Merge remote-tracking branch 'origin/main' into feat/249-system-shell

fix(system): make two health tests portable to Windows
- Windows forbids "?" in file names, so the URI-character open test uses "#", "%" and a space there. - ntpath.realpath on Python 3.11+ returns a NUL-byte path instead of raising, so the bad-path test raises as POSIX does to reach the missing-files failure path on every platform.
2026-10-23 04:25:39 -07:00 · 2026-10-23 03:54:20 -07:00 · 2026-10-23 03:51:38 -07:00 · 2026-10-23 03:35:34 -07:00 · 2026-10-23 03:35:33 -07:00 · 2026-10-23 03:24:20 -07:00
78 changed files with 10837 additions and 288 deletions
@@ -50,6 +50,13 @@ stdin open and the server (`--exit-on-stdin-eof`) shuts down cleanly, removing i
 temp root, when that pipe closes, so a worker killed without teardown leaves no
 server behind. A test that fails gets the stderr its server wrote during the test
 attached to the report as `server-stderr` (an aiohttp traceback behind a 500).
+A `/__test__/.../reset` still running after 2 s writes a report to the job log,
+passing test or not: every thread's stack taken while it waits, the default
+executor's threads and queue, the open connections and WAL size, then the total
+and how long each executor call queued and ran. Its lines start with
+`pm-slow-reset| ` (`tests/browser/slow_reset_watch.py`). The report never reads a
+connection another thread is using: one that is busy inside SQLite would block
+that read with the GIL held and freeze the whole server.

 The coverage run can be split the way CI splits it, and each shard keeps the raw
 V8 files it writes under `coverage/js/raw`:
@@ -398,6 +405,13 @@ naming it, here and in a detailer's image ancestry; a latent that is not a link
 reaches its own sampler is `malformed`; running out of budget is `work-limit` or
 `depth-limit`, never single stage. Each sampler's walk runs once per resolution;
 selector branch runs share it and other candidates are charged its visit cost.
+A UI workflow node whose `type` is a list or an object (read only for the overwritten
+PromptManager check) is skipped like a non-object node, since it can be neither a
+subgraph instance nor a PromptManager node, so a prompt that resolves still resolves
+and the other nodes still feed the check; a list or object `class_type` is never a
+preview output. Before #286 both raised and the inspect route answered 500
+(`test_unhashable_*` in `tests/test_api_prompt_inspector.py`, the `workflow-type-*`
+golden cases on both sides).
 Text encoders: `single` encoders (the Qwen image encoders, `TextEncodeQwenImage21`
 slot 0 `prompt` and slot 1 `negative_prompt`, `KikoTextEncode`) read one string
 input unchanged. `parts-equal` encoders (CLIPTextEncodeSDXL, Flux, SD3) resolve when
@@ -1581,7 +1595,43 @@ AVI/WMV preview only), chosen or dropped, previews inline. The heading's one act
 the shared viewer with the full inspector on a record read entirely in this browser
 (`web/js/workspace/inspect.mjs`, `local-session.mjs`, `local-inspection.mjs` and the L1
 readers `png-metadata.js`, `local-video.mjs`, `local-projection.mjs`). Nothing is
-uploaded, imported or stored. Only HTML and JS change, so no ComfyUI restart is needed.
+uploaded, imported or stored. PRs L1 and L2 change only HTML and JS, so they need no
+ComfyUI restart; PR L3 does (below).
+
+Local roles (#249 PR L3, decision LI-1): the prompts and resolution of a local record are
+the server inspector's for the same records. `web/js/workspace/local-resolver.mjs` (with
+`local-resolver-support.mjs`, `local-resolver-stages.mjs`, `local-parameters.mjs` and
+`py-json.mjs`) ports `inspect_prompt_evidence` with `INSPECTION_PROFILE`: execution
+evidence, graph tracing, every bound, several sampler candidates with the
+identical-branch rule (#270), preview-only stages, detailer stages (multistage) and A1111
+`parameters`. It reads the server's own node table, `web/js/inspection-semantics.json`,
+which the page fetches once through the API client as it mounts, before any selection
+(`local-semantics.mjs`; `/prompt_manager/js/inspection-semantics.json` is the one JSON
+file the static route serves, by exact path). A table that cannot be fetched answers
+"The inspector's node table is unavailable." as the server does. The legacy fill in
+`projectInspectionPayload` then applies to a local record exactly where it applies to the
+Images answer for the same bytes. Python is the oracle:
+`tests/test_local_inspect_parity.py` `LocalResolverParityTests` compares the local
+evidence byte for byte with `inspect_prompt_evidence` for every parity PNG and inspection
+vector (prompts, resolution and facts), the golden and selection record sets
+(`tests/local_resolver_cases.py`, `tests/local_resolver_selection_cases.py`), every work
+bound and 1,200 seeded fuzz cases; `tests/fixtures/local-inspect/resolver-vectors.json`
+holds the committed answers the Node unit test reads. The browser spec `chooser shows the
+Images roles and resolution for every parity PNG` compares the rail with Images for all
+25 committed parity PNGs. The static route change and the resolver fixes (Python) need a
+ComfyUI restart.
+
+Main thread (M4): the resolver runs on the page's thread, not a worker. On a desktop
+(Node 26) `resolveLocalEvidence` on maximal 2 MiB graphs (a 19,990-sampler chain, 6,600
+independent samplers, a consumer-dense scan, a 100,000-node PromptManager workflow) took
+130–455 ms; the server took 80–905 ms on the same inputs. `localFileAdapter.read` runs in
+bounded steps (read, table, parse and resolve, project, fit) with a turn of the event
+loop between them, every wait ends with the selection's signal (a stalled table request
+included), and the inspector carries `aria-busy="true"` with "Loading file details…"
+until the answer lands. `tests/js/workspace-local-inspection.test.js` pins a 2,500 ms
+budget per step on maximal independent-sampler and stage-chain graphs, checks that the
+stepped read answers byte for byte as one synchronous build, and that an abort at any
+step ends the read.

 Bounds (the server's own budgets, ported by PR L1; see "Follow-up: local Inspect parity"
 under "Chronological Library history" for the known divergences):
@@ -1600,7 +1650,8 @@ under "Chronological Library history" for the known divergences):

 Privacy, asserted by `local inspection makes no content request or storage write` and
 `local roles send exactly` in `tests/browser/workspace-inspect.spec.mjs`, and by the
-managed-host spec below: no request carries the file's bytes, name or text (fetch, XHR,
+managed-host spec below: the only static file Inspect reads is its node table, once per
+page and before any selection; no request carries the file's bytes, name or text (fetch, XHR,
 beacon, WebSocket, EventSource); Inspect writes nothing to `localStorage`,
 `sessionStorage` or IndexedDB; only an explicit Send crosses the host bridge, and its
 payload carries neither the `blob:` URL nor the filename; no console message names the
@@ -1627,19 +1678,40 @@ mapped differences"):
  `image/png,image/jpeg,image/webp` plus `video/*,.mp4,.mov,.m4v,.webm,.mkv,.avi,.wmv`. A
  video previews in the same `#local-preview` slot as `video.local-file-preview` with
  native `controls`, `playsInline`, `preload="metadata"` and `muted`, never autoplays
-  inline, and is paused, has its `src` removed and is removed from the page on replacement
-  or dispose, before its URL is revoked. Each preview owns its listeners, so the page never
-  pins a released node. A settled video (metadata read, or failed) is then reset with
-  `load()` at once; one still starting is reset only once it reports metadata or an error,
-  because WebKit (GStreamer) blocked the page when such a pipeline was reset (`replacing a
-  video that just started loading never blocks the page`, `a video replaced while still
-  starting is reset once it settles`). A WebKit load cut off by the revoked URL usually
-  stalls and never settles; a fallback then only drops the waiting listeners. The viewer's
-  own video teardown was checked the same way (`closing the viewer on a video that just
-  started never blocks the page`, 15 fresh pages on WebKit) and needed no change.
-  Follow-up: on WebKit, a video released exactly at its `loadstart` sometimes blocks the
-  page, with or without any reset and also before the deferred reset (2 of 24 runs in the
-  pinned image), so the `loadstart` spec is skipped on WebKit until that is investigated.
+  inline. On replacement or dispose it is paused, has its `src` removed, is reset with
+  `load()` (which frees its decoder) and is removed from the page, before its URL is
+  revoked. Each preview owns its listeners, so the page never pins a released node.
+  A video replaced while still starting (a source, but neither metadata nor an error yet)
+  stays where it is, inert and `aria-hidden`, with the new preview inserted after it, and
+  the session's revoke of its URL waits; once it reports metadata or an error (or after
+  15 s) it is released as above and only then is its URL revoked. For that moment (the
+  time to metadata, or at most 15 s for a video that never settles) the old video and the
+  new preview both show, the new one below it: a known, brief overlap. Stacking them in one
+  slot instead hung again, because it changes the video's own box: the old video
+  absolutely positioned in its own box hung 5 of 120 pages (8 of 120 with `opacity: 0`),
+  and a one-cell grid 4 of 120. Only `opacity: 0` on the video, left in the flow, did not
+  hang (0 of 120), and alone it would leave an empty hole above the new preview. A route
+  change within the workspace waits the same way: the shell renders the next route once a
+  video still starting on Inspect settles (`leaveGuard`; the latest route wins). Route
+  changes at `loadstart` + 0–7 ms hung 4–5 of 120 pages before and 0 of 120 after.
+  A real page leave cannot wait. With no page code releasing anything, navigating
+  away hung 8 of 120 pages and reload 22 of 120 (3 and 8 of 120 with the page's own
+  release), so that WebKit teardown stays a known limitation; dispose still releases at
+  once. Cause, found with native stacks of the hung WPE web process in the
+  pinned image: WebKit (GStreamer) deadlocks when a video leaves the page or the viewport
+  before its pipeline has started. The main thread changes the pipeline state and waits
+  for the source's streaming thread, which is itself waiting on the main thread in a
+  synchronous bus handler. Removing the video, hiding it, or only pushing it below the
+  fold with a taller preview inserted before it all hung (7 to 21 of 120 fresh pages each,
+  replaced at `loadstart` + 0–7 ms), and none of the earlier steps (`pause()`, removing
+  `src`, `load()`, revoking the URL) was the cause on its own; pushing it out after
+  `loadedmetadata` hung 0 of 180. Specs: `replacing a video that just started loading
+  never blocks the page`, and `a video replaced while still starting is reset once it
+  settles`, which now runs on WebKit too (15 fresh pages, replaced at `loadstart` + 0–4
+  ms), and `leaving for another route while a video starts waits for it to settle`. The
+  viewer's own video teardown was checked the same way (`closing the viewer on a video
+  that just started never blocks the page`, 15 fresh pages on WebKit) and needed no
+  change.
 - **D63** (status line): one `p.small.spaced-16` in `#local-preview`, for states the
  concept never shows: "Drop one file at a time.", "Folders cannot be inspected. Choose
  one image or video file.", "This file type cannot be previewed or inspected here.
@@ -1664,6 +1736,29 @@ mapped differences"):
  Modified with no Path row and no Show in folder, and ends with "Local file; no saved
  library association was checked." and Download original. There is no Prompt history
  action and no category or tag chips.
+- **D117** (Copy settings summary, LI-4): the legacy metadata
+  page's COPY ALL, consolidated into the shared full inspector (the viewer's
+  `#viewer-details`, so Images, the recorded history's current file and Inspect all have
+  it). The concept has no such action. One plain button "Copy settings summary" follows
+  the six facts (before "File & provenance"); the Images side panel keeps the concept's
+  footer and has none. Its text is the legacy `copyAllData` template, line for line:
+  `Checkpoint`, `Positive Prompt`, `Negative Prompt`, `Steps`, `CFG Scale`, `Sampler`,
+  `Seed`, with the legacy placeholders ("Unknown", "No prompt found", "No negative prompt
+  found"). The values are the ones the inspector shows: a confirmed prompt and a known
+  fact verbatim, anything else (an explicitly empty prompt included, as the legacy parse
+  treats '') the placeholder. Against the legacy page, for the same file, only these
+  differ: numbers keep the server's spelling ("8.0" where the legacy page wrote 8); a fact
+  the legacy parse could not read can be known; and a negative the #249 ZeroOut guard
+  zeroed reads "No negative prompt found" where the legacy parse read the positive's text
+  through the zero-out. `workspace-file-inspector.test.js` runs the template taken from
+  `web/metadata.html` itself on the legacy parse of every parity PNG: 22 of 25 are
+  byte-equal, f01b and f23 differ by the ZeroOut guard and f17 by facts the legacy parse
+  missed. Copying works as the concept's prompt copy: the toast "Settings summary
+  copied.", or, without a clipboard or when it is refused, the select-to-copy dialog
+  titled "Copy settings summary". `.ca-tools #viewer-details > div > button` wraps
+  (`white-space: normal`) in the narrow rail at 200% zoom, as D20's buttons do. The concept
+  comparisons add the button to the concept's viewer at runtime (a copy of its own plain
+  button) and to the Inspect rail's section order.

 The chooser keeps naming the chosen file, as the concept's does: it is cleared as the
 picker opens (so choosing the same file again is a new selection), not after `change`,
@@ -1677,9 +1772,8 @@ Legacy floor (`web/metadata.html`), dispositions:
 - Full text (the old "Show more"): the prompt blocks show the whole text.
 - Raw workflow view and Download workflow JSON: kept, in "Workflow & raw metadata".
 - Copy all summary and filename copy (LI-4): the filename is selectable text in the rail
-  and Download original saves the file under its name. The ruled "Copy settings summary"
-  button after the six facts of the shared full inspector is not part of PR L2; until it
-  lands, the legacy page keeps COPY ALL and stays reachable from Overview.
+  and Download original saves the file under its name. COPY ALL is the shared full
+  inspector's "Copy settings summary" (D117), with the legacy text.
 - Fully browser-local reading: kept and asserted (privacy above).
 - Case-variant keys `Workflow|comfy|ComfyUI|Prompt|Parameters` (LI-5): a separate
  backend issue; Inspect follows the server's readers, so the two never disagree.
@@ -1722,6 +1816,142 @@ npm run --prefix tools/vendor test:workflows -- inspect-concept.spec.mjs workspa
 npm run --prefix tools/vendor test:comfyui -- inspect-sender.spec.mjs
 ```

+### Native System (#249 System)
+
+`#/system/<section>` is a native workspace route rendered by `web/js/workspace/system.mjs`
+on the concept's `renderSystem` markup (app.js a698–706; `concept.css` 709–895). `#/system`
+is Overview under the sidebar's own hash; `#/system/overview|appearance|sources|
+integrations|tagging|maintenance|backups|diagnostics` select a section, and an unknown
+child (the concept's `#/system/general`) is replaced by `#/system/overview`. The
+production hub `#/overview` is unchanged (D28); its System card opens
+`#/system/overview` (Q12). Switching sections keeps the shell, the drafts and focus on
+the pressed section button and disposes the previous section's scope, so its reads,
+listeners and dialogs never outlive it.
+
+Drafts (`system-state.mjs`) live for the page session (Q10). Save writes the dirty
+browser fields, then the host fields (`POST /prompt_manager/settings` with
+`expected_revision`, #220), then the runtime fields. A failed domain keeps its drafts and
+highlights their controls; `settings-changed` is a conflict and keeps the draft. System
+reads the host values on mount and again after a conflict; until a read returned a
+revision, a host save fails without a request, so it never sends a blind
+`expected_revision: null` (which S1 merges into the file on disk). No delivered section
+edits a setting yet, so Save stays disabled until Appearance (S3).
+
+Overview (`system-overview.mjs`) reads `GET /prompt_manager/system/overview` once per
+visit through `latestOnly()` on the section scope; a late answer after the section left
+paints nothing. Until it answers, the section shows "Loading the overview…"; a failure
+shows "The overview could not be loaded. Your saved data has not changed." and Retry,
+never zeros. The thumbnail row is a separate read of `/images/thumbnails/status` (a
+walk of every source), so the other values never wait for it: "Checking thumbnails…"
+until it answers. The health check (`POST /prompt_manager/system/health`) is a `read`
+registry job of kind `health`: one at a time, beside a scan, not cancellable and with
+no file outcomes. The page tracks the started job in the Activity store (its event
+stream; the store marks it lost if the server stops listing it), never by polling. A press while one runs (another tab) waits
+for that one. The last report lives for this server session (`GET
+/prompt_manager/system/health`) and describes the database it was taken from: a
+restore that replaces the database forgets it, and a check that started before the
+swap is not kept. The check's own connection opens a `mode=ro` URI that keeps a Windows
+UNC path (`file:////server/share/prompts.db`; pathlib's `file://server/share/...` is a
+remote authority SQLite refuses). A check that raises fails only itself, and the
+missing-files check reads its rows inside the snapshot but stats the files after it
+ended, so a slow source never pins the WAL. Statistics
+read `GET /prompt_manager/system/statistics` (`by_category`, the legacy `/stats` totals
+and `rated_images`).
+
+Read-only standard for a check or preview (S2's health check; S6 and S8 previews use
+the same): the database and `-wal` bytes are unchanged, the `-shm` size is unchanged,
+the connection's `total_changes` is 0 at close and the data reads back unchanged. The
+`-shm` bytes are not compared: every WAL reader rewrites its read marks there, so no
+reader can keep it byte-identical (`test_health_check_never_writes`).
+
+Recorded deviations (plan D60–D64 renumbered D92–D96; D121, D122 and D123 assigned):
+
+- **D92** (shell): no "Sample configuration" chip. The Save status is truthful: "No
+  unsaved changes.", "Unsaved changes.", "Saved in this browser." / "Saved to the server
+  configuration." / "Applied until the server restarts.", "Some changes were not saved.
+  Review the highlighted settings.", "Saved for this tab only; browser storage is
+  unavailable." and "Settings changed elsewhere. Reload this section to see them."
+  "Save preferences" is `aria-disabled` (opacity .55, `not-allowed`) while clean or
+  saving; a setting the last save could not save gets a red outline. CSS under D92.
+- **D93** (Overview): real values. The metrics are the Library's eligible positives
+  and active saved negatives and the indexed `generated_images` rows (Q2). "Database
+  integrity" is "Not checked" until a check ran this session, then "N issues" (checks
+  that found issues, even beside a check that could not run), "Passed" or "Incomplete".
+  "Ambiguous image links" reads "Not available yet." with its Review metadata action
+  `aria-disabled` (CSS under D93) until the Needs review queue reports a count (Q6).
+  "Backup status" reads "No retained backup record." until verified backups exist (S8).
+  The thumbnail row is "Checking thumbnails…" until its own read answers, then "No
+  missing thumbnails", "N missing thumbnails" (the pending count of
+  `/images/thumbnails/status`) or "Thumbnail status unavailable"; Review thumbnails
+  opens Sources until the thumbnail dialog (S5). "One display configuration" says "Grid
+  and density settings are shared across views." (no paging). The sources row is
+  "N output sources" with "Monitoring and enrichment share one source list.", prefixed
+  by "M of N configured sources available." or "None configured is available; ComfyUI's
+  output folder is used." when that is the case.
+- **D94** (all sections): a section not delivered yet shows the hand-off panel "Your
+  current tools are ready" with a link to each legacy tool that still owns it (the
+  plan's legacy coverage table); retired section by section, gone after S12.
+- **D95** (health report): the concept's `health-check` dialog titled "Health report",
+  with no sample note. It lists every check in the server's order: Integrity check,
+  Foreign keys & pair references, Canonical hashes, Pair uniqueness (added), Missing
+  files, Ambiguous metadata, Consistency (added). Missing files has one row per image
+  source when there are several ("Missing files · output"). Each chip is the real
+  result: "Passed", a count with what was found ("2 broken references", "1 link needs
+  review", the concept's "N links need review" and "N images need review"; "100+
+  problems found" when SQLite's integrity check stopped at its limit), "Not
+  available" (an unavailable source), "Not available yet" (Ambiguous metadata, Q6) or
+  "Could not check". A `p.small` after the list says when it was checked and whether
+  every check passed, some could not run, or issues need review. Close / Review missing
+  links (to Maintenance, its hand-off until S7). Nothing is changed by a check.
+- **D96** (Statistics): "Usage statistics" without the sample note: the concept's
+  "Runs by category" table (Category / Runs / Avg. rating) with the real runs and
+  average rating of eligible parents per category ("Uncategorized", "Not rated"),
+  then a second table "Library totals" (Total / Count: Prompts, Tags, Images from the
+  legacy statistics, and Rated images: indexed images whose linked prompt is rated).
+  The Overview row says "Runs and ratings by category, with library totals." because
+  that is what the dialog shows (the concept's own dialog shows only "Runs by
+  category"); per-prompt run counts, prompt tags and dated runs are recorded, but no
+  table of them exists yet. A failed read toasts "Statistics could not
+  be loaded. Your saved data has not changed."
+- **D121** (production hub): the Overview hub's System card reads the concept's System
+  heading and "Open System"; the concept has no hub card.
+- **D122** (shell): the section nav's `aria-label` is "System sections"; the concept's
+  literal label is its prototype action name "system-tab sections".
+- **D123** (Maintenance): the concept's Maintenance notice
+  ("Check first. Review changes. Then apply." + Run health checks) is delivered ahead of
+  the rest of Maintenance, above its D94 hand-off, as the native place that runs the
+  health check. A press shows "Checking…" (`aria-disabled`) and opens the report; a
+  failed check toasts "The health check could not finish. Nothing was changed."
+
+`tests/browser/system-concept.spec.mjs` compares the shell and Overview with the concept
+(dark and light, 1600×1100 and 390×844), mapping only the deviations above; unmapped,
+the difference is exactly the D92, D93, D96 and D122 paths. Each surface's `top` is
+measured, which pins the concept's `.surface + .surface` 18px offset that concept.css
+also applies inside `.two-col` (copied as is). `statistics and health dialogs match
+the concept` maps D95 from the concept's own five rows (labels verbatim): it inserts
+Pair uniqueness after Canonical hashes and Consistency last, splits Missing files per
+source when there are several, replaces only the chips with the fixture's expected
+results, and asserts the full unmapped path list; it maps D96 and compares the
+Maintenance notice unchanged. `system comparison detects mutations` removes a row,
+renames a metric label, swaps the `--line` token, recolours a chip, renames a check,
+removes the totals table and renames a caption. Paired captures (`{concept,production}-system-{dark,light}-{1600,390}.png`,
+`{concept,production}-{statistics,health}-{dark,light}.png`) are test artifacts; there
+are no PNG baselines. `tests/browser/workspace-system.spec.mjs` covers the real counts,
+the health check and metric 4, a failed check, the thumbnail row against the status
+endpoint (painted after the rest when its read is held, unavailable when it fails), the review row (Q6), the section links, the Statistics dialog against the
+route, a load failure with Retry and late answers after leaving. Its hooks are
+`tests/browser/workspace_system_fixture.py` (`/__test__/system/*`: reset, injected
+failures, an absent source, a deleted linked file, unthumbnailed files) on the
+concept-shaped fixture, with delays through the shared request holds.
+
+```sh
+python3 -m unittest tests.test_database_health tests.test_system_api tests.test_library -v
+node --test tests/js/workspace-system-state.test.js tests/js/workspace-system-controls.test.js \
+  tests/js/workspace-system-overview.test.js tests/js/workspace-state.test.js
+npm run --prefix tools/vendor test:workflows -- system-concept.spec.mjs workspace-system.spec.mjs \
+  --project chromium --project touch --project firefox --project webkit
+```
+
 ## Workspace data fields for the concept pages (#249)

 These fields are additive. The legacy `/prompt_manager/images/output` listing (no
@@ -2272,12 +2502,41 @@ skip without ffmpeg). The remaining known divergences, checked against ffprobe 9
  `unreadable`); ffprobe reads such files.
 - An EBML DocType other than `matroska`/`webm` is an invalid container locally; ffmpeg
  only warns and reads it.
- Envelope JSON deeper than 1,000 levels is refused locally as Python's default
-  recursion limit refuses it; the server's real limit depends on the interpreter and
-  call stack. A duplicate key in an object enclosing a nest deeper than the running
+- Deep JSON (local roles, PR L3, and video envelopes): both browser CPython-JSON
+  parsers (`py-json.mjs`, `local-video.mjs`) share one cap, `JSON_MAX_DEPTH` = 1,000
+  nested arrays or objects (each counts, an empty one too); past it a record is invalid
+  JSON locally. The server's `json.loads` raises RecursionError at a limit that depends
+  on the Python, measured on Linux x86-64: 993 levels from a bare script on 3.10 and
+  3.11 (the 1,000 recursion limit minus the caller's frames, so about 990 inside the
+  server), 9,997 on 3.12 and 9,998 on 3.13 (the C recursion counter; lower on Windows
+  builds), and about 52,150 on 3.14 (stack-based, varies with the thread's stack).
+  The record kinds answer: a deep `prompt` graph (or `comfyassets_prompt_pairs`
+  envelope) is malformed; a deep `workflow` is ignored, so the overwritten PromptManager
+  check (R1) does not run and a prompt can resolve; a deep video `comment` or
+  `description` envelope makes the file unreadable on both sides (the server's
+  RecursionError reaches `read_inspection_file`). That gives two directions:
+  - 3.10/3.11, between the server's limit and 1,000: the server refuses and the local
+    page reads, so a deep prompt resolves locally while the server says malformed, and
+    a deep workflow can make R1 refuse locally where the server resolves.
+  - 3.12 and newer, from 1,001 up to the server's limit: the local page refuses and
+    the server reads, so a deep prompt is malformed locally while the server resolves,
+    and a deep workflow is ignored locally while the server can refuse it under R1.
+  Past both limits they agree. `test_local_json_depth_cap_at_its_boundary` checks the
+  local answer at 999, 1,000 and 1,001 for both kinds and that any server difference
+  is only one of the two directions above.
+- Local roles (PR L3): `\d` in the A1111 settings footer is any Unicode decimal
+  digit on both sides, but the browser's Unicode version can be newer than the server
+  Python's, so a footer whose step count uses a digit added after Unicode 15 can differ.
+  `str.lower()` and `toLowerCase()` differ only for characters no node class name uses.
+- A duplicate key in an object enclosing a nest deeper than the running
  Python's json limit is `malformed` locally and `limited` on that Python.
 - Decimal exponent limits assume CPython's C `_decimal`; on a `_pydecimal` interpreter
  the server would read the over-limit exponents the local projection refuses.
+- Follow-up (two CPython-JSON emulations, review M6): `local-video.mjs`
+  (`pythonJsonLoads`/`pythonFloatRepr`, numbers kept as lexemes) and `py-json.mjs`
+  (`pyJsonLoads`/`pyFloatRepr`, Python value kinds) both emulate `json.loads`; only the
+  depth cap is shared so far. A fix to one parser can miss the other, so the video
+  reader should move onto `py-json.mjs` in a later PR.

 Preserve raw logs, failed traces, paired PNGs, geometry, runtime versions and
 source hashes before later managed commands clear their output directories.
@@ -0,0 +1,354 @@
+"""The read-only health check behind System › Overview and Maintenance.
+
+``run_health_checks`` opens its own ``mode=ro`` connection, reads one
+snapshot and closes the connection in ``finally``; it never writes. Each
+check reports ``passed``, ``issues`` (with an exact ``count``; the
+integrity check stops at ``INTEGRITY_LIMIT`` problems and then says
+``capped``),
+``unavailable`` (it could not be checked here, so ``count`` is None, or
+``missing_files`` checked only some sources and found nothing) or ``failed``
+(it raised; the other checks still run). ``missing_files`` also reports each
+source and whether the check was ``partial``; it reads the image rows inside
+the snapshot and checks their files after the snapshot ended, so a slow source
+never holds the WAL. At most ``MAX_DETAIL`` detail strings are returned per
+check, and none of them carries a server path.
+"""
+
+import datetime
+import logging
+import ntpath
+import os
+import sqlite3
+from pathlib import PurePosixPath, PureWindowsPath
+from urllib.parse import quote
+
+try:
+    from ..utils.hashing import generate_prompt_hash
+    from .models import normalize_image_path
+except ImportError:
+    from utils.hashing import generate_prompt_hash
+    from database.models import normalize_image_path
+
+logger = logging.getLogger("prompt_manager.database.health")
+
+MAX_DETAIL = 10  # detail strings returned per check
+INTEGRITY_LIMIT = 100  # PRAGMA integrity_check(N): problems SQLite reports
+BATCH_ROWS = 100  # image rows read per fetch
+REVIEW_UNAVAILABLE = "Needs review is not available yet."
+CHECK_FAILED = "The check could not finish."
+# Check ids and the labels of the concept's health report, in its order;
+# pair uniqueness and consistency are the added rows (D63, now D95).
+CHECKS = (
+    ("integrity", "Integrity check"),
+    ("foreign_keys", "Foreign keys & pair references"),
+    ("canonical_hashes", "Canonical hashes"),
+    ("pair_uniqueness", "Pair uniqueness"),
+    ("missing_files", "Missing files"),
+    ("ambiguous_metadata", "Ambiguous metadata"),
+    ("consistency", "Consistency"),
+)
+_DATABASE_CHECKS = (
+    "integrity",
+    "foreign_keys",
+    "canonical_hashes",
+    "pair_uniqueness",
+    "missing_files",
+    "consistency",
+)
+
+
+def iter_consistency_issues(conn):
+    """The legacy consistency issues: tag and image rows of a missing prompt."""
+    for ref in conn.execute(
+        "SELECT pt.prompt_id FROM prompt_tags pt "
+        "LEFT JOIN prompts p ON pt.prompt_id = p.id WHERE p.id IS NULL"
+    ):
+        yield f"prompt_tags entry references non-existent prompt {ref[0]}"
+    for ref in conn.execute(
+        "SELECT gi.id, gi.prompt_id FROM generated_images gi "
+        "LEFT JOIN prompts p ON gi.prompt_id = p.id WHERE p.id IS NULL"
+    ):
+        yield f"Image {ref[0]} references non-existent prompt {ref[1]}"
+
+
+def _result(count, detail, *, status=None):
+    return {
+        "status": status or ("issues" if count else "passed"),
+        "count": count,
+        "detail": detail[:MAX_DETAIL],
+    }
+
+
+def _counted(lines):
+    """(count, first MAX_DETAIL lines) of an iterable, consumed once."""
+    count, detail = 0, []
+    for line in lines:
+        count += 1
+        if len(detail) < MAX_DETAIL:
+            detail.append(line)
+    return _result(count, detail)
+
+
+def readonly_uri(db_path, *, windows=None):
+    """The ``mode=ro`` SQLite URI of *db_path*, on this platform or the given one.
+
+    pathlib spells a UNC path ``\\\\server\\share\\x.db`` as
+    ``file://server/share/x.db``, a remote authority SQLite refuses to open.
+    With an empty authority (``file:////server/share/x.db``) SQLite hands
+    Windows the ``//server/share`` path, which it opens as the UNC path.
+    """
+    if windows is None:
+        windows = os.name == "nt"
+        db_path = os.path.abspath(db_path)
+    if not windows:
+        return PurePosixPath(db_path).as_uri() + "?mode=ro"
+    path = PureWindowsPath(db_path)
+    if ntpath.splitdrive(str(path))[0].startswith("\\\\"):
+        return "file:" + quote("//" + path.as_posix()) + "?mode=ro"
+    return path.as_uri() + "?mode=ro"
+
+
+def _integrity(conn, _roots):
+    rows = [
+        row[0] for row in conn.execute(f"PRAGMA integrity_check({INTEGRITY_LIMIT})")
+    ]
+    if rows == ["ok"]:
+        return {**_result(0, []), "capped": False}
+    # SQLite stops listing at the limit: there may be more problems than that.
+    return {**_result(len(rows), rows), "capped": len(rows) >= INTEGRITY_LIMIT}
+
+
+def _foreign_keys(conn, _roots):
+    return _counted(
+        f"{table} row {rowid} references a missing {parent} row"
+        for table, rowid, parent, _fkid in conn.execute("PRAGMA foreign_key_check")
+    )
+
+
+def _prompt_hash(text):
+    return generate_prompt_hash(text) if isinstance(text, str) else None
+
+
+def _canonical_hashes(conn, _roots):
+    conn.create_function("pm_prompt_hash", 1, _prompt_hash, deterministic=True)
+    return _counted(
+        f"Prompt {row[0]}: the stored hash does not match its text"
+        for row in conn.execute(
+            "SELECT id FROM prompts WHERE hash IS NOT pm_prompt_hash(text) ORDER BY id"
+        )
+    )
+
+
+def _pair_uniqueness(conn, _roots):
+    groups = conn.execute(
+        "SELECT positive_prompt_id,negative_prompt_id,COUNT(*) FROM prompt_pairs "
+        "GROUP BY positive_prompt_id,negative_prompt_id HAVING COUNT(*)>1 "
+        "ORDER BY positive_prompt_id,negative_prompt_id"
+    ).fetchall()
+    detail = [
+        f"Positive prompt {positive} with "
+        + ("no negative" if negative is None else f"negative {negative}")
+        + f": {rows} pair rows"
+        for positive, negative, rows in groups
+    ]
+    # The surplus rows: what keeping one row per pair would leave out.
+    return _result(sum(rows - 1 for _p, _n, rows in groups), detail)
+
+
+def _consistency(conn, _roots):
+    return _counted(iter_consistency_issues(conn))
+
+
+def _readable(root):
+    return os.path.isdir(root) and os.access(root, os.R_OK | os.X_OK)
+
+
+def _root_prefix(root):
+    return normalize_image_path(root).rstrip("\\/") + os.sep
+
+
+def _source_name(root, index):
+    """A source's folder name for the report (never its server path)."""
+    return os.path.basename(str(root).rstrip("\\/")) or f"Source {index + 1}"
+
+
+def _owner(path, prefixes):
+    """Index of the longest source prefix *path* lies under, or None."""
+    owner, longest = None, -1
+    for index, prefix in enumerate(prefixes):
+        if path.startswith(prefix) and len(prefix) > longest:
+            owner, longest = index, len(prefix)
+    return owner
+
+
+def _image_owner(image_path, file_path, prefixes):
+    spelled = file_path or normalize_image_path(image_path)
+    owner = _owner(spelled, prefixes)
+    if owner is None:
+        owner = _owner(normalize_image_path(os.path.realpath(image_path)), prefixes)
+    return owner
+
+
+def _unavailable_line(unavailable, *, partial):
+    noun = "source is" if unavailable == 1 else "sources are"
+    effect = "its files were" if unavailable == 1 else "their files were"
+    if not partial:
+        effect = "missing files were"
+    return f"{unavailable} image {noun} unavailable, so {effect} not counted."
+
+
+def _missing_files(conn, roots):
+    """Links whose file is gone, counted per source (only readable ones).
+
+    Each source reports ``checked`` with its own count, or ``unavailable``
+    (an unmounted drive) with no count: its links are never turned into a
+    count, while the readable sources still are. The check's ``count`` is the
+    readable sources' total (None when none is readable) and ``partial`` says
+    some sources were not checked. Links outside every source are named in the
+    detail, not counted.
+
+    Inside the snapshot this only reads the image rows; it returns the step
+    that checks their files, which runs after the snapshot ended.
+    """
+    if not roots:
+        result = _result(None, ["No image source is available."], status="unavailable")
+        return {**result, "partial": False, "sources": []}
+    rows = []
+    cursor = conn.execute(
+        "SELECT id,image_path,filename,file_path FROM generated_images ORDER BY id"
+    )
+    while batch := cursor.fetchmany(BATCH_ROWS):
+        rows.extend(batch)
+    return lambda: _check_files(rows, roots)
+
+
+def _check_files(rows, roots):
+    """The ``missing_files`` result of the image *rows*, from the file system."""
+    readable = [_readable(root) for root in roots]
+    sources = [
+        {
+            "name": _source_name(root, index),
+            "status": "checked" if ok else "unavailable",
+            "count": 0 if ok else None,
+        }
+        for index, (root, ok) in enumerate(zip(roots, readable))
+    ]
+    unavailable = readable.count(False)
+    if not any(readable):
+        result = _result(
+            None, [_unavailable_line(unavailable, partial=False)], status="unavailable"
+        )
+        return {**result, "partial": False, "sources": sources}
+    prefixes = [_root_prefix(root) for root in roots]
+    outside, missing = 0, []
+    for image_id, image_path, filename, file_path in rows:
+        owner = _image_owner(image_path, file_path, prefixes)
+        if owner is None:
+            outside += 1
+        elif readable[owner] and not os.path.exists(image_path):
+            sources[owner]["count"] += 1
+            if len(missing) < MAX_DETAIL:
+                name = filename or os.path.basename(image_path)
+                missing.append(f"Image {image_id}: {name} is missing")
+    count = sum(source["count"] or 0 for source in sources)
+    detail = [_unavailable_line(unavailable, partial=True)] if unavailable else []
+    detail += missing
+    if outside:
+        links = "link" if outside == 1 else "links"
+        verb = "was" if outside == 1 else "were"
+        detail.append(
+            f"{outside} {links} outside the image sources {verb} not checked."
+        )
+    status = None if count or not unavailable else "unavailable"
+    result = _result(count, detail, status=status)
+    return {**result, "partial": bool(unavailable), "sources": sources}
+
+
+def _ambiguous(review_count):
+    if review_count is None:
+        return _result(None, [REVIEW_UNAVAILABLE], status="unavailable")
+    return _result(review_count, [])
+
+
+def overall_status(checks) -> str:
+    """``passed`` only when every check passed; any check not run is incomplete."""
+    statuses = {check["status"] for check in checks}
+    if statuses & {"unavailable", "failed"} or any(
+        check.get("partial") for check in checks
+    ):
+        return "incomplete"
+    return "issues" if "issues" in statuses else "passed"
+
+
+def _failed():
+    return _result(None, [CHECK_FAILED], status="failed")
+
+
+def _run_check(check_id, step, *args):
+    """One check's result, or None (reported as failed) when it raised."""
+    try:
+        return step(*args)
+    except Exception:  # any error fails this check only; the others still run
+        logger.exception(f"Health check {check_id} failed")
+        return None
+
+
+def _run_database_checks(db_path, roots):
+    """Each database check's result (None when it raised), from one snapshot.
+
+    A check may return a step instead of its result: the step runs after the
+    snapshot ended and the connection closed (``missing_files``' file checks).
+    """
+    results = dict.fromkeys(_DATABASE_CHECKS)
+    try:
+        conn = sqlite3.connect(readonly_uri(db_path), uri=True)
+    except sqlite3.Error:
+        logger.exception("Health check could not open the database")
+        return results
+    try:
+        conn.execute("BEGIN")  # one read snapshot for every check
+        for check_id in _DATABASE_CHECKS:
+            runner = globals()["_" + check_id]  # looked up per run (tests patch it)
+            results[check_id] = _run_check(check_id, runner, conn, roots)
+    except sqlite3.Error:
+        logger.exception("Health check could not read the database")
+    finally:
+        conn.close()
+    for check_id, result in results.items():
+        if callable(result):
+            results[check_id] = _run_check(check_id, result)
+    return results
+
+
+class HealthOperations:
+    """Mixin for PromptDatabase: the read-only System health check."""
+
+    def run_health_checks(self, roots, *, review_count=None) -> dict:
+        """Run every check and return a ``HealthReport``.
+
+        Args:
+            roots: The image source directories to judge missing files under:
+                the effective sources plus any configured source that is not
+                available (reported as an unavailable source of ``missing_files``).
+            review_count: The Needs-review pending count, or None while no
+                review queue exists (``ambiguous_metadata`` is then unavailable).
+        """
+        if review_count is not None and (
+            type(review_count) is not int or review_count < 0
+        ):
+            raise ValueError("review_count must be a non-negative integer or None")
+        roots = [str(root) for root in roots]
+        database = _run_database_checks(self.model.db_path, roots)
+        checks = []
+        for check_id, label in CHECKS:
+            if check_id == "ambiguous_metadata":
+                result = _ambiguous(review_count)
+            else:
+                result = database[check_id] or _failed()
+            checks.append({"id": check_id, "label": label, **result})
+        return {
+            "success": True,
+            "checked_at": datetime.datetime.now(datetime.timezone.utc).isoformat(),
+            "status": overall_status(checks),
+            "checks": checks,
+        }
@@ -628,3 +628,54 @@ class LibraryOperations:
                "kind": "prompt-manager-library",
                "positives": [owners[key] for key in order],
            }
+
+    def library_counts(self) -> dict:
+        """System › Overview counts from one snapshot, writing nothing.
+
+        ``positive_prompts`` and ``negative_variants`` are the unfiltered
+        Library's ``total`` and ``variant_total``: eligible parents and active
+        pairs (every pair's positive is eligible). ``images`` counts indexed
+        ``generated_images`` rows, not files on disk. An image has no rating
+        of its own (it shows its linked prompt's), so ``rated_images`` counts
+        the indexed images whose linked prompt is rated.
+        """
+        with self.library_snapshot() as (conn, _epoch, _ceiling):
+            row = conn.execute(
+                "SELECT (SELECT COUNT(*) FROM prompts p WHERE " + _ELIGIBLE + "),"
+                "(SELECT COUNT(*) FROM prompt_pairs WHERE archived=0),"
+                "(SELECT COUNT(*) FROM generated_images),"
+                "(SELECT COUNT(*) FROM generated_images gi JOIN prompts r "
+                "ON r.id=gi.prompt_id WHERE r.rating IS NOT NULL)"
+            ).fetchone()
+        return {
+            "positive_prompts": row[0],
+            "negative_variants": row[1],
+            "images": row[2],
+            "rated_images": row[3],
+        }
+
+    def usage_by_category(self) -> list[dict]:
+        """Runs and average rating of the Library's parents, per category.
+
+        Only eligible parents count, so a negative-only prompt's runs (which
+        repeat its pairs' runs) are never added twice. A blank category groups
+        with no category as ``None``. Unrated parents are left out of the
+        average, which is ``None`` when no parent is rated. Most runs first.
+        """
+        with self.library_snapshot() as (conn, _epoch, _ceiling):
+            rows = conn.execute(
+                "SELECT * FROM (SELECT NULLIF(TRIM(p.category),'') AS category,"
+                "COALESCE(SUM(p.run_count),0) AS runs,AVG(p.rating) AS rating "
+                "FROM prompts p WHERE " + _ELIGIBLE + " GROUP BY 1) "
+                "ORDER BY runs DESC,category IS NULL,category"
+            ).fetchall()
+        return [
+            {
+                "category": row["category"],
+                "runs": row["runs"],
+                "average_rating": (
+                    None if row["rating"] is None else round(row["rating"], 2)
+                ),
+            }
+            for row in rows
+        ]
@@ -20,6 +20,7 @@ from .execution_history import ExecutionHistoryOperations
 from .execution_contexts import ExecutionContextOperations, LIVE_HINT_CTES
 from .execution_outputs import ExecutionOutputOperations
 from .history_reads import HistoryReadOperations
+from .health import HealthOperations, iter_consistency_issues

 # Import logging system
 try:
@@ -342,6 +343,7 @@ class PromptDatabase(
    ImageFavoriteOperations,
    AnnotationOperations,
    SavedViewOperations,
+    HealthOperations,
 ):
    """Database operations class for managing prompts."""

@@ -2570,33 +2572,13 @@ class PromptDatabase(
            return cursor.rowcount

    def check_consistency(self) -> List[str]:
-        """Run consistency checks and return a list of issue descriptions."""
-        issues: List[str] = []
-        with self.model.get_connection() as conn:
-            # Check for orphaned prompt_tags entries
-            cursor = conn.execute("""
-                SELECT pt.prompt_id, pt.tag_id FROM prompt_tags pt
-                LEFT JOIN prompts p ON pt.prompt_id = p.id
-                WHERE p.id IS NULL
-            """)
-            for ref in cursor.fetchall():
-                issues.append(
-                    "prompt_tags entry references non-existent prompt "
-                    f"{ref['prompt_id']}"
-                )
+        """Run consistency checks and return a list of issue descriptions.

-            # Check for orphaned image entries
-            cursor = conn.execute("""
-                SELECT gi.id, gi.prompt_id FROM generated_images gi
-                LEFT JOIN prompts p ON gi.prompt_id = p.id
-                WHERE p.id IS NULL
-            """)
-            for ref in cursor.fetchall():
-                issues.append(
-                    f"Image {ref['id']} references non-existent prompt "
-                    f"{ref['prompt_id']}"
-                )
-        return issues
+        The same queries back the System health check's Consistency row
+        (database/health.py).
+        """
+        with self.model.get_connection() as conn:
+            return list(iter_consistency_issues(conn))

    def _image_row_to_dict(self, row: sqlite3.Row) -> Dict[str, Any]:
        """
@@ -8,6 +8,7 @@ Split into domain-specific mixins for maintainability:
 - AutotagRoutesMixin: auto-tagging model management and tagging
 - JobRoutesMixin: the session job registry behind Activity (py/api/jobs.py)
 - ImageTagJobsMixin: bulk Add tags / Auto-tag as image-tags jobs
+- SystemRoutesMixin: System health check, Overview and usage statistics
 """

 import asyncio
@@ -35,6 +36,7 @@ from .admin import AdminRoutesMixin
 from .settings_routes import SettingsRoutesMixin
 from .job_routes import JobRoutesMixin
 from .image_tag_jobs import ImageTagJobsMixin
+from .system import SystemRoutesMixin
 from .jobs import JobRegistry
 from .logging_routes import LoggingRoutesMixin
 from .autotag_routes import AutotagRoutesMixin
@@ -108,16 +110,20 @@ STATIC_MIME_TYPES = {
    ".html": "text/html",
 }
 _STATIC_SEPARATORS = re.compile(r"[\\/]+")
+# Served by exact request path beside the extension allow-list: the browser's
+# copy of the inspection node table (local Inspect resolves with it, #249).
+STATIC_EXACT_FILES = {("js", "inspection-semantics.json"): "application/json"}


-def _resolve_static_file(root, filepath):
+def _resolve_static_file(root, filepath, allowed=STATIC_MIME_TYPES):
    """Real path of ``filepath`` under ``root``, or None when it must not be served.

    The request path is untrusted. It is rejected when it is empty, carries a
    ``..`` segment, is absolute on any platform (a leading slash or backslash,
    a drive letter such as ``C:`` or a UNC ``\\\\server\\share`` prefix all
    re-anchor ``os.path.join`` on Windows), has an extension outside
-    STATIC_MIME_TYPES, or resolves (symlinks included) outside ``root``.
+    ``allowed`` (STATIC_MIME_TYPES), or resolves (symlinks included) outside
+    ``root``.
    """
    if not isinstance(filepath, str) or not filepath:
        return None
@@ -130,7 +136,7 @@ def _resolve_static_file(root, filepath):
    segments = _STATIC_SEPARATORS.split(filepath)
    if any(segment in ("", ".", "..") for segment in segments):
        return None
-    if os.path.splitext(filepath)[1].lower() not in STATIC_MIME_TYPES:
+    if os.path.splitext(filepath)[1].lower() not in allowed:
        return None
    try:
        root_real = Path(os.path.normcase(os.path.realpath(root)))
@@ -265,6 +271,7 @@ class PromptManagerAPI(
    SettingsRoutesMixin,
    JobRoutesMixin,
    ImageTagJobsMixin,
+    SystemRoutesMixin,
    LoggingRoutesMixin,
    AutotagRoutesMixin,
    LoraIntegrationMixin,
@@ -321,6 +328,11 @@ class PromptManagerAPI(
        self._scan_job = None
        # The current duplicate scan (a py/api/jobs.Job outside the registry).
        self._duplicate_job = None
+        # The last System health report this session and the database
+        # generation it describes, bumped when a restore replaces self.db
+        # (py/api/system.py).
+        self._health_report = None
+        self._db_generation = 0

        # Run cleanup on initialization to remove any existing duplicates
        try:
@@ -478,6 +490,7 @@ class PromptManagerAPI(
        self._register_admin_routes(routes)
        self._register_settings_routes(routes)
        self._register_job_routes(routes)
+        self._register_system_routes(routes)
        self._register_logging_routes(routes)
        self._register_autotag_routes(routes)
        self._register_lora_routes(routes)
@@ -499,15 +512,20 @@ class PromptManagerAPI(
    def _serve_static_file(self, subdir, filepath):
        """Serve ``web/<subdir>/<filepath>``; 403 outside it, 404 when missing."""
        root = os.path.join(_get_project_root(), "web", subdir)
-        file_path = _resolve_static_file(root, filepath)
+        exact = STATIC_EXACT_FILES.get((subdir, filepath))
+        # An exact file passes the same containment check, its extension only.
+        allowed = STATIC_MIME_TYPES if exact is None else {".json"}
+        file_path = _resolve_static_file(root, filepath, allowed)
        if file_path is None:
            return web.Response(text="Forbidden", status=403)
+        content_type = (
+            exact or STATIC_MIME_TYPES[os.path.splitext(file_path)[1].lower()]
+        )
        if not os.path.isfile(file_path):
            return web.Response(text="Not Found", status=404)
-        ext = os.path.splitext(file_path)[1].lower()
        with open(file_path, "rb") as f:
            content = f.read()
-        return web.Response(body=content, content_type=STATIC_MIME_TYPES[ext])
+        return web.Response(body=content, content_type=content_type)

    def _serve_html_page(self, filename, title, cache=True):
        """Serve ``web/<filename>``; 404 when missing, 500 when unreadable."""
@@ -719,6 +737,13 @@ class PromptManagerAPI(
        Returns:
            List[Path]: Validated directory paths, possibly empty.
        """
+        return self._output_dirs_with_origin()[0]
+
+    def _output_dirs_with_origin(self):
+        """``(dirs, auto_detected)``: the ``_get_all_output_dirs`` list, and
+        whether it comes from detection or ComfyUI's output rather than from
+        a valid configured root (False when there is no directory at all).
+        """
        from ..config import GalleryConfig

        configured = list(GalleryConfig.MONITORING_DIRECTORIES)
@@ -737,15 +762,16 @@ class PromptManagerAPI(
            output_dirs.append(Path(real))

        if output_dirs:
-            return output_dirs
+            return output_dirs, False

        if configured:
            # Every configured root was rejected: never let auto-detection
            # resurrect it, serve ComfyUI's own output directory instead.
-            return self._comfyui_output_dir_list()
-
-        fallback = self._find_comfyui_output_dir()
-        return [Path(fallback)] if fallback else []
+            fallback_dirs = self._comfyui_output_dir_list()
+        else:
+            fallback = self._find_comfyui_output_dir()
+            fallback_dirs = [Path(fallback)] if fallback else []
+        return fallback_dirs, bool(fallback_dirs)

    def _comfyui_output_dir_list(self):
        """ComfyUI's output directory as a one-element list, or [] if unknown."""
@@ -1271,6 +1271,7 @@ class AdminRoutesMixin:
                self.logger.info(f"Removed {len(removed)} old safety backups")
            previous = self.db
            self.db = PromptDatabase(model.db_path)
+            self._database_replaced()  # a health report described the old one
            # Its connections would otherwise linger (a file lock on Windows)
            previous.close_all()
            prompt_count = self.db.model.get_database_info().get("total_prompts", 0)
@@ -88,6 +88,9 @@ DUPLICATE_CLEANUP_JOB_KIND = "duplicate_cleanup"
 THUMBNAILS_JOB_KIND = "thumbnails"
 LORA_IMPORT_JOB_KIND = "lora_import"
 AUTOTAG_BATCH_JOB_KIND = "autotag"
+# The System health check (py/api/system.py): a read-only ``read`` job with
+# no file outcomes, so it may run beside a scan.
+HEALTH_JOB_KIND = "health"


 def resolve_admission(admission=None, record_changing=None) -> str:
@@ -0,0 +1,207 @@
+"""System routes: the read-only health check, the Overview and usage statistics.
+
+- ``POST /prompt_manager/system/health`` starts the health check
+  (``database/health.py``) off-loop as a ``read`` job of kind ``health``: one
+  at a time, beside a scan, not cancellable and with no file outcomes. The
+  API keeps the last report for this session; ``GET`` returns it or null.
+  A report describes the database it was taken from: replacing the database
+  (a restore) forgets it, and a check that started before the swap is not
+  kept.
+- ``GET /prompt_manager/system/overview`` is the System › Overview aggregate.
+  Every value is real or null: there is no backup status until backups report
+  one, no health result until a check ran, and no Needs-review count until
+  the review queue exists. The missing-thumbnail count is not part of it:
+  the page reads ``/images/thumbnails/status``, which walks every source.
+- ``GET /prompt_manager/system/statistics`` lists runs and ratings per
+  category, with the legacy ``/stats`` totals and the Overview's count of
+  rated images (images whose linked prompt is rated).
+
+New routes answer errors with ``{success:false, code, error}``.
+"""
+
+import asyncio
+import os
+from collections import namedtuple
+
+from aiohttp import web
+
+from .job_routes import busy_response
+from .jobs import HEALTH_JOB_KIND, JobBusy
+
+HEALTH_JOB_TITLE = "Health check"
+_HEALTH_STATUS_LINES = {
+    "passed": "Health check passed",
+    "issues": "Health check found issues",
+    "incomplete": "Health check incomplete",
+}
+
+
+# The last health report and the database generation it was taken from.
+_StoredReport = namedtuple("_StoredReport", "generation report")
+
+
+def _failure(message, status=500, code=None):
+    return web.json_response(
+        {"success": False, "code": code, "error": message}, status=status
+    )
+
+
+def health_summary(report):
+    """What the Overview shows of a report: when, the outcome, checks with issues."""
+    if report is None:
+        return None
+    return {
+        "checked_at": report["checked_at"],
+        "status": report["status"],
+        "issues": sum(1 for check in report["checks"] if check["status"] == "issues"),
+    }
+
+
+class SystemRoutesMixin:
+    """Mixin providing the /prompt_manager/system endpoints."""
+
+    def _register_system_routes(self, routes):
+        @routes.post("/prompt_manager/system/health")
+        async def start_health_check_route(request):
+            return await self.start_health_check(request)
+
+        @routes.get("/prompt_manager/system/health")
+        async def health_report_route(request):
+            return await self.get_health_report(request)
+
+        @routes.get("/prompt_manager/system/overview")
+        async def system_overview_route(request):
+            return await self.get_system_overview(request)
+
+        @routes.get("/prompt_manager/system/statistics")
+        async def system_statistics_route(request):
+            return await self.get_system_statistics(request)
+
+    # ── health ────────────────────────────────────────────────────────
+
+    def _health_roots(self):
+        """The sources missing files are judged under.
+
+        The effective sources, plus every configured source that is not an
+        existing directory (an unmounted drive): the check then reports
+        missing files as unavailable instead of counting that source's links.
+        """
+        from ..config import GalleryConfig
+
+        roots = [str(path) for path in self._get_all_output_dirs()]
+        for configured in GalleryConfig.MONITORING_DIRECTORIES:
+            try:
+                resolved = GalleryConfig.resolve_gallery_root(configured)
+            except (OSError, TypeError, ValueError):
+                continue
+            if not os.path.isdir(resolved):
+                roots.append(resolved)
+        return roots
+
+    def _database_replaced(self):
+        """Forget what described the previous database (call after swapping ``db``)."""
+        self._db_generation += 1
+        self._health_report = None
+
+    def _current_health_report(self):
+        """The last report, or None when none was kept for the current database."""
+        stored = self._health_report
+        generation = self._db_generation
+        if isinstance(stored, _StoredReport) and stored.generation == generation:
+            return stored.report
+        return None
+
+    async def start_health_check(self, request):
+        """Start the health check job (202), or 409 naming the running check."""
+        generation = self._db_generation
+        db = self.db
+        try:
+            roots = await self._run_in_executor(self._health_roots)
+        except Exception:
+            self.logger.exception("Health check could not resolve the image sources")
+            return _failure("Failed to start the health check")
+
+        async def run(job):
+            job.update(status_line="Checking the database and image links")
+            report = await self._run_in_executor(db.run_health_checks, roots)
+            if generation == self._db_generation:
+                self._health_report = _StoredReport(generation, report)
+            else:
+                self.logger.info("Health report dropped: the database was replaced")
+            job.update(progress=100, status_line=_HEALTH_STATUS_LINES[report["status"]])
+
+        try:
+            job = self._jobs.start(
+                HEALTH_JOB_KIND,
+                HEALTH_JOB_TITLE,
+                admission="read",
+                cancellable=False,
+                scope={},
+                runner=run,
+            )
+        except JobBusy as busy:
+            return busy_response(busy)
+        return web.json_response({"success": True, "job": job.summary()}, status=202)
+
+    async def get_health_report(self, request):
+        return web.json_response(
+            {"success": True, "report": self._current_health_report()}
+        )
+
+    # ── overview ──────────────────────────────────────────────────────
+
+    async def get_system_overview(self, request):
+        from ..config import GalleryConfig
+
+        try:
+            (output_dirs, auto_detected), counts = await asyncio.gather(
+                self._run_in_executor(self._output_dirs_with_origin),
+                self._run_in_executor(self.db.library_counts),
+            )
+        except Exception:
+            self.logger.exception("System overview failed")
+            return _failure("Failed to read the overview")
+        return web.json_response(
+            {
+                "success": True,
+                "library": {
+                    "positive_prompts": counts["positive_prompts"],
+                    "negative_variants": counts["negative_variants"],
+                },
+                "images": {
+                    "indexed": counts["images"],
+                    "rated": counts["rated_images"],
+                },
+                "health": health_summary(self._current_health_report()),
+                "backup": None,  # no verified backup status exists yet (S8)
+                "needs_review": {"pending": None},  # no review queue yet (Q6)
+                "sources": {
+                    "configured": len(GalleryConfig.MONITORING_DIRECTORIES),
+                    "effective": len(output_dirs),
+                    "auto_detected": auto_detected,
+                },
+            },
+            headers={"Cache-Control": "no-store"},
+        )
+
+    # ── statistics ────────────────────────────────────────────────────
+
+    async def get_system_statistics(self, request):
+        try:
+            by_category, totals, counts = await asyncio.gather(
+                self._run_in_executor(self.db.usage_by_category),
+                self._run_in_executor(self.db.get_statistics),
+                self._run_in_executor(self.db.library_counts),
+            )
+        except Exception:
+            self.logger.exception("System statistics failed")
+            return _failure("Failed to read statistics")
+        return web.json_response(
+            {
+                "success": True,
+                "by_category": by_category,
+                "totals": totals,
+                "rated_images": counts["rated_images"],
+            },
+            headers={"Cache-Control": "no-store"},
+        )
@@ -78,6 +78,17 @@ export async function seedConcept(request,data={}) {
    return response.json();
 }

+/**
+ * Seed the concept fixture and fix the browser's clock at the fixture's own instant (`manifest.now`), so the page and
+ * the fixture read one "now": a prompt used now reads "Used today" and the caption names the fixture's day even when
+ * the run crosses midnight between seeding and rendering. Timers keep running; only `Date` stands still.
+ */
+export async function seedConceptAt(page,request,data={}) {
+    const manifest=await seedConcept(request,data);
+    await page.clock.setFixedTime(new Date(manifest.now*1000));
+    return manifest;
+}
+
 /**
 * Save `tags` as the current image tag set of the listed file at `path` (root 0) through the real observe and tag
 * routes (#249 PR C), releasing the capture afterwards; returns the receipt's saved names.
@@ -237,9 +237,12 @@ const viewerStructure=details=>details.evaluate(node=>{
 test('viewer details hold provenance, raw records and downloads',async({page,request})=>{
    await page.setViewportSize({width:1600,height:1100});const reads=await patchInspection(page);
    await fullFixture(page,request);let details=await viewerDetails(page,'complete.png');
-    // The panel content without the cover, then the two disclosures, then the pair send and history buttons (D20).
+    // The panel content without the cover, D117's Copy settings summary after the facts, then the two disclosures,
+    // then the pair send and history buttons (D20).
    expect(await viewerStructure(details)).toEqual({outer:['div','button.send','button'],
-        inner:['div.panel-heading','p.small','div.tags','section.prompt-section.positive','section.prompt-section.negative','div.tags','dl.meta-grid','details','details']});
+        inner:['div.panel-heading','p.small','div.tags','section.prompt-section.positive','section.prompt-section.negative','div.tags','dl.meta-grid','button.settings-summary','details','details']});
+    await expect(details.locator(':scope > div > button')).toHaveText('Copy settings summary');
+    await expect(details.locator(':scope > div > button.settings-summary')).toHaveCSS('white-space','normal');
    await expect(details.locator('.detail-cover,.detail-inner,.detail-footer')).toHaveCount(0);
    await expect(details.locator('.panel-heading h2')).toHaveText(POSITIVE_TITLE);await expect(details.locator('.panel-heading .chip')).toHaveText('PNG');
    await expect(details.locator(':scope > div > p.small')).toHaveText('complete.png');
@@ -1,7 +1,7 @@
 import {writeFile} from 'node:fs/promises';
 import {test,expect} from './fixtures.mjs';
 import {captureCanonicalState} from './history-canonical-comparison.mjs';
-import {SIZES,THEMES,MOTIONS,seedConcept,openConcept,openProduction,inventoryOf,diffInventory,mutate,stripExact,countCopy,reflow,withoutItems} from './concept-inventory.mjs';
+import {SIZES,THEMES,MOTIONS,seedConceptAt,openConcept,openProduction,inventoryOf,diffInventory,mutate,stripExact,countCopy,reflow,withoutItems} from './concept-inventory.mjs';

 // Task C7 of #249: the production Images page against the immutable concept, on the concept-shaped real fixture (24
 // images of the concept's six prompts, its seeds, sizes and favorites). Heading, toolbar, filter row, caption, grid,
@@ -85,7 +85,7 @@ function listInfo(card,actionsWidth) {
 /** Recorded Images deviations only (spec §8); everything else in the concept inventory must equal production. */
 const nocase=(a,b)=>{const x=a.toLowerCase(),y=b.toLowerCase();return x<y?-1:x>y?1:a<b?-1:a>b?1:0;};

-export function mapImagesConcept(reference,{manifest,now=new Date()}) {
+export function mapImagesConcept(reference,{manifest,now=new Date(manifest.now*1000)}) {
    const paths=new Map(manifest.images.map(image=>[image.filename,image.path]));
    // D14: the sort appends production's two sorts. Save view is the concept's own (saved views, #249 D16 retired).
    const toolbar={...reference.toolbar};
@@ -318,7 +318,7 @@ async function behaviorsOf(page,scope) {
    return {hover,opened,viewerTitle,focusAfterViewer,selected,layouts,search,single};
 }

-test.beforeEach(async({request},testInfo)=>{testInfo.manifest=await seedConcept(request);});
+test.beforeEach(async({page,request},testInfo)=>{testInfo.manifest=await seedConceptAt(page,request);});

 for(const [width,height] of SIZES)for(const theme of THEMES)test(`images page geometry, tokens, controls and behaviors match the concept ${width}x${height} ${theme}`,async({page,request},testInfo)=>{
    test.setTimeout(240_000);
@@ -348,7 +348,7 @@ for(const [width,height] of SIZES)for(const theme of THEMES)test(`images page ge
            importDiff:diffInventory(mapImportConcept(referenceImport),actualImport),referenceBehaviors,actualBehaviors};
    }
    // Load more in production: a fixture past one listing page appends one batch and shows the concept's toast.
-    testInfo.manifest=await seedConcept(request,{extra_images:LOAD_MORE_EXTRA});
+    testInfo.manifest=await seedConceptAt(page,request,{extra_images:LOAD_MORE_EXTRA});
    for(const motion of MOTIONS) {
        const total=FIXTURE_IMAGES+LOAD_MORE_EXTRA;
        await openProductionLoaded(page,theme,motion,total);
@@ -514,7 +514,7 @@ test('one appended image reads in the singular',async({page,request})=>{
    test.setTimeout(120_000);
    await page.setViewportSize({width:1600,height:1100});
    const total=PRODUCTION_BATCH+1;
-    await seedConcept(request,{extra_images:total-FIXTURE_IMAGES});
+    await seedConceptAt(page,request,{extra_images:total-FIXTURE_IMAGES});
    await openProductionLoaded(page,'dark','no-preference',total);
    await expect(page.locator('.infinite-continuation > p').first()).toHaveText(countCopy(`${PRODUCTION_BATCH} of ${total} images · more load as you scroll`));
    // A dispatched press: scrolling the button into view lets the page's own observer load the one image first.
@@ -530,7 +530,7 @@ test('one image appended by scrolling reads in the singular',async({page,request
    test.setTimeout(120_000);
    await page.setViewportSize({width:1600,height:1100});
    const total=PRODUCTION_BATCH+1;
-    await seedConcept(request,{extra_images:total-FIXTURE_IMAGES});
+    await seedConceptAt(page,request,{extra_images:total-FIXTURE_IMAGES});
    await openProductionLoaded(page,'dark','no-preference',total);
    await expect(page.locator('#result-count')).toHaveText(new RegExp(`^${PRODUCTION_BATCH} of ${total} images`));
    await page.locator('.infinite-continuation').scrollIntoViewIfNeeded();
@@ -551,7 +551,7 @@ test('one footer height for the collection (D3)',async({page,request})=>{
    const reference=await inventoryOf(page,'#main');
    expect(reference.grid.columns).toBe(2);
    expect(reference.cards.every(card=>card.info.p.height>parseFloat(card.info.p.lineHeight))).toBe(true);
-    const manifest=await seedConcept(request,{seedless_images:2,short_seedless:true});
+    const manifest=await seedConceptAt(page,request,{seedless_images:2,short_seedless:true});
    await openProductionLoaded(page,'dark','no-preference',FIXTURE_IMAGES+2);
    const actual=await inventoryOf(page,'#workspace-main');
    const box=card=>({left:card.left,top:card.top,width:card.width,height:card.height});
@@ -117,7 +117,7 @@ function measureViewer() {
        ['dl.meta-grid', node => node.closest('details') ? null : 'facts'],
        ['details > summary', node => text(node)],
        ['button.send', node => node.closest('.prompt-section') ? `send ${node.closest('.prompt-section').matches('.positive') ? 'positive' : 'negative'}` : 'send pair'],
-        ['button', node => /Prompt history/.test(node.textContent) ? 'Prompt history' : null],
+        ['button', node => /Prompt history/.test(node.textContent) ? 'Prompt history' : text(node) === 'Copy settings summary' ? 'settings summary' : null],
    ];
    const sections = [...rail.querySelectorAll('*')].map(node => {
        for (const [selector, label] of SECTIONS) if (node.matches(selector)) return label(node);
@@ -158,13 +158,18 @@ async function withProductionCopy(page) {
    }, { COPY, ACCEPT });
 }

-/** D66: the viewer of a local file is titled by its filename and has no tag chips and no Prompt history. */
+/**
+ * D66: the viewer of a local file is titled by its filename and has no tag chips and no Prompt history. D117 (LI-4):
+ * "Copy settings summary" follows the six facts.
+ */
 function mapViewerConcept(reference) {
+    const sections = reference.sections.filter(section => section !== 'tag chips' && section !== 'Prompt history');
+    const facts = sections.indexOf('facts');
    return {
        ...reference,
        title: FILE,
        railTitle: FILE,
-        sections: reference.sections.filter(section => section !== 'tag chips' && section !== 'Prompt history'),
+        sections: [...sections.slice(0, facts + 1), 'settings summary', ...sections.slice(facts + 1)],
    };
 }

@@ -269,9 +274,9 @@ for (const [width, height] of SIZES) for (const theme of THEMES) {
        // The chooser names the chosen file after a real setInputFiles, as the concept's does.
        expect(production.initial.chosen).toEqual({ name: '', files: [] });
        expect(production.selected.chosen).toEqual({ name: FILE, files: [FILE] });
-        // D66 in the rail: no tag chips and no Prompt history; the title is the filename.
+        // D66 in the rail: no tag chips and no Prompt history; the title is the filename. D117 follows the facts.
        expect(production.viewer.sections).toEqual(['heading', 'filename', 'badges', 'positive', 'send positive', 'negative',
-            'send negative', 'facts', 'File & provenance', 'Workflow & raw metadata', 'send pair']);
+            'send negative', 'facts', 'settings summary', 'File & provenance', 'Workflow & raw metadata', 'send pair']);
    });
 }

@@ -45,10 +45,10 @@ function withCategoryScope(inventory) {
 }

 /**
- * Recorded inspector deviations only (spec §8, TESTING.md D3, D20–D22, D34 and D38); everything else must equal
- * production. `reference.viewerPlain` is the concept's own full details
- * with its tag chips made plain (D20) and, under a coarse pointer, D34's targets, both at runtime: the browser lays out
- * what follows them, as the Images spec's removed toolbar items do.
+ * Recorded inspector deviations only (spec §8, TESTING.md D3, D20–D22, D34, D38 and D117); everything else must
+ * equal production. `reference.viewerPlain` is the concept's own full details
+ * with its tag chips made plain (D20), D117's summary button added and, under a coarse pointer, D34's targets, all at
+ * runtime: the browser lays out what follows them, as the Images spec's removed toolbar items do.
 */
 export function mapInspectorConcept(reference,{viewport}) {
    const {panel,viewerPlain,fileControls}=reference;
@@ -105,7 +105,11 @@ async function openProductionPanel(page,theme) {
    await settle(page);
 }

-/** The concept's tag chips in the open viewer as plain `span.chip`s (D20) and D34's coarse targets; returns an undo. */
+/**
+ * The concept's tag chips in the open viewer as plain `span.chip`s (D20), D34's coarse targets and D117's "Copy
+ * settings summary" after the six facts (LI-4), drawn as the concept's own plain button (its "Download sample JSON",
+ * without its action); returns an undo.
+ */
 async function plainViewerChips(page) {
    const restoreTargets=await mutate(page,{css:D34_COARSE_TARGETS});
    await page.evaluate(()=>{
@@ -113,10 +117,15 @@ async function plainViewerChips(page) {
            const span=document.createElement('span');span.className='chip';span.textContent=button.textContent;
            button.replaceWith(span);return [span,button];
        });
+        const summary=document.querySelector('#viewer-details [data-action="download-workflow"]').cloneNode(false);
+        for(const key of Object.keys(summary.dataset))delete summary.dataset[key];
+        summary.textContent='Copy settings summary';summary.classList.add('settings-summary');
+        document.querySelector('#viewer-details > div > dl.meta-grid').after(summary);window.__summaryButton=summary;
    });
    await settle(page);
    return async()=>{
-        await page.evaluate(()=>{for(const [span,button] of window.__plainChips)span.replaceWith(button);delete window.__plainChips;});
+        await page.evaluate(()=>{for(const [span,button] of window.__plainChips)span.replaceWith(button);delete window.__plainChips;
+            window.__summaryButton.remove();delete window.__summaryButton;});
        await restoreTargets();
    };
 }
@@ -342,7 +351,7 @@ for(const [width,height] of SIZES)test(`image tags saved on the concept image ke

 // The comparison is only worth something if it notices a change (spec §7 mutation check): on the panel one CSS
 // mutation (the role label's letter spacing) and one DOM mutation (the footer removed); in the viewer (final review m5)
-// its pair actions removed and D38's Show in folder removed; each applied after an exact match.
