test(collections): change sources only after the page's selected-file read is answered

The details panel reads its selected file as soon as the page lists. When the
test's source change landed before that read was answered, the page found the
file again on its own (409 -> rescope -> relist), so the card under the old
numbering the test was about to click was gone. Every test in the spec now
waits for that read before changing sources.

Closes #484

.github/dependabot.yml

@@ -17,11 +17,6 @@ updates:
       prefix: "deps(pip)"
       include: "scope"
     rebase-strategy: "auto"
-    # These floors follow ComfyUI's requirements.txt, never the newest release.
-    ignore:
-      - dependency-name: "Pillow"
-      - dependency-name: "aiohttp"
-      - dependency-name: "numpy"
     # Optional: group non-breaking updates to reduce PR noise
     groups:
       python-minor-and-patch:

.github/workflows/portability.yml

@@ -1,9 +1,9 @@
-name: Windows
+name: Windows and macOS
 
 permissions:
   contents: read
 
-# Non-blocking Windows runs (#420; macOS dropped from CI in #571): never on pull requests or in the merge queue, and no context
+# Non-blocking portability runs (#420): never on pull requests or in the merge queue, and no context
 # here is a required check. A red run is fixed at its cause before the workspace cutover (#334).
 on:
   push:
@@ -21,23 +21,19 @@ env:
   PYTHONFAULTHANDLER: "1"
 
 # Time limit rule as in test.yml: ceil(1.5 x the slowest of three recent green runs on main) + 3
-# minutes, never under 5, timed as whole-job wall time. One matrix job, so the slowest leg of each
-# run counts (tests/vendor/ci-workflow.test.mjs recomputes it, #493).
-# Measured 2026-10-29 on main runs 40935337099 (dd247e3), 40938407252 (dd247e3), 40941240624 (dd247e3):
-#   slowest leg: 7m24s (py3.12 windows) / 7m31s (py3.13 windows) / 7m32s (py3.14 windows) -> 15 min
-#     (windows 4m56s-7m32s)
-#   native-trash-linux (#543) has no green main runs yet: it installs the dev requirements and runs
-#     one test module, about 1 minute by the same estimate, so ceil(1.5 x 2) + 3 gives it 6 minutes.
-#     Recalibrate after three green runs.
+# minutes, never under 5. Measured 2026-10-26 in test.yml on runs 40257217681 (3be0ada),
+# 40240706568 (fb9134f), 40228167328 (f9835aa), before these legs moved here in #420:
+#   slowest py3.10 on windows-latest: 12m43s / 15m54s / 14m53s -> 27 min
+#     (macos 6m14s-8m30s, windows 11m42s-15m54s)
 jobs:
   test:
     name: py${{ matrix.python-version }} on ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
-    timeout-minutes: 15
+    timeout-minutes: 27
     strategy:
       fail-fast: false
       matrix:
-        os: [windows-latest]
+        os: [windows-latest, macos-latest]
         python-version: ["3.12", "3.13", "3.14"]
 
     steps:
@@ -55,63 +51,5 @@ jobs:
           python -m pip install --upgrade pip
           pip install -r requirements-dev.txt
 
-      # The runner's TEMP is on C:, the OS disk, where a flush took about 6 ms
-      # and a test database's create-to-delete about 111 ms; on the D: work
-      # disk the same took 0.5 ms and 23 ms. Tests write their
-      # databases under TEMP, so it moves to a folder on D: (measured in #487,
-      # run 40915866444). The runner's TEMP was an 8.3 short name
-      # (C:\Users\RUNNER~1\...), so the new one is spelled by its short name too
-      # and paths still have to be resolved. D: makes no short names by default
-      # (run 40922502209), so they are switched on for it first.
-      - name: Keep test files on the work disk (Windows)
-        if: runner.os == 'Windows'
-        shell: pwsh
-        run: |
-          fsutil 8dot3name set D: 0
-          $folder = New-Item -ItemType Directory -Force -Path (Join-Path $env:RUNNER_TEMP "PromptManagerTests")
-          $short = (New-Object -ComObject Scripting.FileSystemObject).GetFolder($folder.FullName).ShortPath
-          Write-Output "test TEMP: $short (long name $($folder.FullName))"
-          if ($short -eq $folder.FullName) { Write-Output "::warning::D: gave the test TEMP no 8.3 short name" }
-          "TEMP=$short" >> $env:GITHUB_ENV
-          "TMP=$short" >> $env:GITHUB_ENV
-
       - name: Run tests
-        env:
-          PM_TEST_SLOWEST: "40"
         run: python -m tests.run_suite -v
-
-  # The same tests as the fake mount table, on a real ext4 mount used as the output root (#543). A
-  # runner can mount with sudo; the tests run as the normal user, so owner and mode checks are real.
-  native-trash-linux:
-    name: native trash on a real mount
-    runs-on: ubuntu-latest
-    timeout-minutes: 6
-
-    steps:
-      - uses: actions/checkout@v7
-
-      - name: Set up Python
-        uses: actions/setup-python@v7
-        with:
-          python-version: "3.12"
-          cache: pip
-          cache-dependency-path: requirements-dev.txt
-
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          pip install -r requirements-dev.txt
-
-      - name: Mount an ext4 image
-        run: |
-          truncate -s 64M "$RUNNER_TEMP/drive.img"
-          mkfs.ext4 -q "$RUNNER_TEMP/drive.img"
-          mkdir "$RUNNER_TEMP/drive"
-          sudo mount -o loop "$RUNNER_TEMP/drive.img" "$RUNNER_TEMP/drive"
-          sudo rmdir "$RUNNER_TEMP/drive/lost+found"
-          sudo chown "$(id -u):$(id -g)" "$RUNNER_TEMP/drive"
-          findmnt "$RUNNER_TEMP/drive"
-
-      - name: Native trash proof
-        timeout-minutes: 4
-        run: PM_TRASH_MOUNT="$RUNNER_TEMP/drive" python -m unittest tests.test_trash_mount_root -v

.github/workflows/test.yml

@@ -28,8 +28,8 @@ env:
 #   py matrix, slowest py3.10 on windows-latest: 12m43s / 15m54s / 14m53s -> 27 min
 #     (ubuntu 5m27s-6m27s, macos 6m14s-8m30s, windows 11m42s-15m54s)
 #     3.10 and 3.11 left the matrix and 3.14 joined it in #356; re-measure after three green main runs.
-#     Windows moved to portability.yml (#420; macOS left CI in #571), which has its own measured limit (#493);
-#     this Linux-only matrix keeps 27 minutes until it is re-measured.
+#     Windows and macOS moved to portability.yml (#420), which keeps this 27-minute limit; this
+#     Linux-only matrix keeps it too until it is re-measured.
 #   real ComfyUI compatibility: 13m32s / 8m55s / 11m46s -> 24 min
 #   coverage gate (85%): 7m26s / 7m22s / 7m54s -> 15 min
 #   perf budget 30s / 29s / 27s, black and flake8 39s / 37s / 39s,
@@ -39,7 +39,7 @@ env:
 # Pull requests run a fast subset (#420): Python 3.12 on ubuntu-latest, coverage, lint and frontend
 # modules. The merge queue (merge_group), pushes to main and manual runs add Python 3.13 and 3.14 on
 # Linux and the real ComfyUI job. "all tests" is the required gate that holds the queue to that set.
-# Windows runs in portability.yml (push to main, nightly, on demand) and never gate a merge.
+# Windows and macOS run in portability.yml (push to main, nightly, on demand) and never gate a merge.
 jobs:
   test:
     name: py${{ matrix.python-version }} on ${{ matrix.os }}
@@ -80,7 +80,7 @@ jobs:
     # pulled them from Ubuntu's apt mirror on every run, and three runs (#349, #378, #382) crawled at
     # ~26 kB/s for 11-12 minutes until the job hit its limit after every test had passed.
     container:
-      image: mcr.microsoft.com/playwright:v1.64.1-noble@sha256:47b510dd9230bf0b9bfc9b20102241e577ea7a99334ab4c3ca19f19770e9b8ea
+      image: mcr.microsoft.com/playwright:v1.64.1-noble
       options: --user 1001
     timeout-minutes: 24
     steps:

.github/workflows/viewerjs-check.yml

@@ -41,19 +41,15 @@ concurrency:
 # 7.3m-12.2m), because --shard splits by test count and the slow concept specs sort into shard 1. The page
 # workflows now run in three shards per browser with the limits unchanged; the per-shard times are
 # re-measured after three green main runs.
-# #563: coverage shards reached their 18-minute step limit three times on 2026-10-31 with no failing
-# test (PR #560 shard 2/3: 814 passed in 17.9m; queue run 41206495451 shard 1/3: 827 passed; PR #564
-# shard 2/3 twice), against recent green shards of 11m-17m. Coverage now runs in four shards with the
-# limits unchanged; the per-shard times are re-measured after three green main runs.
 jobs:
   frontend-coverage:
-    name: frontend coverage (shard ${{ matrix.shard }}/4)
+    name: frontend coverage (shard ${{ matrix.shard }}/3)
     runs-on: ubuntu-latest
     # Layout comparisons depend on the fonts each browser falls back to, so browser jobs run in the
     # same pinned Playwright image as local runs (tag = @playwright/test in tools/vendor/package-lock.json;
     # tests/vendor/browser-image.test.mjs checks it). Browsers and fonts come from the image.
     container:
-      image: mcr.microsoft.com/playwright:v1.64.1-noble@sha256:47b510dd9230bf0b9bfc9b20102241e577ea7a99334ab4c3ca19f19770e9b8ea
+      image: mcr.microsoft.com/playwright:v1.64.1-noble
       options: --user 1001
     timeout-minutes: 20
     # Public-repo ubuntu-latest runners have 4 vCPUs: three Playwright workers, each with its own test
@@ -63,7 +59,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        shard: [1, 2, 3, 4]
+        shard: [1, 2, 3]
     steps:
       - uses: actions/checkout@v7
       # The image's own Python 3.12 and Node 24: setup-python/setup-node install the runner's toolcache
@@ -92,13 +88,13 @@ jobs:
       - run: npm ci --prefix tools/vendor --ignore-scripts
       # Shard 1 also runs the node units and the viewer suite, so the vendor pins and the tooling tests
       # run on the lightest shard instead.
-      - if: matrix.shard == 4
+      - if: matrix.shard == 3
         run: npm run --prefix tools/vendor check
-      - if: matrix.shard == 4
+      - if: matrix.shard == 3
         run: npm run --prefix tools/vendor test
-      - name: Page workflows with coverage, shard ${{ matrix.shard }}/4
+      - name: Page workflows with coverage, shard ${{ matrix.shard }}/3
         timeout-minutes: 18
-        run: npm run --prefix tools/vendor test:coverage:shard -- ${{ matrix.shard }}/4
+        run: npm run --prefix tools/vendor test:coverage:shard -- ${{ matrix.shard }}/3
       - name: Upload raw coverage
         uses: actions/upload-artifact@v7
         with:
@@ -121,7 +117,7 @@ jobs:
     runs-on: ubuntu-latest
     # Same image as the shards: the raw files name sources by the container's workspace path.
     container:
-      image: mcr.microsoft.com/playwright:v1.64.1-noble@sha256:47b510dd9230bf0b9bfc9b20102241e577ea7a99334ab4c3ca19f19770e9b8ea
+      image: mcr.microsoft.com/playwright:v1.64.1-noble
       options: --user 1001
     timeout-minutes: 10
     steps:
@@ -140,13 +136,13 @@ jobs:
         with:
           pattern: coverage-raw-*
           path: ${{ runner.temp }}/coverage-raw
-      # coverage:merge only checks that raw files exist; merging three of four shards would report
+      # coverage:merge only checks that raw files exist; merging two of three shards would report
       # partial coverage, so a missing or empty shard artifact fails here.
       - name: Verify every shard's raw coverage arrived
         shell: bash
         env:
           STAGED_RAW: ${{ runner.temp }}/coverage-raw
-          EXPECTED_SHARDS: 4
+          EXPECTED_SHARDS: 3
         run: |
           found=0
           for shard in $(seq 1 "$EXPECTED_SHARDS"); do
@@ -192,7 +188,7 @@ jobs:
     # same pinned Playwright image as local runs (tag = @playwright/test in tools/vendor/package-lock.json;
     # tests/vendor/browser-image.test.mjs checks it). Browsers and fonts come from the image.
     container:
-      image: mcr.microsoft.com/playwright:v1.64.1-noble@sha256:47b510dd9230bf0b9bfc9b20102241e577ea7a99334ab4c3ca19f19770e9b8ea
+      image: mcr.microsoft.com/playwright:v1.64.1-noble
       options: --user 1001
     timeout-minutes: 20
     # Public-repo ubuntu-latest runners have 4 vCPUs: three Playwright workers, each with its own test

__init__.py

@@ -92,21 +92,10 @@ try:
     routes = config.routes
     api = PromptManagerAPI()
     api.add_routes(routes)
-
-    # The thumbnail location's startup check (#320), then the temp files of
-    # preview writes a crash interrupted (#317), off the import path: the
-    # walk may cover a large thumbnails folder.
-    # #320: the configured thumbnail location is in force before any request
-    # (no I/O); the thread below checks it.
-    api.use_preview_location()
-
-    def _preview_startup():
-        api.start_preview_location()
-        api.recover_thumbnail_move()  # an interrupted move, before the sweep
-        api.sweep_thumbnail_temps()
-
+    # Temp files of preview writes a crash interrupted (#317), off the
+    # import path: the walk may cover a large thumbnails folder.
     threading.Thread(
-        target=_preview_startup,
+        target=api.sweep_thumbnail_temps,
         name="PromptManagerPreviewTempSweep",
         daemon=True,
     ).start()
@@ -119,8 +108,6 @@ try:
         # Build each output root's Images listing once the server's loop runs,
         # so the first open does not wait for the walk (#348).
         host_app.on_startup.append(api.warm_gallery_listings)
-        # #320: old thumbnails a move left to remove, once it is checked.
-        host_app.on_startup.append(api.finish_thumbnail_move)
     if host_app is not None and hasattr(host_app, "on_shutdown"):
         # Open Needs review change streams end before the server waits on them.
         host_app.on_shutdown.append(api.close_review_events)
@@ -133,7 +120,6 @@ except Exception as e:
         logger = get_logger("prompt_manager.init")
         logger.error(f"Failed to register API routes: {e}")
     except Exception:
-        # logging failed too; a report must never stop the node loading
         pass
 
 # Shared database, set up with the monitoring system below. Stays None when that
@@ -293,11 +279,11 @@ def _teardown_logger():
 
 
 def _stop_background_work():
-    """Stop the image monitor, the preview worker, the job worker threads
-    and the prompt cleanup thread against one TEARDOWN_SECONDS deadline, once.
+    """Stop the image monitor, the preview worker and the prompt cleanup
+    thread against one TEARDOWN_SECONDS deadline, once.
 
-    Returns ``{"monitor", "thumbnails", "workers", "tracker"}`` booleans
-    (True: it stopped), leaving out parts that never started. Later calls return a
+    Returns ``{"monitor", "thumbnails", "tracker"}`` booleans (True: it
+    stopped), leaving out parts that never started. Later calls return a
     copy of the first result. A Ctrl+C inside a step is logged and the
     step is False; one between steps is re-raised after the result (parts
     not reached are False) is stored and the ``atexit`` entry removed.
@@ -311,14 +297,11 @@ def _stop_background_work():
             api,
             _global_prompt_tracker,
         )
-        from .utils import parallel
-
         # A part whose global is set has started; False until its step says
         # otherwise, so an interrupt between steps leaves an honest result.
         started = (
             ("monitor", monitor),
             ("thumbnails", thumbnails),
-            ("workers", parallel.job_pool_started() or None),
             ("tracker", tracker),
         )
         result = {name: False for name, part in started if part is not None}
@@ -361,16 +344,6 @@ def _stop_background_work():
                 result["thumbnails"] = _teardown_step(
                     "the preview worker", close_previews, logger
                 )
-            if "workers" in result:
-
-                def stop_workers():
-                    from .utils.parallel import JOB_POOL_JOIN_SECONDS
-
-                    return parallel.shutdown_job_pool(left(JOB_POOL_JOIN_SECONDS))
-
-                result["workers"] = _teardown_step(
-                    "the job worker threads", stop_workers, logger
-                )
             if tracker is not None:
 
                 def stop_tracker():
@@ -438,7 +411,6 @@ except Exception as e:
             f"Failed to register the exit signal: {e}"
         )
     except Exception:
-        # logging failed too; a report must never stop the node loading
         pass
 
 try:
@@ -456,17 +428,16 @@ except Exception as e:
             f"Failed to register the background work teardown: {e}"
         )
     except Exception:
-        # logging failed too; a report must never stop the node loading
         pass
 
 __all__ = ["NODE_CLASS_MAPPINGS", "NODE_DISPLAY_NAME_MAPPINGS", "WEB_DIRECTORY"]
 
-# One startup line, printed at import on purpose: it is the package's banner on
-# stdout, as ComfyUI's other custom nodes print theirs. Not a log record: the
-# console log handler hides INFO by default, so a logger would drop it. ASCII
-# only: a Windows console using a legacy code page cannot print emoji, and a
-# UnicodeEncodeError here would abort loading the node.
-print(
-    f"\033[94m[ComfyUI-PromptManager] Version:\033[0m {get_version()}"
-    f" - {len(NODE_CLASS_MAPPINGS)} tools loaded"
-)
+# Print startup message with loaded tools
+print()
+print(f"\033[94m[ComfyUI-PromptManager] Version:\033[0m {get_version()}")
+for node_key, display_name in NODE_DISPLAY_NAME_MAPPINGS.items():
+    # ASCII only: a Windows console using a legacy code page cannot print emoji,
+    # and a UnicodeEncodeError here would abort loading the whole node.
+    print(f"  \033[94mLoaded:\033[0m {display_name}")
+print(f"\033[94mTotal: {len(NODE_CLASS_MAPPINGS)} tools loaded\033[0m")
+print()

database/annotations.py

@@ -40,7 +40,6 @@ from .annotation_schema import (
     METADATA_TABLE,
 )
 from .autotag_schema import AUTOTAG_TABLE
-from .image_removal_schema import clear_marks
 from .library_commands import _UUID, LibraryCommandError, _validate_epoch
 from .models import utc_now_iso
 from .vocabulary import validate_vocabulary_tag_name
@@ -237,9 +236,6 @@ class AnnotationOperations:
 
     @staticmethod
     def _annotation_owner(conn: sqlite3.Connection, locator: str, now: str) -> str:
-        # A file with image tags or Needs review state is in the library: a
-        # removal mark never hides it (#480).
-        clear_marks(conn, [locator])
         row = conn.execute(_OWNER, (locator,)).fetchone()
         if row is not None:
             return row[0]

database/health.py

@@ -199,23 +199,6 @@ def link_states(rows, roots, readable):
     check's ``missing_files`` and the maintenance missing-link plan both
     judge links this way, so their counts agree.
     """
-    for row, owner, state in _placed_links(rows, roots, readable):
-        if state is None:
-            state = "present" if os.path.exists(row[1]) else "missing"
-        yield row, owner, state
-
-
-def held_links(rows, roots, readable):
-    """``(row, owner, state)`` for each link ``link_states`` holds back
-    (``unavailable`` or ``outside``), without looking at any file (#586)."""
-    for row, owner, state in _placed_links(rows, roots, readable):
-        if state is not None:
-            yield row, owner, state
-
-
-def _placed_links(rows, roots, readable):
-    """``link_states`` before any file is looked at: state None means the
-    link lies under a readable source."""
     prefixes = [_root_prefix(root) for root in roots]
     for row in rows:
         owner = _image_owner(row[1], row[3], prefixes)
@@ -223,8 +206,10 @@ def _placed_links(rows, roots, readable):
             yield row, None, "outside"
         elif not readable[owner]:
             yield row, owner, "unavailable"
+        elif os.path.exists(row[1]):
+            yield row, owner, "present"
         else:
-            yield row, owner, None
+            yield row, owner, "missing"
 
 
 def _unavailable_line(unavailable, *, partial):

database/image_categories.py

@@ -221,7 +221,6 @@ class ImageCategoryOperations:
         sources. Returns ``{updated, unchanged}``; a file that already had
         exactly this value is ``unchanged`` and keeps its ``updated_at``.
         """
-        from .image_removal_schema import clear_marks_of_keys
         from .models import utc_now_iso  # models imports this module's schema
 
         keys = list(dict.fromkeys(tuple(key) for key in file_keys))
@@ -235,7 +234,6 @@ class ImageCategoryOperations:
                     continue
                 conn.execute(UPSERT_SQL, (*key, category, now))
                 counts["updated"] += 1
-            clear_marks_of_keys(conn, keys)  # #480: a categorized file is listed
         return counts
 
     def clear_image_categories(self, file_keys) -> int:

database/image_collections.py

@@ -402,7 +402,6 @@ class ImageCollectionOperations:
         is created only when at least one item is inserted. Returns
         ``{collection, created, added, already}``.
         """
-        from .image_removal_schema import clear_marks_of_keys
         from .models import utc_now_iso  # models imports this module's schema
 
         if (collection_id is None) == (name is None):
@@ -439,7 +438,6 @@ class ImageCollectionOperations:
                 ).rowcount
                 for root, path in pairs
             )
-            clear_marks_of_keys(conn, pairs)  # #480: a collected file is listed
         return {
             "collection": collection,
             "created": created,

database/image_favorites.py

@@ -104,14 +104,11 @@ class ImageFavoriteOperations:
         """Mark one file as a favorite; repeating it is a no-op. Returns True."""
         from .models import utc_now_iso  # models imports this module's schema
 
-        from .image_removal_schema import clear_marks_of_keys
-
         with self.model.get_connection() as conn:
             conn.execute(
                 "INSERT OR IGNORE INTO image_favorites VALUES (?, ?, ?)",
                 (root_key, relative_path, utc_now_iso()),
             )
-            clear_marks_of_keys(conn, [(root_key, relative_path)])  # #480
         return True
 
     def clear_image_favorite(self, root_key: str, relative_path: str) -> bool:

