails/plan'));
+    await row.getByRole('button', { name: 'Review move…' }).click();
+    expect((await planned).status()).toBe(507);
+    const review = dialog(page);
+    await expect(review.locator('.review-refusal')).toHaveText(/^There is not enough space for the thumbnails: 1 B free/);
+    await expect(review.getByRole('button', { name: 'Move thumbnails' })).toHaveAttribute('aria-disabled', 'true');
+    await review.getByRole('button', { name: 'Cancel' }).click();
+    await expect(dialog(page)).toHaveCount(0);
+});

tests/browser/workspace-vocabulary.spec.mjs

@@ -145,9 +145,10 @@ test('long vocabularies append and Load more is keyboard reachable',async({page,
     await expect(loadMore(page)).toHaveCount(0);
     await expect(rows(page).nth(200).getByRole('button',{name:'Browse',exact:true})).toBeFocused();
     await expect(rows(page).locator('td:nth-child(1)')).toHaveText(manifest.tags);
-    // Reload with the window at its top: Firefox restores a scrolled window, whose end then appends a page before the check.
-    await main(page).locator('.two-col .table-wrap').evaluate(node=>new Promise(resolve=>{node.scrollTop=0;requestAnimationFrame(()=>requestAnimationFrame(resolve));}));
-    await page.reload();
+    // Open the screen as a new history entry, not a reload: Firefox restores a reloaded page's scrolled tag window, and
+    // its end then appends a page before the check (#567). Scrolling the window to its top first does not always stick.
+    await page.goto('about:blank');
+    await page.goto(route);
     await expect(rows(page)).toHaveCount(100);
     // D183: the end of the list arrives inside the tag window.
     const scroll=top=>main(page).locator('.two-col .table-wrap').evaluate((node,y)=>new Promise(resolve=>{node.scrollTop=y ?? node.scrollHeight;requestAnimationFrame(()=>requestAnimationFrame(resolve));}),top);

tests/browser/workspace_system_fixture.py

@@ -41,6 +41,11 @@ read. These per-server hooks only change what a System test needs on top:
 - ``POST /__test__/system/duplicate-prompts`` (S7) adds two prompts whose
   text differs only in case and spacing (a duplicate prompt text group);
   ``{"again": true}`` adds a third, so a reviewed plan no longer matches;
+- ``POST /__test__/system/pair-metadata`` (#550) saves two saved pairs the
+  way the Pair node did before #546 (the pair holds the category and tags,
+  its new positive prompt none): ``S550 lantern`` (category ``night``, tags
+  ``s550-glow``, ``s550-warm``) fills; ``S550 harbor`` was edited after it was
+  saved, so the plan keeps it;
 - ``POST /__test__/system/duplicate-files`` (S7) writes one PNG's bytes three
   times: ``output/s7-dupes/same.png``, ``input/s7-dupes/same.png`` (the same
   relative path in the other source) and ``output/s7-dupes/copy.png``;
@@ -344,6 +349,25 @@ def register_system_commands(app, routes, api, root: Path):
             conn.commit()
         return web.json_response({"success": True})
 
+    @routes.post("/__test__/system/pair-metadata")
+    async def pair_metadata(request):
+        def seed():
+            api.db.save_prompt_pair(
+                "S550 lantern",
+                "S550 blurry",
+                category="night",
+                tags=["s550-glow", "s550-warm"],
+            )
+            api.db.save_prompt_pair("S550 harbor", category="night")
+            with api.db.model.get_connection() as conn:
+                conn.execute(
+                    "UPDATE prompts SET updated_at='2099-01-01T00:00:00+00:00' "
+                    "WHERE text='S550 harbor'"
+                )
+
+        await api._run_in_executor(seed)
+        return web.json_response({"success": True})
+
     @routes.post("/__test__/system/duplicate-files")
     async def duplicate_files(request):
         body = await request.json() if request.can_read_body else {}

tests/browser/workspace_tagging_fixture.py

@@ -226,6 +226,7 @@ def register_tagging_commands(
         return download["result"]
 
     _set_defaults(model, DEFAULTS)  # the server starts on the standard ones
+    _write_labels(model, True)
 
     @routes.post("/__test__/tagging/reset")
     async def reset(request: web.Request) -> web.Response:
@@ -244,6 +245,7 @@ def register_tagging_commands(
         model.loaded = None
         restore_download()
         _set_defaults(model, DEFAULTS)
+        await api._run_in_executor(_write_labels, model, True)
         # A test that ends with the dialog open leaves its capture behind; drop
         # every capture so the next test starts below the store's limits.
         await api._run_in_executor(api.close_annotation_captures)
@@ -353,13 +355,22 @@ def register_tagging_commands(
 
         ``{"general": g, "character": c, "limit": n}``: the WD14 thresholds
         (in [0, 1]) and the persisted suggestion count (1..100), so a test can
-        tell the server's values from the dialog's built-in ones. Reset
-        restores the standard 0.35 / 0.85 / 10.
+        tell the server's values from the dialog's built-in ones. Optional
+        ``skipped`` sets the saved Skipped tags (#431) and ``labels`` (true or
+        false) writes or removes the fake WD14 SwinV2 label list the Skipped
+        tags preview reads. Reset restores the standard 0.35 / 0.85 / 10, no
+        skipped tags and the label list.
         """
         data = await request.json() if request.can_read_body else None
         if request.query or not _valid_defaults(data):
             raise web.HTTPBadRequest()
         _set_defaults(model, (data["general"], data["character"], data["limit"]))
+        if "skipped" in data:
+            from py.config import AutotagConfig
+
+            AutotagConfig.SKIPPED_TAGS = tuple(data["skipped"])
+        if "labels" in data:
+            await api._run_in_executor(_write_labels, model, data["labels"])
         return web.json_response({"success": True})
 
     @routes.get("/__test__/tagging/captures")
@@ -380,10 +391,15 @@ DOWNLOAD_HOLD_LIMIT_S = 60
 DEFAULTS = (0.35, 0.85, 10)
 
 
+# The saved "Describe the image" entry's id (#431).
+FIXTURE_INSTRUCTIONS_ID = "d35c71be0a1e"
+
+
 def _set_defaults(model, values) -> None:
     """Set the saved tagging defaults (``AutotagConfig``, #328); a reset also
-    puts back the saved model, batch policy and template (the fake model's
-    short instructions, which the concept comparisons show)."""
+    puts back the saved model, batch policy, skipped tags and instructions
+    (the fake model's short instructions, which the concept comparisons
+    show)."""
     from py.config import AutotagConfig
 
     general, character, limit = values
@@ -393,7 +409,48 @@ def _set_defaults(model, values) -> None:
     if values == DEFAULTS:
         AutotagConfig.MODEL_TYPE = "wd14-swinv2"
         AutotagConfig.EXISTING = "skip"
-        AutotagConfig.TEMPLATE = model.default_prompt
+        # #431: Built-in is always the shipped text, so the fake model's short
+        # instructions are a saved entry, the default of both engines (the
+        # concept comparisons show it).
+        AutotagConfig.INSTRUCTIONS = (
+            {
+                "id": FIXTURE_INSTRUCTIONS_ID,
+                "name": model.default_prompt,
+                "text": model.default_prompt,
+            },
+        )
+        AutotagConfig.DEFAULT_INSTRUCTIONS = {
+            "gguf": FIXTURE_INSTRUCTIONS_ID,
+            "hf": FIXTURE_INSTRUCTIONS_ID,
+        }
+        AutotagConfig._LEGACY_TEMPLATE = None
+        AutotagConfig.SKIPPED_TAGS = ()
+
+
+# The fake WD14 SwinV2 label list (general 0, character 4, rating 9): the
+# names the Skipped tags preview checks beside the library's tags (#431).
+FAKE_LABELS = (
+    ("blurry", "0"),
+    ("blurry_background", "0"),
+    ("signature", "0"),
+    ("watermark", "0"),
+    ("t-shirt", "0"),
+    ("half-closed_eyes", "0"),
+    ("saber_(fate)", "4"),
+    ("general", "9"),
+)
+
+
+def _write_labels(model, present: bool) -> None:
+    """Write (or remove) the fake label list under the fake models folder."""
+    path = Path(model.models_dir) / "WD14-SwinV2" / "selected_tags.csv"
+    if not present:
+        path.unlink(missing_ok=True)
+        return
+    path.parent.mkdir(parents=True, exist_ok=True)
+    lines = ["tag_id,name,category,count"]
+    lines += [f"{i},{name},{cat},1" for i, (name, cat) in enumerate(FAKE_LABELS)]
+    path.write_text("\n".join(lines) + "\n", encoding="utf-8")
 
 
 def _valid_defaults(data: object) -> bool:
@@ -402,9 +459,20 @@ def _valid_defaults(data: object) -> bool:
         and not isinstance(value, bool)
         and 0 <= value <= 1
     )
+    optional = {"skipped", "labels"}
+    if isinstance(data, dict) and "skipped" in data:
+        try:
+            from py.tagging_defaults import validate_skipped_tags
+
+            validate_skipped_tags(data["skipped"])
+        except ValueError:
+            return False
+    if isinstance(data, dict) and not isinstance(data.get("labels", True), bool):
+        return False
     return (
         isinstance(data, dict)
-        and set(data) == {"general", "character", "limit"}
+        and {"general", "character", "limit"} <= set(data)
+        and set(data) <= {"general", "character", "limit"} | optional
         and unit(data["general"])
         and unit(data["character"])
         and type(data["limit"]) is int

tests/comfyui/prompt-sender.spec.mjs

@@ -131,11 +131,40 @@ test('native image inspector previews and sends a pair into real visible widgets
         const twinId=await page.evaluate(async()=>{const {app}=await import('/scripts/app.js');const node=LiteGraph.createNode('PromptManagerPair');app.graph.add(node);return node.id;});
         await find0.click();
         const targets=sender.getByRole('combobox',{name:'Destination node',exact:true});
-        await expect(targets.locator('option')).toHaveCount(3);
+        await expect(targets.locator('option')).toHaveCount(4);
         await expect(targets).toHaveValue('');
         await expect(apply).toBeDisabled();
         await expect(targets.locator('option').nth(2)).toHaveText(new RegExp(`^#${twinId} `));
-        await page.evaluate(async twinId=>{const {app}=await import('/scripts/app.js');app.graph.remove(app.graph.getNodeById(twinId));},twinId);
+        // #542 D191: "All 2 eligible nodes" writes both real nodes, one after another; a linked third node is not offered.
+        const linkedId=await page.evaluate(async()=>{
+            const {app}=await import('/scripts/app.js');const {convertToInput}=await import('/extensions/core/widgetInputs.js');
+            const node=LiteGraph.createNode('PromptManagerPair');app.graph.add(node);
+            const widget=node.widgets.find(widget=>widget.name==='text');
+            if(!node.inputs.some(input=>input.name==='text'))convertToInput(node,widget);
+            const source=LiteGraph.createNode('PrimitiveString');app.graph.add(source);
+            source.connect(0,node,node.inputs.findIndex(input=>input.name==='text'));
+            for(const each of app.graph._nodes.filter(item=>item.type==='PromptManagerPair')){const text=each.widgets.find(widget=>widget.name==='text');if(text)text.value=`Before all ${each.id}`;}
+            return node.id;
+        });
+        await find0.click();
+        await expect(targets.locator('option')).toHaveText(['Choose a destination node',new RegExp(`^#${id} `),new RegExp(`^#${twinId} `),'All 2 eligible nodes']);
+        await expect(sender.getByRole('status')).toContainText('1 other Prompt Manager node cannot receive this prompt.');
+        await targets.selectOption({label:'All 2 eligible nodes'});
+        await sender.getByRole('button',{name:'Preview changes',exact:true}).click();
+        await expect(sender.locator('section.prompt-sender-node > h4')).toHaveText([new RegExp(`^#${id} `),new RegExp(`^#${twinId} `)]);
+        await apply.click();
+        // The tab title gains ComfyUI's unsaved mark once the workflow changed, so the window is matched loosely.
+        await expect(sender.getByRole('status')).toHaveText(/^Sent to 2 of 2 nodes in .*ComfyUI\.$/);
+        await expect(apply).toBeDisabled();
+        const all=await page.evaluate(async ids=>{
+            const {app}=await import('/scripts/app.js');const output=(await app.graphToPrompt()).output;
+            return ids.map(nodeId=>{const node=app.graph.getNodeById(nodeId);const serialized=node.serialize();const index=node.widgets.findIndex(widget=>widget.name==='negative_text');
+                return{prompt:output[String(nodeId)]?.inputs.negative_text,serialized:serialized.widgets_values[index],text:node.widgets.find(widget=>widget.name==='text')?.value};});
+        },[id,twinId,linkedId]);
+        expect(all.slice(0,2)).toEqual([{prompt:negative,serialized:negative,text:positive},{prompt:negative,serialized:negative,text:positive}]);
+        expect(all[2].text).toBe(`Before all ${linkedId}`);
+        expect(await page.evaluate(()=>window.senderEffects.queue-window.senderSendBaseline.queue)).toBe(0);
+        await page.evaluate(async ids=>{const {app}=await import('/scripts/app.js');for(const nodeId of ids)app.graph.remove(app.graph.getNodeById(nodeId));},[twinId,linkedId]);
         // #535: the status line says why a window cannot receive.
         const find=sender.getByRole('button',{name:'Find ComfyUI windows',exact:true});
         const preview=sender.getByRole('button',{name:'Preview changes',exact:true});

tests/fixtures/legacy_contract_snapshot.json

@@ -105,6 +105,7 @@
     "POST /prompt_manager/autotag/batch/preview",
     "POST /prompt_manager/autotag/download/{model_type}",
     "POST /prompt_manager/autotag/single",
+    "POST /prompt_manager/autotag/skipped-tags/preview",
     "POST /prompt_manager/autotag/start",
     "POST /prompt_manager/autotag/unload",
     "POST /prompt_manager/bulk/category",
@@ -125,6 +126,9 @@
     "POST /prompt_manager/images/removed/return",
     "POST /prompt_manager/images/rescope",
     "POST /prompt_manager/images/reveal",
+    "POST /prompt_manager/images/thumbnails/location/adopt",
+    "POST /prompt_manager/images/thumbnails/location/recreate",
+    "POST /prompt_manager/images/thumbnails/plan",
     "POST /prompt_manager/jobs/autotag",
     "POST /prompt_manager/jobs/duplicates",
     "POST /prompt_manager/jobs/image-tags",
@@ -184,10 +188,14 @@
     "monitor.scheduled",
     "revision",
     "settings",
+    "settings.autotag_builtin_instructions",
     "settings.autotag_character_threshold",
+    "settings.autotag_default_instructions",
     "settings.autotag_existing",
     "settings.autotag_general_threshold",
+    "settings.autotag_instructions",
     "settings.autotag_model_type",
+    "settings.autotag_skipped_tags",
     "settings.autotag_suggestion_limit",
     "settings.autotag_template",
     "settings.cpu_count",
@@ -212,6 +220,13 @@
     "thumbnail_encoders",
     "thumbnail_encoders.jpeg",
     "thumbnail_encoders.jxl",
-    "thumbnail_encoders.webp"
+    "thumbnail_encoders.webp",
+    "thumbnail_location",
+    "thumbnail_location.available",
+    "thumbnail_location.cleanup_pending",
+    "thumbnail_location.default_path",
+    "thumbnail_location.mode",
+    "thumbnail_location.path",
+    "thumbnail_location.problem"
   ]
 }

tests/js/api-client.test.js

@@ -371,6 +371,16 @@ test("ApiError keeps the job that applied a used plan (plan-used, System S7)", (
     }
 });
 
+test("ApiError keeps a move refused for space with its review (#320)", () => {
+    const plan = { totals: { files: 3 }, insufficient: { text: "Not enough space" } };
+    assert.equal(new ApiError(507, "no space", "insufficient-space", null, { plan }).plan, plan);
+    for (const bad of [null, "x", [1], undefined]) {
+        assert.equal(new ApiError(507, "no space", "insufficient-space", null, { plan: bad }).plan, null);
+    }
+    assert.equal(new ApiError(409, "busy", "busy", null, { plan }).plan, null);
+    assert.equal(new ApiError(507, "no space", "insufficient-space").plan, null);
+});
+
 test("ApiError keeps a validated running job on busy and a validated source on invalid-source", () => {
     const body = { running: { id: "a".repeat(32), title: "Scan for metadata" }, source: "output/gone" };
     const busy = new ApiError(409, "busy", "busy", null, body);