+// its pair actions removed, D38's Show in folder removed and D117's summary removed; each applied after an exact match.
 test('inspector comparison detects mutations',async({page})=>{
    test.setTimeout(120_000);
    const viewport={width:1600,height:1100};
@@ -366,6 +375,9 @@ test('inspector comparison detects mutations',async({page})=>{
    expect(()=>assertInspectorMatch(reference,withoutActions,viewport)).toThrow(/viewerDetails\.actions/);
    const withoutReveal=await viewerMutated({remove:['#viewer-details button[aria-label$=" in folder"]']});
    expect(()=>assertInspectorMatch(reference,withoutReveal,viewport)).toThrow(/fileControls/);
+    // D117: the summary action after the facts is part of the mapped concept, so losing it is a difference.
+    const withoutSummary=await viewerMutated({remove:['#viewer-details > div > button']});
+    expect(()=>assertInspectorMatch(reference,withoutSummary,viewport)).toThrow(/viewerDetails\.structure\.inner/);
    assertInspectorMatch(reference,await viewerMutated(),viewport);

    await mutate(page,{remove:['#image-inspector > .detail-footer']});
@@ -1,7 +1,7 @@
 import {writeFile} from 'node:fs/promises';
 import {test,expect} from './fixtures.mjs';
 import {captureCanonicalState} from './history-canonical-comparison.mjs';
-import {SIZES,THEMES,MOTIONS,seedConcept,openConcept,openProduction,inventoryOf,diffInventory,mutate,stripExact,countCopy,reflow} from './concept-inventory.mjs';
+import {SIZES,THEMES,MOTIONS,seedConceptAt,openConcept,openProduction,inventoryOf,diffInventory,mutate,stripExact,countCopy,reflow} from './concept-inventory.mjs';

 // Task E3 of #249: the production Prompt library shelf against the immutable concept (app.js renderLibrary a572–586,
 // style.css s648–708), on the concept-shaped real fixture (the concept's six prompts with their negatives, categories,
@@ -37,7 +37,8 @@ export function mapLibraryConcept(reference) {
        // D43: tag chips come in the store's alphabetical order; the row flows again from the concept's own chips.
        tags:sortedTags(card.tags),
        // D23: the stars are aria-hidden, with a visually hidden "Rated N out of 5" spoken in their place. The fixture's
-        // run_count (4) and last_used_at (now) give the concept's own "4 runs" and "Used today". The two-line clamp is
+        // run_count (4) and last_used_at (its own "now", where the page's clock stands) give the concept's own "4 runs"
+        // and "Used today". The two-line clamp is
        // applied below through `clampedCards`, measured on the concept with `CLAMP_CSS` (its samples wrap at 390px).
        footer:{...card.footer,facts:{...card.footer.facts,spoken:card.footer.facts.spoken.replace(/^(★+)/,stars=>`Rated ${stars.length} out of 5`)}}}));
    return {...reference,library:{...library,toolbar,
@@ -238,7 +239,8 @@ async function openHost(context) {
 }

 test.beforeEach(async({page,request},testInfo)=>{
-    testInfo.manifest=await seedConcept(request);
+    // The page's clock stands at the fixture's own "now", so its last use reads "Used today" on either side of midnight.
+    testInfo.manifest=await seedConceptAt(page,request);
    // Both documents copy through the clipboard; the stub records what they wrote.
    await page.addInitScript(()=>{window.copied=[];Object.defineProperty(navigator,'clipboard',{configurable:true,value:{writeText:async text=>{window.copied.push(text);}}});});
 });
@@ -322,6 +324,27 @@ for(const theme of THEMES)test(`library grid and cards match the concept 1800x11
    expect(compare(reference,actual,{sections:['library'],library:['grid','cards','trailing']})).toEqual([]);
 });

+// PR #284's CI run: the fixture recorded the last use at 23:59:5x UTC and the shelf rendered at 00:00:05, so production
+// read "Used yesterday" against the concept's "Used today". Here the browser's wall clock starts at 23:59:58 UTC, the
+// fixture records its use at that instant, and midnight passes before either document opens.
+const BEFORE_MIDNIGHT=Date.UTC(2026,9,22,23,59,58);
+const PAST_MIDNIGHT_MS=5_000;
+test('a run that crosses midnight still reads the concept fixture\'s day',async({page,request})=>{
+    await page.setViewportSize({width:1800,height:1100});
+    await page.clock.install({time:BEFORE_MIDNIGHT});
+    const manifest=await seedConceptAt(page,request,{now:BEFORE_MIDNIGHT/1000});
+    expect(manifest.now*1000,'the fixture\'s now').toBe(BEFORE_MIDNIGHT);
+    const used=(await (await request.get('/prompt_manager/library')).json()).items.map(item=>Date.parse(item.last_used_at));
+    expect(used,'every last use at the fixture\'s now').toEqual(Array(CONCEPT_PROMPTS).fill(BEFORE_MIDNIGHT));
+    await page.clock.fastForward(PAST_MIDNIGHT_MS);
+    await openConceptLibrary(page,'dark','no-preference');
+    const reference=await conceptInventory(page);
+    await openProductionLibrary(page,'dark','no-preference');
+    const actual=await inventoryOf(page,'#workspace-main');
+    expect(actual.library.cards.map(card=>card.footer.facts.text.replace(/^★+ · /,''))).toEqual(Array(CONCEPT_PROMPTS).fill('Used today'));
+    expect(compare(reference,actual,{sections:['library'],library:['grid','cards','trailing']})).toEqual([]);
+});
+
 // The comparison is only worth something if it notices a change (spec §7 mutation check): one CSS mutation (the footer
 // padding) and one DOM mutation (the negative-variants chip removed), each applied after an exact match.
 test('library comparison detects mutations',async({page})=>{
@@ -19,10 +19,13 @@ from PIL import Image
 from PIL.PngImagePlugin import PngInfo

 from tests.browser.request_hold import register_request_holds
+from tests.browser import slow_reset_watch
 from tests.browser.workspace_activity_fixture import register_activity_commands
+from tests.browser.workspace_system_fixture import register_system_commands
 from tests.browser.workspace_concept_fixture import (
    MAX_EXTRA_IMAGES as CONCEPT_MAX_EXTRA_IMAGES,
    MAX_SEEDLESS_IMAGES as CONCEPT_MAX_SEEDLESS_IMAGES,
+    MAX_EPOCH_SECONDS as CONCEPT_MAX_EPOCH_SECONDS,
    seed_workspace_concept,
 )
 from tests.browser.workspace_visual_fixture import seed_workspace_visual
@@ -196,7 +199,9 @@ def create_app(root: Path) -> web.Application:
    register_tagging_commands(routes, api, root, model)
    reveal_stub = register_reveal_stub(routes, api, root)
    register_activity_commands(app, routes, api)
+    register_system_commands(app, routes, api, root)
    request_holds = register_request_holds(app, routes)
+    slow_reset_watch.install(app, api)

    async def canonical_asset(request: web.Request) -> web.Response:
        filename, content_type = CANONICAL_ASSETS[request.path]
@@ -489,8 +494,17 @@ def create_app(root: Path) -> web.Application:
        if (
            request.query
            or not isinstance(data, dict)
-            or set(data) - set(limits) - {"short_seedless"}
+            or set(data) - set(limits) - {"short_seedless", "now"}
            or not isinstance(data.get("short_seedless", False), bool)
+            # A chosen "now" (epoch seconds) pins every time the fixture writes.
+            or (
+                "now" in data
+                and (
+                    isinstance(data["now"], bool)
+                    or not isinstance(data["now"], (int, float))
+                    or not 0 < data["now"] < CONCEPT_MAX_EPOCH_SECONDS
+                )
+            )
            or any(
                isinstance(data.get(key, 0), bool)
                or not isinstance(data.get(key, 0), int)
@@ -510,6 +524,7 @@ def create_app(root: Path) -> web.Application:
                extra_images=data.get("extra_images", 0),
                seedless_images=data.get("seedless_images", 0),
                short_seedless=data.get("short_seedless", False),
+                now=data.get("now"),
            )
        )
        return web.json_response({"success": True, **manifest})
@@ -178,27 +178,28 @@ async function captureFooter(page,testInfo,name) {

 test.beforeEach(async({request})=>{await seedConcept(request);});

-for(const [width,height] of SIZES)for(const theme of THEMES)test(`shell geometry, tokens and controls match the concept ${width}x${height} ${theme}`,async({page},testInfo)=>{
+// One test per route, size, theme and motion. All of them in one test per size and theme (12 page loads, 12 captures,
+// 36 hovers) steadily took 22 s median and up to 33 s on CI WebKit, past the 30 s budget with no step stalled; one
+// route in one motion is a sixth of that work under the same budget.
+for(const [route,breadcrumb] of ROUTES)for(const [width,height] of SIZES)for(const theme of THEMES)for(const motion of MOTIONS)test(`shell geometry, tokens and controls match the concept on ${route} ${width}x${height} ${theme} ${motion}`,async({page},testInfo)=>{
    await page.setViewportSize({width,height});const result={};
-    for(const motion of MOTIONS)for(const [route,breadcrumb] of ROUTES) {
-        await openConcept(page,route,theme,motion);await page.mouse.move(0,0);
-        const reference=await inventoryOf(page,'#main');
-        if(motion==='no-preference')await captureCanonicalState(page,testInfo,`concept-shell-${route}-${width}-${theme}`);
-        const referenceRings=FULL_HEADING.has(route)?await ringsOf(page,'#main'):null;
-        const referenceHovers=await hoversOf(page);
-        if(motion==='no-preference')await captureFooter(page,testInfo,`concept-footer-${route}-${width}-${theme}`);
-        await openProduction(page,route,theme,motion);await page.mouse.move(0,0);
-        const actual=await inventoryOf(page,'#workspace-main');
-        if(motion==='no-preference')await captureCanonicalState(page,testInfo,`production-shell-${route}-${width}-${theme}`);
-        const actualRings=FULL_HEADING.has(route)?await ringsOf(page,'#workspace-main'):null;
-        const actualHovers=await hoversOf(page);
-        if(motion==='no-preference')await captureFooter(page,testInfo,`production-footer-${route}-${width}-${theme}`);
-        result[`${motion} ${route}`]={route,breadcrumb,reference,actual,diff:compare(route,reference,actual),referenceRings,actualRings,
-            referenceHovers,actualHovers};
-    }
-    const path=testInfo.outputPath('shell-geometry.json');await writeFile(path,JSON.stringify(result,null,2));
-    await testInfo.attach('shell-geometry',{path,contentType:'application/json'});
-    for(const [key,{route,breadcrumb,reference,actual,diff,referenceRings,actualRings,referenceHovers,actualHovers}] of Object.entries(result)) {
+    await openConcept(page,route,theme,motion);await page.mouse.move(0,0);
+    const reference=await inventoryOf(page,'#main');
+    if(motion==='no-preference')await captureCanonicalState(page,testInfo,`concept-shell-${route}-${width}-${theme}`);
+    const referenceRings=FULL_HEADING.has(route)?await ringsOf(page,'#main'):null;
+    const referenceHovers=await hoversOf(page);
+    if(motion==='no-preference')await captureFooter(page,testInfo,`concept-footer-${route}-${width}-${theme}`);
+    await openProduction(page,route,theme,motion);await page.mouse.move(0,0);
+    const actual=await inventoryOf(page,'#workspace-main');
+    if(motion==='no-preference')await captureCanonicalState(page,testInfo,`production-shell-${route}-${width}-${theme}`);
+    const actualRings=FULL_HEADING.has(route)?await ringsOf(page,'#workspace-main'):null;
+    const actualHovers=await hoversOf(page);
+    if(motion==='no-preference')await captureFooter(page,testInfo,`production-footer-${route}-${width}-${theme}`);
+    result[`${motion} ${route}`]={reference,actual,diff:compare(route,reference,actual),referenceRings,actualRings,
+        referenceHovers,actualHovers};
+    const path=testInfo.outputPath(`shell-geometry-${route}-${motion}.json`);await writeFile(path,JSON.stringify(result,null,2));
+    await testInfo.attach(`shell-geometry-${route}-${motion}`,{path,contentType:'application/json'});
+    for(const [key,{reference,actual,diff,referenceRings,actualRings,referenceHovers,actualHovers}] of Object.entries(result)) {
        // The concept itself is what this comparison assumes: its sample counts and its shell controls.
        expect.soft(reference.chrome.navs[0].rows.map(row=>[row.text,row.count?.text??null]),`${key} concept WORKSPACE rows`)
            .toEqual([['Images','24'],['Prompt library','6'],['Tags & categories','15'],['Inspect a file',null]]);
@@ -0,0 +1,237 @@
+"""Report a slow test reset with what the server was doing while it waited.
+
+A reset normally answers within about a second. Once one runs past
+SLOW_RESET_SECONDS, this writes to stderr, while the reset is still waiting:
+
+- every thread's stack, so a reset waiting on a lock, a full executor or a
+  slow disk shows where it waits and who holds it;
+- the default executor's threads and queued work;
+- how many database connections are open, and the WAL size;
+- on Linux, each thread's scheduler state and the kernel function it sleeps
+  in (``D`` with a journal or writeback wait is a slow disk flush, a nanosleep
+  is SQLite's busy handler, a futex is a Python lock or an idle worker).
+
+When the reset ends it writes how long it took and, for each executor call it
+made, how long the call queued and how long it ran.
+
+Every report line starts with REPORT_PREFIX. The worker fixture
+(tools/vendor/start-browser-server.mjs) copies those lines to the job log,
+so a slow reset is visible even in a test that still passes.
+"""
+
+import asyncio
+import contextvars
+import faulthandler
+import os
+import sys
+import tempfile
+import threading
+import time
+from typing import Callable, TextIO
+
+from aiohttp import web
+
+SLOW_RESET_SECONDS = 2.0
+REPORT_PREFIX = "pm-slow-reset| "
+
+_current: contextvars.ContextVar["ResetWatch | None"] = contextvars.ContextVar(
+    "pm_reset_watch", default=None
+)
+
+
+def is_reset_path(path: str) -> bool:
+    return path.startswith("/__test__/") and path.endswith("/reset")
+
+
+class ResetWatch:
+    """Time one reset; dump the server's state if it passes the threshold."""
+
+    def __init__(
+        self,
+        label: str,
+        describe: Callable[[], list[str]],
+        *,
+        threshold: float = SLOW_RESET_SECONDS,
+        stream: TextIO | None = None,
+    ) -> None:
+        self.label = label
+        self.threshold = threshold
+        self._describe = describe
+        self._stream = stream
+        self._start = time.monotonic()
+        self._calls: list[str] = []
+        self._calls_lock = threading.Lock()
+        self._stalled = threading.Event()
+        self._timer = threading.Timer(threshold, self._report_stall)
+        self._timer.daemon = True
+        self._timer.name = "pm-slow-reset-watch"
+
+    def start(self) -> "ResetWatch":
+        self._timer.start()
+        return self
+
+    def elapsed(self) -> float:
+        return time.monotonic() - self._start
+
+    def record_call(self, name: str, queued: float, ran: float) -> None:
+        with self._calls_lock:
+            self._calls.append(
+                f"executor call {name}: queued {queued:.3f}s, ran {ran:.3f}s"
+            )
+
+    def finish(self, outcome: str) -> None:
+        self._timer.cancel()
+        elapsed = self.elapsed()
+        # A coarse clock (Windows) can fire the timer just short of the
+        # threshold; a reset that was reported always gets its summary.
+        if elapsed < self.threshold and not self._stalled.is_set():
+            return
+        with self._calls_lock:
+            calls = list(self._calls)
+        self._write([f"{self.label} {outcome} after {elapsed:.3f}s", *calls])
+
+    def _report_stall(self) -> None:
+        self._stalled.set()
+        lines = [f"{self.label} still running after {self.elapsed():.3f}s"]
+        try:
+            lines.extend(self._describe())
+        except Exception as error:  # a diagnostic never breaks the reset
+            lines.append(f"state unavailable: {error!r}")
+        lines.extend(thread_stacks())
+        self._write(lines)
+
+    def _write(self, lines: list[str]) -> None:
+        stream = self._stream or sys.stderr
+        text = "".join(
+            f"{REPORT_PREFIX}{part}\n" for line in lines for part in line.splitlines()
+        )
+        try:
+            stream.write(text)
+            stream.flush()
+        except (OSError, ValueError):
+            pass
+
+
+def thread_stacks() -> list[str]:
+    """Every thread's stack, from faulthandler.
+
+    Formatting sys._current_frames() showed a thread blocked in SQLite as idle
+    (Python 3.14); faulthandler reports where each thread really is.
+    """
+    # Before Python 3.14 faulthandler prints ids only; name each id here.
+    names = [
+        f"thread 0x{thread.ident:016x} is {thread.name}"
+        for thread in threading.enumerate()
+        if thread.ident is not None
+    ]
+    with tempfile.TemporaryFile() as dump:
+        faulthandler.dump_traceback(file=dump, all_threads=True)
+        dump.seek(0)
+        return [*names, *dump.read().decode("utf-8", "replace").splitlines()]
+
+
+def executor_state(loop: asyncio.AbstractEventLoop) -> list[str]:
+    executor = getattr(loop, "_default_executor", None)
+    if executor is None:
+        return ["default executor: not started"]
+    threads = getattr(executor, "_threads", ())
+    queue = getattr(executor, "_work_queue", None)
+    queued = queue.qsize() if queue is not None else "?"
+    return [
+        f"default executor: {len(threads)} of "
+        f"{getattr(executor, '_max_workers', '?')} threads, {queued} queued"
+    ]
+
+
+def database_state(model) -> list[str]:
+    """How many connections are open, and the WAL size.
+
+    Never touches another thread's connection: a connection busy in SQLite
+    holds its mutex, and reading even ``in_transaction`` from here would block
+    on it while holding the GIL, freezing every thread until that query ends.
+    """
+    with model._conn_lock:
+        count = len(model._connections)
+    wal = model.db_path + "-wal"
+    size = os.path.getsize(wal) if os.path.exists(wal) else 0
+    return [f"database: {count} connections, WAL {size} bytes"]
+
+
+def kernel_wait_state() -> list[str]:
+    """Each thread's state and kernel wait channel, where /proc has them."""
+    lines = []
+    for thread in threading.enumerate():
+        task = f"/proc/self/task/{thread.native_id}"
+        try:
+            with open(f"{task}/stat", encoding="ascii") as stat:
+                state = stat.read().rsplit(")", 1)[1].split()[0]
+            with open(f"{task}/wchan", encoding="ascii") as wchan:
+                channel = wchan.read().strip() or "0"
+        except (OSError, IndexError):
+            continue
+        # The id matches the "Thread 0x..." headers of the stacks below.
+        lines.append(
+            f"kernel: {thread.name} (0x{thread.ident:016x}) state {state}, "
+            f"waiting in {channel}"
+        )
+    return lines
+
+
+def install(app: web.Application, api) -> None:
+    """Watch every reset route, and time the executor calls each one makes."""
+    run_in_executor = api._run_in_executor
+
+    async def timed_run_in_executor(func, *args, **kwargs):
+        watch = _current.get()
+        if watch is None:
+            return await run_in_executor(func, *args, **kwargs)
+        queued_at = time.monotonic()
+        started: list[float] = []
+
+        def timed(*call_args, **call_kwargs):
+            started.append(time.monotonic())
+            return func(*call_args, **call_kwargs)
+
+        try:
+            return await run_in_executor(timed, *args, **kwargs)
+        finally:
+            end = time.monotonic()
+            begin = started[0] if started else end
+            watch.record_call(
+                getattr(func, "__qualname__", repr(func)),
+                begin - queued_at,
+                end - begin,
+            )
+
+    api._run_in_executor = timed_run_in_executor
+
+    @web.middleware
+    async def watch_resets(request: web.Request, handler):
+        if not is_reset_path(request.path):
+            return await handler(request)
+        loop = asyncio.get_running_loop()
+
+        def describe() -> list[str]:
+            return [
+                *executor_state(loop),
+                *database_state(api.db.model),
+                *kernel_wait_state(),
+            ]
+
+        watch = ResetWatch(
+            f"{request.method} {request.path}", describe, threshold=SLOW_RESET_SECONDS
+        ).start()
+        token = _current.set(watch)
+        outcome = "failed"
+        try:
+            response = await handler(request)
+            outcome = f"answered {response.status}"
+            return response
+        except web.HTTPException as error:
+            outcome = f"answered {error.status}"
+            raise
+        finally:
+            _current.reset(token)
+            watch.finish(outcome)
+
+    app.middlewares.append(watch_resets)
@@ -0,0 +1,410 @@
+import { startCoverage, saveCoverage } from '../../tools/vendor/browser-coverage.mjs';
+import { test, expect } from './fixtures.mjs';
+import { SIZES, THEMES, seedConcept, openConcept, openProduction, diffInventory, mutate } from './concept-inventory.mjs';
+
+// #249 System S2 Task 6: System's shell and its Overview section (app.js renderSystem 658–706), the Statistics dialog
+// ("Usage statistics", a1600–1604) and the health report (a1439–1456) against the immutable concept, on the
+// concept-shaped real fixture. Each concept measurement is mapped only by the recorded deviations (D92–D96, D121,
+// D122, D123), each commented where it applies; after that the difference must be empty, and a mutation of a
+// row, a label or a token must be noticed.
+test.use({ locale: 'en-US', timezoneId: 'UTC' });
+
+test.beforeEach(async ({ page, request, browserName }) => {
+    await startCoverage(page, browserName);
+    await seedConcept(request);
+    await expect(await request.post('/__test__/system/reset')).toBeOK();
+    await expect(await request.post('/__test__/jobs/restart')).toBeOK();
+    page.conceptErrors = [];
+    page.on('pageerror', error => page.conceptErrors.push(error.message));
+});
+
+test.afterEach(async ({ page, request, browserName }) => {
+    await saveCoverage(page, browserName);
+    await request.post('/__test__/system/reset');
+    expect(page.conceptErrors).toEqual([]);
+});
+
+/** Runs in the page; self-contained. System's heading, section nav, Overview body and Save row under `mainSelector`. */
+function measureSystem(mainSelector) {
+    const main = document.querySelector(mainSelector);
+    const css = (node, ...keys) => node ? Object.fromEntries(keys.map(key => [key, getComputedStyle(node)[key]])) : null;
+    const name = node => [node.localName, ...[...node.classList].sort()].join('.');
+    const box = (node, origin = main) => {
+        const rect = node.getBoundingClientRect(), base = origin.getBoundingClientRect();
+        return { left: Math.round(rect.left - base.left), width: Math.round(rect.width) };
+    };
+    // A surface's top: from `.two-col` beside its neighbour, else from the bottom of the surface above it. This pins the
+    // concept's `.surface + .surface` 18px offset, which concept.css applies inside `.two-col` too (copied, not ruled).
+    const top = node => {
+        const rect = node.getBoundingClientRect(), previous = node.previousElementSibling?.getBoundingClientRect();
+        if (previous && rect.top >= previous.bottom) return Math.round(rect.top - previous.bottom);
+        return Math.round(rect.top - node.parentElement.getBoundingClientRect().top);
+    };
+    const text = node => node?.textContent.trim() ?? null;
+    const button = node => ({ text: text(node), className: node.className,
+        ...css(node, 'backgroundColor', 'color', 'fontSize', 'paddingTop', 'paddingLeft', 'borderTopWidth', 'borderTopColor',
+            'borderTopLeftRadius', 'opacity', 'cursor') });
+    const heading = main.querySelector(':scope > .heading');
+    const nav = main.querySelector(':scope > .section-nav');
+    const layout = main.querySelector(':scope > .settings-layout');
+    const metrics = layout.querySelector(':scope > .summary-metrics');
+    const columns = layout.querySelector(':scope > .two-col');
+    const save = layout.querySelector(':scope > .save-row');
+    const firstMetric = metrics.querySelector('.metric');
+    const firstSurface = columns.querySelector('.surface');
+    const firstOperation = firstSurface.querySelector('.operation');
+    return {
+        tree: [...main.children].map(name),
+        heading: {
+            title: text(heading.querySelector('h1')), description: text(heading.querySelector('p.muted')),
+            actions: [...(heading.querySelector('.heading-actions')?.children ?? [])].map(name),
+        },
+        nav: {
+            role: nav.getAttribute('role'), label: nav.getAttribute('aria-label'),
+            ...css(nav, 'display', 'flexWrap', 'columnGap', 'rowGap', 'paddingBottom', 'marginBottom', 'borderBottomWidth', 'borderBottomColor'),
+            box: box(nav),
+            buttons: [...nav.children].map(item => ({ pressed: item.getAttribute('aria-pressed'), ...button(item) })),
+        },
+        layout: { tree: [...layout.children].map(name), ...css(layout, 'maxWidth'), box: box(layout) },
+        metrics: {
+            ...css(metrics, 'display', 'gridTemplateColumns', 'columnGap', 'rowGap', 'marginBottom'), box: box(metrics),
+            items: [...metrics.children].map(item => ({ tree: [...item.children].map(name), value: text(item.querySelector('strong')),
+                label: text(item.querySelector('span')), box: box(item) })),
+            metric: css(firstMetric, 'paddingTop', 'paddingLeft', 'borderTopWidth', 'borderTopColor', 'borderTopLeftRadius', 'backgroundColor'),
+            strong: css(firstMetric.querySelector('strong'), 'display', 'fontSize', 'fontWeight', 'color'),
+            span: css(firstMetric.querySelector('span'), 'fontSize', 'color', 'marginTop'),
+        },
+        columns: {
+            ...css(columns, 'display', 'gridTemplateColumns', 'columnGap', 'rowGap'), box: box(columns),
+            surfaces: [...columns.children].map(surface => ({ tree: [...surface.children].map(name), box: box(surface), top: top(surface),
+                heading: text(surface.querySelector(':scope > h2')),
+                rows: [...surface.querySelectorAll(':scope > .operation')].map(row => ({ tree: [...row.children].map(name),
+                    title: text(row.querySelector('h3')), description: text(row.querySelector('p')),
+                    action: button(row.querySelector('.row-actions > button')) })) })),
+            surface: css(firstSurface, 'paddingTop', 'paddingLeft', 'backgroundColor', 'borderTopWidth', 'borderTopColor', 'borderTopLeftRadius'),
+            h2: css(firstSurface.querySelector('h2'), 'fontSize', 'fontWeight', 'color', 'marginBottom'),
+            operation: css(firstOperation, 'display', 'alignItems', 'justifyContent', 'columnGap', 'paddingTop', 'paddingBottom',
+                'borderTopWidth', 'borderTopColor'),
+            h3: css(firstOperation.querySelector('h3'), 'fontSize', 'fontWeight', 'color'),
+            p: css(firstOperation.querySelector('p'), 'fontSize', 'color', 'marginTop'),
+            actions: css(firstOperation.querySelector('.row-actions'), 'display', 'columnGap', 'flexShrink'),
+        },
+        save: {
+            tree: [...save.children].map(name), ...css(save, 'display', 'alignItems', 'justifyContent', 'columnGap', 'marginTop', 'paddingTop'),
+            status: { text: text(save.querySelector('#settings-status')), ...css(save.querySelector('#settings-status'), 'fontSize', 'color') },
+            button: button(save.querySelector('button')),
+        },
+        pageScroll: document.documentElement.scrollWidth > document.documentElement.clientWidth,
+    };
+}
+
+/** Runs in the page: the open dialog's title, body sequence, tables, operation rows and actions. */
+function measureDialog() {
+    const dialog = document.querySelector('dialog#modal[open]');
+    const css = (node, ...keys) => node ? Object.fromEntries(keys.map(key => [key, getComputedStyle(node)[key]])) : null;
+    const name = node => [node.localName, ...[...node.classList].sort()].join('.');
+    const body = dialog.querySelector('#modal-body');
+    const firstCell = selector => body.querySelector(selector);
+    const list = body.querySelector(':scope > .operation-list');
+    const actions = body.querySelector(':scope > .dialog-actions');
+    return {
+        title: dialog.querySelector('#modal-title').textContent,
+        body: [...body.children].map(name),
+        tables: [...body.querySelectorAll(':scope > table')].map(table => ({
+            caption: table.caption?.textContent ?? null,
+            head: [...table.tHead.rows[0].cells].map(cell => [cell.localName, cell.scope, cell.textContent]),
+            rows: [...table.tBodies[0].rows].map(row => [...row.cells].map(cell => cell.textContent)),
+        })),
+        tableStyle: firstCell(':scope > table') && {
+            table: css(firstCell(':scope > table'), 'width', 'borderCollapse', 'fontSize', 'marginTop'),
+            caption: css(firstCell(':scope > table caption'), 'textAlign', 'fontSize', 'fontWeight', 'color', 'paddingBottom'),
+            th: css(firstCell(':scope > table thead th'), 'textAlign', 'fontSize', 'fontWeight', 'color', 'paddingTop', 'paddingLeft',
+                'borderBottomWidth', 'borderBottomColor'),
+            td: css(firstCell(':scope > table tbody td'), 'textAlign', 'fontSize', 'color', 'paddingTop', 'paddingLeft',
+                'borderBottomWidth', 'borderBottomColor'),
+        },
+        operations: list && {
+            ...css(list, 'display', 'rowGap', 'marginTop'),
+            rows: [...list.children].map(row => ({ tree: [...row.children].map(name), title: row.querySelector('h3').textContent,
+                chip: row.querySelector('.chip').textContent })),
+            operation: css(list.querySelector('.operation'), 'display', 'alignItems', 'justifyContent', 'paddingTop', 'borderTopWidth'),
+            h3: css(list.querySelector('.operation h3'), 'fontSize', 'fontWeight', 'color'),
+            chip: css(list.querySelector('.operation .chip'), 'fontSize', 'color', 'backgroundColor', 'borderTopLeftRadius', 'paddingLeft'),
+        },
+        actions: actions && {
+            ...css(actions, 'display', 'justifyContent', 'columnGap', 'marginTop'),
+            buttons: [...actions.children].map(item => ({ text: item.textContent, className: item.className,
+                ...css(item, 'backgroundColor', 'color', 'fontSize', 'paddingTop', 'paddingLeft') })),
+        },
+    };
+}
+
+/** Runs in the page: a `.notice` (Maintenance's "Check first…") with its copy. */
+function measureNotice(mainSelector) {
+    const notice = document.querySelector(`${mainSelector} .settings-layout > .notice`);
+    const css = (node, ...keys) => Object.fromEntries(keys.map(key => [key, getComputedStyle(node)[key]]));
+    const name = node => [node.localName, ...[...node.classList].sort()].join('.');
+    const run = notice.querySelector(':scope > button');
+    return {
+        tree: [...notice.children].map(name), text: [...notice.querySelectorAll(':scope > div > *')].map(node => [node.localName, node.textContent]),
+        frame: css(notice, 'display', 'alignItems', 'justifyContent', 'columnGap', 'borderTopWidth', 'borderTopColor', 'backgroundColor',
+            'borderTopLeftRadius', 'paddingTop', 'paddingLeft', 'marginBottom'),
+        h2: css(notice.querySelector('h2'), 'fontSize', 'fontWeight', 'color'),
+        p: css(notice.querySelector('p'), 'fontSize', 'color', 'marginTop'),
+        run: { text: run.textContent, className: run.className, ...css(run, 'backgroundColor', 'color', 'fontSize', 'paddingTop', 'paddingLeft') },
+    };
+}
+
+async function serverJson(request, url) {
+    const response = await request.get(url);
+    await expect(response).toBeOK();
+    return response.json();
+}
+
+const number = value => value.toLocaleString('en-US');
+const ratingText = value => value === null ? 'Not rated' : `${number(value)} / 5`;
+
+/** The concept's shell and Overview with the recorded deviations applied, given the server's real overview. */
+function mapOverviewConcept(reference, overview) {
+    const relabel = { 'Database integrity': 'Not checked', 'Positive prompts': number(overview.library.positive_prompts),
+        'Negative variants': number(overview.library.negative_variants), Images: number(overview.images.indexed) };
+    const rows = {
+        // D93 (Q6): no review queue yet, so no count and the action is unavailable (dimmed, as the Save row's D92).
+        '3 ambiguous image links': row => ({ ...row, title: 'Ambiguous image links', description: 'Not available yet.',
+            action: { ...row.action, opacity: '0.55', cursor: 'not-allowed' } }),
+        // D93: no backup has been recorded (verified backups arrive with S8).
+        'Backup status': row => ({ ...row, description: 'No retained backup record.' }),
+        // D93: there is no paging, so the shared settings are grid and density.
+        'One display configuration': row => ({ ...row, description: 'Grid and density settings are shared across views.' }),
+        // D93: the real sources, not samples.
+        '2 sample output sources': row => ({ ...row, title: `${number(overview.sources.effective)} output sources` }),
+        // D96: the dialog shows runs and ratings by category and library totals, not prompt, tag or date usage.
+        Statistics: row => ({ ...row, description: 'Runs and ratings by category, with library totals.' }),
+    };
+    return {
+        ...reference,
+        // D92: no "Sample configuration" chip.
+        heading: { ...reference.heading, actions: [] },
+        // D122: the concept's literal label is its prototype action name ("system-tab sections").
+        nav: { ...reference.nav, label: 'System sections' },
+        metrics: { ...reference.metrics, items: reference.metrics.items.map(item => ({ ...item, value: relabel[item.label] })) },
+        columns: { ...reference.columns, surfaces: reference.columns.surfaces.map(surface => ({ ...surface,
+            rows: surface.rows.map(row => (rows[row.title] ?? (value => value))(row)) })) },
+        save: { ...reference.save,
+            // D92: truthful status copy, and "Save preferences" is aria-disabled (dimmed) while nothing is unsaved.
+            status: { ...reference.save.status, text: 'No unsaved changes.' },
+            button: { ...reference.save.button, opacity: '0.55', cursor: 'not-allowed' } },
+    };
+}
+
+async function conceptOverview(page, theme) {
+    await openConcept(page, 'system', theme);
+    await expect(page.locator('#main .summary-metrics')).toBeVisible();
+    await page.mouse.move(0, 0);
+    return page.evaluate(measureSystem, '#main');
+}
+
+async function productionOverview(page, theme) {
+    await openProduction(page, 'system/overview', theme);
+    await expect(page.locator('#workspace-main .summary-metrics')).toBeVisible();
+    // The thumbnail row is its own read (I2): compare once it answered.
+    await expect(page.locator('#workspace-main .operation h3').filter({ hasText: 'thumbnails' })).toHaveText('No missing thumbnails');
+    await page.mouse.move(0, 0);
+    return page.evaluate(measureSystem, '#workspace-main');
+}
+
+for (const theme of THEMES) for (const [width, height] of SIZES) {
+    test(`system shell and overview match the concept ${theme} ${width}x${height}`, async ({ page, request }, testInfo) => {
+        await page.setViewportSize({ width, height });
+        const overview = await serverJson(request, '/prompt_manager/system/overview');
+        // The fixture's thumbnails all exist, so the concept's "No missing thumbnails" is also the real title.
+        expect((await serverJson(request, '/prompt_manager/images/thumbnails/status')).pending).toBe(0);
+        const concept = await conceptOverview(page, theme);
+        expect(concept.heading.actions).toEqual(['span.chip']);
+        // Paired captures are artifacts only; there are no PNG baselines.
+        await page.screenshot({ path: testInfo.outputPath(`concept-system-${theme}-${width}.png`), fullPage: true });
+        const production = await productionOverview(page, theme);
+        await page.screenshot({ path: testInfo.outputPath(`production-system-${theme}-${width}.png`), fullPage: true });
+        expect(diffInventory(mapOverviewConcept(concept, overview), production)).toEqual([]);
+        expect(production.pageScroll).toBe(false);
+    });
+}
+
+// The recorded differences, by path: D93 the review row (title, Not available yet, dimmed action), the backup row, the
+// preferences row and the sources row, and metric 4; D96 the statistics row; D92 the chip, the status and the dimmed
+// Save; D122 the nav label. (The fixture's first three metrics are the concept's own counts.)
+const UNMAPPED_PATHS = [
+    'columns.surfaces.0.rows.0.action.cursor', 'columns.surfaces.0.rows.0.action.opacity',
+    'columns.surfaces.0.rows.0.description', 'columns.surfaces.0.rows.0.title', 'columns.surfaces.0.rows.1.description',
+    'columns.surfaces.1.rows.0.description', 'columns.surfaces.1.rows.1.title', 'columns.surfaces.1.rows.2.description',
+    'heading.actions.0', 'heading.actions.length', 'metrics.items.3.value', 'nav.label',
+    'save.button.cursor', 'save.button.opacity', 'save.status.text',
+];
+
+test('system comparison detects mutations', async ({ page, request }) => {
+    await page.setViewportSize({ width: 1600, height: 1100 });
+    const overview = await serverJson(request, '/prompt_manager/system/overview');
+    const concept = await conceptOverview(page, 'dark');
+    const expected = mapOverviewConcept(concept, overview);
+    const production = await productionOverview(page, 'dark');
+    expect(diffInventory(expected, production)).toEqual([]);
+    // Unmapped, the concept differs exactly where a deviation is recorded, and nowhere else.
+    expect(diffInventory(concept, production).map(item => item.path).sort()).toEqual(UNMAPPED_PATHS);
+    const measure = () => page.evaluate(measureSystem, '#workspace-main');
+    const paths = async () => diffInventory(expected, await measure()).map(item => item.path);
+
+    // A removed row.
+    const undoRow = await mutate(page, { remove: ['#workspace-main .two-col > .surface:first-child > .operation:nth-of-type(2)'] });
+    expect(await paths()).toEqual(expect.arrayContaining(['columns.surfaces.0.rows.length', 'columns.surfaces.0.tree.length']));
+    await undoRow();
+    // A changed label.
+    await page.evaluate(() => { document.querySelector('#workspace-main .metric span').textContent = 'Positive prompt'; });
+    expect(await paths()).toEqual(['metrics.items.0.label']);
+    await page.evaluate(() => { document.querySelector('#workspace-main .metric span').textContent = 'Positive prompts'; });
+    // A swapped token.
+    const undoToken = await mutate(page, { css: '#workspace-main .settings-layout { --line: rgb(255, 0, 0); }' });
+    expect(await paths()).toEqual(expect.arrayContaining(['metrics.metric.borderTopColor', 'columns.surface.borderTopColor']));
+    await undoToken();
+    expect(diffInventory(expected, await measure())).toEqual([]);
+});
+
+/** D96: the concept's table, its rows the real ones; then "Library totals" in the same table markup. */
+function mapStatisticsConcept(reference, statistics) {
+    const [runs] = reference.tables;
+    return {
+        ...reference,
+        // No sample note (prototype copy); a second table follows the first.
+        body: ['table', 'table'],
+        tables: [
+            { ...runs, rows: statistics.by_category.map(row => [row.category ?? 'Uncategorized', number(row.runs), ratingText(row.average_rating)]) },
+            { caption: 'Library totals', head: [['th', 'col', 'Total'], ['th', 'col', 'Count']],
+                rows: [['Prompts', number(statistics.totals.total_prompts)], ['Tags', number(statistics.totals.total_tags)],
+                    ['Images', number(statistics.totals.total_images)], ['Rated images', number(statistics.rated_images)]] },
+        ],
+    };
+}
+
+// The fixture's image sources and each check's real chip on it: nothing is damaged, Needs review does not exist yet (Q6).
+const FIXTURE_SOURCES = ['output', 'input'];
+const FIXTURE_CHIPS = Object.freeze({ 'Integrity check': 'Passed', 'Foreign keys & pair references': 'Passed',
+    'Canonical hashes': 'Passed', 'Pair uniqueness': 'Passed', 'Missing files': 'Passed', 'Ambiguous metadata': 'Not available yet',
+    Consistency: 'Passed' });
+const chipOf = title => {
+    if (!(title in FIXTURE_CHIPS)) throw new Error(`No expected chip for ${title}`);
+    return FIXTURE_CHIPS[title];
+};
+
+/**
+ * D95: the concept's health report from its own five rows, labels verbatim, titled "Health report". Only the D95 rows
+ * are inserted where they are recorded (Pair uniqueness after Canonical hashes, Consistency last); Missing files has a
+ * row per image source when there are several; each chip is the fixture's expected result.
+ */
+function mapHealthConcept(reference, sources = FIXTURE_SOURCES) {
+    const [first] = reference.operations.rows;
+    const added = title => ({ ...first, title, chip: chipOf(title) });
+    const rows = reference.operations.rows.flatMap(row => {
+        const mapped = row.title === 'Missing files' && sources.length > 1
+            ? sources.map(source => ({ ...row, title: `Missing files · ${source}`, chip: chipOf(row.title) }))
+            : [{ ...row, chip: chipOf(row.title) }];
+        return row.title === 'Canonical hashes' ? [...mapped, added('Pair uniqueness')] : mapped;
+    });
+    return {
+        ...reference,
+        title: 'Health report',
+        // No sample note (prototype copy); D95 adds the checked line after the list.
+        body: ['div.operation-list', 'p.small', 'div.dialog-actions'],
+        operations: { ...reference.operations, rows: [...rows, added('Consistency')] },
+    };
+}
+
+// Unmapped, the health report differs exactly where D95 is recorded: the title, the body sequence (no sample note, the
+// checked line), the rows after Canonical hashes (Pair uniqueness inserted, Missing files per source) and the chips of
+// the concept's sample findings.
+const UNMAPPED_HEALTH_PATHS = [
+    'body.0', 'body.1',
+    ...[3, 4].flatMap(row => [`operations.rows.${row}.chip`, `operations.rows.${row}.title`]),
+    // The concept's five rows end at row 4; rows 5–7 exist only with the D95 rows and the second source.
+    ...[5, 6, 7].flatMap(row => ['chip', 'title', 'tree.0', 'tree.1', 'tree.length'].map(key => `operations.rows.${row}.${key}`)),
+    'operations.rows.length', 'title',
+];
+
+async function conceptDialogs(page, theme, testInfo) {
+    await openConcept(page, 'system', theme);
+    await page.locator('#main').getByRole('button', { name: 'Explore', exact: true }).click();
+    await expect(page.locator('dialog#modal[open] #modal-title')).toHaveText('Usage statistics');
+    await page.mouse.move(0, 0);
+    const statistics = await page.evaluate(measureDialog);
+    await page.screenshot({ path: testInfo.outputPath(`concept-statistics-${theme}.png`) });
+    await page.keyboard.press('Escape');
+    await page.locator('#main .section-nav').getByRole('button', { name: 'Maintenance', exact: true }).click();
+    const notice = await page.evaluate(measureNotice, '#main');
+    await page.locator('#main .notice').getByRole('button', { name: 'Run health checks', exact: true }).click();
+    await expect(page.locator('dialog#modal[open] #modal-title')).toHaveText('Sample health report');
+    await page.mouse.move(0, 0);
+    await page.screenshot({ path: testInfo.outputPath(`concept-health-${theme}.png`) });
+    return { statistics, notice, health: await page.evaluate(measureDialog) };
+}
+
+async function productionDialogs(page, theme, testInfo) {
+    await openProduction(page, 'system/overview', theme);
+    await page.locator('#workspace-main').getByRole('button', { name: 'Explore', exact: true }).click();
+    await expect(page.locator('dialog#modal[open] #modal-title')).toHaveText('Usage statistics');
+    await page.mouse.move(0, 0);
+    const statistics = await page.evaluate(measureDialog);
+    await page.screenshot({ path: testInfo.outputPath(`production-statistics-${theme}.png`) });
+    await page.keyboard.press('Escape');
+    await page.locator('#workspace-main .section-nav').getByRole('button', { name: 'Maintenance', exact: true }).click();
+    await expect(page.locator('#workspace-main .notice')).toBeVisible();
+    const notice = await page.evaluate(measureNotice, '#workspace-main');
+    await page.locator('#workspace-main .notice').getByRole('button', { name: 'Run health checks', exact: true }).click();
+    await expect(page.locator('dialog#modal[open] #modal-title')).toHaveText('Health report');
+    await page.mouse.move(0, 0);
+    await page.screenshot({ path: testInfo.outputPath(`production-health-${theme}.png`) });
+    return { statistics, notice, health: await page.evaluate(measureDialog) };
+}
+
+for (const theme of THEMES) test(`statistics and health dialogs match the concept ${theme}`, async ({ page, request }, testInfo) => {
+    await page.setViewportSize({ width: 1600, height: 1100 });
+    const concept = await conceptDialogs(page, theme, testInfo);
+    expect(concept.statistics.body).toEqual(['p.demo-note', 'table']);
+    expect(concept.health.body).toEqual(['p.demo-note', 'div.operation-list', 'div.dialog-actions']);
+    const production = await productionDialogs(page, theme, testInfo);
+    const statistics = await serverJson(request, '/prompt_manager/system/statistics');
+    const { report } = await serverJson(request, '/prompt_manager/system/health');
+    // The fixture the expected chips describe: its two sources, and the concept's checks plus the D95 ones.
+    const missing = report.checks.find(check => check.id === 'missing_files');
+    expect(missing.sources.map(source => source.name)).toEqual(FIXTURE_SOURCES);
+    expect(diffInventory(mapStatisticsConcept(concept.statistics, statistics), production.statistics)).toEqual([]);
+    expect(diffInventory(mapHealthConcept(concept.health), production.health)).toEqual([]);
+    // D123: Maintenance's notice is the concept's own, delivered ahead of the rest of the section.
+    expect(diffInventory(concept.notice, production.notice)).toEqual([]);
+
+    // Unmapped, the dialogs differ only where D95 and D96 are recorded.
+    expect(diffInventory(concept.health, production.health).map(item => item.path).sort()).toEqual(UNMAPPED_HEALTH_PATHS);
+    expect(diffInventory(concept.statistics, production.statistics).map(item => item.path.split('.')[0])
+        .filter((part, index, all) => all.indexOf(part) === index).sort()).toEqual(['body', 'tables']);
+
+    // Mutation check: a changed chip token in the health report is noticed, then undone to an exact match again.
+    const undo = await mutate(page, { css: '#modal .operation .chip { background: rgb(255, 0, 0); }' });
+    expect(diffInventory(mapHealthConcept(concept.health), await page.evaluate(measureDialog)).map(item => item.path))
+        .toEqual(['operations.chip.backgroundColor']);
+    await undo();
+    expect(diffInventory(mapHealthConcept(concept.health), await page.evaluate(measureDialog))).toEqual([]);
+    // A renamed check (database/health.py's label) is noticed against the concept's own label.
+    await page.evaluate(() => { document.querySelector('#modal .operation h3').textContent = 'Integrity checks'; });
+    expect(diffInventory(mapHealthConcept(concept.health), await page.evaluate(measureDialog)).map(item => item.path))
+        .toEqual(['operations.rows.0.title']);
+    await page.evaluate(() => { document.querySelector('#modal .operation h3').textContent = 'Integrity check'; });
+    // And a removed "Library totals" table and a changed caption in the statistics dialog.
+    await page.keyboard.press('Escape');
+    await page.locator('#workspace-main .section-nav').getByRole('button', { name: 'Overview', exact: true }).click();
+    await page.locator('#workspace-main').getByRole('button', { name: 'Explore', exact: true }).click();
+    await expect(page.locator('dialog#modal[open] #modal-title')).toHaveText('Usage statistics');
+    const expectedStatistics = mapStatisticsConcept(concept.statistics, statistics);
+    const undoTable = await mutate(page, { remove: ['#modal-body > table:nth-of-type(2)'] });
+    expect(diffInventory(expectedStatistics, await page.evaluate(measureDialog)).map(item => item.path))
+        .toEqual(expect.arrayContaining(['body.length', 'tables.length']));
+    await undoTable();
+    await page.evaluate(() => { document.querySelector('#modal-body caption').textContent = 'Runs per category'; });
+    expect(diffInventory(expectedStatistics, await page.evaluate(measureDialog)).map(item => item.path)).toEqual(['tables.0.caption']);
+});
@@ -2,6 +2,13 @@ import { startCoverage, saveCoverage } from '../../tools/vendor/browser-coverage
 import { test, expect } from './fixtures.mjs';
 import { seedConcept, openConcept, openProduction } from './concept-inventory.mjs';

+// The Activity store's periodic list read (activity-store.mjs POLL_MS) and the detail view's read throttle
+// (activity-job-view.mjs DETAIL_INTERVAL_MS).
+const POLL_MS = 15_000;
+const DETAIL_INTERVAL_MS = 1_000;
+// A request is reported to the test a little after the browser sends it; that delay is not a shorter wait.
+const REPORT_SLACK_MS = 100;
+
 // Activity (#249 Activity-1): the concept's Activity page (app.js renderActivity 732–738), its top-bar button
 // (index.html 51–52) and sidebar row (app.js ~341), with the recorded D52 (counts of running jobs), D53 (the progress
 // pill) and D54 (real job items). Fake jobs come from tests/browser/workspace_activity_fixture.py.
@@ -278,6 +285,8 @@ test('reload during a scan reattaches to the running job', async ({ page, reques
 });

 test('lost server clears the pill and marks jobs ended', async ({ page, request }) => {
+    // A poll interval after the restart, then failed re-reads backing off for 1 + 2 + 4 s.
+    test.setTimeout(90_000);
    await page.setViewportSize({ width: 1600, height: 1100 });
    const job = await startJob(request);
    await step(request, job.id, { processed: 4000 });
@@ -294,9 +303,12 @@ test('lost server clears the pill and marks jobs ended', async ({ page, request
    await expect(items(page).first().locator('p')).toHaveText(LOST);
    await expect(items(page).first().locator('progress, .row-actions')).toHaveCount(0);
    await expect(navRow(page).locator('.nav-count')).toHaveCount(0);
-    // One re-read found the restart; there is no retry storm and no finish toast for a job that only vanished.
-    await page.waitForTimeout(2500);
-    expect(reads.length).toBeLessThanOrEqual(2);
+    // One re-read found the restart; there is no retry storm and no finish toast for a job that only vanished. The
+    // read after it is the periodic one, a whole poll interval later: any extra read lands in that gap and fails it.
+    const found = reads.length;
+    expect(found, 'reads that found the restart').toBeGreaterThanOrEqual(1);
+    await expect.poll(() => reads.length, { timeout: POLL_MS + 10_000 }).toBeGreaterThan(found);
+    expect(reads[found] - reads[found - 1], 'the next read waits for the poll').toBeGreaterThanOrEqual(POLL_MS - REPORT_SLACK_MS);
    await expect(toast(page)).toHaveText('');

    // A server that cannot be read at all also ends the running job, then is read again with a growing backoff.
@@ -308,9 +320,12 @@ test('lost server clears the pill and marks jobs ended', async ({ page, request
    await expect(await request.post('/__test__/jobs/restart')).toBeOK();
    await expect(pill(page)).toBeHidden();
    await expect(items(page).filter({ hasText: LOST })).toHaveCount(1);
-    await page.waitForTimeout(3500);
-    // 1 s, then 2 s: at most two re-reads in 3.5 s.
-    expect(failed.length).toBeLessThanOrEqual(2);
+    // 1 s, then 2 s, then 4 s: each failed re-read waits twice as long as the one before. The gaps between the
+    // reads themselves are the evidence, so a slow runner noticing the ended job late cannot add a read to a window.
+    await expect.poll(() => failed.length, { timeout: 20_000 }).toBeGreaterThanOrEqual(3);
+    const gaps = failed.slice(1, 3).map((at, index) => at - failed[index]);
+    expect(gaps[0]).toBeGreaterThanOrEqual(2000 - REPORT_SLACK_MS);
+    expect(gaps[1]).toBeGreaterThanOrEqual(4000 - REPORT_SLACK_MS);
    await page.unroute('**/prompt_manager/jobs**');
    expect(second.id).not.toBe(job.id);
 });
@@ -607,6 +622,8 @@ test('filter narrows the selected outcome', async ({ page, request }) => {

 test('job view renders 200-row cap note', async ({ page, request }) => {
    await page.setViewportSize({ width: 1600, height: 1100 });
+    // The page's timers are Playwright's, running at real speed, so the M12 check below can run a read throttle out.
+    await page.clock.install();
    const job = await startJob(request);
    await step(request, job.id, { processed: 260, bulk: { group: 'added', count: 250 }, records: [
        ...Array.from({ length: 10 }, (_, index) => ({ group: 'no_metadata', path: `misc/plain_${index}.png`, detail: 'No prompt metadata in the file' })),
@@ -646,11 +663,15 @@ test('job view renders 200-row cap note', async ({ page, request }) => {
    page.on('request', item => { if (new URL(item.url()).pathname === `/prompt_manager/jobs/${job.id}`) reads.push(Date.now()); });
    await step(request, job.id, { processed: 300, bulk: { group: 'added', count: 40 } });
    await expect(tiles(page).first().locator('dd')).toHaveText('290');
-    await page.waitForTimeout(1500);
+    // Every read the counter update could have scheduled is due within one throttle interval: run it out, so any such
+    // read is sent before the log opens. Requests reach the test in the order they were sent, so once the log's read
+    // has answered, a read sent before it would already be listed.
+    await page.clock.runFor(DETAIL_INTERVAL_MS);
    expect(reads).toEqual([]);
    await scanLog(page).locator('summary').click();
    await expect.poll(() => reads.length).toBe(1);
    await expect(scanLog(page).locator('pre')).toContainText('bulk/file_00039.png');
+    expect(reads, 'only the log\'s own read').toHaveLength(1);
 });

 test('cancel scan ends cancelled with partial counts', async ({ page, request }) => {
@@ -705,14 +726,17 @@ test('a held legacy job shows no Cancel in the list or its view', async ({ page,

 test('busy start names the running job', async ({ page, request }) => {
    await page.setViewportSize({ width: 1600, height: 1100 });
+    // The page's timers are Playwright's, so the toast's lifetime below is run out rather than waited for.
+    await page.clock.install();
    const running = await startJob(request, { title: 'Database maintenance', kind: 'maintenance' });
    await startFromImport(page);
    await expect(toast(page)).toHaveText('Another job is running: Database maintenance.');
    await expect(toast(page).getByRole('link', { name: 'Database maintenance', exact: true })).toHaveAttribute('href', `#/activity/${running.id}`);
    await expect(page).toHaveURL(/#\/images$/);
    expect((await listed(request)).map(item => item.id)).toEqual([running.id]);
-    // Review M14: a toast with a link outlasts the plain 6.5 s, so the link stays reachable.
-    await page.waitForTimeout(7000);
+    // Review M14: a toast with a link outlasts the plain 6.5 s, so the link stays reachable. Running the page's timers
+    // 7 s on fires a 6.5 s clear for certain, however slowly this runner reached this line.
+    await page.clock.runFor(7000);
    await expect(toast(page).getByRole('link', { name: 'Database maintenance', exact: true })).toBeVisible();
    await toast(page).getByRole('link', { name: 'Database maintenance', exact: true }).click();
    await expect(heading(page).locator('h1')).toHaveText('Database maintenance');
@@ -494,6 +494,23 @@ test('the inline current file names its prompts apart from the frozen run fields
    expect(await exact(dialog(page).getByRole('region',{name:'Positive prompt',exact:true}).locator('p.prompt-text'))).toBe(before);
 });

+// LI-4 (D117): the recorded history's current-file viewer is the shared full inspector, so it copies the legacy summary.
+test('the current file viewer copies its settings summary',async({page})=>{
+    await page.addInitScript(()=>{window.__copied=[];Object.defineProperty(navigator,'clipboard',{configurable:true,value:{writeText:async text=>{window.__copied.push(text);}}});});
+    await page.route(url=>url.pathname.endsWith('/inspection'),async route=>{const response=await route.fetch();const body=await response.json();
+        body.prompts={positive:{status:'resolved',text:'current file positive',source:'graph-inferred'},negative:{status:'resolved',text:'current file negative',source:'graph-inferred'}};
+        await route.fulfill({response,json:body});});
+    await open(page,page.fixture.detail_id);await marker(page,page.fixture.runs.shared).click();await expect(dialog(page).locator('[data-receipt]')).toHaveCount(5);
+    await dialog(page).locator('[data-receipt]').first().getByRole('button',{name:'View current file',exact:true}).click();
+    const details=page.locator('dialog#viewer-dialog #viewer-details');await expect(details.locator('.panel-heading')).toBeVisible();
+    const facts=await details.locator(':scope > div > dl.meta-grid dd').allTextContents();
+    await details.getByRole('button',{name:'Copy settings summary',exact:true}).click();
+    await expect(page.locator('#workspace-toast')).toHaveText('Settings summary copied.');
+    const [seed,steps,cfg,sampler,,model]=facts;
+    expect(await page.evaluate(()=>window.__copied)).toEqual([[`Checkpoint: ${model}`,'Positive Prompt: current file positive','Negative Prompt: current file negative',
+        `Steps: ${steps}`,`CFG Scale: ${cfg}`,`Sampler: ${sampler}`,`Seed: ${seed}`].join('\n').replace(/: (Not recorded|Unresolved|Ambiguous|Unavailable within inspection limits)(?=\n|$)/g,': Unknown')]);
+});
+
 test('the recorded run dialog with a resolved current file has no duplicate button or region names',async({page})=>{
    await page.route(url=>url.pathname.endsWith('/inspection'),async route=>{const response=await route.fetch();const body=await response.json();
        body.prompts={positive:{status:'resolved',text:'current file positive',source:'graph-inferred'},negative:{status:'resolved',text:'current file negative',source:'graph-inferred'}};
@@ -787,7 +787,12 @@ test('density changes and resize preserve identity focus and selection', async (
    await page.getByRole('button',{name:'Grid',exact:true}).click();
    for (const [width,columns] of [[951,3],[950,3],[700,2],[390,2]]) {
        await page.setViewportSize({width,height:844});
-        await expect.poll(()=>cards(page).nth(columns).evaluate(node=>node.offsetLeft)).toBe(0);
+        // 700px and 390px both lay out two columns, so a card at the row start alone is also true of the previous
+        // width's cards before WebKit runs the first frame after the resize; wait for the row to fit the new grid.
+        await expect.poll(()=>page.locator('.image-grid').evaluate((grid,columns)=>{
+            const row=[...grid.querySelectorAll(':scope > article[data-image-key]')];
+            return row[columns].offsetLeft===0&&row[columns-1].getBoundingClientRect().right<=grid.getBoundingClientRect().right+1;
+        },columns)).toBe(true);
        await first.getByRole('button',{name:/^Open /}).focus();await page.keyboard.press('ArrowDown');
        await expect(cards(page).nth(columns).getByRole('button',{name:/^Open /})).toBeFocused();
        expect(await page.evaluate(()=>document.documentElement.scrollWidth-document.documentElement.clientWidth)).toBeLessThanOrEqual(1);
@@ -902,6 +907,10 @@ test('browser Back closes the open Images dialog and leaves the next page usable

 test('count line shows images and positive prompts', async ({ page, request }) => {
    await page.addInitScript(() => { window.IntersectionObserver = undefined; });
+    // D17's "Today" is the newest file's day: the page's clock stands at that file's mtime, so the fixture's day and
+    // the page's agree on either side of midnight.
+    const { images } = await (await request.get('/prompt_manager/images/output?mode=workspace&limit=40')).json();
+    await page.clock.setFixedTime(new Date(Math.max(...images.map(image => image.modified_time)) * 1000));
    await page.goto(workspace);
    await expect(cards(page)).toHaveCount(2);
    await expect(caption(page).locator('#result-count')).toHaveText('2 of 2 images · 2 positive prompts');
@@ -207,6 +207,40 @@ test('chooser opens the shared full inspector without a second read', async ({ p
    expect(await page.evaluate(() => window.__slices)).toBe(0);
 });

+// PR L3 Task 10: local roles are the server inspector's (local-resolver.mjs), so for every parity PNG the rail shows the
+// prompts, their status lines and the facts Images shows for the same bytes in the output folder.
+const PARITY_PNGS = ['f01b', 'f02', 'f03', 'f06a', 'f06b', 'f06c', 'f06d', 'f06e', 'f07a', 'f07b', 'f08', 'f09', 'f10', 'f11', 'f12',
+    'f14', 'f15', 'f16', 'f17', 'f19', 'f20', 'f21', 'f22', 'f23', 'f24'];
+const roleSections = locator => locator.evaluate(node => [...node.querySelectorAll('.prompt-section')].map(item => item.textContent));
+
+test('chooser shows the Images roles and resolution for every parity PNG', async ({ page, request }) => {
+    test.slow();
+    for (const name of PARITY_PNGS) {
+        await expect(await request.post('/__test__/add-local-inspect-file', { data: { name: `${name}.png` } })).toBeOK();
+    }
+    const served = {};
+    await page.goto(`${workspace}#/images`);
+    for (const name of PARITY_PNGS) {
+        await page.locator(`article[data-image-key="0:local-inspect/${name}.png"] .image-open`).click();
+        await expect(viewer(page).locator('#viewer-title')).toHaveText(`${name}.png`);
+        await expect(rail(page).locator('.panel-heading')).toBeVisible();
+        await expect(rail(page).locator('.prompt-section')).not.toHaveCount(0);
+        served[name] = { content: await railContent(rail(page)), roles: await roleSections(rail(page)) };
+        await page.keyboard.press('Escape');
+        await expect(viewer(page)).toHaveCount(0);
+    }
+    await openInspect(page);
+    for (const name of PARITY_PNGS) {
+        await choose(page, parityPng(`${name}.png`));
+        await openViewer(page);
+        await expect(viewer(page).locator('#viewer-title')).toHaveText(`${name}.png`);
+        await expect(rail(page).locator('.prompt-section')).not.toHaveCount(0);
+        expect({ content: await railContent(rail(page)), roles: await roleSections(rail(page)) }, name).toEqual(served[name]);
+        await page.keyboard.press('Escape');
+        await expect(viewer(page)).toHaveCount(0);
+    }
+});
+
 test('Import → Inspect a local image lands here', async ({ page }) => {
    await page.goto(`${workspace}#/images`);
    await page.getByRole('button', { name: 'Import', exact: true }).click();
@@ -481,15 +515,13 @@ test('replacing a video that just started loading never blocks the page', async
 });

 test('a video replaced while still starting is reset once it settles', async ({ context, browserName }) => {
-    // A WebKit (GStreamer) video released exactly at its `loadstart` sometimes blocks the page, with or without any
-    // reset and also with the code before the deferred reset (2 of 24 runs); tracked in TESTING.md (D62). WebKit's
-    // no-hang guard is `replacing a video that just started loading never blocks the page`.
-    test.skip(browserName === 'webkit', 'WebKit release at loadstart is a tracked follow-up (D62)');
-    test.setTimeout(120000);
-    // The video is replaced from its own `loadstart` (readyState HAVE_NOTHING). It leaves the page with no src before
-    // its URL is revoked, and is reset (load() with no src, which frees its decoder) only once it reports metadata or
-    // an error, so the page never blocks. Fresh pages share one browser process.
-    for (let attempt = 0; attempt < 5; attempt++) {
+    test.setTimeout(180000);
+    // The video is replaced from its own `loadstart` (readyState HAVE_NOTHING), or a few milliseconds after it. On
+    // WebKit (GStreamer) a video that left the page or the viewport before its pipeline had started deadlocked the
+    // page (TESTING.md D62), so it stays in place, inert and still playing its URL, with the new preview after it.
+    // Once it reports metadata or an error it is paused, loses its src, is reset (load() with no src, which frees its
+    // decoder) and leaves the page, and only then is its URL revoked. Fresh pages share one browser process.
+    for (let attempt = 0; attempt < 15; attempt++) {
        const page = await context.newPage();
        try {
            if (attempt === 0) await startCoverage(page, browserName);
@@ -510,10 +542,12 @@ test('a video replaced while still starting is reset once it settles', async ({
                    const video = slot.querySelector('video');
                    if (!video) return;
                    observer.disconnect();
-                    video.addEventListener('loadstart', () => {
+                    const replace = () => {
                        window.__starting = { node: video, url: video.getAttribute('src'), readyState: video.readyState };
                        input.files = window.__pngFiles; input.dispatchEvent(new Event('change', { bubbles: true }));
-                    }, { once: true });
+                        window.__starting.replaced = { connected: video.isConnected, src: video.hasAttribute('src'), inert: video.inert, resets: video.__resets ?? 0 };
+                    };
+                    video.addEventListener('loadstart', () => { if (window.__delay) setTimeout(replace, window.__delay); else replace(); }, { once: true });
                }).observe(slot, { childList: true });
            });
            const png = parityPng('f02.png');
@@ -522,13 +556,17 @@ test('a video replaced while still starting is reset once it settles', async ({
                transfer.items.add(new File([new Uint8Array(bytes)], 'f02.png', { type: 'image/png' }));
                window.__pngFiles = transfer.files;
            }, [...png.buffer]);
+            await page.evaluate(delay => { window.__delay = delay; }, attempt % 5);
            await choose(page, localFixture('core-tags.webm', 'video/webm'));
            await expect(preview(page).locator('img.local-file-preview')).toBeVisible({ timeout: 8000 });
            await expect(preview(page).locator('video')).toHaveCount(0);
-            // Released while starting, and never reset synchronously: the URL went once the node had no src.
-            expect(await page.evaluate(() => ({ readyState: window.__starting.readyState, revoked: window.__starting.revoked })))
-                .toEqual({ readyState: 0, revoked: { src: false, connected: false, resets: 0 } });
-            await expect.poll(() => page.evaluate(() => window.__starting.node.__resets ?? 0), { timeout: 15000 }).toBe(1);
+            // Replaced while starting (always so at `loadstart` itself): kept in place and untouched. A video that had
+            // settled is released at once. Either way it is reset once, and its URL goes last.
+            await expect.poll(() => page.evaluate(() => window.__starting.revoked ?? null)).toEqual({ src: false, connected: false, resets: 1 });
+            const { readyState, replaced } = await page.evaluate(() => ({ readyState: window.__starting.readyState, replaced: window.__starting.replaced }));
+            if (attempt % 5 === 0) expect(readyState).toBe(0);
+            expect(replaced).toEqual(readyState === 0 ? { connected: true, src: true, inert: true, resets: 0 } : { connected: false, src: false, inert: false, resets: 1 });
+            expect(await page.evaluate(() => window.__starting.node.__resets)).toBe(1);
            // The page still answers.
            await chooser(page).setInputFiles(parityPng('f02.png', 'after.png'), { timeout: 8000 });
            await expect(preview(page).locator('img.local-file-preview')).toBeVisible({ timeout: 8000 });
@@ -539,6 +577,54 @@ test('a video replaced while still starting is reset once it settles', async ({
    }
 });

+test('leaving for another route while a video starts waits for it to settle', async ({ context, browserName }) => {
+    test.setTimeout(180000);
+    // A WebKit (GStreamer) video detached before its pipeline had started deadlocked the page (TESTING.md D62); a
+    // route change detaches the whole page, so the shell renders the next route once the video reports metadata or an
+    // error. The route changes from the video's own `loadstart`, or a few milliseconds after it.
+    for (let attempt = 0; attempt < 15; attempt++) {
+        const page = await context.newPage();
+        try {
+            if (attempt === 0) await startCoverage(page, browserName);
+            await page.addInitScript(() => {
+                const load = HTMLMediaElement.prototype.load;
+                HTMLMediaElement.prototype.load = function () {
+                    if (!this.hasAttribute('src') && window.__starting?.node === this) window.__starting.reset = { readyState: this.readyState, failed: this.error !== null, connected: this.isConnected };
+                    return load.call(this);
+                };
+            });
+            await openInspect(page);
+            await page.evaluate(delay => {
+                const slot = document.querySelector('#local-preview');
+                new MutationObserver((records, observer) => {
+                    const video = slot.querySelector('video');
+                    if (!video) return;
+                    observer.disconnect();
+                    const leave = () => {
+                        window.__starting = { node: video, readyState: video.readyState };
+                        location.hash = '#/overview';
+                    };
+                    video.addEventListener('loadstart', () => { if (delay) setTimeout(leave, delay); else leave(); }, { once: true });
+                }).observe(slot, { childList: true });
+            }, attempt % 5);
+            await choose(page, localFixture('core-tags.webm', 'video/webm'));
+            await expect(main(page).getByRole('heading', { level: 1, name: 'Overview', exact: true })).toBeVisible({ timeout: 8000 });
+            const { readyState, reset } = await page.evaluate(() => ({ readyState: window.__starting.readyState, reset: window.__starting.reset }));
+            if (attempt % 5 === 0) expect(readyState).toBe(0);
+            // The video was reset and left the page only once it had settled.
+            expect(reset.readyState >= 1 || reset.failed).toBe(true);
+            expect(reset.connected).toBe(true);
+            // The page still answers.
+            await page.locator('aside.sidebar nav').getByRole('link', { name: 'Inspect a file', exact: true }).click();
+            await chooser(page).setInputFiles(parityPng('f02.png'), { timeout: 8000 });
+            await expect(preview(page).locator('img.local-file-preview')).toBeVisible({ timeout: 8000 });
+            if (attempt === 0) await saveCoverage(page, browserName);
+        } finally {
+            await page.close();
+        }
+    }
+});
+
 test('closing the viewer on a video that just started never blocks the page', async ({ context, browserName }) => {
    test.setTimeout(180000);
    // The viewer's video teardown resets its element; on WebKit a reset of a still-starting pipeline blocked the page.
@@ -652,13 +738,19 @@ test('local roles send exactly', async ({ page, context }) => {

 test('local inspection makes no content request or storage write', async ({ page }) => {
    await instrument(page);
-    await openInspect(page);
-    // The shell's own reads (counts, Activity) settle before the baseline.
-    await expect(page.locator('aside.sidebar nav [data-route="images"] .nav-count')).toBeAttached();
-    const baseline = (await urls(page)).writes.length;
    const requests = [];
    page.on('request', request => requests.push({ url: request.url(), method: request.method(), body: request.postData() }));
    page.on('websocket', socket => requests.push({ url: socket.url(), method: 'WS', body: null }));
+    const table = /\/prompt_manager\/js\/inspection-semantics\.json$/;
+    const tableRead = page.waitForResponse(response => table.test(response.url()));
+    await openInspect(page);
+    // The one static file Inspect reads, its node table, is fetched as the page mounts: before any selection.
+    expect((await tableRead).ok()).toBe(true);
+    // The shell's own reads (counts, Activity) settle before the baseline.