database/image_removal.py

@@ -1,348 +0,0 @@
-"""Remove a file's records from the library, and its removal mark (#480).
-
-A *removal* describes one physical file the way the API resolved it from the
-walked listing (``py/api/image_delete.py``):
-
-- ``spellings``: every path string records may name it by
-  (``duplicate_spellings.Spellings.of``);
-- ``locator``: its private canonical locator;
-- ``favorites``: ``(root key, relative key)`` under every listed root holding
-  it, the keys of its favorite and its collection memberships;
-- ``category``: its own category's file key, or None.
-
-``remove_image_records`` deletes, in one ``BEGIN IMMEDIATE`` transaction:
-
-- its image records (``generated_images``) under every spelling, plus legacy
-  rows matched by ``image_path``; their saved-pair links go by cascade and the
-  workflow documents they held are released;
-- the image tags and auto-tag marks of its byte records. The annotation file
-  and byte rows go too, unless a Needs review item still cites them
-  (``media_review_items.byte_id`` is ``ON DELETE RESTRICT``): a decided or
-  revised item keeps its decision;
-- its pending, undecided Needs review items (settled as duplicate removal
-  settles them);
-- its own category, favorite and collection memberships.
-
-With ``mark`` it also writes the file's removal mark (library-only removal):
-the file stays on disk, hidden until its bytes change. Prompts, recorded runs
-and the media file itself are never touched here.
-"""
-
-import os
-
-from .annotation_schema import BYTES_TABLE, FILES_TABLE
-from .annotations import _BUMP_INDEX
-from .autotag_schema import AUTOTAG_TABLE
-from .duplicate_copies import (
-    DELETE_FAVORITE_SQL,
-    DELETE_LINK_SQL,
-    DELETE_MEMBERSHIPS_SQL,
-    _file_link_rows,
-)
-from .image_categories import DELETE_SQL as DELETE_CATEGORY_SQL
-from .image_removal_schema import (
-    META_TABLE,
-    TABLE,
-    bump_generation,
-    clear_marks,
-    has_marks_table,
-    mark_of,
-    write_mark as _write_mark,
-)
-from .library import display_title
-from .models import utc_now_iso
-from .review import _BUMP_REVIEW_INDEX, _PENDING_OF_LOCATOR, _SETTLE_ITEM
-from .review_changes import notify_review_change
-from .workflow_documents import documents_of_rows, release_documents
-
-BYTES_OF_LOCATOR_SQL = (
-    f"SELECT b.id FROM {FILES_TABLE} f JOIN {BYTES_TABLE} b "  # nosec B608
-    "ON b.file_id=f.id WHERE f.locator=?"
-)
-TAG_COUNT_SQL = "SELECT COUNT(*) FROM media_image_tags WHERE byte_id=?"
-AUTOTAG_COUNT_SQL = (
-    f"SELECT COUNT(*) FROM {AUTOTAG_TABLE} WHERE byte_id=?"  # nosec B608
-)
-CLEAR_TAGS_SQL = "DELETE FROM media_image_tags WHERE byte_id=?"
-CLEAR_AUTOTAG_SQL = f"DELETE FROM {AUTOTAG_TABLE} WHERE byte_id=?"  # nosec B608
-BUMP_TAG_REVISION_SQL = (
-    f"UPDATE {BYTES_TABLE} SET tag_revision=tag_revision+1 WHERE id=?"  # nosec B608
-)
-REVIEW_REFS_SQL = (
-    f"SELECT COUNT(*) FROM {FILES_TABLE} f "  # nosec B608
-    f"JOIN {BYTES_TABLE} b ON b.file_id=f.id "
-    "JOIN media_review_items i ON i.byte_id=b.id WHERE f.locator=?"
-)
-DELETE_FILE_SQL = f"DELETE FROM {FILES_TABLE} WHERE locator=?"  # nosec B608
-FILE_EXISTS_SQL = f"SELECT 1 FROM {FILES_TABLE} WHERE locator=?"  # nosec B608
-FAVORITE_EXISTS_SQL = (
-    "SELECT COUNT(*) FROM image_favorites WHERE root_key=? AND relative_path=?"
-)
-MEMBERSHIP_COUNT_SQL = (
-    "SELECT COUNT(*) FROM image_collection_items WHERE root_key=? AND relative_path=?"
-)
-CATEGORY_EXISTS_SQL = (
-    "SELECT COUNT(*) FROM image_categories WHERE root_key=? AND relative_path=?"
-)
-PAIR_LINK_COUNT_SQL = "SELECT COUNT(*) FROM image_prompt_pairs WHERE image_id=?"
-PROMPT_LINKS_SQL = "SELECT id FROM generated_images WHERE prompt_id=?"
-PROMPT_TITLE_SQL = (
-    "SELECT p.text, s.title FROM prompts p "
-    "LEFT JOIN prompt_library_state s ON s.prompt_id=p.id WHERE p.id=?"
-)
-MARKS_SQL = f"SELECT locator, size, mtime_ns FROM {TABLE}"  # nosec B608
-REVISION_SQL = f"SELECT revision FROM {META_TABLE} WHERE singleton_id=1"  # nosec B608
-MAX_ORPHAN_TITLES = 3
-RECORD_KINDS = (
-    "prompt_links",
-    "pair_links",
-    "image_tags",
-    "auto_tagged",
-    "categories",
-    "collections",
-    "favorites",
-    "review_items",
-)
-
-
-def _link_ids(conn, removal):
-    """``{image id: prompt id}`` of the records naming the file, any spelling."""
-    found = {}
-    for spelled in dict.fromkeys(removal["spellings"]):
-        for image_id, prompt_id in _file_link_rows(conn, spelled):
-            found[image_id] = prompt_id
-    return found
-
-
-def _byte_ids(conn, locator):
-    return [row[0] for row in conn.execute(BYTES_OF_LOCATOR_SQL, (locator,))]
-
-
-def file_locator(path) -> str:
-    """The locator of an absolute path (``normcase(realpath)``)."""
-    return os.path.normcase(os.path.realpath(str(path)))
-
-
-def removed_from_library(conn, path) -> bool:
-    """Whether *path* is hidden by a removal mark whose bytes still match.
-
-    A mark whose file changed (other size or ``mtime_ns``) or is gone is
-    stale: it is deleted on *conn* (the caller's write transaction), and the
-    file is not hidden.
-    """
-    locator = file_locator(path)
-    mark = mark_of(conn, locator)
-    if mark is None:
-        return False
-    try:
-        info = os.lstat(path)
-    except OSError:
-        clear_marks(conn, [locator])
-        return False
-    if (info.st_size, info.st_mtime_ns) == tuple(mark):
-        return True
-    clear_marks(conn, [locator])
-    return False
-
-
-def mark_hides(marks: dict, locator: str, path) -> bool:
-    """Whether a removal mark in *marks* hides the file at *path* (blocking).
-
-    *marks* is ``{locator: (size, mtime_ns)}``. The mark of *locator* hides
-    the file while ``os.lstat(path)`` still has the size and ``mtime_ns`` it
-    was removed with; a file that cannot be looked at is not hidden.
-    """
-    mark = marks.get(locator)
-    if mark is None:
-        return False
-    try:
-        info = os.lstat(path)
-    except OSError:
-        return False
-    return (info.st_size, info.st_mtime_ns) == tuple(mark)
-
-
-def write_mark(conn, locator, size, mtime_ns):
-    _write_mark(conn, locator, size, mtime_ns, utc_now_iso())
-
-
-class ImageRemovalOperations:
-    """PromptDatabase mixin: remove a file's records; removal marks."""
-
-    def count_removal_records(self, removals) -> dict:
-        """Counts of what removing *removals* deletes, in one read snapshot.
-
-        ``{records: {kind: n}, orphaned_prompts: {count, titles}}``: prompts
-        whose every image record is among these files lose their last image
-        (they stay in the Library).
-        """
-        from .maintenance import _read_snapshot
-
-        def read(conn):
-            totals = dict.fromkeys(RECORD_KINDS, 0)
-            links = {}
-            for removal in removals:
-                found = _link_ids(conn, removal)
-                links.update(found)
-                for image_id in found:
-                    totals["pair_links"] += conn.execute(
-                        PAIR_LINK_COUNT_SQL, (image_id,)
-                    ).fetchone()[0]
-                tagged = autotagged = False
-                for byte_id in _byte_ids(conn, removal["locator"]):
-                    tagged |= bool(
-                        conn.execute(TAG_COUNT_SQL, (byte_id,)).fetchone()[0]
-                    )
-                    autotagged |= bool(
-                        conn.execute(AUTOTAG_COUNT_SQL, (byte_id,)).fetchone()[0]
-                    )
-                totals["image_tags"] += int(tagged)
-                totals["auto_tagged"] += int(autotagged)
-                totals["review_items"] += len(
-                    conn.execute(_PENDING_OF_LOCATOR, (removal["locator"],)).fetchall()
-                )
-                totals["favorites"] += int(
-                    any(
-                        conn.execute(FAVORITE_EXISTS_SQL, key).fetchone()[0]
-                        for key in removal["favorites"]
-                    )
-                )
-                totals["collections"] += sum(
-                    conn.execute(MEMBERSHIP_COUNT_SQL, key).fetchone()[0]
-                    for key in removal["favorites"]
-                )
-                if removal.get("category"):
-                    totals["categories"] += conn.execute(
-                        CATEGORY_EXISTS_SQL, removal["category"]
-                    ).fetchone()[0]
-            totals["prompt_links"] = len(links)
-            return {
-                "records": totals,
-                "orphaned_prompts": self._orphaned_prompts(conn, links),
-            }
-
-        return _read_snapshot(self.model.db_path, read)
-
-    @staticmethod
-    def _orphaned_prompts(conn, links):
-        removed = set(links)
-        orphans = []
-        for prompt_id in dict.fromkeys(links.values()):
-            remaining = [
-                row[0]
-                for row in conn.execute(PROMPT_LINKS_SQL, (prompt_id,))
-                if row[0] not in removed
-            ]
-            if not remaining:
-                orphans.append(prompt_id)
-        titles = []
-        for prompt_id in orphans[:MAX_ORPHAN_TITLES]:
-            row = conn.execute(PROMPT_TITLE_SQL, (prompt_id,)).fetchone()
-            if row is not None:
-                titles.append(display_title((row[1],), row[0]) or "")
-        return {"count": len(orphans), "titles": titles}
-
-    def remove_image_records(self, removal, *, mark=None) -> dict:
-        """Delete every record of one file (one transaction); see the module.
-
-        ``mark``: ``(size, mtime_ns)`` to write the file's removal mark, or
-        None (the file was moved to the trash). Returns the counts deleted.
-        """
-        counts = dict.fromkeys(RECORD_KINDS, 0)
-        locator = removal["locator"]
-        with self._pair_transaction() as conn:
-            links = _link_ids(conn, removal)
-            if links:
-                documents = documents_of_rows(conn, "id", list(links))
-                for image_id in links:
-                    counts["pair_links"] += conn.execute(
-                        PAIR_LINK_COUNT_SQL, (image_id,)
-                    ).fetchone()[0]
-                    conn.execute(DELETE_LINK_SQL, (image_id,))
-                release_documents(conn, documents)
-            counts["prompt_links"] = len(links)
-            counts.update(self._remove_annotations(conn, locator))
-            for key in removal["favorites"]:
-                counts["favorites"] += conn.execute(DELETE_FAVORITE_SQL, key).rowcount
-                counts["collections"] += conn.execute(
-                    DELETE_MEMBERSHIPS_SQL, key
-                ).rowcount
-            if removal.get("category"):
-                counts["categories"] += conn.execute(
-                    DELETE_CATEGORY_SQL, tuple(removal["category"])
-                ).rowcount
-            if mark is not None:
-                write_mark(conn, locator, *mark)
-        if counts["review_items"]:
-            notify_review_change(self.model.db_path)
-        return counts
-
-    def _remove_annotations(self, conn, locator) -> dict:
-        """Tags, auto-tag marks, pending review items and, when free, the rows."""
-        counts = {"image_tags": 0, "auto_tagged": 0, "review_items": 0}
-        bytes_ = _byte_ids(conn, locator)
-        for byte_id in bytes_:
-            tags = conn.execute(CLEAR_TAGS_SQL, (byte_id,)).rowcount
-            autotags = conn.execute(CLEAR_AUTOTAG_SQL, (byte_id,)).rowcount
-            if tags:
-                conn.execute(BUMP_TAG_REVISION_SQL, (byte_id,))
-            counts["image_tags"] |= bool(tags)
-            counts["auto_tagged"] |= bool(autotags)
-        for (item_id,) in conn.execute(_PENDING_OF_LOCATOR, (locator,)).fetchall():
-            counts["review_items"] += conn.execute(_SETTLE_ITEM, (item_id,)).rowcount
-        if counts["review_items"]:
-            conn.execute(_BUMP_REVIEW_INDEX)
-        if conn.execute(FILE_EXISTS_SQL, (locator,)).fetchone():
-            if not conn.execute(REVIEW_REFS_SQL, (locator,)).fetchone()[0]:
-                conn.execute(DELETE_FILE_SQL, (locator,))
-            conn.execute(_BUMP_INDEX)
-        counts["image_tags"] = int(counts["image_tags"])
-        counts["auto_tagged"] = int(counts["auto_tagged"])
-        return counts
-
-    def removal_marks(self) -> dict:
-        """``{locator: (size, mtime_ns)}`` of every removal mark (one read)."""
-        conn = self.model.get_connection()
-        if not has_marks_table(conn):
-            return {}
-        return {row[0]: (row[1], row[2]) for row in conn.execute(MARKS_SQL)}
-
-    def removal_revision(self) -> int:
-        conn = self.model.get_connection()
-        if not has_marks_table(conn):
-            return 0
-        row = conn.execute(REVISION_SQL).fetchone()
-        return row[0] if row else 0
-
-    def clear_removal_marks(self, locators) -> int:
-        """Show these files again (their marks go); the count removed."""
-        locators = list(locators)
-        if not locators:
-            return 0
-        with self._pair_transaction() as conn:
-            removed = clear_marks(conn, locators)
-        # #498: again after the commit, so a reader that cached the marks
-        # between the in-transaction bump and the commit reloads them.
-        bump_generation()
-        return removed
-
-    def clear_hiding_marks(self, files) -> set:
-        """Delete the marks that still hide their file (#498, Return to library).
-
-        *files* are ``(locator, path)`` pairs. In one ``BEGIN IMMEDIATE``
-        transaction each mark is read again and deleted only while the file at
-        *path* still has its size and ``mtime_ns``. Returns the locators whose
-        marks went.
-        """
-        cleared = set()
-        files = list(files)
-        if not files:
-            return cleared
-        with self._pair_transaction() as conn:
-            for locator, path in files:
-                mark = mark_of(conn, locator)
-                if mark is not None and mark_hides({locator: mark}, locator, path):
-                    cleared.add(locator)
-            clear_marks(conn, sorted(cleared))
-        bump_generation()
-        return cleared

database/image_removal_schema.py

@@ -1,213 +0,0 @@
-"""Removal marks (#480): files removed from the library that stay on disk.
-
-``image_removals`` holds one row per hidden file: its private canonical
-locator (the ``media_annotation_files.locator`` form) and the ``size`` and
-``mtime_ns`` it had when it was removed. A file at that locator with other
-bytes is a new file and shows again. ``image_removals_meta`` is one row, the
-marks revision, bumped in the same transaction as every mark change so the
-workspace listing caches can tell marks changed.
-
-The group installs like ``image_favorites``: optional in old backups,
-required once a database is current. Older builds ignore it.
-"""
-
-import os
-import re
-import sqlite3
-
-from .annotation_schema import MAX_LOCATOR_LENGTH
-
-TABLE = "image_removals"
-META_TABLE = "image_removals_meta"
-TABLES = (TABLE, META_TABLE)
-_TABLE_DDL = {
-    TABLE: (
-        f"CREATE TABLE {TABLE} (locator TEXT PRIMARY KEY, "
-        "size INTEGER NOT NULL CHECK(size>=0), mtime_ns INTEGER NOT NULL, "
-        "removed_at TEXT NOT NULL) WITHOUT ROWID"
-    ),
-    META_TABLE: (
-        f"CREATE TABLE {META_TABLE} (singleton_id INTEGER PRIMARY KEY "
-        "CHECK(singleton_id=1), revision INTEGER NOT NULL DEFAULT 0 "
-        "CHECK(revision>=0))"
-    ),
-}
-_SEED_META = (
-    f"INSERT OR IGNORE INTO {META_TABLE} (singleton_id, revision) VALUES (1, 0)"
-)
-_COLUMNS = {
-    TABLE: (
-        ("locator", "TEXT", 1, 1),
-        ("size", "INTEGER", 1, 0),
-        ("mtime_ns", "INTEGER", 1, 0),
-        ("removed_at", "TEXT", 1, 0),
-    ),
-    META_TABLE: (
-        ("singleton_id", "INTEGER", 0, 1),
-        ("revision", "INTEGER", 1, 0),
-    ),
-}
-_AUTOINDEX = f"sqlite_autoindex_{TABLE}_1"
-
-
-def _compact(sql: str) -> str:
-    return re.sub(r"\s+", "", sql or "").lower()
-
-
-def _structure_error(conn: sqlite3.Connection, allow_missing: bool) -> str | None:
-    rows = conn.execute(
-        "SELECT type,name,tbl_name,sql FROM sqlite_master WHERE name IN (?,?) "
-        "OR tbl_name IN (?,?)",
-        TABLES + TABLES,
-    ).fetchall()
-    if not rows:
-        return None if allow_missing else "Missing image removal marks schema"
-    tables = {name: sql for kind, name, _tbl, sql in rows if kind == "table"}
-    others = {(kind, name) for kind, name, _tbl, _sql in rows if kind != "table"}
-    if set(tables) != set(TABLES) or others - {("index", _AUTOINDEX)}:
-        return "Image removal marks name is reserved by an unsupported schema object"
-    for table in TABLES:
-        if _compact(tables[table]) != _compact(_TABLE_DDL[table]):
-            return "Image removal marks have an invalid table definition"
-        columns = tuple(
-            (row[1], row[2].upper(), row[3], row[5])
-            for row in conn.execute(f"PRAGMA table_info({table})")
-        )
-        if columns != _COLUMNS[table]:
-            return "Image removal marks have invalid columns"
-    return None
-
-
-def _values_error(conn: sqlite3.Connection) -> str | None:
-    limit = MAX_LOCATOR_LENGTH * 4
-    if conn.execute(
-        f"SELECT 1 FROM {TABLE} WHERE typeof(locator) != 'text' "  # nosec B608
-        f"OR length(CAST(locator AS BLOB)) > {limit} OR locator = '' "
-        "OR typeof(size) != 'integer' OR typeof(mtime_ns) != 'integer' "
-        "OR typeof(removed_at) != 'text' OR length(CAST(removed_at AS BLOB)) > 64 "
-        "LIMIT 1"
-    ).fetchone():
-        return "Image removal marks contain invalid values"
-    meta = conn.execute(
-        f"SELECT singleton_id, typeof(revision) FROM {META_TABLE}"  # nosec B608
-    ).fetchall()
-    if meta != [(1, "integer")]:
-        return "Image removal marks have an invalid revision"
-    return None
-
-
-def image_removals_schema_error(
-    conn: sqlite3.Connection, *, allow_missing: bool = True
-) -> str | None:
-    """Reject unsupported schemas and invalid persisted values (reads only)."""
-    error = _structure_error(conn, allow_missing)
-    if error:
-        return error
-    exists = conn.execute(
-        "SELECT 1 FROM sqlite_master WHERE type='table' AND name=?", (TABLE,)
-    ).fetchone()
-    return _values_error(conn) if exists else None
-
-
-def migrate_image_removals(conn: sqlite3.Connection) -> None:
-    """Install both tables atomically; validate before and after."""
-    conn.execute("SAVEPOINT image_removals_schema")
-    try:
-        error = image_removals_schema_error(conn)
-        if error:
-            raise sqlite3.DatabaseError(error)
-        for sql in _TABLE_DDL.values():
-            conn.execute(sql.replace("CREATE TABLE", "CREATE TABLE IF NOT EXISTS", 1))
-        conn.execute(_SEED_META)
-        error = image_removals_schema_error(conn, allow_missing=False)
-        if error:
-            raise sqlite3.DatabaseError(error)
-        conn.execute("RELEASE image_removals_schema")
-    except BaseException:
-        conn.execute("ROLLBACK TO image_removals_schema")
-        conn.execute("RELEASE image_removals_schema")
-        raise
-
-
-_UNMARK_SQL = f"DELETE FROM {TABLE} WHERE locator=?"  # nosec B608
-_MARK_SQL = (
-    f"INSERT OR REPLACE INTO {TABLE} "  # nosec B608
-    "(locator, size, mtime_ns, removed_at) VALUES (?, ?, ?, ?)"
-)
-_MARK_OF_SQL = f"SELECT size, mtime_ns FROM {TABLE} WHERE locator=?"  # nosec B608
-BUMP_MARKS_SQL = (
-    f"UPDATE {META_TABLE} SET revision=revision+1 WHERE singleton_id=1"  # nosec B608
-)
-
-
-# Bumped whenever this process writes or clears a mark (even in a transaction
-# that later rolls back): readers that cache the marks reload when it moves.
-_generation = 0
-
-
-def generation() -> int:
-    """The marks generation of this process (see ``_generation``)."""
-    return _generation
-
-
-def _bump() -> None:
-    global _generation
-    _generation += 1
-
-
-def bump_generation() -> None:
-    """Move the generation after a commit (a cached read made before it reloads)."""
-    _bump()
-
-
-def has_marks_table(conn: sqlite3.Connection) -> bool:
-    return (
-        conn.execute(
-            "SELECT 1 FROM sqlite_master WHERE type='table' AND name=?", (TABLE,)
-        ).fetchone()
-        is not None
-    )
-
-
-def locator_of_key(root_key: str, relative_key: str) -> str:
-    """The locator of a favorite-style file key (root key + relative key)."""
-    return os.path.normcase(os.path.join(root_key, *relative_key.split("/")))
-
-
-def mark_of(conn: sqlite3.Connection, locator: str):
-    """``(size, mtime_ns)`` of the file's removal mark, or None."""
-    if not has_marks_table(conn):
-        return None
-    row = conn.execute(_MARK_OF_SQL, (locator,)).fetchone()
-    return (row[0], row[1]) if row else None
-
-
-def write_mark(
-    conn: sqlite3.Connection, locator: str, size: int, mtime_ns: int, now: str
-):
-    conn.execute(_MARK_SQL, (locator, int(size), int(mtime_ns), now))
-    conn.execute(BUMP_MARKS_SQL)
-    _bump()
-
-
-def clear_marks(conn: sqlite3.Connection, locators) -> int:
-    """Delete the marks of *locators* on *conn* (no commit); the count removed.
-
-    Every record write for a file calls this (#480): a file with records is
-    in the library, so it is never hidden.
-    """
-    locators = list(dict.fromkeys(locators))
-    if not locators or not has_marks_table(conn):
-        return 0
-    removed = 0
-    for locator in locators:
-        removed += conn.execute(_UNMARK_SQL, (locator,)).rowcount
-    if removed:
-        conn.execute(BUMP_MARKS_SQL)
-        _bump()
-    return removed
-
-
-def clear_marks_of_keys(conn: sqlite3.Connection, file_keys) -> int:
-    """``clear_marks`` for favorite-style ``(root key, relative key)`` pairs."""
-    return clear_marks(conn, [locator_of_key(*key) for key in file_keys])

database/library.py

@@ -7,7 +7,6 @@ from contextlib import contextmanager
 
 from .library_folders import folder_condition, list_library_folders
 from .library_tokens import library_edit_token
-from .prompt_archive import ARCHIVED, SHELVED
 
 _ELIGIBLE = """(EXISTS(SELECT 1 FROM prompt_pairs ep WHERE ep.positive_prompt_id=p.id)
  OR EXISTS(SELECT 1 FROM generated_images eg WHERE eg.prompt_id=p.id)
@@ -107,12 +106,6 @@ ARCHIVE_SCOPES = {
 }
 
 
-# Shelves (#443): the parents on the shelf, or the archived ones.
-PARENT_SCOPES = {"active": SHELVED, "archived": ARCHIVED}
-# A positive pair owner that is on the shelf, as a condition on alias pp.
-SHELVED_PAIR = SHELVED.replace("p.id", "pp.positive_prompt_id")
-
-
 def _escape(value: str) -> str:
     return value.replace("\\", "\\\\").replace("%", "\\%").replace("_", "\\_")
 
@@ -277,8 +270,6 @@ class LibraryOperations:
         rows = conn.execute(
             "SELECT p.id,p.text,ls.title,p.category,p.rating,p.notes,p.created_at,"
             "p.run_count,p.last_used_at,"
-            + ARCHIVED
-            + " AS archived,"
             + (f"{sort_expression} AS _sort," if sort_expression else "")
             + "(SELECT COUNT(*) FROM prompt_pairs v WHERE v.positive_prompt_id=p.id "
             "AND v.archived=0) AS variant_count,"
@@ -302,7 +293,6 @@ class LibraryOperations:
             # Usage is shown, never compared: the token hashes owner fields only.
             row["run_count"] = row["run_count"] if type(row["run_count"]) is int else 0
             row["last_used_at"] = utc_iso(row["last_used_at"])
-            row["archived"] = bool(row["archived"])
             row["edit_token"] = library_edit_token(epoch, row)
         return result
 
@@ -320,13 +310,10 @@ class LibraryOperations:
         sort: str = "newest",
         limit: int = 40,
         after: dict | None = None,
-        shelf: str = "active",
     ) -> dict:
         _limit(limit)
         if sort not in _ORDERS:
             raise ValueError("Unknown library sort order")
-        if not isinstance(shelf, str) or shelf not in PARENT_SCOPES:
-            raise ValueError("shelf must be active or archived")
         where, params = _filter(
             text, category, [] if tags is None else tags, tag_mode, folder_prefixes
         )
@@ -341,18 +328,15 @@ class LibraryOperations:
             ceiling = after["ceiling"]
         where += " AND p.id<=?"
         params.append(ceiling)
-        # One SELECT counts the filtered parents of this scope, their active
-        # variants, and the filtered archived parents (Show archived, #443).
-        scope = PARENT_SCOPES[shelf]
-        total, variant_total, archived_total = conn.execute(
-            f"SELECT COALESCE(SUM({scope}),0),"
-            f"COALESCE(SUM(CASE WHEN {scope} THEN (SELECT COUNT(*) "
-            "FROM prompt_pairs v WHERE v.positive_prompt_id=p.id "
-            "AND v.archived=0) ELSE 0 END),0),"
-            f"COALESCE(SUM({ARCHIVED}),0) FROM " + _FROM + " WHERE " + where,
+        # One SELECT counts the filtered parents and their active variants.
+        total, variant_total = conn.execute(
+            "SELECT COUNT(*),COALESCE(SUM((SELECT COUNT(*) FROM prompt_pairs v "
+            "WHERE v.positive_prompt_id=p.id AND v.archived=0)),0) FROM "
+            + _FROM
+            + " WHERE "
+            + where,
             params,
         ).fetchone()
-        where += f" AND {scope}"
         expression, direction = _ORDERS[sort]
         if after is not None:
             operator = ">" if direction == "ASC" else "<"
@@ -385,7 +369,6 @@ class LibraryOperations:
             "items": rows,
             "total": total,
             "variant_total": variant_total,
-            "archived_total": archived_total,
             # Echoed so a client can tell this read applied its tag match.
             "tag_mode": tag_mode,
             "has_more": has_more,
@@ -403,7 +386,6 @@ class LibraryOperations:
         sort: str = "newest",
         limit: int = 40,
         after: dict | None = None,
-        shelf: str = "active",
     ) -> dict:
         with self.library_snapshot(include_ceiling=True) as (conn, epoch, ceiling):
             return self._list_library(
@@ -418,7 +400,6 @@ class LibraryOperations:
                 sort=sort,
                 limit=limit,
                 after=after,
-                shelf=shelf,
             )
 
     def _is_library_positive(self, conn: sqlite3.Connection, positive_id: int) -> bool:
@@ -663,9 +644,7 @@ class LibraryOperations:
             owners = {}
             order = []
             for row in conn.execute(
-                "SELECT p.id,p.text,ls.title,p.category,p.rating,p.notes,"
-                + ARCHIVED
-                + " AS archived FROM "
+                "SELECT p.id,p.text,ls.title,p.category,p.rating,p.notes FROM "
                 + _FROM
                 + " WHERE "
                 + _ELIGIBLE
@@ -678,7 +657,6 @@ class LibraryOperations:
                     "tags": [],
                     "rating": row["rating"],
                     "notes": row["notes"],
-                    "archived": bool(row["archived"]),
                     "variants": [],
                 }
                 order.append(row["id"])
@@ -723,9 +701,8 @@ class LibraryOperations:
         """System › Overview counts from one snapshot, writing nothing.
 
         ``positive_prompts`` and ``negative_variants`` are the unfiltered
-        Library's ``total`` and ``variant_total``: eligible parents on the
-        shelf (not archived, #443) and their active pairs (every pair's
-        positive is eligible). ``images`` counts indexed
+        Library's ``total`` and ``variant_total``: eligible parents and active
+        pairs (every pair's positive is eligible). ``images`` counts indexed
         ``generated_images`` rows, not files on disk. An image has no rating
         of its own (it shows its linked prompt's), so ``rated_images`` counts
         the indexed images whose linked prompt is rated. ``review_pending`` is
@@ -733,14 +710,8 @@ class LibraryOperations:
         """
         with self.library_snapshot() as (conn, _epoch, _ceiling):
             row = conn.execute(
-                "SELECT (SELECT COUNT(*) FROM prompts p WHERE "
-                + _ELIGIBLE
-                + " AND "
-                + SHELVED
-                + "),"
-                "(SELECT COUNT(*) FROM prompt_pairs pp WHERE pp.archived=0 AND "
-                + SHELVED_PAIR
-                + "),"
+                "SELECT (SELECT COUNT(*) FROM prompts p WHERE " + _ELIGIBLE + "),"
+                "(SELECT COUNT(*) FROM prompt_pairs WHERE archived=0),"
                 "(SELECT COUNT(*) FROM generated_images),"
                 "(SELECT COUNT(*) FROM generated_images gi JOIN prompts r "
                 "ON r.id=gi.prompt_id WHERE r.rating IS NOT NULL),"