tests/js/prompt-sender.test.js

@@ -225,3 +225,187 @@ test('acknowledgement cannot claim an extra role beyond approved changes',async(
     const {createSendSession}=await source;const s=setup(createSendSession,{apply:async()=>({targetId:'one',values:{positive:'new',negative:'also changed'}})});
     await s.session.discover();s.session.selectHost('host');s.session.selectTarget('one');await s.session.preview();await s.session.apply();assert.equal(s.session.state.phase,'error');assert.match(s.session.state.message,/unexpected acknowledgement/);s.session.dispose();
 });
+// #542: "All N eligible nodes" sends to every eligible node of one window, previewing every node first (Q542-2 C).
+function allHost({nodes=['10','9','2'],revision,preview,apply,discover}={}) {
+    const calls=[];const sent=new Set();
+    const targets=nodes.map(id=>pm(id,['positive'],revision?{revision}:{}));
+    const client={
+        discover:discover ?? (async()=>[window1(targets)]),
+        preview:async(host,id,roles)=>{calls.push(['preview',id]);if(preview)return preview(id,calls,sent);return{ticket:`t-${id}-${calls.length}`,revision,target:{id,label:`Node ${id}`},fields:[{role:'positive',before:sent.has(id)?'new':'old',after:roles.positive}]};},
+        apply:async(host,ticket)=>{const id=ticket.split('-')[1];calls.push(['apply',id,ticket]);if(apply)return apply(id,calls);sent.add(id);return{targetId:id,values:{positive:'new'}};},
+        dispose:()=>calls.push(['dispose']),
+    };
+    return {client,calls,sent};
+}
+async function allSession(createSendSession,options) {
+    const host=allHost(options);const session=createSendSession({client:host.client,roles:{positive:'new'},onChange:()=>{}});
+    await session.discover();return {...host,session};
+}
+const order=calls=>calls.filter(call=>call[0]!=='dispose').map(call=>`${call[0]} ${call[1]}`);
+test('All is offered only with two or more eligible nodes and is never selected for you',async()=>{
+    const {createSendSession,ALL_NODES}=await source;
+    const one=await allSession(createSendSession,{nodes:['1']});
+    one.session.selectTarget(ALL_NODES);assert.equal(one.session.state.targetId,'');assert.equal(one.calls.length,0);one.session.dispose();
+    const two=await allSession(createSendSession,{nodes:['1','2']});
+    assert.equal(two.session.state.targetId,'');
+    two.session.selectTarget(ALL_NODES);assert.equal(two.session.state.targetId,ALL_NODES);
+    assert.match(two.session.state.message,/all 2 eligible nodes in Flow - ComfyUI/);
+    await two.session.discover();assert.equal(two.session.state.targetId,'');two.session.dispose();
+});
+test('Apply to All previews every node first, then sends one after another in node id order',async()=>{
+    const {createSendSession,ALL_NODES}=await source;const s=await allSession(createSendSession);
+    s.session.selectTarget(ALL_NODES);await s.session.apply();
+    // Each node takes a fresh ticket, the first too: the host keeps only its latest 100 (#593).
+    assert.deepEqual(order(s.calls),['preview 2','preview 9','preview 10','preview 2','apply 2','preview 9','apply 9','preview 10','apply 10']);
+    assert.equal(s.session.state.phase,'success');assert.equal(s.session.state.message,'Sent to 3 of 3 nodes in Flow - ComfyUI.');
+    await s.session.apply();assert.equal(s.calls.filter(call=>call[0]==='apply').length,3);s.session.dispose();
+});
+test('a double click on Apply to All sends to each node once',async()=>{
+    const {createSendSession,ALL_NODES}=await source;const s=await allSession(createSendSession,{nodes:['1','2']});
+    s.session.selectTarget(ALL_NODES);await Promise.all([s.session.apply(),s.session.apply()]);
+    assert.deepEqual(s.calls.filter(call=>call[0]==='apply').map(call=>call[1]),['1','2']);s.session.dispose();
+});
+test('a node refusing its preview stops All before anything is written and names the node',async()=>{
+    const {createSendSession,ALL_NODES}=await source;
+    const s=await allSession(createSendSession,{preview:id=>{if(id==='9')throw Error('positive is connected to an upstream input.');return{ticket:`t-${id}`,target:{id},fields:[{role:'positive',before:'old',after:'new'}]};}});
+    s.session.selectTarget(ALL_NODES);await s.session.apply();
+    assert.equal(s.calls.filter(call=>call[0]==='apply').length,0);assert.equal(s.session.state.phase,'error');
+    assert.match(s.session.state.message,/^#9 Node 9: positive is connected to an upstream input\. Nothing was sent\./);
+    assert.equal(s.session.state.outcomeUnknown,false);s.session.dispose();
+});
+test('a refusal while sending to All is reported by node and the other nodes are still sent',async()=>{
+    const {createSendSession,ALL_NODES}=await source;
+    const s=await allSession(createSendSession,{apply:id=>{if(id==='9')throw Error('Workflow or prompt changed. Preview again.');return{targetId:id,values:{positive:'new'}};}});
+    s.session.selectTarget(ALL_NODES);await s.session.apply();
+    assert.deepEqual(s.calls.filter(call=>call[0]==='apply').map(call=>call[1]),['2','9','10']);
+    assert.equal(s.session.state.phase,'error');assert.equal(s.session.state.outcomeUnknown,false);
+    assert.equal(s.session.state.message,'Sent to 2 of 3 nodes in Flow - ComfyUI. #9 Node 9: Workflow or prompt changed. Preview again.');s.session.dispose();
+});
+test('a lost reply on one node of All leaves the later nodes unsent and that outcome unknown',async()=>{
+    const {createSendSession,ALL_NODES}=await source;
+    const s=await allSession(createSendSession,{apply:id=>{if(id==='9')throw Error('Bridge request timed out');return{targetId:id,values:{positive:'new'}};}});
+    s.session.selectTarget(ALL_NODES);await s.session.apply();
+    assert.deepEqual(s.calls.filter(call=>call[0]==='apply').map(call=>call[1]),['2','9']);
+    assert.equal(s.session.state.outcomeUnknown,true);
+    assert.match(s.session.state.message,/^Sent to 1 of 3 nodes in Flow - ComfyUI\. No confirmation received from #9 Node 9; the update may have applied\. Not sent: #10 Node 10\. Check ComfyUI, then preview again\. Bridge request timed out$/);
+    await s.session.apply();assert.equal(s.calls.filter(call=>call[0]==='apply').length,2);s.session.dispose();
+});
+test('closing the dialog during All stops after the current node',async()=>{
+    const {createSendSession,ALL_NODES}=await source;let release;
+    const s=await allSession(createSendSession,{apply:id=>id==='2'?new Promise(done=>release=()=>done({targetId:id,values:{positive:'new'}})):{targetId:id,values:{positive:'new'}}});
+    s.session.selectTarget(ALL_NODES);const pending=s.session.apply();
+    for(let i=0;i<50 && !release;i++)await tick();assert.ok(release,'the first node was sent');
+    s.session.dispose();release();await pending;
+    assert.deepEqual(s.calls.filter(call=>call[0]==='apply').map(call=>call[1]),['2']);
+});
+test('All accepts the revision our own write moved, but not a workflow changed before the run',async()=>{
+    const {createSendSession,ALL_NODES}=await source;
+    // The host moves the graph version on every write: later nodes preview with the new revision.
+    let version=4;
+    const bumped=await allSession(createSendSession,{revision:'1:4',preview:id=>({ticket:`t-${id}`,revision:`1:${version}`,target:{id},fields:[{role:'positive',before:'old',after:'new'}]}),apply:id=>{version++;return{targetId:id,values:{positive:'new'}};}});
+    bumped.session.selectTarget(ALL_NODES);await bumped.session.apply();
+    assert.equal(bumped.session.state.message,'Sent to 3 of 3 nodes in Flow - ComfyUI.');bumped.session.dispose();
+    const moved=await allSession(createSendSession,{revision:'1:4',preview:id=>({ticket:`t-${id}`,revision:'1:5',target:{id},fields:[{role:'positive',before:'old',after:'new'}]})});
+    moved.session.selectTarget(ALL_NODES);await moved.session.apply();
+    assert.match(moved.session.state.message,/workflow changed since this window was found/i);assert.equal(moved.calls.filter(call=>call[0]==='apply').length,0);moved.session.dispose();
+});
+test('a node whose text changed after the preview pass is refused, not overwritten',async()=>{
+    const {createSendSession,ALL_NODES}=await source;let edited=false;
+    const s=await allSession(createSendSession,{preview:id=>({ticket:`t-${id}`,target:{id},fields:[{role:'positive',before:id==='10'&&edited?'typed in ComfyUI':'old',after:'new'}]}),apply:id=>{edited=true;return{targetId:id,values:{positive:'new'}};}});
+    s.session.selectTarget(ALL_NODES);await s.session.apply();
+    assert.deepEqual(s.calls.filter(call=>call[0]==='apply').map(call=>call[1]),['2','9']);
+    assert.match(s.session.state.message,/^Sent to 2 of 3 nodes in Flow - ComfyUI\. #10 Node 10: Its prompt changed since the preview\./);s.session.dispose();
+});
+test('Preview with All shows every node in order, and Apply sends fresh tickets that match the review',async()=>{
+    const {createSendSession,ALL_NODES}=await source;const s=await allSession(createSendSession);
+    s.session.selectTarget(ALL_NODES);await s.session.preview();
+    assert.equal(s.session.state.phase,'ready');assert.equal(s.session.state.preview,null);
+    assert.deepEqual(s.session.state.previews.map(item=>item.label),['#2 Node 2','#9 Node 9','#10 Node 10']);
+    assert.match(s.session.state.message,/Sending to all 3 eligible nodes in Flow - ComfyUI\. Review the complete changes, then apply\./);
+    const first=s.session.state.previews[0].preview.ticket;
+    await s.session.apply();
+    // A held review may have outlived the host's 30 s tickets, so even the first node takes a fresh one.
+    assert.deepEqual(order(s.calls),['preview 2','preview 9','preview 10','preview 2','apply 2','preview 9','apply 9','preview 10','apply 10']);
+    assert.notEqual(s.calls.find(call=>call[0]==='apply')[2],first);assert.equal(s.session.state.phase,'success');
+    s.session.selectTarget('2');assert.deepEqual(s.session.state.previews,[]);s.session.dispose();
+});
+test('the dialog offers All for two or more nodes and reviews each node under its name',async()=>{
+    const {createPromptSender,ALL_NODES}=await source;const {createScope}=await import('../../web/js/shared/toolkit/core.js');
+    const dom=fakeDOM();const scope=createScope();
+    const {client}=allHost({nodes:['1','2']});
+    try {
+        createPromptSender({scope,clientFactory:()=>client}).open({positive:'new'});await tick();
+        const dialog=dom.body.children.at(-1);const target=dom.find(dialog,node=>node.id==='prompt-sender-target');
+        assert.deepEqual(target.children.map(option=>[option.value,option.textContent]),[['','Choose a destination node'],['1','#1 Node 1'],['2','#2 Node 2'],[ALL_NODES,'All 2 eligible nodes']]);
+        assert.equal(target.value,'');target.value=ALL_NODES;target.dispatchEvent(new Event('change'));
+        dom.find(dialog,node=>node.textContent==='Preview changes').dispatchEvent(new Event('click'));for(let i=0;i<5;i++)await tick();
+        const sections=[];(function walk(node){if(node.className==='prompt-sender-node')sections.push(node);node.children.forEach(walk);})(dialog);
+        assert.deepEqual(sections.map(section=>section.children[0].textContent),['#1 Node 1','#2 Node 2']);
+        dom.find(dialog,node=>node.textContent==='Apply to ComfyUI').dispatchEvent(new Event('click'));for(let i=0;i<10;i++)await tick();
+        assert.ok(dom.find(dialog,node=>node.textContent==='Sent to 2 of 2 nodes in Flow - ComfyUI.'));
+    } finally {scope.dispose();dom.restore();}
+});
+test('an expired review still sends every node, and a held review checks the discovered revision first',async()=>{
+    const {createSendSession,ALL_NODES}=await source;let reviewing=true;
+    // The host refuses every ticket taken during the review, as after its 30 s expiry.
+    const s=await allSession(createSendSession,{preview:(id,calls)=>({ticket:`t-${id}-${reviewing?'old':calls.length}`,target:{id},fields:[{role:'positive',before:'old',after:'new'}]}),apply:id=>({targetId:id,values:{positive:'new'}})});
+    const realApply=s.client.apply;s.client.apply=async(host,ticket,options)=>{if(ticket.endsWith('-old'))throw Error('Preview expired or unavailable; preview again');return realApply(host,ticket,options);};
+    s.session.selectTarget(ALL_NODES);await s.session.preview();reviewing=false;await s.session.apply();
+    assert.equal(s.session.state.message,'Sent to 3 of 3 nodes in Flow - ComfyUI.');s.session.dispose();
+    const moved=await allSession(createSendSession,{revision:'1:4',preview:(id,calls)=>({ticket:`t-${id}`,revision:calls.length>3?'1:5':'1:4',target:{id},fields:[{role:'positive',before:'old',after:'new'}]})});
+    moved.session.selectTarget(ALL_NODES);await moved.session.preview();assert.equal(moved.session.state.phase,'ready');await moved.session.apply();
+    assert.match(moved.session.state.message,/^Sent to 0 of 3 nodes in Flow - ComfyUI\. #2 Node 2: The workflow changed since this window was found/);
+    assert.equal(moved.calls.filter(call=>call[0]==='apply').length,0);moved.session.dispose();
+});
+test('a changed prepend or append after the review refuses that node',async()=>{
+    const {createSendSession,ALL_NODES}=await source;let edited=false;
+    const s=await allSession(createSendSession,{preview:id=>({ticket:`t-${id}`,target:{id},fields:[{role:'positive',before:'old',after:'new'}],composition:{prepend:id==='9'&&edited?'typed':'trigger',append:'',before:'trigger old',after:'trigger new'}}),apply:id=>{edited=true;return{targetId:id,values:{positive:'new'}};}});
+    s.session.selectTarget(ALL_NODES);await s.session.apply();
+    assert.deepEqual(s.calls.filter(call=>call[0]==='apply').map(call=>call[1]),['2','10']);
+    assert.match(s.session.state.message,/^Sent to 2 of 3 nodes in Flow - ComfyUI\. #9 Node 9: Its prompt changed since the preview\./);s.session.dispose();
+});
+
+// #593: Send to All through the real Toolkit bridge and the real adapter, as the review bot reproduced it.
+function realWindow(count) {
+    const listeners=new Set();
+    const channelFactory=()=>{const own=new Set();return{
+        addEventListener(type,listener){if(type==='message'){own.add(listener);listeners.add(listener);}},removeEventListener(type,listener){listeners.delete(listener);},
+        postMessage(data){for(const listener of [...listeners])if(!own.has(listener))queueMicrotask(()=>listener({data:structuredClone(data),origin:'https://comfy.example'}));},close(){},
+    };};
+    // Like LiteGraph, a widget write moves the version of the graph it is in.
+    const graph=()=>{const made={_version:1,setDirtyCanvas(){made._version++;}};made._nodes=Array.from({length:count},(_,index)=>{
+        const widgets=['text','prepend_text','append_text'].map(name=>({name,value:name==='text'?'old':'',inputEl:{value:name==='text'?'old':''}}));
+        return {id:index+1,type:'PromptManager',title:`Node ${index+1}`,widgets,widgets_values:widgets.map(widget=>widget.value),inputs:[],setDirtyCanvas(){}};
+    });return made;};
+    return {channelFactory,graph};
+}
+async function realSend(count,{afterFirstApply}={}) {
+    const {createSendSession,ALL_NODES}=await source;
+    const {createBridgeHost,createBridgeClient}=await import('../../web/js/shared/toolkit/prompt-bridge.js');
+    const {createPromptAdapter}=await import('../../web/js/prompt-bridge-adapter.js');
+    const win=realWindow(count);const app={graph:win.graph(),canvas:{}};
+    const adapter=createPromptAdapter(app,{runtime:{}});let applied=0;
+    const watched={...adapter,apply(snapshot){const result=adapter.apply(snapshot);if(++applied===1)afterFirstApply?.(app,win);return result;}};
+    const options={namespace:'/prompt_manager/',origin:'https://comfy.example',channelFactory:win.channelFactory};
+    const host=createBridgeHost({...options,label:'Flow - ComfyUI',adapter:watched});
+    const client=createBridgeClient(options);
+    const session=createSendSession({client,roles:{positive:'new'},onChange:()=>{}});
+    try {
+        await session.discover();session.selectTarget(ALL_NODES);await session.apply();
+        return {state:session.state,app};
+    } finally { session.dispose();host.dispose(); }
+}
+test('All refuses the later nodes when another workflow is loaded after the first send (#593)',async()=>{
+    let first;
+    const {state,app}=await realSend(3,{afterFirstApply:(target,win)=>{first=target.graph;target.graph=win.graph();target.graph._version=first._version;}});
+    // The new workflow has the same ids, text and composition, and even the same graph version: only node identity differs.
+    assert.equal(first._nodes[0].widgets[0].value,'new');
+    assert.deepEqual(app.graph._nodes.map(node=>node.widgets[0].value),['old','old','old']);
+    assert.equal(state.phase,'error');
+    assert.match(state.message,/^Sent to 1 of 3 nodes in Flow - ComfyUI\. #2 Node 2: The workflow changed since this window was found\./);
+});
+test('All sends to every node of a window with more than 100 of them (#593)',async()=>{
+    const {state,app}=await realSend(101);
+    assert.equal(state.message,'Sent to 101 of 101 nodes in Flow - ComfyUI.');
+    assert.ok(app.graph._nodes.every(node=>node.widgets[0].value==='new'));
+});

tests/js/workspace-image-tagging-state.test.js

@@ -53,8 +53,12 @@ function observed(overrides = {}, capture = {}) {
         ...overrides,
     };
 }
+// #431: the saved instructions; the fixture's entry is the default of both engines.
+const SAVED_ENTRY = { id: '0123456789ab', name: 'Saved', text: DEFAULT_PROMPT };
 const models = (overrides = {}) => ({
-    success: true, models: { 'wd14-swinv2': { downloaded: true } }, default_prompt: DEFAULT_PROMPT,
+    success: true, models: { 'wd14-swinv2': { downloaded: true } },
+    instructions: [{ id: 'builtin', name: 'Built-in', text: 'Built-in text.' }, SAVED_ENTRY],
+    default_instructions: { gguf: SAVED_ENTRY.id, hf: SAVED_ENTRY.id },
     wd14_general_threshold: 0.35, wd14_character_threshold: 0.85, suggestion_limit: 10, ...overrides,
 });
 const SANDSTONE = [
@@ -244,10 +248,13 @@ test('dialog starts on the saved model unless a preset or the user chose one', a
 });
 
 test('an unreadable or malformed models read falls back to the documented defaults', async () => {
-    for (const route of [() => fail(500, null), () => response(200, models({ default_prompt: 4, suggestion_limit: 0, wd14_general_threshold: 2, wd14_character_threshold: 'x' }))]) {
+    for (const route of [() => fail(500, null), () => response(200, models({ instructions: 4, suggestion_limit: 0, wd14_general_threshold: 2, wd14_character_threshold: 'x' }))]) {
         const { c } = await opened({ [`GET ${MODELS}`]: route });
         assert.equal(c.state.phase, 'ready');
-        assert.deepEqual({ ...c.state.options }, { general_threshold: 0.35, character_threshold: 0.85, instructions: '', suggestion_limit: 10 });
+        // #431: the client's Built-in copy (D204's read failure).
+        const { BUILTIN_INSTRUCTIONS } = await load();
+        assert.deepEqual({ ...c.state.options }, { general_threshold: 0.35, character_threshold: 0.85, instructions: BUILTIN_INSTRUCTIONS,
+            suggestion_limit: 10 });
     }
 });
 
@@ -936,3 +943,99 @@ test('#515: text typed before Retry after a failed first observation follows the
     assert.equal(c.state.manual, 'Minimal, warm_light, dunes');
     assert.equal(c.state.statusText, '');
 });
+
+test('the chip hint says how many skipped tags were not suggested (#431)', async () => {
+    const { skippedNote } = await load();
+    assert.equal(skippedNote(0), '');
+    assert.equal(skippedNote(undefined), '');
+    assert.equal(skippedNote(1), ' 1 skipped tag was not suggested.');
+    assert.equal(skippedNote(2), ' 2 skipped tags were not suggested.');
+    for (const [skipped, hint] of [[2, 'Remove anything you do not want to add. 2 skipped tags were not suggested.'],
+        [0, 'Remove anything you do not want to add.'], ['3', 'Remove anything you do not want to add.']]) {
+        const { c } = await opened({ [`POST ${SUGGEST}`]: () => response(200, { ...suggested(), skipped }) });
+        await c.generate();
+        assert.equal(c.state.chipHint, hint, String(skipped));
+    }
+});
+
+// D204 (#431): the Saved instructions picker of both dialogs.
+const PHOTO_ENTRY = { id: '0123456789ac', name: 'Photo', text: 'Photo tags.' };
+const picker = (overrides = {}) => ({ [`GET ${MODELS}`]: () => response(200, models({ model_type: 'gguf',
+    instructions: [{ id: 'builtin', name: 'Built-in', text: 'Built-in text.' }, SAVED_ENTRY, PHOTO_ENTRY],
+    default_instructions: { gguf: SAVED_ENTRY.id, hf: PHOTO_ENTRY.id }, ...overrides })) });
+
+test('the picker starts at the engine default; a pick replaces the text and an edit is one-off (D204)', async () => {
+    const { c } = await opened(picker());
+    assert.deepEqual([c.state.instructionId, c.state.options.instructions, c.state.instructionsEdited], [SAVED_ENTRY.id, DEFAULT_PROMPT, false]);
+    const revision = c.state.optionsRevision;
+    c.pickInstructions(PHOTO_ENTRY.id);
+    assert.deepEqual([c.state.instructionId, c.state.options.instructions, c.state.instructionsEdited], [PHOTO_ENTRY.id, 'Photo tags.', false]);
+    assert.equal(c.state.optionsRevision, revision + 1, 'a pick re-renders the textarea');
+    c.setOption('instructions', 'Photo tags, please.');
+    assert.equal(c.state.instructionsEdited, true);
+    assert.equal(c.state.optionsRevision, revision + 1, 'typing never re-renders');
+    // Choosing an entry again replaces the edit without asking; an unknown id changes nothing.
+    c.pickInstructions(PHOTO_ENTRY.id);
+    assert.deepEqual([c.state.options.instructions, c.state.instructionsEdited], ['Photo tags.', false]);
+    c.pickInstructions('nope');
+    assert.equal(c.state.instructionId, PHOTO_ENTRY.id);
+    // Switching engines resets to the new engine's default and drops a one-off edit; WD14 is never "edited".
+    c.setOption('instructions', 'edited');
+    c.setModel('hf');
+    assert.deepEqual([c.state.instructionId, c.state.options.instructions, c.state.instructionsEdited], [PHOTO_ENTRY.id, 'Photo tags.', false]);
+    c.setModel('wd14-vit');
+    assert.equal(c.state.instructionsEdited, false);
+    c.setModel('gguf');
+    assert.deepEqual([c.state.instructionId, c.state.options.instructions], [SAVED_ENTRY.id, DEFAULT_PROMPT]);
+    c.dispose();
+});
+
+test('a preset shows the entry with its text, else "Edited for this run" (D204)', async () => {
+    const { c } = await opened(picker(), { preset: { model: 'hf', options: { instructions: DEFAULT_PROMPT } } });
+    assert.deepEqual([c.state.instructionId, c.state.instructionsEdited], [SAVED_ENTRY.id, false]);
+    const { c: other } = await opened(picker(), { preset: { model: 'hf', options: { instructions: 'Something else' } } });
+    assert.deepEqual([other.state.instructionId, other.state.options.instructions, other.state.instructionsEdited],
+        [PHOTO_ENTRY.id, 'Something else', true]);
+    for (const controller of [c, other]) controller.dispose();
+});
+
+test('a models read without instructions offers Built-in only with the client copy (D204)', async () => {
+    const { BUILTIN_INSTRUCTIONS, readChoices } = await load();
+    assert.equal(BUILTIN_INSTRUCTIONS.startsWith('Generate only comma-separated Danbooru tags'), true);
+    for (const value of [null, {}, { instructions: [] }, { instructions: [{ id: 'x', name: 'X', text: 'y' }] }]) {
+        assert.deepEqual(readChoices(value).entries.map(entry => entry.id), ['builtin'], JSON.stringify(value));
+    }
+    // A default naming no entry is Built-in.
+    assert.deepEqual({ ...readChoices({ instructions: [{ id: 'builtin', name: 'Built-in', text: 't' }], default_instructions: { gguf: 'gone' } }).defaults },
+        { gguf: 'builtin', hf: 'builtin' });
+    const { c } = await opened(picker({ instructions: 'broken' }));
+    assert.deepEqual([c.state.instructionId, c.state.options.instructions], ['builtin', BUILTIN_INSTRUCTIONS]);
+    c.dispose();
+});
+
+test('the bulk options pick and reset like the Tag image dialog (D204)', async () => {
+    const { createTaggingOptionsController } = await load();
+    const options = createTaggingOptionsController({ api: harness(defaultRoutes(picker())).api });
+    await options.open();
+    assert.deepEqual([options.state.model, options.state.instructionId, options.state.options.instructions], ['gguf', SAVED_ENTRY.id, DEFAULT_PROMPT]);
+    options.pickInstructions(PHOTO_ENTRY.id);
+    assert.equal(options.request().options.instructions, 'Photo tags.');
+    options.setOption('instructions', 'One-off.');
+    assert.equal(options.state.instructionsEdited, true);
+    assert.equal(options.request().options.instructions, 'One-off.');
+    options.setModel('hf');
+    assert.deepEqual([options.state.instructionId, options.state.instructionsEdited], [PHOTO_ENTRY.id, false]);
+    options.pickInstructions('nope');
+    options.dispose();
+    options.pickInstructions(SAVED_ENTRY.id);
+    assert.equal(options.state.instructionId, PHOTO_ENTRY.id);
+});
+
+test('the client Built-in copy equals the server DEFAULT_TAG_TEMPLATE (#431)', async () => {
+    const { BUILTIN_INSTRUCTIONS } = await load();
+    const source = require('node:fs').readFileSync(require('node:path').join(__dirname, '../../py/tagging_defaults.py'), 'utf8');
+    const block = source.slice(source.indexOf('DEFAULT_TAG_TEMPLATE = ('), source.indexOf('\n)\n', source.indexOf('DEFAULT_TAG_TEMPLATE = (')));
+    const text = [...block.matchAll(/"((?:[^"\\]|\\.)*)"/g)].map(([, part]) => JSON.parse(`"${part}"`)).join('');
+    assert.ok(text.length > 100);
+    assert.equal(BUILTIN_INSTRUCTIONS, text);
+});

tests/js/workspace-images-tagging-bulk.test.js

@@ -180,7 +180,9 @@ test('the bulk options start from the server defaults and wait for them before S
     assert.equal(options.state.canStart, false);
     assert.equal(options.state.canGenerate, false);
     const opening = options.open();
-    answer({ wd14_general_threshold: 0.5, wd14_character_threshold: 0.9, default_prompt: 'Say it', suggestion_limit: 7,
+    answer({ wd14_general_threshold: 0.5, wd14_character_threshold: 0.9, suggestion_limit: 7,
+        instructions: [{ id: 'builtin', name: 'Built-in', text: 'Built-in text.' }, { id: '0123456789ab', name: 'Say', text: 'Say it' }],
+        default_instructions: { gguf: '0123456789ab', hf: 'builtin' },
         models: { 'wd14-swinv2': { downloaded: true }, 'wd14-vit': { downloaded: false }, gguf: { downloaded: true } } });
     await opening;
     assert.equal(options.state.canStart, true);

tests/js/workspace-system-backups.test.js

@@ -128,6 +128,24 @@ test('invalid file shows the validator message; a refusal names its job; a lost
     assert.deepEqual(await uploadRestore(file, { ApiError, fetchUrl: async () => response(200, PREVIEW) }), PREVIEW);
 });
 