+    await expect(page.locator('aside.sidebar nav [data-route="images"] .nav-count')).toBeAttached();
+    const baseline = (await urls(page)).writes.length;
+    const before = requests.length;
+    expect(requests.filter(entry => table.test(entry.url))).toHaveLength(1);
    for (const file of [sendablePng('private-name.png'), localFixture('core-tags.webm', 'video/webm', 'private-clip.webm')]) {
        await choose(page, file);
        await openViewer(page);
@@ -666,7 +758,8 @@ test('local inspection makes no content request or storage write', async ({ page
        await page.keyboard.press('Escape');
        await expect(viewer(page)).toHaveCount(0);
    }
-    const network = requests.filter(entry => !entry.url.startsWith('blob:') && !entry.url.startsWith('data:'));
+    const network = requests.slice(before).filter(entry => !entry.url.startsWith('blob:') && !entry.url.startsWith('data:'));
+    expect(requests.filter(entry => table.test(entry.url)), 'the table is read once per page').toHaveLength(1);
    expect(network.filter(entry => /private|lighthouse|fox/.test(`${entry.url} ${entry.body ?? ''}`))).toEqual([]);
    expect(network.filter(entry => entry.method !== 'GET')).toEqual([]);
    expect(network.filter(entry => !/\/prompt_manager\/(activity|images\/output|library|vocabulary)/.test(entry.url))).toEqual([]);
@@ -685,3 +778,80 @@ test('touch layout at 390 has no horizontal overflow at 200% zoom', async ({ pag
        expect(area).toBe(true);
    }
 });
+
+// LI-4 (D117): "Copy settings summary" after the six facts is the legacy metadata page's COPY ALL, in the shared full
+// inspector, so a file served in Images and the same bytes chosen here copy the same summary of what the rail shows.
+/** Records clipboard writes in the page, or (`clipboard: false`) leaves the page without a clipboard. */
+async function stubClipboard(page, { clipboard = true } = {}) {
+    await page.addInitScript(available => {
+        window.__copied = [];
+        Object.defineProperty(navigator, 'clipboard', { configurable: true,
+            value: available ? { writeText: async text => { window.__copied.push(text); } } : undefined });
+    }, clipboard);
+}
+/** The summary the rail's own prompts and facts make, in the legacy COPY ALL lines and placeholders. */
+const expectedSummary = locator => locator.evaluate(node => {
+    const facts = Object.fromEntries([...node.querySelectorAll(':scope .meta-grid:not(details .meta-grid) > div')]
+        .map(item => [item.querySelector('dt').textContent, item.querySelector('dd').textContent]));
+    // A confirmed prompt has its Copy action; an explicitly empty one takes the legacy placeholder too.
+    const prompt = role => {
+        const text = node.querySelector(`.prompt-section.${role} [data-copy-role]`) ? node.querySelector(`.prompt-section.${role} p.prompt-text`).textContent : null;
+        return text === `No ${role} prompt (explicitly empty)` ? null : text;
+    };
+    return [`Checkpoint: ${facts.Model}`, `Positive Prompt: ${prompt('positive') ?? 'No prompt found'}`,
+        `Negative Prompt: ${prompt('negative') ?? 'No negative prompt found'}`, `Steps: ${facts.Steps}`, `CFG Scale: ${facts.CFG}`,
+        `Sampler: ${facts.Sampler}`, `Seed: ${facts.Seed}`].join('\n');
+});
+async function copySummary(page) {
+    const button = rail(page).getByRole('button', { name: 'Copy settings summary', exact: true });
+    // It follows the six facts, before "File & provenance".
+    expect(await button.evaluate(node => [node.previousElementSibling?.localName, node.nextElementSibling?.localName])).toEqual(['dl', 'details']);
+    await button.click();
+}
+
+test('Copy settings summary copies the same legacy summary in Images and Inspect', async ({ page, request }) => {
+    await stubClipboard(page);
+    await expect(await request.post('/__test__/add-local-inspect-file', { data: { name: 'f02.png' } })).toBeOK();
+    await page.goto(`${workspace}#/images`);
+    await page.locator('article[data-image-key="0:local-inspect/f02.png"] .image-open').click();
+    await expect(rail(page).locator('.prompt-section.positive p.prompt-text')).toBeVisible();
+    const served = await expectedSummary(rail(page));
+    expect(served).toMatch(/^Checkpoint: .+\nPositive Prompt: [\s\S]+\nNegative Prompt: [\s\S]+\nSteps: .+\nCFG Scale: .+\nSampler: .+\nSeed: .+$/);
+    expect(served).not.toContain('Unknown');
+    await copySummary(page);
+    await expect(page.locator('#workspace-toast')).toHaveText('Settings summary copied.');
+    expect(await page.evaluate(() => window.__copied)).toEqual([served]);
+    await page.keyboard.press('Escape');
+    await expect(viewer(page)).toHaveCount(0);
+
+    await openInspect(page);
+    await choose(page, parityPng('f02.png'));
+    await openViewer(page);
+    expect(await expectedSummary(rail(page))).toBe(served);
+    await copySummary(page);
+    await expect.poll(() => page.evaluate(() => window.__copied)).toEqual([served, served]);
+    // The panel variant (the Images side panel) keeps the concept's footer: no summary action there.
+    await page.keyboard.press('Escape');
+    await page.goto(`${workspace}#/images`);
+    await expect(page.locator('#image-inspector .panel-heading')).toBeVisible();
+    await expect(page.locator('#image-inspector').getByRole('button', { name: 'Copy settings summary', exact: true })).toHaveCount(0);
+});
+
+test('Copy settings summary without a clipboard opens the select-to-copy dialog', async ({ page }) => {
+    await stubClipboard(page, { clipboard: false });
+    await openInspect(page);
+    await choose(page, sendablePng());
+    await openViewer(page);
+    const summary = await expectedSummary(rail(page));
+    expect(summary).toContain(`Positive Prompt: ${POSITIVE_LINES}`);
+    await copySummary(page);
+    const fallback = page.getByRole('dialog', { name: 'Copy settings summary', exact: true });
+    await expect(fallback).toBeVisible();
+    await expect(fallback.getByRole('textbox', { name: 'Select and copy this text', exact: true })).toHaveValue(summary);
+    await expect(fallback.getByRole('textbox', { name: 'Select and copy this text', exact: true })).toBeFocused();
+    await page.keyboard.press('Escape');
+    await expect(fallback).toHaveCount(0);
+    // Escape closes only the copy dialog; focus returns to the action in the still-open viewer.
+    await expect(viewer(page)).toBeVisible();
+    await expect(rail(page).getByRole('button', { name: 'Copy settings summary', exact: true })).toBeFocused();
+});
@@ -610,7 +610,9 @@ test('card matches the concept and never wraps the category mid-word',async({pag
    await expect(await request.post('/prompt_manager/bulk/category',{data:{prompt_ids:[dual.id],category:''}})).toBeOK();
    // A long saved title fills the title row, so only the chip's own min-content keeps "Uncategorized" and "asian" whole.
    const wide='A remarkably long saved positive prompt title that fills the whole card title row';
-    await patchShelf(page,item=>item.id===cat.id?{run_count:4,last_used_at:new Date().toISOString(),rating:5}:item.id===dual.id||item.id===dog.id?{title:wide,run_count:1,last_used_at:null,rating:null}:{});
+    // One "now" for the patched last use and the page's clock, so it reads "Used today" on either side of midnight.
+    const usedAt=new Date();await page.clock.setFixedTime(usedAt);
+    await patchShelf(page,item=>item.id===cat.id?{run_count:4,last_used_at:usedAt.toISOString(),rating:5}:item.id===dual.id||item.id===dog.id?{title:wide,run_count:1,last_used_at:null,rating:null}:{});
    for(const [width,height] of [[1600,1100],[390,844]]) {
        await page.setViewportSize({width,height});await page.goto(route);await expect(cards(page)).toHaveCount(3);
        const card=page.locator(`article[data-prompt-id="${cat.id}"]`);
@@ -0,0 +1,252 @@
+import { startCoverage, saveCoverage } from '../../tools/vendor/browser-coverage.mjs';
+import { test, expect } from './fixtures.mjs';
+import { seedConcept } from './concept-inventory.mjs';
+
+// System › Overview (#249 System S2 Task 6) on the concept-shaped real fixture: the metrics, rows, Statistics dialog and
+// Health report read the server, never sample values (D93, D95, D96). The hooks are workspace_system_fixture.py's.
+const workspace = '/prompt_manager/workspace';
+const OVERVIEW_URL = '/prompt_manager/system/overview';
+const THUMBNAILS_URL = '/prompt_manager/images/thumbnails/status';
+const number = value => value.toLocaleString('en-US');
+
+test.beforeEach(async ({ page, request, browserName }) => {
+    await startCoverage(page, browserName);
+    await seedConcept(request);
+    await expect(await request.post('/__test__/system/reset')).toBeOK();
+    await expect(await request.post('/__test__/jobs/restart')).toBeOK();
+    page.systemErrors = [];
+    page.on('pageerror', error => page.systemErrors.push(error.message));
+});
+
+test.afterEach(async ({ page, request, browserName }) => {
+    await saveCoverage(page, browserName);
+    await request.post('/__test__/release');
+    await request.post('/__test__/system/reset');
+    expect(page.systemErrors).toEqual([]);
+});
+
+async function serverJson(request, url) {
+    const response = await request.get(url);
+    await expect(response).toBeOK();
+    return response.json();
+}
+
+const layoutOf = page => page.locator('#workspace-main .settings-layout');
+
+async function openOverview(page) {
+    await page.goto(`${workspace}#/system/overview`);
+    await expect(layoutOf(page).locator(':scope > .summary-metrics')).toBeVisible();
+    return layoutOf(page);
+}
+
+/** The rows of one Overview surface: `[h3, p, button]`. */
+function rowsOf(layout, heading) {
+    return layout.locator('.two-col > section.surface').filter({ has: layout.page().getByRole('heading', { name: heading, exact: true }) })
+        .locator('.operation').evaluateAll(rows => rows.map(row => [row.querySelector('h3').textContent,
+            row.querySelector('p').textContent, row.querySelector('.row-actions button').textContent]));
+}
+
+test('overview shows real counts and Not checked', async ({ page, request }) => {
+    const writes = [];
+    page.on('request', item => { if (!['GET', 'HEAD', 'OPTIONS'].includes(item.method())) writes.push(item.url()); });
+    const overview = await serverJson(request, OVERVIEW_URL);
+    const thumbnails = await serverJson(request, THUMBNAILS_URL);
+    // The concept fixture: six positives, their saved negatives and 24 linked images, all with thumbnails.
+    expect([overview.library.positive_prompts, overview.images.indexed, thumbnails.pending]).toEqual([6, 24, 0]);
+    // I2: the Overview never walks the sources for thumbnails; the row reads the status route itself.
+    expect(overview).not.toHaveProperty('thumbnails');
+    const layout = await openOverview(page);
+    expect(await layout.locator('.summary-metrics > .metric').evaluateAll(items => items.map(item =>
+        [item.querySelector('strong').textContent, item.querySelector('span').textContent]))).toEqual([
+        [number(overview.library.positive_prompts), 'Positive prompts'],
+        [number(overview.library.negative_variants), 'Negative variants'],
+        [number(overview.images.indexed), 'Images'],
+        ['Not checked', 'Database integrity'],
+    ]);
+    expect(await rowsOf(layout, 'Library health')).toEqual([
+        ['Ambiguous image links', 'Not available yet.', 'Review metadata'],
+        ['Backup status', 'No retained backup record.', 'View backups'],
+        ['No missing thumbnails', 'Generate only missing previews when necessary.', 'Review thumbnails'],
+    ]);
+    expect(await rowsOf(layout, 'Workspace preferences')).toEqual([
+        ['One display configuration', 'Grid and density settings are shared across views.', 'Appearance'],
+        ['2 output sources', 'Monitoring and enrichment share one source list.', 'Manage sources'],
+        ['Statistics', 'Runs and ratings by category, with library totals.', 'Explore'],
+    ]);
+    expect(writes).toEqual([]);
+});
+
+test('Run health checks opens Health report and updates metric 4', async ({ page, request }) => {
+    await page.goto(`${workspace}#/system/maintenance`);
+    const layout = layoutOf(page);
+    await expect(layout.locator(':scope > .notice h2')).toHaveText('Check first. Review changes. Then apply.');
+    // The rest of Maintenance is still the existing tools' (D94).
+    await expect(layout.locator(':scope > section.handoff h2')).toHaveText('Your current tools are ready');
+    const run = layout.getByRole('button', { name: 'Run health checks', exact: true });
+    await run.click();
+    const dialog = page.locator('dialog#modal[open]');
+    await expect(dialog.locator('#modal-title')).toHaveText('Health report');
+    const { report } = await serverJson(request, '/prompt_manager/system/health');
+    expect(report.status).toBe('incomplete');
+    expect(await dialog.locator('.operation-list > .operation').evaluateAll(rows => rows.map(row =>
+        [row.querySelector('h3').textContent, row.querySelector('span.chip').textContent]))).toEqual([
+        ['Integrity check', 'Passed'], ['Foreign keys & pair references', 'Passed'], ['Canonical hashes', 'Passed'],
+        ['Pair uniqueness', 'Passed'], ['Missing files · output', 'Passed'], ['Missing files · input', 'Passed'],
+        ['Ambiguous metadata', 'Not available yet'], ['Consistency', 'Passed'],
+    ]);
+    await expect(dialog.locator('#modal-body > p.small')).toHaveText(/^Checked .+\. Some checks could not run, so this report is incomplete\.$/);
+    await expect(dialog.locator('.dialog-actions button')).toHaveText(['Close', 'Review missing links']);
+    await dialog.getByRole('button', { name: 'Close', exact: true }).click();
+    await expect(page.locator('dialog#modal[open]')).toHaveCount(0);
+    await expect(run).toBeFocused();
+    await page.locator('#workspace-main .section-nav').getByRole('button', { name: 'Overview', exact: true }).click();
+    await expect(layout.locator('.metric').nth(3).locator('strong')).toHaveText('Incomplete');
+
+    // A missing file and an unmounted source: the report counts the readable sources and names the other one.
+    await expect(await request.post('/__test__/system/missing-file')).toBeOK();
+    await expect(await request.post('/__test__/system/missing-source')).toBeOK();
+    await page.locator('#workspace-main .section-nav').getByRole('button', { name: 'Maintenance', exact: true }).click();
+    await layout.getByRole('button', { name: 'Run health checks', exact: true }).click();
+    await expect(dialog.locator('.operation').filter({ hasText: 'Missing files' }).locator('.chip'))
+        .toHaveText(['1 link needs review', 'Passed', 'Not available']);
+    await expect(dialog.locator('.operation h3').filter({ hasText: 'Missing files' }))
+        .toHaveText(['Missing files · output', 'Missing files · input', 'Missing files · unmounted-drive']);
+    // Review missing links goes to Maintenance, where the cleanup's existing tool is linked.
+    await dialog.getByRole('button', { name: 'Review missing links', exact: true }).click();
+    await expect(page.locator('dialog#modal[open]')).toHaveCount(0);
+    await expect(page).toHaveURL(`${workspace}#/system/maintenance`);
+    await page.locator('#workspace-main .section-nav').getByRole('button', { name: 'Overview', exact: true }).click();
+    await expect(layout.locator('.metric').nth(3).locator('strong')).toHaveText('1 issue');
+});
+
+test('a health check that fails says so and keeps the last result', async ({ page, request }) => {
+    await expect(await request.post('/__test__/system/fail', { data: { path: '/prompt_manager/system/health' } })).toBeOK();
+    await page.goto(`${workspace}#/system/maintenance`);
+    const run = layoutOf(page).getByRole('button', { name: 'Run health checks', exact: true });
+    await run.click();
+    await expect(page.locator('#workspace-toast')).toHaveText('The health check could not finish. Nothing was changed.');
+    await expect(page.locator('dialog#modal[open]')).toHaveCount(0);
+    await expect(run).not.toHaveAttribute('aria-disabled', 'true');
+    await openOverview(page);
+    await expect(layoutOf(page).locator('.metric').nth(3).locator('strong')).toHaveText('Not checked');
+});
+
+test('thumbnail row reflects the status endpoint', async ({ page, request }) => {
+    await expect(await request.post('/__test__/system/unthumbnailed', { data: { count: 3 } })).toBeOK();
+    const status = await serverJson(request, '/prompt_manager/images/thumbnails/status');
+    expect(status.pending).toBe(3);
+    const layout = await openOverview(page);
+    const row = layout.locator('.operation').filter({ has: page.getByRole('button', { name: 'Review thumbnails', exact: true }) });
+    await expect(row.locator('h3')).toHaveText('3 missing thumbnails');
+    // Until the thumbnail review dialog (S5), Review thumbnails opens Sources.
+    await row.getByRole('button', { name: 'Review thumbnails', exact: true }).click();
+    await expect(page).toHaveURL(`${workspace}#/system/sources`);
+});
+
+test('the thumbnail row paints when its own status read answers', async ({ page, request }) => {
+    const held = async () => (await serverJson(request, '/__test__/hold')).held[THUMBNAILS_URL] ?? 0;
+    await expect(await request.post('/__test__/hold', { data: { path: THUMBNAILS_URL } })).toBeOK();
+    const layout = await openOverview(page);
+    const row = layout.locator('.operation').filter({ has: page.getByRole('button', { name: 'Review thumbnails', exact: true }) });
+    // The other values do not wait for the walk of every source.
+    await expect(row.locator('h3')).toHaveText('Checking thumbnails…');
+    await expect(layout.locator('.summary-metrics > .metric')).toHaveCount(4);
+    await expect.poll(held).toBe(1);
+    await expect(await request.post('/__test__/release')).toBeOK();
+    await expect(row.locator('h3')).toHaveText('No missing thumbnails');
+});
+
+test('a failed thumbnail read is unavailable, never zero', async ({ page }) => {
+    await page.route(`**${THUMBNAILS_URL}`, route => route.fulfill({ status: 500, contentType: 'application/json',
+        body: JSON.stringify({ success: false, error: 'Injected failure' }) }));
+    const layout = await openOverview(page);
+    const row = layout.locator('.operation').filter({ has: page.getByRole('button', { name: 'Review thumbnails', exact: true }) });
+    await expect(row.locator('h3')).toHaveText('Thumbnail status unavailable');
+    await expect(layout.getByRole('alert')).toHaveCount(0);
+    await expect(layout.locator('.metric').nth(2).locator('strong')).toHaveText('24');
+});
+
+test('ambiguous row reads Not available yet (Q6)', async ({ page }) => {
+    const layout = await openOverview(page);
+    const row = layout.locator('.operation').filter({ hasText: 'Ambiguous image links' });
+    await expect(row.locator('p')).toHaveText('Not available yet.');
+    const review = row.getByRole('button', { name: 'Review metadata', exact: true });
+    await expect(review).toHaveAttribute('aria-disabled', 'true');
+    await review.click({ force: true });
+    await expect(page).toHaveURL(`${workspace}#/system/overview`);
+});
+
+test('View backups / Appearance / Manage sources switch sections', async ({ page }) => {
+    for (const [label, section, pressed] of [['View backups', 'backups', 'Backup & export'], ['Appearance', 'appearance', 'Appearance'],
+        ['Manage sources', 'sources', 'Sources & scans']]) {
+        const layout = await openOverview(page);
+        await layout.getByRole('button', { name: label, exact: true }).click();
+        await expect(page).toHaveURL(`${workspace}#/system/${section}`);
+        await expect(page.locator('#workspace-main .section-nav [aria-pressed="true"]')).toHaveText(pressed);
+        await expect(layout.locator(':scope > .summary-metrics')).toHaveCount(0);
+    }
+});
+
+test('statistics dialog lists runs by category and library totals', async ({ page, request }) => {
+    const statistics = await serverJson(request, '/prompt_manager/system/statistics');
+    expect(statistics.by_category.length).toBeGreaterThan(1);
+    const layout = await openOverview(page);
+    const explore = layout.getByRole('button', { name: 'Explore', exact: true });
+    await explore.click();
+    const dialog = page.locator('dialog#modal[open]');
+    await expect(dialog.locator('#modal-title')).toHaveText('Usage statistics');
+    const tables = dialog.locator('#modal-body > table');
+    await expect(tables.locator('caption')).toHaveText(['Runs by category', 'Library totals']);
+    await expect(tables.first().locator('thead th')).toHaveText(['Category', 'Runs', 'Avg. rating']);
+    const cells = table => table.locator('tbody tr').evaluateAll(rows => rows.map(row => [...row.cells].map(cell => cell.textContent)));
+    expect(await cells(tables.first())).toEqual(statistics.by_category.map(row => [row.category ?? 'Uncategorized',
+        number(row.runs), row.average_rating === null ? 'Not rated' : `${number(row.average_rating)} / 5`]));
+    expect(await cells(tables.nth(1))).toEqual([['Prompts', number(statistics.totals.total_prompts)],
+        ['Tags', number(statistics.totals.total_tags)], ['Images', number(statistics.totals.total_images)],
+        ['Rated images', number(statistics.rated_images)]]);
+    await page.keyboard.press('Escape');
+    await expect(explore).toBeFocused();
+    // A statistics read that fails says so; the Overview stays.
+    await expect(await request.post('/__test__/system/fail', { data: { path: '/prompt_manager/system/statistics' } })).toBeOK();
+    await explore.click();
+    await expect(page.locator('#workspace-toast')).toHaveText('Statistics could not be loaded. Your saved data has not changed.');
+    await expect(page.locator('dialog#modal[open]')).toHaveCount(0);
+});
+
+test('load failure shows Retry and no zeros', async ({ page, request }) => {
+    await expect(await request.post('/__test__/system/fail', { data: { path: OVERVIEW_URL } })).toBeOK();
+    await page.goto(`${workspace}#/system/overview`);
+    const layout = layoutOf(page);
+    await expect(layout.getByRole('alert')).toHaveText('The overview could not be loaded. Your saved data has not changed.');
+    await expect(layout.locator('.metric')).toHaveCount(0);
+    await expect(layout).not.toContainText('0');
+    await layout.getByRole('button', { name: 'Retry', exact: true }).click();
+    await expect(layout.locator('.summary-metrics > .metric')).toHaveCount(4);
+    await expect(layout.getByRole('alert')).toHaveCount(0);
+});
+
+test('out-of-order overview responses never repaint a newer section', async ({ page, request }) => {
+    const held = async () => (await serverJson(request, '/__test__/hold')).held[OVERVIEW_URL] ?? 0;
+    await expect(await request.post('/__test__/hold', { data: { path: OVERVIEW_URL } })).toBeOK();
+    await page.goto(`${workspace}#/system/overview`);
+    const layout = layoutOf(page);
+    await expect(layout.getByRole('status')).toHaveText('Loading the overview…');
+    await expect.poll(held).toBe(1);
+    // Leave for Appearance, come back (a second read), then leave again before either answers.
+    const nav = page.locator('#workspace-main .section-nav');
+    await nav.getByRole('button', { name: 'Appearance', exact: true }).click();
+    await nav.getByRole('button', { name: 'Overview', exact: true }).click();
+    await expect.poll(held).toBe(2);
+    await nav.getByRole('button', { name: 'Sources & scans', exact: true }).click();
+    await expect(await request.post('/__test__/release')).toBeOK();
+    await expect.poll(held).toBe(0);
+    // Both late answers reached a section that had left: Sources keeps its own body.
+    await expect(layout.locator(':scope > section.handoff')).toBeVisible();
+    await page.evaluate(() => new Promise(resolve => requestAnimationFrame(() => requestAnimationFrame(resolve))));
+    await expect(layout.locator('.summary-metrics')).toHaveCount(0);
+    expect(await layout.evaluate(node => [...node.children].map(child => child.className))).toEqual(['surface handoff', 'save-row']);
+    // Back on Overview, one fresh read paints one set of metrics.
+    await nav.getByRole('button', { name: 'Overview', exact: true }).click();
+    await expect(layout.locator('.summary-metrics')).toHaveCount(1);
+    await expect(layout.locator('.two-col')).toHaveCount(1);
+});
@@ -340,6 +340,9 @@ test('Tag opens the dialog without selecting the card', async ({ page }) => {
    const panel = page.getByRole('complementary', { name: 'Selected image details', exact: true });
    await page.goto(images);
    await expect(card(page, FIRST)).toHaveClass(/\bselected\b/);
+    // Capture the panel once it shows the first card's details, not while it is still reading them.
+    await expect(panel.getByRole('heading', { level: 2 })).toBeVisible();
+    await expect(panel).not.toContainText('Loading file details');
    const before = await panel.innerText();
    await openTag(page, SECOND, { goto: false });
    await page.keyboard.press('Escape');
@@ -18,7 +18,8 @@ const routes = [
    ['tags', 'Tags & categories', null],
    // #249 local Inspect: the native Inspect a file page; Overview's tool card still links the legacy metadata page.
    ['inspect', 'Inspect a file', null],
-    ['system', 'System', '/prompt_manager/admin'],
+    // #249 System S2: native System; its undelivered sections hand off per section (D94, asserted below).
+    ['system', 'System', null],
    // #249 D51: SAVED VIEWS' Favorites, Images filtered to favorites.
    ['favorites', 'Favorites', null],
    // #249 Activity-1: the concept's Activity page in the tools-and-system group.
@@ -409,6 +410,8 @@ for (const width of [1600, 390]) test(`overview and handoff render with concept
    expect(await page.evaluate(() => document.documentElement.scrollWidth <= window.innerWidth)).toBe(true);

    await sidebarLink(page, 'System').click();
+    // System's Overview is native (S2 Task 6); a section not delivered yet still hands off (D94).
+    await main.locator('.section-nav').getByRole('button', { name: 'Integrations', exact: true }).click();
    const handoff = main.locator('section.handoff');
    await expect(handoff).toHaveClass(/\bsurface\b/);
    expect(await handoff.evaluate(surfaceStyle)).toMatchObject(SURFACE);
@@ -417,6 +420,98 @@ for (const width of [1600, 390]) test(`overview and handoff render with concept
    expect(await page.evaluate(() => document.documentElement.scrollWidth <= window.innerWidth)).toBe(true);
 });

+// #249 System S2 Task 5: the concept's renderSystem shell (app.js 698–706) at `#/system/<section>`, every section a D94
+// hand-off until its PR, and the Save row's truthful status (D92).
+const SYSTEM_SECTION_LABELS = ['Overview', 'Appearance', 'Sources & scans', 'Integrations', 'Auto-tagging', 'Maintenance',
+    'Backup & export', 'Diagnostics & logs'];
+const SYSTEM_HASHES = ['overview', 'appearance', 'sources', 'integrations', 'tagging', 'maintenance', 'backups', 'diagnostics'];
+const SYSTEM_HANDOFFS = { appearance: ['/prompt_manager/gallery', '/prompt_manager/admin'], sources: ['/prompt_manager/admin', '/prompt_manager/gallery'],
+    maintenance: ['/prompt_manager/admin', '/prompt_manager/gallery'] };
+
+test('System is native: the concept shell, section navigation, sections, hand-offs and the Save row', async ({ page }) => {
+    const mutations = [];
+    page.on('request', item => { if (!['GET', 'HEAD', 'OPTIONS'].includes(item.method())) mutations.push(item.url()); });
+    await page.goto(`${workspace}#/system`);
+    const main = page.locator('#workspace-main');
+    await expect(main.locator('h1')).toHaveText('System');
+    await expect(main.locator('.heading p.muted')).toHaveText('Configuration, maintenance and recovery—with browsing kept in the workspace.');
+    // D92: no "Sample configuration" chip.
+    await expect(main.locator('.heading .chip')).toHaveCount(0);
+    expect(await main.evaluate(node => [...node.children].map(child => `${child.localName}.${child.className}`)))
+        .toEqual(['div.heading', 'div.section-nav', 'div.settings-layout']);
+    const nav = main.getByRole('group', { name: 'System sections', exact: true });
+    await expect(nav.getByRole('button')).toHaveText(SYSTEM_SECTION_LABELS);
+    await expect(nav.getByRole('button', { name: 'Overview', exact: true })).toHaveAttribute('aria-pressed', 'true');
+    await expect(nav.locator('[aria-pressed="true"]')).toHaveCount(1);
+    await expect(page.locator('aside.sidebar a[href="#/system"]')).toHaveAttribute('aria-current', 'page');
+    const layout = main.locator('.settings-layout');
+    await expect(layout.locator(':scope > .save-row > span.small#settings-status')).toHaveText('No unsaved changes.');
+    const save = layout.locator(':scope > .save-row > button.ca-primary');
+    await expect(save).toHaveText('Save preferences');
+    await expect(save).toHaveAttribute('aria-disabled', 'true');
+    // Playwright waits on an aria-disabled control, so the ignored press is forced.
+    await save.click({ force: true });
+    await expect(layout.locator('#settings-status')).toHaveText('No unsaved changes.');
+
+    for (const [index, label] of SYSTEM_SECTION_LABELS.entries()) {
+        const hash = SYSTEM_HASHES[index];
+        const button = nav.getByRole('button', { name: label, exact: true });
+        await button.click();
+        await expect(page).toHaveURL(`${workspace}#/system/${hash}`);
+        await expect(button).toHaveAttribute('aria-pressed', 'true');
+        await expect(nav.locator('[aria-pressed="true"]')).toHaveCount(1);
+        // The section changes in place: focus stays on the pressed section, not the page title.
+        await expect(button).toBeFocused();
+        // S2 Task 6: Overview is native (workspace-system.spec.mjs); Maintenance shows its health-check notice above
+        // the hand-off (D123); every other section hands off.
+        if (hash === 'overview') await expect(layout.locator(':scope > .summary-metrics')).toBeVisible();
+        expect(await layout.evaluate(node => [...node.children].map(child => `${child.localName}.${child.className}`)))
+            .toEqual({ overview: ['div.summary-metrics', 'div.two-col', 'div.save-row'],
+                maintenance: ['div.notice', 'section.surface handoff', 'div.save-row'] }[hash]
+                ?? ['section.surface handoff', 'div.save-row']);
+        if (hash === 'overview') continue;
+        const handoff = layout.locator('section.handoff');
+        await expect(handoff.locator('h2')).toHaveText('Your current tools are ready');
+        expect(await handoff.locator('a.workspace-link').evaluateAll(links => links.map(link => link.getAttribute('href'))))
+            .toEqual(SYSTEM_HANDOFFS[hash] ?? ['/prompt_manager/admin']);
+        await expect(layout.locator('#settings-status')).toHaveText('No unsaved changes.');
+        await expect(page.locator('aside.sidebar a[href="#/system"]')).toHaveAttribute('aria-current', 'page');
+    }
+    // Deep links, reload and history keep the section; an unknown section is Overview under its own hash.
+    await page.reload();
+    await expect(nav.getByRole('button', { name: 'Diagnostics & logs', exact: true })).toHaveAttribute('aria-pressed', 'true');
+    await page.goBack();
+    await expect(page).toHaveURL(`${workspace}#/system/backups`);
+    await expect(nav.getByRole('button', { name: 'Backup & export', exact: true })).toHaveAttribute('aria-pressed', 'true');
+    await page.goto(`${workspace}#/system/general`);
+    await expect(page).toHaveURL(`${workspace}#/system/overview`);
+    await expect(nav.getByRole('button', { name: 'Overview', exact: true })).toHaveAttribute('aria-pressed', 'true');
+    // The sidebar's System returns to the Overview section.
+    await nav.getByRole('button', { name: 'Integrations', exact: true }).click();
+    await sidebarLink(page, 'System').click();
+    await expect(page).toHaveURL(`${workspace}#/system`);
+    await expect(nav.getByRole('button', { name: 'Overview', exact: true })).toHaveAttribute('aria-pressed', 'true');
+    // Leaving System and coming back renders it once, with a fresh section.
+    await sidebarLink(page, 'Images').click();
+    await expect(main.locator('h1')).toHaveText('Images');
+    await expect(main.locator('.section-nav')).toHaveCount(0);
+    await page.goBack();
+    await expect(main.locator('.section-nav')).toHaveCount(1);
+    await expect(main.locator('.settings-layout')).toHaveCount(1);
+    expect(mutations).toEqual([]);
+});
+
+test('Overview opens native System from its System card (Q12)', async ({ page }) => {
+    await page.goto(`${workspace}#/overview`);
+    const card = page.locator('#workspace-main .tool-card').filter({ has: page.getByRole('heading', { name: 'System', exact: true }) });
+    await expect(card.locator('p.small')).toHaveText('Configuration, maintenance and recovery—with browsing kept in the workspace.');
+    const link = card.getByRole('link', { name: 'Open System', exact: true });
+    await expect(link).toHaveAttribute('href', '#/system/overview');
+    await link.click();
+    await expect(page.locator('#workspace-main h1')).toHaveText('System');
+    await expect(page.locator('#workspace-main .section-nav [aria-pressed="true"]')).toHaveText('Overview');
+});
+
 // Task A3: the concept sidebar (index.html h16-41, app.js nav()) rendered from real data (D27, D28).
 const NAV_TOTALS = [
    ['images', 'Images', '/prompt_manager/images/output?mode=workspace&limit=1'],
@@ -11,6 +11,7 @@ the same sidebar counts (24 images, 6 prompts, 15 tags). Nothing is mocked.
 from __future__ import annotations

 from dataclasses import dataclass
+import datetime
 import json
 import math
 import os
@@ -157,6 +158,8 @@ CONCEPT_MODEL = "illustrative-model.safetensors"
 MAX_EXTRA_IMAGES = 120
 # Unlinked, seedless images (D11 "W × H · PNG") newer than the concept's, for D3 checks.
 MAX_SEEDLESS_IMAGES = 2
+# A test's chosen "now" (epoch seconds) stays before the year 3000.
+MAX_EPOCH_SECONDS = 32_503_680_000
 SEEDLESS_SIZE = (1536, 1152)
 # The same 4:3 shape with a short "96 × 72 · PNG" subtitle that stays on one line at
 # 390px beside the card's Info and Tag (the D3 footer check).
@@ -342,6 +345,17 @@ def _bounded(name: str, value: int, maximum: int) -> None:
        raise ValueError(f"{name} is out of range")


+def _instant(now: float | None) -> float:
+    """The fixture's one "now": ``now`` itself, or the wall clock when omitted."""
+    if now is None:
+        return time.time()
+    if isinstance(now, bool) or not isinstance(now, (int, float)):
+        raise TypeError("now must be a number of epoch seconds")
+    if not 0 < now < MAX_EPOCH_SECONDS:
+        raise ValueError("now is out of range")
+    return float(now)
+
+
 def seed_workspace_concept(
    api: PromptManagerAPI,
    root: Path,
@@ -349,9 +363,16 @@ def seed_workspace_concept(
    extra_images: int = 0,
    seedless_images: int = 0,
    short_seedless: bool = False,
+    now: float | None = None,
 ) -> dict:
    """Replace this server's disposable rows and files with the concept's data.

+    Every relative time the fixture writes (the prompts' last use, the files'
+    mtimes, the runs' observation times) is taken from one instant, ``now``
+    (epoch seconds, the wall clock when omitted), returned as ``manifest["now"]``.
+    A browser whose clock is fixed at that instant reads the concept's "Used
+    today" and caption day however close to midnight the run starts.
+
    ``extra_images`` continues the concept's rounds (same prompts, dimensions and
    seed rule) after its 24 images, for bounded-rendering and Load more checks.
    ``seedless_images`` adds unlinked PNGs without metadata, newest of all;
@@ -361,6 +382,10 @@ def seed_workspace_concept(
        raise TypeError("short_seedless must be a boolean")
    _bounded("extra_images", extra_images, MAX_EXTRA_IMAGES)
    _bounded("seedless_images", seedless_images, MAX_SEEDLESS_IMAGES)
+    now = _instant(now)
+    used_at = datetime.datetime.fromtimestamp(now, datetime.timezone.utc).isoformat(
+        timespec="microseconds"
+    )
    _clear(api, root)
    db = api.db
    epoch = db.get_execution_epoch()
@@ -385,8 +410,15 @@ def seed_workspace_concept(
        db.update_prompt_pair_metadata(pair_ids[0], title=first_name)
        for name, text in prompt.negatives[1:]:
            pair_ids.append(db.save_prompt_pair(prompt.positive, text, title=name))
-        # Real queue-hook counting (D23): four runs, the last one now.
+        # Real queue-hook counting (D23): four runs, the last one now, at the
+        # fixture's own instant rather than the database's later wall clock.
        db.record_prompt_use(positive_id, times=CONCEPT_RUN_COUNT)
+        with db.model.get_connection() as conn:
+            conn.execute(
+                "UPDATE prompts SET last_used_at = ? WHERE id = ?",
+                (used_at, positive_id),
+            )
+            conn.commit()
        prompts.insert(
            0, {"id": prompt.id, "positive_id": positive_id, "pair_ids": pair_ids}
        )
@@ -400,7 +432,6 @@ def seed_workspace_concept(
    favorite_root = _favorite_root_key(list(api._get_all_output_dirs())[0])
    total = len(CONCEPT_PROMPTS) * CONCEPT_IMAGE_ROUNDS + extra_images
    rounds = math.ceil(total / len(CONCEPT_PROMPTS))
-    now = time.time()
    images, runs = [], []
    slots = [
        (round_index, prompt_index, prompt)
@@ -484,6 +515,8 @@ def seed_workspace_concept(
    api.invalidate_gallery_cache()
    return {
        "epoch": epoch,
+        # The fixture's "now" (epoch seconds), for the browser's fixed clock.
+        "now": now,
        # The newest file's mtime (epoch seconds), for the D17 caption date.
        "newest_modified": now - 10 if seedless_images else now - 60,
        "seedless": seedless,
@@ -0,0 +1,116 @@
+"""System test hooks for the browser tests (#249 System S2 Task 6).
+
+The data is the concept-shaped real fixture (``POST /__test__/concept/reset``,
+``workspace_concept_fixture.py``): its parents, saved pairs, images, ratings
+and runs are what the Overview, the Statistics dialog and the health check
+read. These per-server hooks only change what a System test needs on top:
+
+- ``POST /__test__/system/reset`` restores the configured sources, forgets the
+  session's health report and ends every injected failure;
+- ``POST /__test__/system/fail`` ``{path, times}`` answers the next ``times``
+  requests for ``path`` (a ``/prompt_manager/system/`` route) with the routes'
+  500 error envelope;
+- ``POST /__test__/system/missing-source`` configures one more source that
+  does not exist (an unmounted drive);
+- ``POST /__test__/system/missing-file`` deletes the newest linked image's
+  file from disk, leaving its database row (a missing-file link);
+- ``POST /__test__/system/unthumbnailed`` ``{count}`` writes ``count`` plain
+  PNGs with no thumbnail into the output folder.
+
+Delays use the shared request holds (``request_hold.py``).
+"""
+
+import os
+from pathlib import Path
+
+from aiohttp import web
+from PIL import Image
+
+FAILABLE_PREFIX = "/prompt_manager/system/"
+MAX_UNTHUMBNAILED = 50
+
+
+def register_system_commands(app, routes, api, root: Path):
+    from py.config import GalleryConfig
+
+    configured = list(GalleryConfig.MONITORING_DIRECTORIES)
+    failures: dict[str, int] = {}
+
+    @web.middleware
+    async def inject_failures(request, handler):
+        left = failures.get(request.path, 0)
+        if left <= 0:
+            return await handler(request)
+        failures[request.path] = left - 1
+        return web.json_response(
+            {"success": False, "code": None, "error": "Injected failure"}, status=500
+        )
+
+    app.middlewares.append(inject_failures)
+
+    def reset():
+        failures.clear()
+        GalleryConfig.MONITORING_DIRECTORIES = list(configured)
+        api._health_report = None
+
+    @routes.post("/__test__/system/reset")
+    async def system_reset(request):
+        reset()
+        return web.json_response({"success": True})
+
+    @routes.post("/__test__/system/fail")
+    async def system_fail(request):
+        data = await request.json()
+        path, times = data.get("path"), data.get("times", 1)
+        if (
+            not isinstance(path, str)
+            or not path.startswith(FAILABLE_PREFIX)
+            or isinstance(times, bool)
+            or not isinstance(times, int)
+            or not 1 <= times <= 10
+        ):
+            raise web.HTTPBadRequest()
+        failures[path] = times
+        return web.json_response({"success": True})
+
+    @routes.post("/__test__/system/missing-source")
+    async def missing_source(request):
+        absent = str(root / "unmounted-drive")
+        if os.path.exists(absent):
+            raise web.HTTPConflict()
+        GalleryConfig.MONITORING_DIRECTORIES = [*configured, absent]
+        return web.json_response(
+            {"success": True, "configured": len(GalleryConfig.MONITORING_DIRECTORIES)}
+        )
+
+    @routes.post("/__test__/system/missing-file")
+    async def missing_file(request):
+        with api.db.model.get_connection() as conn:
+            row = conn.execute(
+                "SELECT file_path FROM generated_images ORDER BY id DESC LIMIT 1"
+            ).fetchone()
+        if row is None:
+            raise web.HTTPNotFound()
+        Path(row[0]).unlink()
+        api.invalidate_gallery_cache()
+        return web.json_response({"success": True, "filename": Path(row[0]).name})
+
+    @routes.post("/__test__/system/unthumbnailed")
+    async def unthumbnailed(request):
+        data = await request.json()
+        count = data.get("count")
+        if (
+            isinstance(count, bool)
+            or not isinstance(count, int)
+            or not 1 <= count <= MAX_UNTHUMBNAILED
+        ):
+            raise web.HTTPBadRequest()
+        folder = root / "output" / "unthumbnailed"
+        folder.mkdir(exist_ok=True)
+        for number in range(count):
+            with Image.new("RGB", (64, 64), "#2b3442") as image:
+                image.save(folder / f"plain_{number + 1:03}.png")
+        api.invalidate_gallery_cache()
+        return web.json_response({"success": True})
+
+    return reset
@@ -14,6 +14,11 @@
 //         the carrier rule alone, as the server selects from ffprobe's tag map.
 //         A {records} entry (records null = an unreadable file) answers
 //         {classified: null, result: null, metadata} for the projection alone.
+// A {mode: 'resolve'} entry (PR L3) answers {evidence}: resolveLocalEvidence of its {records} texts
+// with the repository semantics table. With a {path} it reads the file locally and also answers
+// {facts} (and {unreadable: true} with the server's unreadable evidence when nothing could be read):
+// extractGenerationFacts on the local payload through projectInspectionPayload, exactly as
+// tests/js/support/inspection-parity-facts.mjs reads the server's response for vectors.json.
 import fs from 'node:fs';
 import path from 'node:path';
 import { createRequire } from 'node:module';
@@ -28,6 +33,22 @@ const web = path.join(here, '..', '..', '..', 'web', 'js', 'workspace');
 const { selectVideoCarrier } = await import(moduleUrl(path.join(web, 'local-video.mjs')));
 const { projectMetadata } = await import(moduleUrl(path.join(web, 'local-projection.mjs')));
 const { readLocalFile, toInspectionRead } = await import(moduleUrl(path.join(web, 'local-inspection.mjs')));
+const { resolveLocalEvidence, compileSemantics, unreadableEvidence } = await import(moduleUrl(path.join(web, 'local-resolver.mjs')));
+const { buildLocalPayload } = await import(moduleUrl(path.join(web, 'local-inspection.mjs')));
+const { projectInspectionPayload } = await import(moduleUrl(path.join(web, 'inspection-state.mjs')));
+const semantics = compileSemantics(JSON.parse(fs.readFileSync(path.join(here, '..', '..', '..', 'web', 'js', 'inspection-semantics.json'), 'utf8')));
+const { extractGenerationFacts } = require(path.join(here, '..', '..', '..', 'web', 'js', 'comfy-metadata.js'));
+
+/** The local evidence for one set of record texts. */
+const resolved = records => ({ evidence: resolveLocalEvidence(records, semantics) });
+
+/** The local wire's evidence and six facts for one read (no legacy fill, as in the vectors' own harness). */
+function localPayload(read, file, classification) {
+    const payload = buildLocalPayload({ read, file, classification, semantics });
+    const record = projectInspectionPayload(payload, { kind: 'local-file', key: 'local:1', path: file.name }, null, extractGenerationFacts);
+    const facts = Object.fromEntries(Object.entries(record.generation).map(([field, fact]) => [field, { status: fact.status, value: fact.value }]));
+    return { evidence: { prompts: payload.prompts, resolution: payload.resolution }, facts };
+}

 const selectionRead = (selection) => selection.status === 'complete' ?
    { records: selection.records, record_formats: selection.record_formats, carrierText: selection.carrierText, limited: selection.limited } : null;
@@ -37,6 +58,19 @@ for await (const chunk of process.stdin) chunks.push(chunk);
 const output = {};
 for (const entry of JSON.parse(Buffer.concat(chunks).toString('utf8'))) {
    const { name } = entry;
+    if (entry.mode === 'resolve') {
+        if (entry.records !== undefined) { output[name] = resolved(entry.records); continue; }
+        const blob = await fs.openAsBlob(entry.path);
+        const { classification, result } = await readLocalFile(blob, { pngMetadata });
+        const read = classification === null ? null : toInspectionRead(classification, result).read;
+        if (classification === null) { output[name] = { unreadable: true }; continue; }
+        // The evidence is the local wire's own (buildLocalPayload), and it equals resolveLocalEvidence of the records.
+        const local = localPayload(result, { name: path.basename(entry.path), size: blob.size }, classification);
+        const direct = read === null ? unreadableEvidence() : resolved(read.records).evidence;
+        if (JSON.stringify(direct) !== JSON.stringify(local.evidence)) throw new Error(`${name}: the wire's roles are not the resolver's`);
+        output[name] = read === null ? { unreadable: true, ...local } : local;
+        continue;
+    }
    if (entry.records !== undefined) {
        const read = entry.records === null ? null : {
            records: entry.records,
@@ -182,6 +182,24 @@ test('start returns busy with the running job', async () => {
    world.dispose();
 });

+test('track follows a job another route started, with no read of its own', async () => {
+    const { createActivityStore } = await source;
+    const { world, ...deps } = harness();
+    const store = createActivityStore(deps);
+    const seen = [];
+    store.subscribe(() => seen.push(store.find(ID_A)?.state));
+    const job = store.track(summary({ kind: 'health', title: 'Health check' }));
+    assert.equal(job.id, ID_A);
+    assert.equal(world.gets, 0, 'the started job is known without a list read');
+    assert.deepEqual(world.open().map(stream => stream.url), [`/prompt_manager/jobs/${ID_A}/events`]);
+    assert.deepEqual(world.toasts, [], 'the route that started it says so itself');
+    send(world.open()[0], summary({ kind: 'health', title: 'Health check', state: 'finished', progress: 100 }));
+    assert.deepEqual(seen, ['running', 'finished']);
+    assert.equal(world.open().length, 0, 'an ended job is no longer followed');
+    assert.throws(() => store.track({ id: 'nope' }), /Invalid job/);
+    world.dispose();
+});
+
 test('a list that is not a job list counts as a failed read', async () => {
    const { createActivityStore } = await source;
    const { world, api, ...deps } = harness();
@@ -215,3 +215,151 @@ test('none and unavailable render no image chips', async () => {
        assert.deepEqual(inspectorTagChips(tagged({state, tags:[]}, {status:'none', tags:[], tags_scope:null}), {filterable:true}), []);
    }
 });
+
+// LI-4 (D117): "Copy settings summary" after the six facts of the full inspector consolidates the legacy metadata
+// page's COPY ALL (web/metadata.html copyAllData). The legacy template is read from that page itself and run on the
+// legacy parse, so the summary's text is the legacy page's, line for line, wherever the two agree on the values.
+const METADATA_PAGE = fs.readFileSync(new URL('../../web/metadata.html', import.meta.url), 'utf8');
+function legacyCopyAll(params) {
+    const template = METADATA_PAGE.match(/const allData = `([\s\S]*?)`;/)[1];
+    return new Function('currentWorkflowData', `return \`${template}\`;`)(params);
+}
+const legacyParams = record => ComfyMetadata.extractGenerationParams({prompt:record.metadata.prompt_graph.status === 'parsed' ? record.metadata.prompt_graph.value : null,
+    workflow:record.metadata.workflow_graph.status === 'parsed' ? record.metadata.workflow_graph.value : null});
+
+/**
+ * Each summary line against the legacy page's, allowing only the recorded differences (D117): a number keeps the
+ * inspector's (the server's) spelling ("8.0" where the legacy page wrote 8); a fact the legacy parse left "Unknown" may
+ * be known; and a negative the #249 ZeroOut guard zeroed reads "No negative prompt found" where the legacy parse read
+ * the positive's text through the zero-out.
+ */
+function assertLegacySummary(summary, legacy, record) {
+    const lines = summary.split('\n'), expected = legacy.split('\n');
+    assert.deepEqual(lines.map(line => line.split(':')[0]), expected.map(line => line.split(':')[0]), 'the legacy labels, in order');
+    lines.forEach((line, index) => {
+        if (line === expected[index]) return;
+        const [label, value] = [line.slice(0, line.indexOf(': ')), line.slice(line.indexOf(': ') + 2)];
+        const old = expected[index].slice(label.length + 2);
+        if (label === 'Negative Prompt' && record.prompts.negative?.source === 'zeroed-conditioning' && value === 'No negative prompt found') return;
+        if (old === 'Unknown' && !/Prompt$/.test(label)) return;
+        assert.ok(value.trim() !== '' && Number(value) === Number(old), `${label}: "${value}" differs from the legacy "${old}"`);
+    });
+}
+
+test('settings summary is the legacy COPY ALL text for a local file', async () => {
+    const {settingsSummary} = await load();
+    assert.equal(typeof settingsSummary, 'function', 'settingsSummary is exported');
+    const record = await localRecord(localPng('fox.png'));
+    assertLegacySummary(settingsSummary(record), legacyCopyAll(legacyParams(record)), record);
+    assert.equal(settingsSummary(record), ['Checkpoint: synthetic-v1.safetensors', 'Positive Prompt: a red fox in snow, detailed fur',
+        'Negative Prompt: blurry, lowres', 'Steps: 20', 'CFG Scale: 8.0', 'Sampler: euler', 'Seed: 7'].join('\n'));
+    // Every parity PNG read in this browser: the legacy page's text but for the recorded differences, and exactly the
+    // legacy text for most of them (f09 among them: the server is ambiguous, so the record shows the legacy fill).
+    const exact = [];
+    for (const name of fs.readdirSync(PARITY).filter(item => item.endsWith('.png')).sort()) {
+        const parity = await localRecord(new File([fs.readFileSync(new URL(name, PARITY))], name));
+        const summary = settingsSummary(parity), legacy = legacyCopyAll(legacyParams(parity));
+        assertLegacySummary(summary, legacy, parity);
+        if (summary === legacy) exact.push(name);
+    }
+    assert.ok(exact.includes('f09.png'));
+    assert.deepEqual(fs.readdirSync(PARITY).filter(item => item.endsWith('.png') && !exact.includes(item)).sort(), ['f01b.png', 'f17.png', 'f23.png']);
+});
+
+test('settings summary uses the legacy placeholders for what the record does not know', async () => {
+    const {settingsSummary} = await load();
+    const unknown = {...record(), prompts:{positive:{status:'unresolved'}, negative:{status:'ambiguous'}}, generation:{}};
+    assert.equal(settingsSummary(unknown), legacyCopyAll({}).replace('Positive Prompt: undefined', 'Positive Prompt: No prompt found')
+        .replace('Negative Prompt: undefined', 'Negative Prompt: No negative prompt found'));
+    assert.equal(settingsSummary(unknown), ['Checkpoint: Unknown', 'Positive Prompt: No prompt found', 'Negative Prompt: No negative prompt found',
+        'Steps: Unknown', 'CFG Scale: Unknown', 'Sampler: Unknown', 'Seed: Unknown'].join('\n'));
+    // A server answer is shown as the inspector shows it: known facts verbatim, every other state the legacy "Unknown".
+    const server = {...record(), prompts:{positive:{status:'resolved', text:'a\n猫'}, negative:{status:'resolved', text:''}}, generation:{
+        model:{status:'known', value:'m.safetensors'}, steps:{status:'not-recorded', value:null}, cfg:{status:'known', value:'6.50'},
+        sampler:{status:'ambiguous', value:null}, seed:{status:'known', value:'9007199254740993'}, scheduler:{status:'known', value:'karras'}}};
+    assert.equal(settingsSummary(server), ['Checkpoint: m.safetensors', 'Positive Prompt: a\n猫', 'Negative Prompt: No negative prompt found',
+        'Steps: Unknown', 'CFG Scale: 6.50', 'Sampler: Unknown', 'Seed: 9007199254740993'].join('\n'));
+});
+
+/** The full inspector with a toast node and `clipboard` as `navigator.clipboard`; returns the summary button. */
+function renderSummary(record, {variant = 'full', clipboard} = {}) {
+    const f = mountedDom(), scope = createScope(), fallbacks = [], toast = new f.Node('div');
+    f.doc.getElementById = id => id === 'workspace-toast' ? toast : null;
+    const previous = Object.getOwnPropertyDescriptor(globalThis, 'navigator');
+    Object.defineProperty(globalThis, 'navigator', {configurable:true, value:clipboard === undefined ? {} : {clipboard}});
+    const view = mountFileInspector(f.container, {sender:{open() {}}, parentScope:scope, variant, copyFallback:(text, options) => fallbacks.push({text, ...options})});
+    view.setState({loading:false, error:false, record});
+    const button = f.walk(f.container, n => n.tagName === 'button' && n.textContent === 'Copy settings summary')[0] ?? null;
+    return {f, button, toast, fallbacks, scope, done() {
+        view.dispose(); scope.dispose(); f.restore();
+        if (previous) Object.defineProperty(globalThis, 'navigator', previous); else delete globalThis.navigator;
+    }};
+}
+
+test('Copy settings summary follows the facts in the full inspector only', async () => {
+    const full = renderSummary(record());
+    try {
+        assert.ok(full.button, 'the full inspector offers Copy settings summary');
+        const inner = full.button.parent, index = inner.children.indexOf(full.button);
+        assert.equal(inner.children[index - 1].tagName, 'dl', 'it follows the six facts');
+        assert.equal(inner.children[index + 1].tagName, 'details', 'File & provenance follows it');
+        // M7: the D117 wrap rule targets this button by its class, never any button of a details block.
+        assert.equal(full.button.className, 'settings-summary');
+    } finally { full.done(); }
+    const panel = renderSummary(record(), {variant:'panel'});
+    try { assert.equal(panel.button, null, 'the Images side panel keeps the concept footer'); } finally { panel.done(); }
+});
+
+test('Copy settings summary copies the summary and shows the shared toast', async () => {
+    const {settingsSummary} = await load(), copied = [];
+    const view = renderSummary(record(), {clipboard:{writeText:async text => {copied.push(text);}}});
+    try {
+        await view.button.listeners.get('click')[0].callback({target:view.button});
+        assert.deepEqual(copied, [settingsSummary(record())]);
+        assert.equal(view.toast.textContent, 'Settings summary copied.');
+        assert.equal(view.fallbacks.length, 0);
+    } finally { view.done(); }
+});
+
+test('Copy settings summary without a clipboard opens the select-to-copy fallback', async () => {
+    const {settingsSummary} = await load();
+    for (const clipboard of [undefined, {writeText:async () => {throw new Error('Denied');}}]) {
+        const view = renderSummary(record(), {clipboard});
+        try {
+            await view.button.listeners.get('click')[0].callback({target:view.button});
+            assert.equal(view.fallbacks.length, 1);
+            assert.equal(view.fallbacks[0].text, settingsSummary(record()));
+            assert.equal(view.fallbacks[0].title, 'Copy settings summary');
+            assert.equal(view.fallbacks[0].trigger, view.button);
+            assert.notEqual(view.toast.textContent, 'Settings summary copied.');
+        } finally { view.done(); }
+    }
+});
+
+test('the inspector is busy while a read is loading, then not', async () => {
+    const f = mountedDom(), scope = createScope();
+    const view = mountFileInspector(f.container, {sender:{open() {}}, parentScope:scope, variant:'full'});
+    try {
+        view.setState({loading:true, error:false, record:null});
+        assert.equal(f.container.getAttribute('aria-busy'), 'true');
+        assert.ok(f.walk(f.container, n => n.textContent === 'Loading file details…').length);
+        view.setState({loading:false, error:false, record:record()});
+        assert.equal(f.container.getAttribute('aria-busy'), null);
+        view.setState({loading:true, error:false, record:null});
+        view.setState({loading:false, error:true, record:null});
+        assert.equal(f.container.getAttribute('aria-busy'), null);
+        view.setState({loading:true, error:false, record:null});
+    } finally {
+        view.dispose();
+        assert.equal(f.container.getAttribute('aria-busy'), null, 'dispose clears the busy state');
+        scope.dispose(); f.restore();
+    }
+});
+
+test('the D117 wrap rule targets only the settings summary button', async () => {
+    const fs = await import('node:fs');
+    const css = fs.readFileSync(new URL('../../web/js/workspace/workspace.css', import.meta.url), 'utf8');
+    const rules = css.split('\n').filter(line => line.includes('D117'));
+    assert.deepEqual(rules.map(line => line.trim()), ['.ca-tools #viewer-details .settings-summary { white-space: normal; /* D117 */ }']);
+    assert.doesNotMatch(css, /#viewer-details > div > button/);
+});
@@ -20,6 +20,16 @@ const { extractGenerationFacts } = ComfyMetadata;
 // The page loads both as scripts; the legacy fill and the PNG reader find them on the global.
 globalThis.PngMetadata = PngMetadata;
 globalThis.ComfyMetadata = ComfyMetadata;
+// The page's API client and the node table it serves (local-semantics.mjs fetches it once).
+const SEMANTICS = fs.readFileSync(path.join(here, "..", "..", "web", "js", "inspection-semantics.json"), "utf8");
+globalThis.window = { ApiClient: { resolveUrl: (value) => value } };
+// A test can hold the table request (`tableGate`) to stand for a slow or stalled proxy.
+let tableGate = null;
+globalThis.fetch = async (url) => {
+    if (url !== "/prompt_manager/js/inspection-semantics.json") throw new Error(`unexpected request ${url}`);
+    if (tableGate) await tableGate;
+    return new Response(SEMANTICS, { status: 200 });
+};
 const m = await import("../../web/js/workspace/local-inspection.mjs").catch((error) => {
    if (error.code !== "ERR_MODULE_NOT_FOUND") throw error;
    return {};
@@ -59,6 +69,37 @@ test("contract", () => {
    assert.ok(Object.isFrozen(m.localFileAdapter));
 });

+// M3: the first read waits for the page's one table request; an aborted, replaced or cleared selection must not.
+test("a read waiting for the node table ends with its selection", async () => {
+    let release;
+    tableGate = new Promise((resolve) => { release = resolve; });
+    try {
+        const file = pngFile("slow.png", [tEXt("prompt", PROMPT)]);
+        const aborted = new AbortController();
+        const reading = m.localFileAdapter.read(await handleFor(file), { signal: aborted.signal });
+        const settled = (promise) => Promise.race([promise.then(() => "resolved", (error) => error.name), new Promise((resolve) => setTimeout(() => resolve("pending"), 200))]);
+        await new Promise((resolve) => setTimeout(resolve, 20));
+        aborted.abort();
+        assert.equal(await settled(reading), "AbortError");
+        // Through the controller: clearing the selection ends its read; nothing is published for it.
+        const controller = createInspectionController({ api: null, adapter: m.localFileAdapter, extractFacts: extractGenerationFacts });
+        const states = [];
+        controller.subscribe((state) => states.push(state));
+        const selected = controller.select(await handleFor(file));
+        await new Promise((resolve) => setTimeout(resolve, 20));
+        controller.clear();
+        assert.equal(await settled(selected), "resolved");
+        assert.ok(states.every((state) => state.record === null && state.error === false), "no record or error for a cleared selection");
+        controller.dispose();
+    } finally {
+        tableGate = null;
+        release();
+    }
+    // The shared request still lands for the next selection.
+    const { wire } = await recordFor(pngFile("next.png", [tEXt("prompt", PROMPT)]));
+    assert.equal(wire.resolution.state, "resolved");
+});
+
 test("a PNG File becomes the server-shaped wire with local provenance", async () => {
    const file = pngFile("Fox Render.PNG", [tEXt("prompt", PROMPT), tEXt("workflow", WORKFLOW)]);
    const { wire, record, handle } = await recordFor(file);
@@ -66,8 +107,12 @@ test("a PNG File becomes the server-shaped wire with local provenance", async ()
        size: file.size, width: 640, height: 480, modified_time: 1_700_000_000.123 });
    assert.equal(wire.success, true);
    assert.equal(wire.inspection_version, 1);
-    assert.deepEqual(wire.prompts, { positive: { status: "unresolved" }, negative: { status: "unresolved" } });
-    assert.deepEqual(wire.resolution, { state: "unresolved", sampler_id: null, reason: "Resolved in this browser from the workflow.", reason_code: null, node: null });
+    // The roles the server's inspector resolves for the same records (local-resolver.mjs).
+    assert.deepEqual(wire.prompts, {
+        positive: { status: "resolved", text: "a red fox in snow, detailed fur", source: "graph-inferred" },
+        negative: { status: "resolved", text: "blurry, lowres", source: "graph-inferred" },
+    });
+    assert.deepEqual(wire.resolution, { state: "resolved", sampler_id: "3", reason: "", reason_code: null, node: null });
    assert.deepEqual(wire.library, { status: "unavailable", scope: "saved-library", tags: [], category_scope: null, tags_scope: null });
    assert.equal(wire.metadata.status, "available");
    assert.deepEqual(wire.metadata.raw, { prompt: PROMPT, workflow: WORKFLOW });
@@ -96,6 +141,33 @@ test("a PNG File becomes the server-shaped wire with local provenance", async ()
    assert.equal(exported.file.source_label, "Selected local file");
 });

+test("roles answer as the server's inspector: unreadable, unavailable table, ambiguous", async () => {
+    const png = { media: "image", kind: "png" };
+    const unreadable = m.buildLocalPayload({ read: null, file: { name: "a.png" }, classification: png });
+    assert.deepEqual(unreadable.resolution, { state: "unresolved", sampler_id: null, reason: "Media metadata could not be read", reason_code: null, node: null });
+    assert.equal(unreadable.prompts.positive.message, "Metadata in this file could not be read.");
+    const records = { prompt: PROMPT };
+    const read = { status: "complete", records, limited: [], width: 2, height: 3 };
+    // Without a table (it could not be fetched) the roles stay open, with the server's own line.
+    const missing = m.buildLocalPayload({ read, file: { name: "a.png" }, classification: png });
+    assert.equal(missing.resolution.reason, "Inspection node semantics are unavailable");
+    assert.equal(missing.prompts.positive.message, "The inspector's node table is unavailable.");
+    const semantics = await (await import("../../web/js/workspace/local-semantics.mjs")).loadInspectionSemantics();
+    const graph = JSON.parse(PROMPT);
+    graph["9"] = { ...graph["3"], inputs: { ...graph["3"].inputs, positive: ["8", 0] } };
+    graph["8"] = { class_type: "CLIPTextEncode", inputs: { text: "a cat", clip: ["4", 1] } };
+    const several = m.buildLocalPayload({ read: { ...read, records: { prompt: JSON.stringify(graph) } }, file: { name: "a.png" }, classification: png, semantics });
+    assert.equal(several.resolution.reason, "Multiple sampler branches");
+    assert.deepEqual(several.prompts.positive, { status: "ambiguous", text: null, source: null });
+    // The legacy fill then applies exactly as it does to the server's answer for the same bytes in Images.
+    const handle = await handleFor(pngFile("grid.png", [tEXt("prompt", JSON.stringify(graph))]));
+    const local = m.localFileAdapter.toRecord(several, handle, extractGenerationFacts);
+    const asServed = { ...several, file: { ...several.file, observation: "current-file", source_label: "output" } };
+    const served = projectInspectionPayload(asServed, { kind: "rooted-file", key: "0:grid.png", root_index: 0, path: "grid.png", root_scope: null }, null, extractGenerationFacts);
+    assert.deepEqual(local.prompts, served.prompts);
+    assert.deepEqual(local.generation, served.generation);
+});
+
 test("file facts follow the server: extension like Path.suffix, null when unknown", async () => {
    const cases = [["a.b.PnG", ".png"], [".hidden", ""], ["noext", ""], ["dot.", ""], ["x.tar.gz", ".gz"]];
    for (const [name, extension] of cases) {
@@ -307,3 +379,89 @@ test("the parity corpus PNGs read into renderable records", async () => {
        assert.ok(["parsed", "limited", "malformed"].includes(wire.metadata.prompt_graph.status));
    }
 });
+
+// M4: resolution runs on the page's main thread, so a read yields between its bounded steps (the busy state paints
+// and input is handled) and no step may exceed a budget on the largest record the readers keep (2 MiB of roles).
+const ROLE_BYTES = 2 * 1024 * 1024;
+// Generous for a shared CI runner: a desktop resolves these in 130-455 ms.
+const STEP_BUDGET_MS = 2500;
+const ENCODE = (text) => ({ class_type: "CLIPTextEncode", inputs: { text, clip: ["4", 1] } });
+const KSAMPLER = (positive, negative, latent) => ({ class_type: "KSampler", inputs: { seed: 1, steps: 20, cfg: 8.0, sampler_name: "euler", scheduler: "normal",
+    denoise: 1.0, model: ["4", 0], positive, negative, latent_image: latent } });
+const LOADERS = { "4": { class_type: "CheckpointLoaderSimple", inputs: { ckpt_name: "m.safetensors" } }, "5": { class_type: "EmptyLatentImage", inputs: { width: 64, height: 64, batch_size: 1 } } };
+/** The largest graph of this shape whose JSON fits the role budget. */
+function maximal(build, high) {
+    let low = 1;
+    while (low < high) {
+        const middle = (low + high + 1) >> 1;
+        if (Buffer.byteLength(JSON.stringify(build(middle)), "utf8") <= ROLE_BYTES) low = middle;
+        else high = middle - 1;
+    }
+    return JSON.stringify(build(low));
+}
+const MAXIMAL_GRAPHS = {
+    // Many candidates: every sampler is a final stage with its own pair.
+    independent: maximal((count) => {
+        const graph = { ...LOADERS };
+        for (let index = 0; index < count; index++) {
+            graph[`s${index}`] = KSAMPLER([`p${index}`, 0], [`n${index}`, 0], ["5", 0]);
+            graph[`p${index}`] = ENCODE(`fox ${index}`);
+            graph[`n${index}`] = ENCODE(`blur ${index}`);
+        }
+        return graph;
+    }, 6666),
+    // One long stage chain through the latent: the deepest stage walk.
+    chain: maximal((count) => {
+        const graph = { ...LOADERS, "6": ENCODE("fox"), "7": ENCODE("blur") };
+        for (let index = 0; index < count; index++) graph[`s${index}`] = KSAMPLER(["6", 0], ["7", 0], index ? [`s${index - 1}`, 0] : ["5", 0]);
+        return graph;
+    }, 19996),
+};
+
+test("resolution of a maximal 2 MiB graph stays within the step budget", async () => {
+    const { resolveLocalEvidence } = await import("../../web/js/workspace/local-resolver.mjs");
+    const semantics = await (await import("../../web/js/workspace/local-semantics.mjs")).loadInspectionSemantics();
+    for (const [name, prompt] of Object.entries(MAXIMAL_GRAPHS)) {
+        assert.ok(Buffer.byteLength(prompt, "utf8") > ROLE_BYTES - 1024, `${name} fills the role budget`);
+        const started = performance.now();
+        const evidence = resolveLocalEvidence({ prompt }, semantics);
+        const elapsed = performance.now() - started;
+        assert.ok(elapsed < STEP_BUDGET_MS, `${name}: ${Math.round(elapsed)} ms`);
+        assert.notEqual(evidence.resolution.reason_code, "malformed", name);
+    }
+});
+
+test("a read yields between bounded steps and answers byte for byte as one synchronous build", async () => {
+    const semantics = await (await import("../../web/js/workspace/local-semantics.mjs")).loadInspectionSemantics();
+    const file = pngFile("maximal.png", [tEXt("prompt", MAXIMAL_GRAPHS.independent)]);
+    const handle = await handleFor(file);
+    const marks = [];
+    const yieldControl = async (signal) => {
+        signal?.throwIfAborted();
+        marks.push(performance.now());
+        await new Promise((resolve) => setTimeout(resolve, 0));
+    };
+    const started = performance.now();
+    const wire = await m.localFileAdapter.read(handle, { signal: new AbortController().signal, yieldControl });
+    marks.push(performance.now());
+    // Resolution and the projection each run in a turn of their own after the table is in.
+    assert.ok(marks.length >= 3, `yields: ${marks.length - 1}`);
+    const gaps = marks.map((mark, index) => mark - (index ? marks[index - 1] : started));
+    assert.ok(Math.max(...gaps) < STEP_BUDGET_MS, `longest step ${Math.round(Math.max(...gaps))} ms`);
+    const { result } = await m.readLocalFile(file, { classification: handle.classification });
+    const direct = await m.fitLocalPayload(m.buildLocalPayload({ read: result, file: { name: handle.filename, size: file.size, lastModified: file.lastModified },
+        classification: handle.classification, semantics }));
+    assert.equal(JSON.stringify(wire), JSON.stringify(direct));
+    assert.equal(wire.resolution.state, "ambiguous");
+    // An abort at any yield ends the read there.
+    for (let stop = 0; stop < marks.length - 1; stop++) {
+        const controller = new AbortController();
+        let seen = 0;
+        const stopping = async (signal) => {
+            if (seen++ === stop) controller.abort();
+            signal.throwIfAborted();
+            await new Promise((resolve) => setTimeout(resolve, 0));
+        };
+        await assert.rejects(m.localFileAdapter.read(handle, { signal: controller.signal, yieldControl: stopping }), { name: "AbortError" }, `yield ${stop}`);
+    }
+});
@@ -0,0 +1,161 @@
+// PR L3 Tasks 8-9: the server's inspection resolver in this browser. The values below are what CPython answers
+// (json.loads, len, str.strip, repr, utils/prompt_inspector.inspect_prompt_evidence); the full comparison with the
+// server runs in tests/test_local_inspect_parity.py through tests/js/support/local-inspect-oracle.mjs.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+
+const py = await import('../../web/js/workspace/py-json.mjs');
+const resolver = await import('../../web/js/workspace/local-resolver.mjs');
+const semantics = resolver.compileSemantics(JSON.parse(fs.readFileSync(new URL('../../web/js/inspection-semantics.json', import.meta.url), 'utf8')));
+
+test('json.loads keeps Python value kinds and dict order', () => {
+    const value = py.pyJsonLoads('{"9": 1, "10": 1.0, "a": NaN, "9": [true, -0, 9007199254740993, -Infinity]}');
+    assert.ok(value instanceof Map);
+    // A repeated key keeps its first position and takes its last value; integer-like keys keep text order.