database/library_archive.py

@@ -1,473 +0,0 @@
-"""Delete selected Library prompts; archive the paired ones (#443, D152).
-
-A selected Library parent is classified, in this order, as ``not_found``
-(missing, or not a Library parent), ``protected`` (tagged ``__protected__``;
-never changed), ``already_archived``, ``archive`` (the positive or negative of
-any saved pair, archived pair or not: archiving hides it from the shelf and
-removes nothing) or ``delete`` (in no pair: deleted exactly as the legacy
-delete does, through ``delete_prompt_rows``). Every command checks the
-storage epoch first and runs in one ``BEGIN IMMEDIATE`` transaction.
-
-The write executes what the user reviewed: it is given the reviewed archive
-and delete lists, and deletes only reviewed deletes the route backed up
-(``candidates``) whose fingerprint is unchanged since that backup.
-"""
-
-import hashlib
-import json
-import re
-import sqlite3
-from typing import Iterable
-
-from .library import _ELIGIBLE
-from .library_commands import _validate_bulk_ids, _validate_epoch
-from .models import utc_now_iso
-from .prompt_archive import ARCHIVED as _ARCHIVED
-from .prompt_archive import TABLE as ARCHIVE
-from .workflow_documents import documents_of_rows, release_documents
-
-try:
-    from ..utils.hashing import generate_prompt_hash
-except ImportError:
-    from utils.hashing import generate_prompt_hash
-
-# Ids bound per statement: the pair check binds each id twice, which stays
-# under SQLite's historical 999-variable limit (maintenance.py ID_BATCH).
-ID_BATCH = 400
-_PROTECTED = (
-    "EXISTS(SELECT 1 FROM prompt_tags pt JOIN tags t ON t.id=pt.tag_id "
-    "WHERE pt.prompt_id=p.id AND t.name='__protected__')"
-)
-_PAIRED = (
-    "EXISTS(SELECT 1 FROM prompt_pairs pp "
-    "WHERE pp.positive_prompt_id=p.id OR pp.negative_prompt_id=p.id)"
-)
-# #482: used as the negative of another positive's pair (archived or not):
-# never deleted, so that positive's variant stays (archive only).
-_NEGATIVE_OF_OTHER = (
-    "EXISTS(SELECT 1 FROM prompt_pairs op "
-    "WHERE op.negative_prompt_id=p.id AND op.positive_prompt_id!=p.id)"
-)
-# Classes in the order a prompt is tested; the first that holds wins.
-CLASSES = (
-    "not_found",
-    "protected",
-    "already_archived",
-    "not_archived",
-    "archive",
-    "delete",
-)
-# #492: the shelf a Delete… runs on. On the archived shelf an archived prompt is
-# classified by its pairs, and one restored since is ``not_archived``.
-SHELVES = ("active", "archived")
-
-
-def _check_shelf(shelf: str) -> bool:
-    """Whether ``shelf`` is the archived shelf (ValueError when unknown)."""
-    if shelf not in SHELVES:
-        raise ValueError("shelf must be active or archived")
-    return shelf == "archived"
-
-
-_DIGEST = re.compile(r"^[0-9a-f]{64}$")
-
-
-def _batches(ids: list) -> Iterable[list]:
-    for start in range(0, len(ids), ID_BATCH):
-        yield ids[start : start + ID_BATCH]
-
-
-def delete_prompt_rows(conn: sqlite3.Connection, prompt_ids: list[int]) -> int:
-    """Delete prompts and their image link rows; return the prompts deleted.
-
-    The legacy delete's statements (``delete_prompt``, ``bulk_delete_prompts``)
-    in the caller's transaction: image link rows first (``image_prompt_pairs``
-    cascades, review decisions keep a NULL image), then the prompts (tags and
-    Library state cascade), then the workflow documents no row references.
-    Image files are never touched. The caller checks pairs first.
-    """
-    documents = documents_of_rows(conn, "prompt_id", prompt_ids)
-    deleted = 0
-    for chunk in _batches(list(prompt_ids)):
-        marks = ",".join("?" for _ in chunk)
-        conn.execute(
-            f"DELETE FROM generated_images WHERE prompt_id IN ({marks})",  # nosec
-            chunk,
-        )
-        deleted += conn.execute(
-            f"DELETE FROM prompts WHERE id IN ({marks})", chunk  # nosec B608
-        ).rowcount
-    release_documents(conn, documents)
-    return deleted
-
-
-class LibraryArchiveOperations:
-    """PromptDatabase mixin: classify, archive or delete, and restore parents."""
-
-    def _classify_library_delete(
-        self, conn: sqlite3.Connection, prompt_ids: list[int], shelf: str = "active"
-    ) -> dict:
-        on_archived_shelf = _check_shelf(shelf)
-        found, deletable = {}, set()
-        for chunk in _batches(prompt_ids):
-            marks = ",".join("?" for _ in chunk)
-            for row in conn.execute(
-                f"SELECT p.id,{_PROTECTED},{_ARCHIVED},{_PAIRED},"  # nosec B608
-                f"{_NEGATIVE_OF_OTHER} "
-                f"FROM prompts p WHERE p.id IN ({marks}) AND {_ELIGIBLE}",
-                chunk,
-            ):
-                protected, archived, paired, negative_of_other = row[1:5]
-                if protected:
-                    found[row[0]] = "protected"
-                elif on_archived_shelf and not archived:
-                    found[row[0]] = "not_archived"
-                elif archived and not on_archived_shelf:
-                    found[row[0]] = "already_archived"
-                elif paired:
-                    found[row[0]] = "archive"
-                    if not negative_of_other:
-                        deletable.add(row[0])
-                else:
-                    found[row[0]] = "delete"
-        classes = {name: [] for name in CLASSES}
-        for pid in prompt_ids:
-            classes[found.get(pid, "not_found")].append(pid)
-        # #482: the archive ids Delete permanently may delete with their pairs.
-        classes["deletable"] = [pid for pid in classes["archive"] if pid in deletable]
-        return classes
-
-    @staticmethod
-    def _image_links(conn: sqlite3.Connection, prompt_ids: list[int]) -> int:
-        total = 0
-        for chunk in _batches(prompt_ids):
-            marks = ",".join("?" for _ in chunk)
-            total += conn.execute(
-                "SELECT COUNT(*) FROM generated_images "  # nosec B608
-                f"WHERE prompt_id IN ({marks})",
-                chunk,
-            ).fetchone()[0]
-        return total
-
-    @staticmethod
-    def _fingerprints(conn: sqlite3.Connection, prompt_ids: list[int]) -> dict:
-        """What a safety backup holds of each prompt a delete would remove.
-
-        The prompt row (usage included), its tag ids, its Library title and
-        its image link rows (count and newest id), as a JSON-safe list.
-        """
-        prints = {}
-        for chunk in _batches(prompt_ids):
-            marks = ",".join("?" for _ in chunk)
-            for row in conn.execute(
-                "SELECT p.id,p.text,p.hash,p.category,p.rating,p.notes,"  # nosec
-                "p.updated_at,p.run_count,p.last_used_at,"
-                "(SELECT group_concat(tag_id) FROM (SELECT tag_id FROM prompt_tags "
-                "WHERE prompt_id=p.id ORDER BY tag_id)),"
-                "(SELECT title FROM prompt_library_state WHERE prompt_id=p.id),"
-                "(SELECT COUNT(*) FROM generated_images WHERE prompt_id=p.id),"
-                "(SELECT MAX(id) FROM generated_images WHERE prompt_id=p.id) "
-                f"FROM prompts p WHERE p.id IN ({marks})",
-                chunk,
-            ):
-                prints[row[0]] = [
-                    value if isinstance(value, (int, str, type(None))) else repr(value)
-                    for value in tuple(row)[1:]
-                ]
-        return prints
-
-    @staticmethod
-    def _distinct_images(conn: sqlite3.Connection, prompt_ids: list[int]) -> int:
-        """Image rows of ``prompt_ids`` (each image once; #482 deletes them)."""
-        return LibraryArchiveOperations._image_links(conn, prompt_ids)
-
-    @staticmethod
-    def _pair_prints(conn: sqlite3.Connection, prompt_ids: list[int]) -> dict:
-        """#482: each prompt's own saved pairs, as the review saw them.
-
-        Per pair (by id): its negative, archived flag, metadata, usage, ordered
-        tag ids and its image-pair links (count and newest id).
-        """
-        prints = {pid: [] for pid in prompt_ids}
-        for chunk in _batches(prompt_ids):
-            marks = ",".join("?" for _ in chunk)
-            for row in conn.execute(
-                "SELECT pp.positive_prompt_id,pp.id,pp.negative_prompt_id,"  # nosec
-                "pp.archived,pp.title,pp.category,pp.rating,pp.notes,pp.run_count,"
-                "pp.last_used_at,pp.updated_at,"
-                "(SELECT group_concat(tag_id) FROM (SELECT tag_id FROM "
-                "prompt_pair_tags WHERE pair_id=pp.id ORDER BY tag_id)),"
-                "(SELECT COUNT(*) FROM image_prompt_pairs WHERE pair_id=pp.id),"
-                "(SELECT MAX(id) FROM image_prompt_pairs WHERE pair_id=pp.id) "
-                f"FROM prompt_pairs pp WHERE pp.positive_prompt_id IN ({marks}) "
-                "ORDER BY pp.id",
-                chunk,
-            ):
-                prints[row[0]].append(
-                    [
-                        v if isinstance(v, (int, str, type(None))) else repr(v)
-                        for v in tuple(row)[1:]
-                    ]
-                )
-        return prints
-
-    @classmethod
-    def _review_digests(cls, conn: sqlite3.Connection, prompt_ids: list[int]) -> dict:
-        """#482: one digest per deletable prompt of its row and its pairs."""
-        prompts = cls._fingerprints(conn, prompt_ids)
-        pairs = cls._pair_prints(conn, prompt_ids)
-        return {
-            pid: hashlib.sha256(
-                json.dumps(
-                    [prompts.get(pid), pairs[pid]], separators=(",", ":")
-                ).encode("utf-8")
-            ).hexdigest()
-            for pid in prompt_ids
-        }
-
-    @staticmethod
-    def _paired_counts(
-        conn: sqlite3.Connection, prompt_ids: list[int], selected: list[int]
-    ) -> dict:
-        """#482: what Delete permanently would remove with ``prompt_ids``."""
-        pairs = archived = variants = 0
-        negatives = set()
-        for chunk in _batches(prompt_ids):
-            marks = ",".join("?" for _ in chunk)
-            for archived_flag, negative, positive in conn.execute(
-                "SELECT archived,negative_prompt_id,positive_prompt_id "  # nosec
-                f"FROM prompt_pairs WHERE positive_prompt_id IN ({marks})",
-                chunk,
-            ):
-                pairs += 1
-                archived += 1 if archived_flag else 0
-                if negative is not None:
-                    variants += 1
-                    if negative != positive:
-                        negatives.add(negative)
-        return {
-            "pairs": pairs,
-            "archived_pairs": archived,
-            "variants": variants,
-            "kept_negatives": len(negatives - set(selected)),
-        }
-
-    @staticmethod
-    def _checked_ids(prompt_ids: list[int], expected_epoch: str) -> list[int]:
-        _validate_epoch(expected_epoch)
-        _validate_bulk_ids(prompt_ids)
-        return list(dict.fromkeys(prompt_ids))
-
-    def classify_library_delete(
-        self, prompt_ids: list[int], *, expected_epoch: str, shelf: str = "active"
-    ) -> dict:
-        """What a delete of ``prompt_ids`` would do now (reads only).
-
-        Returns the id lists per class, in request order, ``image_links``
-        (the image link rows the ``delete`` class would remove) and
-        ``fingerprints`` of the ``delete`` class (``_fingerprints``). On the
-        archived ``shelf`` (#492) archived prompts are classified by their pairs.
-        """
-        _check_shelf(shelf)
-        prompt_ids = self._checked_ids(prompt_ids, expected_epoch)
-        with self.library_snapshot() as (conn, _epoch, _ceiling):
-            epoch = self._library_epoch(conn, expected_epoch)
-            classes = self._classify_library_delete(conn, prompt_ids, shelf)
-            deletable = classes["deletable"]
-            return {
-                "library_epoch": epoch,
-                **classes,
-                "image_links": self._image_links(conn, classes["delete"]),
-                "fingerprints": self._fingerprints(conn, classes["delete"]),
-                # #482: Delete permanently, with the deletable prompts' pairs.
-                "review_digests": self._review_digests(conn, deletable),
-                "paired_counts": self._paired_counts(conn, deletable, prompt_ids),
-                "paired_image_links": self._distinct_images(conn, deletable),
-            }
-
-    @staticmethod
-    def _repair_hash(conn: sqlite3.Connection, prompt_id: int) -> None:
-        """Give an archived prompt its canonical hash, so ingestion finds it.
-
-        Scans, the monitor and node saves resolve prompts by hash; a stale or
-        missing one would make them insert a visible copy (Q3). When another
-        row already holds the canonical hash, lookups find that row and no new
-        copy is made, so nothing is written.
-        """
-        text, stored = conn.execute(
-            "SELECT text,hash FROM prompts WHERE id=?", (prompt_id,)
-        ).fetchone()
-        canonical = generate_prompt_hash(text) if isinstance(text, str) else None
-        if canonical is None or stored == canonical:
-            return
-        if conn.execute(
-            "SELECT 1 FROM prompts WHERE hash=? AND id!=?", (canonical, prompt_id)
-        ).fetchone():
-            return
-        conn.execute("UPDATE prompts SET hash=? WHERE id=?", (canonical, prompt_id))
-
-    def archive_or_delete_library_prompts(
-        self,
-        archive_ids: list[int],
-        delete_ids: list[int],
-        *,
-        expected_epoch: str,
-        candidates: dict | None,
-        delete_paired: dict | None = None,
-        shelf: str = "active",
-    ) -> dict:
-        """Archive and delete what the user reviewed, all or nothing.
-
-        ``archive_ids`` and ``delete_ids`` are the reviewed classes.
-        ``candidates`` maps each reviewed delete the route backed up to its
-        fingerprint then (None: every reviewed delete, unchecked; tests and
-        callers without a backup). A reviewed delete is deleted only when it
-        still classifies ``delete`` and its fingerprint is unchanged; one that
-        is now paired, and a reviewed archive now unpaired, are archived (the
-        restorable direction); anything else is kept and counted.
-
-        ``delete_paired`` (#482) maps reviewed archive ids the user chose to
-        Delete permanently to their review digest. Each is deleted with its
-        own saved pairs only while it is still deletable and its digest is
-        unchanged; otherwise it is archived and counted ``changed``.
-
-        On the archived ``shelf`` (#492) the ids are archived already: nothing
-        is archived or rewritten, every reviewed id not deleted (protected or
-        changed) counts ``changed``, and one restored since ``not_archived``.
-        """
-        on_archived_shelf = _check_shelf(shelf)
-        _validate_epoch(expected_epoch)
-        for ids in (archive_ids, delete_ids):
-            if not isinstance(ids, list) or any(
-                type(pid) is not int or not 1 <= pid <= 2**63 - 1 for pid in ids
-            ):
-                raise ValueError("prompt ids must be lists of positive integers")
-        reviewed_delete = set(delete_ids)
-        delete_paired = {} if delete_paired is None else delete_paired
-        if not isinstance(delete_paired, dict) or any(
-            type(pid) is not int
-            or not isinstance(digest, str)
-            or not _DIGEST.match(digest)
-            for pid, digest in delete_paired.items()
-        ):
-            raise ValueError("delete_paired must map prompt ids to review digests")
-        if not set(delete_paired) <= set(archive_ids):
-            raise ValueError("A permanent delete must be a reviewed archive id")
-        if not archive_ids and not delete_ids:
-            raise ValueError("Nothing to delete or archive")
-        if reviewed_delete & set(archive_ids):
-            raise ValueError("A prompt cannot be both archived and deleted")
-        prompt_ids = list(dict.fromkeys([*archive_ids, *delete_ids]))
-        with self._pair_transaction() as conn:
-            epoch = self._library_epoch(conn, expected_epoch)
-            classes = self._classify_library_delete(conn, prompt_ids, shelf)
-            now_prints = self._fingerprints(conn, classes["delete"])
-            deletes, archives, changed = [], [], 0
-            paired_now = set(classes["deletable"])
-            chosen = [pid for pid in classes["archive"] if pid in delete_paired]
-            digests = self._review_digests(
-                conn, [pid for pid in chosen if pid in paired_now]
-            )
-            paired_deletes = []
-            for pid in classes["archive"]:
-                if pid not in delete_paired:
-                    archives.append(pid)
-                elif digests.get(pid) == delete_paired[pid]:
-                    paired_deletes.append(pid)
-                else:
-                    archives.append(pid)  # changed since the review: restorable
-                    changed += 1
-            for pid in classes["delete"]:
-                if pid not in reviewed_delete:
-                    archives.append(pid)  # reviewed as archive, now unpaired
-                    changed += 1 if pid in delete_paired else 0
-                elif candidates is None or candidates.get(pid) == now_prints[pid]:
-                    deletes.append(pid)
-                else:
-                    changed += 1
-            changed += len(classes["protected"])
-            if on_archived_shelf:
-                # Already archived: the rest stay as they are, each one counted.
-                archives = []
-                changed = len(prompt_ids) - len(deletes) - len(paired_deletes)
-                changed -= len(classes["not_found"]) + len(classes["not_archived"])
-            image_links = self._image_links(conn, [*deletes, *paired_deletes])
-            now = utc_now_iso()
-            for pid in archives:
-                self._repair_hash(conn, pid)
-            conn.executemany(
-                f"INSERT INTO {ARCHIVE}(prompt_id, archived_at) VALUES (?, ?)",
-                [(pid, now) for pid in archives],
-            )
-            # A changed row is the newest edit the restore fingerprint reads.
-            conn.executemany(
-                "UPDATE prompts SET updated_at=? WHERE id=?",
-                [(now, pid) for pid in archives],
-            )
-            # #482: the image-pair links (RESTRICT) go first, then the pairs
-            # (pair tags CASCADE, review decisions SET NULL), then the prompts.
-            pairs_removed = 0
-            for chunk in _batches(paired_deletes):
-                marks = ",".join("?" for _ in chunk)
-                pairs_of = (
-                    "SELECT id FROM prompt_pairs "  # nosec B608
-                    f"WHERE positive_prompt_id IN ({marks})"
-                )
-                conn.execute(
-                    f"DELETE FROM image_prompt_pairs WHERE pair_id IN ({pairs_of})",
-                    chunk,
-                )
-                pairs_removed += conn.execute(
-                    "DELETE FROM prompt_pairs "  # nosec B608
-                    f"WHERE positive_prompt_id IN ({marks})",
-                    chunk,
-                ).rowcount
-            deleted = delete_prompt_rows(conn, [*deletes, *paired_deletes])
-            return {
-                "library_epoch": epoch,
-                "deleted": deleted,
-                "archived": len(archives),
-                "already_archived": len(classes["already_archived"]),
-                "not_archived": len(classes["not_archived"]),
-                "not_found": len(classes["not_found"]),
-                "changed": changed,
-                "image_links": image_links,
-                "pairs_removed": pairs_removed,
-            }
-
-    def restore_library_prompts(
-        self, prompt_ids: list[int], *, expected_epoch: str
-    ) -> dict:
-        """Put archived prompts back on the shelf, all or nothing.
-
-        Every requested id with an archive row is restored, whatever its
-        protection or Library parent state: restoring only un-hides it.
-        """
-        prompt_ids = self._checked_ids(prompt_ids, expected_epoch)
-        with self._pair_transaction() as conn:
-            epoch = self._library_epoch(conn, expected_epoch)
-            restored, existing = [], set()
-            for chunk in _batches(prompt_ids):
-                marks = ",".join("?" for _ in chunk)
-                for pid, archived in conn.execute(
-                    f"SELECT p.id,{_ARCHIVED} FROM prompts p "  # nosec B608
-                    f"WHERE p.id IN ({marks})",
-                    chunk,
-                ):
-                    existing.add(pid)
-                    if archived:
-                        restored.append(pid)
-            now = utc_now_iso()
-            conn.executemany(
-                f"DELETE FROM {ARCHIVE} WHERE prompt_id=?", [(pid,) for pid in restored]
-            )
-            conn.executemany(
-                "UPDATE prompts SET updated_at=? WHERE id=?",
-                [(now, pid) for pid in restored],
-            )
-            return {
-                "library_epoch": epoch,
-                "restored": len(restored),
-                "unchanged": len(existing) - len(restored),
-                "not_found": len(prompt_ids) - len(existing),
-            }

database/library_move.py

@@ -78,10 +78,6 @@ MESSAGES = {
     ),
     "same-folder": "The new folder is the node folder itself.",
     "target-invalid": "The new folder cannot hold the library.",
-    "data-dir-served": (
-        "The new folder is inside Prompt Manager's thumbnail folder. Nothing was "
-        "moved."
-    ),
     "target-has-library": (
         "The new folder already holds a Prompt Manager library. Nothing was moved."
     ),
@@ -594,7 +590,6 @@ class _Move:
             try:
                 os.rmdir(self.plan.target_dir)
             except OSError:
-                # not empty or already gone: the undo leaves it alone
                 pass
 
 

database/maintenance.py

@@ -2,8 +2,7 @@
 
 Four operations, each the native owner of a legacy ``/maintenance`` one and
 built on the same queries, so a preview counts what the legacy cleanup would
-change (``workflow_storage`` and #550's ``pair_metadata``, which fills old
-Pair prompts' empty category and tags, live in their own modules):
+change:
 
 - ``duplicate_prompts``: prompts whose text is equal ignoring case and outer
   spaces (``DUPLICATE_PROMPTS_SQL``, legacy ``cleanup_duplicates``); each
@@ -16,8 +15,6 @@ Pair prompts' empty category and tags, live in their own modules):
   ``cleanup_orphaned_images``), counted only under a source that can be read
   now, as the health check's ``missing_files`` judges them
   (``health.link_states``). It deletes database rows only, never a file.
-  It also forgets the removal marks (#480) that hide nothing any more: the
-  file is gone or changed, under a readable source (#501, ``_stale_marks``).
 
 ``preview_maintenance`` reads one snapshot on its own ``mode=ro`` connection
 (``health.readonly_uri``) and closes it in ``finally``; files are looked at
@@ -43,9 +40,7 @@ from dataclasses import dataclass, field
 from pathlib import Path
 
 from .execution_contexts import LIVE_HINT_CTES
-from .health import BATCH_ROWS, held_links, link_states, readable_roots, readonly_uri
-from .image_removal_schema import TABLE as MARKS_TABLE
-from .image_removal_schema import clear_marks, has_marks_table
+from .health import BATCH_ROWS, link_states, readable_roots, readonly_uri
 from .pairs import PairDependencyError
 from .workflow_documents import documents_of_rows, release_documents
 
@@ -61,9 +56,6 @@ MAINTENANCE_OPERATIONS = (
     "missing_links",
     # Applied as its own batched job (database/workflow_storage.py).
     "workflow_storage",
-    # #550: fill old Pair prompts' empty category and tags
-    # (database/pair_metadata_repair.py).
-    "pair_metadata",
 )
 MAX_DETAILS = 50  # detail rows a plan lists
 MAX_RESULT_ROWS = 200  # changed records an apply describes (the job lists 200)
@@ -93,12 +85,6 @@ PROTECTIONS = (
         "with Library state (a title or an explicit parent)",
         "with Library state (a title or an explicit parent)",
     ),
-    (
-        # #443: an archived prompt is restorable, never pruned.
-        "EXISTS (SELECT 1 FROM prompt_archive pa WHERE pa.prompt_id = p.id)",
-        "archived in the Library",
-        "archived in the Library",
-    ),
     (
         "p.id IN (SELECT prompt_id FROM live_hint_prompts)",
         "used by recorded runs",
@@ -107,8 +93,7 @@ PROTECTIONS = (
 )
 
 # Exempt references: images, pairs, the __protected__ tag, Library parent
-# state, the Library archive, and live recorded-run hints (computed once,
-# see LIVE_HINT_CTES).
+# state, and live recorded-run hints (computed once, see LIVE_HINT_CTES).
 ORPHANED_PROMPTS_SQL = (
     "WITH "
     + LIVE_HINT_CTES
@@ -130,16 +115,6 @@ _UNLINKED_PROTECTIONS_SQL = (
     + "), 0) FROM prompts p WHERE NOT EXISTS "
     "(SELECT 1 FROM generated_images gi WHERE gi.prompt_id = p.id)"
 )
-# Each prompt no image links to, with which protections keep it (#586); the
-# ones with none are filtered out in Python, so each predicate runs once.
-_UNLINKED_KEPT_SQL = (
-    "WITH "
-    + LIVE_HINT_CTES
-    + " SELECT p.id, "
-    + ", ".join(f"({predicate})" for predicate, _many, _one in PROTECTIONS)
-    + " FROM prompts p WHERE NOT EXISTS "
-    "(SELECT 1 FROM generated_images gi WHERE gi.prompt_id = p.id) ORDER BY p.id"
-)
 
 # Duplicate prompt groups, as the legacy cleanup finds them (case-insensitive
 # text; GROUP_CONCAT order is sorted by created_at afterwards).
@@ -169,14 +144,6 @@ _PROMPT_STATE_SQL = (
     "ORDER BY id",
 )
 
-# Why the missing-link cleanup holds a link back: (one, many) (#586).
-HELD_LINK_REASONS = {
-    "unavailable": (
-        "link under an unavailable source",
-        "links under unavailable sources",
-    ),
-    "outside": ("link outside the image sources", "links outside the image sources"),
-}
 NO_FILES_DELETED = "No image file is deleted."
 LINKS_ONLY = "Database links only; no image file is deleted."
 UNUSED_DETAIL = "No image, saved pair, Library state or recorded run uses it"
@@ -190,7 +157,6 @@ CONFLICT_REASONS = {
         "groups have their own Library titles",
     ),
 }
-PAIRED_DETAIL = "Kept: belongs to a saved pair"
 CONFLICT_DETAILS = {
     "collision": "Kept: two copies link the same image",
     "title": "Kept: a copy has its own Library title",
@@ -221,8 +187,6 @@ class MaintenanceDraft:
     protected: dict
     media: dict
     details: list = field(default_factory=list)
-    # missing_links only: locators of removal marks whose file is gone (#501).
-    marks: list = field(default_factory=list)
 
     def public(self):
         """The plan fields a response may carry (no fingerprint, no targets)."""
@@ -325,90 +289,6 @@ def _delete_ids(conn, table, ids):
     return removed
 
 
-def _mark_rows(conn, only=None):
-    """``[(locator, size, mtime_ns)]`` of the removal marks (all, or those
-    among *only*), sorted by locator."""
-    if not has_marks_table(conn):
-        return []
-    sql = f"SELECT locator, size, mtime_ns FROM {MARKS_TABLE}"  # nosec B608
-    if only is None:
-        return sorted(tuple(row) for row in conn.execute(sql))
-    found = []
-    for batch in _batches(sorted(only)):
-        found.extend(
-            tuple(row)
-            for row in conn.execute(
-                f"{sql} WHERE locator IN ({_marks(batch)})", batch  # nosec B608
-            )
-        )
-    return sorted(found)
-
-
-def _lists_something(folder):
-    """Whether *folder* holds at least one entry (an unplugged drive's mount
-    point, or an unbound volume, is an empty folder that reads fine)."""
-    try:
-        with os.scandir(folder) as entries:
-            return next(entries, None) is not None
-    except OSError:
-        return False
-
-
-def _name_listed(path):
-    """Whether *path*'s folder lists its name, compared under ``normcase``.
-
-    A locator is ``normcase``d; on a case-sensitive NTFS folder ``lstat`` of
-    the lower-cased spelling fails for a file that is there.
-    """
-    folder, name = os.path.split(path)
-    wanted = os.path.normcase(name)
-    try:
-        with os.scandir(folder) as entries:
-            return any(os.path.normcase(entry.name) == wanted for entry in entries)
-    except OSError:
-        return True  # cannot tell: keep the mark
-
-
-def _stale_mark(locator, size, mtime_ns):
-    """Whether the file of a mark is gone or has other bytes (blocking)."""
-    try:
-        info = os.lstat(locator)
-    except (FileNotFoundError, NotADirectoryError):
-        return os.path.isdir(os.path.dirname(locator)) and not _name_listed(locator)
-    except OSError:
-        return False
-    return (info.st_size, info.st_mtime_ns) != (size, mtime_ns)
-
-
-def _stale_marks(marks, roots):
-    """``[(locator, owner)]`` of the marks that hide nothing any more (#501).
-
-    *marks* are ``(locator, size, mtime_ns)`` rows. A mark is stale when its
-    file was changed, or is gone from a folder that still exists. Only marks
-    under a source that can be read now and lists something are judged (an
-    unplugged drive's marks, or its empty mount point's, stay); any doubt
-    keeps the mark. *owner* is the index of the longest source holding it.
-    Locators are ``normcase(realpath)`` paths, so the sources are too.
-    """
-    readable = readable_roots(roots)
-    prefixes = [
-        os.path.normcase(os.path.realpath(root)).rstrip("\\/") + os.sep
-        for root in roots
-    ]
-    judged = {}
-    stale = []
-    for locator, size, mtime_ns in marks:
-        owners = [i for i, prefix in enumerate(prefixes) if locator.startswith(prefix)]
-        if not owners:
-            continue  # under no source now (a source removed from the settings)
-        owner = max(owners, key=lambda i: len(prefixes[i]))
-        if owner not in judged:
-            judged[owner] = readable[owner] and _lists_something(roots[owner])
-        if judged[owner] and _stale_mark(locator, size, mtime_ns):
-            stale.append((locator, owner))
-    return stale
-
-
 def _read_snapshot(db_path, read):
     """``read(conn)`` on one ``mode=ro`` snapshot; the connection always closes."""
     conn = sqlite3.connect(readonly_uri(db_path), uri=True)
@@ -432,35 +312,6 @@ def _source_name(root, index):
     return os.path.basename(str(root).rstrip("\\/")) or f"Source {index + 1}"
 
 
-def _kept_duplicates(paired, conflicted):
-    """``{prompt_id, reasons}`` for each prompt of a group kept whole (#586).
-
-    The reasons are the review's details without "Kept: ".
-    """
-    held = [(ids, PAIRED_DETAIL) for ids in paired] + [
-        (ids, CONFLICT_DETAILS[reason]) for ids, reason in conflicted
-    ]
-    return [
-        {"prompt_id": prompt_id, "reasons": [detail.removeprefix("Kept: ")]}
-        for ids, detail in held
-        for prompt_id in ids
-    ]
-
-
-def _kept_unused(conn):
-    """``{prompt_id, reasons}`` for each prompt the unused prune keeps (#586).
-
-    The reasons are the review's, one per protection that applies, in the
-    order the plan names them.
-    """
-    kept = []
-    for row in conn.execute(_UNLINKED_KEPT_SQL):
-        reasons = [one for flag, (_p, _m, one) in zip(row[1:], PROTECTIONS) if flag]
-        if reasons:
-            kept.append({"prompt_id": row[0], "reasons": reasons})
-    return kept
-
-
 class MaintenanceOperations:
     """Mixin for PromptDatabase: maintenance previews and their apply."""
 
@@ -580,15 +431,8 @@ class MaintenanceOperations:
         if operation == "workflow_storage":
             return self._plan_workflow_storage()
         if operation == "missing_links":
-            rows, marks = _read_snapshot(
-                self.model.db_path,
-                lambda conn: (self._link_rows(conn), _mark_rows(conn)),
-            )
-            return self._plan_missing_links(rows, roots, _stale_marks(marks, roots))
-        if operation == "pair_metadata":
-            from .pair_metadata_repair import plan_pair_metadata
-
-            return _read_snapshot(self.model.db_path, plan_pair_metadata)
+            rows = _read_snapshot(self.model.db_path, self._link_rows)
+            return self._plan_missing_links(rows, roots)
         reader = (
             self._plan_duplicate_prompts
             if operation == "duplicate_prompts"
@@ -640,7 +484,7 @@ class MaintenanceOperations:
             + [
                 {
                     "label": _excerpt(texts.get(group[0])),
-                    "detail": PAIRED_DETAIL,
+                    "detail": "Kept: belongs to a saved pair",
                 }
                 for group in paired
             ]
@@ -718,34 +562,14 @@ class MaintenanceOperations:
             ],
         )
 
-    def kept_links(self, roots):
-        """``{image_path, owner, reason}`` for each link the missing-link
-        cleanup holds back under ``roots`` (blocking, reads only, no file
-        opened); ``owner`` indexes ``roots`` (None outside every source).
-
-        ``reason`` is the review's (``HELD_LINK_REASONS``), one link each.
-        """
-        roots = [str(root) for root in roots]
-        rows = _read_snapshot(self.model.db_path, self._link_rows)
-        return [
-            {
-                "image_path": row[1],
-                "owner": owner,
-                "reason": HELD_LINK_REASONS[state][0],
-            }
-            for row, owner, state in held_links(rows, roots, readable_roots(roots))
-        ]
-
     @staticmethod
-    def _links_fingerprint(candidates, stale=()):
+    def _links_fingerprint(candidates):
         fingerprint = _Fingerprint("missing_links")
         for row, owner in candidates:
             fingerprint.add([row[0], row[1], row[3], owner])
-        for locator, owner in stale:
-            fingerprint.add(["mark", locator, owner])
         return fingerprint.hexdigest()
 
-    def _plan_missing_links(self, rows, roots, stale=()):
+    def _plan_missing_links(self, rows, roots):
         readable = readable_roots(roots)
         candidates, unavailable, outside = [], 0, 0
         for row, owner, state in link_states(rows, roots, readable):
@@ -755,53 +579,47 @@ class MaintenanceOperations:
                 unavailable += 1
             elif state == "outside":
                 outside += 1
-        reasons = [
-            _plural(count, *HELD_LINK_REASONS[state])
-            for state, count in (("unavailable", unavailable), ("outside", outside))
-            if count
-        ]
-        count = len(candidates)
-        parts = []
-        if count:
-            parts.append(
-                _plural(count, "link to a missing file", "links to missing files")
-            )
-        if stale:
-            parts.append(
+        reasons = []
+        if unavailable:
+            reasons.append(
                 _plural(
-                    len(stale),
-                    "removed image whose file is gone or changed",
-                    "removed images whose files are gone or changed",
+                    unavailable,
+                    "link under an unavailable source",
+                    "links under unavailable sources",
                 )
             )
-        details = [
-            {
-                "label": _relative(row[1], roots[owner]),
-                "detail": f"{_source_name(roots[owner], owner)} · the file is missing",
-            }
-            for row, owner in candidates
-        ] + [
-            {
-                "label": _relative(locator, os.path.realpath(roots[owner])),
-                "detail": (
-                    f"{_source_name(roots[owner], owner)} · removed image, "
-                    "the file is gone or changed"
-                ),
-            }
-            for locator, owner in stale
-        ]
+        if outside:
+            reasons.append(
+                _plural(
+                    outside,
+                    "link outside the image sources",
+                    "links outside the image sources",
+                )
+            )
+        count = len(candidates)
         return MaintenanceDraft(
             operation="missing_links",
-            fingerprint=self._links_fingerprint(candidates, stale),
+            fingerprint=self._links_fingerprint(candidates),
             targets=[row[0] for row, _owner in candidates],
             scope={
-                "count": count + len(stale),
-                "label": "; ".join(parts) or "No links to missing files",
+                "count": count,
+                "label": (
+                    _plural(count, "link to a missing file", "links to missing files")
+                    if count
+                    else "No links to missing files"
+                ),
             },
             protected={"count": unavailable + outside, "reasons": reasons},
             media={"deletes_files": False, "label": LINKS_ONLY},
-            details=details[:MAX_DETAILS],
-            marks=[locator for locator, _owner in stale],
+            details=[
+                {
+                    "label": _relative(row[1], roots[owner]),
+                    "detail": (
+                        f"{_source_name(roots[owner], owner)} · the file is missing"
+                    ),
+                }
+                for row, owner in candidates[:MAX_DETAILS]
+            ],
         )
 
     def _plan_optimize(self):
@@ -851,22 +669,14 @@ class MaintenanceOperations:
 
     # ── apply ─────────────────────────────────────────────────────────
 
-    def apply_maintenance(
-        self, operation, fingerprint, targets, roots=(), marks=()
-    ) -> dict:
+    def apply_maintenance(self, operation, fingerprint, targets, roots=()) -> dict:
         """Apply a reviewed plan exactly, or raise PlanChanged (blocking).
 