+// #583: WebKit reads a FormData's file part by reference, possibly after a garbage collection; the page holds the form
+// until the upload is answered, then lets it go, whether the server staged it, refused it or the request failed.
+test('a review upload keeps its form referenced until the upload is answered', async () => {
+    const { uploadRestore, uploadsInFlight } = await backups;
+    const file = new File(['bytes'], 'b.db');
+    for (const answer of [async () => response(200, PREVIEW), async () => response(400, { success: false, error: 'x' }),
+        async () => { throw new TypeError('offline'); }]) {
+        let held;
+        const upload = uploadRestore(file, { ApiError, fetchUrl: async (url, init) => {
+            held = uploadsInFlight.has(init.body) && init.body.get('database_file').size === file.size;
+            return answer();
+        } }).catch(() => {});
+        await upload;
+        assert.equal(held, true);
+        assert.equal(uploadsInFlight.size, 0);
+    }
+});
+
 test('Cancel discards the stage through the api client and never throws', async () => {
     const { discardRestore, PREVIEW_URL } = await backups;
     const calls = [];

tests/js/workspace-system-instructions.test.js

@@ -0,0 +1,257 @@
+// System › Auto-tagging "Saved instructions" (#431, D203): Built-in read-only, New, Duplicate, Delete (a deleted default
+// resets to Built-in), the caps, the editor drafts and the per-engine default selects.
+const test = require('node:test');
+const assert = require('node:assert/strict');
+
+const instructionsModule = import('../../web/js/workspace/system-instructions.mjs');
+const stateModule = import('../../web/js/workspace/system-state.mjs');
+const coreModule = import('../../web/js/shared/toolkit/core.js');
+
+/** A minimal DOM: elements with children, attributes, listeners (aborted by their signal) and focus. */
+function fakeDOM() {
+    const previous = global.document;
+    class Element {
+        constructor(tag) {
+            this.tagName = tag.toUpperCase();
+            this.children = [];
+            this.attributes = {};
+            this.listeners = [];
+            this.dataset = {};
+            this.className = '';
+            this.id = '';
+            this.value = '';
+            this.title = '';
+            this.disabled = false;
+            this._text = '';
+        }
+        get localName() { return this.tagName.toLowerCase(); }
+        get textContent() { return this._text + this.children.map(child => (typeof child === 'string' ? child : child.textContent)).join(''); }
+        set textContent(text) { this.children = []; this._text = String(text); }
+        append(...nodes) { for (const node of nodes) { if (typeof node !== 'string') node.parentNode = this; this.children.push(node); } }
+        replaceChildren(...nodes) { this.children = []; this._text = ''; this.append(...nodes); }
+        querySelectorAll(selector) {
+            assert.equal(selector, 'button');
+            const found = [];
+            const walk = node => { for (const child of node.children) if (typeof child !== 'string') { if (child.tagName === 'BUTTON') found.push(child); walk(child); } };
+            walk(this);
+            return found;
+        }
+        focus() { global.document.activeElement = this; }
+        setAttribute(name, value) { this.attributes[name] = String(value); }
+        getAttribute(name) { return Object.hasOwn(this.attributes, name) ? this.attributes[name] : null; }
+        removeAttribute(name) { delete this.attributes[name]; }
+        addEventListener(type, callback, options = {}) {
+            if (options.signal?.aborted) return;
+            const entry = { type, callback };
+            this.listeners.push(entry);
+            options.signal?.addEventListener('abort', () => { this.listeners = this.listeners.filter(item => item !== entry); });
+        }
+        dispatch(type, event = {}) {
+            return Promise.all(this.listeners.filter(item => item.type === type).map(({ callback }) => callback({ type, target: this, ...event })));
+        }
+    }
+    global.document = { createElement: tag => new Element(tag), activeElement: null };
+    const walk = (node, found = []) => { found.push(node); node.children.forEach(child => typeof child !== 'string' && walk(child, found)); return found; };
+    return { find: (root, predicate) => walk(root).find(predicate), restore() { global.document = previous; } };
+}
+
+
+const PHOTO = { id: '0123456789ab', name: 'Custom template', text: 'Photo tags.' };
+const ANIME = { id: '0123456789ac', name: 'Anime', text: 'Anime tags.' };
+const HOST = { autotag_builtin_instructions: 'Built-in text.', autotag_instructions: [PHOTO, ANIME],
+    autotag_default_instructions: { gguf: PHOTO.id, hf: PHOTO.id } };
+
+async function mounted({ host = HOST } = {}) {
+    const { savedInstructionsBlock } = await instructionsModule;
+    const { createSystemDrafts } = await stateModule;
+    const { createScope } = await coreModule;
+    const dom = fakeDOM();
+    const drafts = createSystemDrafts({
+        readBrowser: () => ({}), readRuntime: () => ({}), readHost: async () => ({ values: host, revision: 'sha256:one' }),
+        writeBrowser: async () => ({}), writeHost: async () => ({ success: true, persisted: true }), writeRuntime: async () => ({}),
+    });
+    const scope = createScope();
+    let counter = 0;
+    const random = bytes => bytes.map(() => (counter += 1));
+    const block = savedInstructionsBlock({ scope, drafts, random });
+    const root = global.document.createElement('div');
+    root.append(...block.nodes);
+    scope.cleanup(drafts.subscribe(block.repaint));
+    block.repaint();
+    await drafts.reloadHost();
+    const byId = id => dom.find(root, node => node.id === id);
+    const options = () => byId('instruction-list').children.map(option => [option.children[0].textContent,
+        option.children[1]?.children.map(badge => badge.textContent) ?? [], option.getAttribute('aria-selected')]);
+    const click = id => byId(id).dispatch('click');
+    // A click on an option reaches the list's one listener (as it bubbles in a browser).
+    const pick = name => byId('instruction-list').dispatch('click', { target: byId('instruction-list').children
+        .find(option => option.children[0].textContent === name).children[0] });
+    return { dom, drafts, scope, block, byId, options, click, pick, root };
+}
+
+test('helpers: Built-in first, defaults, free names, ids and the server sentences', async () => {
+    const { allEntries, defaultEntry, freeName, newId, listProblem, entryNote } = await instructionsModule;
+    assert.deepEqual(allEntries(HOST).map(entry => entry.name), ['Built-in', 'Custom template', 'Anime']);
+    assert.equal(allEntries(HOST)[0].text, 'Built-in text.');
+    assert.equal(defaultEntry(HOST, 'hf').text, 'Photo tags.');
+    assert.equal(defaultEntry({ ...HOST, autotag_default_instructions: { gguf: 'gone', hf: 'builtin' } }, 'gguf').name, 'Built-in');
+    assert.equal(freeName('New instructions', allEntries(HOST)), 'New instructions');
+    assert.equal(freeName('anime', allEntries(HOST)), 'anime (2)');
+    assert.equal(freeName('Anime', [...allEntries(HOST), { name: 'Anime (2)' }]), 'Anime (3)');
+    let calls = 0;
+    const id = newId([{ id: '000000000000' }], bytes => { calls += 1; return bytes.fill(calls === 1 ? 0 : 171); });
+    assert.equal(id, 'abababababab');
+    assert.match(newId([]), /^[0-9a-f]{12}$/);
+    const list = entries => listProblem({ autotag_instructions: entries });
+    assert.equal(list([PHOTO]), null);
+    assert.equal(list([{ ...PHOTO, name: ' ' }]), 'Saved instructions: entry 1 needs a name.');
+    assert.equal(list([PHOTO, { ...ANIME, name: 'x'.repeat(61) }]), 'Saved instructions: entry 2 name must be at most 60 characters.');
+    assert.equal(list([{ ...PHOTO, name: 'a\nb' }]), 'Saved instructions: entry 1 name must not contain a line break.');
+    assert.equal(list([{ ...PHOTO, name: 'built-in' }]), 'Saved instructions: the name “Built-in” is reserved.');
+    assert.equal(list([PHOTO, { ...ANIME, name: ' custom TEMPLATE ' }]), 'Saved instructions: entry 2 name “custom TEMPLATE” is already used.');
+    assert.equal(list([{ ...PHOTO, text: ' ' }]), 'Saved instructions: entry 1 text must be non-empty text.');
+    assert.equal(list([{ ...PHOTO, text: 'x'.repeat(4001) }]), 'Saved instructions: entry 1 text must be at most 4000 characters.');
+    const long = { ...PHOTO, text: 'x'.repeat(4001) };
+    assert.equal(entryNote(long, [long]), 'The text must be at most 4,000 characters.');
+});
+
+test('the list shows Built-in read-only first, the saved entries and their default chips', async () => {
+    const view = await mounted();
+    try {
+        assert.deepEqual(view.options(), [['Built-in', ['Read-only'], 'true'],
+            ['Custom template', ['Default for GGUF', 'Default for HuggingFace'], 'false'], ['Anime', [], 'false']]);
+        assert.equal(view.byId('instructions-count').textContent, '2 of 20 saved · Built‑in is not counted.');
+        assert.equal(view.byId('instruction-name').value, 'Built-in');
+        assert.equal(view.byId('instruction-name').readOnly, true);
+        assert.equal(view.byId('instruction-text').value, 'Built-in text.');
+        assert.equal(view.byId('instruction-text').readOnly, true);
+        assert.equal(view.byId('instruction-note').textContent, 'Built-in instructions can’t be changed. Duplicate them to make your own.');
+        assert.equal(view.byId('instruction-delete').disabled, true);
+        assert.equal(view.byId('instruction-list').getAttribute('role'), 'listbox');
+        assert.equal(view.block.nodes[0].dataset.key, 'autotag_instructions');
+        assert.deepEqual(view.byId('instruction-default-gguf').children.map(option => option.textContent), ['Built-in', 'Custom template', 'Anime']);
+        assert.equal(view.byId('instruction-default-gguf').value, PHOTO.id);
+        assert.equal(view.byId('instruction-default-hf').dataset.key, 'autotag_default_instructions');
+    } finally { view.scope.dispose(); view.dom.restore(); }
+});
+
+test('editing a saved entry drafts the list; its counts and note follow', async () => {
+    const view = await mounted();
+    try {
+        await view.pick('Anime');
+        assert.equal(view.byId('instruction-name').readOnly, false);
+        assert.equal(view.byId('instruction-delete').disabled, false);
+        view.byId('instruction-name').value = 'Anime tags';
+        await view.byId('instruction-name').dispatch('input');
+        view.byId('instruction-text').value = 'Tags, anime.';
+        await view.byId('instruction-text').dispatch('input');
+        assert.deepEqual(view.drafts.get('host', 'autotag_instructions'), [PHOTO, { ...ANIME, name: 'Anime tags', text: 'Tags, anime.' }]);
+        assert.equal(view.byId('instruction-name').parentNode.children[0].children[1].textContent, '10 of 60');
+        assert.equal(view.byId('instruction-text').parentNode.children[0].children[1].textContent, '12 of 4,000 characters');
+        view.byId('instruction-name').value = 'custom template';
+        await view.byId('instruction-name').dispatch('input');
+        assert.equal(view.byId('instruction-note').textContent, 'The name “custom template” is already used.');
+        // Built-in is never edited.
+        await view.pick('Built-in');
+        view.byId('instruction-text').value = 'changed';
+        await view.byId('instruction-text').dispatch('input');
+        assert.equal(view.drafts.get('host', 'autotag_instructions')[0], PHOTO);
+    } finally { view.scope.dispose(); view.dom.restore(); }
+});
+
+test('New and Duplicate append an entry with a fresh id and a free name; the caps disable them', async () => {
+    const view = await mounted();
+    try {
+        await view.click('instruction-new');
+        const added = view.drafts.get('host', 'autotag_instructions').at(-1);
+        assert.match(added.id, /^[0-9a-f]{12}$/);
+        assert.deepEqual([added.name, added.text], ['New instructions', '']);
+        assert.equal(view.options().at(-1)[2], 'true');
+        assert.equal(view.byId('instruction-note').textContent, 'The text must not be empty.');
+        await view.pick('Built-in');
+        await view.click('instruction-duplicate');
+        assert.deepEqual(view.drafts.get('host', 'autotag_instructions').at(-1).name, 'Built-in copy');
+        assert.equal(view.drafts.get('host', 'autotag_instructions').at(-1).text, 'Built-in text.');
+        const full = await mounted({ host: { ...HOST, autotag_instructions: Array.from({ length: 20 },
+            (_, i) => ({ id: i.toString(16).padStart(12, '0'), name: `n${i}`, text: 't' })) } });
+        try {
+            assert.equal(full.byId('instruction-new').disabled, true);
+            assert.equal(full.byId('instruction-duplicate').disabled, true);
+            assert.equal(full.byId('instruction-cap').hidden, false);
+            await full.click('instruction-new');
+            assert.equal(full.drafts.get('host', 'autotag_instructions').length, 20);
+        } finally { full.scope.dispose(); }
+    } finally { view.scope.dispose(); view.dom.restore(); }
+});
+
+test('deleting a default resets that engine to Built-in and says so; a select change clears the note', async () => {
+    const view = await mounted();
+    try {
+        await view.pick('Custom template');
+        await view.click('instruction-delete');
+        assert.deepEqual(view.drafts.get('host', 'autotag_instructions'), [ANIME]);
+        assert.deepEqual(view.drafts.get('host', 'autotag_default_instructions'), { gguf: 'builtin', hf: 'builtin' });
+        assert.equal(view.byId('instruction-reset').textContent, 'GGUF and HuggingFace now use Built-in.');
+        assert.equal(view.options()[1][2], 'true', 'the next entry is selected');
+        view.byId('instruction-default-hf').value = ANIME.id;
+        await view.byId('instruction-default-hf').dispatch('change');
+        assert.deepEqual(view.drafts.get('host', 'autotag_default_instructions'), { gguf: 'builtin', hf: ANIME.id });
+        assert.equal(view.byId('instruction-reset').textContent, '');
+        await view.click('instruction-delete');
+        assert.equal(view.byId('instruction-reset').textContent, 'HuggingFace now uses Built-in.');
+        assert.deepEqual(view.options().map(([name]) => name), ['Built-in']);
+    } finally { view.scope.dispose(); view.dom.restore(); }
+});
+
+test('arrow keys move the selection; before the read everything is disabled', async () => {
+    const view = await mounted();
+    try {
+        const list = view.byId('instruction-list');
+        await list.dispatch('keydown', { key: 'ArrowDown' });
+        assert.equal(view.byId('instruction-name').value, 'Custom template');
+        await list.dispatch('keydown', { key: 'End' });
+        assert.equal(view.byId('instruction-name').value, 'Anime');
+        await list.dispatch('keydown', { key: 'ArrowDown' });
+        assert.equal(view.byId('instruction-name').value, 'Anime');
+        await list.dispatch('keydown', { key: 'Home' });
+        assert.equal(view.byId('instruction-name').value, 'Built-in');
+        await list.dispatch('keydown', { key: 'a' });
+        assert.equal(list.getAttribute('aria-activedescendant'), 'instruction-option-builtin');
+    } finally { view.scope.dispose(); view.dom.restore(); }
+    const unread = await mounted({ host: {} });
+    try {
+        assert.equal(unread.byId('instruction-new').disabled, true);
+        assert.equal(unread.byId('instruction-default-gguf').disabled, true);
+    } finally { unread.scope.dispose(); unread.dom.restore(); }
+});
+
+test('the reset note goes once the defaults are saved; a long name is cut to fit its copy suffix', async () => {
+    const view = await mounted();
+    try {
+        await view.pick('Custom template');
+        await view.click('instruction-delete');
+        assert.equal(view.byId('instruction-reset').textContent, 'GGUF and HuggingFace now use Built-in.');
+        await view.drafts.save();
+        assert.equal(view.byId('instruction-reset').textContent, '');
+        await view.pick('Anime');
+        view.byId('instruction-name').value = 'x'.repeat(60);
+        await view.byId('instruction-name').dispatch('input');
+        await view.click('instruction-duplicate');
+        const copy = view.drafts.get('host', 'autotag_instructions').at(-1).name;
+        assert.equal(copy, `${'x'.repeat(55)} copy`);
+        await view.click('instruction-duplicate');
+        assert.equal([...view.drafts.get('host', 'autotag_instructions').at(-1).name].length <= 60, true);
+    } finally { view.scope.dispose(); view.dom.restore(); }
+});
+
+test('option clicks are one listener on the list, not one per repaint', async () => {
+    const view = await mounted();
+    try {
+        const list = view.byId('instruction-list');
+        const before = list.listeners.length;
+        for (let i = 0; i < 5; i += 1) await view.pick('Anime');
+        assert.equal(list.listeners.length, before);
+        assert.equal(view.byId('instruction-list').children.every(option => option.listeners.length === 0), true);
+        assert.equal(view.byId('instruction-name').value, 'Anime');
+    } finally { view.scope.dispose(); view.dom.restore(); }
+});

tests/js/workspace-system-maintenance.test.js

@@ -21,8 +21,23 @@ test('the section lists the concept rows in its order, labels and danger marks',
     assert.deepEqual(MAINTENANCE_SURFACES.map(([heading]) => heading), surfaces.map(text => text.replace('&', '&')));
     const production = MAINTENANCE_SURFACES.flatMap(([, rows]) => rows.map(([title, description, label, , danger = false]) =>
         [title, description, label, danger]));
-    assert.deepEqual(production, concept.map(([title, ...rest]) => [title.replace('&', '&'), ...rest]));
-    assert.equal(production.length, 8);
+    // D192 (#550, beyond the concept): "Pair category and tags" follows "Unused prompt components" in Database.
+    const expected = concept.map(([title, ...rest]) => [title.replace('&', '&'), ...rest]);
+    expected.splice(expected.findIndex(([title]) => title === 'Unused prompt components') + 1, 0, PAIR_ROW);
+    assert.deepEqual(production, expected);
+    assert.equal(production.length, 9);
+});
+
+const PAIR_ROW = Object.freeze(['Pair category and tags', 'Fill an empty category or tags on prompts older Pair node runs ' +
+    'saved, from their saved pairs. Only empty fields of never-edited prompts.', 'Review plan', false]);
+
+test('D192: the Pair category and tags row reviews the pair_metadata plan under its title (#550)', async () => {
+    const { MAINTENANCE_SURFACES } = await maintenance;
+    const { OPERATION_TITLES } = await review;
+    const [, database] = MAINTENANCE_SURFACES[0];
+    const row = database.find(([title]) => title === PAIR_ROW[0]);
+    assert.deepEqual(row, [PAIR_ROW[0], PAIR_ROW[1], PAIR_ROW[2], 'pair_metadata']);
+    assert.equal(OPERATION_TITLES.pair_metadata, 'Pair category and tags');
 });
 
 const PLAN = Object.freeze({
@@ -210,3 +225,40 @@ test('a rotated-log cleanup the log overtook offers Review again (S12)', async (
     assert.deepEqual(reviewAgainOf({ kind: 'maintenance', state: 'failed', scope: { operation: 'rotated_logs', failure: 'plan-changed' } }),
         { operation: 'rotated_logs' });
 });
+
+// #550 live test: a records operation's rows have no path, only a detail ("Prompt 12: category …").
+const RECORD_JOB = Object.freeze({
+    id: 'a'.repeat(32), kind: 'maintenance', title: 'Pair category and tags', state: 'finished',
+    admission: 'records', cancellable: false, progress: 100, processed: 0, total: 0, status_line: 'Filled 2 prompts',
+    scope: { operation: 'pair_metadata' }, counters: { changed: 2, protected: 0, errors: 0 },
+    started_at: 1, finished_at: 2,
+});
+
+test('#550: path-less record rows are kept with their detail; file rows are unchanged', async () => {
+    const { parseDetail, filterRows } = await jobView;
+    const parsed = parseDetail({ ...RECORD_JOB, outcomes: { changed: [
+        { path: '', root: '', root_index: null, detail: 'Prompt 2325: category “asian”; tags asian' },
+        { path: '', root: '', root_index: null, detail: '' },
+        { path: 'a/b.png', root: 'output', root_index: 0, detail: 'Link removed' },
+    ] }, log: [] });
+    assert.deepEqual(parsed.outcomes.changed, [
+        { path: '', root: '', root_index: null, detail: 'Prompt 2325: category “asian”; tags asian', record: true },
+        { path: 'a/b.png', root: 'output', root_index: 0, detail: 'Link removed', record: false },
+    ]);
+    // The filter reads a record's detail and a file's path.
+    assert.deepEqual(filterRows(parsed.outcomes.changed, 'asian').map(row => row.detail),
+        ['Prompt 2325: category “asian”; tags asian']);
+    assert.deepEqual(filterRows(parsed.outcomes.changed, 'a/b').map(row => row.path), ['a/b.png']);
+});
+
+test('#550: a records operation says records, not files, for an empty group and a filter', async () => {
+    const { groupCopy, EMPTY_GROUP, NO_MATCH } = await jobView;
+    assert.deepEqual(groupCopy(RECORD_JOB), { empty: 'No records in this group.', noMatch: 'No listed record matches this filter.',
+        placeholder: 'Filter records…' });
+    for (const operation of ['duplicate_prompts', 'unused_components']) {
+        assert.equal(groupCopy({ ...RECORD_JOB, scope: { operation } }).empty, 'No records in this group.');
+    }
+    const files = { empty: EMPTY_GROUP, noMatch: NO_MATCH, placeholder: 'Filter by file path…' };
+    assert.deepEqual(groupCopy({ ...RECORD_JOB, scope: { operation: 'missing_links' } }), files);
+    assert.deepEqual(groupCopy({ ...RECORD_JOB, kind: 'scan', scope: {} }), files);
+});

tests/js/workspace-system-overview.test.js

@@ -16,12 +16,22 @@ const OVERVIEW = Object.freeze({
 
 test('metrics are the server counts and Not checked before any health check', async () => {
     const { metricValues } = await overviewModule;
-    assert.deepEqual(metricValues(OVERVIEW), [
+    assert.deepEqual(metricValues(OVERVIEW, 24), [
         [(1234).toLocaleString(), 'Positive prompts'], ['7', 'Negative variants'], ['24', 'Images'],
         ['Not checked', 'Database integrity'],
     ]);
 });
 