+    assert.deepEqual([...value.keys()], ['9', '10', 'a']);
+    const [flag, zero, big, negative] = value.get('9');
+    assert.equal(flag, true); assert.equal(zero, 0); assert.equal(big, 9007199254740993n);
+    assert.ok(negative instanceof py.PyFloat); assert.equal(negative.value, -Infinity);
+    assert.ok(value.get('10') instanceof py.PyFloat, '1.0 is a float, not an int');
+    assert.ok(Number.isNaN(value.get('a').value));
+    assert.equal(py.isInt(value.get('10')), false);
+    assert.equal(py.pyJsonLoads('"\\ud83d\\ude00\\ud800"'), '\u{1f600}\ud800');
+    for (const bad of ['{}', '{"a":1,}', '[01]', '{"a" 1}', '"\u0001"', '"\\x"', '1 2', '-', `${'9'.repeat(4301)}`, '"\\ud800\\uzzzz"']) {
+        assert.throws(() => py.pyJsonLoads(bad), py.PyValueError, bad);
+    }
+    assert.equal(py.pyJsonLoads(` ${'9'.repeat(4300)}\n`), BigInt('9'.repeat(4300)));
+});
+
+// One depth cap for both browser CPython-JSON parsers (py-json.mjs here, local-video.mjs for video envelopes): every
+// array or object counts, an empty one too, as CPython's scanner enters recursion for each; past the cap it refuses.
+test('json.loads refuses nesting past the shared depth cap, counting every container', () => {
+    const video = import('../../web/js/workspace/local-video.mjs');
+    assert.equal(py.JSON_MAX_DEPTH, 1000);
+    const nest = (depth, inner = '') => '['.repeat(depth) + inner + ']'.repeat(depth);
+    const objects = (depth, inner) => '{"a":'.repeat(depth) + inner + '}'.repeat(depth);
+    for (const text of [nest(1000), nest(1000, '1'), nest(999, '{}'), objects(1000, '1'), objects(999, '[]')]) assert.doesNotThrow(() => py.pyJsonLoads(text));
+    for (const text of [nest(1001), nest(1001, '1'), nest(1000, '{}'), objects(1001, '1'), objects(1000, '[]')]) {
+        assert.throws(() => py.pyJsonLoads(text), py.PyValueError);
+    }
+    return video.then(({ pythonJsonLoads, PythonJsonError }) => {
+        for (const text of [nest(1000), nest(1000, '1'), objects(999, '[]')]) assert.doesNotThrow(() => pythonJsonLoads(text));
+        for (const text of [nest(1001), nest(1001, '1'), objects(1000, '[]')]) {
+            assert.throws(() => pythonJsonLoads(text), error => error instanceof PythonJsonError && error.recursion === true);
+        }
+    });
+});
+
+test('str helpers measure, slice and strip as CPython', () => {
+    assert.equal(py.pyLen('a\u{1f600}\ud800'), 3);
+    assert.equal(py.pySlice('\u{1f600}\u{1f600}x', 2), '\u{1f600}\u{1f600}');
+    // str.isspace() includes \x1c-\x1f and \x85 and excludes , unlike String.prototype.trim.
+    assert.equal(py.pyStrip('\x1c\x85 a b　\x1f'), 'a b');
+    assert.equal(py.pyStrip('a'), 'a');
+    assert.deepEqual([1.0, 0.0001, 1e-5, 1e16, 123456789012345.6, -2.5, 1e22].map(py.pyFloatRepr),
+        ['1.0', '0.0001', '1e-05', '1e+16', '123456789012345.6', '-2.5', '1e+22']);
+    assert.deepEqual([null, true, 0, 1n, new py.PyFloat(2), '', [], new Map()].map(py.pyTruthy), [false, true, false, true, true, false, false, false]);
+    assert.deepEqual([1, 1n, true, new py.PyFloat(1), '1', 2].map(py.pyEqualsOne), [true, true, true, true, false, false]);
+});
+
+const encode = text => ({class_type: 'CLIPTextEncode', inputs: {text, clip: ['4', 1]}});
+const sampler = (extra = {}) => ({class_type: 'KSampler', inputs: {seed: 1, positive: ['6', 0], negative: ['7', 0], latent_image: ['5', 0], model: ['4', 0], ...extra}});
+const base = (nodes = {}) => ({'3': sampler(), '4': {class_type: 'CheckpointLoaderSimple', inputs: {ckpt_name: 'm.safetensors'}},
+    '5': {class_type: 'EmptyLatentImage', inputs: {width: 64, height: 64, batch_size: 1}}, '6': encode('a fox'), '7': encode('blurry'), ...nodes});
+
+test('a single chain resolves both roles with their sources', () => {
+    const evidence = resolver.resolveLocalEvidence({prompt: JSON.stringify(base())}, semantics);
+    assert.deepEqual(evidence, {
+        prompts: {positive: {status: 'resolved', text: 'a fox', source: 'graph-inferred'}, negative: {status: 'resolved', text: 'blurry', source: 'graph-inferred'}},
+        resolution: {state: 'resolved', sampler_id: '3', reason: '', reason_code: null, node: null},
+    });
+});
+
+test('records without roles, malformed text and a missing sampler answer as the server', () => {
+    assert.deepEqual(resolver.resolveLocalEvidence({workflow: '{}'}, semantics).resolution,
+        {state: 'absent', sampler_id: null, reason: 'No parsed prompt metadata', reason_code: null, node: null});
+    const malformed = resolver.resolveLocalEvidence({prompt: '{broken'}, semantics);
+    assert.equal(malformed.resolution.reason, 'Prompt evidence is malformed');
+    assert.equal(malformed.prompts.positive.message, 'Prompt metadata in this file is malformed.');
+    const none = resolver.resolveLocalEvidence({prompt: JSON.stringify({'1': encode('x'), '2': {class_type: 'MySampler', inputs: {positive: ['1', 0]}}})}, semantics);
+    assert.deepEqual(none.resolution, {state: 'unresolved', sampler_id: null, reason: 'No supported sampler pair found (saw MySampler)', reason_code: 'no-sampler', node: null});
+    assert.equal(none.prompts.negative.message, 'No supported sampler was found.');
+    assert.equal(resolver.resolveLocalEvidence({prompt: JSON.stringify(base()), parameters: 'x'}, null).resolution.reason, 'Inspection node semantics are unavailable');
+});
+
+test('a float output slot is not a link, and a runtime node is named', () => {
+    const floatSlot = resolver.resolveLocalEvidence({prompt: JSON.stringify(base()).replace('"positive":["6",0]', '"positive":["6",0.0]')}, semantics);
+    assert.deepEqual(floatSlot.resolution, {state: 'unresolved', sampler_id: '3', reason: 'Expected a typed graph link or text input', reason_code: 'malformed', node: null});
+    const runtime = resolver.resolveLocalEvidence({prompt: JSON.stringify(base({'6': {class_type: 'PromptSearchList', inputs: {}}}))}, semantics);
+    assert.deepEqual(runtime.resolution.node, {id: '6', class_type: 'PromptSearchList'});
+    assert.equal(runtime.prompts.positive.message, 'Prompt is chosen at run time (PromptSearchList).');
+});
+
+test('execution evidence replaces a PromptManagerPair text when it matches the node inputs', () => {
+    const pair = {class_type: 'PromptManagerPair', inputs: {text: 'fox', negative_text: 'blur', prepend_text: '', append_text: ''}};
+    const record = {text: 'fox', negative_text: 'blur', positive_text: 'fox, executed', negative_effective_text: 'blur', prepend_text: '', append_text: ''};
+    const graph = base({'3': sampler({positive: ['8', 0], negative: ['8', 1]}), '8': pair});
+    const evidence = resolver.resolveLocalEvidence({prompt: JSON.stringify(graph), comfyassets_prompt_pairs: JSON.stringify({version: 1, nodes: {'8': {records: [record]}}})}, semantics);
+    assert.deepEqual(evidence.prompts.positive, {status: 'resolved', text: 'fox, executed', source: 'execution'});
+    const stale = resolver.resolveLocalEvidence({prompt: JSON.stringify(graph), comfyassets_prompt_pairs: JSON.stringify({version: 1, nodes: {'8': {records: [{...record, text: 'other'}]}}})}, semantics);
+    assert.equal(stale.resolution.reason, 'Execution evidence does not match recorded node inputs');
+});
+
+test('identical sampler branches resolve to their shared pair, differing ones stay ambiguous (#270)', () => {
+    const shared = resolver.resolveLocalEvidence({prompt: JSON.stringify(base({'9': sampler()}))}, semantics);
+    assert.deepEqual(shared.resolution, {state: 'resolved', sampler_id: null, reason: 'Every sampler branch uses the same prompt pair', reason_code: null, node: null});
+    assert.equal(shared.prompts.positive.text, 'a fox');
+    const differ = resolver.resolveLocalEvidence({prompt: JSON.stringify(base({'9': sampler({positive: ['8', 0]}), '8': encode('a cat')}))}, semantics);
+    assert.deepEqual(differ.resolution, {state: 'ambiguous', sampler_id: null, reason: 'Multiple sampler branches', reason_code: null, node: null});
+    assert.equal(differ.prompts.positive.status, 'ambiguous');
+});
+
+test('a detailer stage is compared with the sampler in its image ancestry', () => {
+    const graph = base({'10': {class_type: 'VAEDecode', inputs: {samples: ['3', 0]}}, '8': encode('a cat'), '12': {class_type: 'SaveImage', inputs: {images: ['11', 0]}},
+        '11': {class_type: 'FaceDetailer', inputs: {image: ['10', 0], model: ['4', 0], positive: ['8', 0], negative: ['7', 0]}}});
+    const evidence = resolver.resolveLocalEvidence({prompt: JSON.stringify(graph)}, semantics);
+    assert.deepEqual(evidence.resolution, {state: 'ambiguous', sampler_id: '11', reason: 'Sampler stages have different prompts', reason_code: 'multistage-differs', node: null});
+    assert.equal(evidence.prompts.positive.message, undefined);
+});
+
+test('A1111 parameters split on the unique settings footer as Python does', () => {
+    const read = text => resolver.resolveLocalEvidence({parameters: text}, semantics);
+    assert.deepEqual(read('a fox\nNegative prompt: blur\nSteps: 20, Sampler: euler').prompts, {
+        positive: {status: 'resolved', text: 'a fox', source: 'embedded-parameters'}, negative: {status: 'resolved', text: 'blur', source: 'embedded-parameters'},
+    });
+    // Python's multiline ^ and $ break only at \n: a U+2028 or a lone \r never starts the footer line.
+    for (const text of ['a fox\u2028Steps: 20, x', 'a fox\rSteps: 20, x']) assert.equal(read(text).resolution.reason, 'A1111 settings footer is not unique');
+    // \d is any Unicode decimal digit and \s spans line breaks, as in Python's re.
+    assert.equal(read('a fox\nSteps: \u0662\u0660, x').resolution.reason, 'Negative prompt delimiter is absent');
+    assert.equal(read('a fox\nSteps:\n 20 \n, x').resolution.state, 'absent');
+    assert.equal(read('a fox\nSteps: 1, x\nNegative Template: n\nTemplate: t').resolution.reason_code, 'malformed');
+    assert.equal(read('\u{1f600}'.repeat(60000) + '\nSteps: 1, x').resolution.state, 'absent', 'the length limit counts code points');
+});
+
+test('an unusable semantics table is refused', () => {
+    for (const doc of [null, {schema: 2}, {schema: 1, samplers: []}]) assert.throws(() => resolver.compileSemantics(doc), resolver.SemanticsError);
+});
+
+// The committed server answers (tests/fixtures/local-inspect/resolver-vectors.json, written by
+// `python3 -m tests.local_resolver_cases --write` and checked current by the Python suite).
+test('committed server answers equal the local evidence', () => {
+    const {vectors} = JSON.parse(fs.readFileSync(new URL('../fixtures/local-inspect/resolver-vectors.json', import.meta.url), 'utf8'));
+    const canonical = value => Array.isArray(value) ? value.map(canonical) :
+        value !== null && typeof value === 'object' ? Object.fromEntries(Object.keys(value).sort().map(key => [key, canonical(value[key])])) : value;
+    let compared = 0;
+    for (const {name, records, evidence} of vectors) {
+        assert.deepEqual(canonical(resolver.resolveLocalEvidence(records, semantics)), canonical(evidence), name);
+        compared++;
+    }
+    assert.ok(compared > 280, `compared ${compared}`);
+});
+
+test('a list or object workflow node type is skipped, as on the server (#286)', () => {
+    const graph = base({'6': {class_type: 'PromptManager', inputs: {text: 'a fox', clip: ['4', 1]}}});
+    for (const type of [['PromptManager'], {name: 'PromptManager'}]) {
+        const evidence = resolver.resolveLocalEvidence({prompt: JSON.stringify(graph), workflow: JSON.stringify({nodes: [{id: 6, type, widgets_values: ['x']}]})}, semantics);
+        assert.equal(evidence.resolution.state, 'resolved');
+        assert.equal(evidence.prompts.positive.status, 'resolved');
+        assert.equal(evidence.prompts.positive.text, 'a fox');
+    }
+});
@@ -0,0 +1,43 @@
+// web/js/workspace/local-semantics.mjs (#249 local Inspect, PR L3 Task 10): the node table local Inspect resolves
+// with is the server's own web/js/inspection-semantics.json, fetched once through the API client before a file is
+// chosen. A table that cannot be fetched or used answers as the server does when its table is unusable.
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+
+const TABLE = fs.readFileSync(new URL("../../web/js/inspection-semantics.json", import.meta.url), "utf8");
+let instance = 0;
+/** A fresh module instance (its cache is per page) with `fetch` and the API client stubbed. */
+async function load(respond) {
+    const calls = [];
+    globalThis.window = { ApiClient: { resolveUrl: (path) => `/proxy${path}` } };
+    globalThis.fetch = async (url, init) => { calls.push([url, init]); return respond(); };
+    const module = await import(`../../web/js/workspace/local-semantics.mjs?instance=${++instance}`);
+    return { module, calls };
+}
+test.after(() => { delete globalThis.window; delete globalThis.fetch; });
+
+test("the table is fetched once through the API client and compiled", async () => {
+    const { module, calls } = await load(() => new Response(TABLE, { status: 200 }));
+    const [first, second] = await Promise.all([module.loadInspectionSemantics(), module.loadInspectionSemantics()]);
+    assert.equal(first, second);
+    assert.ok(first.samplers.has("KSampler"));
+    assert.equal(await module.loadInspectionSemantics(), first);
+    assert.deepEqual(calls, [["/proxy/prompt_manager/js/inspection-semantics.json", { credentials: "same-origin" }]]);
+});
+
+test("a failed or unusable table is null, and a later selection asks again", async () => {
+    for (const respond of [() => new Response("nope", { status: 404 }), () => new Response("{\"schema\": 2}", { status: 200 }), () => { throw new TypeError("offline"); }]) {
+        const { module, calls } = await load(respond);
+        assert.equal(await module.loadInspectionSemantics(), null);
+        assert.equal(await module.loadInspectionSemantics(), null);
+        assert.equal(calls.length, 2);
+    }
+});
+
+test("without the API client nothing is fetched", async () => {
+    const { module, calls } = await load(() => new Response(TABLE));
+    delete globalThis.window;
+    assert.equal(await module.loadInspectionSemantics(), null);
+    assert.deepEqual(calls, []);
+});
@@ -193,8 +193,8 @@ test("unclassified input creates no object URL", async () => {
    // declares a supported type it opens the inspector's unreadable state, with no preview and no URL (ledger ruling).
    const gone = pngFile("gone.png", "fox", { gate: () => Promise.reject(new DOMException("The file was removed", "NotReadableError")) });
    assert.equal(value.select([gone]), "accepted");
-    await settle();
-    const unreadable = value.controller.state;
+    // The read yields between its steps (local-inspection.mjs): wait for the answer, not a fixed number of turns.
+    const unreadable = await recorded(value.controller);
    assert.ok(unreadable.record, "the unreadable record is published");
    assert.deepEqual([value.state.phase, value.state.message, value.state.preview], ["ready", m.LOCAL_SESSION_MESSAGES.unreadable, null]);
    assert.equal(m.LOCAL_SESSION_MESSAGES.unreadable, "Embedded metadata could not be read.");
@@ -23,8 +23,50 @@ test('tags is a native route titled Tags; only unbuilt routes hand off to legacy
        assert.equal(routeTitle(route), route.label);
    }
    assert.equal(routeTitle(resolveRoute('#/library/7')), 'Prompt library');
-    for (const id of ['images', 'library', 'tags', 'inspect', 'overview', 'activity']) assert.equal(isHandoff(resolveRoute(`#/${id}`)), false, id);
-    for (const id of ['system']) assert.equal(isHandoff(resolveRoute(`#/${id}`)), true, id);
+    // System is native from S2 (#249 System): its undelivered sections hand off per section (D94), not the route.
+    for (const id of ['images', 'library', 'tags', 'inspect', 'overview', 'activity', 'system']) assert.equal(isHandoff(resolveRoute(`#/${id}`)), false, id);
+});
+
+test('system resolves its sections; #/overview stays the production hub', async () => {
+    const { resolveRoute, routeTitle, isHandoff, routes } = await source;
+    // `#/system` is the Overview section and keeps the sidebar's hash.
+    const system = resolveRoute('#/system');
+    assert.deepEqual([system.id, system.section, system.hash, routeTitle(system), isHandoff(system)],
+        ['system', 'overview', '#/system', 'System', false]);
+    for (const section of ['overview', 'appearance', 'sources', 'integrations', 'tagging', 'maintenance', 'backups', 'diagnostics']) {
+        const route = resolveRoute(`#/system/${section}`);
+        assert.deepEqual([route.id, route.section, route.hash], ['system', section, `#/system/${section}`]);
+    }
+    // An unknown child is the Overview section with a replaced hash.
+    for (const hash of ['#/system/general', '#/system/', '#/system/__proto__', '#/system/backups/1', '#/system/<b>']) {
+        const route = resolveRoute(hash);
+        assert.deepEqual([route.id, route.section, route.hash], ['system', 'overview', '#/system/overview'], hash);
+    }
+    // D28: the production hub is untouched.
+    const hub = resolveRoute('#/overview');
+    assert.deepEqual([hub.id, hub.section], ['overview', undefined]);
+    // Q12: Overview's System card opens the native System Overview, with no legacy href or action.
+    const card = routes.find(route => route.id === 'system');
+    assert.equal(card.href, '#/system/overview');
+    assert.equal(card.native, true);
+    assert.equal(card.action, 'Open System');
+});
+
+test('the router renders again when only the System section changes', async () => {
+    const { mountRouter } = await source;
+    const win = new EventTarget();
+    win.location = { hash: '#/system' };
+    const replacements = [];
+    win.history = { state: null, replaceState(state, unused, hash) { replacements.push(hash); win.location.hash = hash; } };
+    const seen = [];
+    const dispose = mountRouter(win, route => seen.push([route.id, route.section]));
+    for (const hash of ['#/system/appearance', '#/system/appearance', '#/system/bogus', '#/system/overview', '#/images']) {
+        win.location.hash = hash;
+        win.dispatchEvent(new Event('hashchange'));
+    }
+    assert.deepEqual(seen, [['system', 'overview'], ['system', 'appearance'], ['system', 'overview'], ['images', undefined]]);
+    assert.deepEqual(replacements, ['#/system/overview']);
+    dispose();
 });

 test('inspect is the native Inspect a file page with the concept description', async () => {
@@ -0,0 +1,214 @@
+// System controls (#249 System S2 Task 5): the concept's `setting()` (app.js 624–634, its toggles hydrated into Toolkit
+// switches by `hydrateSwitches` 708–717), `operation()` (645–654) and `sectionNav()` (306–308) as DOM builders whose
+// listeners live on the caller's scope.
+const test = require('node:test');
+const assert = require('node:assert/strict');
+
+const controlsModule = import('../../web/js/workspace/system-controls.mjs');
+const coreModule = import('../../web/js/shared/toolkit/core.js');
+
+/** A minimal DOM whose elements count their live listeners (a listener's signal aborts it, as in a browser). */
+function fakeDOM() {
+    const previous = global.document;
+    const elements = [];
+    class Element {
+        constructor(tag) {
+            this.tagName = tag.toUpperCase();
+            this.children = [];
+            this.attributes = {};
+            this.listeners = [];
+            this.dataset = {};
+            this.className = '';
+            this.id = '';
+            this.value = '';
+            this._text = '';
+            elements.push(this);
+        }
+        get textContent() { return this._text + this.children.map(child => child.textContent).join(''); }
+        set textContent(text) { this.children = []; this._text = String(text); }
+        append(...nodes) {
+            for (const node of nodes) {
+                const child = typeof node === 'string' ? Object.assign(new Element('#text'), { _text: node }) : node;
+                child.parentNode = this;
+                this.children.push(child);
+            }
+        }
+        replaceChildren(...nodes) { this.children = []; this._text = ''; this.append(...nodes); }
+        setAttribute(name, value) { this.attributes[name] = String(value); }
+        getAttribute(name) { return Object.hasOwn(this.attributes, name) ? this.attributes[name] : null; }
+        removeAttribute(name) { delete this.attributes[name]; }
+        addEventListener(type, callback, options = {}) {
+            if (options.signal?.aborted) return;
+            const entry = { type, callback };
+            this.listeners.push(entry);
+            options.signal?.addEventListener('abort', () => { this.listeners = this.listeners.filter(item => item !== entry); });
+        }
+        removeEventListener(type, callback) { this.listeners = this.listeners.filter(item => item.type !== type || item.callback !== callback); }
+        dispatch(type) { for (const { callback } of this.listeners.filter(item => item.type === type)) callback({ type, target: this }); }
+        click() { this.dispatch('click'); }
+    }
+    global.document = {
+        createElement: tag => new Element(tag),
+        createTextNode: text => Object.assign(new Element('#text'), { _text: String(text) }),
+    };
+    const walk = (node, found = []) => { found.push(node); node.children.forEach(child => walk(child, found)); return found; };
+    return {
+        listenerCount: () => elements.reduce((sum, element) => sum + element.listeners.length, 0),
+        find: (root, predicate) => walk(root).find(predicate),
+        tags: node => node.children.map(child => child.tagName.toLowerCase()),
+        restore() { global.document = previous; },
+    };
+}
+
+test('settingRow is the concept row: div > label[for] + p, then the control', async () => {
+    const { settingRow } = await controlsModule;
+    const { createScope } = await coreModule;
+    const dom = fakeDOM();
+    const scope = createScope();
+    try {
+        const changes = [];
+        const row = settingRow({ id: 'timeout', label: 'Node search auto-hide (seconds)',
+            description: 'Node search behavior only. Use 0 to keep results visible.',
+            control: { type: 'number', value: 30, min: 0, max: 300 }, scope, onChange: value => changes.push(value) });
+        assert.equal(row.className, 'setting-row');
+        assert.deepEqual(dom.tags(row), ['div', 'input']);
+        const [text, input] = row.children;
+        assert.deepEqual(dom.tags(text), ['label', 'p']);
+        assert.equal(text.children[0].textContent, 'Node search auto-hide (seconds)');
+        assert.equal(text.children[0].htmlFor, 'timeout');
+        assert.equal(text.children[1].textContent, 'Node search behavior only. Use 0 to keep results visible.');
+        assert.deepEqual([input.id, input.type, input.value, input.min, input.max], ['timeout', 'number', '30', '0', '300']);
+        assert.equal(input.dataset.setting, 'timeout');
+        input.value = '45';
+        input.dispatch('change');
+        assert.deepEqual(changes, [45]);
+
+        const select = settingRow({ id: 'open-mode', label: 'Open from ComfyUI', description: 'Keep the node pack’s popup / new-tab preference.',
+            control: { type: 'select', options: [['newtab', 'New tab'], ['popup', 'Popup window']], value: 'popup' }, scope,
+            onChange: value => changes.push(value) }).children[1];
+        assert.equal(select.tagName, 'SELECT');
+        assert.deepEqual(select.children.map(option => [option.value, option.textContent]), [['newtab', 'New tab'], ['popup', 'Popup window']]);
+        assert.equal(select.value, 'popup');
+        select.value = 'newtab';
+        select.dispatch('change');
+        assert.deepEqual(changes, [45, 'newtab']);
+
+        // The concept's range is 1–16 unless the row says otherwise (D113: the CPU count).
+        const range = settingRow({ id: 'workers', label: 'Worker threads', description: 'Balance background scans.',
+            control: { type: 'range', value: 4 } }).children[1];
+        assert.deepEqual([range.type, range.min, range.max, range.value], ['range', '1', '16', '4']);
+        const password = settingRow({ id: 'civitai-key', label: 'CivitAI API key', description: 'Credentials stay on the server.',
+            control: { type: 'password', value: '' } }).children[1];
+        assert.equal(password.type, 'password');
+
+        // A ready-made control is placed as given and takes the row id.
+        const custom = document.createElement('textarea');
+        const customRow = settingRow({ id: 'custom', label: 'Custom', description: 'Any control.', control: custom });
+        assert.equal(customRow.children[1], custom);
+        assert.equal(custom.id, 'custom');
+        assert.throws(() => settingRow({ id: '', label: 'x', description: 'y', control: { type: 'number' } }), TypeError);
+        assert.throws(() => settingRow({ id: 'x', label: 'x', description: 'y', control: { type: 'colour' } }), TypeError);
+    } finally {
+        scope.dispose();
+        dom.restore();
+    }
+});
+
+test('a toggle row holds the Toolkit switch, labelled by the row label', async () => {
+    const { settingRow } = await controlsModule;
+    const { createScope } = await coreModule;
+    const dom = fakeDOM();
+    const scope = createScope();
+    try {
+        const changes = [];
+        const row = settingRow({ id: 'video-auto', label: 'Autoplay videos', description: 'Videos stay within the same gallery.',
+            control: { type: 'toggle', checked: false }, scope, onChange: value => changes.push(value) });
+        const field = row.children[1];
+        // createSwitch('', '', id): `label.ca-switch` > input[type=checkbox][role=switch] + an empty label text.
+        assert.equal(field.tagName, 'LABEL');
+        assert.equal(field.className, 'ca-switch');
+        const input = field.children[0];
+        assert.deepEqual([input.type, input.role, input.id, input.checked], ['checkbox', 'switch', 'video-auto', false]);
+        assert.equal(row.children[0].children[0].htmlFor, input.id);
+        assert.equal(input.dataset.setting, 'video-auto');
+        input.checked = true;
+        input.dispatch('change');
+        assert.deepEqual(changes, [true]);
+        // The concept's toggles are on unless configured off (`val !== false`).
+        const on = settingRow({ id: 'video-loop', label: 'Loop videos', description: 'Repeat a clip.', control: { type: 'toggle' } });
+        assert.equal(on.children[1].children[0].checked, true);
+    } finally {
+        scope.dispose();
+        dom.restore();
+    }
+});
+
+test('operationRow is the concept operation with a danger class only when flagged', async () => {
+    const { operationRow } = await controlsModule;
+    const { createScope } = await coreModule;
+    const dom = fakeDOM();
+    const scope = createScope();
+    try {
+        const clicks = [];
+        const row = operationRow({ title: 'Missing-file links',
+            description: 'Remove stale database links only. Files on disk are never deleted by this operation.',
+            label: 'Review plan', danger: true, scope, onClick: button => clicks.push(button) });
+        assert.equal(row.className, 'operation');
+        assert.deepEqual(dom.tags(row), ['div', 'div']);
+        assert.deepEqual(dom.tags(row.children[0]), ['h3', 'p']);
+        assert.equal(row.children[0].children[0].textContent, 'Missing-file links');
+        assert.equal(row.children[1].className, 'row-actions');
+        const button = row.children[1].children[0];
+        assert.deepEqual([button.tagName, button.type, button.textContent, button.className], ['BUTTON', 'button', 'Review plan', 'danger']);
+        button.click();
+        assert.deepEqual(clicks, [button]);
+        const plain = operationRow({ title: 'Statistics', description: 'Usage by prompt, category, tag and date.', label: 'Explore',
+            scope, onClick() {} });
+        assert.equal(plain.children[1].children[0].className, '');
+        assert.throws(() => operationRow({ title: 'x', description: 'y', label: 'z', onClick() {} }), TypeError);
+    } finally {
+        scope.dispose();
+        dom.restore();
+    }
+});
+
+test('sectionNav marks the active section and reports the chosen one', async () => {
+    const { sectionNav } = await controlsModule;
+    const { createScope } = await coreModule;
+    const dom = fakeDOM();
+    const scope = createScope();
+    try {
+        const chosen = [];
+        const nav = sectionNav({ label: 'System sections', sections: [['overview', 'Overview'], ['appearance', 'Appearance']],
+            active: 'appearance', scope, onSelect: id => chosen.push(id) });
+        assert.equal(nav.className, 'section-nav');
+        assert.equal(nav.getAttribute('role'), 'group');
+        assert.equal(nav.getAttribute('aria-label'), 'System sections');
+        assert.deepEqual(nav.children.map(button => [button.textContent, button.getAttribute('aria-pressed'), button.dataset.value]),
+            [['Overview', 'false', 'overview'], ['Appearance', 'true', 'appearance']]);
+        nav.children[0].click();
+        assert.deepEqual(chosen, ['overview']);
+    } finally {
+        scope.dispose();
+        dom.restore();
+    }
+});
+
+test('disposing the scope leaves no listener behind', async () => {
+    const { settingRow, operationRow, sectionNav } = await controlsModule;
+    const { createScope } = await coreModule;
+    const dom = fakeDOM();
+    const scope = createScope();
+    try {
+        settingRow({ id: 'a', label: 'A', description: 'a', control: { type: 'toggle' }, scope, onChange() {} });
+        settingRow({ id: 'b', label: 'B', description: 'b', control: { type: 'select', options: ['Grid', 'List'] }, scope, onChange() {} });
+        operationRow({ title: 'C', description: 'c', label: 'Go', scope, onClick() {} });
+        sectionNav({ label: 'System sections', sections: [['overview', 'Overview']], active: 'overview', scope, onSelect() {} });
+        assert.equal(dom.listenerCount() > 0, true);
+        scope.dispose();
+        assert.equal(dom.listenerCount(), 0);
+    } finally {
+        scope.dispose();
+        dom.restore();
+    }
+});
@@ -0,0 +1,255 @@
+// System › Overview (#249 System S2 Task 6): the concept's Overview copy on real values (D93), the Health report rows
+// (D95), the Statistics tables (D96) and the health check run that waits for its read job.
+const test = require('node:test');
+const assert = require('node:assert/strict');
+
+const overviewModule = import('../../web/js/workspace/system-overview.mjs');
+
+const OVERVIEW = Object.freeze({
+    library: { positive_prompts: 1234, negative_variants: 7 },
+    images: { indexed: 24, rated: 20 },
+    health: null,
+    backup: null,
+    needs_review: { pending: null },
+    sources: { configured: 2, effective: 2, auto_detected: false },
+});
+
+test('metrics are the server counts and Not checked before any health check', async () => {
+    const { metricValues } = await overviewModule;
+    assert.deepEqual(metricValues(OVERVIEW), [
+        [(1234).toLocaleString(), 'Positive prompts'], ['7', 'Negative variants'], ['24', 'Images'],
+        ['Not checked', 'Database integrity'],
+    ]);
+});
+
+test('metric 4 is the last health result', async () => {
+    const { integrityText } = await overviewModule;
+    assert.equal(integrityText(null), 'Not checked');
+    assert.equal(integrityText({ status: 'passed', issues: 0 }), 'Passed');
+    assert.equal(integrityText({ status: 'issues', issues: 1 }), '1 issue');
+    assert.equal(integrityText({ status: 'issues', issues: 3 }), '3 issues');
+    assert.equal(integrityText({ status: 'incomplete', issues: 0 }), 'Incomplete');
+    // Issues found beside a check that could not run (Needs review, Q6) are still named.
+    assert.equal(integrityText({ status: 'incomplete', issues: 2 }), '2 issues');
+});
+
+test('library health rows never invent a review count, a backup or thumbnails', async () => {
+    const { ambiguousTitle, backupText } = await overviewModule;
+    assert.equal(ambiguousTitle({ pending: null }), 'Ambiguous image links');
+    assert.equal(ambiguousTitle(undefined), 'Ambiguous image links');
+    assert.equal(ambiguousTitle({ pending: 1 }), '1 ambiguous image link');
+    assert.equal(ambiguousTitle({ pending: 3 }), '3 ambiguous image links');
+    assert.equal(backupText(null), 'No retained backup record.');
+    assert.equal(backupText({ verified_at: 'not a time' }), 'No retained backup record.');
+    assert.match(backupText({ verified_at: '2026-10-22T09:30:00Z' }), /^Last verified backup .+\.$/);
+});
+
+test('the thumbnail row is its own read of the thumbnail status', async () => {
+    const { thumbnailTitle, THUMBNAILS_LOADING } = await overviewModule;
+    // Until `/images/thumbnails/status` answers the row says it is checking; a failed read is unavailable, never 0.
+    assert.equal(THUMBNAILS_LOADING, 'Checking thumbnails…');
+    assert.equal(thumbnailTitle(undefined), THUMBNAILS_LOADING);
+    assert.equal(thumbnailTitle({ pending: 0 }), 'No missing thumbnails');
+    assert.equal(thumbnailTitle({ pending: 1 }), '1 missing thumbnail');
+    assert.equal(thumbnailTitle({ pending: 12 }), '12 missing thumbnails');
+    assert.equal(thumbnailTitle(null), 'Thumbnail status unavailable');
+    assert.equal(thumbnailTitle({ pending: 'x' }), 'Thumbnail status unavailable');
+    // With no image source there is nothing to count.
+    assert.equal(thumbnailTitle({ pending: 0 }, { effective: 0 }), 'Thumbnail status unavailable');
+    assert.equal(thumbnailTitle({ pending: 2 }, { effective: 1 }), '2 missing thumbnails');
+});
+
+test('an integrity count SQLite stopped at reads as a lower bound', async () => {
+    const { checkChip } = await overviewModule;
+    assert.equal(checkChip({ id: 'integrity', status: 'issues', count: 100, capped: true }), '100+ problems found');
+    assert.equal(checkChip({ id: 'integrity', status: 'issues', count: 37, capped: false }), '37 problems found');
+    assert.equal(checkChip({ id: 'integrity', status: 'issues', count: 1 }), '1 problem found');
+});
+
+test('the sources row tells configured, available and detected sources apart', async () => {
+    const { sourcesCopy } = await overviewModule;
+    const shared = 'Monitoring and enrichment share one source list.';
+    assert.deepEqual(sourcesCopy({ configured: 2, effective: 2, auto_detected: false }), ['2 output sources', shared]);
+    assert.deepEqual(sourcesCopy({ configured: 2, effective: 1, auto_detected: false }),
+        ['1 output source', `1 of 2 configured sources available. ${shared}`]);
+    assert.deepEqual(sourcesCopy({ configured: 0, effective: 1, auto_detected: true }),
+        ['1 output source', `None configured is available; ComfyUI's output folder is used. ${shared}`]);
+});
+
+const REPORT = Object.freeze({
+    checked_at: '2026-10-23T08:00:00Z',
+    status: 'issues',
+    checks: [
+        { id: 'integrity', label: 'Integrity check', status: 'passed', count: 0 },
+        { id: 'foreign_keys', label: 'Foreign keys & pair references', status: 'issues', count: 2 },
+        { id: 'canonical_hashes', label: 'Canonical hashes', status: 'issues', count: 1 },
+        { id: 'pair_uniqueness', label: 'Pair uniqueness', status: 'failed', count: null },
+        { id: 'missing_files', label: 'Missing files', status: 'issues', count: 2,
+            sources: [{ name: 'output', status: 'checked', count: 2 }] },
+        { id: 'ambiguous_metadata', label: 'Ambiguous metadata', status: 'unavailable', count: null },
+        { id: 'consistency', label: 'Consistency', status: 'issues', count: null },
+    ],
+});
+
+test('health rows give each check a chip from its real status, in the server order', async () => {
+    const { healthRows } = await overviewModule;
+    assert.deepEqual(healthRows(REPORT), [
+        ['Integrity check', 'Passed'],
+        ['Foreign keys & pair references', '2 broken references'],
+        ['Canonical hashes', '1 hash does not match its text'],
+        ['Pair uniqueness', 'Could not check'],
+        ['Missing files', '2 links need review'],
+        ['Ambiguous metadata', 'Not available yet'],
+        ['Consistency', 'Issues found'],
+    ]);
+});
+
+test('missing files is reported per image source when there are several', async () => {
+    const { healthRows } = await overviewModule;
+    const report = { ...REPORT, checks: [{ id: 'missing_files', label: 'Missing files', status: 'issues', count: 1, partial: true,
+        sources: [{ name: 'output', status: 'checked', count: 1 }, { name: 'input', status: 'checked', count: 0 },
+            { name: 'archive', status: 'unavailable', count: null }] }] };
+    assert.deepEqual(healthRows(report), [
+        ['Missing files · output', '1 link needs review'],
+        ['Missing files · input', 'Passed'],
+        ['Missing files · archive', 'Not available'],
+    ]);
+    const unavailable = { ...REPORT, checks: [{ id: 'missing_files', label: 'Missing files', status: 'unavailable', count: null, sources: [] }] };
+    assert.deepEqual(healthRows(unavailable), [['Missing files', 'Not available']]);
+});
+
+test('the report summary says when it was checked and whether it is complete', async () => {
+    const { healthSummary } = await overviewModule;
+    const when = new Date(REPORT.checked_at).toLocaleString();
+    assert.equal(healthSummary({ ...REPORT, status: 'passed' }), `Checked ${when}. Every check passed.`);
+    assert.equal(healthSummary({ ...REPORT, status: 'incomplete' }), `Checked ${when}. Some checks could not run, so this report is incomplete.`);
+    assert.equal(healthSummary({ ...REPORT, checked_at: 'x' }), 'Nothing was changed; review the checks with issues.');
+});
+
+test('statistics rows are the real runs and ratings, then the library totals', async () => {
+    const { categoryRows, totalsRows } = await overviewModule;
+    const statistics = {
+        by_category: [{ category: 'Landscapes', runs: 1200, average_rating: 4.5 },
+            { category: null, runs: 3, average_rating: null }],
+        totals: { total_prompts: 12, total_tags: 15, total_images: 24 },
+        rated_images: 20,
+    };
+    assert.deepEqual(categoryRows(statistics), [['Landscapes', (1200).toLocaleString(), '4.5 / 5'], ['Uncategorized', '3', 'Not rated']]);
+    assert.deepEqual(totalsRows(statistics), [['Prompts', '12'], ['Tags', '15'], ['Images', '24'], ['Rated images', '20']]);
+});
+
+/** A fake api answering each `get`/`post` from a queue per URL, recording the calls. */
+function fakeApi(answers) {
+    const calls = [];
+    const answer = (method, url) => {
+        calls.push(`${method} ${url}`);
+        const queue = answers[`${method} ${url}`];
+        if (!queue?.length) throw new Error(`unexpected ${method} ${url}`);
+        const next = queue.shift();
+        return next instanceof Error ? Promise.reject(next) : Promise.resolve(next);
+    };
+    return { calls, get: url => answer('GET', url), post: url => answer('POST', url) };
+}
+
+const JOB = '0123456789abcdef0123456789abcdef';
+const job = (state, id = JOB, kind = 'health') => ({ id, kind, state });
+
+/**
+ * A fake Activity store holding `jobs`: `track(job)` lists a started job, `load()` applies the next of `reads` (the
+ * server's job lists) and `push(job)` is a stream update; each notifies as the real store does. It never polls.
+ */
+function fakeActivity({ jobs = [], reads = [] } = {}) {
+    const listeners = new Set();
+    const emit = () => { for (const listener of [...listeners]) listener(); };
+    const store = {
+        loads: 0,
+        find: id => jobs.find(item => item.id === id),
+        running: () => jobs.filter(item => item.state === 'running'),
+        subscribe(listener) { listeners.add(listener); return () => listeners.delete(listener); },
+        listeners: () => listeners.size,
+        async load() {
+            store.loads += 1;
+            if (reads.length) jobs = reads.shift();
+            emit();
+        },
+        track(item) {
+            if (!item?.id) throw new TypeError('Invalid job');
+            store.push(item);
+            return item;
+        },
+        push(item) {
+            jobs = [...jobs.filter(other => other.id !== item.id), item];
+            emit();
+        },
+    };
+    return store;
+}
+
+test('a health check tracks its job in the Activity store, then reads the report', async () => {
+    const { runHealthCheck } = await overviewModule;
+    const api = fakeApi({
+        'POST /prompt_manager/system/health': [{ job: job('running') }],
+        'GET /prompt_manager/system/health': [{ report: REPORT }],
+    });
+    const activity = fakeActivity();
+    const checking = runHealthCheck(api, { activity });
+    await new Promise(resolve => setImmediate(resolve));
+    // The store follows the started job's event stream; nothing reads or polls the job here.
+    assert.equal(activity.loads, 0);
+    assert.equal(activity.find(JOB).state, 'running');
+    assert.deepEqual(api.calls, ['POST /prompt_manager/system/health']);
+    activity.push(job('finished'));
+    assert.equal(await checking, REPORT);
+    assert.deepEqual(api.calls, ['POST /prompt_manager/system/health', 'GET /prompt_manager/system/health']);
+    assert.equal(activity.listeners(), 0);
+});
+
+test('a check already running elsewhere is waited for, not refused', async () => {
+    const { runHealthCheck } = await overviewModule;
+    const busy = Object.assign(new Error('busy'), { status: 409, code: 'busy' });
+    const api = fakeApi({
+        'POST /prompt_manager/system/health': [busy],
+        'GET /prompt_manager/system/health': [{ report: REPORT }],
+    });
+    const activity = fakeActivity({ reads: [[job('running', 'f'.repeat(32), 'scan'), job('running')]] });
+    const checking = runHealthCheck(api, { activity });
+    await new Promise(resolve => setImmediate(resolve));
+    assert.equal(activity.loads, 1);
+    activity.push(job('finished'));
+    assert.equal(await checking, REPORT);
+    // The other check ended between the refusal and the read: its report is the latest.
+    const ended = fakeApi({ 'POST /prompt_manager/system/health': [busy], 'GET /prompt_manager/system/health': [{ report: REPORT }] });
+    assert.equal(await runHealthCheck(ended, { activity: fakeActivity({ reads: [[]] }) }), REPORT);
+});
+
+test('a failed, lost or reportless check rejects; other errors pass through', async () => {
+    const { runHealthCheck, waitForJob, HEALTH_FAILED_TEXT } = await overviewModule;
+    const failed = fakeApi({ 'POST /prompt_manager/system/health': [{ job: job('failed') }] });
+    await assert.rejects(runHealthCheck(failed, { activity: fakeActivity() }), { message: HEALTH_FAILED_TEXT });
+    // The store marks a job lost when the server no longer lists it (ComfyUI restarted).
+    const restarted = fakeActivity({ jobs: [job('running')] });
+    const waiting = waitForJob(restarted, JOB);
+    restarted.push(job('lost'));
+    assert.equal(await waiting, 'lost');
+    const empty = fakeApi({ 'POST /prompt_manager/system/health': [{ job: job('finished') }],
+        'GET /prompt_manager/system/health': [{ report: null }] });
+    await assert.rejects(runHealthCheck(empty, { activity: fakeActivity() }), { message: HEALTH_FAILED_TEXT });
+    const broken = fakeApi({ 'POST /prompt_manager/system/health': [Object.assign(new Error('server'), { status: 500 })] });
+    await assert.rejects(runHealthCheck(broken, { activity: fakeActivity() }), { message: 'server' });
+    const invalid = fakeApi({ 'POST /prompt_manager/system/health': [{ job: null }] });
+    await assert.rejects(runHealthCheck(invalid, { activity: fakeActivity() }), { message: 'Invalid job' });
+});
+
+test('waiting stops when its signal aborts', async () => {
+    const { waitForJob } = await overviewModule;
+    const controller = new AbortController();
+    const activity = fakeActivity({ jobs: [job('running')] });
+    const waiting = waitForJob(activity, JOB, { signal: controller.signal });
+    await new Promise(resolve => setImmediate(resolve));
+    controller.abort(new Error('left'));
+    await assert.rejects(waiting, { message: 'left' });
+    assert.equal(activity.listeners(), 0);
+    const gone = new AbortController();
+    gone.abort(new Error('already'));
+    await assert.rejects(waitForJob(fakeActivity(), JOB, { signal: gone.signal }), { message: 'already' });
+});
@@ -0,0 +1,261 @@
+// System draft store (#249 System S2 Task 5): one Save row for browser, host and runtime fields (concept app.js
+// renderSystem `.save-row` 705, `save-settings` 1320). It saves browser, then host with the GET revision, then runtime;
+// a domain that fails keeps its fields dirty, and the status copy (D92) says what really happened.
+const test = require('node:test');
+const assert = require('node:assert/strict');
+
+const source = import('../../web/js/workspace/system-state.mjs');
+
+/** Adapters that record every call; `host` answers like POST /prompt_manager/settings. */
+function adapters({ browser = {}, host = {}, runtime = {}, revision = 'sha256:one' } = {}) {
+    const calls = [];
+    const outcome = { browser: null, host: null, runtime: null };
+    return {
+        calls,
+        outcome,
+        readBrowser: () => { calls.push(['readBrowser']); return { ...browser }; },
+        readHost: async () => { calls.push(['readHost']); return { values: { ...host }, revision }; },
+        readRuntime: async () => { calls.push(['readRuntime']); return { ...runtime }; },
+        writeBrowser: async changes => {
+            calls.push(['writeBrowser', changes]);
+            if (outcome.browser) return outcome.browser(changes);
+            return { persisted: true };
+        },
+        writeHost: async (changes, options) => {
+            calls.push(['writeHost', changes, options]);
+            if (outcome.host) return outcome.host(changes, options);
+            return { success: true, persisted: true, revision: 'sha256:two', runtime_applied: true };
+        },
+        writeRuntime: async changes => {
+            calls.push(['writeRuntime', changes]);
+            if (outcome.runtime) return outcome.runtime(changes);
+            return { success: true };
+        },
+    };
+}
+
+async function loaded(domains) {
+    const { createSystemDrafts } = await source;
+    const drafts = createSystemDrafts(domains);
+    await Promise.all(['browser', 'host', 'runtime'].map(domain => drafts.load(domain)));
+    domains.calls.length = 0;
+    return drafts;
+}
+
+test('sections follow the concept order and the production hashes', async () => {
+    const { SYSTEM_SECTIONS, isSystemSection } = await source;
+    assert.deepEqual(SYSTEM_SECTIONS.map(([id, label]) => [id, label]), [
+        ['overview', 'Overview'], ['appearance', 'Appearance'], ['sources', 'Sources & scans'],
+        ['integrations', 'Integrations'], ['tagging', 'Auto-tagging'], ['maintenance', 'Maintenance'],
+        ['backups', 'Backup & export'], ['diagnostics', 'Diagnostics & logs'],
+    ]);
+    assert.equal(isSystemSection('backups'), true);
+    for (const value of ['general', '', 'constructor', '__proto__', undefined]) assert.equal(isSystemSection(value), false, value);
+});
+
+test('drafts read baselines and report dirty only for changed values', async () => {
+    const domains = adapters({ browser: { layout: 'grid' }, host: { result_timeout: 30 } });
+    const drafts = await loaded(domains);
+    assert.equal(drafts.get('browser', 'layout'), 'grid');
+    assert.equal(drafts.get('host', 'result_timeout'), 30);
+    assert.equal(drafts.dirty(), false);
+    drafts.set('host', 'result_timeout', 45);
+    assert.equal(drafts.get('host', 'result_timeout'), 45);
+    assert.equal(drafts.dirty(), true);
+    assert.equal(drafts.dirty('host'), true);
+    assert.equal(drafts.dirty('browser'), false);
+    // Setting the saved value back is clean again.
+    drafts.set('host', 'result_timeout', 30);
+    assert.equal(drafts.dirty(), false);
+    assert.throws(() => drafts.set('elsewhere', 'x', 1), TypeError);
+    assert.throws(() => drafts.get('elsewhere', 'x'), TypeError);
+});
+
+test('save commits browser then host then runtime', async () => {
+    const domains = adapters({ browser: { layout: 'grid' }, host: { result_timeout: 30 }, runtime: { level: 'INFO' } });
+    const drafts = await loaded(domains);
+    drafts.set('runtime', 'level', 'DEBUG');
+    drafts.set('host', 'result_timeout', 45);
+    drafts.set('browser', 'layout', 'list');
+    const outcome = await drafts.save();
+    assert.deepEqual(outcome, { browser: 'saved', host: 'saved', runtime: 'applied' });
+    assert.deepEqual(domains.calls, [
+        ['writeBrowser', { layout: 'list' }],
+        ['writeHost', { result_timeout: 45 }, { expected_revision: 'sha256:one' }],
+        ['writeRuntime', { level: 'DEBUG' }],
+    ]);
+    assert.equal(drafts.dirty(), false);
+    // The next host save sends the revision the last one returned.
+    drafts.set('host', 'result_timeout', 60);
+    await drafts.save();
+    assert.deepEqual(domains.calls.at(-1), ['writeHost', { result_timeout: 60 }, { expected_revision: 'sha256:two' }]);
+});
+
+test('host failure keeps host fields dirty and browser saved', async () => {
+    const domains = adapters({ browser: { layout: 'grid' }, host: { result_timeout: 30 } });
+    const drafts = await loaded(domains);
+    domains.outcome.host = () => { throw Object.assign(new Error('Settings could not be written to config.json.'), { code: 'config-write-failed' }); };
+    drafts.set('browser', 'layout', 'list');
+    drafts.set('host', 'result_timeout', 45);
+    const outcome = await drafts.save();
+    assert.deepEqual(outcome, { browser: 'saved', host: 'failed', runtime: 'clean' });
+    assert.equal(drafts.dirty('browser'), false);
+    assert.equal(drafts.dirty('host'), true);
+    assert.equal(drafts.get('host', 'result_timeout'), 45);
+    assert.deepEqual([...drafts.failed('host')], ['result_timeout']);
+    assert.deepEqual([...drafts.failed('browser')], []);
+    assert.equal(drafts.statusText(), 'Some changes were not saved. Review the highlighted settings.');
+    // A save answered `persisted: false` without an error is not saved either.
+    domains.outcome.host = () => ({ success: false, persisted: false });
+    assert.deepEqual(await drafts.save(), { browser: 'clean', host: 'failed', runtime: 'clean' });
+    // Editing the failed field clears its highlight and reads as unsaved again.
+    drafts.set('host', 'result_timeout', 50);
+    assert.deepEqual([...drafts.failed('host')], []);
+    assert.equal(drafts.statusText(), 'Unsaved changes.');
+});
+
+test('stale revision reports conflict and keeps the draft', async () => {
+    const domains = adapters({ host: { result_timeout: 30 } });
+    const drafts = await loaded(domains);
+    domains.outcome.host = () => { throw Object.assign(new Error('Settings changed since they were loaded.'), { code: 'settings-changed' }); };
+    drafts.set('host', 'result_timeout', 45);
+    assert.deepEqual(await drafts.save(), { browser: 'clean', host: 'conflict', runtime: 'clean' });
+    assert.equal(drafts.dirty('host'), true);
+    assert.equal(drafts.get('host', 'result_timeout'), 45);
+    assert.equal(drafts.statusText(), 'Settings changed elsewhere. Reload this section to see them.');
+    // The conflict read the host values again (their new revision), keeping the draft.
+    assert.deepEqual(domains.calls.slice(-2).map(([name]) => name), ['writeHost', 'readHost']);
+    // Reloading the section reads the new revision and keeps the draft (Q10).
+    domains.outcome.host = null;
+    await drafts.load('host');
+    assert.equal(drafts.get('host', 'result_timeout'), 45);
+    await drafts.save();
+    assert.deepEqual(domains.calls.at(-1)[2], { expected_revision: 'sha256:one' });
+});
+
+test('host save without a read revision never posts', async () => {
+    const { createSystemDrafts } = await source;
+    // Never read: an edit made before the host values (and their revision) arrived must not merge blindly.
+    const unread = adapters({ host: { result_timeout: 30 } });
+    const drafts = createSystemDrafts(unread);
+    drafts.set('host', 'result_timeout', 45);
+    assert.deepEqual(await drafts.save(), { browser: 'clean', host: 'failed', runtime: 'clean' });
+    assert.deepEqual(unread.calls, []);
+    assert.equal(drafts.dirty('host'), true);
+    assert.deepEqual([...drafts.failed('host')], ['result_timeout']);
+    // A read of an unreadable configuration has no revision either.
+    const unreadable = adapters({ host: { result_timeout: 30 }, revision: null });
+    const blind = createSystemDrafts(unreadable);
+    await blind.load('host');
+    blind.set('host', 'result_timeout', 45);
+    assert.equal((await blind.save()).host, 'failed');
+    assert.equal(unreadable.calls.filter(([name]) => name === 'writeHost').length, 0);
+    // Once read, the same draft saves with the revision.
+    await drafts.load('host');
+    assert.equal((await drafts.save()).host, 'saved');
+    assert.deepEqual(unread.calls.at(-1), ['writeHost', { result_timeout: 45 }, { expected_revision: 'sha256:one' }]);
+});
+
+test('reloadHost reads the host values and says whether it could', async () => {
+    const { createSystemDrafts } = await source;
+    const domains = adapters({ host: { result_timeout: 30 } });
+    const drafts = createSystemDrafts(domains);
+    assert.equal(await drafts.reloadHost(), true);
+    assert.equal(drafts.get('host', 'result_timeout'), 30);
+    const broken = createSystemDrafts({ ...domains, readHost: async () => { throw new Error('offline'); } });
+    assert.equal(await broken.reloadHost(), false);
+    broken.set('host', 'result_timeout', 45);
+    assert.equal((await broken.save()).host, 'failed');
+});
+
+test('no domain called when clean', async () => {
+    const domains = adapters({ browser: { layout: 'grid' } });
+    const drafts = await loaded(domains);
+    assert.deepEqual(await drafts.save(), { browser: 'clean', host: 'clean', runtime: 'clean' });
+    assert.deepEqual(domains.calls, []);
+    drafts.set('browser', 'layout', 'list');
+    drafts.discard();
+    assert.equal(drafts.dirty(), false);
+    assert.equal(drafts.get('browser', 'layout'), 'grid');
+    assert.deepEqual(await drafts.save(), { browser: 'clean', host: 'clean', runtime: 'clean' });
+    assert.deepEqual(domains.calls, []);
+});
+
+test('status text per outcome', async () => {
+    const { statusText, SETTINGS_STATUS } = await source;
+    assert.deepEqual(SETTINGS_STATUS, {
+        clean: 'No unsaved changes.',
+        dirty: 'Unsaved changes.',
+        browser: 'Saved in this browser.',
+        host: 'Saved to the server configuration.',
+        runtime: 'Applied until the server restarts.',
+        partial: 'Some changes were not saved. Review the highlighted settings.',
+        tabOnly: 'Saved for this tab only; browser storage is unavailable.',
+        conflict: 'Settings changed elsewhere. Reload this section to see them.',
+    });
+    const clean = { browser: 'clean', host: 'clean', runtime: 'clean' };
+    assert.equal(statusText(clean), 'No unsaved changes.');
+    assert.equal(statusText({ ...clean, browser: 'saved' }), 'Saved in this browser.');
+    assert.equal(statusText({ ...clean, host: 'saved' }), 'Saved to the server configuration.');
+    assert.equal(statusText({ ...clean, runtime: 'applied' }), 'Applied until the server restarts.');
+    assert.equal(statusText({ ...clean, browser: 'tab-only' }), 'Saved for this tab only; browser storage is unavailable.');
+    assert.equal(statusText({ browser: 'saved', host: 'saved', runtime: 'applied' }),
+        'Saved in this browser. Saved to the server configuration. Applied until the server restarts.');
+    assert.equal(statusText({ ...clean, browser: 'saved', runtime: 'failed' }),
+        'Some changes were not saved. Review the highlighted settings.');
+    assert.equal(statusText({ browser: 'failed', host: 'conflict', runtime: 'clean' }),
+        'Settings changed elsewhere. Reload this section to see them.');
+});
+
+test('the store says unsaved, then the save outcome, and notifies subscribers', async () => {
+    const domains = adapters({ browser: { layout: 'grid' } });
+    const drafts = await loaded(domains);
+    const seen = [];
+    const unsubscribe = drafts.subscribe(() => seen.push(drafts.statusText()));
+    assert.equal(drafts.statusText(), 'No unsaved changes.');
+    drafts.set('browser', 'layout', 'list');
+    domains.outcome.browser = () => ({ persisted: false });
+    await drafts.save();
+    assert.deepEqual(seen, ['Unsaved changes.', 'Saved for this tab only; browser storage is unavailable.']);
+    unsubscribe();
+    drafts.set('browser', 'layout', 'masonry');
+    assert.equal(seen.length, 2);
+    // The tab-only value is this tab's baseline now.
+    drafts.set('browser', 'layout', 'list');
+    assert.equal(drafts.dirty(), false);
+});
+
+test('an edit made while a save runs stays dirty', async () => {
+    const domains = adapters({ browser: { layout: 'grid' } });
+    const drafts = await loaded(domains);
+    let release;
+    domains.outcome.browser = () => new Promise(resolve => { release = () => resolve({ persisted: true }); });
+    drafts.set('browser', 'layout', 'list');
+    const saving = drafts.save();
+    // A second Save while one runs joins it instead of writing twice.
+    assert.equal(drafts.save(), saving);
+    assert.equal(drafts.saving(), true);
+    await new Promise(resolve => setImmediate(resolve));
+    drafts.set('browser', 'layout', 'masonry');
+    release();
+    assert.deepEqual(await saving, { browser: 'saved', host: 'clean', runtime: 'clean' });
+    assert.equal(drafts.saving(), false);
+    assert.equal(drafts.dirty('browser'), true);
+    assert.equal(drafts.get('browser', 'layout'), 'masonry');
+    assert.equal(domains.calls.filter(([name]) => name === 'writeBrowser').length, 1);
+});
+
+test('a failed read keeps the store usable and drafts survive a reload (Q10)', async () => {
+    const { createSystemDrafts } = await source;
+    const domains = adapters({ browser: { layout: 'grid' } });
+    const drafts = createSystemDrafts(domains);
+    await drafts.load('browser');
+    drafts.set('browser', 'layout', 'list');
+    await drafts.load('browser');
+    assert.equal(drafts.get('browser', 'layout'), 'list');
+    assert.equal(drafts.dirty(), true);
+    const failing = createSystemDrafts({ ...domains, readHost: async () => { throw new Error('offline'); } });
+    await assert.rejects(failing.load('host'), /offline/);
+    assert.equal(failing.dirty(), false);
+    assert.throws(() => createSystemDrafts({ ...domains, writeHost: null }), TypeError);
+});
@@ -76,6 +76,7 @@ function fakeDOM() {
        get activeElement() { return active ?? body; },
        createElement: tag => new Element(tag),
        createElementNS: (namespace, tag) => new Element(tag),
+        createTextNode: text => Object.assign(new Element('#text'), { _text: String(text) }),
    };
    const all = (root, predicate, found = []) => {
        if (predicate(root)) found.push(root);
@@ -521,6 +522,10 @@ test('copy fallback selects the text', async () => {
        assert.equal(note.className, 'small');
        assert.equal(note.textContent, 'Automatic clipboard access requires a secure browser context.');
        assert.throws(() => openCopyFallback(42, { scope }), TypeError);
+        // LI-4 (D117): the settings summary names its own dialog; the select-to-copy body is the same.
+        openCopyFallback('Seed: 7', { scope, title: 'Copy settings summary' });
+        assert.equal(byId(dom, 'modal-title').textContent, 'Copy settings summary');
+        assert.equal(byId(dom, 'copy-text').value, 'Seed: 7');
    } finally {
        closeWorkspaceDialog();
        scope.dispose();
@@ -786,3 +791,145 @@ test('the Filters button shows the active refinement count', async () => {
        dom.restore();
    }
 });
+
+// #249 System S2 Task 5: the scan review's dialog and backup box (D55) generalised for every record-changing review.
+const scanModule = import('../../web/js/workspace/activity-scan.mjs');
+const bodyShape = dom => byId(dom, 'modal-body').children.map(node => [node.tagName.toLowerCase(), node.className].filter(Boolean).join('.'));
+
+test('backupNotice is the concept .notice with its copy and one Back up now action', async () => {
+    const { backupNotice, SCAN_BACKUP_COPY } = await dialogsModule;
+    const dom = fakeDOM();
+    try {
+        let calls = 0;
+        const notice = backupNotice({ copy: SCAN_BACKUP_COPY, onBackup: () => { calls++; } });
+        assert.equal(notice.className, 'notice');
+        assert.deepEqual(tags(notice), ['div', 'div']);
+        assert.deepEqual(tags(notice.children[0]), ['h3', 'p']);
+        assert.equal(notice.children[0].children[0].textContent, 'Back up the database first (recommended)');
+        assert.equal(notice.children[0].children[1].textContent,
+            'Downloads a copy of the prompts database before the scan changes any records.');
+        assert.equal(notice.children[1].className, 'row-actions');
+        const action = button(notice, 'Back up now');
+        action.click();
+        assert.equal(calls, 1);
+        assert.throws(() => backupNotice({ copy: { heading: '', text: 'x' }, onBackup() {} }), TypeError);
+        assert.throws(() => backupNotice({ copy: SCAN_BACKUP_COPY }), TypeError);
+    } finally {
+        dom.restore();
+    }
+});
+
+test('openReviewDialog lays out heading, grid, options, sentence, backup box and actions', async () => {
+    const { openReviewDialog, closeWorkspaceDialog } = await dialogsModule;
+    const { createScope } = await coreModule;
+    const dom = fakeDOM();
+    const scope = createScope();
+    try {
+        const trigger = new dom.Element('button');
+        dom.body.append(trigger);
+        const option = new dom.Element('div');
+        option.className = 'setting-row';
+        const started = [];
+        const review = openReviewDialog({ scope, title: 'Review maintenance plan', heading: 'Missing-file links',
+            grid: [['Scope', '2 stale image links'], ['Media on disk', 'No source files removed']], options: [option],
+            sentence: 'Cancelling leaves all data untouched.', backup: { copy: { heading: 'Back up first', text: 'A copy.' }, onBackup() {} },
+            cancelLabel: 'Cancel', primary: { label: 'Apply reviewed operation' }, onStart: () => started.push('start'), trigger });
+        assert.equal(byId(dom, 'modal-title').textContent, 'Review maintenance plan');
+        assert.deepEqual(bodyShape(dom), ['h3', 'dl.meta-grid', 'div.setting-row', 'p.small', 'div.notice', 'div.dialog-actions']);
+        const grid = byId(dom, 'modal-body').children[1];
+        assert.deepEqual(grid.children.map(entry => [tags(entry), entry.children[0].textContent, entry.children[1].textContent]), [
+            [['dt', 'dd'], 'Scope', '2 stale image links'], [['dt', 'dd'], 'Media on disk', 'No source files removed']]);
+        review.setValue('Scope', '3 stale image links');
+        assert.equal(grid.children[0].children[1].textContent, '3 stale image links');
+        const actions = byId(dom, 'modal-body').children.at(-1);
+        assert.deepEqual(actions.children.map(node => [node.textContent, node.className]),
+            [['Cancel', ''], ['Apply reviewed operation', 'ca-primary']]);
+        actions.children[1].click();
+        assert.deepEqual(started, ['start']);
+        assert.equal(modal(dom).open, false);
+        assert.equal(document.activeElement, trigger);
+
+        // A danger primary (the concept's Restore) has no sentence, heading, options or backup box when none is given.
+        openReviewDialog({ scope, title: 'Restore preview', grid: [['Integrity', 'Verified']], backup: null,
+            cancelLabel: 'Cancel', primary: { label: 'Restore', danger: true }, onStart() {} });
+        assert.deepEqual(bodyShape(dom), ['dl.meta-grid', 'div.dialog-actions']);
+        assert.equal(button(byId(dom, 'modal-body'), 'Restore').className, 'danger');
+        button(byId(dom, 'modal-body'), 'Cancel').click();
+        assert.equal(modal(dom).open, false);
+        assert.throws(() => openReviewDialog({ scope, title: 'x', grid: [['a']], cancelLabel: 'Cancel', primary: { label: 'Go' },
+            onStart() {} }), TypeError);
+        assert.throws(() => openReviewDialog({ scope, title: 'x', grid: [], cancelLabel: 'Cancel', primary: {}, onStart() {} }), TypeError);
+    } finally {
+        scope.dispose();
+        closeWorkspaceDialog();
+        dom.restore();
+    }
+});
+
+test('review dialog backup box keeps the dialog open and toasts the outcome', async () => {
+    const { openReviewDialog, closeWorkspaceDialog, SCAN_BACKUP_COPY } = await dialogsModule;
+    const { downloadDatabaseBackup, BACKUP_DONE, BACKUP_FAILED } = await scanModule;
+    const { createScope } = await coreModule;
+    const dom = fakeDOM();
+    const scope = createScope();
+    const created = URL.createObjectURL;
+    const revoked = URL.revokeObjectURL;
+    URL.createObjectURL = () => 'blob:backup';
+    URL.revokeObjectURL = () => {};
+    try {
+        const toasts = [];
+        let answer;
+        const fetchUrl = () => new Promise(resolve => { answer = resolve; });
+        openReviewDialog({ scope, title: 'Review metadata scan', grid: [['Sources', '2 output folders']],
+            backup: { copy: SCAN_BACKUP_COPY, onBackup: () => downloadDatabaseBackup({ fetchUrl, notify: text => toasts.push(text) }) },
+            cancelLabel: 'Cancel', primary: { label: 'Start scan' }, onStart() { throw new Error('not started'); } });
+        const action = button(byId(dom, 'modal-body'), 'Back up now');
+        action.click();
+        assert.equal(action.textContent, 'Backing up…');
+        assert.equal(action.getAttribute('aria-disabled'), 'true');
+        // A second press while the copy downloads is ignored.
+        action.click();
+        answer({ ok: true, blob: async () => new Blob(['db']), headers: { get: () => 'attachment; filename="prompts_backup_1.db"' } });
+        await tick();
+        assert.deepEqual(toasts, [BACKUP_DONE]);
+        assert.equal(modal(dom).open, true);
+        assert.equal(action.textContent, 'Back up now');
+        assert.equal(action.getAttribute('aria-disabled'), null);
+        action.click();
+        answer({ ok: false, status: 500 });
+        await tick();
+        assert.deepEqual(toasts, [BACKUP_DONE, BACKUP_FAILED]);
+        assert.equal(modal(dom).open, true);
+    } finally {
+        URL.createObjectURL = created;
+        URL.revokeObjectURL = revoked;
+        scope.dispose();
+        closeWorkspaceDialog();
+        dom.restore();
+    }
+});
+
+test('the scan review is a thin openReviewDialog caller with its scope switch', async () => {
+    const { openScanReviewDialog, closeWorkspaceDialog } = await dialogsModule;
+    const { createScope } = await coreModule;
+    const dom = fakeDOM();
+    const scope = createScope();
+    try {
+        const starts = [];
+        openScanReviewDialog({ scope, sources: 2, onBackup() {}, onStart: value => starts.push(value) });
+        assert.equal(byId(dom, 'modal-title').textContent, 'Review metadata scan');
+        assert.deepEqual(bodyShape(dom), ['dl.meta-grid', 'div.setting-row', 'p.small', 'div.notice', 'div.dialog-actions']);
+        const grid = byId(dom, 'modal-body').children[0];
+        assert.deepEqual(grid.children.map(entry => entry.textContent), ['Sources2 output folders', 'ScopeNew and unresolved files']);
+        const allFiles = byId(dom, 'scan-all-files');
+        allFiles.checked = true;
+        allFiles.dispatchEvent(new Event('change'));
+        assert.equal(grid.children[1].children[1].textContent, 'All files');
+        button(byId(dom, 'modal-body'), 'Start scan').click();
+        assert.deepEqual(starts, [{ scope: 'all' }]);
+    } finally {
+        scope.dispose();
+        closeWorkspaceDialog();
+        dom.restore();
+    }
+});
@@ -0,0 +1,574 @@
+"""Candidate-selection record sets for the local resolver parity test (PR L3 Task 9).
+
+``local_resolver_cases`` covers one sampler's tracing. These cases reach the
+rest of ``_resolve``: several sampler candidates and the identical-branch rule
+(#270), stages that only reach previews, detailer stages and their upstream
+samplers (multistage), and A1111 ``parameters`` with every footer shape. The
+server's ``inspect_prompt_evidence`` is the oracle; nothing here states an
+expected answer. All content is synthetic.
+"""
+
+import json
+import random
+
+try:
+    from tests.local_resolver_cases import EXECUTION_KEY, SPACES, WORDS, _Builder
+except ImportError:  # pragma: no cover - discover -s tests puts tests/ first
+    from local_resolver_cases import EXECUTION_KEY, SPACES, WORDS, _Builder
+
+
+def _encode(text):
+    return {"class_type": "CLIPTextEncode", "inputs": {"text": text, "clip": ["4", 1]}}
+
+
+def _sampler(positive, negative, latent=None, name="KSampler"):
+    inputs = {"seed": 1, "model": ["4", 0], "positive": positive}
+    if negative is not None:
+        inputs["negative"] = negative
+    inputs["latent_image"] = latent or ["5", 0]
+    return {"class_type": name, "inputs": inputs}
+
+
+def _decode(sampler_id):
+    return {"class_type": "VAEDecode", "inputs": {"samples": [sampler_id, 0]}}
+
+
+def _save(image, name="SaveImage"):
+    return {"class_type": name, "inputs": {"images": image}}
+
+
+def _detailer(image, positive, negative, name="FaceDetailer", **extra):
+    inputs = {"image": image, "model": ["4", 0], "positive": positive}
+    inputs["negative"] = negative
+    inputs.update(extra)
+    return {"class_type": name, "inputs": inputs}
+
+
+def _base(**nodes):
+    graph = {
+        "4": {"class_type": "CheckpointLoaderSimple", "inputs": {"ckpt_name": "m"}},
+        "5": {"class_type": "EmptyLatentImage", "inputs": {"width": 64}},
+        "6": _encode("a fox"),
+        "7": _encode("blurry"),
+        "8": _encode("a cat"),
+    }
+    graph.update(nodes)
+    return graph
+
+
+def _samplers():
+    """Several unanchored samplers: identical, differing and mixed branches."""
+    same = _sampler(["6", 0], ["7", 0])
+    cases = {
+        "two-identical": _base(**{"3": same, "9": same}),
+        "two-differ": _base(**{"3": same, "9": _sampler(["8", 0], ["7", 0])}),
+        "two-negative-differs": _base(**{"3": same, "9": _sampler(["6", 0], ["8", 0])}),
+        "identical-without-negative": _base(
+            **{"3": _sampler(["6", 0], None), "9": _sampler(["6", 0], None)}
+        ),
+        "one-unresolved": _base(**{"3": same, "9": _sampler(["missing", 0], ["7", 0])}),
+        "both-unresolved": _base(
+            **{"3": _sampler(["x", 0], ["7", 0]), "9": _sampler(["y", 0], ["7", 0])}
+        ),
+        "three-identical-one-advanced": _base(
+            **{
+                "3": same,
+                "9": same,
+                "10": _sampler(["6", 0], ["7", 0], name="KSamplerAdvanced"),
+            }
+        ),
+        # Equal texts, different recipes: a PromptManager pair against an encoder.