         Inside ``BEGIN IMMEDIATE`` the fingerprint is computed again on the
         write connection; when it differs nothing is written. ``targets`` and
         ``roots`` are the plan's. Returns ``{changed, rows}``: how many
         records changed and up to ``MAX_RESULT_ROWS`` descriptions of them
-        (``{prompt_id[, kept_id]}`` or ``{image_path}``). ``marks`` are a
-        missing-links plan's stale removal marks; that apply also returns
-        ``marks``, how many it forgot. ``pair_metadata`` returns every filled
-        prompt, uncapped (its job keeps the complete record, #550). The
-        prompt operations also return ``kept``: every prompt the plan keeps,
-        ``{prompt_id, reasons}`` in the review's wording (#550, #586); the
-        links a missing-links plan keeps are read by ``kept_links``.
+        (``{prompt_id[, kept_id]}`` or ``{image_path}``).
         """
         if operation not in MAINTENANCE_OPERATIONS or operation == "workflow_storage":
             raise ValueError(f"Unknown maintenance operation {operation!r}")
@@ -879,24 +689,16 @@ class MaintenanceOperations:
         appliers = {
             "duplicate_prompts": self._apply_duplicate_prompts,
             "unused_components": self._apply_unused_components,
+            "missing_links": self._apply_missing_links,
         }
         with self._pair_transaction() as conn:
-            if operation == "pair_metadata":
-                from .pair_metadata_repair import apply_pair_metadata
-
-                return apply_pair_metadata(conn, fingerprint, targets)
-            if operation == "missing_links":
-                return self._apply_missing_links(
-                    conn, fingerprint, targets, roots, list(marks)
-                )
             return appliers[operation](conn, fingerprint, targets, roots)
 
     def _apply_duplicate_prompts(self, conn, fingerprint, targets, _roots):
-        groups, paired, conflicted, current = self._duplicates_fingerprint(conn)
+        groups, _paired, _conflicted, current = self._duplicates_fingerprint(conn)
         if current != fingerprint or groups != targets:
             raise PlanChanged("duplicate_prompts")
         changed, rows = 0, []
-        kept = _kept_duplicates(paired, conflicted)
         for sorted_ids in groups:
             removed, _moved = self._merge_duplicate_group(conn, sorted_ids, strict=True)
             changed += removed
@@ -904,7 +706,7 @@ class MaintenanceOperations:
                 {"prompt_id": duplicate_id, "kept_id": sorted_ids[0]}
                 for duplicate_id in sorted_ids[1:]
             )
-        return {"changed": changed, "rows": rows[:MAX_RESULT_ROWS], "kept": kept}
+        return {"changed": changed, "rows": rows[:MAX_RESULT_ROWS]}
 
     def _apply_unused_components(self, conn, fingerprint, targets, _roots):
         ids, current = self._unused_fingerprint(conn)
@@ -916,9 +718,9 @@ class MaintenanceOperations:
             {"prompt_id": prompt_id, "text": _excerpt(texts.get(prompt_id))}
             for prompt_id in ids[:MAX_RESULT_ROWS]
         ]
-        return {"changed": changed, "rows": rows, "kept": _kept_unused(conn)}
+        return {"changed": changed, "rows": rows}
 
-    def _apply_missing_links(self, conn, fingerprint, targets, roots, marks):
+    def _apply_missing_links(self, conn, fingerprint, targets, roots):
         rows = []
         for batch in _batches(sorted(targets)):
             rows.extend(
@@ -935,14 +737,10 @@ class MaintenanceOperations:
             if state != "missing":  # back, or its source went away
                 raise PlanChanged("missing_links")
             candidates.append((row, owner))
-        stale = _stale_marks(_mark_rows(conn, marks) if marks else [], roots)
-        if [locator for locator, _owner in stale] != marks:  # a mark went or is valid
-            raise PlanChanged("missing_links")
-        if self._links_fingerprint(candidates, stale) != fingerprint:
+        if self._links_fingerprint(candidates) != fingerprint:
             raise PlanChanged("missing_links")
         changed = _delete_ids(conn, "generated_images", [row[0] for row in rows])
         return {
             "changed": changed,
-            "marks": clear_marks(conn, marks),
             "rows": [{"image_path": row[1]} for row in rows[:MAX_RESULT_ROWS]],
         }

database/managed_connection.py

@@ -35,51 +35,38 @@ from __future__ import annotations
 
 import contextlib
 import logging
-import operator
-import sys
 import threading
 import time
 import weakref
-from collections import deque
-from typing import Any, Callable, Iterable, Iterator, List, Optional
+from typing import Iterable, Iterator, List, Optional
 
 import sqlite3
 
 CLOSED_MESSAGE = "Cannot operate on a closed database."
 # Rows fetched per step when a cursor is iterated: the connection is marked
 # in use once per chunk instead of once per row (iteration costs about what
-# a plain cursor costs). Prefetched rows belong to the cursor so iteration
-# and explicit fetches always advance the same position.
+# a plain cursor costs). A loop that stops early leaves up to this many rows
+# fetched; ``fetchone``/``fetchmany`` after a partial loop skip them.
 ITER_CHUNK = 128
 
 
 class ManagedCursor(sqlite3.Cursor):
     """A cursor whose calls into SQLite count as its connection being in use."""
 
-    def __init__(self, *args: Any, **kwargs: Any) -> None:
-        super().__init__(*args, **kwargs)
-        self._pending = deque()
-        self._closed = False
-
     def execute(self, sql, parameters=(), /):
-        return self._run_statement(super().execute, sql, parameters)
-
-    def executemany(self, sql, seq_of_parameters, /):
-        return self._run_statement(super().executemany, sql, seq_of_parameters)
-
-    def _run_statement(self, operation: Callable, *args: Any) -> ManagedCursor:
         conn = self.connection
         conn._enter()
-        description = self.description
-        completed = False
         try:
-            result = operation(*args)
-            completed = True
-            return result
+            return super().execute(sql, parameters)
+        finally:
+            conn._leave()
+
+    def executemany(self, sql, seq_of_parameters, /):
+        conn = self.connection
+        conn._enter()
+        try:
+            return super().executemany(sql, seq_of_parameters)
         finally:
-            # Argument parsing can fail before SQLite replaces the old statement.
-            if completed or self.description is not description:
-                self._pending.clear()
             conn._leave()
 
     def executescript(self, sql_script, /):
@@ -94,8 +81,6 @@ class ManagedCursor(sqlite3.Cursor):
         conn = self.connection
         conn._enter()
         try:
-            if self._pending and not self._closed:
-                return self._pending.popleft()
             return super().fetchone()
         finally:
             conn._leave()
@@ -104,20 +89,7 @@ class ManagedCursor(sqlite3.Cursor):
         conn = self.connection
         conn._enter()
         try:
-            # Let SQLite validate the original arguments, including version-specific
-            # handling of zero/negative sizes, before touching prefetched rows.
-            rows = super().fetchmany(*args, **kwargs)
-            if not self._pending:
-                return rows
-            size = operator.index(
-                kwargs.get("size", args[0] if args else self.arraysize)
-            )
-            # Python 3.12 reads all rows for size=0; 3.13+ reads none.
-            if size == 0 and sys.version_info >= (3, 13):
-                return rows
-            self._pending.extend(rows)
-            count = len(self._pending) if size <= 0 else min(size, len(self._pending))
-            return [self._pending.popleft() for _ in range(count)]
+            return super().fetchmany(*args, **kwargs)
         finally:
             conn._leave()
 
@@ -125,31 +97,25 @@ class ManagedCursor(sqlite3.Cursor):
         conn = self.connection
         conn._enter()
         try:
-            rows = super().fetchall()
-            pending = list(self._pending)
-            self._pending.clear()
-            return pending + rows
+            return super().fetchall()
         finally:
             conn._leave()
 
     def __iter__(self) -> Iterator:
-        return self
+        return self._chunks()
+
+    def _chunks(self) -> Iterator:
+        while True:
+            rows = self.fetchmany(ITER_CHUNK)
+            if not rows:
+                return
+            yield from rows
 
     def __next__(self):
         conn = self.connection
-        pending = self._pending
-        # Buffered Python rows need no SQLite lock, but retirement and cursor
-        # close must still stop an iterator obtained before either operation.
-        if conn._retired or self._closed:
-            raise sqlite3.ProgrammingError(CLOSED_MESSAGE)
-        if pending:
-            return pending.popleft()
         conn._enter()
         try:
-            pending.extend(super().fetchmany(ITER_CHUNK))
-            if not pending:
-                raise StopIteration
-            return pending.popleft()
+            return super().__next__()
         finally:
             conn._leave()
 
@@ -160,10 +126,7 @@ class ManagedCursor(sqlite3.Cursor):
         except sqlite3.ProgrammingError:
             return super().close()  # the connection is closed or closing
         try:
-            result = super().close()
-            self._pending = deque()
-            self._closed = True
-            return result
+            return super().close()
         finally:
             conn._leave()
 
@@ -330,9 +293,6 @@ class ManagedConnection(sqlite3.Connection):
             cursors = list(self._cursors)
         try:
             for cursor in cursors:
-                if isinstance(cursor, ManagedCursor):
-                    cursor._pending = deque()
-                    cursor._closed = True
                 with contextlib.suppress(sqlite3.Error):
                     sqlite3.Cursor.close(cursor)
             super().close()

database/models.py

@@ -44,8 +44,6 @@ try:
 except ImportError:
     from utils.hashing import register_prompt_functions
 from .image_categories import image_categories_schema_error, migrate_image_categories
-from .image_removal_schema import image_removals_schema_error, migrate_image_removals
-from .prompt_archive import migrate_prompt_archive, prompt_archive_schema_error
 from .workflow_documents import (
     DOCUMENT_ID_COLUMNS,
     migrate_workflow_documents,
@@ -368,10 +366,6 @@ class PromptModel:
         migrate_autotag_state(conn)
         # Image categories (#332): independent of every table above.
         migrate_image_categories(conn)
-        # The Library parent archive (#443): independent of every table above.
-        migrate_prompt_archive(conn)
-        # Removal marks (#480): independent of every table above.
-        migrate_image_removals(conn)
         # Last: the older generated_images rebuilds run only before file_path.
         migrate_workflow_documents(conn)
 
@@ -1248,16 +1242,6 @@ class PromptModel:
             )
             if categories_error:
                 return False, categories_error
-            archive_error = prompt_archive_schema_error(
-                conn, allow_missing=not require_library_state
-            )
-            if archive_error:
-                return False, archive_error
-            removals_error = image_removals_schema_error(
-                conn, allow_missing=not require_library_state
-            )
-            if removals_error:
-                return False, removals_error
             views_error = saved_views_schema_error(
                 conn, allow_missing=not require_library_state
             )

database/operations.py

@@ -18,14 +18,12 @@ from .models import PromptModel, normalize_image_path, utc_now_iso
 from .pairs import PairDependencyError, PairOperations  # noqa: F401 (re-exported)
 from .library import LibraryOperations, titled
 from .image_favorites import ImageFavoriteOperations
-from .image_removal import ImageRemovalOperations, removed_from_library
 from .image_collections import ImageCollectionOperations
 from .annotations import AnnotationOperations
 from .review import ReviewOperations
 from .review_decisions import ReviewDecisionOperations
 from .saved_views import SavedViewOperations
 from .library_commands import LibraryCommandOperations
-from .library_archive import LibraryArchiveOperations, delete_prompt_rows
 from .vocabulary import VocabularyOperations
 from .execution_history import ExecutionHistoryOperations
 from .execution_contexts import ExecutionContextOperations
@@ -34,7 +32,7 @@ from .history_reads import HistoryReadOperations
 from .health import HealthOperations, iter_consistency_issues
 from .duplicate_copies import DuplicateCopyOperations
 from .workflow_storage import WorkflowStorageOperations
-from .category_import import CategoryImportOperations
+from .category_import import CategoryImportOperations, EmptyReplacement  # noqa: F401
 from .image_categories import ImageCategoryOperations
 from .workflow_documents import (
     DocumentReader,
@@ -450,7 +448,6 @@ class PromptDatabase(
     PairOperations,
     LibraryOperations,
     LibraryCommandOperations,
-    LibraryArchiveOperations,
     VocabularyOperations,
     ExecutionHistoryOperations,
     ExecutionContextOperations,
@@ -468,7 +465,6 @@ class PromptDatabase(
     WorkflowStorageOperations,
     CategoryImportOperations,
     ImageCategoryOperations,
-    ImageRemovalOperations,
 ):
     """Database operations class for managing prompts."""
 
@@ -1810,11 +1806,6 @@ class PromptDatabase(
         """
         if not isinstance(metadata, dict):
             metadata = {}
-        if removed_from_library(conn, image_path):
-            # #480: the user removed this exact file from the library; its
-            # bytes are unchanged, so nothing links it again.
-            self.logger.debug("Not linking a file removed from the library")
-            return 0
         filename = os.path.basename(image_path)
         file_path = normalize_image_path(image_path)
         file_size, width, height, image_format = _coerce_file_info(metadata)
@@ -2353,10 +2344,16 @@ class PromptDatabase(
         Returns:
             Number of prompts actually deleted.
         """
+        count = 0
         with self._pair_transaction() as conn:
             self._ensure_prompts_unpaired(conn, prompt_ids)
-            # The workspace Library's delete runs the same statements (#443).
-            count = delete_prompt_rows(conn, list(dict.fromkeys(prompt_ids)))
+            documents = documents_of_rows(conn, "prompt_id", prompt_ids)
+            for pid in prompt_ids:
+                conn.execute("DELETE FROM generated_images WHERE prompt_id = ?", (pid,))
+                cursor = conn.execute("DELETE FROM prompts WHERE id = ?", (pid,))
+                if cursor.rowcount > 0:
+                    count += 1
+            release_documents(conn, documents)
             conn.commit()
         return count
 

database/pair_metadata_repair.py

@@ -1,452 +0,0 @@
-"""Pair category and tags repair (#550): the ``pair_metadata`` maintenance plan.
-
-Before #546 a Pair node run saved its category and tags on the saved pair
-only; the positive prompt it created stayed Uncategorized and untagged. This
-plan fills the **empty** category and the **empty** tag set of those prompts
-from their saved pairs (``docs/egm/post-3.4.1/550-design.md``):
-
-- Considered: prompts the Pair node created as a positive (their earliest
-  pair, in either role, has them as the positive and its ``created_at`` is
-  within ``PAIR_CREATED_TOLERANCE`` of theirs) whose category is blank
-  and/or that have no tags.
-- Sources: the prompt's non-archived pairs where it is the positive. Pairs
-  with a blank category or no tags are ignored for that field. A field fills
-  when exactly one value remains (category: trimmed, case-sensitive; tags:
-  the tag-id set).
-- Kept (protected), in this order: archived prompt, edited prompt
-  (``updated_at`` not within the tolerance of ``created_at``), pairs that
-  disagree, a tag set over ``MAX_LIBRARY_TAGS``.
-
-The apply runs in the caller's ``BEGIN IMMEDIATE`` transaction, recomputes
-the fingerprint, then writes guarded statements (the field must still be
-empty) that never touch a pair, a negative or ``updated_at``. A guard that
-hits nothing raises ``PlanChanged`` so the whole transaction rolls back.
-"""
-
-import datetime
-
-from . import maintenance as _maintenance
-from .library_commands import MAX_LIBRARY_TAGS
-from .maintenance import (
-    MAX_DETAILS,
-    MaintenanceDraft,
-    PlanChanged,
-    _excerpt,
-    _Fingerprint,
-    _marks,
-    _plural,
-)
-
-OPERATION = "pair_metadata"
-# Seconds: the Pair save stamps its new prompt and its pair with separate
-# utc_now_iso() calls in one transaction (microseconds apart).
-PAIR_CREATED_TOLERANCE = 2.0
-# Fill prompts one plan applies; the rest are applied by the next review.
-# Bounds the complete record a job keeps in memory (about 100 bytes a row).
-MAX_PLAN_FILLS = 20000
-DETAIL_VALUES = 3
-DETAIL_TAGS = 5
-MEDIA_LABEL = "No image file or saved pair is changed."
-EMPTY_LABEL = "No Pair prompts are missing a category or tags"
-RECORD_NOTE = (
-    "The job's report lists every filled field. Download it to keep it: "
-    "Activity forgets jobs after a restart."
-)
-# Protected classes in precedence order: (key, detail, reason one, many).
-EDITED_DETAIL = (
-    "Kept: edited after it was saved; its empty category or tags may be intentional"
-)
-PROTECTED = (
-    (
-        "archived",
-        "Kept: archived in the Library",
-        "archived in the Library",
-        "archived in the Library",
-    ),
-    (
-        "edited",
-        EDITED_DETAIL,
-        "edited after it was saved",
-        "edited after they were saved",
-    ),
-    ("conflict", None, "where pairs disagree", "where pairs disagree"),
-    (
-        "too-many-tags",
-        f"Kept: its pair has more than {MAX_LIBRARY_TAGS} tags",
-        f"whose pair has more than {MAX_LIBRARY_TAGS} tags",
-        f"whose pair has more than {MAX_LIBRARY_TAGS} tags",
-    ),
-)
-_PROTECTED_ORDER = [key for key, *_rest in PROTECTED]
-# Detail rows: what the user can act on (a conflict) first.
-DETAIL_ORDER = ("conflict", "edited", "archived", "too-many-tags")
-
-_CANDIDATES_SQL = """
-    SELECT p.id, p.hash, p.text, p.created_at, p.updated_at,
-           COALESCE(TRIM(p.category), '') = '' AS blank_category,
-           NOT EXISTS (SELECT 1 FROM prompt_tags pt WHERE pt.prompt_id = p.id)
-               AS untagged,
-           EXISTS (SELECT 1 FROM prompt_archive pa WHERE pa.prompt_id = p.id)
-               AS archived,
-           (SELECT CASE WHEN pp.positive_prompt_id = p.id
-                        THEN pp.created_at END
-              FROM prompt_pairs pp
-             WHERE pp.positive_prompt_id = p.id OR pp.negative_prompt_id = p.id
-             ORDER BY pp.id LIMIT 1) AS first_pair_at
-      FROM prompts p
-     WHERE EXISTS (SELECT 1 FROM prompt_pairs pp WHERE pp.positive_prompt_id = p.id)
-       AND (COALESCE(TRIM(p.category), '') = ''
-            OR NOT EXISTS (SELECT 1 FROM prompt_tags pt WHERE pt.prompt_id = p.id))
-     ORDER BY p.id
-"""
-_SOURCES_SQL = (
-    "SELECT id, positive_prompt_id, TRIM(COALESCE(category, '')) FROM prompt_pairs "
-    "WHERE archived = 0 AND positive_prompt_id IN ({marks}) ORDER BY id"
-)
-_PAIR_TAGS_SQL = (
-    "SELECT ppt.pair_id, t.id, t.name FROM prompt_pair_tags ppt "
-    "JOIN tags t ON t.id = ppt.tag_id WHERE ppt.pair_id IN ({marks}) "
-    "ORDER BY ppt.pair_id, t.id"
-)
-
-
-def parse_stamp(value):
-    """A stored timestamp as an aware UTC datetime, or None when unreadable."""
-    if not isinstance(value, str) or not value.strip():
-        return None
-    try:
-        stamp = datetime.datetime.fromisoformat(value.strip())
-    except ValueError:
-        return None
-    if stamp.tzinfo is None:
-        stamp = stamp.replace(tzinfo=datetime.timezone.utc)
-    return stamp
-
-
-def _close(first, second):
-    """Whether two stored stamps parse and lie within the tolerance."""
-    a, b = parse_stamp(first), parse_stamp(second)
-    if a is None or b is None:
-        return False
-    return abs((a - b).total_seconds()) <= PAIR_CREATED_TOLERANCE
-
-
-def _batches(ids):
-    size = _maintenance.ID_BATCH
-    for start in range(0, len(ids), size):
-        yield ids[start : start + size]
-
-
-def _sources(conn, ids):
-    """``{prompt_id: [(pair_id, category, ((tag_id, name), ...)), ...]}``."""
-    pairs = {}
-    for batch in _batches(ids):
-        for pair_id, prompt_id, category in conn.execute(
-            _SOURCES_SQL.format(marks=_marks(batch)), batch
-        ):
-            pairs.setdefault(prompt_id, []).append([pair_id, category, []])
-    by_pair = {pair[0]: pair for group in pairs.values() for pair in group}
-    pair_ids = sorted(by_pair)
-    for batch in _batches(pair_ids):
-        for pair_id, tag_id, name in conn.execute(
-            _PAIR_TAGS_SQL.format(marks=_marks(batch)), batch
-        ):
-            by_pair[pair_id][2].append((tag_id, name))
-    return {
-        prompt_id: [(pid, category, tuple(tags)) for pid, category, tags in group]
-        for prompt_id, group in pairs.items()
-    }
-
-
-def _field(values, guard):
-    """``(class, value)`` of one field from its distinct values, or None."""
-    if not values:
-        return None
-    if guard:
-        return (guard, None)
-    if len(values) > 1:
-        return ("conflict", sorted(values))
-    return ("fill", next(iter(values)))
-
-
-def _classify(row, sources):
-    """The result of one considered prompt, or None when nothing applies."""
-    guard = None
-    if row["archived"]:
-        guard = "archived"
-    elif not _close(row["updated_at"], row["created_at"]):
-        guard = "edited"
-    category = tags = None
-    tag_pair = None
-    if row["blank_category"]:
-        category = _field({c for _p, c, _t in sources if c}, guard)
-    if row["untagged"]:
-        sets = {}
-        for pair_id, _category, pair_tags in sources:
-            if pair_tags:
-                sets.setdefault(frozenset(pair_tags), pair_id)
-        tags = _field(set(sets), guard)
-        if tags and tags[0] == "fill":
-            tag_pair = sets[tags[1]]
-            if len(tags[1]) > MAX_LIBRARY_TAGS:
-                tags = ("too-many-tags", None)
-            else:
-                tags = ("fill", tuple(sorted(tags[1])))
-        elif tags and tags[0] == "conflict":
-            tags = ("conflict", [sorted(s) for s in sorted(sets, key=sorted)])
-    if category is None and tags is None:
-        return None
-    return {
-        "id": row["id"],
-        "hash": row["hash"],
-        "text": row["text"],
-        "category": category,
-        "tags": tags,
-        "tag_pair": tag_pair if tags and tags[0] == "fill" else None,
-        "pairs": [pair_id for pair_id, _c, _t in sources],
-    }
-
-
-def _state(conn):
-    """``(results, fingerprint)``: every considered prompt's result, by id."""
-    considered = []
-    for row in conn.execute(_CANDIDATES_SQL):
-        row = dict(
-            zip(
-                (
-                    "id",
-                    "hash",
-                    "text",
-                    "created_at",
-                    "updated_at",
-                    "blank_category",
-                    "untagged",
-                    "archived",
-                    "first_pair_at",
-                ),
-                tuple(row),
-            )
-        )
-        if _close(row["created_at"], row["first_pair_at"]):
-            considered.append(row)
-    sources = _sources(conn, [row["id"] for row in considered])
-    fingerprint = _Fingerprint(OPERATION)
-    results = []
-    for row in considered:
-        result = _classify(row, sources.get(row["id"], []))
-        if result is None:
-            continue
-        results.append(result)
-        fingerprint.add(
-            [
-                result["id"],
-                result["hash"],
-                result["category"],
-                result["tags"],
-                result["tag_pair"],
-                result["pairs"],
-            ]
-        )
-    return results, fingerprint.hexdigest()
-
-
-def _fills(result):
-    return (
-        bool(result["category"] and result["category"][0] == "fill"),
-        bool(result["tags"] and result["tags"][0] == "fill"),
-    )
-
-
-def _targets(results):
-    targets = []
-    for result in results:
-        category, tags = _fills(result)
-        if category or tags:
-            targets.append([result["id"], category, tags])
-    return targets[:MAX_PLAN_FILLS]
-
-
-def _protected_classes(result):
-    """The protected classes of a result's fields, in precedence order."""
-    found = {
-        field[0]
-        for field in (result["category"], result["tags"])
-        if field and field[0] != "fill"
-    }
-    return [key for key in _PROTECTED_ORDER if key in found]
-
-
-def _more(values, limit):
-    shown = ", ".join(values[:limit])
-    return shown + (", …" if len(values) > limit else "")
-
-
-def _fill_detail(result):
-    parts = []
-    category, tags = _fills(result)
-    if category:
-        parts.append(f"category “{result['category'][1]}”")
-    if tags:
-        names = sorted(name for _id, name in result["tags"][1])
-        noun = "tag" if len(names) == 1 else "tags"
-        parts.append(f"{len(names)} {noun}: {_more(names, DETAIL_TAGS)}")
-    pairs = [str(pair_id) for pair_id in result["pairs"]]
-    label = "pair" if len(pairs) == 1 else "pairs"
-    return f"Fills {' and '.join(parts)} ({label} {_more(pairs, DETAIL_VALUES)})"
-
-
-def _protected_detail(result, key):
-    if key != "conflict":
-        return next(detail for k, detail, *_r in PROTECTED if k == key)
-    if result["category"] and result["category"][0] == "conflict":
-        values = result["category"][1]
-        return f"Kept: pairs disagree on category: {_more(values, DETAIL_VALUES)}"
-    return "Kept: pairs disagree on tags"
-
-
-def _kept(results):
-    """One row per kept prompt, its review reasons without "Kept: " (#550)."""
-    rows = []
-    for result in results:
-        classes = set(_protected_classes(result))
-        if classes:
-            rows.append(
-                {
-                    "prompt_id": result["id"],
-                    "reasons": [
-                        _protected_detail(result, key).removeprefix("Kept: ")
-                        for key in DETAIL_ORDER
-                        if key in classes
-                    ],
-                }
-            )
-    return rows
-
-
-def _details(results, targets):
-    rows = []
-    for key in DETAIL_ORDER:
-        for result in results:
-            if key in _protected_classes(result):
-                rows.append(
-                    {
-                        "label": _excerpt(result["text"]),
-                        "detail": _protected_detail(result, key),
-                    }
-                )
-    planned = {target[0] for target in targets}
-    for result in results:
-        if result["id"] in planned:
-            rows.append(
-                {"label": _excerpt(result["text"]), "detail": _fill_detail(result)}
-            )
-    if not targets:
-        return rows[:MAX_DETAILS]
-    return rows[: MAX_DETAILS - 1] + [{"label": "Record", "detail": RECORD_NOTE}]
-
-
-def _scope_label(targets, total):
-    if not targets:
-        return EMPTY_LABEL
-    categories = sum(1 for _id, category, _tags in targets if category)
-    tag_sets = sum(1 for _id, _category, tags in targets if tags)
-    label = (
-        f"{_plural(len(targets), 'prompt')} to fill: "
-        f"{_plural(categories, 'category', 'categories')}, "
-        f"{_plural(tag_sets, 'tag set')}"
-    )
-    if total > len(targets):
-        label += (
-            f" (the first {len(targets):,} of {total:,}; review again for the rest)"
-        )
-    return label
-
-
-def plan_pair_metadata(conn):
-    """The reviewed ``pair_metadata`` plan on ``conn``'s snapshot."""
-    results, fingerprint = _state(conn)
-    targets = _targets(results)
-    total = sum(1 for result in results if any(_fills(result)))
-    counts = {key: 0 for key in _PROTECTED_ORDER}
-    held = 0
-    for result in results:
-        classes = _protected_classes(result)
-        held += bool(classes)
-        for key in classes:
-            counts[key] += 1
-    reasons = [
-        f"{counts[key]:,} {one if counts[key] == 1 else many}"
-        for key, _detail, one, many in PROTECTED
-        if counts[key]
-    ]
-    return MaintenanceDraft(
-        operation=OPERATION,
-        fingerprint=fingerprint,
-        targets=targets,
-        scope={"count": len(targets), "label": _scope_label(targets, total)},
-        protected={"count": held, "reasons": reasons},
-        media={"deletes_files": False, "label": MEDIA_LABEL},
-        details=_details(results, targets),
-    )
-
-
-def _fill_categories(conn, fills):
-    """Set each blank category; raises PlanChanged when one is no longer blank."""
-    cursor = conn.executemany(
-        "UPDATE prompts SET category = ? WHERE id = ? "
-        "AND COALESCE(TRIM(category), '') = ''",
-        fills,
-    )
-    if cursor.rowcount != len(fills):
-        raise PlanChanged(OPERATION)
-
-
-def _fill_tags(conn, fills, expected):
-    """Copy each source pair's tags onto its untagged prompt."""
-    cursor = conn.executemany(
-        "INSERT INTO prompt_tags(prompt_id, tag_id) "
-        "SELECT ?, ppt.tag_id FROM prompt_pair_tags ppt "
-        "JOIN tags t ON t.id = ppt.tag_id WHERE ppt.pair_id = ? "
-        "AND NOT EXISTS (SELECT 1 FROM prompt_tags WHERE prompt_id = ?)",
-        fills,
-    )
-    if cursor.rowcount != expected:
-        raise PlanChanged(OPERATION)
-
-
-def apply_pair_metadata(conn, fingerprint, targets):
-    """Apply the reviewed fills on ``conn`` (inside BEGIN IMMEDIATE).
-
-    Returns ``{changed, categories, tag_sets, rows, kept}``; ``rows`` lists
-    every filled prompt (``{prompt_id, category?, tags?}``) and ``kept`` every
-    prompt the plan keeps (``{prompt_id, reasons}``, in the review's wording
-    and order), both never capped.
-    """
-    results, current = _state(conn)
-    if current != fingerprint or _targets(results) != targets:
-        raise PlanChanged(OPERATION)
-    by_id = {result["id"]: result for result in results}
-    categories, tags, rows = [], [], []
-    tag_count = 0
-    for prompt_id, fill_category, fill_tags in targets:
-        result = by_id[prompt_id]
-        row = {"prompt_id": prompt_id}
-        if fill_category:
-            row["category"] = result["category"][1]
-            categories.append((row["category"], prompt_id))
-        if fill_tags:
-            row["tags"] = sorted(name for _id, name in result["tags"][1])
-            tags.append((prompt_id, result["tag_pair"], prompt_id))
-            tag_count += len(result["tags"][1])
-        rows.append(row)
-    if categories:
-        _fill_categories(conn, categories)
-    if tags:
-        _fill_tags(conn, tags, tag_count)
-    return {
-        "changed": len(rows),
-        "categories": len(categories),
-        "tag_sets": len(tags),
-        "rows": rows,
-        "kept": _kept(results),
-    }