+test('#555: the Images metric is the Images page count (the sidebar badge), not the indexed rows', async () => {
+    const { metricValues } = await overviewModule;
+    // The demo library: 110 indexed rows, 122 files on the Images page (unlinked ones included).
+    const overview = { ...OVERVIEW, images: { indexed: 110, rated: 0 } };
+    assert.deepEqual(metricValues(overview, 122)[2], [(122).toLocaleString(), 'Images']);
+    // Not read yet (undefined) or failed (null): a dash, as on the workspace Overview, never the row count.
+    assert.deepEqual(metricValues(overview, undefined)[2], ['–', 'Images']);
+    assert.deepEqual(metricValues(overview, null)[2], ['–', 'Images']);
+});
+
 test('metric 4 is the last health result', async () => {
     const { integrityText } = await overviewModule;
     assert.equal(integrityText(null), 'Not checked');
@@ -150,7 +160,7 @@ test('statistics rows are the real runs, then the library totals, without rating
         rated_images: 20,
     };
     assert.deepEqual(categoryRows(statistics), [['Landscapes', (1200).toLocaleString()], ['Uncategorized', '3']]);
-    assert.deepEqual(totalsRows(statistics), [['Prompts', '12'], ['Tags', '15'], ['Images', '24']]);
+    assert.deepEqual(totalsRows(statistics), [['Prompt records', '12'], ['Tags on prompts', '15'], ['Image records', '24']]);
 });
 
 /** A fake api answering each `get`/`post` from a queue per URL, recording the calls. */

tests/js/workspace-system-skipped-tags.test.js

@@ -0,0 +1,247 @@
+// System › Auto-tagging "Skipped tags" (#431, D202): the add input, the chips, the client checks and the preview line.
+const test = require('node:test');
+const assert = require('node:assert/strict');
+
+const skippedModule = import('../../web/js/workspace/system-skipped-tags.mjs');
+const stateModule = import('../../web/js/workspace/system-state.mjs');
+const coreModule = import('../../web/js/shared/toolkit/core.js');
+
+/** A minimal DOM: elements with children, attributes, listeners (aborted by their signal) and focus. */
+function fakeDOM() {
+    const previous = global.document;
+    class Element {
+        constructor(tag) {
+            this.tagName = tag.toUpperCase();
+            this.children = [];
+            this.attributes = {};
+            this.listeners = [];
+            this.dataset = {};
+            this.className = '';
+            this.id = '';
+            this.value = '';
+            this.title = '';
+            this.disabled = false;
+            this._text = '';
+        }
+        get localName() { return this.tagName.toLowerCase(); }
+        get textContent() { return this._text + this.children.map(child => (typeof child === 'string' ? child : child.textContent)).join(''); }
+        set textContent(text) { this.children = []; this._text = String(text); }
+        append(...nodes) { for (const node of nodes) { if (typeof node !== 'string') node.parentNode = this; this.children.push(node); } }
+        replaceChildren(...nodes) { this.children = []; this._text = ''; this.append(...nodes); }
+        querySelectorAll(selector) {
+            assert.equal(selector, 'button');
+            const found = [];
+            const walk = node => { for (const child of node.children) if (typeof child !== 'string') { if (child.tagName === 'BUTTON') found.push(child); walk(child); } };
+            walk(this);
+            return found;
+        }
+        focus() { global.document.activeElement = this; }
+        setAttribute(name, value) { this.attributes[name] = String(value); }
+        getAttribute(name) { return Object.hasOwn(this.attributes, name) ? this.attributes[name] : null; }
+        removeAttribute(name) { delete this.attributes[name]; }
+        addEventListener(type, callback, options = {}) {
+            if (options.signal?.aborted) return;
+            const entry = { type, callback };
+            this.listeners.push(entry);
+            options.signal?.addEventListener('abort', () => { this.listeners = this.listeners.filter(item => item !== entry); });
+        }
+        dispatch(type, event = {}) {
+            return Promise.all(this.listeners.filter(item => item.type === type).map(({ callback }) => callback({ type, target: this, ...event })));
+        }
+    }
+    global.document = { createElement: tag => new Element(tag), activeElement: null };
+    const walk = (node, found = []) => { found.push(node); node.children.forEach(child => typeof child !== 'string' && walk(child, found)); return found; };
+    return { find: (root, predicate) => walk(root).find(predicate), restore() { global.document = previous; } };
+}
+
+const tick = () => new Promise(resolve => setTimeout(resolve, 5));
+
+async function mounted({ saved = ['blurry'], answer, host = true } = {}) {
+    const { skippedTagsBlock } = await skippedModule;
+    const { createSystemDrafts } = await stateModule;
+    const { createScope } = await coreModule;
+    const dom = fakeDOM();
+    const drafts = createSystemDrafts({
+        readBrowser: () => ({}), readRuntime: () => ({}),
+        readHost: async () => ({ values: host ? { autotag_skipped_tags: saved } : {}, revision: 'sha256:one' }),
+        writeBrowser: async () => ({}), writeHost: async () => ({ success: true, persisted: true }), writeRuntime: async () => ({}),
+    });
+    const scope = createScope();
+    const posts = [];
+    const api = {
+        post: (url, body, options) => {
+            posts.push({ url, body, signal: options.signal });
+            if (answer) return answer(body, options);
+            return Promise.resolve({ success: true, count: body.entries.length, sample: body.entries, sample_limit: 12,
+                per_entry: body.entries.map((entry, index) => ({ entry, count: index })), sources: { library: 3, wd14: ['WD14 SwinV2'] } });
+        },
+    };
+    const block = skippedTagsBlock({ api, scope, drafts, delay: 1 });
+    scope.cleanup(drafts.subscribe(block.repaint));
+    block.repaint();
+    await drafts.reloadHost();
+    const byId = id => dom.find(block.node, node => node.id === id);
+    const chips = () => dom.find(block.node, node => node.className === 'tags skip-chips');
+    const preview = () => dom.find(block.node, node => node.className === 'small skip-preview');
+    const add = async text => { byId('tag-skipped-input').value = text; await byId('tag-skipped-add').dispatch('click'); };
+    return { dom, drafts, scope, block, byId, chips, preview, posts, add };
+}
+
+test('words split like the server: NFC, lower case, space, _ and - only', async () => {
+    const { entryWords } = await skippedModule;
+    assert.deepEqual(entryWords('Half-closed_eyes'), ['half', 'closed', 'eyes']);
+    assert.deepEqual(entryWords('saber_(fate)'), ['saber', '(fate)']);
+    assert.deepEqual(entryWords(' _ - '), []);
+    assert.deepEqual(entryWords('CAFÉ'), ['café']);
+});
+
+test('the client checks say why an entry is not added', async () => {
+    const { entryProblem, SKIPPED_COPY } = await skippedModule;
+    assert.equal(entryProblem('  sky ', ['blurry']), '');
+    assert.equal(entryProblem('   ', []), SKIPPED_COPY.empty);
+    assert.equal(entryProblem('_--', []), 'Enter a word.');
+    assert.equal(entryProblem('a, b', []), 'No commas or line breaks.');
+    assert.equal(entryProblem('a\nb', []), 'No commas or line breaks.');
+    assert.equal(entryProblem('x'.repeat(51), []), 'At most 50 characters.');
+    assert.equal(entryProblem('🏜'.repeat(50), []), '');
+    assert.equal(entryProblem('Blurry-Background', ['blurry background']), 'Already in the list.');
+    assert.equal(entryProblem('sky', Array.from({ length: 200 }, (_, i) => `w${i}`)), 'The list is full (200).');
+});
+
+test('the preview line states the count, the sample and the sources', async () => {
+    const { previewText, chipCount } = await skippedModule;
+    assert.deepEqual(previewText({ count: 15, sample: ['blurry', 'signature'], sources: { wd14: ['WD14 SwinV2'] } }), {
+        lead: 'Hides 15 tags from suggestions', rest: ': blurry, signature and 13 more. Tags already on images are not changed.' });
+    assert.deepEqual(previewText({ count: 1, sample: ['blurry'], sources: { wd14: [] } }), {
+        lead: 'Hides 1 tag from suggestions',
+        rest: ': blurry. Checked against library tags only; no WD14 label list is downloaded. Tags already on images are not changed.' });
+    assert.deepEqual(previewText({ count: 0, sample: [], sources: { wd14: ['WD14 ViT'] } }), {
+        lead: 'Hides 0 tags from suggestions', rest: '. Tags already on images are not changed.' });
+    assert.deepEqual(previewText(null).lead, 'Hides 0 tags from suggestions');
+    assert.deepEqual(chipCount(3), { title: 'Hides 3 tags', text: '3' });
+    assert.deepEqual(chipCount(1), { title: 'Hides 1 tag', text: '1' });
+    assert.deepEqual(chipCount(0), { title: 'Hides no known tag', text: 'none' });
+    assert.equal(chipCount(undefined), null);
+});
+
+test('the block shows the saved list, previews it and carries its setting keys', async () => {
+    const view = await mounted({ saved: ['blurry', 'signature'] });
+    try {
+        assert.equal(view.block.node.dataset.setting, 'tag-skipped');
+        assert.equal(view.block.node.dataset.key, 'autotag_skipped_tags');
+        assert.equal(view.preview().textContent, 'Checking…');
+        await tick();
+        assert.deepEqual(view.posts.map(post => [post.url, post.body]),
+            [['/prompt_manager/autotag/skipped-tags/preview', { entries: ['blurry', 'signature'] }]]);
+        assert.equal(view.preview().textContent, 'Hides 2 tags from suggestions: blurry, signature. Tags already on images are not changed.');
+        const chips = view.chips().children;
+        assert.deepEqual(chips.map(chip => [chip.className, chip.title, chip.textContent]), [
+            ['chip tag-suggestion none', 'Hides no known tag', 'blurrynone×'],
+            ['chip tag-suggestion', 'Hides 1 tag', 'signature1×']]);
+        assert.equal(chips[1].children[2].getAttribute('aria-label'), 'Remove signature');
+    } finally { view.scope.dispose(); view.dom.restore(); }
+});
+
+test('add and remove draft the list; a list set back is clean; Enter adds', async () => {
+    const view = await mounted();
+    try {
+        await view.add('  closed eyes ');
+        assert.deepEqual(view.drafts.get('host', 'autotag_skipped_tags'), ['blurry', 'closed eyes']);
+        assert.equal(view.byId('tag-skipped-input').value, '');
+        assert.equal(view.drafts.dirty(), true);
+        view.byId('tag-skipped-input').value = 'sky';
+        let prevented = false;
+        await view.byId('tag-skipped-input').dispatch('keydown', { key: 'Enter', preventDefault: () => { prevented = true; } });
+        assert.equal(prevented, true);
+        await view.byId('tag-skipped-input').dispatch('keydown', { key: 'a' });
+        assert.deepEqual(view.drafts.get('host', 'autotag_skipped_tags'), ['blurry', 'closed eyes', 'sky']);
+        // Remove the two added chips: the list equals the saved one and nothing is unsaved (sameDraft).
+        const removeButton = index => view.chips().children[index].children.at(-1);
+        removeButton(2).focus();
+        await removeButton(2).dispatch('click');
+        assert.equal(global.document.activeElement, removeButton(1), 'focus moves to the neighbour');
+        await removeButton(1).dispatch('click');
+        assert.deepEqual(view.drafts.get('host', 'autotag_skipped_tags'), ['blurry']);
+        assert.equal(view.drafts.dirty(), false);
+        await tick();
+        // Only the last list of a quick series is asked for.
+        assert.deepEqual(view.posts.map(post => post.body.entries), [['blurry']]);
+    } finally { view.scope.dispose(); view.dom.restore(); }
+});
+
+test('a refused entry is not added and the line under the input says why', async () => {
+    const view = await mounted();
+    try {
+        const problem = () => view.byId('tag-skipped-problem').textContent;
+        await view.add('Blurry');
+        assert.equal(problem(), 'Already in the list.');
+        assert.equal(view.byId('tag-skipped-input').getAttribute('aria-invalid'), 'true');
+        assert.equal(view.byId('tag-skipped-input').value, 'Blurry');
+        await view.byId('tag-skipped-input').dispatch('input');
+        assert.equal(problem(), '');
+        assert.equal(view.byId('tag-skipped-input').getAttribute('aria-invalid'), null);
+        await view.add('a,b');
+        assert.equal(problem(), 'No commas or line breaks.');
+        await view.add(' ');
+        assert.equal(problem(), 'Enter a word.');
+        assert.deepEqual(view.drafts.get('host', 'autotag_skipped_tags'), ['blurry']);
+    } finally { view.scope.dispose(); view.dom.restore(); }
+});
+
+test('a full list disables Add and says so', async () => {
+    const view = await mounted({ saved: Array.from({ length: 200 }, (_, i) => `w${i}`) });
+    try {
+        assert.equal(view.byId('tag-skipped-add').disabled, true);
+        assert.equal(view.byId('tag-skipped-problem').textContent, 'The list is full (200).');
+        await view.chips().children[0].children.at(-1).dispatch('click');
+        assert.equal(view.byId('tag-skipped-add').disabled, false);
+        assert.equal(view.byId('tag-skipped-problem').textContent, '');
+    } finally { view.scope.dispose(); view.dom.restore(); }
+});
+
+test('an empty list says no tags are skipped without a request', async () => {
+    const view = await mounted({ saved: [] });
+    try {
+        await tick();
+        assert.equal(view.preview().textContent, 'No tags are skipped.');
+        assert.deepEqual(view.posts, []);
+    } finally { view.scope.dispose(); view.dom.restore(); }
+});
+
+test('a failed preview says so; a newer list aborts the older request', async () => {
+    let calls = 0;
+    const view = await mounted({ answer: (body, options) => {
+        calls += 1;
+        if (calls === 1) return new Promise((_resolve, reject) => options.signal.addEventListener('abort', () => reject(new Error('aborted'))));
+        return Promise.reject(Object.assign(new Error('busy'), { code: 'busy' }));
+    } });
+    try {
+        await tick();
+        assert.equal(view.posts.length, 1);
+        await view.add('sky');
+        assert.equal(view.posts[0].signal.aborted, true);
+        await tick();
+        assert.equal(view.preview().textContent, 'The preview could not be read.');
+        // The list stays editable.
+        assert.equal(view.byId('tag-skipped-input').disabled, false);
+    } finally { view.scope.dispose(); view.dom.restore(); }
+});
+
+test('before the settings are read the controls are disabled', async () => {
+    const view = await mounted({ host: false });
+    try {
+        assert.equal(view.byId('tag-skipped-input').disabled, true);
+        assert.equal(view.byId('tag-skipped-add').disabled, true);
+        await view.add('sky');
+        assert.equal(view.drafts.get('host', 'autotag_skipped_tags'), undefined);
+    } finally { view.scope.dispose(); view.dom.restore(); }
+});
+
+test('leaving the section aborts a request in flight and the pending timer', async () => {
+    const view = await mounted({ answer: (_body, options) => new Promise((_r, reject) => options.signal.addEventListener('abort', () => reject(new Error('x')))) });
+    await tick();
+    assert.equal(view.posts.length, 1);
+    view.scope.dispose();
+    assert.equal(view.posts[0].signal.aborted, true);
+    view.dom.restore();
+});

tests/js/workspace-system-state.test.js

@@ -402,11 +402,12 @@ test('a partial host save keeps what saved, adopts its revision and fails only t
     assert.equal(drafts.statusText(), 'missing can\'t be used: not found. Remove it or reconnect it, then save.');
     // The next save carries the revision the saved part produced: no false "changed elsewhere".
     domains.outcome.host = null;
-    drafts.set('host', 'gallery_root_paths', ['a']);
+    // (#431: a list equal to the saved one is no change, so a different one is drafted.)
+    drafts.set('host', 'gallery_root_paths', ['a', 'b']);
     const second = await drafts.save();
     assert.equal(second.host, 'saved');
     assert.equal(domains.calls.at(-1)[2].expected_revision, 'sha256:lora');
-    assert.deepEqual(domains.calls.at(-1)[1], { gallery_root_paths: ['a'] });
+    assert.deepEqual(domains.calls.at(-1)[1], { gallery_root_paths: ['a', 'b'] });
     // Without a server reason, the status says some were saved and the highlighted ones were not.
     domains.outcome.host = () => { throw Object.assign(new Error('boom'), { partial: { saved: ['x'], revision: 'sha256:three' } }); };
     drafts.set('host', 'x', 1);
@@ -429,3 +430,39 @@ test('runtime adapter maps config.level to runtime_level and back', async () =>
     assert.deepEqual(runtimeBody({ runtime_level: 'WARNING' }), { level: 'WARNING' });
     assert.deepEqual(runtimeBody({ runtime_level: 'CRITICAL', console_logging: true }), { level: 'CRITICAL', console_logging: true });
 });
+
+test('sameDraft compares arrays and plain objects by value, keys in any order (#431)', async () => {
+    const { sameDraft } = await source;
+    assert.equal(sameDraft(1, 1), true);
+    assert.equal(sameDraft(Number.NaN, Number.NaN), true);
+    assert.equal(sameDraft(0, -0), false);
+    assert.equal(sameDraft(['a', 'b'], ['a', 'b']), true);
+    assert.equal(sameDraft(['a', 'b'], ['b', 'a']), false);
+    assert.equal(sameDraft([], []), true);
+    assert.equal(sameDraft([], {}), false);
+    assert.equal(sameDraft({ gguf: 'x', hf: 'y' }, { hf: 'y', gguf: 'x' }), true);
+    assert.equal(sameDraft([{ id: 'a', name: 'n' }], [{ name: 'n', id: 'a' }]), true);
+    assert.equal(sameDraft({ a: 1 }, { a: 2 }), false);
+    assert.equal(sameDraft('a', ['a']), false);
+    assert.equal(sameDraft(null, {}), false);
+    assert.equal(sameDraft(new Date(0), new Date(0)), false);
+});
+
+test('a list draft set back to the saved list is clean, and a save cleans it (#431)', async () => {
+    const domains = adapters({ host: { autotag_skipped_tags: ['blurry'] } });
+    const drafts = await loaded(domains);
+    drafts.set('host', 'autotag_skipped_tags', ['blurry', 'signature']);
+    assert.equal(drafts.dirty('host'), true);
+    // Removing the added chip builds a new array equal to the saved one.
+    drafts.set('host', 'autotag_skipped_tags', ['blurry']);
+    assert.equal(drafts.dirty('host'), false);
+    drafts.set('host', 'autotag_skipped_tags', ['signature']);
+    await drafts.save();
+    assert.equal(drafts.dirty('host'), false);
+    assert.deepEqual(drafts.saved('host').autotag_skipped_tags, ['signature']);
+    // A reload whose list equals the draft's (a new array) keeps nothing dirty.
+    drafts.set('host', 'autotag_skipped_tags', ['sky']);
+    domains.readHost = async () => ({ values: { autotag_skipped_tags: ['sky'] }, revision: 'sha256:three' });
+    await drafts.load('host');
+    assert.equal(drafts.dirty('host'), false);
+});

tests/js/workspace-system-tagging.test.js

@@ -42,6 +42,8 @@ function fakeDOM() {
                 this.children.push(node);
             }
         }
+        replaceChildren(...nodes) { this.children = []; this._text = ''; this.append(...nodes); }
+        focus() { global.document.activeElement = this; }
         remove() { if (this.parentNode) this.parentNode.children = this.parentNode.children.filter(child => child !== this); this.parentNode = null; }
         setAttribute(name, value) { this.attributes[name] = String(value); }
         getAttribute(name) { return Object.hasOwn(this.attributes, name) ? this.attributes[name] : null; }
@@ -65,7 +67,9 @@ function fakeDOM() {
 }
 