+        "same-text-other-recipe": _base(
+            **{
+                "3": same,
+                "9": _sampler(["11", 0], ["7", 0]),
+                "11": {
+                    "class_type": "PromptManager",
+                    "inputs": {
+                        "text": "fox",
+                        "prepend_text": "a",
+                        "append_text": "",
+                        "clip": ["4", 1],
+                    },
+                },
+            }
+        ),
+        "multistage-latent": _base(
+            **{"3": same, "9": _sampler(["6", 0], ["7", 0], latent=["3", 0])}
+        ),
+    }
+    selector = {
+        "class_type": "easy ifElse",
+        "inputs": {"boolean": ["4", 0], "on_true": ["6", 0], "on_false": ["8", 0]},
+    }
+    cases["selector-and-plain"] = _base(
+        **{"3": same, "9": _sampler(["12", 0], ["7", 0]), "12": selector}
+    )
+    return cases
+
+
+def _previews():
+    """Stages whose outputs reach only previews are not the saved file's."""
+    same, other = _sampler(["6", 0], ["7", 0]), _sampler(["8", 0], ["7", 0])
+    return {
+        "preview-dropped": _base(
+            **{
+                "3": same,
+                "9": other,
+                "13": _decode("3"),
+                "14": _decode("9"),
+                "15": _save(["13", 0]),
+                "16": _save(["14", 0], "PreviewImage"),
+            }
+        ),
+        "all-previews-kept": _base(
+            **{
+                "3": same,
+                "9": other,
+                "13": _decode("3"),
+                "14": _decode("9"),
+                "15": _save(["13", 0], "PreviewImage"),
+                "16": _save(["14", 0], "Image Comparer (rgthree)"),
+            }
+        ),
+        "preview-and-file": _base(
+            **{
+                "3": same,
+                "9": other,
+                "13": _decode("3"),
+                "14": _decode("9"),
+                "15": _save(["13", 0]),
+                "16": _save(["14", 0], "PreviewImage"),
+                "17": _save(["14", 0]),
+            }
+        ),
+        "unconsumed-stage-kept": _base(
+            **{
+                "3": same,
+                "9": other,
+                "14": _decode("9"),
+                "16": _save(["14", 0], "PreviewImage"),
+            }
+        ),
+        # A list or object class_type is never a preview class (#286).
+        "preview-unhashable-class": _base(
+            **{
+                "3": same,
+                "9": other,
+                "14": _decode("9"),
+                "16": {"class_type": ["PreviewImage"], "inputs": {"images": ["14", 0]}},
+                "17": {"class_type": {"a": 1}, "inputs": {"images": ["3", 0]}},
+            }
+        ),
+        "preview-through-bad-node": _base(
+            **{
+                "3": same,
+                "9": other,
+                "13": _decode("3"),
+                "15": _save(["13", 0]),
+                "16": _save(["9", 0], "PreviewImage"),
+                "18": "not a node",
+                "19": {"class_type": "Note", "inputs": {"x": ["18", 0]}},
+            }
+        ),
+    }
+
+
+def _detailers():
+    """Detailer stages judged with the samplers in their image ancestry."""
+    same = _sampler(["6", 0], ["7", 0])
+    cases = {
+        "detailer-same-prompt": _base(
+            **{
+                "3": same,
+                "10": _decode("3"),
+                "11": _detailer(["10", 0], ["6", 0], ["7", 0]),
+                "12": _save(["11", 0]),
+            }
+        ),
+        "detailer-differs": _base(
+            **{
+                "3": same,
+                "10": _decode("3"),
+                "11": _detailer(["10", 0], ["8", 0], ["7", 0]),
+                "12": _save(["11", 0]),
+            }
+        ),
+        "detailer-and-own-output": _base(
+            **{
+                "3": same,
+                "10": _decode("3"),
+                "11": _detailer(["10", 0], ["8", 0], ["7", 0]),
+                "12": _save(["11", 0]),
+                "13": _save(["10", 0]),
+            }
+        ),
+        "detailer-image-literal": _base(
+            **{
+                "11": _detailer("not a link", ["6", 0], ["7", 0]),
+                "12": _save(["11", 0]),
+            }
+        ),
+        "detailer-cycle": _base(
+            **{
+                "11": _detailer(["10", 0], ["6", 0], ["7", 0]),
+                "10": {"class_type": "ImageScale", "inputs": {"image": ["11", 0]}},
+                "12": _save(["11", 0]),
+            }
+        ),
+        "detailer-chain": _base(
+            **{
+                "3": same,
+                "10": _decode("3"),
+                "11": _detailer(["10", 0], ["6", 0], ["7", 0]),
+                "21": _detailer(
+                    ["11", 0], ["8", 0], ["7", 0], name="UltimateSDUpscale"
+                ),
+                "12": _save(["21", 0]),
+            }
+        ),
+        "detailer-chain-same": _base(
+            **{
+                "3": same,
+                "10": _decode("3"),
+                "11": _detailer(["10", 0], ["6", 0], ["7", 0]),
+                "21": _detailer(["11", 0], ["6", 0], ["7", 0], name="DetailerForEach"),
+                "12": _save(["21", 0]),
+            }
+        ),
+        "detailer-two-upstream": _base(
+            **{
+                "3": same,
+                "9": _sampler(["8", 0], ["7", 0]),
+                "10": {
+                    "class_type": "ImageBlend",
+                    "inputs": {"image1": ["13", 0], "image2": ["14", 0]},
+                },
+                "13": _decode("3"),
+                "14": _decode("9"),
+                "11": _detailer(["10", 0], ["6", 0], ["7", 0]),
+                "12": _save(["11", 0]),
+            }
+        ),
+        "detailer-unsupported-stage": _base(
+            **{
+                "10": {
+                    "class_type": "MysterySampler",
+                    "inputs": {"positive": ["6", 0], "model": ["4", 0]},
+                },
+                "11": _detailer(["10", 0], ["6", 0], ["7", 0]),
+                "12": _save(["11", 0]),
+            }
+        ),
+        "detailer-upstream-unresolved": _base(
+            **{
+                "3": _sampler(["gone", 0], ["7", 0]),
+                "10": _decode("3"),
+                "11": _detailer(["10", 0], ["6", 0], ["7", 0]),
+                "12": _save(["11", 0]),
+            }
+        ),
+        "detailer-upstream-selector": _base(
+            **{
+                "3": _sampler(["15", 0], ["7", 0]),
+                "15": {
+                    "class_type": "easy ifElse",
+                    "inputs": {
+                        "boolean": ["4", 0],
+                        "on_true": ["6", 0],
+                        "on_false": ["8", 0],
+                    },
+                },
+                "10": _decode("3"),
+                "11": _detailer(["10", 0], ["6", 0], ["7", 0]),
+                "12": _save(["11", 0]),
+            }
+        ),
+        "detailer-wildcard": _base(
+            **{
+                "3": same,
+                "10": _decode("3"),
+                "11": _detailer(["10", 0], ["6", 0], ["7", 0], wildcard="[x|y]"),
+                "12": _save(["11", 0]),
+            }
+        ),
+        "detailer-no-upscaled-image": _base(
+            **{
+                "3": same,
+                "10": _decode("3"),
+                "11": _detailer(
+                    ["10", 0], ["6", 0], ["7", 0], name="UltimateSDUpscaleNoUpscale"
+                ),
+                "12": _save(["11", 0]),
+            }
+        ),
+        "detailer-no-sampler-upstream": _base(
+            **{
+                "10": {"class_type": "LoadImage", "inputs": {"image": "a.png"}},
+                "11": _detailer(["10", 0], ["6", 0], ["7", 0]),
+                "12": _save(["11", 0]),
+            }
+        ),
+    }
+    deep = {"3": _sampler(["6", 0], ["7", 0]), "d0": _decode("3")}
+    for index in range(1, 70):
+        deep[f"d{index}"] = {
+            "class_type": "ImageScale",
+            "inputs": {"image": [f"d{index - 1}", 0]},
+        }
+    deep["11"] = _detailer(["d69", 0], ["6", 0], ["7", 0])
+    deep["12"] = _save(["11", 0])
+    cases["detailer-deep-ancestry"] = _base(**deep)
+    # More nested detailer stages than the depth bound.
+    stacked = {"3": _sampler(["6", 0], ["7", 0]), "s0": _decode("3")}
+    previous = "s0"
+    for index in range(1, 67):
+        stacked[f"s{index}"] = _detailer([previous, 0], ["6", 0], ["7", 0])
+        previous = f"s{index}"
+    stacked["12"] = _save([previous, 0])
+    cases["detailer-stacked-past-depth"] = _base(**stacked)
+    # Each detailer walks a wide shared image ancestry: the total visit budget
+    # runs out across stages before any candidate is read.
+    wide = {
+        f"l{index}": {"class_type": "LoadImage", "inputs": {}} for index in range(1500)
+    }
+    wide["hub"] = {
+        "class_type": "ImageBatchMany",
+        "inputs": {f"i{index}": [f"l{index}", 0] for index in range(1500)},
+    }
+    for index in range(15):
+        wide[f"w{index}"] = _detailer(["hub", 0], ["6", 0], ["7", 0])
+        wide[f"o{index}"] = _save([f"w{index}", 0])
+    cases["detailers-exhaust-total-visits"] = _base(**wide)
+    cases["detailer-mutual-cycle"] = _base(
+        **{
+            "11": _detailer(["21", 0], ["6", 0], ["7", 0]),
+            "21": _detailer(["11", 0], ["6", 0], ["7", 0]),
+            "12": _save(["21", 0]),
+        }
+    )
+    # The sampler's output reaches a preview through more nodes than one
+    # detailer's allowance: the walk runs out, so the sampler is not absorbed.
+    long = {"3": _sampler(["6", 0], ["7", 0]), "10": _decode("3")}
+    previous = "10"
+    for index in range(2100):
+        long[f"c{index}"] = {
+            "class_type": "ImageScale",
+            "inputs": {"image": [previous, 0]},
+        }
+        previous = f"c{index}"
+    long["p"] = _save([previous, 0], "PreviewImage")
+    long["11"] = _detailer(["10", 0], ["6", 0], ["7", 0])
+    long["12"] = _save(["11", 0])
+    cases["detailer-output-walk-exhausted"] = _base(**long)
+    # Every detailer's ancestry walk has its own allowance: the first one is
+    # wide, and the second still absorbs the first.
+    chained = {"3": _sampler(["6", 0], ["7", 0]), "10": _decode("3")}
+    chained["h1"] = {
+        "class_type": "ImageBatchMany",
+        "inputs": {
+            "i": ["10", 0],
+            **{f"i{index}": [f"a{index}", 0] for index in range(1500)},
+        },
+    }
+    chained["h2"] = {
+        "class_type": "ImageBatchMany",
+        "inputs": {
+            "i": ["11", 0],
+            **{f"i{index}": [f"b{index}", 0] for index in range(600)},
+        },
+    }
+    for index in range(1500):
+        chained[f"a{index}"] = {"class_type": "LoadImage", "inputs": {}}
+    for index in range(600):
+        chained[f"b{index}"] = {"class_type": "LoadImage", "inputs": {}}
+    chained["11"] = _detailer(["h1", 0], ["6", 0], ["7", 0])
+    chained["21"] = _detailer(["h2", 0], ["6", 0], ["7", 0])
+    chained["12"] = _save(["21", 0])
+    cases["detailers-each-reset"] = _base(**chained)
+    return cases
+
+
+_FOOTER = "Steps: 20, Sampler: euler, CFG scale: 7"
+
+
+def _parameters():
+    """A1111 ``parameters`` texts: every footer shape and delimiter rule."""
+    texts = {
+        "basic": f"a fox\nNegative prompt: blur\n{_FOOTER}",
+        "no-negative": f"a fox\n{_FOOTER}",
+        "two-delimiters": f"a\nNegative prompt: b\nNegative prompt: c\n{_FOOTER}",
+        "leading-delimiter": f"Negative prompt: blur\n{_FOOTER}",
+        "blank-positive": f" \x85\nNegative prompt: blur\n{_FOOTER}",
+        "footer-not-last": f"a fox\n{_FOOTER}\nmore text",
+        "two-footers": f"a\n{_FOOTER}\n{_FOOTER}",
+        "bare-footer": "a fox\nNegative prompt: blur\nSteps: 20",
+        "bare-and-full": f"a fox\nSteps: 5\n{_FOOTER}",
+        "two-bare": "a\nSteps: 1\nSteps: 2",
+        "template": f"a fox\n{_FOOTER}\nTemplate: {{a|b}}",
+        "both-templates": f"a\n{_FOOTER}\nTemplate: x\nNegative Template: y",
+        "templates-reversed": f"a\n{_FOOTER}\nNegative Template: y\nTemplate: x",
+        "two-templates": f"a\n{_FOOTER}\nTemplate: x\nTemplate: y",
+        "template-multiline": f"a\n{_FOOTER}\nTemplate: x\nmore",
+        "crlf": f"a fox\r\nNegative prompt: blur\r\n{_FOOTER}\r\n",
+        "cr-only": f"a fox\rNegative prompt: blur\r{_FOOTER}",
+        "cr-template": f"a\n{_FOOTER}\rTemplate: x",
+        "line-separator": f"a fox {_FOOTER}",
+        "next-line": f"a fox\x85{_FOOTER}",
+        "spaced-steps": "a fox\nSteps:\n 20 \n, x",
+        "steps-newline-bare": "a fox\nSteps:\n20\n",
+        "arabic-digits": "a fox\nSteps: ٢٠, Sampler: euler",
+        "fullwidth-digits": "a fox\nSteps: ２, x",
+        "no-digits": "a fox\nSteps: , x",
+        "trailing-spaces": f"a fox  \nNegative prompt:   blur  \n{_FOOTER}   \n  \n",
+        "empty-negative": f"a fox\nNegative prompt:\n{_FOOTER}",
+        "astral-within-limit": "\U0001f600" * 60_000 + f"\n{_FOOTER}",
+        "over-limit": "x" * 100_001,
+        "at-limit": "x" * (100_000 - len(_FOOTER) - 1) + "\n" + _FOOTER,
+        "empty": "",
+        "only-footer": _FOOTER,
+        "lone-surrogate": f"\ud800 fox\nNegative prompt: \udfff\n{_FOOTER}",
+    }
+    cases = {f"parameters-{name}": {"parameters": text} for name, text in texts.items()}
+    cases["parameters-with-execution"] = {
+        "parameters": texts["basic"],
+        EXECUTION_KEY: json.dumps({"version": 1, "nodes": {}}),
+    }
+    return cases
+
+
+def selection_cases():
+    """Named record sets for every Task 9 path, each a ``read_inspection_file`` dict."""
+    cases = {}
+    for group in (_samplers(), _previews(), _detailers()):
+        for name, graph in group.items():
+            cases[f"select-{name}"] = {"prompt": json.dumps(graph, ensure_ascii=False)}
+    cases.update(_parameters())
+    return cases
+
+
+class _Selection(_Builder):
+    """Random graphs with several samplers, outputs, previews and detailers."""
+
+    def sampler(self):
+        rng = self.rng
+        positive = self.conditioning(0)
+        negative = self.conditioning(0) if rng.random() < 0.85 else None
+        name = rng.choice(["KSampler", "KSampler", "KSamplerAdvanced", "SamplerCustom"])
+        node_id = self.new_id()
+        self.nodes[node_id] = _sampler(positive, negative, name=name)
+        return node_id
+
+    def shared(self, ids):
+        """A copy of an earlier sampler: an identical branch."""
+        node_id = self.new_id()
+        self.nodes[node_id] = json.loads(json.dumps(self.nodes[self.rng.choice(ids)]))
+        return node_id
+
+    def output(self, image):
+        rng = self.rng
+        choice = rng.randrange(5)
+        if choice == 4:
+            return
+        name = ["SaveImage", "SaveImage", "PreviewImage", "PreviewAny"][choice]
+        self.nodes[self.new_id()] = _save(image, name)
+
+    def detailer(self, image):
+        rng = self.rng
+        node_id = self.new_id()
+        positive = self.conditioning(1) if rng.random() < 0.5 else None
+        name = rng.choice(list(_DETAILER_NAMES))
+        node = _detailer(image, positive, self.conditioning(1), name=name)
+        if positive is None:
+            node["inputs"]["positive"] = self.reuse_positive()
+        if name == "UltimateSDUpscaleNoUpscale":
+            node["inputs"]["upscaled_image"] = node["inputs"].pop("image")
+        if name in ("FaceDetailer", "DetailerForEach") and rng.random() < 0.15:
+            node["inputs"]["wildcard"] = rng.choice(["", "x", ["4", 0]])
+        self.nodes[node_id] = node
+        return node_id
+
+    def reuse_positive(self):
+        samplers = [
+            node
+            for node in self.nodes.values()
+            if node.get("class_type")
+            in ("KSampler", "KSamplerAdvanced", "SamplerCustom")
+        ]
+        if samplers:
+            return self.rng.choice(samplers)["inputs"]["positive"]
+        return self.conditioning(1)
+
+    def build(self):
+        rng = self.rng
+        ids = [self.sampler()]
+        for _ in range(rng.randrange(3)):
+            ids.append(self.shared(ids) if rng.random() < 0.4 else self.sampler())
+        for sampler_id in list(ids):
+            decoded = self.new_id()
+            self.nodes[decoded] = _decode(sampler_id)
+            image = [decoded, 0]
+            for _ in range(rng.randrange(3)):
+                if rng.random() < 0.5:
+                    image = [self.detailer(image), 0]
+                else:
+                    self.output(image)
+            self.output(image)
+            if rng.random() < 0.1:
+                self.nodes[sampler_id]["inputs"]["latent_image"] = [rng.choice(ids), 0]
+        graph = {
+            "4": {"class_type": "CheckpointLoaderSimple", "inputs": {"ckpt_name": "m"}},
+            "5": {"class_type": "EmptyLatentImage", "inputs": {"width": 64}},
+        }
+        graph.update(self.nodes)
+        return graph
+
+
+_DETAILER_NAMES = (
+    "FaceDetailer",
+    "DetailerForEach",
+    "UltimateSDUpscale",
+    "UltimateSDUpscaleNoUpscale",
+)
+_PARAMETER_LINES = [
+    "Negative prompt:",
+    "Negative prompt: blur",
+    "Steps: 20, Sampler: euler",
+    "Steps: 7",
+    "Steps: x",
+    "Template: t",
+    "Negative Template: n",
+    "Steps:٣, a",
+]
+
+
+def _parameter_text(rng):
+    parts = []
+    for _ in range(rng.randint(1, 5)):
+        if rng.random() < 0.5:
+            parts.append(rng.choice(_PARAMETER_LINES))
+        else:
+            parts.append(rng.choice(SPACES) + rng.choice(WORDS) + rng.choice(SPACES))
+    joints = ["\n", "\n", "\r\n", "\r", " ", " "]
+    return "".join(part + rng.choice(joints) for part in parts).rstrip(
+        rng.choice(["", "\n", " "])
+    )
+
+
+def selection_fuzz_cases(seed, count):
+    """Seeded several-sampler graphs (sometimes corrupted) and parameters texts."""
+    rng = random.Random(seed)
+    cases = {}
+    for index in range(count):
+        if rng.random() < 0.2:
+            cases[f"select-fuzz-{seed}-{index}"] = {"parameters": _parameter_text(rng)}
+            continue
+        builder = _Selection(rng)
+        graph = builder.build()
+        if rng.random() < 0.2:
+            builder.nodes = graph
+            builder.corrupt()
+        records = {"prompt": json.dumps(graph, ensure_ascii=rng.random() < 0.5)}
+        records.update(builder.records)
+        cases[f"select-fuzz-{seed}-{index}"] = records
+    return cases
@@ -486,6 +486,30 @@ class TestStaticRoutes(CoreRoutesTestCase):
        self.assertEqual(resp.status, 200)
        self.assertIn("application/javascript", resp.headers["Content-Type"])

+    async def test_inspection_semantics_table_is_the_one_json_served(self):
+        """Local Inspect reads the node table the server resolves with (#249 PR L3).
+
+        Only that exact file is served; every other JSON stays forbidden.
+        """
+        resp = await self.client.request(
+            "GET", "/prompt_manager/js/inspection-semantics.json"
+        )
+        self.assertEqual(resp.status, 200)
+        self.assertIn("application/json", resp.headers["Content-Type"])
+        table = Path(__file__).resolve().parents[1] / "web" / "js"
+        self.assertEqual(
+            await resp.read(), (table / "inspection-semantics.json").read_bytes()
+        )
+        for path in (
+            "js/shared/toolkit/provenance.json",
+            "lib/viewerjs/provenance.json",
+            "lib/inspection-semantics.json",
+            "js/workspace/..%2Finspection-semantics.json",
+            "js/INSPECTION-SEMANTICS.json",
+        ):
+            resp = await self.client.request("GET", f"/prompt_manager/{path}")
+            self.assertEqual(resp.status, 403, path)
+
    async def test_lib_served(self):
        web_dir = self._fake_root()
        (web_dir / "lib" / "x.css").write_text("body{}")
@@ -578,6 +602,28 @@ class TestStaticRoutes(CoreRoutesTestCase):
        resp = await self.client.request("GET", "/prompt_manager/lib/link.js")
        self.assertEqual(resp.status, 403)

+    async def test_inspection_semantics_symlink_escaping_web_dir_is_403(self):
+        """The exact-path JSON gets the same realpath containment as any file."""
+        web_dir = self._fake_root()
+        secret = Path(self.tmpdir) / "secret.json"
+        secret.write_text('{"secret": true}')
+        try:
+            os.symlink(secret, web_dir / "js" / "inspection-semantics.json")
+        except (OSError, NotImplementedError):
+            self.skipTest("symlinks not available")
+        resp = await self.client.request(
+            "GET", "/prompt_manager/js/inspection-semantics.json"
+        )
+        self.assertEqual(resp.status, 403)
+        self.assertNotIn("secret", await resp.text())
+
+    async def test_inspection_semantics_missing_is_404(self):
+        self._fake_root()
+        resp = await self.client.request(
+            "GET", "/prompt_manager/js/inspection-semantics.json"
+        )
+        self.assertEqual(resp.status, 404)
+
    async def test_empty_path_is_not_served(self):
        for prefix in ("lib", "js"):
            resp = await self.client.request("GET", f"/prompt_manager/{prefix}/")
@@ -1643,6 +1643,62 @@ class TestPromptInspector(ImageAPITestCase):
                        str(path), False, report_ambiguity=True
                    )

+    async def test_unhashable_workflow_node_type_is_skipped(self):
+        """A UI workflow node whose ``type`` is a list or dict is skipped (#286).
+
+        The R1 check looks each node's ``type`` up among subgraph IDs; an
+        unhashable ``type`` used to raise there and the route answered 500.
+        Such a node can be neither a subgraph instance nor a PromptManager
+        node, so the walk skips it and a prompt that resolves still resolves.
+        """
+        source = graph()
+        source["1"]["class_type"] = "PromptManager"
+        for kind in (["PromptManager"], {"name": "PromptManager"}):
+            with self.subTest(kind=type(kind).__name__):
+                workflow = json.dumps(
+                    {"nodes": [{"id": 1, "type": kind, "widgets_values": ["x"]}]}
+                )
+                png(
+                    self.output_dir / "image.png",
+                    prompt=json.dumps(source),
+                    workflow=workflow,
+                )
+                response, result = await self.inspect()
+                self.assertEqual(response.status, 200)
+                self.assertEqual(result["resolution"]["state"], "resolved")
+                self.assertEqual(result["resolution"]["sampler_id"], "3")
+                self.assertEqual(result["prompts"]["positive"]["status"], "resolved")
+                self.assertEqual(result["prompts"]["positive"]["text"], "portrait")
+                self.assertEqual(result["prompts"]["negative"]["text"], "blurry")
+                self.assertNotIn("unhashable", json.dumps(result))
+
+    async def test_unhashable_graph_class_type_is_not_a_preview_output(self):
+        """A list or object ``class_type`` never names a preview output (#286).
+
+        With several samplers the inspector first drops stages that reach only
+        previews; looking such a ``class_type`` up among the preview classes
+        used to raise, and the route answered 500.
+        """
+        for kind in (["PreviewImage"], {"name": "PreviewImage"}):
+            with self.subTest(kind=type(kind).__name__):
+                source = graph()
+                source["9"] = {
+                    "class_type": "KSampler",
+                    "inputs": {"positive": ["8", 0], "negative": ["2", 0]},
+                }
+                source["8"] = {
+                    "class_type": "CLIPTextEncode",
+                    "inputs": {"text": "cat"},
+                }
+                source["10"] = {"class_type": kind, "inputs": {"images": ["9", 0]}}
+                png(self.output_dir / "image.png", prompt=json.dumps(source))
+                response, result = await self.inspect()
+                self.assertEqual(response.status, 200)
+                self.assertEqual(
+                    result["resolution"]["reason"], "Multiple sampler branches"
+                )
+                self.assertEqual(result["resolution"]["state"], "ambiguous")
+

 class TestInspectorImageTags(ImageAPITestCase):
    """B3: the inspector envelope's ``image_tags`` facet (spec amendment S1)."""
@@ -0,0 +1,234 @@
+"""A slow page-workflow reset reports where the server waited.
+
+CI run 39904288262 had one ``/__test__/reset`` wait 16 s with nothing in the
+server's stderr. tests/browser/slow_reset_watch.py reports any reset past
+SLOW_RESET_SECONDS with every thread's stack, taken while it still waits.
+These tests hold a real SQLite write lock behind a real test server's reset.
+"""
+
+import glob
+import io
+import os
+import sqlite3
+import subprocess
+import sys
+import tempfile
+import threading
+import time
+import unittest
+import urllib.request
+from pathlib import Path
+
+from tests.browser import slow_reset_watch
+from tests.browser.slow_reset_watch import REPORT_PREFIX, ResetWatch, is_reset_path
+
+REPO_ROOT = Path(__file__).resolve().parent.parent
+SERVER_TIMEOUT_S = 60
+HOLD_SECONDS = slow_reset_watch.SLOW_RESET_SECONDS + 4
+# The reset may take a little longer than the hold, never the 30 s busy timeout.
+RESET_MARGIN_SECONDS = 10
+# While the reset waits, the server still answers other requests this fast.
+# Reading the waiting connection from the report's thread froze it (the GIL is
+# held while SQLite's connection mutex is awaited) until the lock was released.
+RESPONSIVE_SECONDS = 2.0
+PROBE_INTERVAL_SECONDS = 0.1
+
+
+def blocked_here(gate: threading.Event) -> None:
+    gate.wait()
+
+
+class TestResetWatch(unittest.TestCase):
+    def test_reset_paths_are_the_test_reset_routes(self):
+        self.assertTrue(is_reset_path("/__test__/reset"))
+        self.assertTrue(is_reset_path("/__test__/tagging/reset"))
+        self.assertFalse(is_reset_path("/prompt_manager/reset"))
+        self.assertFalse(is_reset_path("/__test__/reset/extra"))
+
+    def test_a_stalled_reset_reports_state_and_stacks_while_it_waits(self):
+        stream = io.StringIO()
+        reported = threading.Event()
+
+        class Stream(io.StringIO):
+            def flush(self):
+                reported.set()
+
+        stream = Stream()
+        gate = threading.Event()
+        worker = threading.Thread(target=blocked_here, args=(gate,), name="held-up")
+        worker.start()
+        self.addCleanup(worker.join)
+        self.addCleanup(gate.set)
+        watch = ResetWatch(
+            "POST /__test__/reset",
+            lambda: ["database: 1 connections"],
+            threshold=0.05,
+            stream=stream,
+        ).start()
+        self.assertTrue(reported.wait(SERVER_TIMEOUT_S))
+        report = stream.getvalue().splitlines()
+        self.assertTrue(all(line.startswith(REPORT_PREFIX) for line in report))
+        text = "\n".join(report)
+        self.assertIn("POST /__test__/reset still running after", text)
+        self.assertIn("database: 1 connections", text)
+        self.assertIn(f"thread 0x{worker.ident:016x} is held-up", text)
+        self.assertIn("in blocked_here", text)
+
+        watch.record_call("seed", 0.25, 1.5)
+        watch.finish("answered 200")
+        self.assertIn("POST /__test__/reset answered 200 after", stream.getvalue())
+        self.assertIn(
+            "executor call seed: queued 0.250s, ran 1.500s", stream.getvalue()
+        )
+
+    def test_a_fast_reset_writes_nothing_and_stops_its_timer(self):
+        stream = io.StringIO()
+        watch = ResetWatch("reset", lambda: [], threshold=60, stream=stream).start()
+        watch.finish("answered 200")
+        self.assertTrue(watch._timer.finished.is_set())
+        self.assertEqual(stream.getvalue(), "")
+
+    def test_a_failing_state_probe_still_reports_the_stacks(self):
+        def broken():
+            raise RuntimeError("no state")
+
+        reported = threading.Event()
+
+        class Stream(io.StringIO):
+            def flush(self):
+                reported.set()
+
+        stream = Stream()
+        ResetWatch("reset", broken, threshold=0.01, stream=stream).start()
+        self.assertTrue(reported.wait(SERVER_TIMEOUT_S))
+        self.assertIn("state unavailable: RuntimeError('no state')", stream.getvalue())
+        self.assertIn("most recent call first", stream.getvalue())
+
+
+class TestSlowResetOnTheServer(unittest.TestCase):
+    """A reset behind another process's write lock, on tests/browser/server.py."""
+
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.tmp.cleanup)
+        env = {**os.environ, "TMPDIR": self.tmp.name}
+        env.update(TEMP=self.tmp.name, TMP=self.tmp.name)
+        self.stderr = tempfile.TemporaryFile()
+        self.addCleanup(self.stderr.close)
+        process = subprocess.Popen(
+            [sys.executable, "-m", "tests.browser.server", "--port", "0"],
+            cwd=REPO_ROOT,
+            env=env,
+            stdin=subprocess.PIPE,
+            stdout=subprocess.PIPE,
+            stderr=self.stderr,
+        )
+
+        def stop():
+            if process.poll() is None:
+                process.kill()
+            process.wait(timeout=SERVER_TIMEOUT_S)
+            for stream in (process.stdin, process.stdout):
+                stream.close()
+
+        self.addCleanup(stop)
+        line = process.stdout.readline().decode()
+        self.assertTrue(line.startswith("PM_TEST_SERVER_PORT="), line)
+        self.base = f"http://127.0.0.1:{int(line.split('=', 1)[1])}"
+        deadline = time.monotonic() + SERVER_TIMEOUT_S
+        while True:
+            try:
+                with urllib.request.urlopen(  # nosec B310
+                    self.base + "/prompt_manager/test", timeout=1
+                ):
+                    break
+            except OSError:
+                self.assertIsNone(process.poll(), "the server exited early")
+                self.assertLess(time.monotonic(), deadline, "never ready")
+                time.sleep(0.1)
+        [self.db_path] = glob.glob(
+            os.path.join(self.tmp.name, "pm-browser-*", "browser.db")
+        )
+
+    def reset(self) -> tuple[int, float]:
+        request = urllib.request.Request(
+            self.base + "/__test__/reset",
+            data=b"{}",
+            headers={"Content-Type": "application/json"},
+            method="POST",
+        )
+        start = time.monotonic()
+        with urllib.request.urlopen(  # nosec B310
+            request, timeout=SERVER_TIMEOUT_S
+        ) as response:
+            return response.status, time.monotonic() - start
+
+    def server_stderr(self) -> str:
+        self.stderr.seek(0)
+        return self.stderr.read().decode("utf-8", "replace")
+
+    def test_a_reset_held_behind_a_write_lock_names_the_wait_and_ends_with_it(self):
+        self.assertEqual(self.reset()[0], 200, self.server_stderr())
+        self.assertNotIn(REPORT_PREFIX, self.server_stderr())
+
+        held = threading.Event()
+
+        def hold_write_lock():
+            holder = sqlite3.connect(self.db_path, timeout=SERVER_TIMEOUT_S)
+            try:
+                holder.execute("BEGIN IMMEDIATE")
+                held.set()
+                time.sleep(HOLD_SECONDS)
+                holder.rollback()
+            finally:
+                holder.close()
+
+        lock = threading.Thread(target=hold_write_lock)
+        lock.start()
+        self.addCleanup(lock.join)
+        self.assertTrue(held.wait(SERVER_TIMEOUT_S))
+        outcome = []
+        resetting = threading.Thread(target=lambda: outcome.append(self.reset()))
+        resetting.start()
+        self.addCleanup(resetting.join)
+        slowest = 0.0
+        while resetting.is_alive():
+            start = time.monotonic()
+            with urllib.request.urlopen(  # nosec B310
+                self.base + "/prompt_manager/test", timeout=SERVER_TIMEOUT_S
+            ):
+                slowest = max(slowest, time.monotonic() - start)
+            time.sleep(PROBE_INTERVAL_SECONDS)
+        resetting.join()
+        lock.join()
+        self.assertEqual(len(outcome), 1, self.server_stderr())
+        [(status, elapsed)] = outcome
+
+        self.assertLess(slowest, RESPONSIVE_SECONDS)
+        self.assertEqual(status, 200)
+        self.assertGreaterEqual(elapsed, HOLD_SECONDS - 0.5)
+        self.assertLess(elapsed, HOLD_SECONDS + RESET_MARGIN_SECONDS)
+        report = [
+            line[len(REPORT_PREFIX) :]
+            for line in self.server_stderr().splitlines()
+            if line.startswith(REPORT_PREFIX)
+        ]
+        text = "\n".join(report)
+        self.assertIn("POST /__test__/reset still running after", text)
+        self.assertIn("default executor:", text)
+        if sys.platform.startswith("linux"):
+            # SQLite's busy handler sleeps between its retries.
+            self.assertRegex(
+                text, r"kernel: asyncio_\d+ \(0x[0-9a-f]{16}\) state \w, waiting in "
+            )
+        # The plain reset's seed() waits on its first DELETE.
+        self.assertRegex(text, r"line \d+ in seed\n")
+        self.assertIn("POST /__test__/reset answered 200 after", text)
+        self.assertRegex(
+            text,
+            r"executor call create_app.<locals>.seed: queued \d+\.\d+s, ran \d+\.\d+s",
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()
@@ -0,0 +1,614 @@
+"""The read-only health check (System › Overview and Maintenance).
+
+``run_health_checks`` reads one snapshot on its own ``mode=ro`` connection:
+SQLite's integrity and foreign-key checks, stored prompt hashes against
+``utils.hashing``, duplicate pair rows, the legacy consistency queries, image
+links whose file is gone (only under readable sources) and the Needs-review
+count when one is supplied. It never writes, and it never turns a check it
+could not run into a count.
+"""
+
+import hashlib
+import ntpath
+import os
+import sqlite3
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+from unittest.mock import patch
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+from database import health  # noqa: E402
+from database.operations import PromptDatabase  # noqa: E402
+from utils.hashing import generate_prompt_hash  # noqa: E402
+
+try:
+    from tests.open_handles import assert_closed  # noqa: E402
+except ImportError:  # discovered with tests/ as the top-level directory
+    from open_handles import assert_closed  # noqa: E402
+
+CHECK_IDS = [
+    "integrity",
+    "foreign_keys",
+    "canonical_hashes",
+    "pair_uniqueness",
+    "missing_files",
+    "ambiguous_metadata",
+    "consistency",
+]
+
+
+def _digest(path):
+    if not os.path.exists(path):
+        return None
+    with open(path, "rb") as handle:
+        return hashlib.sha256(handle.read()).hexdigest()
+
+
+class HealthTestCase(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory()
+        self.root = Path(os.path.realpath(self.temp.name))
+        self.output = self.root / "output"
+        self.output.mkdir()
+        self.db_path = str(self.root / "prompts.db")
+        self.db = PromptDatabase(self.db_path)
+
+    def tearDown(self):
+        self.db.close_all()
+        assert_closed(self, self.root)
+        self.temp.cleanup()
+
+    def save(self, text, **metadata):
+        return self.db.save_prompt(
+            text, prompt_hash=generate_prompt_hash(text), **metadata
+        )
+
+    def image(self, prompt_id, name, *, exists=True, folder=None):
+        folder = Path(folder or self.output)
+        path = folder / name
+        if exists:
+            path.write_bytes(b"png")
+        return self.db.link_image_to_prompt(prompt_id, str(path))
+
+    def run_checks(self, roots=None, **kwargs):
+        roots = [str(self.output)] if roots is None else roots
+        return self.db.run_health_checks(roots, **kwargs)
+
+    @staticmethod
+    def check(report, check_id):
+        return next(c for c in report["checks"] if c["id"] == check_id)
+
+    def raw(self):
+        """A plain connection for planting damage the app itself never writes."""
+        conn = sqlite3.connect(self.db_path)
+        conn.execute("PRAGMA foreign_keys=OFF")
+        return conn
+
+
+class TestHealthReport(HealthTestCase):
+    def test_clean_library_passes_except_unavailable_review(self):
+        prompt = self.save("A clean prompt")
+        self.db.save_prompt_pair("Cat", "Blur")
+        self.image(prompt, "a.png")
+        report = self.run_checks(review_count=0)
+        self.assertTrue(report["success"])
+        self.assertEqual([c["id"] for c in report["checks"]], CHECK_IDS)
+        self.assertEqual(
+            [c["label"] for c in report["checks"]],
+            [
+                "Integrity check",
+                "Foreign keys & pair references",
+                "Canonical hashes",
+                "Pair uniqueness",
+                "Missing files",
+                "Ambiguous metadata",
+                "Consistency",
+            ],
+        )
+        for check in report["checks"]:
+            self.assertEqual(check["status"], "passed", check)
+            self.assertEqual(check["count"], 0, check)
+        self.assertEqual(report["status"], "passed")
+        self.assertRegex(report["checked_at"], r"^\d{4}-\d\d-\d\dT.*\+00:00$")
+
+    def test_health_check_never_writes(self):
+        prompt = self.save("Untouched")
+        self.image(prompt, "kept.png")
+        self.image(prompt, "gone.png", exists=False)
+        with self.raw() as conn:
+            conn.execute("UPDATE prompts SET hash='stale' WHERE id=?", (prompt,))
+        conn.close()
+        # The app's own connection stays open, as in the running server.
+        self.db.get_statistics()
+        files = [self.db_path, self.db_path + "-wal"]
+        before = [_digest(path) for path in files]
+        shm_size = os.path.getsize(self.db_path + "-shm")
+        media = sorted(os.listdir(self.output))
+        opened = []
+        real_connect = sqlite3.connect
+
+        class Recording(sqlite3.Connection):
+            changes_at_close = None
+
+            def close(self):
+                Recording.changes_at_close = self.total_changes
+                super().close()
+
+        def connect(*args, **kwargs):
+            conn = real_connect(*args, factory=Recording, **kwargs)
+            opened.append((args, kwargs, conn))
+            return conn
+
+        with patch.object(health.sqlite3, "connect", side_effect=connect):
+            report = self.run_checks()
+        self.assertEqual(report["status"], "incomplete")
+        self.assertEqual(len(opened), 1)
+        args, kwargs, conn = opened[0]
+        self.assertTrue(str(args[0]).endswith("?mode=ro"), args)
+        self.assertTrue(kwargs.get("uri"))
+        self.assertEqual(Recording.changes_at_close, 0)
+        with self.assertRaises(sqlite3.ProgrammingError):  # closed in finally
+            conn.execute("SELECT 1")
+        self.assertEqual([_digest(path) for path in files], before)
+        # The -shm holds WAL read marks every reader updates; it never grows.
+        self.assertEqual(os.path.getsize(self.db_path + "-shm"), shm_size)
+        self.assertEqual(sorted(os.listdir(self.output)), media)
+        with self.db.model.get_connection() as live:
+            stored = live.execute(
+                "SELECT hash FROM prompts WHERE id=?", (prompt,)
+            ).fetchone()[0]
+        self.assertEqual(stored, "stale")
+
+    def test_connection_closed_when_a_check_raises(self):
+        self.save("Any")
+        with (
+            patch.object(
+                health,
+                "_canonical_hashes",
+                side_effect=sqlite3.OperationalError("boom"),
+            ),
+            self.assertLogs("prompt_manager.database.health", "ERROR"),
+        ):
+            report = self.run_checks(review_count=0)
+        canonical = self.check(report, "canonical_hashes")
+        self.assertEqual(canonical["status"], "failed")
+        self.assertIsNone(canonical["count"])
+        self.assertEqual(canonical["detail"], ["The check could not finish."])
+        self.assertEqual(self.check(report, "integrity")["status"], "passed")
+        self.assertEqual(report["status"], "incomplete")
+        self.db.close_all()
+        assert_closed(self, self.root)
+
+    def test_unopenable_database_fails_every_database_check(self):
+        missing = PromptDatabase.__new__(PromptDatabase)
+        missing.model = type("M", (), {"db_path": str(self.root / "nope.db")})()
+        with self.assertLogs("prompt_manager.database.health", "ERROR"):
+            report = missing.run_health_checks([str(self.output)], review_count=0)
+        statuses = {c["id"]: c["status"] for c in report["checks"]}
+        self.assertEqual(statuses["integrity"], "failed")
+        self.assertEqual(statuses["missing_files"], "failed")
+        self.assertEqual(statuses["ambiguous_metadata"], "passed")
+        self.assertEqual(report["status"], "incomplete")
+        self.assertFalse(os.path.exists(self.root / "nope.db"))
+
+    def test_integrity_and_foreign_key_issues_reported(self):
+        prompt = self.save("Linked")
+        with self.raw() as conn:
+            conn.execute("CREATE TABLE probe(a)")
+            conn.execute("CREATE INDEX probe_a ON probe(a)")
+            conn.executemany("INSERT INTO probe VALUES(?)", [(i,) for i in range(16)])
+            conn.execute(
+                "INSERT INTO generated_images(prompt_id,image_path,filename,file_path)"
+                " VALUES(?,?,?,?)",
+                (9999, str(self.output / "orphan.png"), "orphan.png", "orphan"),
+            )
+            conn.execute(
+                "INSERT INTO prompt_tags(prompt_id,tag_id) VALUES(?,?)", (prompt, 777)
+            )
+        conn.close()
+        with self.raw() as conn:
+            conn.execute("PRAGMA writable_schema=ON")
+            conn.execute(
+                "UPDATE sqlite_master SET sql='CREATE INDEX probe_a ON probe(a DESC)'"
+                " WHERE name='probe_a'"
+            )
+        conn.close()
+        self.db.close_all()  # the next read sees the edited schema
+        (self.output / "orphan.png").write_bytes(b"png")
+        with self.raw() as conn:
+            expected = [r[0] for r in conn.execute("PRAGMA integrity_check(100)")]
+        conn.close()
+        self.assertGreater(len(expected), 10)
+        report = self.run_checks(review_count=0)
+        integrity = self.check(report, "integrity")
+        self.assertEqual(integrity["status"], "issues")
+        self.assertEqual(integrity["count"], len(expected))
+        self.assertEqual(integrity["detail"], expected[:10])
+        self.assertIn("missing from index probe_a", integrity["detail"][0])
+        foreign = self.check(report, "foreign_keys")
+        self.assertEqual(foreign["status"], "issues")
+        self.assertEqual(foreign["count"], 2)
+        self.assertEqual(
+            sorted(foreign["detail"]),
+            [
+                "generated_images row 1 references a missing prompts row",
+                "prompt_tags row 1 references a missing tags row",
+            ],
+        )
+        consistency = self.check(report, "consistency")
+        self.assertEqual(consistency["status"], "issues")
+        self.assertEqual(consistency["count"], 1)
+        self.assertEqual(
+            consistency["detail"], ["Image 1 references non-existent prompt 9999"]
+        )
+        self.assertEqual(report["status"], "issues")
+
+    def test_canonical_hash_mismatch_counts_rows(self):
+        ids = [self.save(f"Prompt {n}") for n in range(14)]
+        with self.raw() as conn:
+            for n, prompt_id in enumerate(ids[:12]):
+                conn.execute(
+                    "UPDATE prompts SET hash=? WHERE id=?", (f"bad{n}", prompt_id)
+                )
+            conn.execute("UPDATE prompts SET hash=NULL WHERE id=?", (ids[12],))
+        conn.close()
+        # Normalised spellings hash alike: this one is not a mismatch.
+        self.save("  MIXED Case  ")
+        report = self.run_checks(review_count=0)
+        canonical = self.check(report, "canonical_hashes")
+        self.assertEqual(canonical["status"], "issues")
+        self.assertEqual(canonical["count"], 13)
+        self.assertEqual(len(canonical["detail"]), 10)
+        self.assertEqual(
+            canonical["detail"][0],
+            f"Prompt {ids[0]}: the stored hash does not match its text",
+        )
+
+    def test_duplicate_pair_rows_reported(self):
+        pair = self.db.save_prompt_pair("Cat", "")
+        positive = self.db.get_prompt_pair(pair)["positive_prompt_id"]
+        self.db.save_prompt_pair("Dog", "Blur")
+        with self.raw() as conn:
+            # Only the partial index keeps positive-only pairs unique; a restored
+            # or hand-edited database may have lost it.
+            conn.execute("DROP INDEX idx_prompt_pairs_positive_only")
+            conn.executemany(
+                "INSERT INTO prompt_pairs(positive_prompt_id,negative_prompt_id)"
+                " VALUES(?,NULL)",
+                [(positive,), (positive,)],
+            )
+        conn.close()
+        report = self.run_checks(review_count=0)
+        pairs = self.check(report, "pair_uniqueness")
+        self.assertEqual(pairs["status"], "issues")
+        self.assertEqual(pairs["count"], 2)
+        self.assertEqual(
+            pairs["detail"],
+            [f"Positive prompt {positive} with no negative: 3 pair rows"],
+        )
+
+    def test_integrity_count_at_the_limit_is_flagged_capped(self):
+        class Rows:
+            def __init__(self, rows):
+                self.rows = rows
+
+            def execute(self, _sql):
+                return iter([(row,) for row in self.rows])
+
+        capped = health._integrity(Rows(["bad"] * health.INTEGRITY_LIMIT), [])
+        self.assertEqual(capped["status"], "issues")
+        self.assertEqual(capped["count"], health.INTEGRITY_LIMIT)
+        self.assertTrue(capped["capped"])
+        exact = health._integrity(Rows(["bad"] * 3), [])
+        self.assertEqual(exact["count"], 3)
+        self.assertFalse(exact["capped"])
+        self.assertFalse(health._integrity(Rows(["ok"]), [])["capped"])
+
+    def test_an_unexpected_error_fails_only_its_own_check(self):
+        self.save("Any")
+        with (
+            patch.object(health, "_pair_uniqueness", side_effect=KeyError("boom")),
+            self.assertLogs("prompt_manager.database.health", "ERROR"),
+        ):
+            report = self.run_checks(review_count=0)
+        statuses = {c["id"]: c["status"] for c in report["checks"]}
+        self.assertEqual(statuses.pop("pair_uniqueness"), "failed")
+        self.assertEqual(set(statuses.values()), {"passed"})
+
+
+class TestDatabaseUri(unittest.TestCase):
+    """The ``mode=ro`` URI of the database file, for every path form SQLite opens."""
+
+    def test_posix_path_is_a_local_file_uri(self):
+        self.assertEqual(
+            health.readonly_uri("/data/my db#1?.db", windows=False),
+            "file:///data/my%20db%231%3F.db?mode=ro",
+        )
+
+    def test_windows_drive_path(self):
+        self.assertEqual(
+            health.readonly_uri(r"C:\Users\Me\prompts.db", windows=True),
+            "file:///C:/Users/Me/prompts.db?mode=ro",
+        )
+
+    def test_windows_unc_path_has_an_empty_authority(self):
+        # pathlib spells \\server\share as file://server/share, which SQLite
+        # rejects (a non-local authority); an empty one keeps the UNC path.
+        uri = health.readonly_uri(r"\\server\share\Comfy UI\prompts.db", windows=True)
+        self.assertEqual(uri, "file:////server/share/Comfy%20UI/prompts.db?mode=ro")
+        self.assertTrue(ntpath.isabs(r"\\server\share\Comfy UI\prompts.db"))
+
+    def test_uri_opens_a_path_with_uri_characters(self):
+        with tempfile.TemporaryDirectory() as temp:
+            # "?" is not a valid Windows file name character; "#", "%" and spaces are.
+            name = "a #b%20 c.db" if os.name == "nt" else "a #b?c%20.db"
+            path = os.path.join(os.path.realpath(temp), name)
+            conn = sqlite3.connect(path)
+            try:
+                conn.execute("CREATE TABLE t(a)")
+                conn.commit()
+            finally:
+                conn.close()
+            ro = sqlite3.connect(health.readonly_uri(path), uri=True)
+            try:
+                self.assertEqual(ro.execute("SELECT COUNT(*) FROM t").fetchone(), (0,))
+                with self.assertRaises(sqlite3.OperationalError):
+                    ro.execute("INSERT INTO t VALUES(1)")
+            finally:
+                ro.close()
+
+    @unittest.skipUnless(os.name == "nt", "a native UNC path exists on Windows only")
+    def test_native_unc_path_opens(self):
+        with tempfile.TemporaryDirectory() as temp:
+            path = os.path.join(os.path.realpath(temp), "prompts.db")
+            conn = sqlite3.connect(path)
+            try:
+                conn.execute("CREATE TABLE t(a)")
+                conn.commit()
+            finally:
+                conn.close()
+            drive, rest = ntpath.splitdrive(path)
+            unc = "\\\\localhost\\" + drive[0] + "$" + rest
+            if not os.path.exists(unc):
+                self.skipTest("the administrative share is not reachable here")
+            ro = sqlite3.connect(health.readonly_uri(unc), uri=True)
+            try:
+                self.assertEqual(ro.execute("SELECT COUNT(*) FROM t").fetchone(), (0,))
+            finally:
+                ro.close()
+
+
+class TestMissingFiles(HealthTestCase):
+    def test_missing_files_counted_under_readable_sources_only(self):
+        prompt = self.save("Images")
+        self.image(prompt, "here.png")
+        for n in range(12):
+            self.image(prompt, f"gone-{n}.png", exists=False)
+        elsewhere = self.root / "elsewhere"
+        elsewhere.mkdir()
+        self.image(prompt, "outside.png", exists=False, folder=elsewhere)
+        report = self.run_checks(review_count=0)
+        missing = self.check(report, "missing_files")
+        self.assertEqual(missing["status"], "issues")
+        self.assertEqual(missing["count"], 12)
+        self.assertEqual(len(missing["detail"]), 10)
+        self.assertRegex(missing["detail"][0], r"^Image \d+: gone-0\.png is missing$")
+        self.assertNotIn(str(self.root), " ".join(missing["detail"]))
+        with self.db.model.get_connection() as conn:
+            self.assertEqual(
+                conn.execute("SELECT COUNT(*) FROM generated_images").fetchone()[0],
+                14,
+            )
+
+    def test_links_outside_every_source_are_named_not_counted(self):
+        prompt = self.save("Images")
+        elsewhere = self.root / "elsewhere"
+        elsewhere.mkdir()
+        self.image(prompt, "outside.png", exists=False, folder=elsewhere)
+        missing = self.check(self.run_checks(review_count=0), "missing_files")
+        self.assertEqual(missing["status"], "passed")
+        self.assertEqual(missing["count"], 0)
+        self.assertEqual(
+            missing["detail"],
+            ["1 link outside the image sources was not checked."],
+        )
+
+    def test_missing_file_vs_unavailable_root(self):
+        # Per source (S2 ruling): the readable source is counted, the absent
+        # one reports "unavailable" with no count, and the report is incomplete.
+        prompt = self.save("Images")
+        absent = self.root / "unmounted"
+        absent.mkdir()
+        self.image(prompt, "on-nas.png", folder=absent)
+        self.image(prompt, "gone.png", exists=False)
+        os.unlink(absent / "on-nas.png")
+        absent.rmdir()
+        report = self.run_checks([str(self.output), str(absent)], review_count=0)
+        missing = self.check(report, "missing_files")
+        self.assertEqual(missing["status"], "issues")
+        self.assertEqual(missing["count"], 1)
+        self.assertTrue(missing["partial"])
+        self.assertEqual(
+            missing["sources"],
+            [
+                {"name": "output", "status": "checked", "count": 1},
+                {"name": "unmounted", "status": "unavailable", "count": None},
+            ],
+        )
+        self.assertEqual(
+            missing["detail"][0],
+            "1 image source is unavailable, so its files were not counted.",
+        )
+        self.assertRegex(missing["detail"][1], r"^Image \d+: gone\.png is missing$")
+        # The link under the unavailable source is neither counted nor "outside".
+        self.assertEqual(len(missing["detail"]), 2)
+        self.assertNotIn(str(self.root), " ".join(missing["detail"]))
+        self.assertEqual(report["status"], "incomplete")
+
+    def test_partial_sources_with_no_missing_file_are_not_passed(self):
+        prompt = self.save("Images")
+        self.image(prompt, "here.png")
+        absent = self.root / "unmounted"
+        missing = self.check(
+            self.run_checks([str(self.output), str(absent)], review_count=0),
+            "missing_files",
+        )
+        self.assertEqual(missing["status"], "unavailable")
+        self.assertEqual(missing["count"], 0)
+        self.assertTrue(missing["partial"])
+        self.assertEqual(
+            [s["status"] for s in missing["sources"]], ["checked", "unavailable"]
+        )
+
+    def test_every_source_unavailable_counts_nothing(self):
+        prompt = self.save("Images")
+        absent = self.root / "unmounted"
+        self.image(prompt, "gone.png", exists=False, folder=self.output)
+        report = self.run_checks([str(absent)], review_count=0)
+        missing = self.check(report, "missing_files")
+        self.assertEqual(missing["status"], "unavailable")
+        self.assertIsNone(missing["count"])
+        self.assertFalse(missing["partial"])
+        self.assertEqual(
+            missing["sources"],
+            [{"name": "unmounted", "status": "unavailable", "count": None}],
+        )
+        self.assertEqual(
+            missing["detail"],
+            ["1 image source is unavailable, so missing files were not counted."],
+        )
+
+    def test_each_source_counts_its_own_missing_files(self):
+        prompt = self.save("Images")
+        archive = self.root / "archive"
+        archive.mkdir()
+        self.image(prompt, "a.png", exists=False)
+        self.image(prompt, "b.png", exists=False, folder=archive)
+        self.image(prompt, "c.png", exists=False, folder=archive)
+        missing = self.check(
+            self.run_checks([str(self.output), str(archive)], review_count=0),
+            "missing_files",
+        )
+        self.assertEqual(missing["count"], 3)
+        self.assertFalse(missing["partial"])
+        self.assertEqual(
+            [(s["name"], s["count"]) for s in missing["sources"]],
+            [("output", 1), ("archive", 2)],
+        )
+
+    def test_no_sources_is_unavailable(self):
+        self.save("Images")
+        missing = self.check(self.run_checks([], review_count=0), "missing_files")
+        self.assertEqual(missing["status"], "unavailable")
+        self.assertIsNone(missing["count"])
+        self.assertEqual(missing["detail"], ["No image source is available."])
+        self.assertEqual(missing["sources"], [])
+        self.assertFalse(missing["partial"])
+
+    def test_a_bad_stored_path_fails_only_missing_files(self):
+        prompt = self.save("Images")
+        self.image(prompt, "here.png")
+        with self.raw() as conn:
+            conn.execute(
+                "INSERT INTO generated_images(prompt_id,image_path,filename)"
+                " VALUES(?,?,?)",
+                (prompt, str(self.root / "else\x00where.png"), "bad.png"),
+            )
+        conn.close()
+        real_realpath = os.path.realpath
+
+        def realpath(path, *args, **kwargs):
+            # POSIX (and Windows before Python 3.11) raise for the NUL byte;
+            # newer ntpath returns it unchanged. Raise everywhere, as POSIX does.
+            if "\x00" in str(path):
+                raise ValueError("embedded null byte")
+            return real_realpath(path, *args, **kwargs)
+
+        with (
+            patch.object(health.os.path, "realpath", side_effect=realpath),
+            self.assertLogs("prompt_manager.database.health", "ERROR"),
+        ):
+            report = self.run_checks(review_count=0)
+        statuses = {c["id"]: c["status"] for c in report["checks"]}
+        self.assertEqual(statuses.pop("missing_files"), "failed")
+        self.assertEqual(set(statuses.values()), {"passed"})
+
+    def test_files_are_checked_after_the_read_snapshot_ends(self):
+        prompt = self.save("Images")
+        self.image(prompt, "here.png")
+        self.image(prompt, "gone.png", exists=False)
+        opened = []
+        real_connect = sqlite3.connect
+
+        def connect(*args, **kwargs):
+            conn = real_connect(*args, **kwargs)
+            opened.append(conn)
+            return conn
+
+        real_exists = os.path.exists
+        in_snapshot = []
+
+        def exists(path):
+            for conn in opened:
+                try:
+                    in_snapshot.append(conn.in_transaction)
+                except sqlite3.ProgrammingError:  # closed: no snapshot
+                    in_snapshot.append(False)
+            return real_exists(path)
+
+        with (
+            patch.object(health.sqlite3, "connect", side_effect=connect),
+            patch.object(health.os.path, "exists", side_effect=exists),
+        ):
+            missing = self.check(self.run_checks(review_count=0), "missing_files")
+        self.assertEqual((missing["status"], missing["count"]), ("issues", 1))
+        self.assertEqual(len(opened), 1)
+        self.assertTrue(in_snapshot)
+        self.assertNotIn(True, in_snapshot)
+
+
+class TestAmbiguousMetadata(HealthTestCase):
+    def test_ambiguous_metadata_unavailable_without_review_queue(self):
+        self.save("Any")
+        report = self.run_checks()
+        ambiguous = self.check(report, "ambiguous_metadata")
+        self.assertEqual(ambiguous["status"], "unavailable")
+        self.assertIsNone(ambiguous["count"])
+        self.assertEqual(ambiguous["detail"], ["Needs review is not available yet."])
+        self.assertEqual(report["status"], "incomplete")
+
+    def test_review_count_reports_images_needing_review(self):
+        report = self.run_checks(review_count=3)
+        ambiguous = self.check(report, "ambiguous_metadata")
+        self.assertEqual(ambiguous["status"], "issues")
+        self.assertEqual(ambiguous["count"], 3)
+        self.assertEqual(ambiguous["detail"], [])
+        self.assertEqual(report["status"], "issues")
+
+    def test_invalid_review_count_is_rejected(self):
+        for value in (-1, True, "3", 1.5):
+            with self.assertRaises(ValueError):
+                self.run_checks(review_count=value)
+
+
+class TestOverallStatus(unittest.TestCase):
+    def test_overall_status_precedence(self):
+        def checks(*statuses):
+            return [{"status": status} for status in statuses]
+
+        self.assertEqual(health.overall_status(checks("passed", "passed")), "passed")
+        self.assertEqual(health.overall_status(checks("passed", "issues")), "issues")
+        self.assertEqual(
+            health.overall_status(checks("issues", "unavailable")), "incomplete"
+        )
+        self.assertEqual(health.overall_status(checks("failed")), "incomplete")
+        # A check that found issues under only some sources is incomplete too.
+        partial = [{"status": "issues", "partial": True}, {"status": "passed"}]
+        self.assertEqual(health.overall_status(partial), "incomplete")
+
+
+if __name__ == "__main__":
+    unittest.main()
@@ -299,45 +299,126 @@ class OutputWriterTests(fixtures.unittest.TestCase):
        )
        self.assertEqual(writer.context_budget.charged_bytes, 0)

+    def isolated_writer(self) -> HistoryWriter:
+        """A ready writer whose budget no other writer or test can charge."""
+        writer = HistoryWriter(
+            lambda: self.db, clock=self.clock, context_budget=ContextBudget()
+        )
+        self.writers.append(writer)
+        writer.start()
+        self.wait_for(lambda: writer.status().accepting)
+        return writer
+
+    def rotate_between_transactions(self, writer, start, after, restore, hold=None):
+        """Wrap ``after`` so a restore or invalidation lands right after it.
+
+        Returns the patch and an event set once that rotation has returned on
+        the worker. A restore is a full verify/migrate/backup/replace cycle, so
+        the handoff waits on this event with the generous ``BLOCK_SECONDS``
+        ceiling instead of the short worker-behavior deadline (TESTING.md,
+        Windows portability preflight).
+        """
+        backup = os.path.join(self.directory.name, f"restore-{start.run_id}.db")
+        self.assertTrue(self.db.model.backup_database(backup))
+        original = getattr(self.db, after)
+        rotated = threading.Event()
+
+        def write(*args, **kwargs):
+            result = original(*args, **kwargs)
+            try:
+                if hold is not None:
+                    entered, release = hold
+                    entered.set()
+                    release.wait(BLOCK_SECONDS)
+                if restore:
+                    self.db.model.restore_from_file(backup)
+                else:
+                    writer.invalidate()
+            finally:
+                rotated.set()
+            return result
+
+        return patch.object(self.db, after, write), rotated
+
    def test_restore_or_generation_rotation_between_transactions_discards_evidence(
        self,
    ):
        for after in ("write_execution_finish", "write_execution_contexts_for_finish"):
            for restore in (False, True):
                with self.subTest(after=after, restore=restore):
-                    writer = self.writer()
-                    start = self.start_command(len(self.writers))
-                    self.db.write_execution_start(start)
-                    backup = os.path.join(self.directory.name, "restore.db")
-                    self.assertTrue(self.db.model.backup_database(backup))
-                    original = getattr(self.db, after)
+                    # Each subtest owns its writer and budget and retires them
+                    # before the next starts, so one slow restore cannot leave
+                    # in-flight charges or an epoch rotation for the next.
+                    writer = self.isolated_writer()
+                    try:
+                        start = self.start_command(len(self.writers))
+                        self.db.write_execution_start(start)
+                        rotation, rotated = self.rotate_between_transactions(
+                            writer, start, after, restore
+                        )
+                        with rotation:
+                            self.finalization(writer, start)
+                            self.assertTrue(rotated.wait(BLOCK_SECONDS))
+                            self.wait_for(lambda: writer.status().pending == 0)
+                        self.assertEqual(
+                            self.db.get_execution_outputs(start.run_id)["state"],
+                            "not_captured",
+                        )
+                        self.assertEqual(
+                            self.db.get_execution_contexts(start.run_id)["state"],
+                            (
+                                "complete"
+                                if after == "write_execution_contexts_for_finish"
+                                and not restore
+                                else "not_captured"
+                            ),
+                        )
+                        self.assertEqual(writer.context_budget.charged_bytes, 0)
+                    finally:
+                        self.assertTrue(writer.close(BLOCK_SECONDS))

-                    def write(*args, **kwargs):
-                        result = original(*args, **kwargs)
-                        if restore:
-                            self.db.model.restore_from_file(backup)
-                        else:
-                            writer.invalidate()
-                        return result
-
-                    with patch.object(self.db, after, write):
-                        self.finalization(writer, start)
-                        self.wait_for(lambda: writer.status().pending == 0)
-                    self.assertEqual(
-                        self.db.get_execution_outputs(start.run_id)["state"],
-                        "not_captured",
-                    )
-                    self.assertEqual(
-                        self.db.get_execution_contexts(start.run_id)["state"],
-                        (
-                            "complete"
-                            if after == "write_execution_contexts_for_finish"
-                            and not restore
-                            else "not_captured"
-                        ),
-                    )
-                    self.assertEqual(writer.context_budget.charged_bytes, 0)
-                    self.assertTrue(writer.close())
+    def test_slow_restore_between_transactions_holds_charge_only_while_in_flight(
+        self,
+    ):
+        writer = self.isolated_writer()
+        start = self.start_command()
+        self.db.write_execution_start(start)
+        entered, release = self.block()
+        rotation, rotated = self.rotate_between_transactions(
+            writer, start, "write_execution_finish", True, (entered, release)
+        )
+        with rotation:
+            context = self.sealed(writer)
+            outputs = self.outputs(writer, context.lease.byte_count)
+            charge = writer.context_budget.charged_bytes
+            self.assertGreater(charge, 0)
+            self.assertTrue(
+                writer.submit_finalization(self.finish_command(start), context, outputs)
+            )
+            self.assertTrue(entered.wait(BLOCK_SECONDS))
+            # The worker is between transactions: the payload is owned, not leaked.
+            self.assertEqual(writer.status().pending, 1)
+            self.assertEqual(writer.context_budget.charged_bytes, charge)
+            release.set()
+            self.assertTrue(rotated.wait(BLOCK_SECONDS))
+            self.wait_for(lambda: writer.status().pending == 0)
+        self.assertEqual(writer.context_budget.charged_bytes, 0)
+        self.assertFalse(writer.status().accepting)
+        self.assertEqual(
+            self.db.get_execution_outputs(start.run_id)["state"], "not_captured"
+        )
+        # The restored epoch is probed again and new evidence is accepted.
+        self.clock.advance(5)
+        self.wait_for(lambda: writer.status().accepting)
+        restored = self.start_command(2)
+        self.db.write_execution_start(restored)
+        self.finalization(writer, restored)
+        self.wait_for(lambda: writer.status().pending == 0)
+        self.assertEqual(
+            self.db.get_execution_outputs(restored.run_id)["state"], "complete"
+        )
+        self.assertEqual(writer.context_budget.charged_bytes, 0)
+        self.assertTrue(writer.close(BLOCK_SECONDS))

    def test_invalidation_during_output_preparation_rechecks_actual_commit(self):
        import database.execution_outputs as outputs_db
@@ -12,6 +12,7 @@ import json
 import os
 import sys
 import tempfile
+import threading
 import types
 import unittest
 import unittest.mock as mock
@@ -368,10 +369,29 @@ class TestConsoleBanner(unittest.TestCase):
        self.assertIn("Loaded:", banner)


+class PriorFileHandler(logging.FileHandler):
+    """A caller-owned sink that stays closed once its owner closes it.
+
+    ``FileHandler.emit`` reopens the file when ``stream`` is None, so a record
+    that selected this handler before ``close()`` would reopen prior.log after
+    it, and Windows then refuses the temp directory cleanup (WinError 32).
+    ``Handler.handle`` and ``FileHandler.close`` hold the same handler lock, so
+    checking ``_closed`` in ``emit`` is race free (as in the product's
+    ``_OwnedRotatingFileHandler``).
+    """
+
+    def emit(self, record):
+        if not self._closed:
+            super().emit(record)
+
+
 class TestPackageLoggerIsolation(unittest.TestCase):
    def setUp(self):
        self.tmp = tempfile.TemporaryDirectory()
        self.addCleanup(self.tmp.cleanup)
+        # Runs after restore_logging, before the cleanup Windows refuses while
+        # prior.log is open; /proc makes Linux fail the same way.
+        self.addCleanup(self.assert_tmp_has_no_open_handles)
        self.logger = logging.getLogger("prompt_manager")
        self.previous = (
            self.logger.handlers[:],
@@ -381,7 +401,7 @@ class TestPackageLoggerIsolation(unittest.TestCase):
        )
        self.addCleanup(self.restore_logging)
        self.path = os.path.join(self.tmp.name, "prior.log")
-        self.handler = logging.FileHandler(self.path)
+        self.handler = PriorFileHandler(self.path)
        self.logger.handlers = [self.handler]
        self.logger.setLevel(logging.DEBUG)
        self.logger.propagate = True
@@ -398,16 +418,20 @@ class TestPackageLoggerIsolation(unittest.TestCase):
        self.server.PromptServer.instance.prompt_queue.task_done = lambda *a, **k: None

    def restore_logging(self):
-        for handler in self.logger.handlers:
-            if handler not in self.previous[0]:
-                handler.close()
-        self.handler.close()
+        # Detach before closing, so new records stop selecting these handlers.
+        retired = [h for h in self.logger.handlers if h not in self.previous[0]]
        (
            self.logger.handlers,
            self.logger.level,
            self.logger.propagate,
            self.logger.disabled,
        ) = self.previous
+        for handler in retired:
+            handler.close()
+        self.handler.close()
+
+    def assert_tmp_has_no_open_handles(self):
+        self.assertEqual(open_handles_under(self.tmp.name), [])

    def assert_logging_restored(self, handlers, registration):
        for key, module in self.saved_modules.items():
@@ -456,6 +480,49 @@ class TestPackageLoggerIsolation(unittest.TestCase):
        self.assertEqual(open_at_disposal, [True])
        self.assert_logging_restored(handlers, registration)

+    def test_record_in_flight_at_restore_cannot_reopen_prior_log(self):
+        """A record that selected prior.log before restore never reopens it.
+
+        Leaked daemon threads of other tests (image workers, watchdog) log
+        under ``prompt_manager.*``. One that reaches the prior handler while
+        restore_logging closes it would, with a plain FileHandler, reopen the
+        file on emit and keep it open through TemporaryDirectory.cleanup().
+        """
+        message = "record selected before restore_logging"
+        selected = threading.Event()
+        resume = threading.Event()
+        errors = []
+
+        def pause_before_handler_lock(record):
+            if record.getMessage() == message:
+                selected.set()
+                if not resume.wait(5):
+                    raise RuntimeError("logging thread was not released")
+            return True
+
+        def log_from_background_thread():
+            try:
+                logging.getLogger("prompt_manager.late_emitter").warning(message)
+            except BaseException as error:
+                errors.append(error)
+
+        self.handler.addFilter(pause_before_handler_lock)
+        worker = threading.Thread(target=log_from_background_thread, daemon=True)
+        worker.start()
+        try:
+            self.assertTrue(selected.wait(5), "record did not select prior.log")
+            self.restore_logging()
+            self.assertIsNone(self.handler.stream)
+        finally:
+            resume.set()
+            worker.join(5)
+        self.assertFalse(worker.is_alive(), "logging thread did not finish")
+        self.assertEqual(errors, [])
+        self.assertIsNone(self.handler.stream)
+        self.assert_tmp_has_no_open_handles()
+        with open(self.path, encoding="utf-8") as log:
+            self.assertNotIn(message, log.read())
+
    def test_failed_package_import_closes_handlers_and_restores_logging(self):
        name = "prompt_manager_pkg_logger_failure"
        captured = {}
@@ -1706,6 +1706,103 @@ class TestLibrary(unittest.TestCase):
            self.db.list_library_images(positive, pair_id=foreign, archive="all")


+class LibraryCounts(unittest.TestCase):
+    """System › Overview counts and usage statistics follow Library eligibility."""