database/pairs.py

@@ -112,14 +112,8 @@ class PairOperations:
         tags: Optional[List[str]] = None,
         rating: Optional[int] = None,
         notes: Optional[str] = None,
-        fill_new_positive: bool = False,
     ) -> int:
-        """Save an ordered pair atomically; repeat saves preserve its metadata.
-
-        ``fill_new_positive`` also gives the positive prompt the category and
-        tags, only if this save inserted its row (#546). An existing prompt
-        never changes, so a cleared category stays cleared.
-        """
+        """Save an ordered pair atomically; repeat saves preserve its metadata."""
         with self._pair_transaction() as conn:
             return self._save_pair(
                 conn,
@@ -130,7 +124,6 @@ class PairOperations:
                 tags=tags,
                 rating=rating,
                 notes=notes,
-                fill_new_positive=fill_new_positive,
             )
 
     def _save_pair(
@@ -144,7 +137,6 @@ class PairOperations:
         tags: Optional[List[str]] = None,
         rating: Optional[int] = None,
         notes: Optional[str] = None,
-        fill_new_positive: bool = False,
     ) -> int:
         """Save an ordered pair atomically; repeat saves preserve its metadata."""
         if not isinstance(positive_text, str) or not positive_text.strip():
@@ -152,13 +144,8 @@ class PairOperations:
         if not isinstance(negative_text, str):
             raise ValueError("Negative prompt text must be a string; use '' for empty")
         # Validate metadata before any component insertion.
-        tags = _validate_metadata(title, category, tags, rating, notes)
-        positive, created = self._pair_component_outcome(conn, positive_text)
-        if created and fill_new_positive:
-            conn.execute(
-                "UPDATE prompts SET category = ? WHERE id = ?", (category, positive)
-            )
-            self._sync_prompt_tags(conn, positive, tags or [])
+        _validate_metadata(title, category, tags, rating, notes)
+        positive = self._pair_component(conn, positive_text)
         negative = (
             self._pair_component(conn, negative_text) if negative_text.strip() else None
         )

database/prompt_archive.py

@@ -1,107 +0,0 @@
-"""Library parent archive (#443, D152): prompts hidden from the shelf, restorable.
-
-A row means the Library parent is archived; no row means it is on the shelf.
-Nothing else about the prompt changes: its text, metadata, tags, run count,
-image links, pairs and recorded runs stay. Restore deletes the row. Deleting
-the prompt (any path) drops the row by cascade.
-
-A table of its own, not a column: ``prompt_library_state`` is validated by its
-exact definition, so a new column there would make older builds refuse the
-upgraded database, while older builds ignore an unknown table (they show the
-archived prompts again and keep the rows). Optional in old backups, required
-once a database is current.
-"""
-
-import re
-import sqlite3
-
-TABLE = "prompt_archive"
-MAX_STAMP_BYTES = 64
-# What ``utc_now_iso`` writes starts with a date; anything else was not written here.
-_STAMP_GLOB = "[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]T*"
-_DDL = (
-    f"CREATE TABLE {TABLE} (prompt_id INTEGER PRIMARY KEY, "
-    "archived_at TEXT NOT NULL, "
-    "FOREIGN KEY(prompt_id) REFERENCES prompts(id) ON DELETE CASCADE)"
-)
-_COLUMNS = (("prompt_id", "INTEGER", 0, 1), ("archived_at", "TEXT", 1, 0))
-_FOREIGN_KEYS = {("prompt_id", "prompts", "id", "CASCADE")}
-# A predicate on ``p`` (the prompts alias): the parent is not archived.
-SHELVED = f"NOT EXISTS(SELECT 1 FROM {TABLE} pa WHERE pa.prompt_id=p.id)"
-ARCHIVED = f"EXISTS(SELECT 1 FROM {TABLE} pa WHERE pa.prompt_id=p.id)"
-
-
-def _compact(sql: str) -> str:
-    return re.sub(r"\s+", "", sql or "").lower()
-
-
-def _structure_error(conn: sqlite3.Connection, allow_missing: bool) -> str | None:
-    objects = conn.execute(
-        "SELECT type,sql FROM sqlite_master WHERE name=? "
-        "OR (type IN ('index','trigger') AND tbl_name=?)",
-        (TABLE, TABLE),
-    ).fetchall()
-    if not objects:
-        return None if allow_missing else "Missing prompt archive schema"
-    tables = [sql for kind, sql in objects if kind == "table"]
-    if len(tables) != 1 or len(objects) != 1:
-        return "Prompt archive name is reserved by an unsupported schema object"
-    if _compact(tables[0]) != _compact(_DDL):
-        return "Prompt archive has an invalid table definition"
-    columns = tuple(
-        (row[1], row[2].upper(), row[3], row[5])
-        for row in conn.execute(f"PRAGMA table_info({TABLE})")
-    )
-    if columns != _COLUMNS:
-        return "Prompt archive has invalid columns"
-    foreign_keys = {
-        (row[3], row[2], row[4], row[6])
-        for row in conn.execute(f"PRAGMA foreign_key_list({TABLE})")
-    }
-    if foreign_keys != _FOREIGN_KEYS:
-        return "Prompt archive has invalid foreign key definitions"
-    return None
-
-
-def prompt_archive_schema_error(
-    conn: sqlite3.Connection, *, allow_missing: bool = True
-) -> str | None:
-    """Reject an unsupported archive schema or values; reads only.
-
-    A missing table is acceptable for backups that predate it unless
-    ``allow_missing`` is false.
-    """
-    error = _structure_error(conn, allow_missing)
-    if error is not None:
-        return error
-    if not conn.execute(
-        "SELECT 1 FROM sqlite_master WHERE type='table' AND name=?", (TABLE,)
-    ).fetchone():
-        return None
-    if conn.execute(f"PRAGMA foreign_key_check({TABLE})").fetchone():
-        return "Prompt archive contains foreign key violations"
-    if conn.execute(
-        f"SELECT 1 FROM {TABLE} WHERE typeof(archived_at)!='text' "  # nosec B608
-        f"OR length(CAST(archived_at AS BLOB))>{MAX_STAMP_BYTES} "
-        f"OR archived_at NOT GLOB '{_STAMP_GLOB}' LIMIT 1"
-    ).fetchone():
-        return "Prompt archive contains invalid values"
-    return None
-
-
-def migrate_prompt_archive(conn: sqlite3.Connection) -> None:
-    """Install the table atomically; validate before and after (no backfill)."""
-    conn.execute("SAVEPOINT prompt_archive_schema")
-    try:
-        error = _structure_error(conn, True)
-        if error:
-            raise sqlite3.DatabaseError(error)
-        conn.execute(_DDL.replace("CREATE TABLE", "CREATE TABLE IF NOT EXISTS", 1))
-        error = _structure_error(conn, False)
-        if error:
-            raise sqlite3.DatabaseError(error)
-        conn.execute("RELEASE prompt_archive_schema")
-    except BaseException:
-        conn.execute("ROLLBACK TO prompt_archive_schema")
-        conn.execute("RELEASE prompt_archive_schema")
-        raise

database/restore_stage.py

@@ -149,7 +149,6 @@ def library_summary(conn: sqlite3.Connection) -> Dict[str, int]:
     collections (#331).
     """
     from .library import _ELIGIBLE
-    from .prompt_archive import SHELVED, TABLE as ARCHIVE
 
     has_state = conn.execute(
         "SELECT 1 FROM sqlite_master WHERE type='table' AND "
@@ -158,15 +157,9 @@ def library_summary(conn: sqlite3.Connection) -> Dict[str, int]:
     has_pairs = conn.execute(
         "SELECT 1 FROM sqlite_master WHERE type='table' AND name='prompt_pairs'"
     ).fetchone()
-    has_archive = conn.execute(
-        "SELECT 1 FROM sqlite_master WHERE type='table' AND name=?", (ARCHIVE,)
-    ).fetchone()
     if has_state and has_pairs:
-        # Archived parents (#443) are off the shelf, as in library_counts.
         positives = conn.execute(
-            "SELECT COUNT(*) FROM prompts p WHERE "
-            + _ELIGIBLE
-            + (" AND " + SHELVED if has_archive else "")
+            "SELECT COUNT(*) FROM prompts p WHERE " + _ELIGIBLE
         ).fetchone()[0]
     else:
         positives = _count(conn, "prompts")

database/review_decisions.py

@@ -5,12 +5,8 @@ A decision is one row of ``media_review_decisions`` for one item revision.
 ingester's compatible-only rules (``_ingest_resolved_pair_in``) in the same
 ``_pair_transaction`` as the decision row, the item's new state and revision
 and the review index revision; any conflict or later failure rolls all of it
-back. ``manual`` (#536) is the same but for a Library prompt the reviewer chose:
-its link's provenance names a manual choice and carries no prompt sides, so it
-cannot pose as file evidence, and the decision's ``candidate_hash`` (the table
-requires one) is the digest of that choice. ``unresolved`` records the decision
-and links nothing. No decision counts a run, touches usage or calls an execution
-writer.
+back. ``unresolved`` records the decision and links nothing. No decision
+counts a run, touches usage or calls an execution writer.
 
 Callers verify the file first (the capture must be the item's bytes and the
 current file must still hash to them); nothing here reads the filesystem.
@@ -21,7 +17,6 @@ import sqlite3
 
 from .annotation_schema import BYTES_TABLE
 from .annotations import _new_id
-from .library import _ELIGIBLE, _FROM, SHELVED
 from .library_commands import LibraryCommandError
 from .models import utc_now_iso
 from .review import (
@@ -35,28 +30,9 @@ from .review import (
     same_name_rows,
 )
 from .review_changes import notify_review_change
-from .review_schema import (
-    DECISIONS_TABLE,
-    ITEMS_TABLE,
-    canonical_evidence,
-    evidence_digest,
-)
+from .review_schema import DECISIONS_TABLE, ITEMS_TABLE, canonical_evidence
 
 DECISION_KIND = "user-selection"
-MANUAL_KIND = "manual-link"
-_MANUAL_POSITIVE = (
-    f"SELECT p.id,p.text FROM {_FROM} "  # nosec B608
-    f"WHERE p.id=? AND {_ELIGIBLE} AND {SHELVED}"
-)
-_MANUAL_PAIR = (
-    "SELECT COALESCE(n.text,'') AS negative FROM prompt_pairs pp "
-    "LEFT JOIN prompts n ON n.id=pp.negative_prompt_id "
-    "WHERE pp.id=? AND pp.positive_prompt_id=? AND pp.archived=0"
-)
-_ARCHIVED_BARE_PAIR = (
-    "SELECT 1 FROM prompt_pairs WHERE positive_prompt_id=? "
-    "AND negative_prompt_id IS NULL AND archived=1"
-)
 _INSERT_DECISION = (
     f"INSERT INTO {DECISIONS_TABLE}(id,item_id,decision_revision,"  # nosec B608
     "created_at,outcome,candidate_hash,evidence,pair_id,image_id) "
@@ -83,8 +59,6 @@ class ReviewCommandError(LibraryCommandError):
     ``fingerprint`` the current dependency fingerprint, when known;
     ``changed`` marks an association conflict caused by links that changed
     since the reviewer read them (rather than an incompatible choice).
-    ``prompt-missing``: the Library prompt or recipe of a manual link is gone,
-    archived or not that prompt's.
     """
 
     def __init__(
@@ -119,7 +93,6 @@ class ReviewDecisionOperations:
         sha256: str,
         outcome: str,
         candidate: dict | None = None,
-        manual: dict | None = None,
         image_path: str | None = None,
         metadata: dict | None = None,
         expected_fingerprint: str | None = None,
@@ -128,9 +101,7 @@ class ReviewDecisionOperations:
     ) -> dict:
         """Record the decision; return ``{item, total, pair}``.
 
-        ``selected`` needs the evidence ``candidate`` (with its ``hash``) or
-        ``manual`` (``{positive_id, pair_id}``; a null ``pair_id`` is no
-        negative), the
+        ``selected`` needs the evidence ``candidate`` (with its ``hash``), the
         ``image_path`` the scan and the monitor link under, the captured
         ``metadata`` and the ``expected_fingerprint`` the reviewer saw.
         ``aliases`` are the other spellings legacy rows of the same physical
@@ -144,12 +115,9 @@ class ReviewDecisionOperations:
         if outcome not in ("selected", "unresolved"):
             raise ValueError("outcome must be selected or unresolved")
         if outcome == "selected" and (
-            (not isinstance(candidate, dict)) == (not isinstance(manual, dict))
-            or not image_path
+            not isinstance(candidate, dict) or not image_path
         ):
-            raise ValueError(
-                "A selected decision needs one candidate or manual choice and a file"
-            )
+            raise ValueError("A selected decision needs a candidate and a file")
         try:
             with self._pair_transaction() as conn:
                 decided = self._decide_in(
@@ -160,7 +128,6 @@ class ReviewDecisionOperations:
                     sha256=sha256,
                     outcome=outcome,
                     candidate=candidate,
-                    manual=manual,
                     image_path=image_path,
                     metadata=metadata or {},
                     expected_fingerprint=expected_fingerprint,
@@ -191,24 +158,13 @@ class ReviewDecisionOperations:
             raise _Rollback(ReviewCommandError("file-changed", epoch))
         decision_id = _new_id()
         pair = None
-        selected = command["outcome"] == "selected"
-        candidate = command["candidate"] if selected else None
-        manual = command["manual"] if selected else None
-        candidate_hash = candidate["hash"] if candidate is not None else None
+        candidate = command["candidate"] if command["outcome"] == "selected" else None
         if candidate is not None:
             pair = self._apply_candidate(
                 conn, epoch, current, decision_id, total, **command
             )
-        elif manual is not None:
-            pair = self._apply_manual(
-                conn, epoch, current, decision_id, total, **command
-            )
-            manual = {"positive_id": manual["positive_id"], "pair_id": pair["id"]}
-            candidate_hash = evidence_digest(
-                canonical_evidence({"kind": MANUAL_KIND, **manual})
-            )
         evidence = {
-            "kind": MANUAL_KIND if manual is not None else DECISION_KIND,
+            "kind": DECISION_KIND,
             "decision_id": decision_id,
             "outcome": command["outcome"],
             "reviewed_digest": command["sha256"],
@@ -218,8 +174,6 @@ class ReviewDecisionOperations:
             "dependency_fingerprint": command["expected_fingerprint"],
             "pair": pair,
         }
-        if manual is not None:
-            evidence["manual"] = manual
         now = utc_now_iso()
         self._insert_review_decision(
             conn,
@@ -229,7 +183,7 @@ class ReviewDecisionOperations:
                 current["revision"] + 1,
                 now,
                 command["outcome"],
-                candidate_hash,
+                candidate["hash"] if candidate is not None else None,
                 canonical_evidence(evidence),
                 pair["id"] if pair else None,
                 pair["image_id"] if pair else None,
@@ -250,77 +204,6 @@ class ReviewDecisionOperations:
         self, conn, epoch, current, decision_id, total, **command
     ) -> dict:
         """Link the candidate's pair, compatible-only; raise on any conflict."""
-        candidate = command["candidate"]
-        positive, negative = candidate["positive"], candidate["negative"]
-        provenance = {
-            "kind": DECISION_KIND,
-            "decision_id": decision_id,
-            "reviewed_digest": command["sha256"],
-            "candidate_hash": candidate["hash"],
-            "resolver_version": current["resolver_version"],
-            "positive": positive,
-            "negative": negative,
-        }
-        return self._link_compatible(
-            conn, epoch, current, total, positive, negative, provenance, command
-        )
-
-    def _apply_manual(self, conn, epoch, current, decision_id, total, **command):
-        """Link the chosen Library prompt, compatible-only; raise otherwise."""
-        missing = _Rollback(
-            ReviewCommandError("prompt-missing", epoch, item=current, total=total)
-        )
-        positive_id = command["manual"]["positive_id"]
-        pair_id = command["manual"]["pair_id"]
-        row = conn.execute(_MANUAL_POSITIVE, (positive_id,)).fetchone()
-        if row is None:
-            raise missing
-        positive_text, negative_text = row[1], ""
-        if pair_id is not None:
-            chosen = conn.execute(_MANUAL_PAIR, (pair_id, positive_id)).fetchone()
-            if chosen is None:
-                raise missing
-            negative_text = chosen[0]
-        elif conn.execute(_ARCHIVED_BARE_PAIR, (positive_id,)).fetchone():
-            raise missing
-        provenance = {
-            "kind": MANUAL_KIND,
-            "decision_id": decision_id,
-            "reviewed_digest": command["sha256"],
-            "resolver_version": current["resolver_version"],
-            "positive_id": positive_id,
-            "pair_id": pair_id,
-        }
-        # The sides name no provenance: only the ingester reads them.
-        pair = self._link_compatible(
-            conn,
-            epoch,
-            current,
-            total,
-            {"text": positive_text},
-            {"text": negative_text},
-            provenance,
-            command,
-        )
-        # A prompt whose stored hash is stale reaches another row: never link that.
-        reached = conn.execute(
-            "SELECT positive_prompt_id FROM prompt_pairs WHERE id=?", (pair["id"],)
-        ).fetchone()[0]
-        if reached != positive_id or pair_id not in (None, pair["id"]):
-            raise missing
-        return pair
-
-    def _link_compatible(
-        self,
-        conn,
-        epoch,
-        current,
-        total,
-        positive,
-        negative,
-        provenance,
-        command,
-    ) -> dict:
         # Imported here: pair_ingestion imports operations, which composes this.
         from .pair_ingestion import _ingest_resolved_pair_in
 
@@ -359,6 +242,17 @@ class ReviewDecisionOperations:
             # Enrich the one row of this file under the spelling it was
             # linked with, so the ingester's compatibility rules see it.
             image_path = rows[0][1]
+        candidate = command["candidate"]
+        positive, negative = candidate["positive"], candidate["negative"]
+        provenance = {
+            "kind": DECISION_KIND,
+            "decision_id": decision_id,
+            "reviewed_digest": command["sha256"],
+            "candidate_hash": candidate["hash"],
+            "resolver_version": current["resolver_version"],
+            "positive": positive,
+            "negative": negative,
+        }
         result = _ingest_resolved_pair_in(
             conn,
             self,

database/safety_backup.py

@@ -46,7 +46,6 @@ def remove_quietly(*paths):
             if path and os.path.exists(path):
                 os.remove(path)
         except OSError:
-            # cleanup after a failure must not replace that failure
             pass
 
 

database/vocabulary.py

@@ -20,8 +20,7 @@ counted, hashed into the token and renamed with the prompts and pairs.
 
 import sqlite3
 
-from .library import _ELIGIBLE, SHELVED_PAIR, UNTAGGED, _escape, _limit
-from .prompt_archive import SHELVED
+from .library import _ELIGIBLE, UNTAGGED, _escape, _limit
 from .library_commands import _TOKEN, LibraryCommandError, _validate_epoch
 from .library_tokens import canonical_token
 from .models import utc_now_iso
@@ -41,21 +40,17 @@ _IMAGE_FILES = (
 
 def _tag_rows(page: str, order: str = "page.id") -> str:
     """Count rows for the registry rows selected by ``page`` (id, name)."""
-    # Eligible parent components on the shelf carrying a tag in the page,
-    # plus the positive parent of every active pair carrying it (always
-    # eligible) when that parent is on the shelf: archived parents (#443)
-    # are hidden with their pairs, so Browse lists what was counted.
+    # Eligible parent components carrying a tag in the page, plus the
+    # positive parent of every active pair carrying it (always eligible).
     return (
         "WITH page AS (" + page + "),"
         "owners(tag_id,pid) AS ("
         "SELECT pt.tag_id,p.id FROM prompts p "
         "JOIN prompt_tags pt ON pt.prompt_id=p.id "
         "WHERE pt.tag_id IN (SELECT id FROM page) AND " + _ELIGIBLE + " "
-        "AND " + SHELVED + " "
         "UNION SELECT ppt.tag_id,pp.positive_prompt_id FROM prompt_pairs pp "
         "JOIN prompt_pair_tags ppt ON ppt.pair_id=pp.id "
-        "WHERE pp.archived=0 AND " + SHELVED_PAIR + " "
-        "AND ppt.tag_id IN (SELECT id FROM page)),"
+        "WHERE pp.archived=0 AND ppt.tag_id IN (SELECT id FROM page)),"
         "images(tag_id,n) AS (" + _IMAGE_FILES + " "
         "WHERE mit.tag_id IN (SELECT id FROM page) GROUP BY mit.tag_id) "
         "SELECT page.id,page.name,COUNT(DISTINCT owners.pid) AS prompt_count,"
@@ -66,6 +61,7 @@ def _tag_rows(page: str, order: str = "page.id") -> str:
     )
 
 
+_TAG_PAGE = _tag_rows("SELECT id,name FROM tags WHERE id>? ORDER BY id LIMIT ?")
 # #444 tag sorts: sort -> (key expression on tags/counted, direction). Ties and
 # "created" follow the id, so every order is total and keyset pages are exact.
 TAG_SORTS = {
@@ -83,10 +79,8 @@ _RANKED_TAG_PAGE = (
     "WITH owners(tag_id,pid) AS ("
     "SELECT pt.tag_id,p.id FROM prompts p "
     "JOIN prompt_tags pt ON pt.prompt_id=p.id WHERE " + _ELIGIBLE + " "
-    "AND " + SHELVED + " "
     "UNION SELECT ppt.tag_id,pp.positive_prompt_id FROM prompt_pairs pp "
-    "JOIN prompt_pair_tags ppt ON ppt.pair_id=pp.id WHERE pp.archived=0 "
-    "AND " + SHELVED_PAIR + "),"
+    "JOIN prompt_pair_tags ppt ON ppt.pair_id=pp.id WHERE pp.archived=0),"
     "counted AS (SELECT t.id,t.name,COUNT(DISTINCT o.pid) AS prompt_count "
     "FROM tags t LEFT JOIN owners o ON o.tag_id=t.id WHERE {search} "
     "GROUP BY t.id),"
@@ -100,13 +94,7 @@ _RANKED_TAG_PAGE = (
     "ORDER BY page.prompt_count {direction},page.id"
 )
 _UNTAGGED_COUNT = (
-    "SELECT COUNT(*) FROM prompts p WHERE ("
-    + _ELIGIBLE
-    + ") AND "
-    + UNTAGGED
-    # Untagged prompts opens the shelf, which hides archived parents (#443).
-    + " AND "
-    + SHELVED
+    "SELECT COUNT(*) FROM prompts p WHERE (" + _ELIGIBLE + ") AND " + UNTAGGED
 )
 _TAG_ONE = _tag_rows("SELECT id,name FROM tags WHERE id=?")
 # Every owner kind a tag can sit on, for the delete confirmation.
@@ -146,9 +134,7 @@ def _validate_tag_id(tag_id: object) -> None:
 
 
 # Category values in Tags & categories (#332 §7): the prompt-backed values
-# (nonblank values on eligible parents or on active pairs; ``prompt_count``
-# counts only parents on the shelf, so a value only archived parents (#443)
-# hold stays listed with 0, as a tag does; grouped exactly, so
+# (nonblank values on eligible parents or on active pairs, grouped exactly, so
 # whitespace and case variants stay distinct; /library/options lists the same
 # prompt-backed set with its own query) plus the values only image rows hold.
 # A prompt-backed value is ordered by its oldest owning positive; an image-only
@@ -157,17 +143,15 @@ def _validate_tag_id(tag_id: object) -> None:
 # files missing on disk. No FULL OUTER JOIN, so it runs on SQLite 3.31+.
 _IMAGE_ONLY_FIRST_PID = 2**63 - 1
 _CATEGORY_ROWS = (
-    "WITH owners(value,pid,shelved) AS ("
-    "SELECT p.category,p.id," + SHELVED + " FROM prompts p "
-    "WHERE p.category IS NOT NULL AND TRIM(p.category)!='' AND " + _ELIGIBLE + " "
-    "UNION SELECT pp.category,pp.positive_prompt_id," + SHELVED_PAIR + " "
-    "FROM prompt_pairs pp "
+    "WITH owners(value,pid) AS ("
+    "SELECT p.category,p.id FROM prompts p WHERE p.category IS NOT NULL "
+    "AND TRIM(p.category)!='' AND " + _ELIGIBLE + " "
+    "UNION SELECT pp.category,pp.positive_prompt_id FROM prompt_pairs pp "
     "WHERE pp.archived=0 AND pp.category IS NOT NULL AND TRIM(pp.category)!=''),"
     "image_values(value,image_count) AS ("
     "SELECT category,COUNT(*) FROM image_categories GROUP BY category),"
     "grouped(value,first_pid,prompt_count) AS ("
-    "SELECT value,MIN(pid),COUNT(DISTINCT CASE WHEN shelved THEN pid END) "
-    "FROM owners GROUP BY value "
+    "SELECT value,MIN(pid),COUNT(DISTINCT pid) FROM owners GROUP BY value "
     "UNION ALL SELECT value," + str(_IMAGE_ONLY_FIRST_PID) + ",0 FROM image_values "
     "WHERE value NOT IN (SELECT value FROM owners)),"
     "counted AS (SELECT g.value,g.first_pid,g.prompt_count,"

database/workflow_storage.py

@@ -112,22 +112,20 @@ QUERY_PLAN_STATEMENTS = {
 
 
 def _rewrite_row(conn, image_id, row, verified, checked):
-    """Store the row's inline texts as documents; returns (changed, kept, size).
-
-    ``kept`` names the columns whose value stays inline (not text).
+    """Store the row's inline texts as documents; returns (changed, protected, size).
 