 const HOST = { autotag_model_type: 'wd14-swinv2', autotag_existing: 'skip', autotag_general_threshold: 0.35,
-    autotag_character_threshold: 0.85, autotag_suggestion_limit: 10, autotag_template: 'Describe the image as tags.' };
+    autotag_character_threshold: 0.85, autotag_suggestion_limit: 10, autotag_builtin_instructions: 'Built-in tags.',
+    autotag_instructions: [{ id: '0123456789ab', name: 'Describe', text: 'Describe the image as tags.' }],
+    autotag_default_instructions: { gguf: '0123456789ab', hf: 'builtin' } };
 const entry = (label, size, extra = {}) => ({ name: label, label, size_label: size, downloaded: true, loaded: false, ...extra });
 const MODELS = {
     success: true,
@@ -124,7 +128,8 @@ test('the section keeps the concept surface, rows, labels and actions in order',
     for (const option of ['Skip already tagged', 'Merge with existing', 'Replace after review']) assert.ok(body.includes(option) && SOURCE.includes(`'${option}'`));
     assert.ok(body.includes('<h2>Auto-tagging</h2>') && SOURCE.includes("'h2', 'Auto-tagging'"));
     assert.ok(body.includes('One tagging configuration for images and prompt-library actions. Every result can be reviewed before applying.'));
-    assert.ok(body.includes('LLM tag template') && SOURCE.includes("'LLM tag template'"));
+    // D203 (#431): Saved instructions replace the concept's template field.
+    assert.ok(body.includes('LLM tag template') && !SOURCE.includes("'LLM tag template'"));
     assert.ok(body.includes('"Preview tagging review", "tag-review", "", "ca-primary"'));
     // Prototype copy is never shipped.
     for (const sample of ['Simulate download', 'Simulate unload', 'Ollama']) assert.ok(!SOURCE.includes(sample), sample);
@@ -167,27 +172,25 @@ test('controls draft their host keys; numbers as numbers, other text as typed',
     const { SETTING_KEYS, coerceNumber, draftValue } = await tagging;
     assert.deepEqual(SETTING_KEYS, { 'tag-model': 'autotag_model_type', 'tag-existing': 'autotag_existing',
         'threshold-general': 'autotag_general_threshold', 'threshold-character': 'autotag_character_threshold',
-        'tag-suggestions': 'autotag_suggestion_limit', 'tag-template': 'autotag_template' });
+        'tag-suggestions': 'autotag_suggestion_limit' });
     assert.deepEqual(['0.4', ' 1.5 ', '15', '', 'abc', '1e-1'].map(coerceNumber), [0.4, 1.5, 15, '', 'abc', 0.1]);
     assert.equal(draftValue('autotag_suggestion_limit', '15'), 15);
-    assert.equal(draftValue('autotag_template', ' 12 '), ' 12 ');
+    assert.equal(draftValue('autotag_existing', ' 12 '), ' 12 ');
     assert.equal(draftValue('autotag_existing', undefined), '');
     const { dom, drafts, scope, byId } = await mounted();
     try {
         assert.equal(byId('tag-model').value, 'wd14-swinv2');
         assert.equal(byId('threshold-general').value, '0.35');
-        assert.equal(byId('tag-template').value, HOST.autotag_template);
         assert.deepEqual([byId('threshold-general').min, byId('threshold-general').max, byId('threshold-general').step], ['0', '1', '0.05']);
         assert.deepEqual([byId('tag-suggestions').min, byId('tag-suggestions').max], ['1', '100']);
         byId('tag-existing').value = 'merge'; await byId('tag-existing').dispatch('change');
         byId('threshold-general').value = '0.4'; await byId('threshold-general').dispatch('change');
         byId('tag-suggestions').value = '15'; await byId('tag-suggestions').dispatch('change');
-        byId('tag-template').value = 'Tags only.'; await byId('tag-template').dispatch('input');
         assert.deepEqual(drafts.changes('host'), { autotag_existing: 'merge', autotag_general_threshold: 0.4,
-            autotag_suggestion_limit: 15, autotag_template: 'Tags only.' });
+            autotag_suggestion_limit: 15 });
         // Every control names its stored key, so a refused save highlights it (D92).
         for (const id of Object.keys(SETTING_KEYS)) assert.equal(byId(id).dataset.key, SETTING_KEYS[id]);
-        assert.equal(byId('tag-template').dataset.setting, 'tag-template');
+        assert.equal(byId('tag-template'), undefined);
     } finally { scope.dispose(); assert.equal(dom.listenerCount(), 0); dom.restore(); }
 });
 
@@ -201,7 +204,8 @@ test('opening the section reads the model status once; the select waits for it',
         assert.deepEqual(byId('tag-model').options.map(option => option.textContent),
             ['WD14 SwinV2 · ~400 MB', 'WD14 ViT · ~400 MB', 'GGUF JoyCaption · ~4.5 GB', 'HuggingFace JoyCaption · ~16 GB']);
         assert.deepEqual(surface.children.map(node => node.className),
-            ['', '', 'setting-row', 'setting-row', 'setting-row', 'setting-row', 'setting-row', 'field', 'row-actions', 'operation']);
+            ['', '', 'setting-row', 'setting-row', 'setting-row', 'setting-row', 'setting-row', 'setting-block', 'setting-block', 'setting-row',
+            'setting-row', 'small instruction-reset', 'row-actions', 'operation']);
     } finally { scope.dispose(); dom.restore(); }
     const failed = await mounted({ modelsFail: true });
     try {
@@ -302,7 +306,9 @@ test('Preview tagging review opens the Tag image dialog with the section’s val
     assert.deepEqual(taggingPreset(HOST), { model: 'wd14-swinv2', options: { general_threshold: 0.35, character_threshold: 0.85,
         suggestion_limit: 10 } });
     assert.deepEqual(taggingPreset({ ...HOST, autotag_model_type: 'gguf' }), { model: 'gguf',
-        options: { instructions: HOST.autotag_template, suggestion_limit: 10 } });
+        options: { instructions: 'Describe the image as tags.', suggestion_limit: 10 } });
+    // D205 (#431): each language-model engine reads its own drafted default; Built-in's text comes from the server.
+    assert.deepEqual(taggingPreset({ ...HOST, autotag_model_type: 'hf' }).options.instructions, 'Built-in tags.');
     assert.equal(draftProblem(HOST), null);
     assert.deepEqual(draftProblem({ ...HOST, autotag_general_threshold: 1.5 }),
         { key: 'autotag_general_threshold', message: 'General-tag confidence must be between 0 and 1.' });
@@ -319,15 +325,17 @@ test('Preview tagging review opens the Tag image dialog with the section’s val
     assert.equal(taggingPreset({ ...HOST, autotag_general_threshold: 0.1 + 0.2 }).options.general_threshold, 0.3);
     assert.equal(draftProblem({ ...HOST, autotag_suggestion_limit: 2.5 }).key, 'autotag_suggestion_limit');
     assert.equal(draftProblem({ ...HOST, autotag_suggestion_limit: 0 }, { limit: false }), null);
-    assert.deepEqual(draftProblem({ ...HOST, autotag_model_type: 'hf', autotag_template: '  ' }),
-        { key: 'autotag_template', message: 'LLM tag template must be non-empty text.' });
-    assert.deepEqual(draftProblem({ ...HOST, autotag_model_type: 'hf', autotag_template: 'x'.repeat(4001) }),
-        { key: 'autotag_template', message: 'LLM tag template must be at most 4000 characters.' });
+    // #431: a saved entry the server would refuse holds back a language-model run, with the server's sentence.
+    const entries = list => ({ ...HOST, autotag_model_type: 'hf', autotag_instructions: list });
+    assert.deepEqual(draftProblem(entries([{ id: '0123456789ab', name: 'A', text: '  ' }])),
+        { key: 'autotag_instructions', message: 'Saved instructions: entry 1 text must be non-empty text.' });
+    assert.deepEqual(draftProblem(entries([{ id: '0123456789ab', name: 'A', text: 'x'.repeat(4001) }])),
+        { key: 'autotag_instructions', message: 'Saved instructions: entry 1 text must be at most 4000 characters.' });
     // Characters are code points, as Python's len counts them: 4000 emoji (8000 UTF-16 units) are allowed.
-    assert.equal(draftProblem({ ...HOST, autotag_model_type: 'hf', autotag_template: '🏜'.repeat(4000) }), null);
-    assert.equal(draftProblem({ ...HOST, autotag_model_type: 'hf', autotag_template: '🏜'.repeat(4001) }).key, 'autotag_template');
-    // A WD14 run never reads the template, nor a language model the thresholds.
-    assert.equal(draftProblem({ ...HOST, autotag_template: '' }), null);
+    assert.equal(draftProblem(entries([{ id: '0123456789ab', name: 'A', text: '🏜'.repeat(4000) }])), null);
+    assert.equal(draftProblem(entries([{ id: '0123456789ab', name: 'A', text: '🏜'.repeat(4001) }])).key, 'autotag_instructions');
+    // A WD14 run never reads the instructions, nor a language model the thresholds.
+    assert.equal(draftProblem({ ...HOST, autotag_instructions: [{ id: '0123456789ab', name: '', text: '' }] }), null);
     assert.equal(draftProblem({ ...HOST, autotag_model_type: 'gguf', autotag_general_threshold: 7 }), null);
 
     const none = await mounted({ image: null });
@@ -372,9 +380,12 @@ test('the batch review grid, body and Cancel-only reasons (D134, #379, CUJ 4–5
         ['Settings', 'General 0.35 · Character 0.85 · up to 10 tags per image'], ['Backup', 'Create and verify before changes']]);
     const llm = { ...HOST, autotag_model_type: 'gguf' };
     assert.deepEqual(batchGrid({ ...PLAN, model: { type: 'gguf' }, backup: { policy: 'off' }, estimate_seconds: null,
-        estimate_device: null, suggestion_limit: 4 }, llm).slice(-3),
+        estimate_device: null, suggestion_limit: 4 }, llm).slice(-4),
     [['Time', 'Language-model engines take longer per image. Activity shows the time left once tagging starts.'],
-        ['Settings', 'Template of 27 characters · up to 4 tags per image'], ['Backup', 'No safety backup (the policy is off)']]);
+        ['Instructions', 'Describe'], ['Settings', 'Up to 4 tags per image'], ['Backup', 'No safety backup (the policy is off)']]);
+    // D205 (#431): HF shows its own default by name.
+    assert.deepEqual(batchGrid({ ...PLAN, model: { type: 'hf' } }, { ...llm, autotag_model_type: 'hf' }).find(([term]) => term === 'Instructions'),
+        ['Instructions', 'Built-in']);
     assert.equal(batchGrid({}, HOST)[2][1], '0');
     assert.equal(batchGrid({}, HOST)[6][1], 'General 0.35 · Character 0.85');
     assert.equal(existingLabel('odd'), 'odd');
@@ -382,7 +393,7 @@ test('the batch review grid, body and Cancel-only reasons (D134, #379, CUJ 4–5
         options: { general_threshold: 0.35, character_threshold: 0.85 } });
     // #369: a threshold a hair off the grid is sent snapped to it.
     assert.equal(batchBody({ ...HOST, autotag_character_threshold: 0.1 + 0.2 }).options.character_threshold, 0.3);
-    assert.deepEqual(batchBody(llm), { model_type: 'gguf', existing: 'skip', options: { instructions: HOST.autotag_template } });
+    assert.deepEqual(batchBody(llm), { model_type: 'gguf', existing: 'skip', options: { instructions: 'Describe the image as tags.' } });
     assert.equal(batchCloseNote(PLAN), null);
     assert.equal(batchCloseNote({ ...PLAN, review_required: true }), REPLACE_NOTE);
     assert.equal(REPLACE_NOTE, 'Replacing tags needs a review of each image. Use Preview tagging review, or choose Skip or Merge for a batch run.');

tests/js/workspace-system-thumbnail-location.test.js

@@ -0,0 +1,170 @@
+// Thumbnail location (#320, D196–D201): the row's state and status line, the move review's rows, the unavailable
+// notice's text, the Activity views of a move and a prune, the prune scope's plan line and the Move library row.
+const test = require('node:test');
+const assert = require('node:assert/strict');
+
+const locationModule = import('../../web/js/workspace/system-thumbnail-location.mjs');
+const kindsModule = import('../../web/js/workspace/activity-kinds.mjs');
+const reviewModule = import('../../web/js/workspace/thumbnail-review.mjs');
+const libraryModule = import('../../web/js/workspace/library-location.mjs');
+
+const SOURCE = Object.freeze({ mode: 'source', path: null, default_path: '/data/thumbnails', available: true,
+    problem: null, cleanup_pending: 0 });
+const FOLDER = Object.freeze({ mode: 'folder', path: 'E:\\Thumbnails', default_path: '/data/thumbnails',
+    available: true, problem: null, cleanup_pending: 0 });
+
+const PLAN = Object.freeze({
+    from: { mode: 'source', path: null, available: true },
+    to: { mode: 'folder', path: 'E:\\Thumbnails', exists: true, will_create: false, default: false },
+    totals: { sources: 3, files: 8512, bytes: 1.2 * 1024 ** 3, orphans: 41, temps: 2, links: 1, left_in_place: 1,
+        too_long: 32, unlisted_sources: 0, unlisted_files: 0 },
+    too_long_listed: ['Archive 2025 · a_thumb.webp', 'Archive 2025 · b_thumb.webp'],
+    left_listed: ['Archive 2025 · notes.txt'],
+    unlisted: [],
+    free_bytes: 1.6 * 1024 ** 4,
+    confirm_required: true,
+    token: 't',
+});
+
+test('the status line says where previews are now', async () => {
+    const { statusText } = await locationModule;
+    assert.equal(statusText(SOURCE), 'Now: inside each source.');
+    assert.equal(statusText(FOLDER), 'Now: one folder, E:\\Thumbnails.');
+    assert.equal(statusText({ ...FOLDER, path: '/data/thumbnails' }),
+        'Now: one folder, /data/thumbnails. Using the default folder next to your library.');
+    assert.equal(statusText({ ...FOLDER, available: false, problem: 'missing' }),
+        'Now: one folder, E:\\Thumbnails · unavailable. Originals are shown.');
+    assert.match(statusText({ ...SOURCE, cleanup_pending: 1 }), /Old thumbnails in 1 place wait to be removed/);
+    assert.equal(statusText(undefined), '');
+    assert.match(statusText(SOURCE, { mode: 'folder', path: '/data/thumbnails' }),
+        /^Now: inside each source\. The suggested folder is next to your library/);
+    assert.equal(statusText(SOURCE, { mode: 'folder', path: '/other' }), 'Now: inside each source.');
+});
+
+test('Review move… is offered only for another location', async () => {
+    const { choiceChanged } = await locationModule;
+    assert.equal(choiceChanged(SOURCE, { mode: 'source' }), false);
+    assert.equal(choiceChanged(SOURCE, { mode: 'folder', path: ' ' }), false);
+    assert.equal(choiceChanged(SOURCE, { mode: 'folder', path: '/data/thumbnails' }), true);
+    assert.equal(choiceChanged(FOLDER, { mode: 'folder', path: 'E:\\Thumbnails' }), false);
+    assert.equal(choiceChanged(FOLDER, { mode: 'folder', path: 'F:\\Thumbs' }), true);
+    assert.equal(choiceChanged(FOLDER, { mode: 'source' }), true);
+    assert.equal(choiceChanged({ ...SOURCE, problem: 'invalid' }, { mode: 'source' }), true);
+    assert.equal(choiceChanged(undefined, { mode: 'source' }), false);
+});
+
+test('the review lists what moves, what is removed and what stays', async () => {
+    const { reviewRows } = await locationModule;
+    const rows = Object.fromEntries(reviewRows(PLAN));
+    assert.equal(rows.From, 'Inside each source (3 sources)');
+    assert.equal(rows.To, 'E:\\Thumbnails (empty folder)');
+    assert.equal(rows.Thumbnails, '8,512 in 3 sources · 1.2 GB');
+    assert.equal(rows['Free space'], '1638.4 GB free');
+    assert.match(rows['Too long for Windows'][0], /^32 thumbnails cannot be stored there/);
+    assert.deepEqual(rows['Too long for Windows'][1], [...PLAN.too_long_listed, 'and 30 more']);
+    assert.deepEqual(rows['Removed after the move'][1],
+        ['41 thumbnails whose original is gone', '2 unfinished temporary files']);
+    assert.equal(rows['Left in place'][0], '1 file that is not a thumbnail:');
+    assert.equal(rows['Links skipped'], '1 link inside a thumbnails folder is not followed');
+});
+
+test('the review of a move back names the folder and the removed sources', async () => {
+    const { reviewRows } = await locationModule;
+    const back = reviewRows({ ...PLAN, from: { mode: 'folder', path: '/data/thumbnails' },
+        to: { mode: 'source', path: null }, unlisted: [{ key: 'old-1c22e0a4', files: 240 }],
+        totals: { sources: 1, files: 1, bytes: 10 }, free_bytes: undefined });
+    const rows = Object.fromEntries(back);
+    assert.equal(rows.From, '/data/thumbnails');
+    assert.equal(rows.To, 'Inside each source (1 source)');
+    assert.equal(rows['Free space'], undefined);
+    assert.match(rows['Removed after the move'][0], /The folder itself is removed once empty/);
+    assert.deepEqual(rows['Removed after the move'][1],
+        ['1 source no longer listed: 240 thumbnails are removed; they are made again if it returns']);
+    // Nothing else removed: one full stop, never "created it.." (live test of #592).
+    const plain = Object.fromEntries(reviewRows({ ...PLAN, from: { mode: 'folder', path: '/data/thumbnails' },
+        to: { mode: 'source', path: null }, unlisted: [], totals: { sources: 1, files: 1, bytes: 10 } }));
+    assert.match(plain['Removed after the move'][0], /Prompt Manager created it\.$/);
+    const fresh = Object.fromEntries(reviewRows({ ...PLAN, to: { mode: 'folder', path: '/d', default: true, will_create: true } }));
+    assert.equal(fresh.To, '/d (new, next to your library)');
+});
+
+test('the notice says why the folder is unavailable', async () => {
+    const { noticeText } = await locationModule;
+    assert.match(noticeText({ ...FOLDER, problem: 'missing' }), /^E:\\Thumbnails is missing\. Originals are shown/);
+    assert.match(noticeText({ ...FOLDER, problem: 'unreachable' }), /can’t be reached/);
+    assert.match(noticeText({ ...FOLDER, problem: 'marker-mismatch' }), /holds another thumbnail folder/);
+    assert.match(noticeText({ ...FOLDER, problem: 'invalid' }), /config\.json can’t be used/);
+    assert.match(noticeText({ ...FOLDER, problem: null }), /is being checked/);
+});
+
+test('sizes are written as the server writes them', async () => {
+    const { sizeText } = await locationModule;
+    assert.equal(sizeText(512), '512 B');
+    assert.equal(sizeText(85.2 * 1024 * 1024), '85.2 MB');
+});
+
+test('a move and a prune show their own tiles in Activity', async () => {
+    const { viewOf, movePhase, finishToast } = await kindsModule;
+    const move = { kind: 'thumbnails', state: 'running', cancellable: true, scope: { mode: 'move', from: 'source' },
+        counters: { moved: 3, skipped: 0, left: 1, errors: 2 }, status_line: '' };
+    assert.deepEqual(viewOf(move).tiles.map(([group, label]) => label), ['Moved', 'Already there', 'Left in place', 'Errors']);
+    assert.equal(viewOf(move).cancelLabel, 'Cancel move');
+    assert.match(movePhase(move), /^Step 1 of 3: copying\. Thumbnails are still read from inside each source/);
+    assert.match(movePhase({ ...move, cancellable: false }), /can no longer be cancelled/);
+    assert.match(movePhase({ ...move, scope: { mode: 'move', phase: 'remove' } }), /Removing the old copies/);
+    assert.match(movePhase({ ...move, state: 'finished' }), /1 file that is not a thumbnail was left in place/);
+    assert.match(movePhase({ ...move, state: 'cancelled' }), /^Nothing changed/);
+    assert.match(movePhase({ ...move, state: 'finished', counters: { moved: 3, left: 2 } }),
+        /2 files that are not thumbnails were left in place\.$/);
+    assert.equal(movePhase({ ...move, state: 'finished', counters: undefined }), 'Thumbnails are now read from the new location.');
+    assert.match(movePhase({ ...move, scope: { mode: 'move', from: 'folder' } }), /read from the old folder until the switch/);
+    const done = { ...move, state: 'finished', status_line: 'Thumbnails moved to E:\\T: 3 moved · old copies removed.' };
+    assert.equal(finishToast(done), done.status_line);
+    const prune = { kind: 'thumbnails', state: 'running', cancellable: true, scope: { mode: 'prune' },
+        counters: { removed: 1, left: 0, errors: 0 } };
+    assert.deepEqual(viewOf(prune).tiles.map(([, label]) => label), ['Removed', 'Left in place', 'Errors']);
+    assert.equal(viewOf(move).line(move), '');
+    assert.equal(viewOf(done).line(done), done.status_line);
+    assert.equal(viewOf(move).kept(move), '3 moved');
+    assert.equal(finishToast({ ...move, state: 'cancelled', status_line: '' }), viewOf(move).finishToast({ ...move,
+        state: 'cancelled', status_line: '' }));
+    const pruned = { ...prune, state: 'finished', status_line: '1 thumbnails removed' };
+    assert.equal(viewOf(prune).line(prune), '');
+    assert.equal(viewOf(pruned).line(pruned), '1 thumbnails removed');
+    assert.equal(viewOf(pruned).line({ ...pruned, status_line: null }), '');
+    assert.equal(viewOf(done).line({ ...done, status_line: null }), '');
+    assert.equal(finishToast(pruned), '1 thumbnails removed');
+    assert.equal(viewOf(prune).kept(prune), '1 removed');
+    assert.match(finishToast({ ...prune, state: 'finished', status_line: '', title: 'Remove thumbnails of removed sources' }),
+        /Remove thumbnails of removed sources/);
+    const generate = { kind: 'thumbnails', state: 'running', cancellable: true, scope: { mode: 'missing' },
+        counters: { generated: 0, skipped: 0, errors: 0 } };
+    assert.deepEqual(viewOf(generate).tiles.map(([, label]) => label), ['Generated', 'Skipped', 'Errors']);
+});
+
+test('the prune scope reads its plan line from the server', async () => {
+    const { planText, PLAN_FAILED, PRUNE_OPTION } = await reviewModule;
+    assert.equal(PRUNE_OPTION[1], 'Remove thumbnails of removed sources');
+    assert.equal(planText({ mode: 'prune', line: '2 sources no longer listed: 1,240 thumbnails (85.2 MB) are removed.' }),
+        '2 sources no longer listed: 1,240 thumbnails (85.2 MB) are removed.');
+    assert.equal(planText({ mode: 'prune' }), PLAN_FAILED);
+});
+
+test('the prune review names the folder and each removed source', async () => {
+    const { pruneText, pruneEntries } = await reviewModule;
+    assert.match(pruneText({ folder: 'E:\\Thumbs' }), /^Only Prompt Manager’s thumbnails in their folders inside E:\\Thumbs are /);
+    assert.match(pruneText({}), /inside the thumbnail folder are removed\. If a source comes back/);
+    assert.deepEqual(pruneEntries({ sources: [{ key: 'gone-0123abcd', files: 1240, bytes: 85.2 * 1024 * 1024 },
+        { key: 'one-0123abcd', files: 1, bytes: 512 }] }),
+    [['gone-0123abcd', '1,240 thumbnails · 85.2 MB'], ['one-0123abcd', '1 thumbnail · 512 B']]);
+    assert.deepEqual(pruneEntries(null), []);
+    assert.deepEqual(pruneEntries({ sources: 'x' }), []);
+});
+
+test('Move library says where thumbnails kept in one folder stay', async () => {
+    const { reviewGrid } = await libraryModule;
+    const base = { path: 'p', target: 't', size_bytes: 0, config_moves: true };
+    assert.equal(reviewGrid(base).some(([term]) => term === 'Thumbnails'), false);
+    const rows = Object.fromEntries(reviewGrid({ ...base, thumbnails_folder: '/data/thumbnails' }));
+    assert.equal(rows.Thumbnails, 'Stay in /data/thumbnails. Move them in System › Sources & scans.');
+});