+
+    setUp = TestLibrary.setUp
+    tearDown = TestLibrary.tearDown
+    save = TestLibrary.save
+    state = TestLibrary.state
+
+    def test_counts_use_library_eligibility(self):
+        self.db.save_prompt_pair("Cat", "Blur")
+        archived = self.db.save_prompt_pair("Cat", "Noise")
+        self.db.archive_prompt_pair(archived)
+        titled_pair = self.db.save_prompt_pair("Dog", "Titled negative")
+        titled = self.db.get_prompt_pair(titled_pair)["negative_prompt_id"]
+        self.state(titled, "A titled parent")  # zero pairs of its own: counted
+        legacy = self.save("Legacy")
+        self.db.link_image_to_prompt(legacy, str(Path(self.temp.name) / "a.png"))
+        self.db.link_image_to_prompt(legacy, str(Path(self.temp.name) / "b.png"))
+        counts = self.db.library_counts()
+        # Cat, Dog, the titled negative and Legacy; "Blur" and "Noise" are
+        # negative-only.
+        self.assertEqual(counts["positive_prompts"], 4)
+        # Cat+Blur and Dog+Titled negative; the archived pair is excluded.
+        self.assertEqual(counts["negative_variants"], 2)
+        self.assertEqual(counts["images"], 2)
+        self.assertEqual(counts["rated_images"], 0)
+        listed = self.db.list_library()
+        self.assertEqual(counts["positive_prompts"], listed["total"])
+        self.assertEqual(counts["negative_variants"], listed["variant_total"])
+
+    def test_counts_of_an_empty_library_are_zero(self):
+        self.assertEqual(
+            self.db.library_counts(),
+            {
+                "positive_prompts": 0,
+                "negative_variants": 0,
+                "images": 0,
+                "rated_images": 0,
+            },
+        )
+
+    def test_rated_images_follow_their_linked_prompt_rating(self):
+        # An image carries no rating of its own: it shows its linked prompt's
+        # (the Images "Highest rated" sort), so "rated" counts those images.
+        folder = Path(self.temp.name)
+        rated = self.save("Rated", rating=4)
+        unrated = self.save("Unrated")
+        for name in ("a.png", "b.png", "c.png"):
+            self.db.link_image_to_prompt(rated, str(folder / name))
+        self.db.link_image_to_prompt(unrated, str(folder / "d.png"))
+        counts = self.db.library_counts()
+        self.assertEqual(counts["images"], 4)
+        self.assertEqual(counts["rated_images"], 3)
+        self.db.update_prompt_rating(unrated, 2)
+        self.assertEqual(self.db.library_counts()["rated_images"], 4)
+
+    def test_statistics_sum_real_run_counts(self):
+        a = self.save("Alpha", category="Landscapes", rating=5)
+        b = self.save("Beta", category="Landscapes", rating=4)
+        self.save("Gamma", category="Landscapes")  # unrated: not in the average
+        c = self.save("Delta", category="Portraits", rating=3)
+        blank = self.save("Epsilon", category="  ")
+        uncategorised = self.save("Zeta")
+        self.db.record_prompt_use(a, times=3)
+        self.db.record_prompt_use(b, times=2)
+        self.db.record_prompt_use(c)
+        self.db.record_prompt_use(blank)
+        self.db.record_prompt_use(uncategorised, times=4)
+        # A negative-only prompt's runs are the pair's runs: never counted twice.
+        pair = self.db.save_prompt_pair("Alpha", "Only negative")
+        negative = self.db.get_prompt_pair(pair)["negative_prompt_id"]
+        with self.db.model.get_connection() as connection:
+            connection.execute(
+                "UPDATE prompts SET category='Landscapes',run_count=50 WHERE id=?",
+                (negative,),
+            )
+        rows = self.db.usage_by_category()
+        self.assertEqual(
+            rows,
+            [
+                {"category": "Landscapes", "runs": 5, "average_rating": 4.5},
+                {"category": None, "runs": 5, "average_rating": None},
+                {"category": "Portraits", "runs": 1, "average_rating": 3.0},
+            ],
+        )
+
+    def test_counts_and_usage_write_nothing(self):
+        self.save("Alpha", category="A")
+        with self.db.model.get_connection() as connection:
+            before = connection.total_changes
+        self.db.library_counts()
+        self.db.usage_by_category()
+        with self.db.model.get_connection() as connection:
+            self.assertEqual(connection.total_changes, before)
+            self.assertFalse(connection.in_transaction)
+
+
 class DisplayTitleUnits(unittest.TestCase):
    """The first-line title is cut like the Library's JavaScript title()."""

@@ -51,12 +51,19 @@ from utils.prompt_inspector import (
    read_inspection_file,
 )

+from utils.prompt_inspector import inspect_prompt_evidence, unreadable_evidence
+from utils.prompt_pair_resolver import INSPECTION_PROFILE
+
 try:
    from tests import inspection_parity as parity
+    from tests import local_resolver_cases as resolver_cases
+    from tests import local_resolver_selection_cases as selection_cases
    from tests.open_handles import assert_closed
    from tests.test_utils_video_metadata import HAVE_FFMPEG, write_video
 except ImportError:  # pragma: no cover - discover -s tests puts tests/ first
    import inspection_parity as parity
+    import local_resolver_cases as resolver_cases
+    import local_resolver_selection_cases as selection_cases
    from open_handles import assert_closed
    from test_utils_video_metadata import HAVE_FFMPEG, write_video

@@ -1111,5 +1118,306 @@ class LocalProjectionParityTests(unittest.TestCase):
        self.assertTrue({"parsed", "malformed", "limited"} <= seen)


+def _server_evidence(records):
+    return inspect_prompt_evidence(records, None, profile=INSPECTION_PROFILE)
+
+
+class LocalResolverParityTests(unittest.TestCase):
+    """``resolveLocalEvidence`` answers as ``inspect_prompt_evidence`` (L3 Tasks 8-9).
+
+    Python is the oracle: every expected value is the server's own answer on the
+    same record texts. Task 8 ported one sampler's tracing; Task 9 ports
+    candidate selection (several samplers, the identical-branch rule of #270,
+    preview-only stages, detailer stages) and A1111 ``parameters``, so no
+    record set is left to the server any more.
+    """
+
+    def setUp(self):
+        temporary = tempfile.TemporaryDirectory()
+        self.addCleanup(temporary.cleanup)
+        self.addCleanup(assert_closed, self, temporary.name)
+        self.directory = Path(temporary.name)
+
+    def _compare(self, cases):
+        """Assert each record set's local evidence equal; return the server answers."""
+        observed = _run_oracle(
+            self,
+            [
+                {"name": name, "mode": "resolve", "records": records}
+                for name, records in cases.items()
+            ],
+        )
+        answers = {}
+        for name, records in cases.items():
+            with self.subTest(case=name):
+                local = observed[name]
+                server = _server_evidence(records)
+                answers[name] = server
+                self.assertEqual(
+                    _canonical_bytes(local["evidence"]), _canonical_bytes(server)
+                )
+        return answers
+
+    def test_local_roles_match_execution_and_single_chain_vectors(self):
+        files = {}
+        for name in parity.COMMITTED:
+            files[name] = parity.fixture_path(name)
+        for name in parity.TEST_TIME:
+            path = parity.fixture_path(name, self.directory)
+            parity.write_png(path, parity.build(name))
+            files[name] = path
+        observed = _run_oracle(
+            self,
+            [
+                {"name": name, "mode": "resolve", "path": str(path)}
+                for name, path in files.items()
+            ],
+        )
+        vectors = {
+            vector["fixture"]: vector
+            for vector in json.loads(parity.VECTORS_PATH.read_text(encoding="utf-8"))
+            if vector["profile"] == "inspection"
+        }
+        compared = 0
+        for name, path in files.items():
+            with self.subTest(fixture=name):
+                local = observed[name]
+                try:
+                    records = read_inspection_file(path).metadata
+                except MetadataReadError:
+                    self.assertTrue(local["unreadable"])
+                    continue
+                # The single-chain subset (Task 8); the rest is Task 9's test below.
+                if not resolver_cases.single_chain(records):
+                    continue
+                server = _server_evidence(records)
+                self.assertEqual(
+                    _canonical_bytes(local["evidence"]), _canonical_bytes(server)
+                )
+                # The committed vector agrees with the server read here.
+                expect = vectors[name]["expect"]
+                self.assertEqual(server["resolution"]["state"], expect["state"])
+                self.assertEqual(
+                    server["resolution"]["reason_code"], expect["reason_code"]
+                )
+                compared += 1
+        self.assertGreaterEqual(compared, 20)
+
+    def test_local_roles_match_inspection_vectors(self):
+        """Every inspection vector: local prompts, resolution and facts equal Images'.
+
+        The facts are ``extractGenerationFacts`` (with the legacy fill) on the
+        local payload, against the facts the committed vectors pin for the
+        server's response on the same file.
+        """
+        vectors = [
+            vector
+            for vector in json.loads(parity.VECTORS_PATH.read_text(encoding="utf-8"))
+            if vector["profile"] == "inspection"
+        ]
+        files = {}
+        for vector in vectors:
+            name = vector["fixture"]
+            if name in parity.TEST_TIME:
+                path = parity.fixture_path(name, self.directory)
+                parity.write_png(path, parity.build(name))
+            else:
+                path = parity.fixture_path(name)
+            files[name] = path
+        observed = _run_oracle(
+            self,
+            [
+                {"name": name, "mode": "resolve", "path": str(path)}
+                for name, path in files.items()
+            ],
+        )
+        for vector in vectors:
+            name = vector["fixture"]
+            with self.subTest(fixture=name):
+                local, expect = observed[name], vector["expect"]
+                try:
+                    server = _server_evidence(
+                        read_inspection_file(files[name]).metadata
+                    )
+                except MetadataReadError:
+                    server = unreadable_evidence()
+                    self.assertTrue(local["unreadable"])
+                self.assertEqual(
+                    _canonical_bytes(local["evidence"]), _canonical_bytes(server)
+                )
+                resolution, prompts = (
+                    local["evidence"]["resolution"],
+                    local["evidence"]["prompts"],
+                )
+                self.assertEqual(
+                    (
+                        resolution["state"],
+                        resolution["reason"],
+                        resolution["reason_code"],
+                    ),
+                    (expect["state"], expect["reason"], expect["reason_code"]),
+                )
+                self.assertEqual(
+                    [
+                        parity._role_text(
+                            prompts[role]["status"], prompts[role]["text"]
+                        )
+                        for role in ("positive", "negative")
+                    ],
+                    [expect["positive"], expect["negative"]],
+                )
+                self.assertEqual(local["facts"], expect["facts"])
+        self.assertEqual(len(vectors), 28)
+
+    def test_local_roles_match_selection_record_sets(self):
+        answers = self._compare(selection_cases.selection_cases())
+        reasons = {answer["resolution"]["reason"] for answer in answers.values()}
+        self.assertTrue(
+            {
+                "Every sampler branch uses the same prompt pair",
+                "Multiple sampler branches",
+                "Sampler stages have different prompts",
+                "Cyclic sampler stage ancestry",
+                "Expected an image link",
+                "Unsupported sampler stage ancestry",
+                "Resolution depth limit reached",
+                "A1111 settings footer is not unique",
+                "Multiple negative prompt delimiters",
+                "Negative prompt delimiter is absent",
+                "Parameters exceed the length limit",
+                "No A1111 parameters",
+            }
+            <= reasons
+        )
+        # A stage reaching only previews is dropped: one sampler is named.
+        self.assertEqual(
+            answers["select-preview-dropped"]["resolution"]["sampler_id"], "3"
+        )
+
+    def test_local_roles_match_fuzzed_selection_sets(self):
+        cases = {}
+        for seed in range(4):
+            cases.update(selection_cases.selection_fuzz_cases(seed, 150))
+        answers = self._compare(cases)
+        reasons = [answer["resolution"]["reason"] for answer in answers.values()]
+        self.assertGreater(reasons.count("Multiple sampler branches"), 20)
+        self.assertGreater(reasons.count("Sampler stages have different prompts"), 0)
+        self.assertGreater(
+            reasons.count("Every sampler branch uses the same prompt pair"), 0
+        )
+        self.assertGreater(reasons.count("A1111 settings footer is not unique"), 0)
+
+    def test_local_roles_match_golden_record_sets(self):
+        answers = self._compare(resolver_cases.golden_cases())
+        codes = {answer["resolution"]["reason_code"] for answer in answers.values()}
+        self.assertTrue(
+            {
+                "malformed",
+                "unsupported-node",
+                "runtime-value",
+                "composite",
+                "work-limit",
+                "depth-limit",
+                "text-limit",
+                "graph-ceiling",
+                "no-sampler",
+                None,
+            }
+            <= codes
+        )
+        sources = {
+            side["source"]
+            for answer in answers.values()
+            for side in answer["prompts"].values()
+        }
+        self.assertTrue(
+            {"execution", "graph-inferred", "zeroed-conditioning"} <= sources
+        )
+
+    def test_committed_resolver_vectors_are_current(self):
+        """The Node unit test's committed answers are still the server's."""
+        committed = json.loads(resolver_cases.VECTORS_PATH.read_text(encoding="utf-8"))
+        self.assertEqual(
+            committed,
+            json.loads(json.dumps(resolver_cases.committed_vectors())),
+            "regenerate with: python3 -m tests.local_resolver_cases --write",
+        )
+
+    def test_local_roles_match_at_every_work_bound(self):
+        answers = self._compare(resolver_cases.boundary_cases())
+        for name in ("visits", "depth", "scanned"):
+            self.assertEqual(answers[f"{name}-edge"]["resolution"]["state"], "resolved")
+            self.assertIn(
+                answers[f"{name}-over"]["resolution"]["reason_code"],
+                ("work-limit", "depth-limit"),
+            )
+        self.assertEqual(
+            answers["named-astral"]["resolution"]["node"]["class_type"],
+            "\U0001f600" * 64,
+        )
+
+    def test_local_json_depth_cap_at_its_boundary(self):
+        """Both kinds of deep record at the browser's JSON depth cap (1,000).
+
+        Locally a record nested past the cap is invalid JSON: a prompt is
+        malformed and a workflow is ignored, as the server answers when
+        ``json.loads`` raises RecursionError. The server's own limit depends on
+        the Python (TESTING.md, "Deep JSON"): about 990 on 3.10 and 3.11, so it
+        agrees past the cap there; about 10,000 on 3.12 and 3.13 and over
+        50,000 on 3.14, so it agrees up to the cap there and reads deeper.
+        """
+        cases = resolver_cases.depth_cases()
+        observed = _run_oracle(
+            self,
+            [
+                {"name": name, "mode": "resolve", "records": records}
+                for name, _kind, _depth, records in cases
+            ],
+        )
+        newer = sys.version_info >= (3, 12)
+        compared = 0
+        for name, kind, depth, records in cases:
+            with self.subTest(case=name):
+                local = observed[name]["evidence"]["resolution"]
+                within = depth <= resolver_cases.JSON_MAX_DEPTH
+                if kind == "prompt":
+                    expected = (
+                        ("resolved", None) if within else ("unresolved", "malformed")
+                    )
+                else:
+                    # A workflow that is read finds the overwritten pair (R1).
+                    expected = (
+                        ("unresolved", "malformed") if within else ("resolved", None)
+                    )
+                self.assertEqual((local["state"], local["reason_code"]), expected)
+                server = _server_evidence(records)
+                if server["resolution"]["state"] == local["state"]:
+                    self.assertEqual(
+                        _canonical_bytes(observed[name]["evidence"]),
+                        _canonical_bytes(server),
+                    )
+                    compared += 1
+                else:
+                    # The documented divergence only: an older server refuses
+                    # a little below the cap, a newer one reads past it.
+                    self.assertEqual(within, not newer)
+        self.assertGreaterEqual(compared, 2)
+
+    def test_local_roles_match_fuzzed_record_sets(self):
+        cases = {}
+        for seed in range(4):
+            cases.update(resolver_cases.fuzz_cases(seed, 150))
+        answers = self._compare(cases)
+        states = [answer["resolution"]["state"] for answer in answers.values()]
+        # Coherent graphs reach real results, not only early refusals.
+        self.assertGreater(states.count("resolved"), len(states) // 5)
+        self.assertGreater(states.count("ambiguous"), 0)
+        self.assertGreater(states.count("unresolved"), len(states) // 10)
+        self.assertGreaterEqual(
+            len({answer["resolution"]["reason_code"] for answer in answers.values()}),
+            5,
+        )
+
+
 if __name__ == "__main__":
    unittest.main()
@@ -0,0 +1,422 @@
+"""System routes (py/api/system.py): health check job, Overview and statistics.
+
+The health check runs off-loop as a ``read`` registry job of kind ``health``
+(one at a time, beside a scan), and the API keeps its last report. The
+Overview reads only real values: Library-eligible counts, indexed images, the
+last health result or null, no backup until one exists, and the effective
+sources and whether they were auto-detected. The missing-thumbnail count is not
+part of it: the Overview reads ``/images/thumbnails/status`` on its own (its
+walk of every source must not hold the other values back).
+"""
+
+import asyncio
+import os
+import sqlite3
+import sys
+import threading
+from pathlib import Path
+from unittest.mock import MagicMock, patch
+
+_mock_server = MagicMock()
+_mock_server.PromptServer.instance.routes = MagicMock()
+sys.modules.setdefault("server", _mock_server)
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+from py.api.jobs import HEALTH_JOB_KIND  # noqa: E402
+from py.config import GalleryConfig  # noqa: E402
+from utils.hashing import generate_prompt_hash  # noqa: E402
+
+try:
+    from tests.test_api_admin import AdminAPITestCase  # noqa: E402
+except ImportError:  # discovered with tests/ as the top-level directory
+    from test_api_admin import AdminAPITestCase  # noqa: E402
+
+WAIT = 5
+
+
+class SystemAPITestCase(AdminAPITestCase):
+    async def get_application(self):
+        app = await super().get_application()
+        # Auto-detection searches the disk; here it finds the fake ComfyUI only.
+        self.api._find_comfyui_output_dir = lambda: (
+            str(self.output_dir) if self.output_dir.is_dir() else None
+        )
+        return app
+
+    def save(self, text, **metadata):
+        return self.api.db.save_prompt(
+            text, prompt_hash=generate_prompt_hash(text), **metadata
+        )
+
+    def image(self, prompt_id, name, *, exists=True, folder=None):
+        path = Path(folder or self.output_dir) / name
+        if exists:
+            path.write_bytes(b"png")
+        return self.api.db.link_image_to_prompt(prompt_id, str(path))
+
+    async def json(self, method, url, status=200):
+        response = await self.client.request(method, url)
+        self.assertEqual(response.status, status, await response.text())
+        return await response.json()
+
+    async def restore_snapshot(self):
+        """Restore the live database from a copy of itself through the legacy route."""
+        from contextlib import closing
+
+        from aiohttp import FormData
+
+        snapshot = os.path.join(self.tmpdir, "snapshot.db")
+        with closing(sqlite3.connect(self.api.db.model.db_path)) as src:
+            with closing(sqlite3.connect(snapshot)) as dst:
+                src.backup(dst)
+        with open(snapshot, "rb") as handle:
+            upload = handle.read()
+        form = FormData()
+        form.add_field("database_file", upload, filename="upload.db")
+        response = await self.client.request(
+            "POST", "/prompt_manager/restore", data=form
+        )
+        self.assertEqual(response.status, 200, await response.text())
+
+    async def run_health(self):
+        body = await self.json("POST", "/prompt_manager/system/health", 202)
+        job = self.api._jobs.get(body["job"]["id"])
+        await asyncio.wait_for(asyncio.shield(job.task), WAIT)
+        return body["job"], job
+
+
+class TestHealthRoute(SystemAPITestCase):
+    async def test_no_report_before_a_check(self):
+        body = await self.json("GET", "/prompt_manager/system/health")
+        self.assertEqual(body, {"success": True, "report": None})
+
+    async def test_health_check_runs_as_a_read_job_and_keeps_its_report(self):
+        prompt = self.save("Images")
+        self.image(prompt, "kept.png")
+        self.image(prompt, "gone.png", exists=False)
+        summary, job = await self.run_health()
+        self.assertEqual(summary["kind"], HEALTH_JOB_KIND)
+        self.assertEqual(summary["title"], "Health check")
+        self.assertEqual(summary["admission"], "read")
+        self.assertFalse(summary["cancellable"])
+        self.assertEqual(summary["counters"], {})
+        self.assertEqual(job.state, "finished")
+        self.assertEqual(job.progress, 100)
+        self.assertEqual(job.status_line, "Health check incomplete")
+        report = (await self.json("GET", "/prompt_manager/system/health"))["report"]
+        self.assertEqual(report["status"], "incomplete")
+        missing = next(c for c in report["checks"] if c["id"] == "missing_files")
+        self.assertEqual((missing["status"], missing["count"]), ("issues", 1))
+        ambiguous = next(c for c in report["checks"] if c["id"] == "ambiguous_metadata")
+        self.assertEqual(ambiguous["status"], "unavailable")
+        self.assertNotIn(self.tmpdir, str(report))
+
+    async def test_health_check_is_single_flight_and_runs_beside_a_scan(self):
+        release = threading.Event()
+        entered = threading.Event()
+        real = self.api.db.run_health_checks
+
+        def gated(*args, **kwargs):
+            entered.set()
+            release.wait(WAIT)
+            return real(*args, **kwargs)
+
+        scan_gate = asyncio.Event()
+
+        async def scanning(job):
+            await scan_gate.wait()
+
+        scan = self.api._jobs.start(
+            "scan", "Metadata scan", admission="records", runner=scanning
+        )
+        with patch.object(self.api.db, "run_health_checks", side_effect=gated):
+            first = await self.json("POST", "/prompt_manager/system/health", 202)
+            loop = asyncio.get_running_loop()
+            await loop.run_in_executor(None, entered.wait, WAIT)
+            busy = await self.json("POST", "/prompt_manager/system/health", 409)
+            self.assertEqual(busy["code"], "busy")
+            self.assertEqual(
+                busy["running"], {"id": first["job"]["id"], "title": "Health check"}
+            )
+            release.set()
+            await asyncio.wait_for(self.api._jobs.get(first["job"]["id"]).task, WAIT)
+        scan_gate.set()
+        await asyncio.wait_for(scan.task, WAIT)
+
+    async def test_failed_check_keeps_the_previous_report(self):
+        await self.run_health()
+        before = (await self.json("GET", "/prompt_manager/system/health"))["report"]
+        with (
+            patch.object(
+                self.api.db, "run_health_checks", side_effect=RuntimeError("boom")
+            ),
+            self.assertLogs("prompt_manager.api", "ERROR"),
+        ):
+            body = await self.json("POST", "/prompt_manager/system/health", 202)
+            job = self.api._jobs.get(body["job"]["id"])
+            await asyncio.wait_for(asyncio.shield(job.task), WAIT)
+        self.assertEqual(job.state, "failed")
+        after = (await self.json("GET", "/prompt_manager/system/health"))["report"]
+        self.assertEqual(after, before)
+
+    async def test_absent_configured_source_is_reported_per_source(self):
+        prompt = self.save("Images")
+        self.image(prompt, "gone.png", exists=False)
+        absent = self.comfy_dir / "output" / "unmounted"
+        GalleryConfig.MONITORING_DIRECTORIES = [
+            self._root(self.output_dir),
+            str(absent),
+        ]
+        await self.run_health()
+        report = (await self.json("GET", "/prompt_manager/system/health"))["report"]
+        missing = next(c for c in report["checks"] if c["id"] == "missing_files")
+        # Per source: the readable output is counted, the absent one is not.
+        self.assertEqual(missing["status"], "issues")
+        self.assertEqual(missing["count"], 1)
+        self.assertTrue(missing["partial"])
+        self.assertEqual(
+            [(s["status"], s["count"]) for s in missing["sources"]],
+            [("checked", 1), ("unavailable", None)],
+        )
+        self.assertEqual(report["status"], "incomplete")
+
+    async def test_restore_clears_health_report(self):
+        self.save("Any")
+        await self.run_health()
+        self.assertIsNotNone(
+            (await self.json("GET", "/prompt_manager/system/health"))["report"]
+        )
+        await self.restore_snapshot()
+        body = await self.json("GET", "/prompt_manager/system/health")
+        self.assertEqual(body, {"success": True, "report": None})
+        overview = await self.json("GET", "/prompt_manager/system/overview")
+        self.assertIsNone(overview["health"])
+
+    async def test_check_finishing_after_a_restore_is_not_kept(self):
+        # A check that started on the old database describes it, not the new one.
+        self.save("Any")
+        release = threading.Event()
+        entered = threading.Event()
+        real = self.api.db.run_health_checks
+
+        def gated(*args, **kwargs):
+            entered.set()
+            release.wait(WAIT)
+            return real(*args, **kwargs)
+
+        with patch.object(self.api.db, "run_health_checks", side_effect=gated):
+            body = await self.json("POST", "/prompt_manager/system/health", 202)
+            loop = asyncio.get_running_loop()
+            await loop.run_in_executor(None, entered.wait, WAIT)
+            await self.restore_snapshot()
+            release.set()
+            job = self.api._jobs.get(body["job"]["id"])
+            await asyncio.wait_for(asyncio.shield(job.task), WAIT)
+        self.assertEqual(job.state, "finished")
+        body = await self.json("GET", "/prompt_manager/system/health")
+        self.assertEqual(body, {"success": True, "report": None})
+        # A check started on the restored database is kept again.
+        await self.run_health()
+        self.assertIsNotNone(
+            (await self.json("GET", "/prompt_manager/system/health"))["report"]
+        )
+
+    async def test_health_sources_resolve_off_the_event_loop(self):
+        loop_thread = threading.get_ident()
+        threads = []
+        real = self.api._health_roots
+
+        def recording():
+            threads.append(threading.get_ident())
+            return real()
+
+        with patch.object(self.api, "_health_roots", side_effect=recording):
+            await self.run_health()
+        self.assertEqual(len(threads), 1)
+        self.assertNotEqual(threads[0], loop_thread)
+
+    async def test_health_start_failure_is_an_error_envelope(self):
+        with (
+            patch.object(self.api, "_health_roots", side_effect=RuntimeError("secret")),
+            self.assertLogs("prompt_manager.api", "ERROR"),
+        ):
+            body = await self.json("POST", "/prompt_manager/system/health", 500)
+        self.assertEqual(
+            body,
+            {
+                "success": False,
+                "code": None,
+                "error": "Failed to start the health check",
+            },
+        )
+        self.assertEqual(self.api._jobs.list(), [])
+
+
+class TestOverviewRoute(SystemAPITestCase):
+    async def test_overview_reports_real_counts(self):
+        self.api.db.save_prompt_pair("Cat", "Blur")
+        archived = self.api.db.save_prompt_pair("Cat", "Noise")
+        self.api.db.archive_prompt_pair(archived)
+        legacy = self.save("Legacy")
+        self.image(legacy, "a.png")
+        self.image(legacy, "b.png")
+        body = await self.json("GET", "/prompt_manager/system/overview")
+        self.assertTrue(body["success"])
+        self.assertEqual(
+            body["library"], {"positive_prompts": 2, "negative_variants": 1}
+        )
+        self.assertEqual(body["images"], {"indexed": 2, "rated": 0})
+        self.assertEqual(
+            set(body),
+            {
+                "success",
+                "library",
+                "images",
+                "health",
+                "backup",
+                "needs_review",
+                "sources",
+            },
+        )
+
+    async def test_overview_rated_counts_images_of_rated_prompts(self):
+        rated = self.save("Rated", rating=5)
+        self.image(rated, "a.png")
+        self.image(rated, "b.png")
+        self.image(self.save("Unrated"), "c.png")
+        body = await self.json("GET", "/prompt_manager/system/overview")
+        self.assertEqual(body["images"], {"indexed": 3, "rated": 2})
+
+    async def test_overview_never_fabricates_backup_or_health(self):
+        body = await self.json("GET", "/prompt_manager/system/overview")
+        self.assertIsNone(body["health"])
+        self.assertIsNone(body["backup"])
+        self.assertEqual(body["needs_review"], {"pending": None})
+        self.save("Any")
+        await self.run_health()
+        report = (await self.json("GET", "/prompt_manager/system/health"))["report"]
+        body = await self.json("GET", "/prompt_manager/system/overview")
+        self.assertEqual(
+            body["health"],
+            {"checked_at": report["checked_at"], "status": "incomplete", "issues": 0},
+        )
+        self.assertIsNone(body["backup"])
+
+    async def test_overview_health_counts_checks_with_issues(self):
+        prompt = self.save("Images")
+        self.image(prompt, "gone.png", exists=False)
+        self.image(prompt, "gone-too.png", exists=False)
+        await self.run_health()
+        body = await self.json("GET", "/prompt_manager/system/overview")
+        self.assertEqual(body["health"]["issues"], 1)
+
+    async def test_overview_sources_distinguish_auto_detect(self):
+        body = await self.json("GET", "/prompt_manager/system/overview")
+        self.assertEqual(
+            body["sources"], {"configured": 0, "effective": 1, "auto_detected": True}
+        )
+        second = self.output_dir / "archive"
+        second.mkdir()
+        GalleryConfig.MONITORING_DIRECTORIES = [
+            self._root(self.output_dir),
+            self._root(second),
+        ]
+        body = await self.json("GET", "/prompt_manager/system/overview")
+        self.assertEqual(
+            body["sources"], {"configured": 2, "effective": 2, "auto_detected": False}
+        )
+        # Every configured source unavailable: ComfyUI's output is used instead.
+        GalleryConfig.MONITORING_DIRECTORIES = [str(self.comfy_dir / "absent")]
+        body = await self.json("GET", "/prompt_manager/system/overview")
+        self.assertEqual(
+            body["sources"], {"configured": 1, "effective": 1, "auto_detected": True}
+        )
+
+    async def test_overview_never_walks_the_sources_for_thumbnails(self):
+        (self.output_dir / "one.png").write_bytes(b"png")
+        with patch.object(
+            self.api,
+            "_plan_gallery_thumbnails",
+            side_effect=AssertionError("walked"),
+        ):
+            body = await self.json("GET", "/prompt_manager/system/overview")
+        self.assertTrue(body["success"])
+        self.assertNotIn("thumbnails", body)
+
+    async def test_overview_sources_resolve_off_the_event_loop(self):
+        loop_thread = threading.get_ident()
+        threads = []
+        real = self.api._output_dirs_with_origin
+
+        def recording():
+            threads.append(threading.get_ident())
+            return real()
+
+        with patch.object(self.api, "_output_dirs_with_origin", side_effect=recording):
+            body = await self.json("GET", "/prompt_manager/system/overview")
+        self.assertEqual(body["sources"]["effective"], 1)
+        self.assertEqual(len(threads), 1)
+        self.assertNotEqual(threads[0], loop_thread)
+
+    async def test_overview_failure_is_an_error_envelope(self):
+        with (
+            patch.object(
+                self.api.db, "library_counts", side_effect=RuntimeError("secret")
+            ),
+            self.assertLogs("prompt_manager.api", "ERROR"),
+        ):
+            body = await self.json("GET", "/prompt_manager/system/overview", 500)
+        self.assertEqual(
+            body,
+            {"success": False, "code": None, "error": "Failed to read the overview"},
+        )
+
+
+class TestStatisticsRoute(SystemAPITestCase):
+    async def test_statistics_sum_real_run_counts(self):
+        a = self.save("Alpha", category="Landscapes", rating=5)
+        b = self.save("Beta", category="Portraits", rating=2)
+        self.api.db.record_prompt_use(a, times=3)
+        self.api.db.record_prompt_use(b)
+        body = await self.json("GET", "/prompt_manager/system/statistics")
+        self.assertEqual(
+            body["by_category"],
+            [
+                {"category": "Landscapes", "runs": 3, "average_rating": 5.0},
+                {"category": "Portraits", "runs": 1, "average_rating": 2.0},
+            ],
+        )
+        self.assertEqual(body["totals"], self.api.db.get_statistics())
+        self.assertTrue(body["success"])
+
+    async def test_statistics_lists_rated_images_for_library_totals(self):
+        # D96: the Statistics dialog's "Library totals" reads the rated count
+        # with the runs (one read), from the same images the Overview counts.
+        rated = self.save("Rated", rating=4)
+        self.image(rated, "a.png")
+        self.image(self.save("Unrated"), "b.png")
+        body = await self.json("GET", "/prompt_manager/system/statistics")
+        self.assertEqual(body["rated_images"], 1)
+        self.assertEqual(
+            set(body), {"success", "by_category", "totals", "rated_images"}
+        )
+
+    async def test_statistics_failure_is_an_error_envelope(self):
+        with (
+            patch.object(
+                self.api.db, "usage_by_category", side_effect=RuntimeError("secret")
+            ),
+            self.assertLogs("prompt_manager.api", "ERROR"),
+        ):
+            body = await self.json("GET", "/prompt_manager/system/statistics", 500)
+        self.assertEqual(
+            body,
+            {"success": False, "code": None, "error": "Failed to read statistics"},
+        )
+
+
+if __name__ == "__main__":
+    import unittest
+
+    unittest.main()
@@ -1,7 +1,9 @@
 """The concept fixture files carry the concept inspector facts (app.js:400-414)."""

 import json
+import math
 import tempfile
+import time
 import unittest
 from pathlib import Path

@@ -15,6 +17,8 @@ except ImportError:  # discovered with tests/ as the top-level directory
 from tests.browser.workspace_concept_fixture import (
    CONCEPT_MODEL,
    CONCEPT_PROMPTS,
+    MAX_EPOCH_SECONDS,
+    _instant,
    write_concept_png,
 )
 from utils.prompt_inspector import inspect_prompt_evidence, read_inspection_file
@@ -80,5 +84,29 @@ class TestWorkspaceConceptFixture(unittest.TestCase):
            self.assertEqual((image["width"], image["height"]), size)


+class TestConceptFixtureInstant(unittest.TestCase):
+    """One "now" for every relative time the fixture writes (PR #284's midnight)."""
+
+    def test_a_chosen_instant_is_kept(self):
+        self.assertEqual(_instant(1_792_713_598), 1_792_713_598.0)
+        self.assertEqual(_instant(1_792_713_598.25), 1_792_713_598.25)
+
+    def test_the_wall_clock_when_omitted(self):
+        before = time.time()
+        now = _instant(None)
+        self.assertLessEqual(before, now)
+        self.assertLessEqual(now, time.time())
+
+    def test_a_non_number_is_refused(self):
+        for value in (True, "1792713598", [1]):
+            with self.subTest(value=value), self.assertRaises(TypeError):
+                _instant(value)
+
+    def test_an_instant_out_of_range_is_refused(self):
+        for value in (0, -1, MAX_EPOCH_SECONDS, math.inf, math.nan):
+            with self.subTest(value=value), self.assertRaises(ValueError):
+                _instant(value)
+
+
 if __name__ == "__main__":
    unittest.main()
@@ -6,7 +6,7 @@ import { once } from 'node:events';
 import { readFileSync } from 'node:fs';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { setTimeout as delay } from 'node:timers/promises';
-import { startBrowserServer, createServerSupervisor, attachServerStderr } from '../../tools/vendor/start-browser-server.mjs';
+import { startBrowserServer, createServerSupervisor, attachServerStderr, forwardPrefixedLines, SLOW_RESET_PREFIX } from '../../tools/vendor/start-browser-server.mjs';
 import { workflowWorkers } from '../../tools/vendor/test-workers.mjs';

 const fakeServer = fileURLToPath(new URL('./fake-browser-server.mjs', import.meta.url));
@@ -193,6 +193,29 @@ test('a failed test gets the server stderr written during it attached; a passing
    assert.equal(String(attached[0].body), 'Traceback (most recent call last): boom\n');
 });

+test('only complete slow-reset report lines are forwarded, however the chunks split them', () => {
+    const written = [];
+    const forward = forwardPrefixedLines(SLOW_RESET_PREFIX, text => written.push(text));
+    forward(`aiohttp access line\n${SLOW_RESET_PREFIX}POST /__test__/reset still`);
+    assert.deepEqual(written, [], 'a report line waits for its newline');
+    forward(` running after 2.000s\nplain stderr\n${SLOW_RESET_PREFIX}Thread 0x1 [asyncio_0]\n${SLOW_RESET_PREFIX.slice(0, 5)}`);
+    forward(`${SLOW_RESET_PREFIX.slice(5)}  File "server.py", line 1\nnot a report ${SLOW_RESET_PREFIX}\n`);
+    assert.deepEqual(written, [
+        `${SLOW_RESET_PREFIX}POST /__test__/reset still running after 2.000s\n${SLOW_RESET_PREFIX}Thread 0x1 [asyncio_0]\n`,
+        `${SLOW_RESET_PREFIX}  File "server.py", line 1\n`,
+    ]);
+});
+
+test('a slow-reset report on server stderr reaches the worker stderr; other stderr does not', async t => {
+    const reported = [];
+    const server = await startBrowserServer({ ...fake(), report: text => reported.push(text) });
+    t.after(() => server.stop());
+    await writeStderr(server, 'Traceback: ordinary stderr\n');
+    await writeStderr(server, `${SLOW_RESET_PREFIX}POST /__test__/reset answered 200 after 16.064s\n`);
+    assert.deepEqual(reported, [`${SLOW_RESET_PREFIX}POST /__test__/reset answered 200 after 16.064s\n`]);
+    assert.ok(server.stderrTail().includes('Traceback: ordinary stderr'), 'the stderr tail still keeps everything');
+});
+
 test('a server exits with its worker even when the worker is SIGKILLed', async () => {
    const pid = await serverOfKilledWorker(`{ command: process.execPath, args: port => [${JSON.stringify(fakeServer)}, '--port', String(port), '--exit-on-stdin-eof'] }`);
    await waitFor(() => !alive(pid), `server ${pid} to exit after its worker died`);
@@ -181,7 +181,7 @@
  },
  "workspace/file-inspector.mjs": {
    "lines": 96,
-    "branches": 92,
+    "branches": 93,
    "functions": 92,
    "statements": 96
  },
@@ -296,7 +296,7 @@
  "workspace/inspect.mjs": {
    "lines": 98,
    "branches": 92,
-    "functions": 92,
+    "functions": 93,
    "statements": 98
  },
  "workspace/inspection-state.mjs": {
@@ -341,12 +341,42 @@
    "functions": 98,
    "statements": 98
  },
+  "workspace/local-parameters.mjs": {
+    "lines": 98,
+    "branches": 94,
+    "functions": 98,
+    "statements": 98
+  },
  "workspace/local-projection.mjs": {
    "lines": 97,
    "branches": 96,
    "functions": 98,
    "statements": 97
  },
+  "workspace/local-resolver-stages.mjs": {
+    "lines": 94,
+    "branches": 93,
+    "functions": 98,
+    "statements": 94
+  },
+  "workspace/local-resolver-support.mjs": {
+    "lines": 96,
+    "branches": 80,
+    "functions": 98,
+    "statements": 96
+  },
+  "workspace/local-resolver.mjs": {
+    "lines": 96,
+    "branches": 86,
+    "functions": 98,
+    "statements": 96
+  },
+  "workspace/local-semantics.mjs": {
+    "lines": 98,
+    "branches": 98,
+    "functions": 98,
+    "statements": 98
+  },
  "workspace/local-session.mjs": {
    "lines": 98,
    "branches": 92,
@@ -389,6 +419,12 @@
    "functions": 98,
    "statements": 98
  },
+  "workspace/py-json.mjs": {
+    "lines": 97,
+    "branches": 92,
+    "functions": 98,
+    "statements": 97
+  },
  "workspace/recorded-run.mjs": {
    "lines": 95,
    "branches": 83,
@@ -407,6 +443,30 @@
    "functions": 98,
    "statements": 98
  },
+  "workspace/system-controls.mjs": {
+    "lines": 98,
+    "branches": 87,
+    "functions": 89,
+    "statements": 98
+  },
+  "workspace/system-overview.mjs": {
+    "lines": 96,
+    "branches": 92,
+    "functions": 98,
+    "statements": 96
+  },
+  "workspace/system-state.mjs": {
+    "lines": 98,
+    "branches": 92,
+    "functions": 92,
+    "statements": 98
+  },
+  "workspace/system.mjs": {
+    "lines": 93,
+    "branches": 85,
+    "functions": 69,
+    "statements": 93
+  },
  "workspace/theme.mjs": {
    "lines": 98,
    "branches": 93,
@@ -17,6 +17,22 @@ const HOST = '127.0.0.1';
 // tests/browser/server.py prints this once it holds its listening socket. Only a
 // complete line counts: a chunk may end mid-number.
 const PORT_ANNOUNCEMENT = /^PM_TEST_SERVER_PORT=(\d+)\r?\n/m;
+// tests/browser/slow_reset_watch.py starts every line of a slow-reset report with
+// this. Those lines go to the worker's stderr, so the job log shows a slow reset
+// even when its test passes.
+export const SLOW_RESET_PREFIX = 'pm-slow-reset| ';
+
+// A stderr chunk handler that passes every complete line starting with `prefix`
+// to `write`. A line split across chunks is held until its newline arrives.
+export function forwardPrefixedLines(prefix, write) {
+    let pending = '';
+    return chunk => {
+        const lines = (pending + chunk).split('\n');
+        pending = lines.pop().slice(-STDERR_TAIL_BYTES);
+        const matched = lines.filter(line => line.startsWith(prefix));
+        if (matched.length) write(matched.map(line => `${line}\n`).join(''));
+    };
+}

 // The server exits when its stdin closes, so a worker that dies without teardown
 // (SIGKILL) leaves no server behind; the launcher holds the pipe's other end.
@@ -40,6 +56,7 @@ export async function startBrowserServer({
    cwd = repositoryRoot,
    timeoutMs = STARTUP_TIMEOUT_MS,
    stderrLogChars = STDERR_LOG_CHARS,
+    report = chunk => process.stderr.write(chunk),
 } = {}) {
    if (!Number.isInteger(port) || port < 0 || port > 65535) {
        throw new Error(`startBrowserServer needs a port from 0 to 65535, got ${port}`);
@@ -50,7 +67,9 @@ export async function startBrowserServer({
    let stderr = '';
    let stderrTotal = 0;
    child.stderr.setEncoding('utf8');
+    const forwardReport = forwardPrefixedLines(SLOW_RESET_PREFIX, report);
    child.stderr.on('data', chunk => {
+        forwardReport(chunk);
        stderr = (stderr + chunk).slice(-Math.max(stderrLogChars, STDERR_TAIL_BYTES));
        stderrTotal += chunk.length;
    });
@@ -20,6 +20,7 @@ from .prompt_pair_resolver import (
    _FOOTER,
    EMPTY_POSITIVE_REASON,
    INSPECTION_PROFILE,
+    MALFORMED_EVIDENCE_REASON,
    ResolverProfile,
    resolve_prompt_pair,
 )
@@ -548,7 +549,7 @@ def inspect_prompt_evidence(
    resolution = {
        "state": "unresolved",
        "sampler_id": None,
-        "reason": "Prompt evidence is malformed",
+        "reason": MALFORMED_EVIDENCE_REASON,
        "reason_code": "malformed",
        "node": None,
    }
@@ -1237,10 +1237,13 @@ class _GraphResolver:

    def non_file_outputs(self) -> set:
        names = self.semantics.non_file_outputs
+        # Only a string names a class: a list or object is never looked up (#286).
        return {
            node_id
            for node_id, node in self.graph.items()
-            if isinstance(node, dict) and node.get("class_type") in names
+            if isinstance(node, dict)
+            and isinstance(node.get("class_type"), str)
+            and node["class_type"] in names
        }

    def producers_of(self, starts: list, previews: set) -> set:
@@ -1832,6 +1835,8 @@ def _shared_pair(candidates: list) -> Optional[Dict[str, Any]]:

 # Bounds for walking a UI workflow's subgraph instances (R1 only).
 _MAX_SUBGRAPH_DEPTH = 8
+# The inspector's own line for evidence it cannot read (``inspect_prompt_evidence``).
+MALFORMED_EVIDENCE_REASON = "Prompt evidence is malformed"
 _MAX_WORKFLOW_NODES = 100_000


@@ -1862,7 +1867,9 @@ def _prompt_manager_widgets(workflow: Any) -> Dict[str, str]:

    Nodes inside a subgraph run as ``"<instance>:<inner>"`` API IDs (nested
    instances chain their IDs); a definition without an instance runs nothing.
-    The walk is bounded in depth and in nodes visited.
+    The walk is bounded in depth and in nodes visited. A node whose ``type`` is
+    a list or an object is skipped: it is neither a subgraph instance nor a
+    PromptManager node (#286).
    """
    nodes = workflow.get("nodes") if isinstance(workflow, dict) else None
    if not isinstance(nodes, list):
@@ -1882,6 +1889,9 @@ def _prompt_manager_widgets(workflow: Any) -> Dict[str, str]:
            if not isinstance(node_id, (str, int)) or isinstance(node_id, bool):
                continue
            api_id = f"{prefix}{node_id}"
+            if isinstance(kind, (list, dict)):
+                # JSON's unhashable values are never a node type (#286).
+                continue
            if kind in subgraphs and depth < _MAX_SUBGRAPH_DEPTH:
                stack.append((subgraphs[kind], api_id + ":", depth + 1))
                continue
@@ -336,6 +336,16 @@ export function createActivityStore({ api, scope, connect = defaultConnect, noti
                return { busy: store.running()[0] ?? null, message: error.message };
            }
        },
+        /**
+         * Follow a job another route started (its summary from that route's answer, e.g. the health check's
+         * `POST /system/health`): it is listed and its stream opened at once, with no read and no start toast.
+         */
+        track(raw) {
+            const job = parseJob(raw);
+            if (!job) throw new TypeError('Invalid job');
+            upsert(job);
+            return job;
+        },
        /** Ask a running job to stop at its next file boundary; false once it has ended. */
        async cancel(id) {
            const result = await api.post(`${JOBS_URL}/${encodeURIComponent(id)}/cancel`, {}, { signal: scope.signal });
@@ -5,6 +5,7 @@ import { createSendButton } from './prompt-sender.mjs';
 import { createWorkspaceIcon } from './icons.mjs';
 import { navigateTo } from './state.mjs';
 import { showWorkspaceToast } from './toast.mjs';
+import { openCopyFallback } from './workspace-dialogs.mjs';

 const RAW_KEYS = ['prompt', 'workflow', 'parameters', 'comfyassets_prompt_pairs'];
 const RAW_LIMIT = 'Raw metadata exceeds the response limit. Download the original file to inspect it externally.';
@@ -26,6 +27,26 @@ const REVEAL_BUSY = 'The folder is already opening.';
 const REVEAL_FAILED = 'The folder could not be opened. Try again.';
 const FACTS = [['seed', 'Seed'], ['steps', 'Steps'], ['cfg', 'CFG'], ['sampler', 'Sampler'], ['scheduler', 'Scheduler'], ['model', 'Model']];

+// D117 (LI-4): the legacy metadata page's COPY ALL (web/metadata.html copyAllData), its lines and placeholders.
+const SUMMARY_LINES = [['Checkpoint', 'model'], ['Positive Prompt', 'positive'], ['Negative Prompt', 'negative'], ['Steps', 'steps'],
+    ['CFG Scale', 'cfg'], ['Sampler', 'sampler'], ['Seed', 'seed']];
+const SUMMARY_MISSING = {positive:'No prompt found', negative:'No negative prompt found'};
+
+/**
+ * The one-click settings summary (D117): the legacy COPY ALL text for what this inspector shows. A confirmed prompt
+ * and a known fact are copied verbatim; anything else, an explicitly empty prompt included, takes the legacy page's
+ * placeholder, as its parse does (`hasValue` treats '' as absent).
+ */
+export function settingsSummary(record) {
+    const roles = promptRoles(record?.prompts);
+    const value = key => {
+        if (Object.hasOwn(SUMMARY_MISSING, key)) return roles[key] ? roles[key] : SUMMARY_MISSING[key];
+        const fact = record?.generation?.[key];
+        return fact?.status === 'known' && typeof fact.value === 'string' && fact.value !== '' ? fact.value : 'Unknown';
+    };
+    return SUMMARY_LINES.map(([label, key]) => `${label}: ${value(key)}`).join('\n');
+}
+
 function safeFilename(value) {
    return String(value || 'file').replace(/[\\/\x00-\x1f\x7f<>:"|?*]/g, '_').replace(/^\.+|[. ]+$/g, '') || 'file';
 }
@@ -175,7 +196,7 @@ function prefixedChip(prefix, text) {
 * `variant: 'full'` (the viewer's `#viewer-details`, imageDetails(i, true)) leaves out the cover and adds "File &
 * provenance" and "Workflow & raw metadata" with the downloads. `inline: true` means `panel`; neither means `full`.
 */
-export function mountFileInspector(container, {api, sender, parentScope, variant, inline = false, promptContext = '', onTagFilter, onRetry, onRefresh, onInteraction = () => {}}) {
+export function mountFileInspector(container, {api, sender, parentScope, variant, inline = false, promptContext = '', onTagFilter, onRetry, onRefresh, onInteraction = () => {}, copyFallback = openCopyFallback}) {
    if (parentScope.signal.aborted) return {setState() {}, dispose() {}};
    const scope = childScope(parentScope);
    let contentScope;
@@ -184,7 +205,7 @@ export function mountFileInspector(container, {api, sender, parentScope, variant
    scope.listen(container, 'keydown', onInteraction);
    scope.listen(container, 'click', onInteraction);
    scope.listen(container, 'wheel', onInteraction, {passive:true});
-    scope.cleanup(() => {contentScope?.dispose(); container.replaceChildren(); container.classList.remove('file-inspector');});
+    scope.cleanup(() => {contentScope?.dispose(); container.replaceChildren(); container.classList.remove('file-inspector'); container.removeAttribute('aria-busy');});

    const full = (variant ?? (inline ? 'panel' : 'full')) === 'full';
    function statusView(state, parent) {
@@ -203,6 +224,8 @@ export function mountFileInspector(container, {api, sender, parentScope, variant
        if (scope.signal.aborted) return;
        contentScope?.dispose(); contentScope = childScope(scope);
        container.replaceChildren();
+        // A local read resolves on this thread in bounded steps; the busy state stays until its answer lands.
+        if (state.loading) container.setAttribute('aria-busy', 'true'); else container.removeAttribute('aria-busy');
        render(state);
    }
    /**
@@ -244,7 +267,7 @@ export function mountFileInspector(container, {api, sender, parentScope, variant
            inner.append(tags);
        }
        inner.append(...generationFacts(record, 'meta-grid', 'small'));
-        if (full) inner.append(provenance(record, badge), rawMetadata(record));
+        if (full) inner.append(summaryButton(record), provenance(record, badge), rawMetadata(record));
        const footer = full ? container : el('div', undefined, 'detail-footer'), roles = promptRoles(record.prompts);
        if (Object.hasOwn(roles, 'positive') && Object.hasOwn(roles, 'negative')) {
            const pair = createButton('', 'send');
@@ -264,6 +287,23 @@ export function mountFileInspector(container, {api, sender, parentScope, variant
        }
        if (!full && footer.childNodes.length) container.append(footer);
    }
+    /**
+     * D117 (LI-4): "Copy settings summary" after the six facts, the legacy COPY ALL. It copies as the concept's prompt
+     * copy does: the shared toast, or the select-to-copy dialog where the clipboard is unavailable or refused.
+     */
+    function summaryButton(record) {
+        const button = createButton('Copy settings summary', 'settings-summary'), text = settingsSummary(record);
+        contentScope.listen(button, 'click', async () => {
+            try {
+                if (!navigator.clipboard) throw new Error('Clipboard requires a secure context');
+                await navigator.clipboard.writeText(text);
+                if (!contentScope.signal.aborted) showWorkspaceToast('Settings summary copied.');
+            } catch {
+                if (!contentScope.signal.aborted) copyFallback(text, {scope:contentScope, trigger:button, title:'Copy settings summary'});
+            }
+        });
+        return button;
+    }
    /** The concept's plain cover; the card image opens the viewer (D19). Video keeps its own element. */
    function cover(record) {
        const {file} = record, video = file?.media_type === 'video';
@@ -1,6 +1,6 @@
 import '../api-client.js';
 import { createButton, createScope } from '../shared/toolkit/core.js';
-import { routes, mountRouter, summarizeStats, routeTitle, isHandoff, loadNavCounts,
+import { routes, mountRouter, summarizeStats, routeTitle, loadNavCounts,
    LIBRARY_WRITE_COUNTS, NAV_COUNT_ROUTES, FAVORITE_WRITE_COUNTS, FAVORITE_COUNT_DELAY_MS } from './state.mjs';
 import { mountWorkspaceTheme } from './theme.mjs';
 import { mountImages, onFavoriteChange } from './images.mjs';
@@ -16,6 +16,7 @@ import { mountActivityPage, mountActivityTopbar } from './activity.mjs';
 import { mountActivityJobView } from './activity-job-view.mjs';
 import { mountInspect } from './inspect.mjs';
 import { createPromptSender } from './prompt-sender.mjs';
+import { mountSystem } from './system.mjs';

 const { createApiClient, resolveUrl } = window.ApiClient;

@@ -28,7 +29,8 @@ function element(tag, text, className) {

 function legacyLink(route) {
    const link = element('a', route.action, 'workspace-link');
-    link.href = resolveUrl(route.href);
+    // A native card (System, Q12) links its workspace hash; a legacy tool's page goes through the mount prefix.
+    link.href = route.native ? route.href : resolveUrl(route.href);
    return link;
 }

@@ -132,11 +134,33 @@ function mountWorkspace() {
    refreshCounts(NAV_COUNT_ROUTES);
    let viewScope;
    let firstRender = true;
+    // D62: a page whose teardown must wait (Inspect, while a video is still starting) holds the next route until it
+    // settles; the latest route wins.
+    let leaveGuard = null, renderToken = 0;
    scope.cleanup(() => viewScope?.dispose());

+    // The mounted System page: another of its sections is shown in place, keeping the shell and the drafts.
+    let system = null;
+
    function render(route) {
+        const token = ++renderToken;
+        const hold = leaveGuard?.();
+        if (hold) {
+            hold.then(() => { if (token === renderToken && !scope.signal.aborted) renderNow(route); });
+            return;
+        }
+        renderNow(route);
+    }
+
+    function renderNow(route) {
+        leaveGuard = null;
        // A shared page dialog never stays open over the next route.
        closeWorkspaceDialog();
+        if (route.id === 'system' && system && currentKey === 'system') {
+            system.show(route.section);
+            return;
+        }
+        system = null;
        viewScope?.dispose();
        images = null;
        viewScope = createScope();
@@ -237,19 +261,16 @@ function mountWorkspace() {
            else mountActivityPage(main, { store: activity, scope: view });
            return;
        }
+        if (route.id === 'system') {
+            // The concept's System (app.js renderSystem): its heading description, section nav and Save row.
+            description.textContent = route.description;
+            system = mountSystem(main, api, view, { section: route.section, activity });
+            return;
+        }
        if (route.id === 'inspect') {
            // The concept's Inspect a file (app.js renderMetadata): a local file, read only in this browser.
            description.textContent = route.description;
-            mountInspect(main, { parentScope: view, api, sender: createPromptSender({ scope: view }) });
-            return;
-        }
-        if (isHandoff(route)) {
-            description.textContent = route.description;
-            const panel = element('section', undefined, 'surface handoff');
-            panel.append(element('h2', 'Your current tools are ready'),
-                element('p', 'This workspace is being introduced in stages. Continue in the existing tool with your saved data.'),
-                legacyLink(route));
-            main.append(panel);
+            ({ leaveGuard } = mountInspect(main, { parentScope: view, api, sender: createPromptSender({ scope: view }) }));
            return;
        }
        description.textContent = 'A home for your prompts, images and creative history.';
@@ -7,6 +7,7 @@ import { pageHeading } from './heading.mjs';
 import { createWorkspaceIcon } from './icons.mjs';
 import { createLocalSession, LOCAL_SESSION_MESSAGES } from './local-session.mjs';
 import { localFileAdapter } from './local-inspection.mjs';
+import { loadInspectionSemantics } from './local-semantics.mjs';
 import { createMediaViewer } from './media-viewer.mjs';
 import { showWorkspaceToast, TOAST_MS } from './toast.mjs';

@@ -39,44 +40,34 @@ function element(tag, className, text) {

 // The status shown for the selection; AVI/WMV's note and an empty status keep the toast's "metadata is available".
 const TOASTABLE = new Set(['', LOCAL_SESSION_MESSAGES.containerOnly]);
-// How long a released video still starting may take to settle before its deferred reset is dropped.
-const DEFERRED_RESET_MS = 15000;
+// How long a replaced video still starting may stay in place before it is released anyway.
+const STARTING_VIDEO_MS = 15000;

-/**
- * Resets a released video once it settles. Removing `src` alone never aborts a load already under way, and WebKit
- * (GStreamer) blocked the page when a pipeline still starting was reset, so load() waits for metadata or an error.
- * The fallback only drops the waiting listeners (a WebKit load cut off by the revoked URL stalls and never settles),
- * so the detached node is never pinned.
- */
-function resetWhenSettled(node) {
-    const waiting = new AbortController();
-    const fallback = setTimeout(() => waiting.abort(), DEFERRED_RESET_MS);
-    const reset = () => { waiting.abort(); clearTimeout(fallback); node.load(); };
-    for (const type of ['loadedmetadata', 'error']) node.addEventListener(type, reset, { once: true, signal: waiting.signal });
+/** A video whose pipeline is still starting: it has a source but neither metadata nor an error yet. */
+function isStarting(node) {
+    return node instanceof HTMLMediaElement && node.hasAttribute('src') && node.readyState < HTMLMediaElement.HAVE_METADATA && node.error === null;
 }

 /**
- * Stops a preview from holding its blob: URL: its own listeners end, media is paused and its src dropped before the
- * session revokes the URL, and the node leaves the page. A settled video (metadata read, or failed) is then reset with
- * load() to free its decoder at once; one still starting is reset as soon as it settles.
+ * Stops a preview from holding its blob: URL: its own listeners end, media is paused, its src dropped and it is reset
+ * with load() (which frees its decoder), and the node leaves the page, all before its URL is revoked.
 */
 function releaseMedia(preview) {
    if (!preview) return;
    const { node, listeners } = preview;
    listeners.abort();
    if (node instanceof HTMLMediaElement) {
-        const settled = node.readyState >= HTMLMediaElement.HAVE_METADATA || node.error !== null;
-        node.pause(); node.removeAttribute('src');
-        if (settled) node.load();
-        else resetWhenSettled(node);
+        node.pause(); node.removeAttribute('src'); node.load();
    } else node.removeAttribute('src');
    node.remove();
 }

 /**
 * Mounts the page into `main` below the heading the shell rendered. `sender` is the shared prompt sender; `api` is
- * only handed to the viewer (the local adapter never calls it). Returns `{dispose}`; the page also ends with
- * `parentScope`.
+ * only handed to the viewer (the local adapter never calls it). Returns `{dispose, leaveGuard}` (`{dispose}` when
+ * `parentScope` has already ended); the page also ends with `parentScope`. `leaveGuard()` is a promise while a video
+ * on the page is still starting (D62): the shell renders the next route once it settles, since detaching it then
+ * deadlocked WebKit.
 */
 export function mountInspect(main, { parentScope, api, sender }) {
    const scope = createScope();
@@ -84,6 +75,8 @@ export function mountInspect(main, { parentScope, api, sender }) {
    if (parentScope.signal.aborted) { scope.dispose(); return { dispose }; }
    parentScope.signal.addEventListener('abort', dispose, { once: true });
    scope.cleanup(() => parentScope.signal.removeEventListener('abort', dispose));
+    // The node table the local roles resolve with, read before any file is chosen (one request per page).
+    loadInspectionSemantics();

    // The concept DOM: section.surface > h2, p; div.file-drop.spaced-20 > icon, label, input, span.small; #local-preview.
    const surface = element('section', 'surface');
@@ -108,7 +101,35 @@ export function mountInspect(main, { parentScope, api, sender }) {
    // The session ends after the viewer has closed and the inline media is gone, so no element holds its URL then.
    // The page owns page leave for the same reason: the session listens for no `pagehide` of its own.
    const sessionScope = createScope();
-    const session = createLocalSession({ parentScope: sessionScope, pageTarget: null });
+    // Replaced videos still starting, by URL. WebKit (GStreamer) deadlocked the page when a video left the page or
+    // the viewport before its pipeline had started, so such a video stays where it is, inert, until it reports
+    // metadata or an error; only then is it released and its URL, which the session asked to revoke, revoked.
+    const retiring = new Map();
+    function finishRetiring(url) {
+        const entry = retiring.get(url);
+        if (!entry) return;
+        retiring.delete(url);
+        entry.waiting.abort(); clearTimeout(entry.timer);
+        releaseMedia(entry.preview);
+        if (entry.revoke) URL.revokeObjectURL(url);
+        entry.done();
+    }
+    function retire(preview, url) {
+        const waiting = new AbortController();
+        const entry = { preview, waiting, revoke: false, timer: setTimeout(() => finishRetiring(url), STARTING_VIDEO_MS) };
+        entry.finished = new Promise(resolve => { entry.done = resolve; });
+        retiring.set(url, entry);
+        preview.listeners.abort();
+        preview.node.inert = true; preview.node.setAttribute('aria-hidden', 'true');
+        for (const type of ['loadedmetadata', 'error']) preview.node.addEventListener(type, () => finishRetiring(url), { once: true, signal: waiting.signal });
+    }
+    const finishAllRetiring = () => { for (const url of [...retiring.keys()]) finishRetiring(url); };
+    const revokeObjectURL = url => {
+        const entry = retiring.get(url);
+        if (entry) entry.revoke = true;
+        else URL.revokeObjectURL(url);
+    };
+    const session = createLocalSession({ parentScope: sessionScope, pageTarget: null, revokeObjectURL });
    const viewer = createMediaViewer({ api, container: main, parentScope: scope, inspectionController: session.controller, sender,
        adapter: localFileAdapter, onRestoreFocus: () => { if (open.isConnected) open.focus({ preventScroll: true }); } });

@@ -153,7 +174,9 @@ export function mountInspect(main, { parentScope, api, sender }) {
    function showMedia(state) {
        const url = state.preview?.url ?? null;
        if (url === mediaUrl) return;
-        releaseMedia(media); media = null; mediaUrl = url;
+        if (media && isStarting(media.node) && !retiring.has(mediaUrl)) retire(media, mediaUrl);
+        else releaseMedia(media);
+        media = null; mediaUrl = url;
        if (!url) return;
        const video = state.preview.media === 'video';
        const node = element(video ? 'video' : 'img', 'local-file-preview');
@@ -173,7 +196,10 @@ export function mountInspect(main, { parentScope, api, sender }) {
        }, { once: true, signal: current.listeners.signal });
        node.src = url;
        media = current;
-        preview.prepend(node);
+        // A video still starting keeps its place, so the new preview goes after it and never moves it.
+        const anchor = [...retiring.values()].map(entry => entry.preview.node).filter(item => item.parentNode === preview).at(-1);
+        if (anchor) anchor.after(node);
+        else preview.prepend(node);
    }
    scope.cleanup(session.subscribe(state => {
        showMedia(state);
@@ -190,6 +216,7 @@ export function mountInspect(main, { parentScope, api, sender }) {
    // viewer (on abort), drops the media, then ends the session.
    scope.cleanup(() => viewer.dispose());
    scope.cleanup(() => { releaseMedia(media); media = null; mediaUrl = null; });
+    scope.cleanup(finishAllRetiring);
    scope.cleanup(() => sessionScope.dispose());

    // Page leave: the viewer closes and the inline media goes before the session revokes the URL, and the chooser is
@@ -198,6 +225,7 @@ export function mountInspect(main, { parentScope, api, sender }) {
        clearRejection();
        viewer.close();
        releaseMedia(media); media = null; mediaUrl = null;
+        finishAllRetiring();
        session.clear();
        chosen = null; input.value = '';
    }
@@ -238,5 +266,22 @@ export function mountInspect(main, { parentScope, api, sender }) {
        if (open.getAttribute('aria-disabled') === 'true' || !entry || session.state.phase !== 'ready') return;
        viewer.open({ items: [entry], selectedKey: entry.key, trigger: open });
    });
-    return { dispose };
+    /** Settles when no video on the page is still starting; `null` when none is. */
+    function leaveGuard() {
+        if (scope.signal.aborted) return null;
+        const waits = [];
+        for (const entry of retiring.values()) waits.push(entry.finished);
+        if (media && isStarting(media.node)) {
+            const { node } = media;
+            waits.push(new Promise(resolve => {
+                const settled = new AbortController();
+                const done = () => { settled.abort(); clearTimeout(timer); resolve(); };
+                const timer = setTimeout(done, STARTING_VIDEO_MS);
+                for (const type of ['loadedmetadata', 'error']) node.addEventListener(type, done, { once: true, signal: settled.signal });
+                scope.signal.addEventListener('abort', done, { once: true, signal: settled.signal });
+            }));
+        }
+        return waits.length ? Promise.all(waits) : null;
+    }
+    return { dispose, leaveGuard };
 }
@@ -6,12 +6,11 @@
 import { readVideoTags, selectVideoCarrier } from './local-video.mjs';
 import { projectMetadata, fitInspectionPayload, MAX_RESPONSE_BYTES } from './local-projection.mjs';
 import { projectInspectionPayload } from './inspection-state.mjs';
+import { resolveLocalEvidence, unreadableEvidence } from './local-resolver.mjs';
+import { loadInspectionSemantics } from './local-semantics.mjs';

 export const LOCAL_OBSERVATION = 'selected-local-file';
 export const LOCAL_SOURCE_LABEL = 'Selected local file';
-// Interim roles until PR L3 ports the inspection resolver: every role is open, and
-// the legacy fill in projectInspectionPayload shows what the legacy pages show.
-const LOCAL_RESOLUTION_REASON = 'Resolved in this browser from the workflow.';
 const LOCAL_LIBRARY = Object.freeze({ status: 'unavailable', scope: 'saved-library', tags: [], category_scope: null, tags_scope: null });
 const LOCAL_SCOPE = 'local';
 const PREFIX_BYTES = 32;
@@ -19,6 +18,24 @@ const MAX_FILENAME_CHARS = 255;
 const MEDIA_TYPES = new Set(['image', 'video']);

 const object = value => value !== null && typeof value === 'object' && !Array.isArray(value);
+const abortError = () => new DOMException('The local selection ended', 'AbortError');
+
+/** `promise`, or an AbortError as soon as `signal` aborts (the work behind `promise` is shared and keeps going). */
+function untilAborted(promise, signal) {
+    if (!signal) return promise;
+    if (signal.aborted) return Promise.reject(abortError());
+    return new Promise((resolve, reject) => {
+        const onAbort = () => reject(abortError());
+        signal.addEventListener('abort', onAbort, { once: true });
+        promise.then(value => { signal.removeEventListener('abort', onAbort); resolve(value); },
+            error => { signal.removeEventListener('abort', onAbort); reject(error); });
+    });
+}
+
+/** One turn of the event loop between bounded steps, so the busy state paints and input is handled. */
+function nextTurn(signal) {
+    return untilAborted(new Promise(resolve => setTimeout(resolve, 0)), signal);
+}
 const pngReader = () => globalThis.PngMetadata || globalThis.window?.PngMetadata;

 /** A display name with no path separators or control characters; never empty. */
@@ -88,8 +105,19 @@ export function toInspectionRead(classification, result) {

 const dimension = value => Number.isSafeInteger(value) && value > 0 ? value : null;

-/** The `inspection_version: 1` wire for one local read, before the response budget. */
-export function buildLocalPayload({ read, file, classification }) {
+/** The roles for one local read (`{prompts, resolution}`): the bounded parse and resolution step of buildLocalPayload. */
+export function localEvidence(read, classification, semantics = null) {
+    const inspection = toInspectionRead(classificationOf(classification), read);
+    return inspection.read === null ? unreadableEvidence() : resolveLocalEvidence(inspection.read.records, semantics);
+}
+
+/**
+ * The `inspection_version: 1` wire for one local read, before the response budget. Its roles are the server
+ * inspector's for the same records (local-resolver.mjs with `semantics`, the compiled node table; null answers
+ * "unavailable" as the server does), so the legacy fill in projectInspectionPayload applies exactly where it does
+ * for Images.
+ */
+export function buildLocalPayload({ read, file, classification, semantics = null, evidence = localEvidence(read, classification, semantics) }) {
    const classified = classificationOf(classification);
    const inspection = toInspectionRead(classified, read);
    const filename = sanitizeLocalFilename(file?.name);
@@ -101,8 +129,8 @@ export function buildLocalPayload({ read, file, classification }) {
            observation: LOCAL_OBSERVATION, source_label: LOCAL_SOURCE_LABEL, media_type: classified.media, extension: localExtension(filename),
            format: inspection.format, size, width: dimension(inspection.width), height: dimension(inspection.height), modified_time: modified,
        },
-        prompts: { positive: { status: 'unresolved' }, negative: { status: 'unresolved' } },
-        resolution: { state: 'unresolved', sampler_id: null, reason: LOCAL_RESOLUTION_REASON, reason_code: null, node: null },
+        prompts: evidence.prompts,
+        resolution: evidence.resolution,
        metadata: projectMetadata(inspection.read),
        library: { ...LOCAL_LIBRARY, tags: [] },
    };
@@ -166,7 +194,12 @@ export const localFileAdapter = Object.freeze({
    scope(handle) { owned(handle); return LOCAL_SCOPE; },
    // An inert sentinel: the controller's same-key check works and no URL is ever built.
    inspectionPath(handle) { return `local-file:${owned(handle).key}`; },
-    async read(handle, { signal } = {}) {
+    /**
+     * Reads, resolves and projects one selection on the page's thread in bounded steps (each bound by the 2 MiB role
+     * and 4 MiB workflow budgets and the resolver's work limits) with a turn of the event loop between them, so the
+     * inspector's busy state paints. Every wait ends with the selection's `signal`; `yieldControl` is for tests.
+     */
+    async read(handle, { signal, yieldControl = nextTurn } = {}) {
        const secret = owned(handle);
        let result = null;
        try {
@@ -176,7 +209,14 @@ export const localFileAdapter = Object.freeze({
            // MetadataReadError, an unreadable record. Abort and programming errors still reject.
            if (!(error instanceof DOMException) || error.name === 'AbortError' || signal?.aborted) throw error;
        }
-        return fitLocalPayload(buildLocalPayload({ read: result, file: { name: secret.filename, size: secret.file.size, lastModified: secret.file.lastModified }, classification: secret.classification }), MAX_RESPONSE_BYTES, { signal });
+        const semantics = await untilAborted(loadInspectionSemantics(), signal);
+        await yieldControl(signal);
+        const evidence = localEvidence(result, secret.classification, semantics);
+        await yieldControl(signal);
+        const file = { name: secret.filename, size: secret.file.size, lastModified: secret.file.lastModified };
+        const payload = buildLocalPayload({ read: result, file, classification: secret.classification, semantics, evidence });
+        await yieldControl(signal);
+        return fitLocalPayload(payload, MAX_RESPONSE_BYTES, { signal });
    },
    toRecord(result, handle, extractFacts) {
        const secret = owned(handle);
@@ -0,0 +1,55 @@
+// A1111 `parameters` for local-resolver.mjs (#249 local Inspect, PR L3 Task 9): a port of
+// utils/prompt_pair_resolver.py `_parameters`, `_footer` and `_trailer_lines` for the inspection profile.