     ``verified`` maps document ids already read back in this batch to their
     text, and ``checked`` holds the reused ids ``store_text`` already
     checked, so a document shared by many rows is decompressed once.
     """
-    changes, replaced, kept = {}, [], []
-    size = 0
+    changes, replaced = {}, []
+    protected = size = 0
     for index, (column, reference) in enumerate(TEXT_COLUMNS):
         value, current = row[index], row[index + len(TEXT_COLUMNS)]
         if value is None:
             continue
         if not storable(value):
-            kept.append(column)
+            protected += 1
             continue
         document_id = store_text(conn, value, checked)
         if document_id not in verified:
@@ -145,7 +143,7 @@ def _rewrite_row(conn, image_id, row, verified, checked):
             [*changes.values(), image_id],
         )
     release_documents(conn, replaced)
-    return bool(changes), kept, size
+    return bool(changes), protected, size
 
 
 def migrate_batch(
@@ -162,10 +160,9 @@ def migrate_batch(
     savepoint: a row that cannot be rewritten (``_row_error``) is rolled
     back alone, stays inline and is listed in ``errors``; anything else rolls
     the whole batch back and propagates. Returns ``{last_id, rows,
-    protected, kept, errors, done}``: the last row looked at, rows
-    rewritten, inline values kept (not text) and each of them as ``(image
-    id, column)`` (#586), the ids kept by an error and whether there was
-    nothing left to look at.
+    protected, errors, done}``: the last row looked at, rows rewritten,
+    inline values kept (not text), the ids kept by an error and whether
+    there was nothing left to look at.
     """
     if conn.in_transaction:
         raise RuntimeError("The migration needs its own transaction")
@@ -177,7 +174,6 @@ def migrate_batch(
             "last_id": after_id,
             "rows": 0,
             "protected": 0,
-            "kept": [],
             "errors": [],
             "done": not ids,
         }
@@ -186,7 +182,7 @@ def migrate_batch(
             conn.execute("SAVEPOINT workflow_row")
             try:
                 row = conn.execute(ROW_SQL, (image_id,)).fetchone()
-                changed, kept, row_size = _rewrite_row(
+                changed, protected, row_size = _rewrite_row(
                     conn, image_id, row, verified, checked
                 )
             except Exception as error:
@@ -198,12 +194,11 @@ def migrate_batch(
                 checked.clear()
                 logger.warning(f"Image record {image_id} kept inline: {error}")
                 result["errors"].append(image_id)
-                changed, kept, row_size = False, [], 0
+                changed, protected, row_size = False, 0, 0
             else:
                 conn.execute("RELEASE workflow_row")
             result["rows"] += int(changed)
-            result["protected"] += len(kept)
-            result["kept"].extend((image_id, column) for column in kept)
+            result["protected"] += protected
             result["last_id"] = image_id
             size += row_size
             if size >= max_bytes or _clock() - started >= max_seconds:

docs/prompt-send-bridge.md

@@ -18,13 +18,9 @@ protocol and peer checks reject unrelated messages. Same-origin scripts are
 trusted; this transport is not authentication against other scripts on that origin.
 Unsupported messaging is reported without breaking existing ComfyUI nodes.
 
-Apply works in one click: without a preview, the sender requests the ticket itself
-and applies it. Preview remains optional, and shows the exact change first.
-
 An apply timeout or abort after posting means the outcome is unknown. It cannot
 prove the host cancelled the write. The sender must inspect a fresh destination
-preview or choose the destination again before sending again; automatic retry must
-not overwrite edits. An error the host returned is a refusal: nothing was written.
+preview before deciding to send again; automatic retry must not overwrite edits.
 
 ## PromptManager adapter
 
@@ -35,9 +31,7 @@ field. Unknown/ambiguous metadata must not become an empty string.
 
 Previews show original and requested text plus positive prepend/append composition.
 Connected composition is marked unknown rather than guessing upstream values.
-Connected destination fields reject writes. The sender compares the destination's revision
-(node object and graph version) from discovery with the one at the preview, and refuses if the workflow changed.
-Applying rechecks graph, node, widgets,
+Connected destination fields reject writes. Applying rechecks graph, node, widgets,
 values and connections. Ordinary serialization cache synchronization is accepted
 only when it preserves live values. Both requested roles are checked before writing.
 

prompt_manager_pair.py

@@ -230,8 +230,6 @@ class PromptManagerPair(PromptManagerFocused):
             negative_text,
             category=category.strip() or None,
             tags=self._parse_tags(tags),
-            # The Library shows the prompt's own category and tags, not the pair's.
-            fill_new_positive=True,
         )
         pair = self.db.get_prompt_pair(pair_id)
         prompt_id = pair["positive_prompt_id"]

py/api/__init__.py

@@ -11,7 +11,6 @@ Split into domain-specific mixins for maintainability:
 - JobRoutesMixin: the session job registry behind Activity (py/api/jobs.py)
 - ImageTagJobsMixin: bulk Add tags / Auto-tag as image-tags jobs
 - ThumbnailJobsMixin: thumbnail plan, thumbnail job and the gallery stream on it
-- ThumbnailLocationMixin: the thumbnail location check and payloads (#320)
 - ThumbnailConvertMixin: Convert outdated thumbnails (#317), a thumbnail job mode
 - AutoThumbnailMixin: previews made on first view, on capture and after a scan
 - ReviewRoutesMixin: the Needs review queue, item detail and decisions
@@ -20,7 +19,6 @@ Split into domain-specific mixins for maintainability:
 - SystemRoutesMixin: System health check, Overview and usage statistics
 - LibraryLocationRoutesMixin: where the library lives, Move library, Keep it here
 - MaintenanceRoutesMixin: reviewed maintenance plans (preview, apply)
-- LibraryDeleteRoutesMixin: the Library's Delete… (archive paired) and Restore
 - WorkflowStorageRoutesMixin: store each workflow once, then Reclaim space
 - DuplicateFilesMixin: duplicate image files as find and removal jobs
 - LoraImportRoutesMixin: the reviewed, staged LoRA reference import job
@@ -42,10 +40,8 @@ from aiohttp import web
 from PIL import Image
 
 from .prompts import PromptRoutesMixin
-from .revalidation import revalidated_response
 from .pairs import PairRoutesMixin
 from .library import LibraryRoutesMixin
-from .library_delete import LibraryDeleteRoutesMixin
 from .vocabulary import VocabularyRoutesMixin
 from .annotations import AnnotationRoutesMixin
 from .review import ReviewRoutesMixin
@@ -61,11 +57,6 @@ from .settings_routes import SettingsRoutesMixin
 from .job_routes import JobRoutesMixin
 from .image_tag_jobs import ImageTagJobsMixin
 from .thumbnail_jobs import ThumbnailJobsMixin
-from .thumbnail_location import ThumbnailLocationMixin
-from .thumbnail_move import ThumbnailMoveMixin
-from .thumbnail_move_plan import ThumbnailMovePlanMixin
-from .thumbnail_move_recovery import ThumbnailMoveRecoveryMixin
-from .thumbnail_prune import ThumbnailPruneMixin
 from .thumbnail_convert import ThumbnailConvertMixin
 from .thumbnail_auto import AutoThumbnailMixin
 from .system import SystemRoutesMixin
@@ -83,16 +74,12 @@ from .autotag_routes import AutotagRoutesMixin
 from .lora_integration import LoraIntegrationMixin
 from .lora_import_routes import LoraImportRoutesMixin
 from .image_categories import ImageCategoryRoutesMixin
-from .image_delete import ImageDeleteMixin
-from .image_return import ImageReturnMixin
 from .source_rescope import SourceRescopeMixin
 
 try:
     from ...database.operations import PromptDatabase
     from ...utils.file_prompt import parse_comfyui_prompt
     from ...utils.logging_config import get_logger
-    from ...utils.native_memory import release_free_memory
-    from ...utils.png_text import png_text
     from ...utils.video_metadata import is_video_path, read_video_metadata
 except ImportError:
     import sys
@@ -103,8 +90,6 @@ except ImportError:
     from database.operations import PromptDatabase
     from utils.file_prompt import parse_comfyui_prompt
     from utils.logging_config import get_logger
-    from utils.native_memory import release_free_memory
-    from utils.png_text import png_text
     from utils.video_metadata import is_video_path, read_video_metadata
 
 
@@ -328,7 +313,6 @@ async def _gzip_middleware(request, handler):
 class PromptManagerAPI(
     PairRoutesMixin,
     LibraryRoutesMixin,
-    LibraryDeleteRoutesMixin,
     VocabularyRoutesMixin,
     AnnotationRoutesMixin,
     ReviewRoutesMixin,
@@ -344,11 +328,6 @@ class PromptManagerAPI(
     JobRoutesMixin,
     ImageTagJobsMixin,
     ThumbnailJobsMixin,
-    ThumbnailLocationMixin,
-    ThumbnailMovePlanMixin,
-    ThumbnailMoveMixin,
-    ThumbnailMoveRecoveryMixin,
-    ThumbnailPruneMixin,
     ThumbnailConvertMixin,
     AutoThumbnailMixin,
     SystemRoutesMixin,
@@ -364,8 +343,6 @@ class PromptManagerAPI(
     LoraIntegrationMixin,
     LoraImportRoutesMixin,
     ImageCategoryRoutesMixin,
-    ImageDeleteMixin,
-    ImageReturnMixin,
     SourceRescopeMixin,
 ):
     """REST API handler for PromptManager operations and web interface.
@@ -446,12 +423,6 @@ class PromptManagerAPI(
         # Reviewed maintenance plans under single-use tokens; a restart
         # forgets them (py/api/maintenance.py).
         self._maintenance_plans = PlanStore()
-        # #480: the removal marks the workspace listing hides, read once now so
-        # a listing page reads no table until a mark or the database changes.
-        try:
-            self._removal_marks()
-        except Exception:
-            self.logger.warning("Removal marks could not be read", exc_info=True)
 
         # A safety backup interrupted by a crash leaves its temp copy behind.
         try:
@@ -541,14 +512,6 @@ class PromptManagerAPI(
             return await loop.run_in_executor(None, call)
         return await loop.run_in_executor(None, func, *args)
 
-    async def _release_job_memory(self):
-        """After a scan or thumbnail job: glibc's free heap pages go back to
-        the OS once (``malloc_trim(0)``; nothing elsewhere, #523)."""
-        try:
-            await self._run_in_executor(release_free_memory)
-        except Exception:  # best effort: the job's result already stands
-            self.logger.debug("Releasing free memory failed", exc_info=True)
-
     def _root_listing(self, root) -> RootListing:
         """The shared listing record of one output root (created empty)."""
         return self._root_listings.setdefault(str(root), RootListing())
@@ -690,46 +653,40 @@ class PromptManagerAPI(
 
         @routes.get("/prompt_manager/workspace")
         async def serve_workspace_ui(request: web.Request) -> web.Response:
-            return self._serve_html_page(request, "workspace.html", "Workspace")
+            return self._serve_html_page("workspace.html", "Workspace")
 
         @routes.get("/prompt_manager/web")
         async def serve_web_ui(request):
-            return self._serve_html_page(request, "index.html", "Web UI", cache=False)
+            return self._serve_html_page("index.html", "Web UI", cache=False)
 
         @routes.get("/prompt_manager/gallery.html")
         async def serve_gallery_ui(request):
-            return self._serve_html_page(request, "metadata.html", "Gallery")
+            return self._serve_html_page("metadata.html", "Gallery")
 
         @routes.get("/prompt_manager/admin")
         async def serve_admin_ui(request):
-            return self._serve_html_page(request, "admin.html", "Admin UI")
+            return self._serve_html_page("admin.html", "Admin UI")
 
         @routes.get("/prompt_manager/gallery")
         async def serve_gallery_admin_ui(request):
-            return self._serve_html_page(request, "gallery.html", "Gallery")
+            return self._serve_html_page("gallery.html", "Gallery")
 
         # ── Static file serving ───────────────────────────────────────
 
         @routes.get("/prompt_manager/lib/{filepath:.*}")
         async def serve_lib_static(request):
             """Serve static library files (JS, CSS) from web/lib directory."""
-            return self._serve_static_file(
-                request, "lib", request.match_info.get("filepath")
-            )
+            return self._serve_static_file("lib", request.match_info.get("filepath"))
 
         @routes.get("/prompt_manager/js/{filepath:.*}")
         async def serve_js_static(request):
             """Serve static JavaScript files from web/js directory."""
-            return self._serve_static_file(
-                request, "js", request.match_info.get("filepath")
-            )
+            return self._serve_static_file("js", request.match_info.get("filepath"))
 
         # ── Register domain-specific routes from mixins ───────────────
 
         self._register_pair_routes(routes)
-        self._register_thumbnail_move_routes(routes)
         self._register_library_routes(routes)
-        self._register_library_delete_routes(routes)
         self._register_vocabulary_routes(routes)
         self._register_annotation_routes(routes)
         self._register_review_routes(routes)
@@ -753,8 +710,6 @@ class PromptManagerAPI(
         self._register_lora_routes(routes)
         self._register_lora_import_routes(routes)
         self._register_image_category_routes(routes)
-        self._register_image_delete_routes(routes)
-        self._register_image_return_routes(routes)
         self._register_rescope_routes(routes)
 
         # Register gzip compression middleware (once)
@@ -771,11 +726,8 @@ class PromptManagerAPI(
 
         self.logger.info("All routes registered with decorator pattern")
 
-    def _serve_static_file(self, request, subdir, filepath):
-        """Serve ``web/<subdir>/<filepath>``; 403 outside it, 404 when missing.
-
-        A served file is revalidated on every reuse (#478, ``revalidation``).
-        """
+    def _serve_static_file(self, subdir, filepath):
+        """Serve ``web/<subdir>/<filepath>``; 403 outside it, 404 when missing."""
         root = os.path.join(_get_project_root(), "web", subdir)
         exact = STATIC_EXACT_FILES.get((subdir, filepath))
         # An exact file passes the same containment check, its extension only.
@@ -790,13 +742,10 @@ class PromptManagerAPI(
             return web.Response(text="Not Found", status=404)
         with open(file_path, "rb") as f:
             content = f.read()
-        return revalidated_response(request, content, content_type)
+        return web.Response(body=content, content_type=content_type)
 
-    def _serve_html_page(self, request, filename, title, cache=True):
-        """Serve ``web/<filename>``; 404 when missing, 500 when unreadable.
-
-        A served page is revalidated on every reuse (#478, ``revalidation``).
-        """
+    def _serve_html_page(self, filename, title, cache=True):
+        """Serve ``web/<filename>``; 404 when missing, 500 when unreadable."""
         html_path = os.path.join(_get_project_root(), "web", filename)
         try:
             if cache and html_path in self._html_cache:
@@ -813,9 +762,7 @@ class PromptManagerAPI(
                     content_type="text/html",
                     status=404,
                 )
-            return revalidated_response(
-                request, content.encode("utf-8"), "text/html", charset="utf-8"
-            )
+            return web.Response(text=content, content_type="text/html", charset="utf-8")
         except Exception:
             self.logger.exception(f"Failed to load {title}")
             return web.Response(
@@ -864,11 +811,20 @@ class PromptManagerAPI(
                         f"{url_quote(rel_path.as_posix(), safe='/')}"
                     )
 
-                    # Any preview the file owns, the current format first
-                    # (#317); no store I/O here in folder mode (#320).
-                    from .images import listing_thumbnail_url
+                    # Any preview the file owns, the current format first (#317)
+                    from . import thumbnail_settings
+                    from .prompts import thumbnail_url_for
 
-                    thumbnail_url = listing_thumbnail_url(output_path, rel_path)
+                    existing = thumbnail_settings.existing_thumbnail(
+                        output_path, rel_path
+                    )
+                    thumbnail_url = None
+                    if existing is not None:
+                        thumb_rel = (
+                            thumbnail_settings.thumbnail_stem_rel(rel_path)
+                            + existing.suffix
+                        )
+                        thumbnail_url = thumbnail_url_for(thumb_rel, existing)
                     if thumbnail_url:
                         image["thumbnail_url"] = thumbnail_url
                     break  # Found matching root, stop searching
@@ -1063,8 +1019,6 @@ class PromptManagerAPI(
     def _extract_comfyui_metadata(self, image_path):
         """Embedded ComfyUI metadata of an image (PNG text chunks) or a video.
 
-        PNG text is read without decoding the pixels (``utils.png_text``, #523).
-
         Videos go through ffprobe (see utils/video_metadata). Unreadable files
         are a warning, not an error: a scan over a large output tree meets
         truncated and foreign files, and it carries on past them.
@@ -1073,7 +1027,7 @@ class PromptManagerAPI(
             return read_video_metadata(image_path)
         try:
             with Image.open(image_path) as img:
-                return png_text(img)
+                return dict(getattr(img, "text", None) or {})
         except Exception as e:
             self.logger.warning(
                 f"Unreadable image {os.path.basename(str(image_path))}: {e}"

py/api/admin.py

@@ -36,21 +36,10 @@ except ImportError:
 
 try:
     from ...utils import exit_signal
-    from ...utils.media_folders import (
-        in_trash_below_roots,
-        in_trash_folder,
-        is_skipped_folder,
-    )
 except ImportError:
     from utils import exit_signal
-    from utils.media_folders import (
-        in_trash_below_roots,
-        in_trash_folder,
-        is_skipped_folder,
-    )
 
 try:
-    from ...database.image_removal import mark_hides
     from ...database.pair_ingestion import SCAN_MARKS, ingest_resolved_pair
     from ...database.run_attribution import (
         RecordedOutput,
@@ -71,7 +60,6 @@ try:
         decide_file_prompt,
     )
 except ImportError:
-    from database.image_removal import mark_hides
     from database.pair_ingestion import SCAN_MARKS, ingest_resolved_pair
     from database.run_attribution import (
         RecordedOutput,
@@ -130,11 +118,10 @@ DUPLICATE_FIND_LEGACY_TITLE = "Find duplicate image files (gallery page)"
 def _collect_media_files(output_dirs, extensions):
     """Media files under ``output_dirs`` (blocking), bounded and symlink-free.
 
-    Walks each root without following symlinks, skips ``thumbnails`` and
-    trash folders (``utils.media_folders``) and symlinked files, never
-    descends more than MAX_SCAN_DEPTH levels and stops after MAX_SCAN_FILES
-    files in total. Extensions match case-insensitively and each path is
-    listed once.
+    Walks each root without following symlinks, skips ``thumbnails``
+    directories and symlinked files, never descends more than MAX_SCAN_DEPTH
+    levels and stops after MAX_SCAN_FILES files in total. Extensions match
+    case-insensitively and each path is listed once.
     """
     wanted = {ext.lower() for ext in extensions}
     found = []
@@ -149,7 +136,7 @@ def _collect_media_files(output_dirs, extensions):
             dirnames[:] = sorted(
                 d
                 for d in dirnames
-                if not is_skipped_folder(d)
+                if d != "thumbnails"
                 and depth < MAX_SCAN_DEPTH
                 and not os.path.islink(os.path.join(current, d))
             )
@@ -176,7 +163,7 @@ def _physical_file_key(path, stat):
     volumes on Windows) falls back to the resolved, case-folded path.
     """
     if stat.st_ino:
-        return ("inode", (stat.st_dev, stat.st_ino))
+        return ("inode", stat.st_dev, stat.st_ino)
     return ("path", os.path.normcase(os.path.realpath(str(path))))
 
 
@@ -249,12 +236,7 @@ SCAN_FINAL_STATES = {
     "error": "failed",
 }
 # The scope as the scan log's first line names it (the review dialog's words).
-SCAN_SCOPE_LOG = {
-    "new": "new and unresolved files",
-    "all": "all files",
-    "returned": "images returned to the library",
-}
-RETURN_JOB_TITLE = "Return images to the library"  # #498
+SCAN_SCOPE_LOG = {"new": "new and unresolved files", "all": "all files"}
 MIN_BATCHES_FOR_ESTIMATE = 2  # "about X min left" waits for this many batches
 # Log line prefix per outcome group (spec: + added, = known, ? review, ! error,
 # - no usable metadata).
@@ -539,7 +521,6 @@ def _diagnose_output_dirs(configured_dirs, public_path=None):
 
         candidates.append(folder_paths.get_output_directory())
     except ImportError:
-        # outside ComfyUI there is no output folder to add
         pass
 
     output_dirs = []
@@ -902,8 +883,6 @@ class AdminRoutesMixin:
         extensions = IMAGE_EXTENSIONS + VIDEO_EXTENSIONS
         media_files = []
         seen = set()
-        # #480: a file removed from the library is never a copy or a keeper.
-        marks = self._removal_marks()
         for slot, root in enumerate(roots):
             for path in _collect_media_files([root], extensions):
                 try:
@@ -912,9 +891,6 @@ class AdminRoutesMixin:
                     stat = os.stat(path)
                 except OSError:
                     continue
-                locator = os.path.normcase(os.path.realpath(str(path)))
-                if locator in marks and mark_hides(marks, locator, path):
-                    continue
                 key = _physical_file_key(path, stat)
                 if key not in seen:
                     seen.add(key)
@@ -1098,21 +1074,13 @@ class AdminRoutesMixin:
         return result
 
     def _delete_one_duplicate(self, image_path, output_path):
-        """Delete one file and its thumbnail; return a failure reason or None.
-
-        What is removed is exactly the folder's real path plus the name: a
-        link is removed itself, never its target, and the preview removed is
-        that name's. Both the link's place and what it leads to are checked.
-        """
+        """Delete one file and its thumbnail; return a failure reason or None."""
         file_path = Path(image_path)
         if not file_path.is_absolute():
             file_path = output_path / file_path
 
         try:
-            real_root = output_path.resolve()
-            rel_path = file_path.resolve().relative_to(real_root)
-            exact = Path(os.path.realpath(file_path.parent)) / file_path.name
-            exact_rel = exact.relative_to(real_root)
+            rel_path = file_path.resolve().relative_to(output_path.resolve())
         except ValueError:
             self.logger.warning(
                 f"Attempted to delete file outside output directory: {image_path}"
@@ -1121,19 +1089,15 @@ class AdminRoutesMixin:
 
         if file_path.suffix.lower() not in DELETABLE_MEDIA_EXTENSIONS:
             return "not a media file"
-        if "thumbnails" in rel_path.parts or "thumbnails" in exact_rel.parts:
+        if "thumbnails" in rel_path.parts:
             return "thumbnails are managed by the gallery"
-        if in_trash_below_roots(file_path, [output_path]) or in_trash_folder(
-            str(exact_rel)
-        ):
-            return "it is in a trash folder"  # never unlinked from a trash (#543)
 
         if not file_path.is_file():
             return "file not found"
 
-        os.remove(exact)
+        os.remove(file_path)
         self.logger.info(f"Deleted duplicate image: {image_path}")
-        _remove_thumbnail(real_root, exact_rel, self.logger)
+        _remove_thumbnail(output_path.resolve(), rel_path, self.logger)
         return None
 
     async def get_statistics(self, request):
@@ -1407,17 +1371,13 @@ class AdminRoutesMixin:
             }
         )
 
-    def _start_scan_job(
-        self, files=DEFAULT_SCAN_SCOPE, roots=None, output_dirs=None, returned=None
-    ):
+    def _start_scan_job(self, files=DEFAULT_SCAN_SCOPE, roots=None, output_dirs=None):
         """Register the scan job synchronously; its runner starts on the loop.
 
         ``files`` is the scope (``SCAN_SCOPES``). ``roots`` selects sources by
         their index in ``output_dirs`` (the effective sources the caller
         resolved); None scans every source, resolved when the job starts.
-        Raises JobBusy while another record-changing job runs. ``returned``
-        (#498, ``[(path, locator)]``) makes it "Return images to the library":
-        those files' removal marks go first, then only they are scanned.
+        Raises JobBusy while another record-changing job runs.
         """
         if files not in SCAN_SCOPES:
             raise ValueError(f"Unknown scan scope: {files!r}")
@@ -1425,26 +1385,20 @@ class AdminRoutesMixin:
             output_dirs is None or not roots or max(roots) >= len(output_dirs)
         ):
             raise ValueError("A scoped scan needs the sources its roots index")
-        scope = {"files": files, "roots": None if roots is None else list(roots)}
-        if returned is not None:
-            scope = {"files": "returned", "roots": None, "images": len(returned)}
         job = self._jobs.start(
             SCAN_JOB_KIND,
-            SCAN_JOB_TITLE if returned is None else RETURN_JOB_TITLE,
+            SCAN_JOB_TITLE,
             record_changing=True,
-            scope=scope,
-            runner=functools.partial(
-                self._run_scan_job, output_dirs=output_dirs, returned=returned
-            ),
+            scope={"files": files, "roots": None if roots is None else list(roots)},
+            runner=functools.partial(self._run_scan_job, output_dirs=output_dirs),
             groups=SCAN_GROUP_NAMES,
         )
         self._scan_job = job
         return job
 
-    async def _run_scan_job(self, job, output_dirs=None, returned=None):
+    async def _run_scan_job(self, job, output_dirs=None):
         final = None
-        extra = {} if returned is None else {"returned": returned}
-        async for payload in self._scan_images_events(job, output_dirs, **extra):
+        async for payload in self._scan_images_events(job, output_dirs):
             job.publish(payload)
             final = payload.get("type")
         state = SCAN_FINAL_STATES.get(final, "finished")
@@ -1454,7 +1408,6 @@ class AdminRoutesMixin:
             verb = "cancelled" if state == "cancelled" else "finished"
             job.log_line(f"Scan {verb} · {_plural(job.processed, 'file')} processed")
         job.finish(state)
-        await self._release_job_memory()
         if state == "finished":
             # After the scan, so the guarded thumbnail job is admitted (#249).
             await self._hand_off_scan_thumbnails(job, output_dirs)
@@ -1483,7 +1436,7 @@ class AdminRoutesMixin:
             )
         return response
 
-    async def _scan_images_events(self, job, output_dirs=None, returned=None):
+    async def _scan_images_events(self, job, output_dirs=None):
         """Yield progress payloads while scanning the output directories.
 
         Every effective source is walked, or only those ``job.scope["roots"]``
@@ -1521,16 +1474,9 @@ class AdminRoutesMixin:
                 0, f"Scanning {len(walked)} directory(ies) for media files..."
             )
 
-            if returned is None:
-                media_files = await self._run_in_executor(
-                    self._collect_output_media_sync, walked
-                )
-            else:
-                # #498: only the files whose marks this job deleted.
-                media_files = await self._run_in_executor(
-                    self._clear_returned_marks, returned
-                )
-                job.log_line(f"Returned {_plural(len(media_files), 'image')}")
+            media_files = await self._run_in_executor(
+                self._collect_output_media_sync, walked
+            )
             counts = dict.fromkeys(SCAN_COUNT_KEYS, 0)
             job.update(
                 total=len(media_files),
@@ -1605,13 +1551,8 @@ class AdminRoutesMixin:
             if job.cancelled:
                 return
             batch = media_files[batch_start : batch_start + SCAN_BATCH_SIZE]
-            # #480: a file removed from the library is not read or linked
-            # again while its bytes are unchanged.
-            removed = await self._run_in_executor(self._removed_paths, batch)
-            skipped = [f for f in batch if str(f) in known or str(f) in removed]
-            to_read = [
-                f for f in batch if str(f) not in known and str(f) not in removed
-            ]
+            skipped = [f for f in batch if str(f) in known]
+            to_read = [f for f in batch if str(f) not in known]
             outcomes = [_scan_outcome(f, roots, "skipped") for f in skipped]
             counts["processed"] += len(skipped)
             counts["unchanged"] += len(skipped)
@@ -1669,10 +1610,9 @@ class AdminRoutesMixin:
     def _extract_batch_metadata_sync(self, file_batch):
         """Extract metadata from a batch of files in one executor call.
 
-        Files are read on the long-lived job pool of
-        ``PromptManagerConfig.WORKER_THREADS`` threads (#523).
-        PNG text is read chunk by chunk without decoding pixels (#523); file
-        reads and ffprobe release the GIL.
+        Files are read on ``PromptManagerConfig.WORKER_THREADS`` threads:
+        Pillow decodes the whole image to reach trailing text chunks and
+        releases the GIL while doing so.
         """
         from ..config import PromptManagerConfig
 

py/api/annotation_suggest.py

@@ -13,6 +13,7 @@ import math
 from ..tagging_defaults import (  # noqa: F401 - re-exported for the route
     LLM_MODEL_TYPES as LLM_MODELS,
     MAX_INSTRUCTION_BYTES,
+    MAX_INSTRUCTION_CHARS,
     MODEL_TYPES,
     WD14_MODEL_TYPES as WD14_MODELS,
     validate_template,
@@ -102,14 +103,11 @@ def model_refusal(status: dict, model_type: str, model_name: str):
     return None
 
 
-def run_suggestions(
-    service, capture_path: str, model_type: str, options: dict, skip=None
-):
+def run_suggestions(service, capture_path: str, model_type: str, options: dict):
     """Blocking: load (or swap to) *model_type*, then suggest for the capture.
 