tests/test_api_annotation_suggest.py

@@ -73,6 +73,7 @@ class FakeTagger:
         self.calls = []
         self.read_paths = []
         self.read_bytes = []
+        self.skips = []
         self.download_model = MagicMock(side_effect=AssertionError("downloaded"))
         self.load_error = None
         self.block = None  # (entered, proceed) events
@@ -115,8 +116,10 @@ class FakeTagger:
         prompt=None,
         general_threshold=None,
         character_threshold=None,
+        skip=None,
     ):
         self.read_paths.append(image_path)
+        self.skips.append(skip)
         with open(image_path, "rb") as handle:
             self.read_bytes.append(handle.read())
         self.calls.append(
@@ -132,9 +135,11 @@ class FakeTagger:
             entered, proceed = self.block
             entered.set()
             proceed.wait(WAIT)
+        # As the engine does (#431): a skipped tag uses up no slot.
+        kept = [pair for pair in SCORED if skip is None or not skip.matches(pair[0])]
         if self.loaded.startswith("wd14"):
-            return list(SCORED[:limit])
-        return [(name, None) for name, _ in SCORED[:limit]]
+            return list(kept[:limit])
+        return [(name, None) for name, _ in kept[:limit]]
 
 
 class SuggestTestCase(AnnotationAPITestCase):

tests/test_api_annotations.py

@@ -1144,8 +1144,10 @@ class TestEnvelopes(AnnotationAPITestCase):
         self.assertEqual(
             sorted(await self.json_of(resp)),
             [
+                "default_instructions",  # #431 adds the saved instructions
                 "default_prompt",
                 "existing",  # #328 adds the saved batch policy and model
+                "instructions",
                 "loaded_model_type",
                 "model_loaded",
                 "model_type",

tests/test_api_autotag.py

@@ -129,8 +129,10 @@ class FakeAutotagService:
         prompt=None,
         general_threshold=None,
         character_threshold=None,
+        skip=None,
     ):
-        """The suggestion entry point (#379): the fixed tags, at most ``limit``."""
+        """The suggestion entry point (#379): the fixed tags, at most ``limit``,
+        without the ones ``skip`` hides (#431)."""
         self.suggest_calls += 1
         tags = self.generate_tags(
             image_path,
@@ -138,6 +140,7 @@ class FakeAutotagService:
             general_threshold=general_threshold,
             character_threshold=character_threshold,
         )
+        tags = [name for name in tags if skip is None or not skip.matches(name)]
         return [(name, None) for name in tags[:limit]]
 
 
@@ -1533,7 +1536,8 @@ class TestSavedTaggingDefaults(AutotagAPITestCase):
             "EXISTING",
             "GENERAL_THRESHOLD",
             "CHARACTER_THRESHOLD",
-            "TEMPLATE",
+            "INSTRUCTIONS",
+            "DEFAULT_INSTRUCTIONS",
             "SUGGESTION_LIMIT",
         ):
             self.addCleanup(setattr, AutotagConfig, attr, getattr(AutotagConfig, attr))
@@ -1554,7 +1558,11 @@ class TestSavedTaggingDefaults(AutotagAPITestCase):
         self.config.EXISTING = "replace_after_review"
         self.config.GENERAL_THRESHOLD = 0.4
         self.config.CHARACTER_THRESHOLD = 0.7
-        self.config.TEMPLATE = "Saved template"
+        # #431: the saved engine's default instructions.
+        self.config.INSTRUCTIONS = (
+            {"id": "0123456789ab", "name": "Saved", "text": "Saved template"},
+        )
+        self.config.DEFAULT_INSTRUCTIONS = {"gguf": "0123456789ab", "hf": "builtin"}
         self.config.SUGGESTION_LIMIT = 15
         data = await (await self.client.get("/prompt_manager/autotag/models")).json()
         self.assertEqual(
@@ -1578,6 +1586,27 @@ class TestSavedTaggingDefaults(AutotagAPITestCase):
                 "suggestion_limit": 15,
             },
         )
+        # Built-in first with every text, and each engine's default.
+        self.assertEqual(
+            data["instructions"],
+            [
+                {"id": "builtin", "name": "Built-in", "text": DEFAULT_TAG_TEMPLATE},
+                {"id": "0123456789ab", "name": "Saved", "text": "Saved template"},
+            ],
+        )
+        self.assertEqual(
+            data["default_instructions"], {"gguf": "0123456789ab", "hf": "builtin"}
+        )
+        # HF reads its own default; a WD14 engine reads GGUF's.
+        for model_type, prompt in (
+            ("hf", DEFAULT_TAG_TEMPLATE),
+            ("wd14-vit", "Saved template"),
+        ):
+            self.config.MODEL_TYPE = model_type
+            data = await (
+                await self.client.get("/prompt_manager/autotag/models")
+            ).json()
+            self.assertEqual(data["default_prompt"], prompt, model_type)
 
     async def test_single_without_thresholds_uses_saved_ones(self):
         image = self._make_image(self.output_dir)

tests/test_api_duplicate_files.py

@@ -452,6 +452,40 @@ class TestReview(DuplicateFilesTestCase):
         )
 
 
+class TestReviewProtectedRows(DuplicateFilesTestCase):
+    async def test_cleanup_lists_each_copy_the_review_kept(self):
+        if not TestReview._can_symlink(self.tmpdir):  # pragma: no cover
+            self.skipTest("symlinks are not available")
+        self.trio()
+        job, group = await self.found_group()
+        # b.png becomes a link after the find: the review protects it (#586).
+        (self.output_dir / "b.png").unlink()
+        os.symlink(str(self.output_dir / "a.png"), str(self.output_dir / "b.png"))
+        plan = await self.review(job.id, [self.keep_of(group, "a.png")])
+        self.assertEqual(plan["protected"]["count"], 1)
+        body = await self.apply(plan["token"])
+        cleanup = self.api._jobs.get(body["job"]["id"])
+        await asyncio.wait_for(asyncio.shield(cleanup.task), DISK_BOUND_SECONDS)
+        self.assertEqual(cleanup.state, "finished", cleanup.log)
+        rows = {row["path"]: row for row in cleanup.outcomes["kept"]}
+        self.assertEqual(
+            rows["b.png"],
+            {
+                "path": "b.png",
+                "root": rows["a.png"]["root"],
+                "root_index": 0,
+                "detail": "Kept: a link, not a regular file",
+            },
+        )
+        self.assertEqual(rows["a.png"]["detail"], "Kept copy")
+        self.assertEqual(cleanup.counters, {"removed": 1, "kept": 2, "errors": 0})
+        report = cleanup.report()["outcomes"]["kept"]
+        self.assertEqual(
+            sorted(row["path"] for row in report["rows"]), ["a.png", "b.png"]
+        )
+        self.assertFalse(report["truncated"])
+
+
 class TestCleanupJob(DuplicateFilesTestCase):
     async def test_cleanup_is_a_records_job_with_a_safety_backup(self):
         self.trio()

tests/test_api_library_location.py

@@ -91,6 +91,8 @@ class TestLocationRoute(LibraryAPITestCase):
                 "size_bytes": os.path.getsize(self.api.db.model.db_path),
                 "target_source": "default",
                 "config_moves": True,
+                # #320 D201: previews kept inside each source (no folder).
+                "thumbnails_folder": None,
             },
         )
 

tests/test_api_log_cleanup.py

@@ -266,6 +266,30 @@ class TestApply(LogCleanupTestCase):
         report = json.dumps(job.report())
         self.assertNotIn(self.tmpdir, report)
 
+    async def test_apply_lists_each_kept_file(self):
+        linked = self.seed()
+        plan = await self.preview()
+        _summary, job = await self.run_apply(plan)
+        expected = [
+            ("prompt_manager.log", "Kept: the active log"),
+            ("prompt_manager.log.9", "Kept: another file"),
+            ("prompt_manager.log.bak", "Kept: another file"),
+        ]
+        if linked:
+            expected.append(("prompt_manager.log.4", "Kept: a link"))
+        rows = job.outcomes["protected"]
+        self.assertEqual(
+            sorted((row["path"], row["detail"]) for row in rows), sorted(expected)
+        )
+        self.assertEqual(
+            {(row["root"], row["root_index"]) for row in rows}, {("", None)}
+        )
+        report = job.report()["outcomes"]["protected"]
+        self.assertEqual(
+            (report["count"], len(report["rows"]), report["truncated"]),
+            (plan["protected"]["count"], len(expected), False),
+        )
+
     async def test_apply_rows_name_each_file(self):
         self.seed()
         plan = await self.preview()

tests/test_api_lora.py

@@ -840,6 +840,23 @@ class TestLoraScanRoute(LoraAPITestCase):
             ("error", error["message"], 0),
         )
 
+    async def test_unexpected_scan_error_is_generic_in_the_stream(self):
+        self._enable()
+        secret = str(self.tmp_root / "x.db")
+        err = RuntimeError(f"could not open {secret}")
+        with patch.object(self.api.db, "replace_category_prompts", side_effect=err):
+            with self.assertLogs("prompt_manager.api", level="ERROR") as logs:
+                resp = await self.client.request("POST", "/prompt_manager/lora/scan")
+                body = await resp.text()  # the stream ends inside the patch
+        self.assertNotIn("x.db", body)
+        error = self._sse_events(body)[-1]
+        self.assertEqual(
+            (error["type"], error["status"], error["progress"]),
+            ("error", error["message"], 0),
+        )
+        self.assertIn("server log", error["message"])
+        self.assertIn(secret, "\n".join(logs.output))
+
     @staticmethod
     def _sse_events(text):
         return [

tests/test_api_maintenance_pair_metadata.py

@@ -0,0 +1,181 @@
+"""Pair category and tags repair through the maintenance routes (#550).
+
+``pair_metadata`` is reviewed and applied like the other maintenance plans:
+``options`` must be ``{}``, the job is titled "Pair category and tags", the
+safety backup follows the ``maintenance.safety_backup`` policy, and the job's
+downloadable report lists every filled prompt, never cut at 200 rows.
+"""
+
+import asyncio
+import os
+import sys
+from unittest.mock import MagicMock
+
+_mock_server = MagicMock()
+_mock_server.PromptServer.instance.routes = MagicMock()
+sys.modules.setdefault("server", _mock_server)
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+from py.api.jobs import MAX_OUTCOME_ROWS  # noqa: E402
+from py.api.maintenance import MAINTENANCE_TITLES  # noqa: E402
+from py.config import PromptManagerConfig  # noqa: E402
+
+try:
+    from tests.test_api_maintenance import WAIT, ApplyTestCase  # noqa: E402
+except ImportError:  # discovered with tests/ as the top-level directory
+    from test_api_maintenance import WAIT, ApplyTestCase  # noqa: E402
+
+OPERATION = "pair_metadata"
+TITLE = "Pair category and tags"
+
+
+class PairMetadataAPITestCase(ApplyTestCase):
+    def pair(self, positive, negative="", **metadata):
+        pair_id = self.api.db.save_prompt_pair(positive, negative, **metadata)
+        with self.api.db.model.get_connection() as conn:
+            prompt = conn.execute(
+                "SELECT positive_prompt_id FROM prompt_pairs WHERE id=?", (pair_id,)
+            ).fetchone()[0]
+        return pair_id, prompt
+
+    def category(self, prompt_id):
+        with self.api.db.model.get_connection() as conn:
+            return conn.execute(
+                "SELECT category FROM prompts WHERE id=?", (prompt_id,)
+            ).fetchone()[0]
+
+
+class TestPairMetadataRoutes(PairMetadataAPITestCase):
+    async def test_preview_accepts_the_operation_and_no_options(self):
+        self.assertEqual(MAINTENANCE_TITLES[OPERATION], TITLE)
+        self.pair("a cat", category="portrait", tags=["a"])
+        plan = await self.preview(OPERATION)
+        self.assertEqual(plan["operation"], OPERATION)
+        self.assertEqual(plan["scope"]["count"], 1)
+        self.assertEqual(plan["backup"]["policy"], "on")
+        refused = await self.preview(OPERATION, 400, options={"all": True})
+        self.assertEqual(refused["code"], "invalid-request")
+
+    async def test_apply_fills_with_a_backup_and_names_it(self):
+        _pair, prompt = self.pair("a cat", "neg", category="portrait", tags=["a", "b"])
+        plan, summary, job = await self.run_apply(OPERATION)
+        self.assertEqual(summary["title"], TITLE)
+        self.assertEqual(summary["admission"], "records")
+        self.assertEqual(job.state, "finished", job.log)
+        self.assertEqual(self.category(prompt), "portrait")
+        [backup] = self.backups()
+        self.assertEqual(
+            job.status_line,
+            "Filled 1 prompt from its saved pairs (1 category, 1 tag set) · "
+            f"Safety backup {backup}",
+        )
+        self.assertEqual(
+            job.outcomes["changed"][0]["detail"],
+            f"Prompt {prompt}: category “portrait”; tags a, b",
+        )
+        self.assertEqual(job.counters["changed"], 1)
+
+    async def test_protected_prompts_are_counted(self):
+        _a, prompt = self.pair("conflict", "n1", category="x")
+        self.pair("conflict", "n2", category="y")
+        self.pair("fill me", category="portrait")
+        plan, _summary, job = await self.run_apply(OPERATION)
+        self.assertEqual(plan["protected"]["reasons"], ["1 where pairs disagree"])
+        self.assertEqual(job.counters["protected"], 1)
+        self.assertIsNone(self.category(prompt))
+        # Live test (#550): the count comes with its rows, in the review's wording.
+        self.assertEqual(
+            job.outcomes["protected"],
+            [
+                {
+                    "path": "",
+                    "root": "",
+                    "root_index": None,
+                    "detail": (
+                        f"Prompt {prompt}: kept, pairs disagree on category: x, y"
+                    ),
+                }
+            ],
+        )
+        report = job.report()["outcomes"]["protected"]
+        self.assertEqual((report["count"], report["truncated"]), (1, False))
+
+    async def test_report_lists_every_kept_prompt(self):
+        PromptManagerConfig.SAFETY_BACKUP = False
+        count = MAX_OUTCOME_ROWS + 5
+        for n in range(count):
+            _pair, prompt = self.pair(f"kept {n:03d}", category="portrait")
+            with self.api.db.model.get_connection() as conn:
+                conn.execute(
+                    "UPDATE prompts SET updated_at='2099-01-01T00:00:00+00:00' "
+                    "WHERE id=?",
+                    (prompt,),
+                )
+        _plan, _summary, job = await self.run_apply(OPERATION)
+        self.assertEqual(job.counters["protected"], count)
+        self.assertEqual(len(job.outcomes["protected"]), MAX_OUTCOME_ROWS)
+        protected = job.report()["outcomes"]["protected"]
+        self.assertEqual(
+            (len(protected["rows"]), protected["truncated"]), (count, False)
+        )
+        self.assertTrue(
+            protected["rows"][0]["detail"].endswith(
+                ": kept, edited after it was saved; its empty category or tags "
+                "may be intentional"
+            )
+        )
+
+    async def test_policy_off_writes_without_a_backup(self):
+        PromptManagerConfig.SAFETY_BACKUP = False
+        _pair, prompt = self.pair("no backup", category="portrait")
+        plan, _summary, job = await self.run_apply(OPERATION)
+        self.assertEqual(plan["backup"]["policy"], "off")
+        self.assertEqual(job.state, "finished", job.log)
+        self.assertIn("No safety backup (the policy is off)", "\n".join(job.log))
+        self.assertTrue(job.status_line.endswith("· No safety backup"))
+        self.assertEqual(self.backups(), [])
+        self.assertEqual(self.category(prompt), "portrait")
+
+    async def test_reviewed_with_the_policy_on_keeps_the_backup(self):
+        self.pair("promise", category="portrait")
+        plan = await self.preview(OPERATION)
+        PromptManagerConfig.SAFETY_BACKUP = False
+        body = await self.apply(plan["token"])
+        job = self.api._jobs.get(body["job"]["id"])
+        await asyncio.wait_for(asyncio.shield(job.task), WAIT)
+        self.assertEqual(len(self.backups()), 1)
+
+    async def test_plan_changed_writes_nothing(self):
+        pair_id, prompt = self.pair("drift", category="portrait")
+        plan = await self.preview(OPERATION)
+        self.api.db.update_prompt_pair_metadata(pair_id, category="landscape")
+        body = await self.apply(plan["token"])
+        job = self.api._jobs.get(body["job"]["id"])
+        await asyncio.wait_for(asyncio.shield(job.task), WAIT)
+        self.assertEqual(job.state, "failed")
+        self.assertEqual(job.last_event["code"], "plan-changed")
+        self.assertIsNone(self.category(prompt))
+
+    async def test_report_lists_every_filled_prompt(self):
+        PromptManagerConfig.SAFETY_BACKUP = False
+        count = MAX_OUTCOME_ROWS + 5
+        for n in range(count):
+            self.pair(f"bulk {n:03d}", category="portrait")
+        _plan, _summary, job = await self.run_apply(OPERATION)
+        self.assertEqual(job.state, "finished", job.log)
+        self.assertEqual(len(job.outcomes["changed"]), MAX_OUTCOME_ROWS)
+        response = await self.client.request(
+            "GET", f"/prompt_manager/jobs/{job.id}/report"
+        )
+        self.assertEqual(response.status, 200)
+        report = await response.json()
+        changed = report["outcomes"]["changed"]
+        self.assertEqual(changed["count"], count)
+        self.assertEqual(len(changed["rows"]), count)
+        self.assertFalse(changed["truncated"])
+        self.assertTrue(
+            all(
+                row["detail"].endswith("category “portrait”") for row in changed["rows"]
+            )
+        )