+// Python's `re` differs from JavaScript's in three ways that matter here, so the patterns spell them out:
+// multiline `^`/`$` break only at "\n" (not "\r", U+2028 or U+2029), `\s` is the `str.isspace()` set and `\d`
+// is any Unicode decimal digit (Nd). Lengths count code points. No DOM.
+import { PY_SPACE, pyLen, pyStrip } from './py-json.mjs';
+import { EMPTY_POSITIVE_REASON, result } from './local-resolver-support.mjs';
+
+const START = '(?<=^|\\n)', END = '(?=\\n|$)', SPACE = `[${PY_SPACE}]*`;
+// `_FOOTER` and `_BARE_FOOTER` (inspection reads a bare `Steps: N` when there is no full footer).
+const FOOTER = new RegExp(`${START}Steps:${SPACE}\\p{Nd}+${SPACE},[^\\n]*${END}`, 'gu');
+const BARE_FOOTER = new RegExp(`${START}Steps:${SPACE}\\p{Nd}+${SPACE}${END}`, 'gu');
+const TRAILERS = ['Template:', 'Negative Template:'];
+const DELIMITER = '\nNegative prompt:';
+
+/** `_trailer_lines`: empty, or at most one `Template:` line then at most one `Negative Template:` line. */
+function trailerLines(text) {
+    const stripped = pyStrip(text);
+    const lines = stripped ? stripped.split(/\r?\n|\r/) : [];
+    const prefixes = lines.map(line => {
+        const index = TRAILERS.findIndex(name => line.startsWith(name));
+        return index === -1 ? null : index;
+    });
+    return !prefixes.includes(null) && prefixes.every((prefix, index) => index === 0 || prefix > prefixes[index - 1]);
+}
+
+/** `_footer(value, inspection=True)`: the unique settings footer match, or null. */
+function footer(value) {
+    let footers = [...value.matchAll(FOOTER)];
+    if (!footers.length) footers = [...value.matchAll(BARE_FOOTER)];
+    if (footers.length !== 1) return null;
+    const [match] = footers;
+    return trailerLines(value.slice(match.index + match[0].length)) ? match : null;
+}
+
+const rstripLineBreaks = text => text.replace(/[\r\n]+$/, '');
+
+/** `_parameters(value, max_text_length, inspection=True)`. */
+export function parameters(value, maxTextLength) {
+    if (typeof value !== 'string' || !value) return result('absent', { reason: 'No A1111 parameters' });
+    if (pyLen(value) > maxTextLength) return result('unresolved', { reason: 'Parameters exceed the length limit', reasonCode: 'text-limit' });
+    const match = footer(value);
+    if (match === null) return result('unresolved', { reason: 'A1111 settings footer is not unique', reasonCode: 'malformed' });
+    // R4: text that starts with the delimiter has an empty positive (#165).
+    const body = `\n${rstripLineBreaks(value.slice(0, match.index))}`;
+    const parts = body.split(DELIMITER);
+    if (parts.length > 2) return result('ambiguous', { reason: 'Multiple negative prompt delimiters' });
+    const positive = pyStrip(parts[0]);
+    if (!positive) return result('unresolved', { reason: EMPTY_POSITIVE_REASON });
+    const provenance = { format: 'a1111', field: 'parameters', text_source: 'embedded-parameters' };
+    const side = (text, role) => ({ text, storage_text: text, provenance: { ...provenance, role } });
+    if (parts.length === 1) return result('absent', { positive: side(positive, 'positive'), reason: 'Negative prompt delimiter is absent' });
+    const negative = pyStrip(parts[1]);
+    return result('resolved', { positive: side(positive, 'positive'), negative: side(negative, 'negative') });
+}
@@ -0,0 +1,174 @@
+// Candidate selection for local-resolver.mjs (#249 local Inspect, PR L3 Task 9): ports of
+// utils/prompt_pair_resolver.py `_GraphResolver` `stage`, `upstream_stages`, `final_stages`, `file_stages`,
+// `non_file_outputs`, `producers_of`, `consumers`, `reaches_output`, plus `_outcome_key`, `_recipe_key` and
+// `_shared_pair` (#270). Each function takes the resolver whose budgets and caches it spends, so the order of
+// work, and with it every limit, is the server's. No DOM.
+import { isDict, pyGet, pyStr } from './py-json.mjs';
+import { DETAILER, IDENTICAL_BRANCHES_REASON, Unresolved, isLink, result } from './local-resolver-support.mjs';
+
+const roleText = side => side !== null && typeof side === 'object' ? side.text : null;
+const storageText = side => side !== null && typeof side === 'object' ? side.storage_text : null;
+/** `_outcome_key`: what a reader sees of a result, the state and the two role texts. */
+export const outcomeKey = item => JSON.stringify([item.state, roleText(item.positive), roleText(item.negative)]);
+/** `_recipe_key`: the outcome plus each side's stored recipe. */
+const recipeKey = item => JSON.stringify([item.state, roleText(item.positive), roleText(item.negative), storageText(item.positive), storageText(item.negative)]);
+
+/** `_shared_pair`: the one pair every sampler branch resolved to, or null (#270). */
+export function sharedPair(candidates) {
+    const first = candidates[0];
+    if (first.state !== 'resolved') return null;
+    if (new Set(candidates.map(recipeKey)).size !== 1) return null;
+    return result('resolved', { positive: first.positive, negative: first.negative, reason: IDENTICAL_BRANCHES_REASON, candidates });
+}
+
+/** `stage`: one sampler's result; a detailer is compared with its upstream stages. */
+export function stage(resolver, samplerId, later) {
+    if (later.size >= resolver.maxDepth) return result('unresolved', { samplerId, reason: 'Resolution depth limit reached', reasonCode: 'depth-limit' });
+    const own = resolver.sides(samplerId);
+    if (own.state === 'unresolved') return own;
+    const [name, inputs] = resolver.node(samplerId);
+    const entry = resolver.semantics.samplers.get(name);
+    if (entry === undefined || entry.strategy !== DETAILER) return own;
+    let upstream;
+    try {
+        upstream = upstreamStages(resolver, samplerId, pyGet(inputs, entry.image_stage));
+        if (upstream.some(nodeId => later.has(nodeId))) throw new Unresolved('Cyclic sampler stage ancestry', 'malformed');
+    } catch (error) {
+        if (!(error instanceof Unresolved)) throw error;
+        return result('unresolved', { samplerId, reason: error.message, reasonCode: error.code, node: error.node });
+    }
+    if (!upstream.length) return own;
+    const deeper = new Set([...later, samplerId]);
+    const stages = upstream.map(nodeId => stage(resolver, nodeId, deeper));
+    const blocked = stages.find(item => item.state === 'unresolved');
+    // A stage that cannot be read cannot be compared: never pick one.
+    if (blocked !== undefined) return result('unresolved', { samplerId, reason: blocked.reason, reasonCode: blocked.reason_code, node: blocked.node });
+    const flat = [];
+    for (const item of [own, ...stages]) flat.push(...(item.state === 'ambiguous' ? item.candidates : [item]));
+    if (new Set(flat.map(outcomeKey)).size === 1) return own;
+    return result('ambiguous', { samplerId, reason: 'Sampler stages have different prompts', candidates: flat, reasonCode: 'multistage-differs' });
+}
+
+/** `upstream_stages`: samplers reached from a detailer's image input, breadth first; each node draws a visit. */
+function upstreamStages(resolver, origin, value) {
+    if (!isLink(value)) throw new Unresolved('Expected an image link', 'malformed');
+    const found = [], start = String(value[0]), queue = [[start, 0]], queued = new Set([start]);
+    for (let head = 0; head < queue.length; head++) {
+        const [nodeId, depth] = queue[head];
+        if (nodeId === origin) throw new Unresolved('Cyclic sampler stage ancestry', 'malformed');
+        if (depth >= resolver.maxDepth) throw new Unresolved('Resolution depth limit reached', 'depth-limit');
+        resolver.budget.spend();
+        const [name, inputs] = resolver.node(nodeId);
+        if (resolver.stageClasses.has(name)) { found.push(nodeId); continue; }
+        if (resolver.stageShaped(name, inputs)) throw resolver.unsupported('Unsupported sampler stage ancestry', nodeId);
+        resolver.enqueue(queue, queued, inputs, depth + 1);
+    }
+    return found;
+}
+
+const strategyOf = (resolver, nodeId) => resolver.semantics.samplers.get(resolver.graph.get(nodeId).get('class_type')).strategy;
+
+/** `final_stages`: drop samplers that only feed detailers (each is judged in that chain). */
+export function finalStages(resolver, samplerIds) {
+    samplerIds = fileStages(resolver, samplerIds);
+    const detailers = samplerIds.filter(nodeId => strategyOf(resolver, nodeId) === DETAILER);
+    if (!detailers.length) return samplerIds;
+    let reverse;
+    try { reverse = consumers(resolver); } catch (error) {
+        if (!(error instanceof Unresolved)) throw error;
+        return samplerIds;
+    }
+    const absorbed = new Set();
+    for (const detailer of detailers) {
+        resolver.budget.reset(resolver.perCandidateVisits);
+        try {
+            const [name, inputs] = resolver.node(detailer);
+            const image = pyGet(inputs, resolver.semantics.samplers.get(name).image_stage);
+            for (const nodeId of upstreamStages(resolver, detailer, image)) {
+                if (!reachesOutput(resolver, nodeId, reverse)) absorbed.add(nodeId);
+            }
+        } catch (error) {
+            if (!(error instanceof Unresolved)) throw error;
+        }
+    }
+    const kept = samplerIds.filter(nodeId => !absorbed.has(nodeId));
+    return kept.length ? kept : samplerIds;
+}
+
+/** `file_stages`: stages not proven preview-only; all of them when every one is. */
+function fileStages(resolver, samplerIds) {
+    if (samplerIds.length < 2) return samplerIds;
+    let toFile, toPreview;
+    try {
+        const reverse = consumers(resolver), previews = nonFileOutputs(resolver);
+        const terminals = [...resolver.graph].filter(([nodeId, node]) => isDict(node) && !previews.has(nodeId) && !reverse.get(nodeId)?.length).map(([nodeId]) => nodeId);
+        toFile = producersOf(resolver, terminals, previews);
+        toPreview = producersOf(resolver, [...previews], previews);
+    } catch (error) {
+        if (!(error instanceof Unresolved)) throw error;
+        return samplerIds;
+    }
+    const kept = samplerIds.filter(nodeId => toFile.has(nodeId) || !toPreview.has(nodeId));
+    return kept.length ? kept : samplerIds;
+}
+
+function nonFileOutputs(resolver) {
+    const names = resolver.semantics.nonFileOutputs, found = new Set();
+    for (const [nodeId, node] of resolver.graph) {
+        // `node.get("class_type") in names`: only a string can be a listed class.
+        if (isDict(node) && names.has(pyGet(node, 'class_type'))) found.add(nodeId);
+    }
+    return found;
+}
+
+/** `producers_of`: nodes whose output reaches one of `starts`, never through a preview. */
+function producersOf(resolver, starts, previews) {
+    const found = new Set(starts), queue = [...starts];
+    for (let head = 0; head < queue.length; head++) {
+        const inputs = pyGet(resolver.graph.get(queue[head]), 'inputs');
+        if (!isDict(inputs)) continue;
+        resolver.scan(inputs.size);
+        for (const value of inputs.values()) {
+            if (!isLink(value)) continue;
+            const producer = String(value[0]);
+            if (found.has(producer) || previews.has(producer) || !isDict(pyGet(resolver.graph, producer))) continue;
+            found.add(producer);
+            queue.push(producer);
+        }
+    }
+    return found;
+}
+
+/** `consumers`: reverse links, node ID to the IDs of nodes reading one of its outputs. */
+function consumers(resolver) {
+    const reverse = new Map();
+    for (const [nodeId, node] of resolver.graph) {
+        if (!isDict(node) || !isDict(pyGet(node, 'inputs'))) continue;
+        const inputs = node.get('inputs');
+        resolver.scan(inputs.size);
+        for (const value of inputs.values()) {
+            if (!isLink(value)) continue;
+            const producer = String(value[0]);
+            if (!reverse.has(producer)) reverse.set(producer, []);
+            reverse.get(producer).push(nodeId);
+        }
+    }
+    return reverse;
+}
+
+/** `reaches_output`: whether a sampler's output reaches a terminal node besides later stages. */
+function reachesOutput(resolver, nodeId, reverse) {
+    const seen = new Set([nodeId]), queue = [nodeId];
+    for (let head = 0; head < queue.length; head++) {
+        for (const consumer of reverse.get(queue[head]) ?? []) {
+            if (seen.has(consumer)) continue;
+            seen.add(consumer);
+            resolver.budget.spend();
+            const name = pyStr(pyGet(resolver.graph.get(consumer), 'class_type', ''));
+            if (resolver.stageClasses.has(name) || resolver.semantics.nonFileOutputs.has(name)) continue;
+            if (!reverse.get(consumer)?.length) return true;
+            queue.push(consumer);
+        }
+    }
+    return false;
+}
@@ -0,0 +1,255 @@
+// Tables, evidence reader, bounds and outcome lines for local-resolver.mjs (#249 local Inspect, PR L3 Tasks 8-9):
+// the constants of utils/prompt_pair_resolver.py and utils/inspection_outcomes.py, utils/pair_execution.py
+// `read_pair_execution` and the semantics table check of utils/inspection_semantics.py. No DOM.
+import { PyFloat, PyValueError, isDict, isList, isInt, pyJsonLoads, pyLen, pySlice, pyStrip, pyTruthy, pyEqualsOne, pyStr, pyGet } from './py-json.mjs';
+
+/** The semantics table is unusable: the server's `SemanticsError`. */
+export class SemanticsError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'SemanticsError';
+    }
+}
+
+// INSPECTION_PROFILE (prompt_pair_resolver.py 152-166); its drop_preview_only_stages is always on here.
+export const PROFILE = Object.freeze({
+    perCandidateVisits: 2000, totalVisits: 20000, maxDepth: 64, maxTextLength: 100000, nodeCeiling: 20000,
+    maxPathEntries: 64 * 20000, maxBuiltChars: 16 * 100000, maxScannedUnits: 8000000,
+});
+export const EXECUTION_KEY = 'comfyassets_prompt_pairs';
+export const ROLE_METADATA_KEYS = new Set(['prompt', 'parameters', EXECUTION_KEY]);
+// pair_execution.py
+export const MAX_EXECUTION_RECORDS = 16, MAX_EXECUTION_NODES = 64, MAX_EXECUTION_TEXT = 100000, MAX_EXECUTION_JSON = 500000;
+export const EXECUTION_FIELDS = ['text', 'negative_text', 'positive_text', 'negative_effective_text', 'prepend_text', 'append_text'];
+
+export const CANDIDATE_STRATEGIES = new Set(['ksampler', 'custom-advanced', 'detailer-stage']);
+export const DETAILER = 'detailer-stage';
+export const GUIDER_ABSENT_REASON = 'Guider has no negative input';
+export const ZEROED_SOURCE = 'zeroed-conditioning';
+export const MAX_BRANCH_CANDIDATES = 32;
+export const RUNTIME_REASON = 'Text is decided at run time';
+export const EMPTY_POSITIVE_REASON = 'Positive prompt is empty';
+export const IDENTICAL_BRANCHES_REASON = 'Every sampler branch uses the same prompt pair';
+export const MULTISTAGE_UNATTRIBUTED_REASON = 'Multistage sampler ancestry is ambiguous';
+export const MALFORMED_EVIDENCE_REASON = 'Prompt evidence is malformed';
+export const UNREADABLE_METADATA_REASON = 'Media metadata could not be read';
+export const SEMANTICS_UNAVAILABLE_REASON = 'Inspection node semantics are unavailable';
+export const INCOMPATIBLE_SLOT = 'Output slot has an incompatible type';
+export const OVERWRITTEN_PROMPT_REASON = 'Saved PromptManager text was overwritten by another node';
+export const UNVERIFIABLE_CODES = new Set(['unsupported-node', 'runtime-value']);
+export const MAX_JOIN_INPUTS = 1000;
+export const SAMPLER_LIKE_INPUTS = ['latent_image', 'guider', 'positive', 'negative'];
+export const NO_SAMPLER_NAMES = 3;
+export const CLASS_NAME_LENGTH = 64;
+export const MAX_SUBGRAPH_DEPTH = 8, MAX_WORKFLOW_NODES = 100000;
+
+// inspection_outcomes.py
+export const OUTCOME_NAME_LENGTH = 200;
+export const LIMIT_CODES = ['work-limit', 'depth-limit', 'text-limit', 'graph-ceiling'];
+export const NAMED_LINES = {
+    'unsupported-node': 'Prompt uses a node the inspector does not support',
+    'runtime-value': 'Prompt is chosen at run time',
+    composite: 'Prompt combines several texts',
+};
+export const CODED_LINES = {
+    ...Object.fromEntries(LIMIT_CODES.map(code => [code, 'Prompt exceeds inspection limits.'])),
+    'no-sampler': 'No supported sampler was found.',
+    malformed: 'Prompt metadata in this file is malformed.',
+    'multistage-differs': 'Sampler stages have different prompts.',
+};
+export const UNCODED_LINES = {
+    [EMPTY_POSITIVE_REASON]: 'Positive prompt is empty.',
+    [MULTISTAGE_UNATTRIBUTED_REASON]: 'Several sampler stages were found; their prompts were not compared.',
+    [SEMANTICS_UNAVAILABLE_REASON]: "The inspector's node table is unavailable.",
+    [UNREADABLE_METADATA_REASON]: 'Metadata in this file could not be read.',
+};
+
+// Output adapters (prompt_pair_resolver.py 44-105): [inputName, kind, {compose, storageInput, comma, strip, default}].
+export const adapter = (inputName, kind, options = {}) => Object.freeze({ inputName, kind, compose: false, storageInput: false, comma: false, strip: false, default: null, ...options });
+export const slotKey = (name, slot) => `${name}\u0000${String(slot)}`;
+export const ADAPTERS = new Map();
+for (const name of ['PromptManager', 'PromptManagerFocused', 'PromptManagerSplit']) {
+    ADAPTERS.set(slotKey(name, 0), adapter('text', 'conditioning', { compose: true }));
+    ADAPTERS.set(slotKey(name, 1), adapter('text', 'string', { compose: true }));
+}
+ADAPTERS.set(slotKey('PromptManagerPair', 0), adapter('text', 'conditioning', { compose: true }));
+ADAPTERS.set(slotKey('PromptManagerPair', 2), adapter('text', 'string', { compose: true }));
+ADAPTERS.set(slotKey('PromptManagerPair', 1), adapter('negative_text', 'conditioning', { storageInput: true }));
+ADAPTERS.set(slotKey('PromptManagerPair', 3), adapter('negative_text', 'string', { storageInput: true }));
+ADAPTERS.set(slotKey('PromptManagerText', 0), adapter('text', 'string', { compose: true }));
+ADAPTERS.set(slotKey('CLIPTextEncode', 0), adapter('text', 'conditioning'));
+for (const name of ['PrimitiveString', 'PrimitiveStringMultiline']) ADAPTERS.set(slotKey(name, 0), adapter('value', 'string'));
+for (const name of ['Text Multiline', 'String Literal', 'ShowText|pysssss']) ADAPTERS.set(slotKey(name, 0), adapter('text', 'string'));
+// Historical PromptManager classes (inspection only).
+export const COMMA = { comma: true }, NEGATIVE = { strip: true, default: '' };
+const historical = [
+    ['PromptManagerV2', 0, 'text', 'conditioning', COMMA], ['PromptManagerV2', 1, 'negative_text', 'conditioning', NEGATIVE],
+    ['PromptManagerV2', 2, 'text', 'string', COMMA], ['PromptManagerV2', 3, 'negative_text', 'string', NEGATIVE],
+    ['PromptManagerV2Text', 0, 'text', 'string', COMMA], ['PromptManagerV2Text', 1, 'negative_text', 'string', NEGATIVE],
+    ['PromptManagerNegative', 0, 'text', 'conditioning', { strip: true }], ['PromptManagerNegative', 1, 'text', 'string', { strip: true }],
+    ['PromptManagerPositiveText', 0, 'text', 'string', COMMA], ['PromptManagerNegativeText', 0, 'text', 'string', COMMA],
+];
+for (const name of ['PromptManagerPositive', 'PromptManagerDetailer']) historical.push([name, 0, 'text', 'conditioning', COMMA], [name, 1, 'text', 'string', COMMA]);
+for (const [name, slot, input, kind, options] of historical) ADAPTERS.set(slotKey(name, slot), adapter(input, kind, options));
+// `known_slots` in execution_record: every adapter slot per class.
+export const ADAPTER_SLOTS = new Map();
+for (const key of ADAPTERS.keys()) {
+    const [name, slot] = key.split('\u0000');
+    if (!ADAPTER_SLOTS.has(name)) ADAPTER_SLOTS.set(name, new Set());
+    ADAPTER_SLOTS.get(name).add(slot);
+}
+
+export class Unresolved extends Error {
+    constructor(message, code = null, node = null) {
+        super(message);
+        this.code = code;
+        this.node = node;
+    }
+}
+export class Diverging extends Error {
+    constructor(key) {
+        super('diverging');
+        this.key = key;
+    }
+}
+
+/** `_link`: a two-item list of (str or int) and a non-negative int, never a bool. */
+export function isLink(value) {
+    if (!isList(value) || value.length !== 2) return false;
+    const [source, slot] = value;
+    return (typeof source === 'string' || isInt(source)) && isInt(slot) && (typeof slot === 'bigint' ? slot >= 0n : slot >= 0);
+}
+export const nodeRef = (nodeId, classType) => ({ id: pySlice(nodeId, CLASS_NAME_LENGTH), class_type: typeof classType === 'string' ? pySlice(classType, CLASS_NAME_LENGTH) : null });
+
+export function result(state, { positive = null, negative = null, samplerId = null, reason = '', candidates = [], reasonCode = null, node = null } = {}) {
+    return { state, positive, negative, sampler_id: samplerId, reason, candidates, reason_code: reasonCode, node };
+}
+
+export class Budget {
+    constructor(total) {
+        this.total = total;
+        this.allowance = total;
+    }
+    reset(allowance) { this.allowance = allowance; }
+    spend() {
+        if (this.total <= 0 || this.allowance <= 0) throw new Unresolved('Resolution visit limit reached', 'work-limit');
+        this.total -= 1;
+        this.allowance -= 1;
+    }
+    charge(cost) {
+        if (cost > this.allowance) throw new Unresolved('Resolution visit limit reached', 'work-limit');
+        this.allowance -= cost;
+    }
+}
+
+/** `read_pair_execution`: one distinct record for a traced node, or null; malformed evidence throws `Unresolved`. */
+export function readPairExecution(metadata, nodeId) {
+    const evidence = message => new Unresolved(message, 'malformed');
+    if (!isDict(metadata) || !metadata.has(EXECUTION_KEY)) return null;
+    let envelope = metadata.get(EXECUTION_KEY);
+    if (typeof envelope === 'string') {
+        if (pyLen(envelope) > MAX_EXECUTION_JSON) throw evidence('Execution evidence exceeds the size limit');
+        try { envelope = pyJsonLoads(envelope); } catch (error) {
+            if (error instanceof PyValueError) throw evidence('Malformed execution evidence JSON');
+            throw error;
+        }
+    }
+    if (!isDict(envelope) || !pyEqualsOne(pyGet(envelope, 'version'))) throw evidence('Unsupported execution evidence format');
+    const nodes = pyGet(envelope, 'nodes');
+    if (pyTruthy(pyGet(envelope, 'truncated')) || !isDict(nodes) || nodes.size > MAX_EXECUTION_NODES) throw evidence('Truncated or malformed execution evidence');
+    if (!nodes.has(nodeId)) return null;
+    const node = nodes.get(nodeId);
+    if (!isDict(node) || pyTruthy(pyGet(node, 'truncated'))) throw evidence('Truncated or malformed node execution evidence');
+    const records = pyGet(node, 'records');
+    if (!isList(records) || !records.length || records.length > MAX_EXECUTION_RECORDS) throw evidence('Malformed node execution records');
+    const unique = new Map();
+    for (const record of records) {
+        if (!isDict(record) || EXECUTION_FIELDS.some(key => typeof pyGet(record, key) !== 'string' || pyLen(record.get(key)) > MAX_EXECUTION_TEXT)) {
+            throw evidence('Malformed execution text values');
+        }
+        const clean = Object.fromEntries(EXECUTION_FIELDS.map(key => [key, record.get(key)]));
+        if (clean.negative_effective_text !== clean.negative_text) throw evidence('Negative execution text must be unchanged');
+        unique.set(JSON.stringify(EXECUTION_FIELDS.map(key => clean[key])), clean);
+    }
+    if (unique.size !== 1) throw evidence('Multiple distinct executions have no image anchor');
+    return [...unique.values()][0];
+}
+
+/**
+ * The validated semantics table (utils/inspection_semantics.py), from the parsed JSON document. Throws
+ * `SemanticsError` for any shape the server rejects; the caller then answers "semantics unavailable".
+ */
+export function compileSemantics(doc) {
+    const fail = message => { throw new SemanticsError(message); };
+    const plain = value => value !== null && typeof value === 'object' && !Array.isArray(value);
+    if (!plain(doc) || doc.schema !== 1) fail('unsupported semantics table');
+    const owners = new Map();
+    const claim = (name, category) => {
+        if (owners.has(name) && owners.get(name) !== category) fail(`duplicate class ${name}`);
+        owners.set(name, category);
+    };
+    const byClass = category => {
+        if (!plain(doc[category])) fail(`category ${category} must be an object`);
+        const table = new Map();
+        for (const [name, entry] of Object.entries(doc[category])) {
+            if (!plain(entry) || typeof entry.strategy !== 'string') fail(`${category}[${name}]`);
+            claim(name, category);
+            table.set(name, entry);
+        }
+        return table;
+    };
+    const bySlot = category => {
+        if (!Array.isArray(doc[category])) fail(`category ${category} must be a list`);
+        const table = new Map();
+        for (const row of doc[category]) {
+            if (!plain(row) || typeof row.class !== 'string' || !Number.isInteger(row.slot) || row.slot < 0 || row.slot > 255) fail(`${category} row`);
+            const key = slotKey(row.class, row.slot);
+            if (table.has(key)) fail(`${category}: duplicate output key`);
+            claim(row.class, category);
+            const { class: _name, slot: _slot, ...entry } = row;
+            table.set(key, entry);
+        }
+        return table;
+    };
+    const bySet = category => {
+        if (!Array.isArray(doc[category])) fail(`category ${category} must be a list`);
+        const set = new Set();
+        for (const name of doc[category]) {
+            if (typeof name !== 'string' || set.has(name)) fail(`${category}: duplicate class`);
+            claim(name, category);
+            set.add(name);
+        }
+        return set;
+    };
+    const samplers = byClass('samplers'), guiders = byClass('guiders'), selectors = byClass('selectors');
+    const composites = byClass('composites'), savers = byClass('savers');
+    const conditioning = bySlot('conditioning'), encoders = bySlot('encoders'), strings = bySlot('strings');
+    const runtime = bySet('runtime'), nonFileOutputs = bySet('non_file_outputs');
+    const stageInputs = doc.stage_inputs;
+    if (!plain(stageInputs) || !Array.isArray(stageInputs.shaped) || !Array.isArray(stageInputs.with_model)) fail('stage_inputs');
+    return Object.freeze({
+        samplers, guiders, selectors, composites, savers, conditioning, encoders, strings, runtime, nonFileOutputs,
+        stageInputs: { shaped: [...stageInputs.shaped], withModel: [...stageInputs.with_model] }, allClasses: new Set(owners.keys()),
+    });
+}
+
+/** `outcome_message`: one line for an unresolved outcome, or null to keep the status copy. */
+export function outcomeMessage(resolution) {
+    if (resolution?.state !== 'unresolved') return null;
+    const code = typeof resolution.reason_code === 'string' ? resolution.reason_code : null;
+    if (Object.hasOwn(NAMED_LINES, code)) {
+        const node = resolution.node, raw = node !== null && typeof node === 'object' ? node.class_type : null;
+        const name = typeof raw === 'string' && raw ? pySlice(raw, OUTCOME_NAME_LENGTH) : null;
+        return name ? `${NAMED_LINES[code]} (${name}).` : `${NAMED_LINES[code]}.`;
+    }
+    if (code === null) return Object.hasOwn(UNCODED_LINES, resolution.reason) ? UNCODED_LINES[resolution.reason] : null;
+    return Object.hasOwn(CODED_LINES, code) ? CODED_LINES[code] : null;
+}
+
+export const sideOf = (status, text = null, source = null) => ({ status, text, source });
+export function explained(prompts, resolution) {
+    const message = outcomeMessage(resolution);
+    if (message === null) return prompts;
+    return Object.fromEntries(Object.entries(prompts).map(([role, side]) => [role, side.status === 'unresolved' && !Object.hasOwn(side, 'message') ? { ...side, message } : side]));
+}
+export const EMPTY_POSITIVE = outcomeMessage({ state: 'unresolved', reason: EMPTY_POSITIVE_REASON });
@@ -0,0 +1,772 @@
+// The server's inspection resolver in this browser (#249 local Inspect, PR L3 Task 8, decision LI-1): a port of
+// utils/prompt_inspector.py `inspect_prompt_evidence` with utils/prompt_pair_resolver.py (INSPECTION_PROFILE) and
+// utils/pair_execution.py `read_pair_execution`, driven by web/js/inspection-semantics.json. Python is the oracle:
+// tests/test_local_inspect_parity.py compares every answer with the server's on the same records. Values follow
+// Python's model (py-json.mjs): dict order, int versus float, code-point lengths, `str.strip()`.
+//
+// Task 8 ported execution evidence and graph tracing for one sampler; Task 9 adds candidate selection among several
+// samplers and detailer stages (local-resolver-stages.mjs) and A1111 `parameters` (local-parameters.mjs). No DOM.
+import { PyValueError, isDict, isList, isInt, pyJsonLoads, pyLen, pySlice, pyStrip, pyStr, pyGet } from './py-json.mjs';
+import {
+    ADAPTERS,
+    ADAPTER_SLOTS,
+    Budget,
+    CANDIDATE_STRATEGIES,
+    CLASS_NAME_LENGTH,
+    Diverging,
+    EMPTY_POSITIVE,
+    EMPTY_POSITIVE_REASON,
+    GUIDER_ABSENT_REASON,
+    INCOMPATIBLE_SLOT,
+    MALFORMED_EVIDENCE_REASON,
+    MAX_BRANCH_CANDIDATES,
+    MAX_JOIN_INPUTS,
+    MAX_SUBGRAPH_DEPTH,
+    MAX_WORKFLOW_NODES,
+    MULTISTAGE_UNATTRIBUTED_REASON,
+    NO_SAMPLER_NAMES,
+    OVERWRITTEN_PROMPT_REASON,
+    PROFILE,
+    ROLE_METADATA_KEYS,
+    RUNTIME_REASON,
+    SAMPLER_LIKE_INPUTS,
+    SEMANTICS_UNAVAILABLE_REASON,
+    UNREADABLE_METADATA_REASON,
+    UNVERIFIABLE_CODES,
+    Unresolved,
+    ZEROED_SOURCE,
+    compileSemantics,
+    explained,
+    isLink,
+    nodeRef,
+    readPairExecution,
+    result,
+    sideOf,
+    slotKey,
+} from './local-resolver-support.mjs';
+import { finalStages, outcomeKey, sharedPair, stage } from './local-resolver-stages.mjs';
+import { parameters } from './local-parameters.mjs';
+
+export { SemanticsError, compileSemantics, readPairExecution, outcomeMessage, isLink } from './local-resolver-support.mjs';
+
+class GraphResolver {
+    constructor(graph, metadata, semantics, overwritten) {
+        this.graph = graph;
+        this.overwritten = overwritten;
+        this.perCandidateVisits = PROFILE.perCandidateVisits;
+        this.budget = new Budget(PROFILE.totalVisits);
+        this.budget.reset(PROFILE.perCandidateVisits);
+        this.pathEntries = PROFILE.maxPathEntries;
+        this.builtChars = PROFILE.maxBuiltChars;
+        this.scanned = PROFILE.maxScannedUnits;
+        this.checked = new Map();
+        this.costs = new Map();
+        this.heights = new Map();
+        this.deepest = 0;
+        this.maxDepth = PROFILE.maxDepth;
+        this.maxTextLength = PROFILE.maxTextLength;
+        this.memo = new Map();
+        this.active = new Set();
+        this.metadata = metadata ?? new Map();
+        this.textSources = new Map();
+        this.choices = new Map();
+        this.tainted = false;
+        this.latentWalks = new Map();
+        this.latentCharged = new Set();
+        this.semantics = semantics;
+        this.samplerClasses = new Set([...semantics.samplers].filter(([, entry]) => CANDIDATE_STRATEGIES.has(entry.strategy)).map(([name]) => name));
+        this.stageClasses = new Set(semantics.samplers.keys());
+    }
+
+    node(nodeId) {
+        if (!this.checked.has(nodeId)) {
+            try {
+                this.checked.set(nodeId, this.checkedNode(nodeId));
+            } catch (error) {
+                if (!(error instanceof Unresolved) || error.code === 'work-limit') throw error;
+                this.checked.set(nodeId, error);
+            }
+        }
+        const checked = this.checked.get(nodeId);
+        if (checked instanceof Unresolved) throw new Unresolved(checked.message, checked.code, checked.node);
+        return checked;
+    }
+    checkedNode(nodeId) {
+        const node = pyGet(this.graph, nodeId);
+        if (!isDict(node) || !isDict(pyGet(node, 'inputs'))) throw new Unresolved('Missing or malformed graph node', 'malformed');
+        const inputs = node.get('inputs');
+        this.scan(inputs.size);
+        return [pyStr(pyGet(node, 'class_type', '')), inputs];
+    }
+    scan(units) {
+        if (units > this.scanned) {
+            this.scanned = -1;
+            throw new Unresolved('Resolution work limit reached', 'work-limit');
+        }
+        this.scanned -= units;
+    }
+    unsupported(message, nodeId) { return this.named(message, 'unsupported-node', nodeId); }
+    named(message, code, nodeId) {
+        const node = pyGet(this.graph, nodeId);
+        const classType = isDict(node) ? pyGet(node, 'class_type') : null;
+        return new Unresolved(message, code, nodeRef(nodeId, classType));
+    }
+    bounded(text) {
+        if (pyLen(text) > this.maxTextLength) throw new Unresolved('Resolved text exceeds the length limit', 'text-limit');
+        return text;
+    }
+    built(text) {
+        this.builtChars -= pyLen(text);
+        if (this.builtChars < 0) throw new Unresolved('Resolution work limit reached', 'work-limit');
+        return text;
+    }
+
+    /** `text`: [text, path, storageText] for a string value or a typed link. */
+    text(value, kind, depth = 0) {
+        this.deepest = Math.max(this.deepest, depth);
+        if (depth >= this.maxDepth) throw new Unresolved('Resolution depth limit reached', 'depth-limit');
+        if (typeof value === 'string' && kind === 'string') return [this.bounded(value), [], value];
+        if (!isLink(value)) throw new Unresolved('Expected a typed graph link or text input', 'malformed');
+        const nodeId = String(value[0]), slot = value[1];
+        const key = `${slotKey(nodeId, slot)}\u0000${kind}`;
+        if (this.active.has(key)) throw new Unresolved('Cyclic prompt graph', 'malformed');
+        if (this.memo.has(key)) {
+            const height = this.heights.get(key);
+            if (depth + height >= this.maxDepth) throw new Unresolved('Resolution depth limit reached', 'depth-limit');
+            this.budget.charge(this.costs.get(key));
+            this.deepest = Math.max(this.deepest, depth + height);
+            return this.memo.get(key);
+        }
+        const allowance = this.budget.allowance, outerDeepest = this.deepest, outerTainted = this.tainted;
+        this.tainted = false;
+        this.deepest = depth;
+        try {
+            this.budget.spend();
+            const [name, inputs] = this.node(nodeId);
+            this.scan(inputs.size);
+            if (this.overwritten.has(nodeId)) throw new Unresolved(OVERWRITTEN_PROMPT_REASON, 'malformed');
+            this.active.add(key);
+            let text, path, storageText;
+            const adapted = ADAPTERS.get(slotKey(name, slot));
+            if (name === 'Reroute' && slot === 0) {
+                const keys = ['value', 'input', 'in'].filter(item => inputs.has(item));
+                if (keys.length !== 1) throw new Unresolved('Reroute input is not uniquely identifiable', 'malformed');
+                [text, path, storageText] = this.text(inputs.get(keys[0]), kind, depth + 1);
+                this.inheritSource(nodeId, slot, [path]);
+            } else if (adapted) {
+                if (adapted.kind !== kind) throw new Unresolved(INCOMPATIBLE_SLOT, 'malformed');
+                const evidence = name === 'PromptManagerPair' ? this.executionRecord(nodeId, inputs) : null;
+                if (evidence !== null) {
+                    text = evidence[adapted.inputName === 'text' ? 'positive_text' : 'negative_effective_text'];
+                    storageText = evidence[adapted.inputName];
+                    path = [];
+                    this.textSources.set(slotKey(nodeId, slot), 'execution');
+                } else if (adapted.comma || adapted.strip) {
+                    [text, path, storageText] = this.historical(adapted, inputs, depth);
+                } else {
+                    [text, path, storageText] = this.text(pyGet(inputs, adapted.inputName), 'string', depth + 1);
+                    if (adapted.compose || adapted.storageInput) storageText = text;
+                    if (adapted.compose) {
+                        const [before, beforePath] = this.text(pyGet(inputs, 'prepend_text', ''), 'string', depth + 1);
+                        const [after, afterPath] = this.text(pyGet(inputs, 'append_text', ''), 'string', depth + 1);
+                        this.scan(pyLen(before) + pyLen(after) + beforePath.length + path.length + afterPath.length);
+                        text = this.built(this.bounded([pyStrip(before), text, pyStrip(after)].filter(part => part).join(' ')));
+                        path = [...beforePath, ...path, ...afterPath];
+                    }
+                }
+            } else if ((name === 'StringConcatenate' || name === 'Text Concatenate') && slot === 0 && kind === 'string') {
+                [text, path] = this.concatenate(name, inputs, depth);
+                storageText = text;
+            } else if (this.follows(name, slot, kind)) {
+                [text, path, storageText] = this.semantic(nodeId, name, slot, kind, inputs, depth);
+            } else {
+                throw this.unsupported('Unsupported node semantics or output slot', nodeId);
+            }
+            this.scan(path.length + 1);
+            path = [{ node_id: nodeId, output_slot: slot }, ...path];
+            const pathLimit = this.maxDepth * Math.max(1, this.perCandidateVisits);
+            this.pathEntries -= path.length;
+            if (path.length > pathLimit || this.pathEntries < 0) throw new Unresolved('Provenance path limit reached', 'work-limit');
+            const traced = [text, path, storageText];
+            if (!this.tainted) {
+                this.memo.set(key, traced);
+                this.costs.set(key, allowance - this.budget.allowance);
+                this.heights.set(key, this.deepest - depth);
+            }
+            return traced;
+        } finally {
+            this.deepest = Math.max(outerDeepest, this.deepest);
+            this.tainted = outerTainted || this.tainted;
+            this.active.delete(key);
+        }
+    }
+
+    /** `StringConcatenate` / `Text Concatenate` (the `text` branch). */
+    concatenate(name, inputs, depth) {
+        let keys, delimiter, clean;
+        if (name === 'StringConcatenate') {
+            keys = ['string_a', 'string_b'];
+            delimiter = pyGet(inputs, 'delimiter', '');
+            clean = false;
+        } else {
+            keys = [...inputs.keys()].filter(item => /^text_[a-z]$/.test(item)).sort();
+            delimiter = pyGet(inputs, 'delimiter', ' ');
+            clean = pyStr(pyGet(inputs, 'clean_whitespace', 'true')).toLowerCase() === 'true';
+        }
+        if (!keys.length || typeof delimiter !== 'string') throw new Unresolved('Malformed concatenation', 'malformed');
+        const parts = [], path = [];
+        let size = 0;
+        for (const inputName of keys) {
+            let [part, followed] = this.text(pyGet(inputs, inputName, ''), 'string', depth + 1);
+            this.scan(pyLen(part) + followed.length);
+            if (clean) part = pyStrip(part);
+            path.push(...followed);
+            if (part || name === 'StringConcatenate') {
+                size += pyLen(part) + (parts.length ? pyLen(delimiter) : 0);
+                if (size > this.maxTextLength) throw new Unresolved('Resolved text exceeds the length limit', 'text-limit');
+                parts.push(part);
+            }
+        }
+        return [this.built(parts.join(delimiter)), path];
+    }
+
+    /** `prompt_manager_*.py` at 07a5af3: strip, then join with ", ". */
+    historical(adapted, inputs, depth) {
+        let [text, path] = this.text(pyGet(inputs, adapted.inputName, adapted.default), 'string', depth + 1);
+        this.scan(pyLen(text));
+        text = pyStrip(text);
+        const storageText = text;
+        if (adapted.comma) {
+            let [before, beforePath] = this.text(pyGet(inputs, 'prepend_text') ?? '', 'string', depth + 1);
+            let [after, afterPath] = this.text(pyGet(inputs, 'append_text') ?? '', 'string', depth + 1);
+            this.scan(pyLen(before) + pyLen(after) + beforePath.length + afterPath.length);
+            before = pyStrip(before); after = pyStrip(after);
+            if (before) text = `${before}${text && !before.endsWith(',') ? ', ' : ''}${text}`;
+            if (after) text = `${text}${text && !text.endsWith(',') ? ', ' : ''}${after}`;
+            text = this.built(this.bounded(text));
+            path = [...beforePath, ...path, ...afterPath];
+        }
+        return [text, path, storageText];
+    }
+
+    follows(name, slot, kind) {
+        const semantics = this.semantics, key = slotKey(name, slot);
+        if (semantics.runtime.has(name)) return true;
+        if (semantics.encoders.has(key) || semantics.strings.has(key)) return true;
+        if (slot === 0 && semantics.selectors.has(name)) return true;
+        return kind === 'conditioning' && (semantics.conditioning.has(key) || (slot === 0 && semantics.composites.has(name)));
+    }
+
+    semantic(nodeId, name, slot, kind, inputs, depth) {
+        const semantics = this.semantics, key = slotKey(name, slot);
+        if (semantics.runtime.has(name)) throw this.named(RUNTIME_REASON, 'runtime-value', nodeId);
+        for (const [table, expected, build] of [[semantics.encoders, 'conditioning', 'encoded'], [semantics.strings, 'string', 'stringed']]) {
+            const listed = table.get(key);
+            if (listed !== undefined) {
+                if (kind !== expected) throw new Unresolved(INCOMPATIBLE_SLOT, 'malformed');
+                return this[build](nodeId, listed, inputs, depth);
+            }
+        }
+        const entry = kind === 'conditioning' ? semantics.conditioning.get(key) : undefined;
+        if (entry !== undefined && entry.strategy === 'zeroed') {
+            this.textSources.set(slotKey(nodeId, slot), ZEROED_SOURCE);
+            return ['', [], ''];
+        }
+        if (entry !== undefined) {
+            const traced = this.text(pyGet(inputs, entry.input), kind, depth + 1);
+            this.inheritSource(nodeId, slot, [traced[1]]);
+            return traced;
+        }
+        if (semantics.selectors.has(name)) return this.select(nodeId, semantics.selectors.get(name), inputs, kind, depth);
+        const parts = semantics.composites.get(name).inputs.map(inputName => this.text(pyGet(inputs, inputName), kind, depth + 1));
+        if (new Set(parts.map(part => part[0])).size !== 1) throw this.named('Combined conditioning has different texts', 'composite', nodeId);
+        return this.merged(nodeId, slot, parts);
+    }
+
+    select(nodeId, entry, inputs, kind, depth) {
+        const condition = pyGet(inputs, entry.condition), branches = entry.branches;
+        let choice;
+        if (typeof condition === 'boolean') choice = condition;
+        else if (!isLink(condition)) throw new Unresolved('Malformed selector condition', 'malformed');
+        else if (this.choices.has(slotKey(String(condition[0]), condition[1]))) {
+            choice = this.choices.get(slotKey(String(condition[0]), condition[1]));
+            this.tainted = true;
+        } else choice = null;
+        if (choice !== null) {
+            const traced = this.text(pyGet(inputs, branches[choice ? 'true' : 'false']), kind, depth + 1);
+            this.inheritSource(nodeId, 0, [traced[1]]);
+            return traced;
+        }
+        const parts = ['true', 'false'].map(label => this.text(pyGet(inputs, branches[label]), kind, depth + 1));
+        if (parts[0][0] !== parts[1][0]) throw new Diverging(slotKey(String(condition[0]), condition[1]));
+        return this.merged(nodeId, 0, parts);
+    }
+
+    merged(nodeId, slot, parts) {
+        const traced = this.joinedPaths(parts, parts);
+        this.inheritSource(nodeId, slot, parts.map(part => part[1]));
+        return traced;
+    }
+
+    joinedPaths(chosen, parts) {
+        const text = chosen[0][0];
+        const storages = new Set(chosen.map(part => part[2]));
+        const storageText = storages.size === 1 ? chosen[0][2] : text;
+        const paths = parts.map(part => part[1]);
+        this.scan(paths.reduce((sum, path) => sum + path.length, 0));
+        const merged = [], seen = new Set();
+        for (const path of paths) {
+            for (const step of path) {
+                const identity = slotKey(step.node_id, step.output_slot);
+                if (!seen.has(identity)) { seen.add(identity); merged.push(step); }
+            }
+        }
+        return [text, merged, storageText];
+    }
+
+    encoded(nodeId, entry, inputs, depth) {
+        const names = entry.inputs;
+        if (entry.strategy === 'single') return this.text(pyGet(inputs, names[0]), 'string', depth + 1);
+        if (entry.strategy === 'flag-parts') return this.flagged(nodeId, entry, inputs, depth);
+        if (entry.strategy !== 'parts-equal') throw this.unsupported('Unsupported encoder strategy', nodeId);
+        const parts = names.map(name => this.text(pyGet(inputs, name), 'string', depth + 1));
+        this.scan(parts.reduce((sum, part) => sum + pyLen(part[0]), 0));
+        if (new Set(parts.map(part => part[0])).size === 1) return this.joinedPaths(parts, parts);
+        const filled = parts.filter(part => part[0] !== '');
+        if (filled.length === 1) return this.joinedPaths(filled, parts);
+        throw this.named('Encoder parts have different texts', 'composite', nodeId);
+    }
+
+    flagged(nodeId, entry, inputs, depth) {
+        const names = entry.inputs;
+        if (!this.setting(nodeId, inputs, entry.params.flag, 'bool')) return this.text(pyGet(inputs, names[0]), 'string', depth + 1);
+        const parts = names.map(name => this.text(pyGet(inputs, name), 'string', depth + 1));
+        this.scan(parts.reduce((sum, part) => sum + pyLen(part[0]), 0));
+        if (new Set(parts.map(part => part[0])).size === 1) return this.joinedPaths(parts, parts);
+        throw this.named(RUNTIME_REASON, 'runtime-value', nodeId);
+    }
+
+    stringed(nodeId, entry, inputs, depth) {
+        const strategy = entry.strategy, source = entry.inputs[0];
+        if (strategy === 'literal') return this.text(pyGet(inputs, source), 'string', depth + 1);
+        if (strategy === 'strip-newlines') {
+            const flag = this.setting(nodeId, inputs, entry.params.flag, 'bool');
+            const traced = this.text(pyGet(inputs, source), 'string', depth + 1);
+            if (!flag) return traced;
+            this.scan(pyLen(traced[0]));
+            const text = this.built(this.bounded(pyStrip(traced[0].replaceAll('\n', ''))));
+            return [text, traced[1], text];
+        }
+        if (strategy === 'join-multi') return this.joinMulti(nodeId, entry, inputs, depth);
+        throw this.unsupported('Unsupported string strategy', nodeId);
+    }
+
+    /** A literal node setting of exactly `type(value) is kind`; linked is `unsupported-node`, else malformed. */
+    setting(nodeId, inputs, name, kind) {
+        if (!inputs.has(name)) throw new Unresolved('Missing string node setting', 'malformed');
+        const value = inputs.get(name);
+        if (isLink(value)) throw this.unsupported('Linked string node setting', nodeId);
+        const typed = { bool: typeof value === 'boolean', int: isInt(value), str: typeof value === 'string' }[kind];
+        if (!typed) throw new Unresolved('Malformed string node setting', 'malformed');
+        return value;
+    }
+
+    joinMulti(nodeId, entry, inputs, depth) {
+        const params = entry.params, flag = params.list_flag;
+        if (!inputs.has(flag)) throw new Unresolved('Missing string node setting', 'malformed');
+        if (isLink(inputs.get(flag)) || inputs.get(flag) === true) throw this.named(RUNTIME_REASON, 'runtime-value', nodeId);
+        if (inputs.get(flag) !== false) throw new Unresolved('Malformed string node setting', 'malformed');
+        const count = this.setting(nodeId, inputs, params.count, 'int');
+        const delimiter = this.setting(nodeId, inputs, params.delimiter, 'str');
+        if (!(count >= 1 && count <= MAX_JOIN_INPUTS)) throw new Unresolved('Malformed string node setting', 'malformed');
+        const total = Number(count);
+        this.scan(total);
+        const names = [entry.inputs[0]];
+        for (let index = 2; index <= total; index++) names.push(`${params.input_prefix}${index}`);
+        const parts = [], path = [], seen = new Set();
+        let size = 0;
+        names.forEach((inputName, position) => {
+            if (position && !inputs.has(inputName)) return;
+            const [part, followed] = this.text(pyGet(inputs, inputName), 'string', depth + 1);
+            this.scan(pyLen(part) + followed.length);
+            for (const step of followed) {
+                const identity = slotKey(step.node_id, step.output_slot);
+                if (!seen.has(identity)) { seen.add(identity); path.push(step); }
+            }
+            if (position && !part) return;
+            size += pyLen(part) + (parts.length ? pyLen(delimiter) : 0);
+            if (size > this.maxTextLength) throw new Unresolved('Resolved text exceeds the length limit', 'text-limit');
+            parts.push(part);
+        });
+        const text = this.built(parts.join(delimiter));
+        return [text, path, text];
+    }
+
+    sourceOf(path) {
+        if (!path.length) return 'graph-inferred';
+        return this.textSources.get(slotKey(path[0].node_id, path[0].output_slot)) ?? 'graph-inferred';
+    }
+    inheritSource(nodeId, slot, paths) {
+        const sources = new Set(paths.map(path => this.sourceOf(path)));
+        if (sources.size === 1) this.textSources.set(slotKey(nodeId, slot), [...sources][0]);
+        else this.textSources.delete(slotKey(nodeId, slot));
+    }
+    unverifiable(error) { return UNVERIFIABLE_CODES.has(error.code); }
+
+    executionRecord(nodeId, inputs) {
+        const record = readPairExecution(this.metadata, nodeId);
+        if (record === null) return null;
+        for (const name of ['text', 'negative_text', 'prepend_text', 'append_text']) {
+            let expected;
+            try {
+                expected = this.text(pyGet(inputs, name, ''), 'string')[0];
+            } catch (error) {
+                if (error instanceof Unresolved && this.unverifiable(error)) {
+                    const value = pyGet(inputs, name);
+                    if (isLink(value)) {
+                        const [sourceName] = this.node(String(value[0]));
+                        const known = ADAPTER_SLOTS.get(sourceName);
+                        if (known && !known.has(String(value[1]))) throw error;
+                        if (['StringConcatenate', 'Text Concatenate', 'Reroute'].includes(sourceName) && value[1] !== 0) throw error;
+                    }
+                    continue;
+                }
+                throw error;
+            }
+            if (name === 'prepend_text' || name === 'append_text') expected = pyStrip(expected);
+            if (expected !== record[name]) throw new Unresolved('Execution evidence does not match recorded node inputs', 'malformed');
+        }
+        return record;
+    }
+
+    side(value, samplerId, guiderId = null, depth = 0) {
+        const [text, path, storageText] = this.text(value, 'conditioning', depth);
+        const origin = path[0];
+        const provenance = {
+            format: 'comfyui', sampler_id: samplerId, ...origin, path,
+            text_source: this.textSources.get(slotKey(origin.node_id, origin.output_slot)) ?? 'graph-inferred',
+        };
+        if (guiderId !== null) provenance.guider_id = guiderId;
+        return { text, storage_text: storageText, provenance };
+    }
+
+    guider(value) {
+        const seen = new Set();
+        let depth = 0;
+        for (;;) {
+            if (depth >= this.maxDepth) throw new Unresolved('Resolution depth limit reached', 'depth-limit');
+            if (!isLink(value)) throw new Unresolved('Expected a guider link', 'malformed');
+            const nodeId = String(value[0]), slot = value[1];
+            if (seen.has(nodeId)) throw new Unresolved('Cyclic guider ancestry', 'malformed');
+            seen.add(nodeId);
+            this.budget.spend();
+            const [name, inputs] = this.node(nodeId);
+            this.scan(inputs.size);
+            depth += 1;
+            if (name === 'Reroute' && slot === 0) {
+                const keys = ['value', 'input', 'in'].filter(item => inputs.has(item));
+                if (keys.length !== 1) throw new Unresolved('Reroute input is not uniquely identifiable', 'malformed');
+                value = inputs.get(keys[0]);
+                continue;
+            }
+            const entry = this.semantics.guiders.get(name);
+            if (entry === undefined || slot !== 0) throw this.unsupported('Unsupported guider', nodeId);
+            return [nodeId, inputs, { positive: entry.positive, negative: entry.negative ?? null }, entry.absent_reason ?? GUIDER_ABSENT_REASON, depth];
+        }
+    }
+
+    pair(samplerId) {
+        this.budget.reset(this.perCandidateVisits);
+        this.latentCharged = new Set();
+        if (this.budget.total <= 0) return result('unresolved', { samplerId, reason: 'Resolution visit limit reached', reasonCode: 'work-limit' });
+        return this.branches(samplerId);
+    }
+
+    branches(samplerId) {
+        const pending = [new Map()], results = [];
+        try {
+            while (pending.length) {
+                this.choices = pending.shift();
+                try {
+                    results.push(stage(this, samplerId, new Set()));
+                } catch (error) {
+                    if (!(error instanceof Diverging)) throw error;
+                    if (results.length + pending.length + 2 > MAX_BRANCH_CANDIDATES) throw new Unresolved('Too many selector branches', 'work-limit');
+                    for (const choice of [true, false]) pending.push(new Map([...this.choices, [error.key, choice]]));
+                }
+            }
+        } catch (error) {
+            if (!(error instanceof Unresolved)) throw error;
+            return result('unresolved', { samplerId, reason: error.message, reasonCode: error.code, node: error.node });
+        } finally {
+            this.choices = new Map();
+        }
+        if (results.every(item => item.state === 'unresolved')) return results[0];
+        if (new Set(results.map(outcomeKey)).size === 1) return results[0];
+        return result('ambiguous', { samplerId, reason: 'Selector branches have different prompts', candidates: results });
+    }
+
+    sides(samplerId) {
+        let positive = null, negative = null;
+        try {
+            let [name, inputs] = this.node(samplerId);
+            const entry = this.semantics.samplers.get(name);
+            this.checkOverrides(samplerId, entry, inputs);
+            const latent = entry.latent;
+            if (latent !== undefined && latent !== null && inputs.has(latent)) this.latentChecked(samplerId, inputs.get(latent));
+            let guiderId = null, depth = 0, conditioning = entry.conditioning, absentReason = 'Negative input is absent';
+            if (entry.strategy === 'custom-advanced') {
+                let guiderReason;
+                [guiderId, inputs, conditioning, guiderReason, depth] = this.guider(pyGet(inputs, conditioning.guider));
+                if (conditioning.negative === null) absentReason = guiderReason;
+            }
+            positive = this.side(pyGet(inputs, conditioning.positive), samplerId, guiderId, depth);
+            if (!pyStrip(positive.text)) throw new Unresolved(EMPTY_POSITIVE_REASON);
+            const negativeName = conditioning.negative;
+            if (negativeName === null || negativeName === undefined || !inputs.has(negativeName)) {
+                return result('absent', { positive, samplerId, reason: absentReason });
+            }
+            negative = this.side(inputs.get(negativeName), samplerId, guiderId, depth);
+            return result('resolved', { positive, negative, samplerId });
+        } catch (error) {
+            if (!(error instanceof Unresolved)) throw error;
+            return result('unresolved', { positive, negative, samplerId, reason: error.message, reasonCode: error.code, node: error.node });
+        }
+    }
+
+    checkOverrides(samplerId, entry, inputs) {
+        for (const name of entry.prompt_overrides ?? []) {
+            const value = pyGet(inputs, name);
+            if (value === null || value === '') continue;
+            if (isLink(value)) throw this.unsupported('Unsupported prompt override', String(value[0]));
+            throw this.named(RUNTIME_REASON, 'runtime-value', samplerId);
+        }
+    }
+
+    latentChecked(samplerId, value) {
+        let error;
+        if (this.latentWalks.has(samplerId)) {
+            const [walked, cost] = this.latentWalks.get(samplerId);
+            error = walked;
+            if (!this.latentCharged.has(samplerId)) {
+                this.budget.charge(cost);
+                this.latentCharged.add(samplerId);
+            }
+        } else {
+            const before = this.budget.allowance;
+            try {
+                this.latentStages(samplerId, value);
+                error = null;
+            } catch (raised) {
+                if (!(raised instanceof Unresolved) || raised.code === 'work-limit') throw raised;
+                error = raised;
+            }
+            this.latentWalks.set(samplerId, [error, before - this.budget.allowance]);
+            this.latentCharged.add(samplerId);
+        }
+        if (error !== null) throw new Unresolved(error.message, error.code, error.node === null ? null : { ...error.node });
+    }
+
+    enqueue(queue, queued, inputs, depth) {
+        this.scan(inputs.size);
+        for (const item of inputs.values()) {
+            if (!isLink(item)) continue;
+            const key = String(item[0]);
+            if (!queued.has(key)) { queued.add(key); queue.push([key, depth]); }
+        }
+    }
+
+    stageShaped(name, inputs) {
+        if (this.semantics.allClasses.has(name)) return false;
+        const { shaped, withModel } = this.semantics.stageInputs;
+        if (shaped.some(key => isLink(pyGet(inputs, key)))) return true;
+        return isLink(pyGet(inputs, 'model')) && withModel.some(key => isLink(pyGet(inputs, key)));
+    }
+
+    latentStages(origin, value) {
+        if (!isLink(value)) throw new Unresolved('Unknown latent ancestry', 'malformed');
+        const start = String(value[0]), queue = [[start, 0]], queued = new Set([start]);
+        for (let head = 0; head < queue.length; head++) {
+            const [nodeId, depth] = queue[head];
+            if (nodeId === origin) throw new Unresolved('Cyclic latent ancestry', 'malformed');
+            if (depth >= this.maxDepth) throw new Unresolved('Resolution depth limit reached', 'depth-limit');
+            this.budget.spend();
+            const [name, inputs] = this.node(nodeId);
+            if (this.stageClasses.has(name)) throw new Unresolved(MULTISTAGE_UNATTRIBUTED_REASON);
+            if (this.stageShaped(name, inputs)) throw this.unsupported('Unsupported latent ancestry', nodeId);
+            this.enqueue(queue, queued, inputs, depth + 1);
+        }
+    }
+}
+
+
+/** `_sampler_like_classes`: distinct classes, in graph order, of nodes shaped like samplers or guiders. */
+function samplerLikeClasses(graph) {
+    const names = [];
+    for (const node of graph.values()) {
+        if (!isDict(node) || !isDict(pyGet(node, 'inputs'))) continue;
+        const name = pyGet(node, 'class_type');
+        if (typeof name !== 'string' || !name || names.includes(name)) continue;
+        if (SAMPLER_LIKE_INPUTS.some(key => isLink(pyGet(node.get('inputs'), key)))) {
+            names.push(pySlice(name, CLASS_NAME_LENGTH));
+            if (names.length === NO_SAMPLER_NAMES) break;
+        }
+    }
+    return names;
+}
+
+function noSampler(graph) {
+    const seen = samplerLikeClasses(graph);
+    const reason = `No supported sampler pair found${seen.length ? ` (saw ${seen.join(', ')})` : ''}`;
+    return result('unresolved', { reason, reasonCode: 'no-sampler' });
+}
+
+/** `_prompt_manager_widgets`: API node ID to widget text for every PromptManager node that runs. */
+function promptManagerWidgets(workflow) {
+    const nodes = isDict(workflow) ? pyGet(workflow, 'nodes') : null;
+    if (!isList(nodes)) return new Map();
+    const definitions = pyGet(workflow, 'definitions');
+    const listed = isDict(definitions) ? pyGet(definitions, 'subgraphs') : null;
+    const subgraphs = new Map();
+    for (const subgraph of isList(listed) ? listed : []) {
+        if (isDict(subgraph) && typeof pyGet(subgraph, 'id') === 'string' && isList(pyGet(subgraph, 'nodes'))) subgraphs.set(subgraph.get('id'), subgraph.get('nodes'));
+    }
+    const widgets = new Map(), stack = [[nodes, '', 0]];
+    let visited = 0;
+    while (stack.length) {
+        const [members, prefix, depth] = stack.pop();
+        for (const node of members) {
+            visited += 1;
+            if (visited > MAX_WORKFLOW_NODES) return widgets;
+            if (!isDict(node)) continue;
+            const kind = pyGet(node, 'type'), nodeId = pyGet(node, 'id');
+            if (!(typeof nodeId === 'string' || isInt(nodeId))) continue;
+            const apiId = `${prefix}${String(nodeId)}`;
+            // A list or object `type` is neither a subgraph instance nor a PromptManager node (#286).
+            if (isList(kind) || isDict(kind)) continue;
+            if (typeof kind === 'string' && subgraphs.has(kind) && depth < MAX_SUBGRAPH_DEPTH) {
+                stack.push([subgraphs.get(kind), `${apiId}:`, depth + 1]);
+                continue;
+            }
+            const values = pyGet(node, 'widgets_values');
+            const text = isList(values) && values.length && typeof values[0] === 'string' ? values[0] :
+                isDict(values) && typeof pyGet(values, 'text') === 'string' ? values.get('text') : null;
+            if (typeof kind === 'string' && kind !== 'PromptManagerPair' && kind.toLowerCase().includes('promptmanager') && text !== null) widgets.set(apiId, text);
+        }
+    }
+    return widgets;
+}
+
+/** `_overwritten_prompt_nodes` (R1). */
+function overwrittenPromptNodes(workflow, graph) {
+    const widgets = promptManagerWidgets(workflow), byText = new Map();
+    for (const [nodeId] of widgets) {
+        const node = pyGet(graph, nodeId);
+        const inputs = isDict(node) ? pyGet(node, 'inputs') : null;
+        const text = isDict(inputs) ? pyGet(inputs, 'text') : null;
+        if (typeof text === 'string') {
+            if (!byText.has(text)) byText.set(text, []);
+            byText.get(text).push(nodeId);
+        }
+    }
+    const found = new Set();
+    for (const ids of byText.values()) {
+        if (ids.length > 1 && new Set(ids.map(id => widgets.get(id))).size > 1) ids.forEach(id => found.add(id));
+    }
+    return found;
+}
+
+/** `_resolve` for an unanchored inspection (output_node_id None). */
+function resolve(metadata, semantics) {
+    if (!isDict(metadata) || !metadata.size) return result('absent', { reason: 'No parsed prompt metadata' });
+    let graph;
+    if (metadata.has('prompt')) graph = metadata.get('prompt');
+    else if (metadata.has('parameters')) return parameters(metadata.get('parameters'), PROFILE.maxTextLength);
+    else graph = metadata;
+    if (!isDict(graph) || !graph.size) return result('unresolved', { reason: 'API graph is missing or malformed', reasonCode: 'malformed' });
+    if (graph.size > PROFILE.nodeCeiling) return result('unresolved', { reason: 'Prompt graph exceeds the inspection node ceiling', reasonCode: 'graph-ceiling' });
+    if (semantics === null) return result('unresolved', { reason: SEMANTICS_UNAVAILABLE_REASON });
+    let overwritten = new Set();
+    if (metadata.has('prompt')) {
+        overwritten = overwrittenPromptNodes(pyGet(metadata, 'workflow'), graph);
+    }
+    const resolver = new GraphResolver(graph, metadata.has('prompt') ? metadata : null, semantics, overwritten);
+    const samplerIds = finalStages(resolver, [...graph].filter(([, node]) => isDict(node) && typeof pyGet(node, 'class_type') === 'string' &&
+        resolver.samplerClasses.has(node.get('class_type'))).map(([id]) => id));
+    if (!samplerIds.length) return noSampler(graph);
+    if (samplerIds.length > 1) {
+        const candidates = samplerIds.map(id => resolver.pair(id));
+        return sharedPair(candidates) ?? result('ambiguous', { reason: 'Multiple sampler branches', candidates });
+    }
+    return resolver.pair(samplerIds[0]);
+}
+
+
+/** `_may_hold_prompt_manager`. */
+function mayHoldPromptManager(canonical) {
+    const graph = pyGet(canonical, 'prompt');
+    if (!isDict(graph)) return false;
+    for (const node of graph.values()) {
+        if (!isDict(node)) continue;
+        const name = pyGet(node, 'class_type'), inputs = pyGet(node, 'inputs');
+        if (typeof name === 'string' && name.toLowerCase().includes('promptmanager')) return true;
+        if (isDict(inputs) && inputs.has('search_text')) return true;
+    }
+    return false;
+}
+
+/** `_parsed_workflow`: the UI workflow as a dict, or null. */
+function parsedWorkflow(value) {
+    if (typeof value === 'string') {
+        try { value = pyJsonLoads(value); } catch (error) {
+            if (error instanceof PyValueError) return null;
+            throw error;
+        }
+    }
+    return isDict(value) ? value : null;
+}
+
+/** `unreadable_evidence`: both roles when the file's metadata could not be read at all. */
+export function unreadableEvidence() {
+    const resolution = { state: 'unresolved', sampler_id: null, reason: UNREADABLE_METADATA_REASON, reason_code: null, node: null };
+    return { prompts: explained({ positive: sideOf('unresolved'), negative: sideOf('unresolved') }, resolution), resolution };
+}
+
+/**
+ * `inspect_prompt_evidence(records, None, profile=INSPECTION_PROFILE)`: `{prompts, resolution}` for the records a
+ * local read found (`{prompt, workflow, parameters, comfyassets_prompt_pairs}` texts). `semantics` is
+ * `compileSemantics(...)`'s table, or null when it could not be loaded.
+ */
+export function resolveLocalEvidence(records, semantics) {
+    const source = records !== null && typeof records === 'object' ? records : {};
+    const metadata = new Map(Object.entries(source).filter(([key]) => ROLE_METADATA_KEYS.has(key)));
+    const malformedResolution = { state: 'unresolved', sampler_id: null, reason: MALFORMED_EVIDENCE_REASON, reason_code: 'malformed', node: null };
+    if (!metadata.size) {
+        return {
+            prompts: { positive: sideOf('absent'), negative: sideOf('absent') },
+            resolution: { state: 'absent', sampler_id: null, reason: 'No parsed prompt metadata', reason_code: null, node: null },
+        };
+    }
+    const malformed = { prompts: explained({ positive: sideOf('unresolved'), negative: sideOf('unresolved') }, malformedResolution), resolution: malformedResolution };
+    if (!metadata.has('prompt') && !metadata.has('parameters')) return malformed;
+    if (typeof metadata.get('prompt') === 'string') {
+        try { metadata.set('prompt', pyJsonLoads(metadata.get('prompt'))); } catch (error) {
+            if (error instanceof PyValueError) return malformed;
+            throw error;
+        }
+    }
+    const workflow = mayHoldPromptManager(metadata) ? parsedWorkflow(source.workflow ?? null) : null;
+    if (workflow !== null && metadata.has('prompt')) metadata.set('workflow', workflow);
+    const resolved = resolve(metadata, semantics);
+    const state = resolved.state, prompts = {};
+    for (const role of ['positive', 'negative']) {
+        const side = resolved[role];
+        const present = side !== null && typeof side === 'object';
+        if (state !== 'ambiguous' && present && (role === 'negative' || pyStrip(side.text))) prompts[role] = sideOf('resolved', side.text, side.provenance.text_source);
+        else if (state === 'resolved' && present) prompts[role] = { ...sideOf('unresolved'), message: EMPTY_POSITIVE };
+        else prompts[role] = sideOf(state !== 'resolved' ? state : 'unresolved');
+    }
+    const resolution = { state, sampler_id: resolved.sampler_id, reason: resolved.reason, reason_code: resolved.reason_code, node: resolved.node };
+    return { prompts: explained(prompts, resolution), resolution };
+}
+
@@ -0,0 +1,27 @@
+// The node table local Inspect resolves with (#249 local Inspect, PR L3 Task 10): web/js/inspection-semantics.json,
+// the very table the server's inspector reads, fetched once per page through the API client (the proxy-mount rule).
+// The Inspect page asks for it as it mounts, before any file is chosen; it is the only static file Inspect fetches,
+// and the request carries nothing about a selection. A table that cannot be fetched or used is null: the roles then
+// answer as the server does when its table is unusable, and a later selection asks again.
+import { compileSemantics } from './local-resolver.mjs';
+
+export const SEMANTICS_PATH = '/prompt_manager/js/inspection-semantics.json';
+let pending = null;
+
+async function fetchSemantics() {
+    const client = globalThis.window?.ApiClient;
+    if (typeof client?.resolveUrl !== 'function' || typeof globalThis.fetch !== 'function') return null;
+    const response = await globalThis.fetch(client.resolveUrl(SEMANTICS_PATH), { credentials: 'same-origin' });
+    if (!response.ok) throw new Error(`Inspection node table request failed (${response.status})`);
+    return compileSemantics(await response.json());
+}
+
+/** The compiled table (one request per page), or null when it is unavailable. */
+export function loadInspectionSemantics() {
+    if (pending !== null) return pending;
+    const current = pending = fetchSemantics().catch(() => null).then(table => {
+        if (table === null && pending === current) pending = null;
+        return table;
+    });
+    return current;
+}
@@ -70,7 +70,7 @@ function chosenFile(input) {
 }

 export function createLocalSession({
-    parentScope, createObjectURL = file => URL.createObjectURL(file), revokeObjectURL = url => URL.revokeObjectURL(url),
+    parentScope, createObjectURL = file => URL.createObjectURL(file), revokeObjectURL = URL.revokeObjectURL.bind(URL),
    schedulerYield = defaultSchedulerYield(), setTimer = setTimeout, clearTimer = clearTimeout,
    pageTarget = globalThis.window, extractFacts, pngMetadata,
 } = {}) {
@@ -17,6 +17,7 @@
 // server folds them.