     The caller holds the model gate for the whole call; nothing is ever
-    downloaded (``load_model`` refuses a model that is not on disk). ``skip``
-    is the request's or job's compiled Skipped tags (#431).
+    downloaded (``load_model`` refuses a model that is not on disk).
     """
     if not service.is_model_loaded() or service.get_loaded_model_type() != model_type:
         service.load_model(model_type, options["use_gpu"])
@@ -119,7 +117,6 @@ def run_suggestions(
         prompt=options.get("instructions"),
         general_threshold=options.get("general_threshold"),
         character_threshold=options.get("character_threshold"),
-        skip=skip,
     )
 
 

py/api/annotations.py

@@ -35,7 +35,6 @@ from .media_target import media_target as _target
 from .images import _unavailable_link, _verified_title
 from .prompts import bad_request
 from .. import model_gate
-from ..tagging_defaults import SkipMatcher
 
 try:
     from ...database.annotations import (
@@ -641,8 +640,6 @@ class AnnotationRoutesMixin:
             owner = model_gate.new_owner("image-annotations")
             if not model_gate.try_acquire(owner):
                 return model_busy_response()
-            # #431: the Skipped tags as they are when the request is accepted.
-            skip = SkipMatcher(AutotagConfig.SKIPPED_TAGS).counting()
             try:
                 # From here the pin is the gate's to end: the worker ends it,
                 # or ``on_skipped`` does when the worker never starts.
@@ -656,7 +653,6 @@ class AnnotationRoutesMixin:
                     capture,
                     model_type,
                     options,
-                    skip,
                     on_skipped=functools.partial(store.release_use, token),
                 )
             except MissingBackendPackages as exc:
@@ -681,8 +677,6 @@ class AnnotationRoutesMixin:
                 "model_type": model_type,
                 "options": options,
                 "suggestions": suggestion_rows(pairs),
-                # How many distinct suggestions the Skipped tags hid (#431).
-                "skipped": len(skip.hidden),
             },
             headers={"Cache-Control": "no-store"},
         )
@@ -738,10 +732,10 @@ def _byte_range(request: web.Request, size: int):
     return start, stop
 
 
-def _pinned_suggestions(store, token, service, capture, model_type, options, skip=None):
+def _pinned_suggestions(store, token, service, capture, model_type, options):
     """Worker thread: infer on the capture, then end its pin (even on error)."""
     try:
-        return run_suggestions(service, capture.path, model_type, options, skip)
+        return run_suggestions(service, capture.path, model_type, options)
     finally:
         store.release_use(token)
 

py/api/autotag_routes.py

@@ -19,15 +19,10 @@ from .jobs import (
 )
 
 from .maintenance import disk_plan
-from .images import listing_thumbnail_url
-from . import preview_store
+from .prompts import thumbnail_url_for
+from . import thumbnail_settings
 from .. import model_gate
 
-try:
-    from ...utils.media_folders import in_trash_below_roots, is_skipped_folder
-except ImportError:
-    from utils.media_folders import in_trash_below_roots, is_skipped_folder
-
 from aiohttp import web
 
 _INTERNAL_ERROR = "An internal error occurred. Check server logs for details."
@@ -40,12 +35,6 @@ BATCH_PREVIEW_BODY_MAX = 1024
 APPLY_BODY_MAX = 64 * 1024  # POST /autotag/apply: one image and its tags
 _HEX64 = re.compile(r"[0-9a-f]{64}")
 BATCH_JOB_BODY_MAX = 32 * 1024
-# Skipped tags preview (#431): 200 entries of 50 characters, with room for JSON.
-SKIPPED_PREVIEW_BODY_MAX = 64 * 1024
-SKIPPED_PREVIEW_LEASE = "Skipped tags preview"
-SKIPPED_PREVIEW_SAMPLE = 12
-# WD14 label lists the preview found missing or unreadable (logged once each).
-_MISSING_LABEL_LISTS = set()
 REVIEW_REQUIRED = (
     "Replacing tags needs a review of each image. Use Preview tagging review, "
     "or choose Skip or Merge for a batch run."
@@ -78,12 +67,6 @@ MODEL_DOWNLOAD_BODY_MAX = 1024
 _download_titles = {}
 
 
-def _instruction_engine(model_type: str) -> str:
-    """The language-model engine whose default instructions ``model_type``
-    reads: itself, or GGUF for a WD14 engine (which takes none)."""
-    return model_type if model_type in ("gguf", "hf") else "gguf"
-
-
 def _holder_label(holder: Optional[str]) -> str:
     if not holder:
         return ANOTHER_OPERATION
@@ -259,10 +242,6 @@ class AutotagRoutesMixin:
         async def preview_autotag_batch_route(request):
             return await self.preview_autotag_batch(request)
 
-        @routes.post("/prompt_manager/autotag/skipped-tags/preview")
-        async def preview_skipped_tags_route(request):
-            return await self.preview_skipped_tags(request)
-
         @routes.post("/prompt_manager/autotag/start")
         async def start_autotag_route(request):
             return await self.start_autotag(request)
@@ -300,15 +279,7 @@ class AutotagRoutesMixin:
                     "success": True,
                     "models": public_models(status, loaded_type),
                     # The saved tagging defaults (#328, System › Auto-tagging).
-                    # The saved engine's default instructions (GGUF for a
-                    # WD14 engine); kept one release for cached pages (#431).
-                    "default_prompt": AutotagConfig.default_instructions_text(
-                        _instruction_engine(AutotagConfig.MODEL_TYPE)
-                    ),
-                    # #431: Built-in first, with every text, and each
-                    # language-model engine's default.
-                    "instructions": AutotagConfig.all_instructions(),
-                    "default_instructions": dict(AutotagConfig.DEFAULT_INSTRUCTIONS),
+                    "default_prompt": AutotagConfig.TEMPLATE,
                     "model_loaded": loaded,
                     "loaded_model_type": loaded_type,
                     "wd14_general_threshold": AutotagConfig.GENERAL_THRESHOLD,
@@ -448,7 +419,6 @@ class AutotagRoutesMixin:
         title = f"Tagging model download · {label}"
         _download_titles.clear()
         _download_titles[owner] = title
-        admitted = False
         try:
             job = self._jobs.start(
                 MODEL_DOWNLOAD_JOB_KIND,
@@ -464,13 +434,13 @@ class AutotagRoutesMixin:
                     self._run_model_download, service, model_type, owner
                 ),
             )
-            admitted = True
-        except JobBusy as refused:
-            return None, busy_response(refused)
-        finally:
-            if not admitted:  # JobBusy, or anything else: give the gate back.
-                model_gate.release(owner)
-                _download_titles.pop(owner, None)
+        except BaseException as refused:
+            # JobBusy, or anything else the registry raised: give the gate back.
+            model_gate.release(owner)
+            _download_titles.pop(owner, None)
+            if isinstance(refused, JobBusy):
+                return None, busy_response(refused)
+            raise
 
         def ended(_task):
             model_gate.release(owner)
@@ -563,10 +533,7 @@ class AutotagRoutesMixin:
         else:
             prompt = params.get("prompt")
             template = prompt if isinstance(prompt, str) and prompt.strip() else None
-            options = {
-                "instructions": template
-                or AutotagConfig.default_instructions_text(model_type)
-            }
+            options = {"instructions": template or AutotagConfig.TEMPLATE}
         try:
             _model, options = validate_options(
                 model_type,
@@ -726,86 +693,6 @@ class AutotagRoutesMixin:
             return None, "existing must be one of " + ", ".join(EXISTING_POLICIES)
         return MODELS[model_type], None
 
-    async def preview_skipped_tags(self, request):
-        """Which known tags a Skipped tags list would hide (#431); no write.
-
-        ``{entries}`` is checked as a save checks it (the same 400 sentence).
-        The known tags are the library's plus the general and character names
-        of each downloaded WD14 label list; no model is loaded and no image is
-        opened. Refused (409 ``busy``) while an exclusive job runs.
-        """
-        from ..tagging_defaults import validate_skipped_tags
-
-        data, error = await self._batch_body(
-            request, ("entries",), SKIPPED_PREVIEW_BODY_MAX
-        )
-        if error is not None:
-            return error
-        try:
-            entries = validate_skipped_tags(data["entries"])
-        except ValueError as exc:
-            return web.json_response({"success": False, "error": str(exc)}, status=400)
-        try:
-            async with self._jobs.lease(SKIPPED_PREVIEW_LEASE):
-                result = await self._run_in_executor(self._skipped_preview, entries)
-        except JobBusy as busy:
-            return busy_response(busy)
-        except Exception:
-            self.logger.exception("The Skipped tags preview failed")
-            return web.json_response(
-                {"success": False, "error": _INTERNAL_ERROR}, status=500
-            )
-        return web.json_response({"success": True, **result})
-
-    def _skipped_preview(self, entries):
-        """Worker thread: the preview's counts over the known tags."""
-        from ..autotag import MODELS, get_autotag_service
-        from ..tagging_defaults import (
-            WD14_MODEL_TYPES,
-            SkipMatcher,
-            wd14_label_names,
-        )
-
-        library = self.db.get_all_tags()
-        known = {}  # case-folded -> (0 library / 1 label list, spelling)
-        for name in library:
-            known.setdefault(name.casefold(), (0, name))
-        lists = []
-        models_dir = getattr(get_autotag_service(), "models_dir", None)
-        for model_type in sorted(WD14_MODEL_TYPES, key=lambda t: MODELS[t]["name"]):
-            if models_dir is None:
-                break
-            path = Path(models_dir) / MODELS[model_type]["subdir"] / "selected_tags.csv"
-            try:
-                names = wd14_label_names(path)
-            except (OSError, ValueError) as exc:
-                if path not in _MISSING_LABEL_LISTS:  # logged once per list
-                    _MISSING_LABEL_LISTS.add(path)
-                    self.logger.debug(f"No WD14 label list for {model_type}: {exc}")
-                continue
-            _MISSING_LABEL_LISTS.discard(path)
-            lists.append(MODELS[model_type]["name"])
-            for name in names:
-                known.setdefault(name.casefold(), (1, name))
-        matchers = [(entry, SkipMatcher([entry])) for entry in entries]
-        whole = SkipMatcher(entries)
-        hidden = [item for item in known.values() if whole.matches(item[1])]
-        hidden.sort(key=lambda item: (item[0], item[1].casefold()))
-        per_entry = [
-            {
-                "entry": entry,
-                "count": sum(1 for _, name in hidden if matcher.matches(name)),
-            }
-            for entry, matcher in matchers
-        ]
-        return {
-            "count": len(hidden),
-            "sample": [name for _, name in hidden[:SKIPPED_PREVIEW_SAMPLE]],
-            "sample_limit": SKIPPED_PREVIEW_SAMPLE,
-            "per_entry": per_entry,
-            "sources": {"library": len(library), "wd14": lists},
-        }
-
     async def preview_autotag_batch(self, request):
         """Review Tag output images: counts, model, backup and disk; no write.
 
@@ -957,12 +844,9 @@ class AutotagRoutesMixin:
         """Return the real path when it is a media file inside an output directory."""
         if Path(str(raw_path)).suffix.lower() not in _MEDIA_EXTENSIONS:
             return None
-        roots = list(self._get_all_output_dirs())
-        for output_dir in roots:
+        for output_dir in self._get_all_output_dirs():
             if path_is_within(raw_path, output_dir):
                 real = os.path.realpath(raw_path)
-                if in_trash_below_roots(real, roots):
-                    return None  # thrown away, not an output (#543)
                 return real if os.path.isfile(real) else None
         return None
 
@@ -1109,10 +993,7 @@ class AutotagRoutesMixin:
         else:
             prompt = data.get("prompt")
             template = prompt if isinstance(prompt, str) and prompt.strip() else None
-            options = {
-                "instructions": template
-                or AutotagConfig.default_instructions_text(model_type)
-            }
+            options = {"instructions": template or AutotagConfig.TEMPLATE}
         use_gpu = data.get("use_gpu", True)
         options["use_gpu"] = use_gpu if isinstance(use_gpu, bool) else True
         return validate_options(
@@ -1152,12 +1033,12 @@ class AutotagRoutesMixin:
                 return self._bad_request('existing must be "skip" or "merge"')
             try:
                 options = self._single_options(data, model_type)
-            except OptionError as error:
-                return self._bad_request(str(error))
             except (ValueError, TypeError):
                 return self._bad_request(
                     "general_threshold and character_threshold must be numeric"
                 )
+            except OptionError as error:
+                return self._bad_request(str(error))
             target, error = await self._select_autotag_target(data)
             if error is not None:
                 return error
@@ -1206,8 +1087,6 @@ class AutotagRoutesMixin:
 
     async def _suggest_single(self, target, model_type, options, base):
         from ..autotag import MODELS, MissingBackendPackages, get_autotag_service
-        from ..config import AutotagConfig
-        from ..tagging_defaults import SkipMatcher
         from .annotation_suggest import model_refusal
         from .annotations import _pinned_suggestions, _settled, _submit
 
@@ -1224,8 +1103,6 @@ class AutotagRoutesMixin:
         owner = model_gate.new_owner("legacy-single")
         if not model_gate.try_acquire(owner):
             return model_busy_response()
-        # #431: the legacy review hides the Skipped tags too (19A).
-        skip = SkipMatcher(AutotagConfig.SKIPPED_TAGS)
         store = self._capture_store()
         try:
             epoch = await self._run_in_executor(self.db.get_execution_epoch)
@@ -1265,7 +1142,6 @@ class AutotagRoutesMixin:
                     capture,
                     model_type,
                     options,
-                    skip,
                     on_skipped=functools.partial(store.release_use, capture.token),
                 )
             except MissingBackendPackages as exc:
@@ -1443,9 +1319,8 @@ class AutotagRoutesMixin:
     def _collect_scan_files(output_path: Path):
         """Media files under ``output_path`` from a bounded, symlink-free walk.
 
-        Descends at most ``_SCAN_MAX_DEPTH`` levels, skips ``thumbnails`` and
-        trash folders (``utils.media_folders``) and symlinked files, and stops
-        after ``_SCAN_MAX_FILES`` files.
+        Descends at most ``_SCAN_MAX_DEPTH`` levels, skips ``thumbnails``
+        trees and symlinked files, and stops after ``_SCAN_MAX_FILES`` files.
         Returns ``(paths, truncated)``.
         """
         found = []
@@ -1455,7 +1330,7 @@ class AutotagRoutesMixin:
             dirnames[:] = sorted(
                 name
                 for name in dirnames
-                if not is_skipped_folder(name) and depth + 1 <= _SCAN_MAX_DEPTH
+                if name != "thumbnails" and depth + 1 <= _SCAN_MAX_DEPTH
             )
             for name in sorted(filenames):
                 if Path(name).suffix.lower() not in _MEDIA_EXTENSIONS:
@@ -1482,25 +1357,23 @@ class AutotagRoutesMixin:
             files, truncated = await self._run_in_executor(
                 self._collect_scan_files, output_path
             )
-            # #501: a file removed from the library is not offered for tagging.
-            files = await self._run_in_executor(
-                self._without_removed, output_path, files
-            )
-            location = preview_store.current()
-            if location.mode == preview_store.FOLDER_MODE:
-                has_thumbnails = location.available  # no store I/O here (#320)
-            else:
-                store = preview_store.store_dir(output_path)
-                has_thumbnails = store is not None and store.is_dir()
+            has_thumbnails = (output_path / "thumbnails").is_dir()
 
             images = []
             for image_path in files:
                 rel_path = image_path.relative_to(output_path)
                 thumbnail_url = None
                 if has_thumbnails:
-                    # Any preview the file owns, the current format first
-                    # (#317); in folder mode without store I/O (#320).
-                    thumbnail_url = listing_thumbnail_url(output_path, rel_path)
+                    # Any preview the file owns, the current format first (#317)
+                    existing = thumbnail_settings.existing_thumbnail(
+                        output_path, rel_path
+                    )
+                    if existing is not None:
+                        thumb_rel = (
+                            thumbnail_settings.thumbnail_stem_rel(rel_path)
+                            + existing.suffix
+                        )
+                        thumbnail_url = thumbnail_url_for(thumb_rel, existing)
                 images.append(
                     {
                         "filename": image_path.name,

py/api/backup_restore.py

@@ -971,7 +971,6 @@ class BackupRestoreRoutesMixin:
         line = restored_line(staged.summary)
         job.log_line(line)
         job.update(progress=100, status_line=line)
-        return None
 
 
 async def _outlive_cancel(future):

py/api/duplicate_files.py

@@ -65,7 +65,6 @@ from .duplicate_review import (  # noqa: F401 (CHANGED, OUTSIDE_SOURCE: public)
     NOT_ATTEMPTED,
     OUTSIDE_SOURCE,
     RECORDS_FAILED,
-    REVIEW_KEPT_DETAILS,
     ROW_DETAILS,
     SAME_FILE,
     SOURCES_CHANGED,
@@ -435,7 +434,6 @@ class DuplicateFilesMixin:
             {
                 "targets": review["targets"],
                 "kept": review["kept"],
-                "held": review["held"],
                 "protected": review["public"]["protected"]["count"],
             },
         )
@@ -448,7 +446,7 @@ class DuplicateFilesMixin:
         job hashes each file again right before it unlinks it.
         """
         listed = self._listed_sources()
-        targets, kept, protected, held = [], [], {}, []
+        targets, kept, protected = [], [], {}
         for group, keepers in selection.values():
             removals = [r for r in group["files"] if r not in keepers]
             for record in removals:
@@ -469,7 +467,6 @@ class DuplicateFilesMixin:
                     problem = _bound_problem(record, group, keeper)
                 if problem:
                     protected[problem] = protected.get(problem, 0) + 1
-                    held.append(self._copy_row(record, REVIEW_KEPT_DETAILS[problem]))
                     continue
                 reviewed.append(self._target(group, record, keeper))
             if reviewed:
@@ -491,7 +488,6 @@ class DuplicateFilesMixin:
         return {
             "targets": targets,
             "kept": kept,
-            "held": held,
             "fingerprint": _fingerprint(targets),
             "public": _public_plan(targets, protected, records),
         }
@@ -578,23 +574,15 @@ class DuplicateFilesMixin:
             return _fail_job(job, "sources-changed", SOURCES_CHANGED)
         ok, backup = await self._safety_backup_step(job, db, backup_on)
         if not ok:
-            return None
+            return
         try:
             await self._remove_duplicates(job, db, plan, backup)
         finally:
             if backup:
                 await self._prune_backup_pool(job, db)
-        return None
 
     async def _remove_duplicates(self, job, db, plan, backup):
         targets = plan.payload["targets"]
-        # #586: every copy the review protected, with its reason, and the
-        # whole group in the report.
-        held = plan.payload["held"]
-        job.record_counted("kept", len(held), held, complete=True)
-        if held:
-            copies = _plural(len(held), "copy", "copies")
-            job.log_line(f"Kept {copies} the review protected")
         for row in plan.payload["kept"]:
             job.record("kept", row, f"= {row['root']}/{row['path']} · {KEPT_COPY}")
         job.update(total=len(targets), status_line="Removing duplicate files")

py/api/duplicate_review.py

@@ -16,11 +16,6 @@ from pathlib import Path
 from .admin import DELETABLE_MEDIA_EXTENSIONS
 from .maintenance import DUPLICATE_FILES
 
-try:
-    from ...utils.media_folders import in_trash_below_roots, is_trash_folder
-except ImportError:
-    from utils.media_folders import in_trash_below_roots, is_trash_folder
-
 # Keep entries one review takes; with paths of a few hundred characters the
 # list stays inside the preview body cap (DUPLICATE_PREVIEW_BODY_MAX, 1 MiB).
 MAX_KEEP = 2000
@@ -70,18 +65,6 @@ PROTECTED_REASONS = {
         "files kept: their kept copy changed or is gone",
     ),
 }
-# The job's row for a copy the review protected (#586): the review's reason.
-REVIEW_KEPT_DETAILS = {
-    MAYBE_SAME: "Kept: may be the same file reached through another mount or share",
-    NO_FILE_ID: "Kept: can't confirm this is a separate file on this drive",
-    SAME: "Kept: the same file as its kept copy",
-    OUTSIDE_SOURCE: "Kept: not inside a configured source",
-    LINK: "Kept: a link, not a regular file",
-    CHANGED_CONTENT: "Kept: changed since the search",
-    GONE: "Kept: no longer exists",
-    UNREADABLE: "Kept: could not be read",
-    KEEPER: "Kept: its kept copy changed or is gone",
-}
 # Job outcome rows (never an OS error text).
 CHANGED = "The file changed since the review; it was kept."
 KEEPER_CHANGED = "The kept copy changed or is gone; this file was kept."
@@ -214,8 +197,6 @@ def file_problem(
     parts = Path(os.path.relpath(lexical, base)).parts
     if "thumbnails" in parts or ".." in parts:
         return OUTSIDE_SOURCE
-    if any(is_trash_folder(part) for part in parts[:-1]):
-        return OUTSIDE_SOURCE  # never removed from a trash folder (#543)
     if os.path.splitext(lexical)[1].lower() not in DELETABLE_MEDIA_EXTENSIONS:
         return OUTSIDE_SOURCE
     try:
@@ -231,8 +212,6 @@ def file_problem(
     try:
         if not _lexically_inside(_canonical_path(path), [_canonical_path(root)]):
             return OUTSIDE_SOURCE  # a linked folder on the way
-        if in_trash_below_roots(path, [root]):
-            return OUTSIDE_SOURCE  # a linked folder into a trash folder
         if keeper is not None:
             same = keeper_problem(path, root, info, keeper, keeper_root)
             if same:

py/api/duplicate_spellings.py

@@ -27,7 +27,7 @@ def _identity(path):
     except OSError:
         return None
     if info.st_ino:
-        return ("inode", (info.st_dev, info.st_ino))
+        return ("inode", info.st_dev, info.st_ino)
     return ("path", os.path.normcase(os.path.realpath(str(path))))
 
 

py/api/history.py

@@ -843,10 +843,7 @@ class HistoryRoutesMixin:
                 raise
 
         async def execute():
-            # An inspection reads the file's header and text: the
-            # interactive image pool (#523); media stays on the default.
-            run = self._run_image if kind == "inspection" else self._run_in_executor
-            pending = asyncio.create_task(run(project))
+            pending = asyncio.create_task(self._run_in_executor(project))
             try:
                 return await asyncio.shield(pending)
             except asyncio.CancelledError:

py/api/history_current.py

@@ -15,10 +15,9 @@ from typing import BinaryIO
 
 from aiohttp import web
 
-from . import preview_store, thumbnail_settings
+from . import thumbnail_settings
 from .images import _canonical, _public_path, SERVABLE_EXTENSIONS, VIDEO_EXTENSIONS
-from .images import in_trash_below_roots
-from .images import existing_media_thumbnail, media_preview_path
+from .images import existing_media_thumbnail, media_thumbnail_rel
 
 try:
     from ...utils.execution_outputs import (
@@ -199,9 +198,6 @@ def resolve_current_candidate(
         if namespace is None or not namespace.is_dir():
             return _unavailable("root_unavailable")
         target = _canonical(lexical)
-        if in_trash_below_roots(target, [namespace]):
-            # Every kind and the outputs listing come through here (#543).
-            return _unavailable("missing")
         if not _authorized(target, namespace, scope):
             return _unavailable("not_authorized")
         if target.suffix.lower() not in SERVABLE_EXTENSIONS:
@@ -244,36 +240,15 @@ def resolve_current_candidate(
         return _unavailable("temporary_unavailable", error=True)
 
 
-def _target_authorized(target, namespace, scope, store_root=None) -> bool:
-    """A preview in the thumbnail folder (#320, folder mode) is authorized by
-    the store of its source (``preview_store.owns``: inside the key folder,
-    no link); everything else by the output namespace and the roots."""
-    if (
-        store_root is not None
-        and preview_store.current().mode == preview_store.FOLDER_MODE
-    ):
-        return preview_store.owns(store_root, target)
-    return _authorized(target, namespace, scope)
-
-
 def _open_current_target(
-    target: Path,
-    namespace: Path,
-    scope: CurrentOutputScope,
-    preview: bool = False,
-    store_root: Path | None = None,
+    target: Path, namespace: Path, scope: CurrentOutputScope, preview: bool = False
 ) -> BinaryIO:
     """Open only the canonical target and verify authority against the actual handle.
 
-    A *preview* (a file under ``thumbnails/``) may also be JPEG XL (#317); in
-    folder mode it is authorized by the store of *store_root* (#320)."""
+    A *preview* (a file under ``thumbnails/``) may also be JPEG XL (#317)."""
     if _canonical(target) != target:
         raise CurrentLocationUnavailable("not_authorized", stale=True)
-    if in_trash_below_roots(target, [namespace]):
-        # Also at the open: the cover chooses its preview after the candidate
-        # check, and a preview can be a link into a trash folder (#543).
-        raise CurrentLocationUnavailable("missing")
-    if not _target_authorized(target, namespace, scope, store_root):
+    if not _authorized(target, namespace, scope):
         raise CurrentLocationUnavailable("not_authorized")
     suffix = target.suffix.lower()
     if suffix not in SERVABLE_EXTENSIONS and not (
@@ -306,7 +281,7 @@ def _open_current_target(
         if (
             _canonical(target) != target
             or (observed.st_dev, observed.st_ino) != (current.st_dev, current.st_ino)
-            or not _target_authorized(target, namespace, scope, store_root)
+            or not _authorized(target, namespace, scope)
         ):
             raise CurrentLocationUnavailable("not_authorized", stale=True)
         return os.fdopen(fd, "rb")
@@ -343,10 +318,12 @@ class _OpenedCurrentMedia:
 
 
 def _preview_writable(root: Path, preview: Path) -> bool:
-    """A preview may be written: the store of *root* and every link segment
-    of the preview's folder resolve inside it (the serve route's rule, #249;
-    ``preview_store.owns``)."""
-    return preview_store.owns(root, preview)
+    """A preview may be written: ``thumbnails`` and every link segment of the
+    preview's folder resolve inside *root* (the serve route's rule, #249)."""
+    folder = root / "thumbnails"
+    return _canonical(folder).is_relative_to(_canonical(root)) and _canonical(
+        preview
+    ).is_relative_to(_canonical(folder))
 
 
 def _is_jxl(path) -> bool:
@@ -396,12 +373,8 @@ def _cover_target(resolved, ensure_preview, placeholder, accepts_jxl):
         return _canonical(preview)
     if preview is not None:
         return _canonical(preview)
-    preview = media_preview_path(resolved.gallery_root, relative, create=True)
-    if (
-        ensure_preview is not None
-        and preview is not None
-        and _preview_writable(resolved.gallery_root, preview)
-    ):
+    preview = resolved.gallery_root / media_thumbnail_rel(relative)
+    if ensure_preview is not None and _preview_writable(resolved.gallery_root, preview):
         ensure_preview(target, preview, is_video)
     if is_video and placeholder is not None:
         return _placeholder_media(placeholder)
@@ -437,13 +410,7 @@ def _prepare_current_media(
             return chosen
         if chosen is not None:
             target, is_preview = chosen, True
-    handle = _open_current_target(
-        target,
-        resolved.namespace,
-        scope,
-        is_preview,
-        resolved.gallery_root if is_preview else None,
-    )
+    handle = _open_current_target(target, resolved.namespace, scope, is_preview)
     try:
         return _OpenedCurrentMedia(
             handle,

py/api/image_categories.py

@@ -232,17 +232,15 @@ class ImageCategoryRoutesMixin:
             return None, _coded(400, "too-many-images", TOO_MANY)
         return tuple(selection.targets), None
 
-    async def _category_request(self, request, fields: frozenset, data=None):
+    async def _category_request(self, request, fields: frozenset):
         """``(data, targets, roots, None)`` or ``(None, None, None, error)``.
 