tests/test_api_maintenance_protected_rows.py

@@ -0,0 +1,140 @@
+"""Protected maintenance items are listed in Activity, not only counted (#586).
+
+Each record a maintenance job keeps gets one ``protected`` row with its
+reason, in the wording of that operation's review, and the job's
+downloadable report lists every one of them (never cut at 200 rows). A kept
+image link names its file, so Activity can still open and locate it.
+"""
+
+import os
+import shutil
+import sys
+from pathlib import Path
+from unittest.mock import MagicMock
+
+_mock_server = MagicMock()
+_mock_server.PromptServer.instance.routes = MagicMock()
+sys.modules.setdefault("server", _mock_server)
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+from py.api.jobs import MAX_OUTCOME_ROWS  # noqa: E402
+from py.config import GalleryConfig, PromptManagerConfig  # noqa: E402
+
+try:
+    from tests.test_api_maintenance import ApplyTestCase  # noqa: E402
+except ImportError:  # discovered with tests/ as the top-level directory
+    from test_api_maintenance import ApplyTestCase  # noqa: E402
+
+
+def _record(detail):
+    return {"path": "", "root": "", "root_index": None, "detail": detail}
+
+
+class TestProtectedRows(ApplyTestCase):
+    def duplicate(self, text, created_at="2999-01-01"):
+        with self.api.db.model.get_connection() as conn:
+            return conn.execute(
+                "INSERT INTO prompts(text, created_at) VALUES(?, ?)",
+                (text.upper(), created_at),
+            ).lastrowid
+
+    def assert_complete(self, job, count):
+        self.assertEqual(job.counters["protected"], count)
+        report = job.report()["outcomes"]["protected"]
+        self.assertEqual(
+            (report["count"], len(report["rows"]), report["truncated"]),
+            (count, count, False),
+        )
+
+    async def test_duplicate_prompts_lists_each_kept_copy(self):
+        paired = self.save("A dog")
+        self.api.db.save_prompt_pair("A dog", "")
+        paired_copy = self.duplicate("A dog")
+        titled = self.save("A bird")
+        titled_copy = self.duplicate("A bird")
+        with self.api.db.model.get_connection() as conn:
+            conn.execute(
+                "INSERT INTO prompt_library_state(prompt_id,title) VALUES(?,?)",
+                (titled_copy, "Bird recipe"),
+            )
+        plan, _summary, job = await self.run_apply("duplicate_prompts")
+        self.assertEqual(job.state, "finished", job.log)
+        self.assertEqual(
+            sorted(row["detail"] for row in job.outcomes["protected"]),
+            sorted(
+                [
+                    f"Prompt {paired}: kept, belongs to a saved pair",
+                    f"Prompt {paired_copy}: kept, belongs to a saved pair",
+                    f"Prompt {titled}: kept, a copy has its own Library title",
+                    f"Prompt {titled_copy}: kept, a copy has its own Library title",
+                ]
+            ),
+        )
+        self.assertEqual(plan["protected"]["count"], 4)
+        self.assert_complete(job, 4)
+
+    async def test_unused_components_lists_each_kept_prompt_with_its_reasons(self):
+        self.save("Orphan")
+        tagged = self.save("Kept", tags=["__protected__"])
+        self.api.db.save_prompt_pair("Paired", "")
+        paired = self.api.db.search_prompts(text="Paired")[0]["id"]
+        with self.api.db.model.get_connection() as conn:
+            conn.execute(
+                "INSERT INTO prompt_tags(prompt_id, tag_id) "
+                "SELECT ?, id FROM tags WHERE name='__protected__'",
+                (paired,),
+            )
+        plan, _summary, job = await self.run_apply("unused_components")
+        self.assertEqual(job.state, "finished", job.log)
+        self.assertEqual(
+            sorted(job.outcomes["protected"], key=lambda row: row["detail"]),
+            sorted(
+                [
+                    _record(f"Prompt {tagged}: kept, tagged __protected__"),
+                    _record(
+                        f"Prompt {paired}: kept, in a saved pair; "
+                        "tagged __protected__"
+                    ),
+                ],
+                key=lambda row: row["detail"],
+            ),
+        )
+        self.assertEqual(plan["protected"]["count"], 2)
+        self.assert_complete(job, 2)
+
+    async def test_report_lists_every_kept_prompt(self):
+        PromptManagerConfig.SAFETY_BACKUP = False
+        count = MAX_OUTCOME_ROWS + 5
+        for n in range(count):
+            self.save(f"Kept {n:03d}", tags=["__protected__"])
+        _plan, _summary, job = await self.run_apply("unused_components")
+        self.assertEqual(len(job.outcomes["protected"]), MAX_OUTCOME_ROWS)
+        self.assert_complete(job, count)
+
+    async def test_missing_links_lists_each_kept_link_with_its_file(self):
+        unmounted = Path(self.tmpdir) / "unmounted"
+        unmounted.mkdir()
+        GalleryConfig.MONITORING_DIRECTORIES = [str(self.output_dir), str(unmounted)]
+        prompt = self.save("Links")
+        self.image(prompt, "gone.png", exists=False)
+        self.image(prompt, "sub/away.png", folder=unmounted, exists=False)
+        self.image(prompt, "x.png", folder=Path(self.tmpdir) / "elsewhere")
+        shutil.rmtree(unmounted)
+        plan, _summary, job = await self.run_apply("missing_links")
+        self.assertEqual(job.state, "finished", job.log)
+        self.assertEqual(plan["protected"]["count"], 2)
+        rows = sorted(job.outcomes["protected"], key=lambda row: row["path"])
+        self.assertEqual(
+            [(row["path"], row["detail"]) for row in rows],
+            [
+                ("sub/away.png", "Kept: link under an unavailable source"),
+                ("x.png", "Kept: link outside the image sources"),
+            ],
+        )
+        # The gone source keeps the path under its label; outside every
+        # source the row names the file only.
+        self.assertEqual((rows[0]["root"], rows[0]["root_index"]), ("unmounted", None))
+        self.assertEqual((rows[1]["root"], rows[1]["root_index"]), ("", None))
+        self.assertNotIn(self.tmpdir, str(job.report()))
+        self.assert_complete(job, 2)

tests/test_api_thumbnail_location.py

@@ -0,0 +1,487 @@
+"""The thumbnail location setting (#320 PR 2): parsing, validation, source
+keys, the marker, the settings payloads and reverse containment.
+
+Spelling rules are tested on both path flavors (``ntpath`` and
+``posixpath``) as text; filesystem rules run on the native one.
+"""
+
+import json
+import ntpath
+import os
+import posixpath
+import re
+import sys
+import tempfile
+import threading
+import unittest
+from pathlib import Path
+from unittest.mock import MagicMock, patch
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+sys.modules.setdefault("server", MagicMock())
+
+from py.api import preview_location as pl  # noqa: E402
+from py.api import preview_store  # noqa: E402
+
+REPO = Path(__file__).resolve().parent.parent
+
+
+class TestParse(unittest.TestCase):
+    def test_missing_or_source_is_inside_each_source(self):
+        for value in (None, {"mode": "source"}, {}):
+            with self.subTest(value=value):
+                parsed = pl.parse_location(value)
+                self.assertEqual((parsed.mode, parsed.problem), ("source", None))
+
+    def test_a_folder_location_is_kept_as_spelled(self):
+        parsed = pl.parse_location(
+            {"mode": "folder", "path": "D:\\Thumbs", "id": "x", "install": "i"},
+            flavor=ntpath,
+        )
+        self.assertEqual(
+            (parsed.mode, parsed.path, parsed.id, parsed.problem),
+            ("folder", "D:\\Thumbs", "x", None),
+        )
+
+    def test_invalid_values_never_fall_back_to_the_sources(self):
+        for value in (
+            "folder",
+            {"mode": "elsewhere"},
+            {"mode": "folder", "path": "relative", "id": "x"},
+            {"mode": "folder", "path": "/abs"},
+            {"mode": "folder", "path": "/abs", "id": ""},
+            {"mode": "folder", "path": 7, "id": "x"},
+        ):
+            with self.subTest(value=value):
+                parsed = pl.parse_location(value, flavor=posixpath)
+                self.assertEqual((parsed.mode, parsed.problem), ("folder", "invalid"))
+
+
+class TestForm(unittest.TestCase):
+    def test_windows_spellings(self):
+        cases = {
+            "D:\\Thumbs": None,
+            "\\\\server\\share\\thumbs": None,
+            "C:thumbs": "location-not-absolute",
+            "\\thumbs": "location-not-absolute",
+            "thumbs": "location-not-absolute",
+            "": "location-not-absolute",
+            " D:\\Thumbs": "location-not-absolute",
+            "\\\\?\\D:\\Thumbs": "location-device-path",
+            "\\\\.\\D:\\Thumbs": "location-device-path",
+            "D:\\CON\\x": "location-invalid-name",
+            "D:\\com1.txt": "location-invalid-name",
+            "D:\\thumbs.": "location-invalid-name",
+            "D:\\thumbs ": "location-invalid-name",
+            "D:\\a|b": "location-invalid-name",
+            "D:\\a?b": "location-invalid-name",
+            "D:\\a\x01b": "location-invalid-name",
+        }
+        for path, code in cases.items():
+            with self.subTest(path=path):
+                self.assertEqual(pl.form_problem(path, flavor=ntpath), code)
+
+    def test_posix_spellings(self):
+        cases = {
+            "/mnt/fast/thumbs": None,
+            "mnt/thumbs": "location-not-absolute",
+            "/mnt/nul": "location-invalid-name",
+            "/mnt/a:b": "location-invalid-name",
+            "//?/x": "location-device-path",
+        }
+        for path, code in cases.items():
+            with self.subTest(path=path):
+                self.assertEqual(pl.form_problem(path, flavor=posixpath), code)
+
+    def test_roots_and_home_are_too_broad(self):
+        self.assertTrue(pl.is_too_broad("C:\\", home="C:\\Users\\a", flavor=ntpath))
+        self.assertTrue(
+            pl.is_too_broad("\\\\server\\share", home="C:\\Users\\a", flavor=ntpath)
+        )
+        self.assertTrue(
+            pl.is_too_broad("C:\\users\\A", home="C:\\Users\\a", flavor=ntpath)
+        )
+        self.assertTrue(pl.is_too_broad("/", home="/home/a", flavor=posixpath))
+        self.assertTrue(pl.is_too_broad("/home/a/", home="/home/a", flavor=posixpath))
+        self.assertFalse(
+            pl.is_too_broad("/home/a/thumbs", home="/home/a", flavor=posixpath)
+        )
+
+    def test_long_windows_paths_are_refused_without_long_paths(self):
+        short = "D:\\" + "a" * 100
+        long = "D:\\" + "a" * 200
+        self.assertFalse(pl.too_long_for_windows(short, long_paths=False))
+        self.assertTrue(pl.too_long_for_windows(long, long_paths=False))
+        self.assertFalse(pl.too_long_for_windows(long, long_paths=True))
+
+
+class TestSourceKeys(unittest.TestCase):
+    def test_slug(self):
+        self.assertEqual(pl.slug("ComfyUI Output"), "comfyui-output")
+        self.assertEqual(pl.slug("Ünïcödé_Fôlder"), "unicode_folder")
+        self.assertEqual(pl.slug(""), "source")
+        self.assertEqual(pl.slug("!!!"), "source")
+        self.assertEqual(len(pl.slug("x" * 80)), 24)
+
+    def test_keys_are_a_slug_plus_a_hash(self):
+        key = pl.source_key("D:\\AI\\Output", "d:\\ai\\output", {})
+        self.assertRegex(key, r"^output-[0-9a-f]{8}$")
+        self.assertRegex(pl.source_key("D:\\", "d:\\", {}), r"^source-[0-9a-f]{8}$")
+        self.assertRegex(
+            pl.source_key("\\\\nas\\share\\Out", "\\\\nas\\share\\out", {}),
+            r"^out-[0-9a-f]{8}$",
+        )
+
+    def test_a_taken_key_grows_its_hash(self):
+        first = pl.source_key("/a/out", "/a/out", {})
+        taken = {first: "/someone/else"}
+        second = pl.source_key("/a/out", "/a/out", taken)
+        self.assertRegex(second, r"^out-[0-9a-f]{12}$")
+        taken[second] = "/another"
+        self.assertRegex(
+            pl.source_key("/a/out", "/a/out", taken), r"^out-[0-9a-f]{16}$"
+        )
+        self.assertEqual(pl.source_key("/a/out", "/a/out", {first: "/a/out"}), first)
+
+    def test_lookup_by_spelling_identity_then_file_id(self):
+        keys = {
+            "out-0123abcd": {
+                "path": "D:\\Out",
+                "identity": "d:\\out",
+                "dev_ino": [1, 2],
+            },
+            "lib-0123abcd": {"path": "E:\\Lib", "identity": "e:\\lib", "dev_ino": None},
+        }
+        self.assertEqual(pl.find_key(keys, "D:\\Out", "x", None), "out-0123abcd")
+        self.assertEqual(pl.find_key(keys, "Z:\\Out", "d:\\out", None), "out-0123abcd")
+        # A letter spelling and its UNC spelling: the same file id.
+        self.assertEqual(
+            pl.find_key(keys, "\\\\nas\\out", "\\\\nas\\out", (1, 2)), "out-0123abcd"
+        )
+        self.assertIsNone(pl.find_key(keys, "F:\\New", "f:\\new", (9, 9)))
+
+
+class TestMarker(unittest.TestCase):
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self._tmp.cleanup)
+        self.folder = self._tmp.name
+
+    def test_init_creates_once_and_adopts_after(self):
+        first = pl.init_folder(self.folder, created_by_pm=True)
+        self.assertEqual(pl.init_folder(self.folder), first)
+        marker = pl.read_marker(self.folder)
+        self.assertEqual(marker["id"], first)
+        self.assertTrue(marker["created_by_pm"])
+        self.assertEqual(marker["version"], 1)
+
+    def test_writes_merge_what_another_writer_added(self):
+        pl.init_folder(self.folder)
+        pl.write_marker(
+            self.folder, lambda m: m["keys"].update({"a-0123abcd": {"install": "1"}})
+        )
+        pl.write_marker(
+            self.folder, lambda m: m["keys"].update({"b-0123abcd": {"install": "2"}})
+        )
+        self.assertEqual(
+            sorted(pl.read_marker(self.folder)["keys"]), ["a-0123abcd", "b-0123abcd"]
+        )
+        # No temp file is left beside it.
+        self.assertEqual(os.listdir(self.folder), [pl.MARKER_NAME])
+
+    def test_two_processes_adding_keys_at_once_keep_every_key(self):
+        """Installs sharing one folder (bot review, P2): the read-modify-write
+        of the marker is locked across processes, so no writer drops another's
+        key. Each child widens the window by pausing inside ``mutate``."""
+        import subprocess
+
+        pl.init_folder(self.folder)
+        child = (
+            "import sys, time\n"
+            "sys.path.insert(0, sys.argv[1])\n"
+            "from py.api import preview_location as pl\n"
+            "folder, tag, start = sys.argv[2], sys.argv[3], float(sys.argv[4])\n"
+            "while time.time() < start: time.sleep(0.001)\n"
+            "for n in range(8):\n"
+            "    def add(m, n=n):\n"
+            "        time.sleep(0.01)\n"
+            "        m['keys'][f'{tag}-{n:08x}'] = {'install': tag}\n"
+            "    pl.write_marker(folder, add)\n"
+        )
+        import time
+
+        start = str(time.time() + 1.0)
+        procs = [
+            subprocess.Popen(  # nosec B603 - this interpreter, fixed arguments
+                [sys.executable, "-c", child, str(REPO), self.folder, tag, start]
+            )
+            for tag in ("a", "b", "c")
+        ]
+        for proc in procs:
+            self.assertEqual(proc.wait(timeout=60), 0)
+        keys = pl.read_marker(self.folder)["keys"]
+        self.assertEqual(len(keys), 24, sorted(keys))
+        self.assertEqual(os.listdir(self.folder), [pl.MARKER_NAME])
+
+    def test_a_lock_left_by_a_crashed_writer_is_taken_over_when_stale(self):
+        pl.init_folder(self.folder)
+        lock = os.path.join(self.folder, pl.MARKER_LOCK_NAME)
+        with open(lock, "w", encoding="utf-8") as handle:
+            handle.write("crashed")
+        old = pl.time.time() - pl.MARKER_LOCK_STALE - 5
+        os.utime(lock, (old, old))
+        pl.write_marker(self.folder, lambda m: m["keys"].update({"a-0123abcd": {}}))
+        self.assertIn("a-0123abcd", pl.read_marker(self.folder)["keys"])
+        self.assertFalse(os.path.exists(lock))
+
+    def test_a_held_lock_times_out_without_writing(self):
+        pl.init_folder(self.folder)
+        lock = os.path.join(self.folder, pl.MARKER_LOCK_NAME)
+        with open(lock, "w", encoding="utf-8") as handle:
+            handle.write("held")
+        with patch.object(pl, "MARKER_LOCK_TIMEOUT", 0.05):
+            with self.assertRaises(TimeoutError):
+                pl.write_marker(self.folder, lambda m: m["keys"].update({"x": {}}))
+        self.assertTrue(os.path.exists(lock))  # never taken from its holder
+        self.assertEqual(pl.read_marker(self.folder)["keys"], {})
+
+    def test_a_folder_without_the_marker_is_missing(self):
+        self.assertEqual(pl.folder_state(self.folder, "x")[:2], (False, "missing"))
+        missing = os.path.join(self.folder, "gone")
+        self.assertEqual(pl.folder_state(missing, "x")[:2], (False, "missing"))
+        marker_id = pl.init_folder(self.folder)
+        self.assertEqual(pl.folder_state(self.folder, marker_id)[:2], (True, None))
+        self.assertEqual(
+            pl.folder_state(self.folder, "other")[:2], (False, "marker-mismatch")
+        )
+
+    @unittest.skipUnless(hasattr(os, "symlink"), "needs symlinks")
+    def test_a_linked_folder_is_not_available(self):
+        real = os.path.join(self.folder, "real")
+        os.mkdir(real)
+        marker_id = pl.init_folder(real)
+        link = os.path.join(self.folder, "link")
+        try:
+            os.symlink(real, link, target_is_directory=True)
+        except OSError:
+            self.skipTest("symlinks not permitted")
+        self.assertEqual(pl.folder_state(link, marker_id)[:2], (False, "invalid"))
+
+
+class TestValidation(unittest.TestCase):
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self._tmp.cleanup)
+        self.base = os.path.realpath(self._tmp.name)
+        self.source = os.path.join(self.base, "output")
+        self.node = os.path.join(self.base, "node")
+        os.mkdir(self.source)
+        os.mkdir(self.node)
+        self.context = pl.Context(
+            roots=(self.source,),
+            node_folder=self.node,
+            default_path=os.path.join(self.node, "data", "thumbnails"),
+            home=os.path.join(self.base, "home"),
+            environ={},
+            long_paths=True,
+            folder_paths=None,
+        )
+
+    def problem(self, path, purpose="move", **changes):
+        context = self.context
+        if changes:
+            context = pl.Context(**{**context.__dict__, **changes})
+        return pl.location_problem(path, purpose=purpose, context=context)
+
+    def test_an_empty_new_folder_beside_the_sources_is_accepted(self):
+        self.assertIsNone(self.problem(os.path.join(self.base, "thumbs")))
+        os.mkdir(os.path.join(self.base, "empty"))
+        Path(self.base, "empty", "Thumbs.db").write_bytes(b"")
+        self.assertIsNone(self.problem(os.path.join(self.base, "empty")))
+
+    def test_codes(self):
+        cases = {
+            "relative": "location-not-absolute",
+            os.path.join(self.source, "thumbs"): "location-served",
+            os.path.join(self.node, "thumbs"): "location-node-folder",
+            self.base: "location-contains-source",
+            os.path.join(self.base, "no", "parent"): "location-parent-missing",
+        }
+        for path, code in cases.items():
+            with self.subTest(path=path):
+                self.assertEqual(self.problem(path), code)
+
+    def test_the_default_may_sit_in_the_node_folder_and_make_its_parents(self):
+        self.assertIsNone(self.problem(self.context.default_path))
+
+    def test_the_folder_in_use_is_the_same(self):
+        folder = os.path.join(self.base, "thumbs")
+        os.mkdir(folder)
+        self.assertEqual(self.problem(folder, current_path=folder), "location-same")
+
+    def test_a_folder_inside_the_folder_in_use_is_refused(self):
+        # Codex P2 on #592: the old key folders are removed after the move,
+        # and with them a target nested inside one of them.
+        folder = os.path.join(self.base, "thumbs")
+        os.mkdir(folder)
+        pl.init_folder(folder)
+        for nested in (
+            os.path.join(folder, "output-0123abcd", "nested"),
+            os.path.join(folder, "beside"),
+        ):
+            with self.subTest(nested=nested):
+                self.assertEqual(
+                    self.problem(nested, current_path=folder),
+                    "location-inside-current",
+                )
+
+    def test_a_folder_with_other_files_is_not_empty_unless_it_is_ours(self):
+        folder = os.path.join(self.base, "full")
+        os.mkdir(folder)
+        Path(folder, "photo.jpg").write_bytes(b"x")
+        self.assertEqual(self.problem(folder), "location-not-empty")
+        pl.init_folder(folder)
+        self.assertIsNone(self.problem(folder))
+
+    @unittest.skipIf(os.name == "nt" or os.geteuid() == 0, "needs POSIX modes")
+    def test_a_folder_that_refuses_writes(self):
+        folder = os.path.join(self.base, "ro")
+        os.mkdir(folder)
+        os.chmod(folder, 0o500)
+        self.addCleanup(os.chmod, folder, 0o700)
+        self.assertEqual(self.problem(folder), "location-not-writable")
+
+    def test_a_stat_that_does_not_answer_is_unavailable(self):
+        release = threading.Event()
+        self.addCleanup(release.set)
+
+        def stuck(*_args):
+            release.wait(10)
+
+        with patch.object(pl, "_filesystem_problem", stuck):
+            code = pl.location_problem(
+                os.path.join(self.base, "thumbs"),
+                purpose="move",
+                context=self.context,
+                timeout=0.1,
+            )
+        self.assertEqual(code, "location-unavailable")
+
+    def test_a_long_windows_path(self):
+        path = os.path.join(self.base, "t" * 220)
+        self.assertEqual(self.problem(path, long_paths=False), "location-path-too-long")
+
+    def test_every_code_has_a_message_without_a_path(self):
+        for code, (status, text) in pl.MESSAGES.items():
+            with self.subTest(code=code):
+                self.assertIn(status, (400, 409, 507))
+                self.assertTrue(text.endswith("."))
+
+
+class TestNoLegacySaveCallers(unittest.TestCase):
+    def test_save_to_file_has_no_callers(self):
+        offenders = []
+        for folder in ("py", "utils", "database"):
+            for path in (REPO / folder).rglob("*.py"):
+                for number, line in enumerate(
+                    path.read_text(encoding="utf-8").splitlines(), 1
+                ):
+                    code = line.split("#", 1)[0]
+                    if (
+                        re.search(r"\bsave_to_file\(", code)
+                        and "def save_to_file" not in code
+                    ):
+                        if "PromptManagerConfig.save_to_file('" in line:
+                            continue  # its own docstring example
+                        offenders.append(f"{path.relative_to(REPO)}:{number}")
+        self.assertEqual(offenders, [])
+
+
+try:
+    from tests.test_api_images import ImageAPITestCase
+except ImportError:  # discovered with tests/ as the top-level directory
+    from test_api_images import ImageAPITestCase
+
+
+class TestLocationRoutes(ImageAPITestCase):
+    async def asyncSetUp(self):
+        await super().asyncSetUp()
+        self.addCleanup(preview_store.configure, None)
+
+    def use_folder(self):
+        folder = self.comfy_dir / "thumbs"
+        folder.mkdir()
+        marker_id = pl.init_folder(str(folder), created_by_pm=True)
+        preview_store.configure(
+            {"mode": "folder", "path": str(folder), "id": marker_id}
+        )
+        return folder
+
+    async def test_settings_get_names_the_location_with_its_path(self):
+        folder = self.use_folder()
+        resp = await self.client.get("/prompt_manager/settings")
+        location = (await resp.json())["thumbnail_location"]
+        self.assertEqual(location["mode"], "folder")
+        self.assertEqual(location["path"], str(folder))
+        self.assertTrue(location["available"])
+        self.assertIsNone(location["problem"])
+        self.assertIn("default_path", location)
+
+    async def test_settings_post_never_changes_the_location(self):
+        resp = await self.client.post(
+            "/prompt_manager/settings",
+            json={"thumbnail_location": {"mode": "folder", "path": "/x"}},
+        )
+        self.assertEqual(resp.status, 409)
+        body = await resp.json()
+        self.assertEqual(body["code"], "location-needs-move")
+        self.assertNotIn("/x", body["error"])
+
+    async def test_status_has_the_location_but_no_path(self):
+        folder = self.use_folder()
+        resp = await self.client.get("/prompt_manager/images/thumbnails/status")
+        body = await resp.text()
+        self.assertNotIn(str(folder), body)
+        self.assertEqual(
+            json.loads(body)["location"],
+            {"mode": "folder", "available": True, "problem": None},
+        )
+
+    async def test_a_source_inside_or_around_the_folder_is_refused(self):
+        from py.api import sources
+
+        folder = self.use_folder()
+        inside = folder / "sub"
+        inside.mkdir()
+        with patch(
+            "py.config.GalleryConfig.gallery_root_problem",
+            classmethod(lambda cls, path: (None, "")),
+        ):
+            for path in (inside, folder, self.comfy_dir):
+                with self.subTest(path=path):
+                    code, reason = sources.source_problem(str(path))
+                    self.assertEqual(code, "holds-thumbnails")
+                    self.assertEqual(reason, pl.HOLDS_THUMBNAILS_REASON)
+            self.assertEqual(sources.source_problem(str(self.output_dir))[0], None)
+
+    async def test_a_library_move_into_the_folder_is_refused(self):
+        from py.api import library_location as routes
+
+        folder = self.use_folder()
+        self.assertTrue(routes._inside_thumbnail_folder(str(folder / "lib")))
+        self.assertFalse(routes._inside_thumbnail_folder(str(self.output_dir)))
+
+    def test_startup_makes_a_location_inside_a_source_invalid(self):
+        inside = self.output_dir / "thumbs"
+        inside.mkdir()
+        marker_id = pl.init_folder(str(inside))
+        from py.config import PromptManagerConfig
+
+        value = {"mode": "folder", "path": str(inside), "id": marker_id}
+        with patch.object(PromptManagerConfig, "THUMBNAIL_LOCATION", value):
+            location = self.api.start_preview_location()
+        self.assertEqual((location.available, location.problem), (False, "invalid"))
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_api_workflow_storage.py