 import { INT_MAX_STR_DIGITS } from "./local-projection.mjs";
+import { JSON_MAX_DEPTH } from "./py-json.mjs";

 // Role records (prompt, parameters, the pair execution record) share one budget:
 // past it the read fails. A workflow has its own budget; past it only the workflow
@@ -40,7 +41,6 @@ const MAX_NAME_BYTES = 64; // the longest carrier name is 24 bytes; longer names
 export const VIDEO_READ_CEILING = MAX_VIDEO_ELEMENTS * (MAX_HEADER_BYTES + MAX_NAME_BYTES) + VIDEO_TAG_READ_BYTES;
 const PREFIX_BYTES = 32;
 const YIELD_INTERVAL_MS = 8;
-const JSON_MAX_DEPTH = 1000; // Python's default recursion limit

 const ROLE_KEYS = ["prompt", "parameters", "comfyassets_prompt_pairs"];
 const METADATA_KEYS = ["prompt", "workflow", "parameters", "comfyassets_prompt_pairs"];
@@ -826,8 +826,9 @@ export function pythonJsonLoads(text) {
        }
    }
    function value(depth) {
-        if (depth > JSON_MAX_DEPTH) throw new PythonJsonError("Maximum recursion depth exceeded", true);
        const char = text[pos];
+        // The shared cap (py-json.mjs): `depth` containers enclose this value, and it would be one more.
+        if ((char === "{" || char === "[") && depth >= JSON_MAX_DEPTH) throw new PythonJsonError("Maximum recursion depth exceeded", true);
        if (char === '"') return string();
        if (char === "{") {
            pos += 1;
@@ -0,0 +1,249 @@
+// Python's value model for the local inspection resolver (#249 local Inspect, PR L3): the server's resolver
+// (utils/prompt_pair_resolver.py) runs on `json.loads` output, so the browser port reads the same text the same way.
+// Objects are `Map`s (insertion order, a repeated key keeps its first position and its last value, as a dict does),
+// integers are numbers (or BigInt past 2^53 - 1), floats are `PyFloat`, None is null. Strings are measured, sliced and
+// stripped as Python's `str` is: by code point, with `str.isspace()` whitespace. No DOM.
+
+/** A Python float: distinct from an int (`1.0` is not a link slot, `type(x) is int` is false). */
+export class PyFloat {
+    constructor(value) {
+        this.value = value;
+        Object.freeze(this);
+    }
+}
+
+/** `ValueError` from `json.loads` (malformed text, or an integer past `sys.int_info.str_digits_check_threshold`). */
+export class PyValueError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'PyValueError';
+    }
+}
+
+// CPython's default int max str digits (PEP 651 / gh-95778).
+const INT_MAX_STR_DIGITS = 4300;
+/**
+ * The nesting both browser CPython-JSON parsers accept (this one and local-video.mjs's): every array or object counts,
+ * an empty one too, as CPython's scanner enters a recursion level for each. Past it `json.loads` raises RecursionError,
+ * which the server treats as invalid JSON; its real limit depends on the Python (TESTING.md, "Deep JSON").
+ */
+export const JSON_MAX_DEPTH = 1000;
+const MAX_SAFE_DIGITS = '9007199254740991';
+const NUMBER = /-?(?:0|[1-9][0-9]*)(\.[0-9]+)?([eE][-+]?[0-9]+)?/y;
+const STRING_STOP = /["\\\u0000-\u001f]/g;
+const HEX4 = /^[0-9a-fA-F]{4}$/;
+const ESCAPES = { '"': '"', '\\': '\\', '/': '/', b: '\b', f: '\f', n: '\n', r: '\r', t: '\t' };
+// The C scanner's constants, in its order of checks.
+const CONSTANTS = [['null', null], ['true', true], ['false', false], ['NaN', new PyFloat(NaN)],
+    ['Infinity', new PyFloat(Infinity)], ['-Infinity', new PyFloat(-Infinity)]];
+
+export const isDict = value => value instanceof Map;
+export const isList = value => Array.isArray(value);
+/** `isinstance(value, int) and not isinstance(value, bool)`. */
+export const isInt = value => (typeof value === 'number' && Number.isInteger(value)) || typeof value === 'bigint';
+
+function numberValue(match) {
+    const [literal, fraction, exponent] = match;
+    if (fraction || exponent) return new PyFloat(Number(literal));
+    const digits = literal[0] === '-' ? literal.slice(1) : literal;
+    if (digits.length > INT_MAX_STR_DIGITS) throw new PyValueError('Exceeds the limit for integer string conversion');
+    if (digits.length > MAX_SAFE_DIGITS.length || (digits.length === MAX_SAFE_DIGITS.length && digits > MAX_SAFE_DIGITS)) return BigInt(literal);
+    // `-0` is the int 0.
+    return Number(literal) || 0;
+}
+
+/** `json.loads(text)` with Python's defaults (C scanner): NaN/Infinity accepted, a repeated key's last value wins. */
+export function pyJsonLoads(text) {
+    if (typeof text !== 'string') throw new TypeError('JSON text must be a string');
+    if (text.startsWith('')) throw new PyValueError('Unexpected UTF-8 BOM (decode using utf-8-sig)');
+    let pos = 0;
+    const fail = message => new PyValueError(`${message}: char ${pos}`);
+    const skip = () => {
+        while (pos < text.length) {
+            const c = text.charCodeAt(pos);
+            if (c !== 0x20 && c !== 0x09 && c !== 0x0a && c !== 0x0d) break;
+            pos++;
+        }
+    };
+    function string() {
+        pos++;
+        let out = '';
+        for (;;) {
+            STRING_STOP.lastIndex = pos;
+            const stop = STRING_STOP.exec(text);
+            if (!stop) throw fail('Unterminated string starting at');
+            out += text.slice(pos, stop.index);
+            pos = stop.index + 1;
+            if (stop[0] === '"') return out;
+            if (stop[0] !== '\\') throw fail('Invalid control character at');
+            const escape = text[pos];
+            if (escape === 'u') {
+                const hex = text.slice(pos + 1, pos + 5);
+                if (!HEX4.test(hex)) throw fail('Invalid \\uXXXX escape');
+                pos += 5;
+                const code = parseInt(hex, 16);
+                if (code >= 0xd800 && code <= 0xdbff && text[pos] === '\\' && text[pos + 1] === 'u') {
+                    const low = text.slice(pos + 2, pos + 6);
+                    if (!HEX4.test(low)) throw fail('Invalid \\uXXXX escape');
+                    const lowCode = parseInt(low, 16);
+                    if (lowCode >= 0xdc00 && lowCode <= 0xdfff) {
+                        out += String.fromCharCode(code, lowCode);
+                        pos += 6;
+                        continue;
+                    }
+                }
+                out += String.fromCharCode(code);
+            } else if (Object.hasOwn(ESCAPES, escape)) {
+                out += ESCAPES[escape];
+                pos++;
+            } else throw fail('Invalid \\escape');
+        }
+    }
+    function key() {
+        if (text[pos] !== '"') throw fail('Expecting property name enclosed in double quotes');
+        const name = string();
+        skip();
+        if (text[pos] !== ':') throw fail("Expecting ':' delimiter");
+        pos++;
+        skip();
+        return name;
+    }
+    function scalar() {
+        if (text[pos] === '"') return string();
+        for (const [literal, value] of CONSTANTS) {
+            if (text.startsWith(literal, pos)) {
+                pos += literal.length;
+                return value;
+            }
+        }
+        NUMBER.lastIndex = pos;
+        const match = NUMBER.exec(text);
+        if (!match) throw fail('Expecting value');
+        pos += match[0].length;
+        return numberValue(match);
+    }
+    skip();
+    const stack = [];
+    const enter = () => {
+        if (stack.length >= JSON_MAX_DEPTH) throw fail('Maximum JSON nesting depth exceeded');
+        pos++; skip();
+    };
+    let result;
+    for (;;) {
+        let value;
+        if (text[pos] === '{') {
+            enter();
+            const frame = { value: new Map(), object: true, key: null };
+            if (text[pos] === '}') pos++;
+            else { frame.key = key(); stack.push(frame); continue; }
+            value = frame.value;
+        } else if (text[pos] === '[') {
+            enter();
+            const frame = { value: [], object: false };
+            if (text[pos] === ']') pos++;
+            else { stack.push(frame); continue; }
+            value = frame.value;
+        } else value = scalar();
+        for (;;) {
+            if (!stack.length) { result = value; break; }
+            const frame = stack[stack.length - 1];
+            if (frame.object) frame.value.set(frame.key, value);
+            else frame.value.push(value);
+            skip();
+            if (text[pos] === ',') {
+                pos++; skip();
+                if (frame.object) frame.key = key();
+                break;
+            }
+            if (text[pos] !== (frame.object ? '}' : ']')) throw fail("Expecting ',' delimiter");
+            pos++;
+            stack.pop();
+            value = frame.value;
+        }
+        if (!stack.length) break;
+    }
+    skip();
+    if (pos !== text.length) throw fail('Extra data');
+    return result;
+}
+
+/** `len(text)`: code points (a lone surrogate counts once). */
+export function pyLen(text) {
+    let pairs = 0;
+    for (let index = 0; index < text.length - 1; index++) {
+        const code = text.charCodeAt(index);
+        if (code >= 0xd800 && code <= 0xdbff) {
+            const next = text.charCodeAt(index + 1);
+            if (next >= 0xdc00 && next <= 0xdfff) { pairs++; index++; }
+        }
+    }
+    return text.length - pairs;
+}
+
+/** `text[:count]` by code points. */
+export function pySlice(text, count) {
+    if (text.length <= count) return text;
+    let end = 0;
+    for (let taken = 0; taken < count && end < text.length; taken++) {
+        const code = text.charCodeAt(end);
+        const next = text.charCodeAt(end + 1);
+        end += code >= 0xd800 && code <= 0xdbff && next >= 0xdc00 && next <= 0xdfff ? 2 : 1;
+    }
+    return text.slice(0, end);
+}
+
+// `str.isspace()`: Unicode Zs plus the bidi classes B, S and WS (not U+FEFF, unlike `trim()`).
+export const PY_SPACE = '\\t\\n\\x0b\\x0c\\r\\x1c-\\x1f \\x85\\xa0\\u1680\\u2000-\\u200a\\u2028\\u2029\\u202f\\u205f\\u3000';
+const LEADING = new RegExp(`^[${PY_SPACE}]+`), TRAILING = new RegExp(`[${PY_SPACE}]+$`);
+/** `text.strip()`. */
+export const pyStrip = text => text.replace(LEADING, '').replace(TRAILING, '');
+
+/** `bool(value)`. */
+export function pyTruthy(value) {
+    if (value === null || value === undefined || value === false) return false;
+    if (value === true) return true;
+    if (typeof value === 'number') return value !== 0;
+    if (typeof value === 'bigint') return value !== 0n;
+    if (value instanceof PyFloat) return value.value !== 0;
+    if (typeof value === 'string' || isList(value)) return value.length > 0;
+    if (isDict(value)) return value.size > 0;
+    return true;
+}
+
+/** `value == 1` (True and 1.0 equal it too). */
+export const pyEqualsOne = value => value === 1 || value === 1n || value === true || (value instanceof PyFloat && value.value === 1);
+
+/** `repr(float)`: the shortest round-trip digits, fixed for exponents -4..15, else `d.ddde+XX`. */
+export function pyFloatRepr(value) {
+    if (Number.isNaN(value)) return 'nan';
+    if (!Number.isFinite(value)) return value > 0 ? 'inf' : '-inf';
+    if (value === 0) return Object.is(value, -0) ? '-0.0' : '0.0';
+    const [mantissa, exponentText] = value.toExponential().split('e');
+    const exponent = Number(exponentText);
+    const sign = mantissa.startsWith('-') ? '-' : '';
+    const digits = mantissa.replace(/^-/, '').replace('.', '');
+    if (exponent < -4 || exponent >= 16) {
+        const rest = digits.slice(1);
+        return `${sign}${digits[0]}${rest ? `.${rest}` : ''}e${exponent < 0 ? '-' : '+'}${String(Math.abs(exponent)).padStart(2, '0')}`;
+    }
+    if (exponent < 0) return `${sign}0.${'0'.repeat(-exponent - 1)}${digits}`;
+    const whole = digits.slice(0, exponent + 1).padEnd(exponent + 1, '0'), fraction = digits.slice(exponent + 1);
+    return `${sign}${whole}.${fraction || '0'}`;
+}
+
+/**
+ * `str(value)` where the resolver compares the result with node class names (`str(node.get("class_type", ""))`).
+ * A container's text never equals a class name, so it is a marker only.
+ */
+export function pyStr(value) {
+    if (typeof value === 'string') return value;
+    if (value === null || value === undefined) return 'None';
+    if (value === true) return 'True';
+    if (value === false) return 'False';
+    if (typeof value === 'number' || typeof value === 'bigint') return String(value);
+    if (value instanceof PyFloat) return pyFloatRepr(value.value);
+    return '\u0000container';
+}
+
+/** `mapping.get(key, fallback)`. */
+export const pyGet = (mapping, key, fallback = null) => mapping.has(key) ? mapping.get(key) : fallback;
@@ -14,11 +14,29 @@ export const routes = [
    { id: 'favorites', label: 'Favorites' },
    // The concept's Activity (app.js renderActivity 732–738): this server session's jobs. No href: no Overview card.
    { id: 'activity', label: 'Activity' },
-    { id: 'system', label: 'System', href: '/prompt_manager/admin',
-        description: 'Open the current dashboard, then choose Settings or Maintenance for configuration, scans, backups and diagnostics.', action: 'Open existing administration' },
+    // Native System (#249 System S2): `#/system/<section>`. Q12: Overview's card opens its Overview section (`native`:
+    // a workspace hash, not a legacy page); each undelivered section hands off to its legacy tool (D94). The
+    // description is the concept's System heading (app.js renderSystem 700).
+    { id: 'system', label: 'System', href: '#/system/overview', native: true,
+        description: 'Configuration, maintenance and recovery—with browsing kept in the workspace.', action: 'Open System' },
 ];

-const NATIVE_ROUTES = new Set(['images', 'library', 'tags', 'inspect', 'overview', 'saved', 'favorites', 'activity']);
+const NATIVE_ROUTES = new Set(['images', 'library', 'tags', 'inspect', 'overview', 'saved', 'favorites', 'activity', 'system']);
+
+/**
+ * System's sections in the concept's order (app.js `systemSections` 635–644); the concept's `general` is production's
+ * `overview`, so `#/system/overview` sits beside the production hub `#/overview` (D28).
+ */
+export const SYSTEM_SECTIONS = Object.freeze([
+    ['overview', 'Overview'], ['appearance', 'Appearance'], ['sources', 'Sources & scans'], ['integrations', 'Integrations'],
+    ['tagging', 'Auto-tagging'], ['maintenance', 'Maintenance'], ['backups', 'Backup & export'], ['diagnostics', 'Diagnostics & logs'],
+].map(section => Object.freeze(section)));
+const SYSTEM_SECTION_IDS = new Set(SYSTEM_SECTIONS.map(([id]) => id));
+
+/** Whether `id` names a System section. */
+export function isSystemSection(id) {
+    return typeof id === 'string' && SYSTEM_SECTION_IDS.has(id);
+}

 /** A saved view (#249 D16): the shell resolves its id to the view's page, name and state. */
 const SAVED_ROUTE = Object.freeze({ id: 'saved', label: 'Saved view' });
@@ -39,6 +57,14 @@ export function resolveRoute(hash) {
    // One job of the Activity page (its id is the registry's uuid4 hex).
    const job = /^#\/activity\/([0-9a-f]{32})$/.exec(hash);
    if (job) return {...routes.find(route => route.id === 'activity'), jobId:job[1], hash};
+    // `#/system` is the Overview section under the sidebar's own hash; an unknown child is Overview, its hash replaced.
+    const system = /^#\/system(?:\/(.*))?$/.exec(hash);
+    if (system) {
+        const route = routes.find(item => item.id === 'system');
+        if (system[1] === undefined) return {...route, section:'overview', hash};
+        const section = isSystemSection(system[1]) ? system[1] : 'overview';
+        return {...route, section, hash:`#/system/${section}`};
+    }
    const match = /^#\/library\/([1-9]\d*)$/.exec(hash);
    if (match && Number.isSafeInteger(Number(match[1]))) {
        return {...routes.find(route => route.id === 'library'), positiveId:Number(match[1]), hash};
@@ -117,7 +143,7 @@ export function mountRouter(win, onRoute) {
        const hash = route.hash || `#/${route.id}`;
        if (win.location.hash !== hash) win.history.replaceState(win.history.state, '', hash);
        if (current?.id === route.id && current?.positiveId === route.positiveId && current?.savedId === route.savedId &&
-            current?.jobId === route.jobId) return;
+            current?.jobId === route.jobId && current?.section === route.section) return;
        current = route;
        onRoute(route);
    };
@@ -0,0 +1,132 @@
+/**
+ * System's row builders on the concept's markup (#249 System S2 Task 5), built with the DOM, never HTML strings:
+ * - `settingRow` is the concept's `setting(id, label, description, type, options)` (app.js 624–634): `.setting-row` >
+ *   `div` > `label[for]` + `p`, then the control. A toggle is the Toolkit switch, as the concept's `hydrateSwitches`
+ *   (708–717) makes it; a range is the concept's `min=1 max=16` unless the row gives its own bounds.
+ * - `operationRow` is `operation(title, desc, action, label, extra, danger)` (645–654): `.operation` > `div` > `h3` + `p`,
+ *   then `.row-actions` with one button, `danger` when flagged.
+ * - `sectionNav` is `sectionNav(items, active, action)` (306–308): `.section-nav[role=group]` buttons with `aria-pressed`.
+ * Every listener is registered on the caller's `scope`, so disposing it leaves none behind.
+ */
+import { createButton, createSwitch } from '../shared/toolkit/core.js';
+
+const INPUT_TYPES = new Set(['number', 'password', 'text', 'range']);
+const RANGE_DEFAULTS = Object.freeze({ min: 1, max: 16 });
+
+function el(tag, text, className) {
+    const node = document.createElement(tag);
+    if (text !== undefined) node.textContent = text;
+    if (className) node.className = className;
+    return node;
+}
+
+function requireText(values) {
+    for (const [name, value] of Object.entries(values)) {
+        if (typeof value !== 'string' || !value) throw new TypeError(`The row needs a ${name}`);
+    }
+}
+
+function requireScope(scope, callback, name) {
+    if (callback === undefined) return;
+    if (typeof callback !== 'function') throw new TypeError(`The row ${name} must be a function`);
+    if (typeof scope?.listen !== 'function') throw new TypeError('The row needs the section scope for its listener');
+}
+
+/** `[value, label]` pairs from strings or pairs. */
+function optionPairs(options) {
+    if (!Array.isArray(options) || options.length === 0) throw new TypeError('A select row needs its options');
+    return options.map(option => (Array.isArray(option) ? option.map(String) : [String(option), String(option)]));
+}
+
+/** The control a spec describes, and how to read its value. */
+function buildControl(id, spec) {
+    if (spec?.type === 'toggle') {
+        const field = createSwitch('', '', id);
+        const input = field.children[0];
+        // The concept's toggles are on unless configured off (`val !== false`).
+        input.checked = spec.checked !== false;
+        return { node: field, input, read: () => input.checked };
+    }
+    if (spec?.type === 'select') {
+        const select = el('select');
+        for (const [value, label] of optionPairs(spec.options)) {
+            const option = el('option', label);
+            option.value = value;
+            select.append(option);
+        }
+        if (spec.value !== undefined) select.value = String(spec.value);
+        return { node: select, input: select, read: () => select.value };
+    }
+    if (INPUT_TYPES.has(spec?.type)) {
+        const input = el('input');
+        input.type = spec.type;
+        const bounds = spec.type === 'range' ? { ...RANGE_DEFAULTS, ...spec } : spec;
+        for (const key of ['min', 'max', 'step']) if (bounds[key] !== undefined) input[key] = String(bounds[key]);
+        input.value = spec.value === undefined || spec.value === null ? '' : String(spec.value);
+        const numeric = spec.type === 'number' || spec.type === 'range';
+        return { node: input, input, read: () => (numeric ? Number(input.value) : input.value) };
+    }
+    throw new TypeError(`Unknown setting control: ${spec?.type}`);
+}
+
+/**
+ * One `.setting-row`. `control` is a spec (`{type:'toggle', checked}`, `{type:'select', options, value}` with string or
+ * `[value, label]` options, `{type:'number'|'password'|'text'|'range', value, min, max, step}`) or a ready-made node,
+ * which takes `id`. `onChange(value)` (on `scope`) reports the checked state, a number for number and range, else the
+ * text.
+ */
+export function settingRow({ id, label, description, control, scope, onChange }) {
+    requireText({ id, label, description });
+    requireScope(scope, onChange, 'onChange');
+    let built;
+    if (control && typeof control === 'object' && typeof control.type !== 'string' && 'tagName' in control) {
+        control.id = id;
+        built = { node: control, input: control, read: () => control.value };
+    } else {
+        built = buildControl(id, control);
+        built.input.id = id;
+    }
+    built.input.dataset.setting = id;
+    const row = el('div', undefined, 'setting-row');
+    const text = el('div');
+    const caption = el('label', label);
+    caption.htmlFor = id;
+    text.append(caption, el('p', description));
+    row.append(text, built.node);
+    if (onChange) scope.listen(built.input, 'change', () => onChange(built.read()));
+    return row;
+}
+
+/** One `.operation` row; `onClick(button)` runs on `scope`. */
+export function operationRow({ title, description, label, danger = false, onClick, scope }) {
+    requireText({ title, description, label });
+    if (typeof onClick !== 'function') throw new TypeError('The operation needs onClick');
+    requireScope(scope, onClick, 'onClick');
+    const row = el('div', undefined, 'operation');
+    const text = el('div');
+    text.append(el('h3', title), el('p', description));
+    const actions = el('div', undefined, 'row-actions');
+    const action = createButton(label, danger ? 'danger' : '');
+    scope.listen(action, 'click', () => onClick(action));
+    actions.append(action);
+    row.append(text, actions);
+    return row;
+}
+
+/** The `.section-nav` group: one button per `[id, title]`, the `active` one pressed; `onSelect(id)` runs on `scope`. */
+export function sectionNav({ label, sections, active, onSelect, scope }) {
+    requireText({ label });
+    if (typeof onSelect !== 'function') throw new TypeError('The section nav needs onSelect');
+    requireScope(scope, onSelect, 'onSelect');
+    const nav = el('div', undefined, 'section-nav');
+    nav.setAttribute('role', 'group');
+    nav.setAttribute('aria-label', label);
+    for (const [id, title] of sections) {
+        const item = createButton(title);
+        item.dataset.value = id;
+        item.setAttribute('aria-pressed', String(id === active));
+        scope.listen(item, 'click', () => onSelect(id));
+        nav.append(item);
+    }
+    return nav;
+}
@@ -0,0 +1,432 @@
+/**
+ * System › Overview (#249 System S2 Task 6): the concept's `renderSystem` "general" body (app.js 658–675) on real
+ * values, its Statistics dialog ("Usage statistics", a1600–1604) and its health report (`health-check`, a1439–1456).
+ *
+ * - The four `.summary-metrics` and the two `.two-col` surfaces ("Library health", "Workspace preferences") come from
+ *   one `GET /prompt_manager/system/overview`. D93: metric 4 is the last health result (Not checked / Passed /
+ *   N issues / Incomplete); the review, backup, thumbnail and sources rows say what the server reports, and nothing
+ *   reads 0 before the read answers: a load shows a status line, a failure an alert and Retry. The thumbnail row is
+ *   its own read of `/images/thumbnails/status` (a walk of every source): "Checking thumbnails…" until it answers.
+ * - D96: the Statistics dialog lists the real runs and average rating per category, then "Library totals".
+ * - D95: the "Health report" lists every check the server ran, Missing files per image source, with a chip per real
+ *   result and when it was checked. The check runs from Maintenance's notice ("Run health checks", D123) as a
+ *   read job of the registry, tracked in the Activity store (its event stream); the report opens when it ends.
+ *
+ * Reads run through `latestOnly()` on the section's scope, so a late answer never repaints a newer section.
+ */
+import { createButton } from '../shared/toolkit/core.js';
+import { navigateTo } from './state.mjs';
+import { closeWorkspaceDialog, openContentDialog } from './workspace-dialogs.mjs';
+import { showWorkspaceToast } from './toast.mjs';
+import { noun } from './plural.mjs';
+import { operationRow } from './system-controls.mjs';
+
+export const OVERVIEW_URL = '/prompt_manager/system/overview';
+export const STATISTICS_URL = '/prompt_manager/system/statistics';
+export const HEALTH_URL = '/prompt_manager/system/health';
+export const THUMBNAILS_URL = '/prompt_manager/images/thumbnails/status';
+export const HEALTH_KIND = 'health';
+
+export const LOADING_TEXT = 'Loading the overview…';
+export const THUMBNAILS_LOADING = 'Checking thumbnails…';
+export const LOAD_FAILED_TEXT = 'The overview could not be loaded. Your saved data has not changed.';
+export const STATISTICS_FAILED_TEXT = 'Statistics could not be loaded. Your saved data has not changed.';
+export const HEALTH_FAILED_TEXT = 'The health check could not finish. Nothing was changed.';
+export const NOT_AVAILABLE = 'Not available yet.';
+
+const number = value => Number(value).toLocaleString();
+
+function el(tag, text, className) {
+    const node = document.createElement(tag);
+    if (text !== undefined) node.textContent = text;
+    if (className) node.className = className;
+    return node;
+}
+
+/**
+ * D93: metric 4, the last health result of this server session: the checks that found issues, even when another
+ * check could not run; otherwise Passed, or Incomplete while a check was unavailable or failed.
+ */
+export function integrityText(health) {
+    if (!health) return 'Not checked';
+    if (health.issues > 0) return `${number(health.issues)} ${noun(health.issues, 'issue')}`;
+    return health.status === 'passed' ? 'Passed' : 'Incomplete';
+}
+
+/** The concept's four metrics `[value, label]`, in its order. */
+export function metricValues(overview) {
+    return [
+        [number(overview.library.positive_prompts), 'Positive prompts'],
+        [number(overview.library.negative_variants), 'Negative variants'],
+        [number(overview.images.indexed), 'Images'],
+        [integrityText(overview.health), 'Database integrity'],
+    ];
+}
+
+/** D93 (Q6): the review row's title; a count only once the Needs review queue reports one. */
+export function ambiguousTitle(needsReview) {
+    const pending = needsReview?.pending;
+    if (!Number.isSafeInteger(pending)) return 'Ambiguous image links';
+    return `${number(pending)} ambiguous image ${noun(pending, 'link')}`;
+}
+
+/** D93: the backup row; only a recorded, verified backup is ever named. */
+export function backupText(backup) {
+    if (!backup) return 'No retained backup record.';
+    const when = new Date(backup.verified_at ?? backup.created_at);
+    return Number.isNaN(when.getTime()) ? 'No retained backup record.' : `Last verified backup ${when.toLocaleString()}.`;
+}
+
+/**
+ * D93: the thumbnail row's title from the `/images/thumbnails/status` answer: undefined while it is read, null when
+ * the read failed; with no image source (`sources.effective` 0) there is nothing to count.
+ */
+export function thumbnailTitle(status, sources) {
+    if (status === undefined) return THUMBNAILS_LOADING;
+    const missing = status?.pending;
+    if (!Number.isSafeInteger(missing) || sources?.effective === 0) return 'Thumbnail status unavailable';
+    if (missing === 0) return 'No missing thumbnails';
+    return `${number(missing)} missing ${noun(missing, 'thumbnail')}`;
+}
+
+const SOURCES_SHARED = 'Monitoring and enrichment share one source list.';
+
+/** D93: the sources row, `[title, description]`: the sources in use and how they were chosen. */
+export function sourcesCopy(sources) {
+    const { configured, effective, auto_detected: auto } = sources;
+    const title = `${number(effective)} output ${noun(effective, 'source')}`;
+    if (auto) return [title, `None configured is available; ComfyUI's output folder is used. ${SOURCES_SHARED}`];
+    if (configured !== effective) return [title, `${number(effective)} of ${number(configured)} configured ${noun(configured, 'source')} available. ${SOURCES_SHARED}`];
+    return [title, SOURCES_SHARED];
+}
+
+// D95: an issue chip names what was found; the concept's own wording for missing files and ambiguous metadata.
+const ISSUE_NOUNS = Object.freeze({
+    integrity: ['problem found', 'problems found'],
+    foreign_keys: ['broken reference', 'broken references'],
+    canonical_hashes: ['hash does not match its text', 'hashes do not match their text'],
+    pair_uniqueness: ['duplicate pair row', 'duplicate pair rows'],
+    missing_files: ['link needs review', 'links need review'],
+    ambiguous_metadata: ['image needs review', 'images need review'],
+    consistency: ['inconsistency', 'inconsistencies'],
+});
+
+/** D95: a check's chip from its real status. */
+export function checkChip(check) {
+    if (check.status === 'passed') return 'Passed';
+    if (check.status === 'failed') return 'Could not check';
+    if (check.status === 'unavailable') return check.id === 'ambiguous_metadata' ? NOT_AVAILABLE.slice(0, -1) : 'Not available';
+    const [one, many] = ISSUE_NOUNS[check.id] ?? ['issue', 'issues'];
+    if (!Number.isSafeInteger(check.count)) return 'Issues found';
+    // SQLite stops listing integrity problems at its limit, so a capped count is a lower bound ("100+").
+    if (check.capped === true) return `${number(check.count)}+ ${many}`;
+    return `${number(check.count)} ${check.count === 1 ? one : many}`;
+}
+
+function sourceChip(source) {
+    if (source.status !== 'checked') return 'Not available';
+    return source.count === 0 ? 'Passed' : checkChip({ id: 'missing_files', status: 'issues', count: source.count });
+}
+
+/** D95: the report's rows `[label, chip]` in the server's order; Missing files once per image source when several. */
+export function healthRows(report) {
+    return report.checks.flatMap(check => {
+        const sources = check.id === 'missing_files' && Array.isArray(check.sources) ? check.sources : [];
+        if (sources.length < 2) return [[check.label, checkChip(check)]];
+        return sources.map(source => [`${check.label} · ${source.name}`, sourceChip(source)]);
+    });
+}
+
+/** D95: when the report was taken, and whether it is complete. */
+export function healthSummary(report) {
+    const when = new Date(report.checked_at);
+    const time = Number.isNaN(when.getTime()) ? '' : `Checked ${when.toLocaleString()}. `;
+    if (report.status === 'passed') return `${time}Every check passed.`;
+    if (report.status === 'incomplete') return `${time}Some checks could not run, so this report is incomplete.`;
+    return `${time}Nothing was changed; review the checks with issues.`;
+}
+
+/** D96: the concept's "Runs by category" rows `[category, runs, average rating]`. */
+export function categoryRows(statistics) {
+    return statistics.by_category.map(row => [
+        row.category ?? 'Uncategorized',
+        number(row.runs),
+        row.average_rating === null || row.average_rating === undefined ? 'Not rated'
+            : `${Number(row.average_rating).toLocaleString(undefined, { maximumFractionDigits: 2 })} / 5`,
+    ]);
+}
+
+/** D96: the added "Library totals" rows `[label, count]` (the legacy statistics and the rated images). */
+export function totalsRows(statistics) {
+    const { totals } = statistics;
+    return [['Prompts', totals.total_prompts], ['Tags', totals.total_tags], ['Images', totals.total_images],
+        ['Rated images', statistics.rated_images]].map(([label, value]) => [label, number(value)]);
+}
+
+function table(caption, head, rows, empty) {
+    const node = el('table');
+    const header = el('tr');
+    for (const text of head) {
+        const cell = el('th', text);
+        cell.scope = 'col';
+        header.append(cell);
+    }
+    const thead = el('thead');
+    thead.append(header);
+    const tbody = el('tbody');
+    for (const values of rows) {
+        const row = el('tr');
+        row.append(...values.map(text => el('td', text)));
+        tbody.append(row);
+    }
+    if (rows.length === 0) {
+        const row = el('tr');
+        const cell = el('td', empty);
+        cell.colSpan = head.length;
+        row.append(cell);
+        tbody.append(row);
+    }
+    node.append(el('caption', caption), thead, tbody);
+    return node;
+}
+
+/** The Statistics dialog: "Runs by category" (the concept's table), then "Library totals" (D96). */
+export function statisticsNodes(statistics) {
+    return [
+        table('Runs by category', ['Category', 'Runs', 'Avg. rating'], categoryRows(statistics), 'No prompts in the library yet.'),
+        table('Library totals', ['Total', 'Count'], totalsRows(statistics), ''),
+    ];
+}
+
+/** The concept's health report body: `.operation-list` of `h3` + chip, the D95 summary, then Close / Review missing links. */
+export function healthNodes(report, { scope, onReviewMissing }) {
+    const list = el('div', undefined, 'operation-list');
+    for (const [label, chip] of healthRows(report)) {
+        const row = el('div', undefined, 'operation');
+        row.append(el('h3', label), el('span', chip, 'chip'));
+        list.append(row);
+    }
+    const close = createButton('Close');
+    const review = createButton('Review missing links', 'ca-primary');
+    scope.listen(close, 'click', () => closeWorkspaceDialog());
+    scope.listen(review, 'click', () => onReviewMissing());
+    const actions = el('div', undefined, 'dialog-actions');
+    actions.append(close, review);
+    return [list, el('p', healthSummary(report), 'small'), actions];
+}
+
+/**
+ * Wait until the job `id` has ended, following it in the Activity store (`activity`), which streams the job's events
+ * and marks it lost when the server no longer lists it; nothing here polls. Resolves its final state ('finished',
+ * 'failed', 'cancelled' or 'lost').
+ */
+export function waitForJob(activity, id, { signal } = {}) {
+    if (signal?.aborted) return Promise.reject(signal.reason);
+    return new Promise((resolve, reject) => {
+        const check = () => {
+            const state = activity.find(id)?.state;
+            if (state && state !== 'running') finish(resolve, state);
+        };
+        const onAbort = () => finish(reject, signal.reason);
+        const unsubscribe = activity.subscribe(check);
+        function finish(settle, value) {
+            unsubscribe();
+            signal?.removeEventListener('abort', onAbort);
+            settle(value);
+        }
+        signal?.addEventListener('abort', onAbort, { once: true });
+        check();
+    });
+}
+
+/**
+ * Run the health check and resolve its report. The started job is tracked in the Activity store; a check already
+ * running (409 busy, another tab) is found in the store's job list and waited for instead of refused. Rejects when the
+ * check fails or ends without a report.
+ */
+export async function runHealthCheck(api, { activity, signal } = {}) {
+    let id;
+    try {
+        const { job } = await api.post(HEALTH_URL, {}, { signal });
+        id = activity.track(job).id;
+    } catch (error) {
+        if (error?.status !== 409 || error?.code !== 'busy') throw error;
+        await activity.load();
+        id = activity.running().find(job => job.kind === HEALTH_KIND)?.id;
+        // The other check ended between the refusal and this read: its report is the latest.
+    }
+    const state = id ? await waitForJob(activity, id, { signal }) : 'finished';
+    if (state !== 'finished') throw new Error(HEALTH_FAILED_TEXT);
+    const { report } = await api.get(HEALTH_URL, { signal, cache: 'no-store' });
+    if (!report) throw new Error(HEALTH_FAILED_TEXT);
+    return report;
+}
+
+/** Open the Health report for `report` (the Maintenance notice's and, from S7, its Check action's dialog). */
+export function openHealthReport(report, { scope, trigger = null, navigate = navigateTo }) {
+    openContentDialog({ scope, title: 'Health report', trigger, nodes: healthNodes(report, { scope,
+        // Missing-link cleanup lives in Maintenance (its D94 hand-off until S7).
+        onReviewMissing: () => { closeWorkspaceDialog(); navigate('#/system/maintenance'); } }) });
+}
+
+/**
+ * The concept's Maintenance notice ("Check first. Review changes. Then apply." + "Run health checks", a689), which
+ * S2 delivers ahead of the rest of Maintenance (D123): the press runs the read-only check, then opens the report.
+ */
+export function healthNotice({ api, activity, scope, navigate = navigateTo, notify = showWorkspaceToast }) {
+    const notice = el('div', undefined, 'notice');
+    const text = el('div');
+    text.append(el('h2', 'Check first. Review changes. Then apply.'),
+        el('p', 'One home for database and media maintenance. Scanning is separate from changing or removing records.'));
+    const run = createButton('Run health checks', 'ca-primary');
+    notice.append(text, run);
+    scope.listen(run, 'click', async () => {
+        if (run.getAttribute('aria-disabled') === 'true') return;
+        run.setAttribute('aria-disabled', 'true');
+        run.textContent = 'Checking…';
+        try {
+            const report = await runHealthCheck(api, { activity, signal: scope.signal });
+            if (scope.signal.aborted) return;
+            openHealthReport(report, { scope, trigger: run, navigate });
+        } catch (error) {
+            if (!scope.signal.aborted) notify(HEALTH_FAILED_TEXT);
+        } finally {
+            if (!scope.signal.aborted) {
+                run.removeAttribute('aria-disabled');
+                run.textContent = 'Run health checks';
+            }
+        }
+    });
+    return notice;
+}
+
+function metricsNode(overview) {
+    const metrics = el('div', undefined, 'summary-metrics');
+    for (const [value, label] of metricValues(overview)) {
+        const metric = el('div', undefined, 'metric');
+        metric.append(el('strong', value), el('span', label));
+        metrics.append(metric);
+    }
+    return metrics;
+}
+
+function surface(heading, rows) {
+    const section = el('section', undefined, 'surface');
+    section.append(el('h2', heading), ...rows);
+    return section;
+}
+
+/** The Overview's nodes, and its thumbnail row (painted by its own read). */
+function overviewNodes(overview, { scope, navigate, openStatistics }) {
+    const go = section => () => navigate(`#/system/${section}`);
+    const review = operationRow({ scope, title: ambiguousTitle(overview.needs_review),
+        description: Number.isSafeInteger(overview.needs_review?.pending)
+            ? 'Review metadata before assigning a positive / negative pair.' : NOT_AVAILABLE,
+        label: 'Review metadata', onClick: () => {} });
+    // D93 (Q6): the review queue (Needs review) is not part of the workspace yet.
+    review.querySelector('button').setAttribute('aria-disabled', 'true');
+    const [sourcesTitle, sourcesDescription] = sourcesCopy(overview.sources);
+    const thumbnails = operationRow({ scope, title: THUMBNAILS_LOADING, description: 'Generate only missing previews when necessary.',
+        label: 'Review thumbnails', onClick: go('sources') });
+    const health = surface('Library health', [
+        review,
+        operationRow({ scope, title: 'Backup status', description: backupText(overview.backup), label: 'View backups',
+            onClick: go('backups') }),
+        // Until the thumbnail review dialog (S5), Review thumbnails opens Sources, where thumbnail generation lives.
+        thumbnails,
+    ]);
+    const preferences = surface('Workspace preferences', [
+        operationRow({ scope, title: 'One display configuration', description: 'Grid and density settings are shared across views.',
+            label: 'Appearance', onClick: go('appearance') }),
+        operationRow({ scope, title: sourcesTitle, description: sourcesDescription, label: 'Manage sources', onClick: go('sources') }),
+        operationRow({ scope, title: 'Statistics', description: 'Runs and ratings by category, with library totals.', label: 'Explore',
+            onClick: openStatistics }),
+    ]);
+    const columns = el('div', undefined, 'two-col');
+    columns.append(health, preferences);
+    return { nodes: [metricsNode(overview), columns], thumbnails };
+}
+
+/**
+ * The Overview section's mount (`mountSystem`'s `sections.overview`): returns its loading line, which the server's
+ * answer replaces in place (the concept's metrics and columns sit directly in `.settings-layout`). A read that a newer
+ * one superseded, or one answering after the section left, paints nothing.
+ */
+export function mountOverview(container, { api, scope, navigate = navigateTo, notify = showWorkspaceToast,
+    latestOnly = window.ApiClient.latestOnly, STALE = window.ApiClient.STALE }) {
+    const overviewRead = latestOnly({ lifetime: scope.signal });
+    const statisticsRead = latestOnly({ lifetime: scope.signal });
+    const thumbnailsRead = latestOnly({ lifetime: scope.signal });
+    let shown = [];
+    // The thumbnail status (undefined while read, null when it failed), painted into the row whenever both are there.
+    let thumbnailStatus;
+    let thumbnailRow = null;
+    let sources = null;
+    const paintThumbnails = () => {
+        if (thumbnailRow) thumbnailRow.querySelector('h3').textContent = thumbnailTitle(thumbnailStatus, sources);
+    };
+
+    function swap(nodes) {
+        const anchor = shown.find(node => node.isConnected);
+        if (anchor) anchor.before(...nodes);
+        for (const node of shown) node.remove();
+        shown = nodes;
+        return nodes;
+    }
+
+    async function openStatistics(button) {
+        try {
+            const statistics = await statisticsRead(signal => api.get(STATISTICS_URL, { signal, cache: 'no-store' }));
+            if (statistics === STALE || scope.signal.aborted) return;
+            openContentDialog({ scope, title: 'Usage statistics', trigger: button, nodes: statisticsNodes(statistics) });
+        } catch (error) {
+            if (!scope.signal.aborted) notify(STATISTICS_FAILED_TEXT);
+        }
+    }
+
+    function loading() {
+        const status = el('p', LOADING_TEXT, 'small');
+        status.setAttribute('role', 'status');
+        return [status];
+    }
+
+    async function load() {
+        try {
+            const overview = await overviewRead(signal => api.get(OVERVIEW_URL, { signal, cache: 'no-store' }));
+            if (overview === STALE || scope.signal.aborted) return;
+            const { nodes, thumbnails } = overviewNodes(overview, { scope, navigate, openStatistics });
+            thumbnailRow = thumbnails;
+            sources = overview.sources;
+            swap(nodes);
+            paintThumbnails();
+        } catch (error) {
+            if (scope.signal.aborted) return;
+            const alert = el('p', LOAD_FAILED_TEXT);
+            alert.setAttribute('role', 'alert');
+            const retry = createButton('Retry');
+            scope.listen(retry, 'click', () => {
+                swap(loading());
+                load();
+                loadThumbnails();
+            });
+            const panel = el('section', undefined, 'surface');
+            panel.append(alert, retry);
+            swap([panel]);
+        }
+    }
+    async function loadThumbnails() {
+        let status;
+        try {
+            status = await thumbnailsRead(signal => api.get(THUMBNAILS_URL, { signal, cache: 'no-store' }));
+        } catch (error) {
+            status = null;
+        }
+        if (status === STALE || scope.signal.aborted) return;
+        thumbnailStatus = status ?? null;
+        paintThumbnails();
+    }
+    const first = swap(loading());
+    load();
+    loadThumbnails();
+    return first;
+}
@@ -0,0 +1,201 @@
+/**
+ * The System draft store (#249 System S2 Task 5): every System section edits drafts behind the one Save row (the
+ * concept's `.save-row`, app.js renderSystem 705), in three domains:
+ * - `browser`: preferences kept in this browser (Appearance);
+ * - `host`: the server configuration, saved with the `revision` its read returned (`expected_revision`, #220);
+ * - `runtime`: values applied to the running server only (the log level, Q10b).
+ *
+ * `save()` writes browser, then host, then runtime, and only the domains with changes. A domain that fails keeps its
+ * drafts dirty and its keys `failed()`, so the section highlights them; the others are saved. A host save refused
+ * because the configuration changed elsewhere (`settings-changed`) is a `conflict` and keeps the draft. A host save before
+ * `load('host')` returned a revision fails without a request: a blind write would merge over a configuration changed
+ * elsewhere (S1 reads a null `expected_revision` as "merge into what is on disk"). `reloadHost()` reads the host values
+ * again (System calls it on mount); a host conflict reloads them itself, so the next save carries the current revision.
+ * Drafts live for
+ * the page session (Q10a): a section left and opened again shows them, and a reload of its values keeps them.
+ *
+ * Adapters: `readBrowser()` and `readRuntime()` return the values; `readHost()` returns `{values, revision}`.
+ * `writeBrowser(changes)` returns `{persisted}` (false: kept for this tab only), `writeHost(changes,
+ * {expected_revision})` the settings response (`{success, persisted, revision}`), `writeRuntime(changes)` anything;
+ * a write that throws failed.
+ */
+export { SYSTEM_SECTIONS, isSystemSection } from './state.mjs';
+
+/** D92: the Save row's status copy; never the concept's prototype text. */
+export const SETTINGS_STATUS = Object.freeze({
+    clean: 'No unsaved changes.',
+    dirty: 'Unsaved changes.',
+    browser: 'Saved in this browser.',
+    host: 'Saved to the server configuration.',
+    runtime: 'Applied until the server restarts.',
+    partial: 'Some changes were not saved. Review the highlighted settings.',
+    tabOnly: 'Saved for this tab only; browser storage is unavailable.',
+    conflict: 'Settings changed elsewhere. Reload this section to see them.',
+});
+
+export const DRAFT_DOMAINS = Object.freeze(['browser', 'host', 'runtime']);
+const CONFLICT_CODE = 'settings-changed';
+const ADAPTERS = ['readBrowser', 'readHost', 'readRuntime', 'writeBrowser', 'writeHost', 'writeRuntime'];
+
+/** The status copy of one `save()` outcome (`{browser, host, runtime}`, each clean/saved/tab-only/applied/failed/conflict). */
+export function statusText(outcome) {
+    const results = DRAFT_DOMAINS.map(domain => outcome?.[domain]);
+    if (results.includes('conflict')) return SETTINGS_STATUS.conflict;
+    if (results.includes('failed')) return SETTINGS_STATUS.partial;
+    const saved = [];
+    if (outcome?.browser === 'saved') saved.push(SETTINGS_STATUS.browser);
+    if (outcome?.browser === 'tab-only') saved.push(SETTINGS_STATUS.tabOnly);
+    if (outcome?.host === 'saved') saved.push(SETTINGS_STATUS.host);
+    if (outcome?.runtime === 'applied') saved.push(SETTINGS_STATUS.runtime);
+    return saved.join(' ') || SETTINGS_STATUS.clean;
+}
+
+function requireDomain(domain) {
+    if (!DRAFT_DOMAINS.includes(domain)) throw new TypeError(`Unknown settings domain: ${domain}`);
+}
+
+/** Create the store; see the module comment for the adapters. */
+export function createSystemDrafts(adapters) {
+    for (const name of ADAPTERS) {
+        if (typeof adapters?.[name] !== 'function') throw new TypeError(`System drafts need ${name}`);
+    }
+    const baseline = { browser: {}, host: {}, runtime: {} };
+    const drafts = { browser: new Map(), host: new Map(), runtime: new Map() };
+    const failedKeys = { browser: new Set(), host: new Set(), runtime: new Set() };
+    const listeners = new Set();
+    let revision = null;
+    let outcome = null;
+    let saving = null;
+
+    const notify = () => { for (const listener of [...listeners]) listener(); };
+    const changes = domain => Object.fromEntries(drafts[domain]);
+
+    /** Read a domain's saved values; drafts are kept, and a draft equal to the new value is clean. */
+    async function load(domain) {
+        requireDomain(domain);
+        let values;
+        if (domain === 'host') {
+            const read = await adapters.readHost();
+            values = read?.values ?? {};
+            revision = read?.revision ?? null;
+        } else {
+            values = await (domain === 'browser' ? adapters.readBrowser() : adapters.readRuntime());
+        }
+        baseline[domain] = { ...(values ?? {}) };
+        for (const [key, value] of drafts[domain]) if (Object.is(baseline[domain][key], value)) drafts[domain].delete(key);
+        notify();
+        return { ...baseline[domain] };
+    }
+
+    function get(domain, key) {
+        requireDomain(domain);
+        return drafts[domain].has(key) ? drafts[domain].get(key) : baseline[domain][key];
+    }
+
+    function set(domain, key, value) {
+        requireDomain(domain);
+        if (Object.is(baseline[domain][key], value)) drafts[domain].delete(key);
+        else drafts[domain].set(key, value);
+        failedKeys[domain].delete(key);
+        outcome = null;
+        notify();
+    }
+
+    function dirty(domain) {
+        if (domain !== undefined) {
+            requireDomain(domain);
+            return drafts[domain].size > 0;
+        }
+        return DRAFT_DOMAINS.some(name => drafts[name].size > 0);
+    }
+
+    function discard(domain) {
+        for (const name of domain === undefined ? DRAFT_DOMAINS : [domain]) {
+            requireDomain(name);
+            drafts[name].clear();
+            failedKeys[name].clear();
+        }
+        outcome = null;
+        notify();
+    }
+
+    /** The values of one domain as written: they become its saved values, and drafts still equal to them are clean. */
+    function commit(domain, written) {
+        for (const [key, value] of written) {
+            baseline[domain][key] = value;
+            if (drafts[domain].has(key) && Object.is(drafts[domain].get(key), value)) drafts[domain].delete(key);
+        }
+    }
+
+    function fail(domain, written) {
+        for (const [key] of written) failedKeys[domain].add(key);
+    }
+
+    async function saveDomain(domain) {
+        const written = new Map(drafts[domain]);
+        if (written.size === 0) return 'clean';
+        const values = Object.fromEntries(written);
+        try {
+            if (domain === 'browser') {
+                const result = await adapters.writeBrowser(values);
+                commit(domain, written);
+                return result?.persisted === false ? 'tab-only' : 'saved';
+            }
+            if (domain === 'host') {
+                if (typeof revision !== 'string') { fail(domain, written); return 'failed'; }
+                const result = await adapters.writeHost(values, { expected_revision: revision });
+                if (result?.code === CONFLICT_CODE) { fail(domain, written); return 'conflict'; }
+                if (!result?.success || result.persisted !== true) { fail(domain, written); return 'failed'; }
+                if (typeof result.revision === 'string') revision = result.revision;
+                commit(domain, written);
+                return 'saved';
+            }
+            await adapters.writeRuntime(values);
+            commit(domain, written);
+            return 'applied';
+        } catch (error) {
+            fail(domain, written);
+            return error?.code === CONFLICT_CODE ? 'conflict' : 'failed';
+        }
+    }
+
+    /** Read the host values again; a failed read leaves host saves refused until one succeeds. */
+    const reloadHost = () => load('host').then(() => true, () => false);
+
+    /** Save the dirty domains in order; a Save pressed while one runs joins it. */
+    function save() {
+        saving ??= (async () => {
+            for (const domain of DRAFT_DOMAINS) failedKeys[domain].clear();
+            const result = {};
+            for (const domain of DRAFT_DOMAINS) result[domain] = await saveDomain(domain);
+            // Settings changed elsewhere: read them (and their revision), keeping the drafts (Q10).
+            if (result.host === 'conflict') await reloadHost();
+            return result;
+        })().then(result => {
+            saving = null;
+            outcome = result;
+            notify();
+            return result;
+        });
+        return saving;
+    }
+
+    return {
+        load,
+        reloadHost,
+        get,
+        set,
+        dirty,
+        discard,
+        save,
+        changes,
+        saving: () => saving !== null,
+        failed: domain => { requireDomain(domain); return new Set(failedKeys[domain]); },
+        /** The Save row's text: the last save's outcome until the next edit, else unsaved or clean. */
+        statusText: () => (outcome ? statusText(outcome) : dirty() ? SETTINGS_STATUS.dirty : SETTINGS_STATUS.clean),
+        subscribe(listener) {
+            listeners.add(listener);
+            return () => listeners.delete(listener);
+        },
+    };
+}
@@ -0,0 +1,148 @@
+/**
+ * Native System (#249 System S2 Task 5): the concept's `renderSystem` shell (app.js 698–706) at `#/system/<section>`.
+ * Under the page heading it renders the section nav (`.section-nav`, one button per section, the shown one
+ * `aria-pressed`; a press navigates to its hash), then `.settings-layout` with the section's body and the Save row
+ * (`span.small#settings-status` + "Save preferences"). D92: no "Sample configuration" chip, the status copy is
+ * truthful and "Save preferences" is aria-disabled while nothing is unsaved. A section not delivered yet shows the
+ * per-section hand-off to its legacy tool (D94), never mock placeholders. Overview is native (system-overview.mjs).
+ *
+ * Switching sections keeps the shell (and focus on the pressed button) and disposes the old section's scope, so its
+ * listeners and timers never outlive it. The drafts are module-level (Q10): they live for the page session.
+ */
+import { createButton, createScope } from '../shared/toolkit/core.js';
+import { SYSTEM_SECTIONS, navigateTo } from './state.mjs';
+import { createSystemDrafts, DRAFT_DOMAINS } from './system-state.mjs';
+import { sectionNav } from './system-controls.mjs';
+import { healthNotice, mountOverview } from './system-overview.mjs';
+
+const SETTINGS_URL = '/prompt_manager/settings';
+const ADMIN = Object.freeze({ href: '/prompt_manager/admin', label: 'Open existing administration' });
+const GALLERY = Object.freeze({ href: '/prompt_manager/gallery', label: 'Open existing image gallery' });
+/**
+ * D94: where each section's capabilities live until its PR (the plan's legacy capability coverage): the admin page's
+ * dashboard, Settings, Maintenance, Backup, Restore, Scan, Logs, Diagnostics and Auto-tag tools, and the gallery's
+ * settings, thumbnails, duplicates and cache tools.
+ */
+export const SECTION_HANDOFFS = Object.freeze({
+    appearance: [GALLERY, ADMIN],
+    sources: [ADMIN, GALLERY],
+    integrations: [ADMIN],
+    tagging: [ADMIN],
+    maintenance: [ADMIN, GALLERY],
+    backups: [ADMIN],
+    diagnostics: [ADMIN],
+});
+export const NOT_DELIVERED = 'This setting is not available here yet.';
+
+let drafts = null;
+
+function el(tag, text, className) {
+    const node = document.createElement(tag);
+    if (text !== undefined) node.textContent = text;
+    if (className) node.className = className;
+    return node;
+}
+
+/** A domain whose settings no delivered section edits yet: nothing can be drafted, and a write would say it failed. */
+const undelivered = async () => { throw new Error(NOT_DELIVERED); };
+
+/** The page session's drafts (Q10); the host domain reads and saves the server settings with their revision (#220). */
+export function systemDrafts(api) {
+    drafts ??= createSystemDrafts({
+        readBrowser: () => ({}),
+        readRuntime: () => ({}),
+        writeBrowser: undelivered,
+        writeRuntime: undelivered,
+        async readHost() {
+            const result = await api.get(SETTINGS_URL, { cache: 'no-store' });
+            // The store reads a missing value as none and a missing revision as unreadable (no host save).
+            return { values: result.settings, revision: result.revision };
+        },
+        writeHost: (changes, { expected_revision }) => api.post(SETTINGS_URL, { ...changes, expected_revision }),
+    });
+    return drafts;
+}
+
+/** D94: the shared hand-off panel, linking each legacy tool that still owns this section. */
+function handoff(section) {
+    const panel = el('section', undefined, 'surface handoff');
+    panel.append(el('h2', 'Your current tools are ready'),
+        el('p', 'This workspace is being introduced in stages. Continue in the existing tool with your saved data.'));
+    for (const tool of SECTION_HANDOFFS[section]) {
+        const link = el('a', tool.label, 'workspace-link');
+        link.href = window.ApiClient.resolveUrl(tool.href);
+        panel.append(link);
+    }
+    return [panel];
+}
+
+/** D92: highlight the controls of the settings the last save could not save. */
+function markFailed(layout, store) {
+    const failed = new Set(DRAFT_DOMAINS.flatMap(domain => [...store.failed(domain)]));
+    for (const control of layout.querySelectorAll('[data-setting]')) {
+        if (failed.has(control.dataset.setting)) control.setAttribute('aria-invalid', 'true');
+        else control.removeAttribute('aria-invalid');
+    }
+}
+
+/**
+ * The sections delivered so far: Overview (S2 Task 6), and Maintenance's notice with "Run health checks" above the
+ * hand-off to the maintenance tools that are not native yet (D123).
+ */
+export const DELIVERED_SECTIONS = Object.freeze({
+    overview: mountOverview,
+    maintenance: (container, { api, activity, scope }) => [healthNotice({ api, activity, scope }), ...handoff('maintenance')],
+});
+
+/**
+ * Mount System under the heading `renderHeading` wrote in `main`. Returns `{show(section)}`, which shows another
+ * section in place. `scope` is the page's view scope; `sections` maps a section id to a delivered section's mount
+ * (`(container, {api, activity, scope, drafts}) => nodes`), and every other section hands off. `activity` is the page's
+ * Activity store, which follows the jobs a section starts.
+ *
+ * The host values are read on mount (and by the store again after a conflict), so a save carries the current revision;
+ * until a read returned one, a host save fails without a request (system-state.mjs).
+ */
+export function mountSystem(main, api, scope, { section, activity, sections = DELIVERED_SECTIONS, navigate = navigateTo }) {
+    const store = systemDrafts(api);
+    store.reloadHost();
+    const nav = sectionNav({ label: 'System sections', sections: SYSTEM_SECTIONS, active: section, scope,
+        onSelect: id => navigate(`#/system/${id}`) });
+    const layout = el('div', undefined, 'settings-layout');
+    const saveRow = el('div', undefined, 'save-row');
+    const status = el('span', undefined, 'small');
+    status.id = 'settings-status';
+    const save = createButton('Save preferences', 'ca-primary');
+    saveRow.append(status, save);
+    layout.append(saveRow);
+    main.append(nav, layout);
+
+    const paintStatus = () => {
+        status.textContent = store.statusText();
+        if (store.dirty() && !store.saving()) save.removeAttribute('aria-disabled');
+        else save.setAttribute('aria-disabled', 'true');
+        markFailed(layout, store);
+    };
+    scope.cleanup(store.subscribe(paintStatus));
+    scope.listen(save, 'click', () => {
+        if (save.getAttribute('aria-disabled') === 'true') return;
+        const saving = store.save();
+        paintStatus();
+        saving.then(() => { if (!scope.signal.aborted) paintStatus(); });
+    });
+
+    let sectionScope = null;
+    scope.cleanup(() => sectionScope?.dispose());
+    function show(next) {
+        sectionScope?.dispose();
+        sectionScope = createScope();
+        for (const button of nav.children) button.setAttribute('aria-pressed', String(button.dataset.value === next));
+        while (layout.firstChild !== saveRow) layout.firstChild.remove();
+        const mount = sections[next];
+        const nodes = mount ? mount(layout, { api, activity, scope: sectionScope, drafts: store }) : handoff(next);
+        layout.prepend(...nodes);
+        paintStatus();
+    }
+    show(section);
+    return { show };
+}
@@ -11,7 +11,8 @@
 *   Rescan; no "Import portable recipes" (D15). Rescan shows its running state (aria-disabled "Rescanning…"). D55: the
 *   concept's own "Scan an output folder → Review scan" row follows as "Scan for metadata".
 * - "Review metadata scan" (a1428–1432 `scan-review`, D55): Sources and Scope in a `dl.meta-grid`, the concept's
- *   sentence, a backup `.notice` ("Back up now") and Cancel / Start scan; no sample-plan note.
+ *   sentence, a backup `.notice` ("Back up now") and Cancel / Start scan; no sample-plan note. It is one caller of
+ *   `openReviewDialog`, the review every record-changing System operation shares, with its `backupNotice`.
 * - "Copy prompt" (a1223–1241): the select-to-copy fallback when the clipboard is unavailable (D22).
 * - One-value input (a1138 `simpleInput`): a "Category"-style field (`input#action-input`) and Cancel / a primary
 *   action; used by the Images selection bar's "Set category" (#249 D8) and the toolbar's Save view.
@@ -286,14 +287,17 @@ export function openImportDialog({ scope, onInspect, onRescan, onMetadataScan =
    return { setRescanBusy };
 }

-/** "Copy prompt": the text in a readonly, pre-selected textarea for a manual copy. */
-export function openCopyFallback(text, { scope, trigger = null } = {}) {
+/**
+ * "Copy prompt": the text in a readonly, pre-selected textarea for a manual copy. `title` names another copy's dialog
+ * (D117 "Copy settings summary").
+ */
+export function openCopyFallback(text, { scope, trigger = null, title = 'Copy prompt' } = {}) {
    requireScope(scope);
    if (typeof text !== 'string') throw new TypeError('Copy text must be a string');
    const area = el('textarea');
    area.readOnly = true;
    area.value = text;
-    show('Copy prompt', [
+    show(title, [
        field('Select and copy this text', area, 'copy-text'),
        el('p', 'Automatic clipboard access requires a secure browser context.', 'small'),
    ], { scope, trigger, focusTarget: area });
@@ -364,6 +368,98 @@ const BACKUP_BUSY_LABEL = 'Backing up…';

 export const SCAN_SCOPE_LABELS = { new: 'New and unresolved files', all: 'All files' };
 export const SCAN_ALL_FILES_HINT = 'Also read the files already linked to their prompt again.';
+/** The scan review's backup box copy (D55). */
+export const SCAN_BACKUP_COPY = Object.freeze({ heading: 'Back up the database first (recommended)',
+    text: 'Downloads a copy of the prompts database before the scan changes any records.' });
+
+/**
+ * The D55 backup box: the concept's System `.notice` (`div` > `h3` + `p`, then `.row-actions` with "Back up now").
+ * `onBackup` runs the backup and toasts its outcome; until it settles the button reads "Backing up…" and is
+ * aria-disabled, so a second press is ignored. It never closes the dialog it sits in.
+ */
+export function backupNotice({ copy, onBackup }) {
+    if (typeof copy?.heading !== 'string' || !copy.heading || typeof copy.text !== 'string' || !copy.text) {
+        throw new TypeError('The backup box needs its heading and text');
+    }
+    requireCallbacks({ onBackup });
+    const notice = el('div', undefined, 'notice');
+    const text = el('div');
+    text.append(el('h3', copy.heading), el('p', copy.text));
+    const actions = el('div', undefined, 'row-actions');
+    const backup = createButton(BACKUP_LABEL);
+    actions.append(backup);
+    notice.append(text, actions);
+    backup.addEventListener('click', async () => {
+        if (backup.getAttribute('aria-disabled') === 'true') return;
+        backup.setAttribute('aria-disabled', 'true');
+        backup.textContent = BACKUP_BUSY_LABEL;
+        try {
+            await onBackup();
+        } finally {
+            backup.removeAttribute('aria-disabled');
+            backup.textContent = BACKUP_LABEL;
+        }
+    });
+    return notice;
+}
+
+function requireGrid(grid) {
+    if (!Array.isArray(grid) || grid.length === 0 || grid.some(row => !Array.isArray(row) || row.length !== 2 ||
+        typeof row[0] !== 'string' || !row[0] || typeof row[1] !== 'string')) {
+        throw new TypeError('The review needs its [term, value] grid');
+    }
+}
+
+/**
+ * The shared record-changing review (the concept's `scan-review`, maintenance plan and restore preview): an optional
+ * `h3` heading, the `dl.meta-grid` of `[term, value]` rows, page-built `options` nodes, the optional `p.small`
+ * sentence, the D55 backup box when `backup` is `{copy, onBackup}`, then `.dialog-actions` with `cancelLabel` and the
+ * primary (`ca-primary`, or the concept's `danger` when `primary.danger`). The primary closes the dialog, then calls
+ * `onStart()`. Returns `{setValue(term, text)}` for a grid value that follows an option.
+ */
+export function openReviewDialog({ scope, title, heading = null, grid, options = [], sentence = null, backup = null,
+    cancelLabel, primary, onStart, trigger = null }) {
+    requireScope(scope);
+    requireCallbacks({ onStart });
+    for (const [name, text] of Object.entries({ title, cancelLabel, label: primary?.label })) {
+        if (typeof text !== 'string' || !text) throw new TypeError(`The review needs its ${name}`);
+    }
+    requireGrid(grid);
+    if (!Array.isArray(options) || options.some(node => !node || typeof node !== 'object')) {
+        throw new TypeError('The review options must be nodes');
+    }
+    const nodes = [];
+    if (heading) nodes.push(el('h3', heading));
+    const list = el('dl', undefined, 'meta-grid');
+    const values = new Map();
+    for (const [term, value] of grid) {
+        const entry = el('div');
+        const dd = el('dd', value);
+        values.set(term, dd);
+        entry.append(el('dt', term), dd);
+        list.append(entry);
+    }
+    nodes.push(list, ...options);
+    if (sentence) nodes.push(el('p', sentence, 'small'));
+    if (backup) nodes.push(backupNotice(backup));
+    const cancel = createButton(cancelLabel);
+    const start = createButton(primary.label, primary.danger ? 'danger' : 'ca-primary');
+    cancel.addEventListener('click', () => finish());
+    start.addEventListener('click', () => {
+        finish();
+        onStart();
+    });
+    const actions = el('div', undefined, 'dialog-actions');
+    actions.append(cancel, start);
+    nodes.push(actions);
+    show(title, nodes, { scope, trigger });
+    return {
+        setValue(term, text) {
+            const dd = values.get(term);
+            if (dd) dd.textContent = text;
+        },
+    };
+}

 /**
 * The concept's "Review metadata scan" (`scan-review`, D55). `sources` is the number of output folders the scan reads.
@@ -376,18 +472,9 @@ export function openScanReviewDialog({ scope, sources, onBackup, onStart, trigge
    requireScope(scope);
    requireCallbacks({ onBackup, onStart });
    if (!Number.isSafeInteger(sources) || sources < 0) throw new TypeError('The scan review needs its source count');
-    const grid = el('dl', undefined, 'meta-grid');
-    const values = {};
-    for (const [term, value] of [['Sources', `${sources.toLocaleString('en-US')} output ${sources === 1 ? 'folder' : 'folders'}`],
-        ['Scope', SCAN_SCOPE_LABELS.new]]) {
-        const entry = el('div');
-        values[term] = el('dd', value);
-        entry.append(el('dt', term), values[term]);
-        grid.append(entry);
-    }
    // The concept's System toggle: a `.setting-row` whose checkbox is the Toolkit switch (concept `hydrateSwitches`).
    const toggle = createSwitch('', '', 'scan-all-files');
-    const allFiles = toggle.querySelector('input');
+    const allFiles = toggle.children[0];
    allFiles.checked = false;
    const option = el('div', undefined, 'setting-row');
    const optionText = el('div');
@@ -399,35 +486,10 @@ export function openScanReviewDialog({ scope, sources, onBackup, onStart, trigge
    optionText.append(optionLabel, hint);
    option.append(optionText, toggle);
    const chosenScope = () => (allFiles.checked ? 'all' : 'new');
-    allFiles.addEventListener('change', () => { values.Scope.textContent = SCAN_SCOPE_LABELS[chosenScope()]; });
-    const notice = el('div', undefined, 'notice');
-    const copy = el('div');
-    copy.append(el('h3', 'Back up the database first (recommended)'),
-        el('p', 'Downloads a copy of the prompts database before the scan changes any records.'));
-    const backupActions = el('div', undefined, 'row-actions');
-    const backup = createButton(BACKUP_LABEL);
-    backupActions.append(backup);
-    notice.append(copy, backupActions);
-    backup.addEventListener('click', async () => {
-        if (backup.getAttribute('aria-disabled') === 'true') return;
-        backup.setAttribute('aria-disabled', 'true');
-        backup.textContent = BACKUP_BUSY_LABEL;
-        try {
-            await onBackup();
-        } finally {
-            backup.removeAttribute('aria-disabled');
-            backup.textContent = BACKUP_LABEL;
-        }
-    });
-    const cancel = createButton('Cancel');
-    const start = createButton('Start scan', 'ca-primary');
-    cancel.addEventListener('click', () => finish());
-    start.addEventListener('click', () => {
-        const files = chosenScope();
-        finish();
-        onStart({ scope: files });
-    });
-    const actions = el('div', undefined, 'dialog-actions');
-    actions.append(cancel, start);
-    show('Review metadata scan', [grid, option, el('p', SCAN_REVIEW_SENTENCE, 'small'), notice, actions], { scope, trigger });
+    const review = openReviewDialog({ scope, trigger, title: 'Review metadata scan',
+        grid: [['Sources', `${sources.toLocaleString('en-US')} output ${sources === 1 ? 'folder' : 'folders'}`],
+            ['Scope', SCAN_SCOPE_LABELS.new]],
+        options: [option], sentence: SCAN_REVIEW_SENTENCE, backup: { copy: SCAN_BACKUP_COPY, onBackup },
+        cancelLabel: 'Cancel', primary: { label: 'Start scan' }, onStart: () => onStart({ scope: chosenScope() }) });
+    allFiles.addEventListener('change', () => review.setValue('Scope', SCAN_SCOPE_LABELS[chosenScope()]));
 }
@@ -82,6 +82,15 @@ main:focus-visible { outline: 2px solid var(--ca-focus); outline-offset: 4px; }
 .tool-card p { flex: 1; margin: 0 0 12px; }
 .workspace-link { display: inline-flex; align-items: center; min-height: 44px; padding: 8px 0; font-size: 12px; overflow-wrap: anywhere; }
 .handoff .workspace-link { margin-top: 12px; }
+/* D94: a System section not delivered yet links every legacy tool that still owns it, side by side. */
+.handoff .workspace-link + .workspace-link { margin-inline-start: 18px; /* D94 */ }
+
+/* D92: System's Save row is aria-disabled while nothing is unsaved (or a save runs), and a setting the last save could
+   not save is highlighted, as its "Review the highlighted settings" status says. */
+.save-row button[aria-disabled="true"] { opacity: .55; cursor: not-allowed; /* D92 */ }
+.setting-row [aria-invalid="true"] { outline: 2px solid var(--red); outline-offset: 2px; /* D92 */ }
+/* D93: an Overview row whose action is not available yet (the review queue, Q6) keeps its button, disabled. */
+.operation .row-actions button[aria-disabled="true"] { opacity: .55; cursor: not-allowed; /* D93 */ }
@media (max-width: 700px) {
    .stat-grid { gap: 8px; }
    .stat { padding: 16px; }
@@ -212,6 +221,8 @@ main:focus-visible { outline: 2px solid var(--ca-focus); outline-offset: 4px; }
 /* #249 D20: the viewer details' pair send and history buttons wrap inside the narrow rail at 200% zoom with wider fonts,
   where the toolkit's `nowrap` would push them past its edge. */
 .ca-tools #viewer-details > button { white-space: normal; /* D20 */ }
+/* LI-4: "Copy settings summary" after the facts wraps the same way in the narrow rail. */
+.ca-tools #viewer-details .settings-summary { white-space: normal; /* D117 */ }
 /* The Images page narrows to one column inside a narrow container (the Library-embedded gallery). */
 .images-main { container: images-page / inline-size; }
@container images-page (inline-size < 600px) {