@@ -363,11 +363,11 @@ class TestWorkflowStorageOutcomes(WorkflowStorageTestCase):
         prompt_id = self.old_library(count=4)
         conn = self.api.db.model.get_connection()
         with conn:
-            conn.execute(
+            image_id = conn.execute(
                 "INSERT INTO generated_images (prompt_id, image_path, filename, "
                 "file_path, workflow_data) VALUES (?, '/x/b', 'b', '/x/b', x'00')",
                 (prompt_id,),
-            )
+            ).lastrowid
             store_text(conn, "a document no record references")
         _plan, _summary, job = await self.start()
         await self.finish(job)
@@ -377,6 +377,13 @@ class TestWorkflowStorageOutcomes(WorkflowStorageTestCase):
             "Rewrote 4 image records; 1 stored value not text, kept as is", log
         )
         self.assertIn("Removed 1 unused workflow document", log)
+        # #586: the kept value has its row, in the review's wording.
+        self.assertEqual(
+            [row["detail"] for row in job.outcomes["protected"]],
+            [f"Image record {image_id}: workflow, stored value not text; kept as is"],
+        )
+        report = job.report()["outcomes"]["protected"]
+        self.assertEqual((report["count"], report["truncated"]), (1, False))
 
     async def reclaim_with(self, **patches):
         self.old_library(count=4)

tests/test_api_workspace_images.py

@@ -908,20 +908,20 @@ class TestWorkspaceImages(ImageAPITestCase):
 
     async def test_one_cards_parse_error_spares_the_page(self):
         prompt = self._save_prompt("a fox")
-        for name, mtime in (("bad.png", 200), ("ok.png", 100)):
+        # Cards are read on the image pool (#523), in no fixed order: the
+        # parser fails on bad.png's own record (seed 6), not on a call count.
+        for name, mtime, seed in (("bad.png", 200, 6), ("ok.png", 100, 5)):
             path = records_png(
-                self.output_dir / name, seeded_records("a fox", 5), mtime
+                self.output_dir / name, seeded_records("a fox", seed), mtime
             )
             self.api.db.link_image_to_prompt(prompt, str(path))
         real_parse = header_params_of_images()
 
         def parsing(info):
-            if parsing.calls == 0:
-                parsing.calls += 1
+            if '"seed": 6' in info["prompt"]:
                 raise RuntimeError("unexpected parser bug")
             return real_parse(info)
 
-        parsing.calls = 0
         with (
             patch("py.api.images.header_params", side_effect=parsing),
             self.assertLogs(self.api.logger, "WARNING") as logged,

tests/test_autotag_batch.py

@@ -54,6 +54,8 @@ class PerImageTagger(HookedTagger):
         names = self.by_bytes.get(self.read_bytes[-1])
         if names is None:
             return result
+        skip = kwargs.get("skip")  # as the engine does (#431)
+        names = [name for name in names if skip is None or not skip.matches(name)]
         return [(name, 0.9) for name in names][: kwargs["limit"]]
 
 

tests/test_autotag_legacy.py

@@ -158,7 +158,30 @@ class TestLegacyBatch(LegacyTestCase):
         self.image("b.png", (2, 2, 2))
         await self.relist()
         await self.legacy("model_type=gguf&prompt=%20")
-        self.assertEqual(self.tagger.calls[-1]["prompt"], AutotagConfig.TEMPLATE)
+        self.assertEqual(
+            self.tagger.calls[-1]["prompt"],
+            AutotagConfig.default_instructions_text("gguf"),
+        )
+        # #431: a blank prompt falls back to the request engine's own default.
+        saved = (AutotagConfig.INSTRUCTIONS, AutotagConfig.DEFAULT_INSTRUCTIONS)
+        self.addCleanup(
+            lambda: (
+                setattr(AutotagConfig, "INSTRUCTIONS", saved[0]),
+                setattr(AutotagConfig, "DEFAULT_INSTRUCTIONS", saved[1]),
+            )
+        )
+        AutotagConfig.INSTRUCTIONS = (
+            {"id": "0123456789ab", "name": "Photo", "text": "Photo tags."},
+        )
+        AutotagConfig.DEFAULT_INSTRUCTIONS = {"gguf": "builtin", "hf": "0123456789ab"}
+        for model_type, expected in (
+            ("hf", "Photo tags."),
+            ("gguf", AutotagConfig.default_instructions_text("gguf")),
+        ):
+            self.image(f"{model_type}.png", (3, 3, len(model_type)))
+            await self.relist()
+            await self.legacy(f"model_type={model_type}&prompt=%20&skip_tagged=false")
+            self.assertEqual(self.tagger.calls[-1]["prompt"], expected, model_type)
         self.assertEqual(self.tagger.custom_prompt, "legacy prompt")
 
     async def test_a_missing_backend_package_is_one_error_frame(self):

tests/test_config.py

@@ -442,8 +442,11 @@ class TestAutotagConfig(unittest.TestCase):
                 "EXISTING",
                 "GENERAL_THRESHOLD",
                 "CHARACTER_THRESHOLD",
-                "TEMPLATE",
                 "SUGGESTION_LIMIT",
+                "SKIPPED_TAGS",
+                "INSTRUCTIONS",
+                "DEFAULT_INSTRUCTIONS",
+                "_LEGACY_TEMPLATE",
             )
         }
 
@@ -487,16 +490,14 @@ class TestAutotagConfig(unittest.TestCase):
                     "general_threshold": 0.35,
                     "character_threshold": 0.85,
                     "suggestion_limit": 10,
+                    "skipped_tags": [],
+                    "instructions": [],
+                    "default_instructions": {"gguf": "builtin", "hf": "builtin"},
                 }
             },
         )
-        # The built-in template is not written; a saved one is.
-        self.config_class.TEMPLATE = "Saved."
-        self.assertEqual(
-            PromptManagerConfig.get_config()["autotag"]["defaults"]["template"],
-            "Saved.",
-        )
-        self.config_class.TEMPLATE = config_module.DEFAULT_TAG_TEMPLATE
+        # #431: the old template key is written only as the GGUF default's
+        # mirror (test_saved_instructions covers it).
         with tempfile.TemporaryDirectory() as tmpdir:
             path = os.path.join(tmpdir, "config.json")
             PromptManagerConfig.update_config(
@@ -524,16 +525,16 @@ class TestAutotagConfig(unittest.TestCase):
             "existing": "merge",
             "general_threshold": 0.4,
             "character_threshold": 0.7,
-            "template": "Tags only.",
             "suggestion_limit": 15,
+            "skipped_tags": ("blurry", "closed eyes"),
         }
         fallback = {
             "model_type": "wd14-swinv2",
             "existing": "skip",
             "general_threshold": 0.35,
             "character_threshold": 0.85,
-            "template": config_module.DEFAULT_TAG_TEMPLATE,
             "suggestion_limit": 10,
+            "skipped_tags": (),
         }
         bad_values = {
             "model_type": ["wd14-convnext", 3, None],
@@ -544,6 +545,8 @@ class TestAutotagConfig(unittest.TestCase):
             # 4000 characters are at most 16,000 UTF-8 bytes, so the 16 KiB
             # byte cap can only be met past the character cap.
             "template": ["", "   ", "x" * 4001, "\U0001f600" * 4097, "\ud800", 7],
+            # #431: the whole list falls back; entries are never dropped one by one.
+            "skipped_tags": ["blurry", ["a,b"], ["sky", "Sky"], [""], ["x"] * 201],
         }
         for key, values in bad_values.items():
             for value in values:
@@ -552,7 +555,7 @@ class TestAutotagConfig(unittest.TestCase):
                     with tempfile.TemporaryDirectory() as tmpdir:
                         path = os.path.join(tmpdir, "config.json")
                         with open(path, "w") as f:
-                            json.dump({"autotag": {"defaults": saved}}, f)
+                            json.dump({"autotag": {"defaults": saved}}, f, default=list)
                         with self.assertLogs(
                             "prompt_manager.config", level="WARNING"
                         ) as logs:
@@ -563,7 +566,32 @@ class TestAutotagConfig(unittest.TestCase):
                         k: getattr(self.config_class, attr)
                         for k, (attr, _v, _d) in self.config_class._KEYS.items()
                     }
-                    self.assertEqual(loaded, dict(good, **{key: fallback[key]}))
+                    # The old template is no attribute any more (#431): a bad
+                    # one is only warned about and imports nothing.
+                    expected = (
+                        dict(good, **{key: fallback[key]}) if key in fallback else good
+                    )
+                    self.assertEqual(loaded, expected)
+
+    def test_skipped_tags_load_trimmed_and_warn_once_when_damaged(self):
+        """#431: the list is kept as typed (trimmed); a damaged list is
+        replaced by no skipped tags with one warning naming the reason."""
+        PromptManagerConfig.update_config(
+            {"autotag": {"defaults": {"skipped_tags": [" blurry ", "(fate)"]}}}
+        )
+        self.assertEqual(self.config_class.SKIPPED_TAGS, ("blurry", "(fate)"))
+        with self.assertLogs("prompt_manager.config", level="WARNING") as logs:
+            PromptManagerConfig.update_config(
+                {"autotag": {"defaults": {"skipped_tags": ["sky", "a,b"]}}}
+            )
+        self.assertEqual(self.config_class.SKIPPED_TAGS, ())
+        self.assertEqual(
+            [record.getMessage() for record in logs.records],
+            [
+                "autotag.defaults.skipped_tags entry 2 must not contain a comma"
+                " or a line break; using no skipped tags"
+            ],
+        )
 
     def test_tagging_validators_moved_with_their_messages(self):
         validate_threshold = config_module.validate_threshold

tests/test_exit_window_threads.py

@@ -146,6 +146,18 @@ class TestPreviewQueueRefusedAtShutdown(unittest.TestCase):
 
 
 class TestMapParallelRefusedAtShutdown(unittest.TestCase):
+    def setUp(self):
+        # The job pool is long-lived (#523): start each test without one, so
+        # the patched pool class is the one created.
+        self.assertTrue(parallel.shutdown_job_pool(30))
+        self.addCleanup(parallel.shutdown_job_pool, 30)
+
+    def test_the_refused_pool_is_not_reused(self):
+        with mock.patch.object(parallel, "ThreadPoolExecutor", _ShutPool):
+            parallel.map_parallel(lambda n: n, [1, 2], 2)
+        self.assertFalse(parallel.job_pool_started())
+        self.assertEqual(parallel.map_parallel(lambda n: n + 1, [1, 2], 2), [2, 3])
+
     def test_a_shut_pool_runs_the_items_on_the_calling_thread(self):
         records = _capture(self, "prompt_manager.parallel")
         with mock.patch.object(parallel, "ThreadPoolExecutor", _ShutPool):

tests/test_file_prompt.py

@@ -564,6 +564,66 @@ class TestUndecidedGraph(unittest.TestCase):
         self.assertEqual(decision.review, "untraced")
 
 
+def _search_list(text="fox", side="positive"):
+    """f22: a PromptSearchList batch (no PromptManager node) feeds CLIPTextEncode."""
+    graph = parity.build("f22")["prompt"]
+    graph["10"]["inputs"]["text"] = text
+    if side == "negative":
+        # The search feeds the negative; the positive is typed text.
+        graph["6"]["inputs"]["text"] = parity.POS
+        graph["7"]["inputs"]["text"] = ["10", 0]
+    return graph
+
+
+class TestSearchTextIsNeverAPrompt(unittest.TestCase):
+    """#548: the PromptSearchList query is a search, never the prompt."""
+
+    def test_the_search_text_is_never_linked_or_stored(self):
+        for policy in Policy:
+            with self.subTest(policy=policy):
+                decision = _decide(
+                    _graph(_search_list()), policy=policy, lookup=_Lookup()
+                )
+                self.assertEqual(decision.kind, "never")
+                self.assertIsNone(decision.text)
+                self.assertEqual(decision.unlinked_status, "unresolved")
+                self.assertTrue(decision.try_recorded_run)
+
+    def test_a_search_text_from_a_primitive_is_never_linked(self):
+        graph = _search_list()
+        graph["10"]["inputs"]["text"] = ["30", 0]
+        graph["30"] = {"class_type": "PrimitiveString", "inputs": {"value": "fox"}}
+        for policy in Policy:
+            with self.subTest(policy=policy):
+                decision = _decide(_graph(graph), policy=policy, lookup=_Lookup())
+                self.assertEqual(decision.kind, "never")
+                self.assertIsNone(decision.text)
+
+    def test_an_empty_search_text_is_unchanged(self):
+        """Regression guard (passes on the base): nothing to exclude."""
+        for policy in Policy:
+            with self.subTest(policy=policy):
+                decision = _decide(
+                    _graph(_search_list("")), policy=policy, lookup=_Lookup()
+                )
+                self.assertEqual((decision.kind, decision.text), ("never", None))
+
+    def test_without_a_sampler_any_search_list_query_is_excluded(self):
+        graph = _search_list()
+        del graph["3"]
+        self.assertTrue(file_prompt._search_text(graph, " fox "))
+        self.assertFalse(file_prompt._search_text(graph, "a fox"))
+        self.assertFalse(file_prompt._search_text(None, "fox"))
+
+    def test_a_search_on_the_negative_keeps_the_typed_positive(self):
+        """Regression guard (passes on the base): only the positive's source
+        is excluded, so the legacy answer from typed text still links."""
+        graph = _search_list(side="negative")
+        decision = _decide(_graph(graph), lookup=_Lookup())
+        self.assertEqual((decision.kind, decision.text), ("positive", parity.POS))
+        self.assertEqual(decision.source, "legacy-parser")
+
+
 class TestStepsWithoutAnUndecidedGraph(unittest.TestCase):
     def test_step_9_ambiguous_parameters_only(self):
         meta = {

tests/test_image_monitor_singleton.py

@@ -392,7 +392,10 @@ class TestStartStop(unittest.TestCase):
             self.assertLogs("prompt_manager.image_monitor", "WARNING") as logs,
         ):
             self.assertFalse(self.monitor.stop_monitoring(timeout=5.0))
-        self.assertEqual(fake.calls[-1], ("join", 0.0))
+        # The stop runs on its own thread and gets 0 s too: it may not have
+        # returned yet, and then nothing is joined at all.
+        joins = [call for call in fake.calls if call[0] == "join"]
+        self.assertTrue(all(call == ("join", 0.0) for call in joins), fake.calls)
         self.assertIn(
             "watchdog observer still running after 0.0 s", "\n".join(logs.output)
         )
@@ -401,6 +404,80 @@ class TestStartStop(unittest.TestCase):
     def test_stop_monitoring_without_an_observer_returns_true(self):
         self.assertTrue(self.monitor.stop_monitoring())
 
+    def test_threads_the_observer_starts_are_daemons(self):
+        # watchdog 7 on Windows starts a plain threading.Thread per watch in
+        # observer.start(); a non-daemon one holds the interpreter's exit
+        # before any atexit callback runs (#561).
+        fake = ReaderObserver()
+        self.addCleanup(fake.release.set)
+        self._start_with(fake)
+        self.assertIsNotNone(fake.reader)
+        self.assertTrue(fake.reader.daemon)
+        self.assertFalse(threading.current_thread().daemon)
+
+    def test_an_observer_that_fails_to_start_on_its_thread_is_reported(self):
+        fake = FakeObserver()
+        fake.start = MagicMock(side_effect=OSError("handle refused"))
+        with self.assertLogs("prompt_manager.image_monitor", "ERROR") as logs:
+            with patch.object(im_mod, "Observer", return_value=fake):
+                self.monitor.start_monitoring([self.tmp.name])
+        self.assertIn("handle refused", "\n".join(logs.output))
+        self.assertFalse(self.monitor.is_monitoring)
+
+    def test_an_observer_stop_that_never_returns_is_bounded(self):
+        # watchdog's observer.stop() joins its emitters (and, in 7.x on
+        # Windows, their reader threads) without a limit (#561).
+        fake = StuckStopObserver()
+        self.addCleanup(fake.release.set)
+        self._start_with(fake)
+        with self.assertLogs("prompt_manager.image_monitor", "WARNING") as logs:
+            self.assertFalse(self.monitor.stop_monitoring(timeout=0.05))
+        self.assertIn("watchdog observer still running", "\n".join(logs.output))
+        self.assertTrue(fake.entered.wait(30))
+        self.assertFalse(self.monitor.is_monitoring)
+        # A second stop waits for the stop already running; it never calls
+        # observer.stop() a second time.
+        fake.release.set()
+        self.assertTrue(self.monitor.stop_monitoring())
+        self.assertEqual(fake.stop_calls, 1)
+        self.assertFalse(self.monitor._unfinished)
+
+
+class ReaderObserver(FakeObserver):
+    """A FakeObserver whose start() starts a plain thread, as watchdog 7's
+    Windows emitter does for its ReadDirectoryChangesW reader."""
+
+    def __init__(self):
+        super().__init__()
+        self.release = threading.Event()
+        self.reader = None
+
+    def start(self):
+        self.reader = threading.Thread(target=self.release.wait)
+        self.reader.start()
+        super().start()
+
+    def stop(self):
+        self.release.set()
+        self.reader.join(30)
+        super().stop()
+
+
+class StuckStopObserver(FakeObserver):
+    """A FakeObserver whose stop() does not return until ``release``."""
+
+    def __init__(self):
+        super().__init__()
+        self.entered = threading.Event()
+        self.release = threading.Event()
+        self.stop_calls = 0
+
+    def stop(self):
+        self.stop_calls += 1
+        self.entered.set()
+        self.release.wait(30)
+        super().stop()
+
 
 class FakeEvent:
     def __init__(self, path, is_directory=False):