         The images are ``items`` (1 to 500 targets) or ``filter`` (all images
-        an Images listing filter admits), besides *fields*. *data* is the body
-        when the caller has already read it (a body is read once).
+        an Images listing filter admits), besides *fields*.
         """
-        if data is None:
-            data, error = await _json_body_or_error(request)
-            if error is not None:
-                return None, None, None, error
+        data, error = await _json_body_or_error(request)
+        if error is not None:
+            return None, None, None, error
         names = set(data) - fields
         if set(data) & fields != fields or names not in ({"items"}, {"filter"}):
             return (

py/api/image_delete.py

@@ -1,522 +0,0 @@
-"""Delete selected images: remove them from the library, or trash them (#480).
-
-``POST /prompt_manager/images/delete/preview {items | filter}`` reviews the
-selection for both modes at once and answers a reviewed plan (the System ›
-Maintenance contract, ``py/api/maintenance.py``): the token, the counts of
-the records each file loses, the refused files with a coded reason (both
-modes, and the trash-only ones), the prompts that lose their last image and
-the safety backup. It writes nothing. ``items`` are Images listing identities
-(at most 500); ``filter`` is "Select all N matching". Each target is matched
-to its entry in the current listing (``not-listed`` otherwise), so every
-later step uses the walked spelling, never the request's text.
-
-``POST /prompt_manager/maintenance/apply {token, mode}`` runs the plan as the
-``image_delete`` job (admission ``records``, not cancellable): the sources
-are checked, the promised safety backup is taken, then each file is checked
-again (containment and fingerprint) and
-
-- ``mode="library"``: its records are deleted and its removal mark written
-  in one transaction; the file stays on disk, hidden;
-- ``mode="trash"``: it is moved to the trash first (``utils/trash.py``); a
-  refused move leaves the file and its records alone; after a move its
-  records are deleted.
-
-No path here unlinks a media file. A failed records write stops the job; the
-files after it are not attempted.
-"""
-
-import hashlib
-import json
-import os
-import stat as stat_module
-from pathlib import Path
-
-from .admin import DELETABLE_MEDIA_EXTENSIONS, _remove_thumbnail
-from .duplicate_review import (
-    CHANGED_CONTENT,
-    GONE,
-    LINK,
-    OUTSIDE_SOURCE,
-    UNREADABLE,
-    file_problem,
-)
-from .images import _favorite_relative_key, _favorite_root_key
-from .jobs import IMAGE_DELETE_GROUP_NAMES, IMAGE_DELETE_JOB_KIND, JobBusy
-from .job_routes import busy_response
-from .maintenance import MAINTENANCE_PREVIEW_LEASE, _fail_job, _failure, backup_note
-
-try:
-    from ...database import image_removal_schema
-    from ...database.image_removal import mark_hides
-    from ...database.annotation_schema import MAX_LOCATOR_LENGTH
-    from ...utils import trash
-    from ...utils.media_folders import is_trash_folder
-except ImportError:
-    from database import image_removal_schema
-    from database.image_removal import mark_hides
-    from database.annotation_schema import MAX_LOCATOR_LENGTH
-    from utils import trash
-    from utils.media_folders import is_trash_folder
-
-IMAGE_DELETE = "delete_images"
-MODES = ("library", "trash")
-TITLES = {
-    "library": "Delete images (remove from the library)",
-    "trash": "Delete images (move to the trash)",
-}
-MAX_DETAIL_ROWS = 50
-# The system moved the file but its place in a trash could not be shown (#499).
-TRASH_UNCONFIRMED = "trash-unconfirmed"
-RECORDS_FAILED_CODE = "records-failed"
-
-# Reason codes (design §4.4) and the sentence each shows.
-REASONS = {
-    "not-listed": "No longer listed in Images.",
-    "outside": "Outside the output folders.",
-    "link": "A link, not a file.",
-    "gone": "The file no longer exists.",
-    "unreadable": "The file can't be read.",
-    "thumbnail": "A generated preview, not an image.",
-    "not-media": "Not a media file.",
-    "trash-folder": "Inside a trash folder.",
-    "path-too-long": "The path is too long.",
-    "changed": "The file changed after the review.",
-    trash.NO_TRASH: "This drive has no trash.",
-    trash.NETWORK: "Network drives can't use the trash.",
-    trash.TRASH_IN_ROOT: "This drive's trash is inside an output folder.",
-    trash.LOCKED: "The file is open in another program. Close it and try again.",
-    trash.FAILED: "The file could not be moved to the trash.",
-    trash.NO_PERMISSION: (
-        "PromptManager isn't allowed to move this file (no permission, or it is "
-        "locked in Finder)."
-    ),
-    trash.CLOUD_SYNC: (
-        "Files in iCloud Drive or a cloud-synced folder can't be moved to the "
-        "trash here."
-    ),
-    TRASH_UNCONFIRMED: (
-        "Moved by macOS, but its place in the trash could not be confirmed."
-    ),
-    trash.WINDOWS_RECYCLE: (
-        "Moving files to the Recycle Bin isn't available on Windows: files larger "
-        "than the bin's capacity would be deleted permanently."
-    ),
-    "not-attempted": "Not attempted: the job stopped after an error.",
-}
-_PROBLEM_CODES = {
-    OUTSIDE_SOURCE: "outside",
-    LINK: "link",
-    GONE: "gone",
-    UNREADABLE: "unreadable",
-    CHANGED_CONTENT: "changed",
-}
-SOURCES_CHANGED = "The sources changed since the review; nothing was changed."
-RECORDS_FAILED = "The image records could not be removed; the job stopped."
-
-
-def lexical_problem(relative: str) -> str | None:
-    """The refusal code a root-relative POSIX path earns before any file access."""
-    parts = relative.split("/")
-    if "thumbnails" in parts[:-1]:
-        return "thumbnail"
-    if any(is_trash_folder(part) for part in parts[:-1]):
-        return "trash-folder"
-    if os.path.splitext(parts[-1])[1].lower() not in DELETABLE_MEDIA_EXTENSIONS:
-        return "not-media"
-    return None
-
-
-def file_check(path, root, relative, *, expected=None):
-    """``(code, lstat)``: why *path* may not be deleted, or ``(None, lstat)``.
-
-    Text first (inside the root, not a preview or trash folder, a media
-    file), then ``duplicate_review.file_problem``: a regular file, not a
-    link, whose resolved path is still inside the resolved root. With
-    *expected* (``{size, mtime_ns, inode}`` from the review) the file must
-    still be those bytes. Every handle is closed when this returns.
-    """
-    code = lexical_problem(relative)
-    if code:
-        return code, None
-    try:
-        info = os.lstat(path)
-    except FileNotFoundError:
-        return "gone", None
-    except OSError:
-        return "unreadable", None
-    if getattr(info, "st_file_attributes", 0) & getattr(
-        stat_module, "FILE_ATTRIBUTE_REPARSE_POINT", 0
-    ):
-        return "link", info
-    if expected is None:
-        problem = file_problem(path, root, None, info.st_size, hash_check=False)
-    else:
-        problem = file_problem(
-            path,
-            root,
-            None,
-            expected["size"],
-            hash_check=False,
-            mtime_ns=expected["mtime_ns"],
-            inode=expected["inode"],
-        )
-    if problem:
-        return _PROBLEM_CODES.get(problem, "outside"), info
-    if len(os.path.normcase(os.path.realpath(path))) > MAX_LOCATOR_LENGTH:
-        return "path-too-long", info
-    return None, info
-
-
-def _row(target, code):
-    return {
-        "path": target["rel"],
-        "root_label": target["root_label"],
-        "code": code,
-        "detail": REASONS[code],
-    }
-
-
-def _summary(rows):
-    counts = {}
-    for row in rows:
-        counts[row["code"]] = counts.get(row["code"], 0) + 1
-    return {"count": len(rows), "counts": counts, "rows": rows[:MAX_DETAIL_ROWS]}
-
-
-def _fingerprint(targets) -> str:
-    material = [
-        (t["root_index"], t["rel"], t["size"], t["mtime_ns"], t["inode"])
-        for t in targets
-    ]
-    return hashlib.sha256(json.dumps(material).encode("utf-8")).hexdigest()
-
-
-class ImageDeleteMixin:
-    """The Images Delete… review and its apply job (#480)."""
-
-    def _register_image_delete_routes(self, routes):
-        # A fixed path beside the dynamic /images/{image_id} routes: aiohttp
-        # (3.10+) looks fixed paths up first (see image_categories.py).
-        @routes.post("/prompt_manager/images/delete/preview")
-        async def preview_image_delete_route(request):
-            return await self.preview_image_delete(request)
-
-    # ── review ────────────────────────────────────────────────────────
-
-    async def preview_image_delete(self, request):
-        """Review the selection under the maintenance preview lease."""
-        try:
-            async with self._jobs.lease(MAINTENANCE_PREVIEW_LEASE):
-                return await self._preview_image_delete(request)
-        except JobBusy as busy:
-            return busy_response(busy)
-
-    async def _preview_image_delete(self, request):
-        _data, targets, roots, error = await self._category_request(
-            request, frozenset()
-        )
-        if error is not None:
-            return error
-        db = self.db
-        identity = self._database_identity(db)
-        try:
-            files = {}
-            for index in dict.fromkeys(t[0] for t in targets):
-                files[index] = await self._get_gallery_files(roots[index])
-            review = await self._run_in_executor(
-                self._review_image_delete, db, roots, targets, files
-            )
-        except Exception:
-            self.logger.exception("Image delete review failed")
-            return _failure("The review failed. Check server logs for details.", 500)
-        return await self._plan_response(
-            db,
-            identity,
-            IMAGE_DELETE,
-            _fingerprint(review["targets"]),
-            review["public"],
-            {"targets": review["targets"]},
-        )
-
-    def _review_image_delete(self, db, roots, targets, files):
-        """Every target checked now (blocking); ``{targets, public}``."""
-        listings, seen = {}, set()
-        acted, refused, trash_refused = [], [], []
-        spellings = self._source_spellings()
-        root_texts = [str(root) for root in roots]
-        for index, _scope, relative in targets:
-            root = roots[index]
-            if index not in listings:
-                listings[index] = self._favorite_listing(root, files[index])
-            spelled = listings[index].get(_favorite_relative_key(relative))
-            target = {
-                "root_index": index,
-                "root_scope": _scope,
-                "root": str(root),
-                "root_label": self._public_path(root),
-                "rel": spelled or relative,
-            }
-            if spelled is None:
-                refused.append(_row(target, "not-listed"))
-                continue
-            absolute = os.path.join(str(root), *spelled.split("/"))
-            code, info = file_check(absolute, str(root), spelled)
-            if code:
-                refused.append(_row(target, code))
-                continue
-            identity = (info.st_dev, info.st_ino)
-            if identity in seen:
-                continue  # one physical file named twice (nested roots, hardlinks)
-            seen.add(identity)
-            target.update(self._removal_of(absolute, info, spellings))
-            target["trash"] = trash.trash_available(absolute, root_texts)
-            if target["trash"]:
-                trash_refused.append(_row(target, target["trash"]))
-            acted.append(target)
-        counted = db.count_removal_records([t["removal"] for t in acted])
-        library_count = len(acted)
-        public = {
-            "operation": IMAGE_DELETE,
-            "scope": {"count": library_count, "label": "images"},
-            "library": {"count": library_count},
-            "trash": {"count": library_count - len(trash_refused)},
-            "protected": {"count": len(refused), "reasons": []},
-            "refused": _summary(refused),
-            "trash_refused": _summary(trash_refused),
-            "records": counted["records"],
-            "orphaned_prompts": counted["orphaned_prompts"],
-            "media": {"deletes_files": False, "label": "Chosen in the review"},
-            "details": [],
-        }
-        return {"targets": acted, "public": public}
-
-    @staticmethod
-    def _removal_of(absolute, info, spellings):
-        favorites = [
-            (_favorite_root_key(root), _favorite_relative_key(relative))
-            for root, relative in spellings.favorites(absolute).items()
-        ]
-        return {
-            "abs": absolute,
-            "size": info.st_size,
-            "mtime_ns": info.st_mtime_ns,
-            "inode": [info.st_dev, info.st_ino],
-            "removal": {
-                "spellings": list(spellings.of(absolute).values()),
-                "locator": os.path.normcase(os.path.realpath(absolute)),
-                "favorites": favorites,
-                "category": spellings.category_key(absolute),
-            },
-        }
-
-    # ── apply ─────────────────────────────────────────────────────────
-
-    def _start_image_delete(self, db, plan, mode, backup_on):
-        """Register the delete job for a reviewed plan (on the loop)."""
-        return self._jobs.start(
-            IMAGE_DELETE_JOB_KIND,
-            TITLES[mode],
-            admission="records",
-            cancellable=False,
-            scope={"operation": IMAGE_DELETE, "mode": mode},
-            groups=IMAGE_DELETE_GROUP_NAMES,
-            runner=lambda job: self._run_image_delete(job, db, plan, mode, backup_on),
-        )
-
-    async def _run_image_delete(self, job, db, plan, mode, backup_on):
-        targets = plan.payload["targets"]
-        unchanged = await self._run_in_executor(self._sources_unchanged, targets)
-        if not unchanged:
-            return _fail_job(job, "sources-changed", SOURCES_CHANGED)
-        ok, backup = await self._safety_backup_step(job, db, backup_on)
-        if not ok:
-            return None
-        try:
-            await self._delete_images(job, db, targets, mode, backup)
-        finally:
-            if backup:
-                await self._prune_backup_pool(job, db)
-        return None
-
-    async def _delete_images(self, job, db, targets, mode, backup):
-        job.update(total=len(targets), status_line=TITLES[mode])
-        roots = [str(root) for root in self._get_all_output_dirs()]
-        done_group = "trashed" if mode == "trash" else "removed"
-        changed, failed = 0, None
-        for done, target in enumerate(targets, start=1):
-            if failed:
-                self._record_delete(job, "not_changed", target, "not-attempted")
-                continue
-            group, code, label = await self._run_in_executor(
-                self._delete_one_image, db, target, mode, roots
-            )
-            if group == "errors":
-                failed = code or RECORDS_FAILED_CODE
-                text = REASONS[code] if code else RECORDS_FAILED
-                job.record(
-                    "errors",
-                    {
-                        "path": target["rel"],
-                        "root": target["root_label"],
-                        "root_index": target["root_index"],
-                        "root_scope": target["root_scope"],
-                        "detail": text,
-                    },
-                    f"! {target['root_label']}/{target['rel']} · {text}",
-                )
-            elif group == done_group:
-                changed += 1
-                detail = (
-                    f"Moved to the {label}" if label else "Removed from the library"
-                )
-                self._record_delete(job, group, target, None, detail)
-            else:
-                self._record_delete(job, group, target, code)
-            job.update(processed=done, progress=int(done / len(targets) * 100))
-        if changed:
-            self.invalidate_gallery_cache()
-        verb = "Moved" if mode == "trash" else "Removed"
-        where = "to the trash" if mode == "trash" else "from the library"
-        line = f"{verb} {changed:,} of {len(targets):,} images {where}"
-        job.log_line(line)
-        job.update(progress=100, status_line=f"{line} · {backup_note(backup)}")
-        if failed:
-            # "records-failed" names every stop at an errors row (the page's
-            # "Stopped after N of M" toast); the row says which error it was.
-            job.scope["failure"] = RECORDS_FAILED_CODE
-            job.publish({"type": "error", "code": failed, "message": line})
-            job.finish("failed")
-
-    @staticmethod
-    def _record_delete(job, group, target, code, detail=None):
-        text = detail or REASONS[code]
-        row = {
-            "path": target["rel"],
-            "root": target["root_label"],
-            "root_index": target["root_index"],
-            "root_scope": target["root_scope"],
-            "code": code,
-            "detail": text,
-        }
-        mark = {"removed": "-", "trashed": "-"}.get(group, "=")
-        job.record(
-            group, row, f"{mark} {target['root_label']}/{target['rel']} · {text}"
-        )
-
-    def _delete_one_image(self, db, target, mode, roots):
-        """``(group, code, trash label)`` for one reviewed file (blocking)."""
-        code, _info = file_check(
-            target["abs"],
-            target["root"],
-            target["rel"],
-            expected={
-                "size": target["size"],
-                "mtime_ns": target["mtime_ns"],
-                "inode": target["inode"],
-            },
-        )
-        if code:
-            return "not_changed", code, None
-        label = None
-        if mode == "trash":
-            try:
-                label = trash.move_to_trash(target["abs"], roots)
-            except trash.TrashRefused as refused:
-                code = refused.code if refused.code in REASONS else trash.FAILED
-                self.logger.info(
-                    "Not moved to the trash (%s): %s %s",
-                    code,
-                    target["rel"],
-                    refused.detail,
-                )
-                return "not_changed", code, None
-            except trash.TrashUnconfirmed as unconfirmed:
-                # The file left its folder: keep its records, stop the job.
-                self.logger.warning(
-                    "Trash move not confirmed: %s %s", target["rel"], unconfirmed.detail
-                )
-                return "errors", TRASH_UNCONFIRMED, None
-            mark = None
-        else:
-            mark = (target["size"], target["mtime_ns"])
-        try:
-            db.remove_image_records(target["removal"], mark=mark)
-        except Exception:
-            self.logger.exception("Removing an image's records failed")
-            return "errors", None, label
-        _remove_thumbnail(Path(target["root"]), Path(target["rel"]), self.logger)
-        return ("trashed" if mode == "trash" else "removed"), None, label
-
-    # ── the workspace listing ─────────────────────────────────────────
-
-    def _removal_marks(self) -> dict:
-        """The removal marks, cached until a mark changes or the database does.
-
-        A listing page reads no table while nothing changed: the cache follows
-        this process's marks generation and the database identity (a restore).
-        """
-        key = (self._database_identity(self.db), image_removal_schema.generation())
-        cached = getattr(self, "_marks_cache", None)
-        if cached is None or cached[0] != key:
-            cached = (key, self.db.removal_marks())
-            self._marks_cache = cached
-        return cached[1]
-
-    def _hidden_entries(self, listings) -> set:
-        """Normalized paths of listed files a removal mark hides (blocking).
-
-        Only marked locators are looked at, and only those files are
-        ``lstat``'ed: a mark hides a file while its size and ``mtime_ns`` are
-        still the ones it was removed with.
-        """
-        marks = self._removal_marks()
-        if not marks:
-            return set()
-        located = self._workspace_locators(listings)
-        return {
-            entry.normalized
-            for locator, entry in ((locator, located.get(locator)) for locator in marks)
-            if entry is not None and mark_hides(marks, locator, entry.path)
-        }
-
-    def _removed_paths(self, paths) -> set:
-        """The absolute paths among *paths* a removal mark hides (blocking)."""
-        marks = self._removal_marks()
-        if not marks:
-            return set()
-        return {
-            str(path)
-            for path in paths
-            if mark_hides(marks, os.path.normcase(os.path.realpath(str(path))), path)
-        }
-
-    def _removal_check_under(self, root):
-        """``hidden(path) -> bool`` for files a walk of *root* found (blocking).
-
-        A walk never follows a link below *root*, so a file's locator is
-        ``normcase(join(realpath(root), relative))``: no ``realpath`` per
-        file, and an ``lstat`` only for a marked one. Without marks it
-        answers False at once.
-        """
-        marks = self._removal_marks()
-        if not marks:
-            return lambda _path: False
-        root = os.fspath(root)
-        real = os.path.realpath(root)
-
-        def hidden(path):
-            relative = os.path.relpath(os.fspath(path), root)
-            locator = os.path.normcase(os.path.join(real, relative))
-            return mark_hides(marks, locator, path)
-
-        return hidden
-
-    def _without_removed(self, root, paths) -> list:
-        """*paths* found by a walk of *root*, less the hidden ones (blocking)."""
-        removed = self._removal_check_under(root)
-        return [path for path in paths if not removed(path)]
-
-
-def parse_mode(value):
-    """The apply's ``mode``, or None when it is not one of MODES."""
-    return value if isinstance(value, str) and value in MODES else None

py/api/image_return.py

@@ -1,148 +0,0 @@
-"""Return removed images to the library (#498).
-
-``POST /prompt_manager/images/removed/return {items | filter}`` names files a
-removal mark hides (#480, "Remove from the library only"): ``items`` are 1 to
-500 listing identities, ``filter`` the removed view's listing query
-(``removed: "1"`` plus the view's other parameters, at most 500 images). Only
-this route takes ``removed``: every other bulk route refuses it, because an
-explicit write there would show a file again without re-reading it.
-
-The route answers 202 ``{job, returned, not_removed}`` after starting a
-``scan`` job titled "Return images to the library" (admission ``records``:
-409 ``busy`` beside a scan, restore or delete, nothing changed). The job
-first deletes the marks that still hide their file (same size and
-``mtime_ns``), in one transaction, then scans exactly those files with the
-scan's own pipeline: prompts, links, pairs and Needs review items come back
-from the files' embedded metadata. Image tags, auto-tag marks, the own
-category, collection memberships and the favorite were deleted by the remove
-and do not come back. No file is moved, written or deleted.
-"""
-
-import os
-from pathlib import Path
-
-from aiohttp import web
-
-from .image_categories import TOO_MANY, _coded
-from .images import (
-    ListingSourceChanged,
-    _favorite_relative_key,
-    _json_body_or_error,
-    parse_listing_filter,
-)
-from .image_tag_jobs import MAX_JOB_TARGETS
-from .jobs import JobBusy
-from .job_routes import busy_response
-
-try:
-    from ...database.image_removal import mark_hides
-except ImportError:
-    from database.image_removal import mark_hides
-
-NONE_REMOVED = "None of the selected images are removed from the library."
-SOURCE_CHANGED = "The image sources changed. Reload Images and try again."
-
-
-def _bad(message):
-    return web.json_response({"success": False, "error": message}, status=400)
-
-
-class ImageReturnMixin:
-    """Return to library (#498): clear the marks, then scan those files."""
-
-    def _register_image_return_routes(self, routes):
-        # A fixed path beside the dynamic /images/{image_id} routes.
-        @routes.post("/prompt_manager/images/removed/return")
-        async def return_removed_images_route(request):
-            return await self.return_removed_images(request)
-
-    async def return_removed_images(self, request):
-        data, error = await _json_body_or_error(request)
-        if error is not None:
-            return error
-        if set(data) == {"filter"}:
-            targets, roots, error = await self._removed_filter_targets(data["filter"])
-        else:
-            _data, targets, roots, error = await self._category_request(
-                request, frozenset(), data=data
-            )
-        if error is not None:
-            return error
-        files = {}
-        for index in dict.fromkeys(t[0] for t in targets):
-            files[index] = await self._get_gallery_files(roots[index])
-        returned, not_removed = await self._run_in_executor(
-            self._hidden_targets, roots, targets, files
-        )
-        if not returned:
-            return _coded(400, "no-images", NONE_REMOVED)
-        try:
-            job = self._start_scan_job(
-                files="all", output_dirs=list(roots), returned=returned
-            )
-        except JobBusy as busy:
-            return busy_response(busy)
-        return web.json_response(
-            {
-                "success": True,
-                "job": job.summary(),
-                "returned": len(returned),
-                "not_removed": not_removed,
-            },
-            status=202,
-        )
-
-    async def _removed_filter_targets(self, raw):
-        """``(targets, roots, None)`` for the removed view's filter, else an error."""
-        if not isinstance(raw, dict) or raw.get("removed") != "1":
-            return None, None, _bad('filter must hold removed: "1"')
-        rest = {key: value for key, value in raw.items() if key != "removed"}
-        try:
-            parse_listing_filter(rest)
-            selection = await self.resolve_listing_filter(
-                {**rest, "removed": "1"}, MAX_JOB_TARGETS
-            )
-        except ListingSourceChanged:
-            return None, None, _coded(409, "source-changed", SOURCE_CHANGED)
-        except ValueError as exc:
-            return None, None, _bad(str(exc))
-        if selection.truncated:
-            return None, None, _coded(400, "too-many-images", TOO_MANY)
-        if not selection.targets:
-            return None, None, _coded(400, "no-images", NONE_REMOVED)
-        return tuple(selection.targets), list(self._get_all_output_dirs()), None
-
-    def _hidden_targets(self, roots, targets, files):
-        """``([(path, locator)], not_removed)``: the targets a mark hides now.
-
-        Each target is matched to its listed spelling (the walk's). One
-        physical file named twice (nested roots) is returned once; a target
-        that is not listed or not hidden counts in ``not_removed``.
-        """
-        marks = self._removal_marks()
-        listings, seen, returned, not_removed = {}, set(), [], 0
-        for index, _scope, relative in targets:
-            root = roots[index]
-            if index not in listings:
-                listings[index] = self._favorite_listing(root, files[index])
-            spelled = listings[index].get(_favorite_relative_key(relative))
-            if spelled is None:
-                not_removed += 1
-                continue
-            path = os.path.join(str(root), *spelled.split("/"))
-            locator = os.path.normcase(os.path.realpath(path))
-            if locator in seen:
-                continue
-            if not mark_hides(marks, locator, path):
-                not_removed += 1
-                continue
-            seen.add(locator)
-            returned.append((Path(path), locator))
-        return returned, not_removed
-
-    def _clear_returned_marks(self, returned) -> list:
-        """The paths whose marks this deleted (blocking; one transaction)."""
-        cleared = self.db.clear_hiding_marks(
-            [(locator, str(path)) for path, locator in returned]
-        )
-        return [path for path, locator in returned if locator in cleared]

py/api/image_tag_jobs.py

@@ -39,7 +39,6 @@ from typing import NamedTuple
 from aiohttp import web
 
 from .. import model_gate
-from ..tagging_defaults import SkipMatcher
 from .admin import _plural, _time_left
 from .annotation_suggest import (
     OptionError,
@@ -171,8 +170,6 @@ class _Run:
     owner: object
     service: object = None
     roots: dict = field(default_factory=dict)
-    # The job's Skipped tags, compiled once at its start (#431).
-    skip: object = None
 
 
 @dataclass(frozen=True)
@@ -186,9 +183,6 @@ class _Spec:
     options: dict | None = None
     # A listing filter the start resolves into ``targets`` (#392).
     filter: dict | None = None
-    # The Skipped tags when the job was requested (#431); a later save does
-    # not change a running job.
-    skip: tuple = ()
 
     @property
     def title(self) -> str:
@@ -244,11 +238,7 @@ def _parse_auto(targets, data):
         )
     except OptionError as exc:
         return None, bad_request(str(exc))
-    skip = tuple(AutotagConfig.SKIPPED_TAGS)
-    return (
-        _Spec("auto", targets, model_type=model_type, options=options, skip=skip),
-        None,
-    )
+    return _Spec("auto", targets, model_type=model_type, options=options), None
 
 
 def parse_image_tag_request(data: dict):
@@ -339,8 +329,6 @@ class AutotagRun:
     keep_in_memory: bool
     backup_on: bool
     owner: object
-    # The Skipped tags when the job was started (#431).
-    skip: tuple = ()
 
 
 @dataclass(frozen=True)
@@ -412,14 +400,6 @@ def _load_model(service, model_type: str, use_gpu: bool) -> None:
         raise RuntimeError(f"{model_type} could not be loaded")
 
 
-def _skipped_tags_line(entries: tuple) -> str:
-    """The job log's one line about the Skipped tags it runs with (#431)."""
-    if not entries:
-        return "Skipped tags: none"
-    count = len(entries)
-    return f"Skipped tags: {count} {'entry' if count == 1 else 'entries'}"
-
-
 def _refusal(status: int, code: str, message: str) -> Refusal:
     response = web.json_response(
         {"success": False, "code": code, "error": message}, status=status
@@ -508,11 +488,7 @@ class ImageTagJobsMixin:
                     _still_targets, self, index, root, files, seen
                 )
             )
-        # #480: a file removed from the library is never tagged by a batch.
-        hidden = await self._run_in_executor(
-            self._removed_paths, [target.path for target in found]
-        )
-        return [target for target in found if target.path not in hidden]
+        return found
 
     async def _start_autotag(
         self, *, model_type, existing, options, keep_in_memory, title, owner_kind
@@ -527,7 +503,6 @@ class ImageTagJobsMixin:
         released when the task ends, also before its runner ever starts.
         """
         from ..autotag import MODELS, get_autotag_service
-        from ..config import AutotagConfig
 
         backup_on = self._safety_backup_policy() == "on"
         status = await self._run_in_executor(get_autotag_service().get_models_status)
@@ -550,15 +525,8 @@ class ImageTagJobsMixin:
             response = model_busy_response()
             return None, Refusal(409, "model-busy", MODEL_BUSY_ERROR, response)
         run = AutotagRun(
-            model_type,
-            existing,
-            options,
-            keep_in_memory,
-            backup_on,
-            owner,
-            skip=tuple(AutotagConfig.SKIPPED_TAGS),
+            model_type, existing, options, keep_in_memory, backup_on, owner
         )
-        admitted = False
         try:
             job = self._jobs.start(
                 AUTOTAG_BATCH_JOB_KIND,
@@ -569,12 +537,11 @@ class ImageTagJobsMixin:
                 groups=AUTOTAG_GROUP_NAMES,
                 runner=functools.partial(self._run_autotag_batch, run),
             )
-            admitted = True
-        except JobBusy as refused:
-            return None, _busy_refusal(refused)
-        finally:
-            if not admitted:
-                model_gate.release(owner)
+        except BaseException as refused:
+            model_gate.release(owner)
+            if isinstance(refused, JobBusy):
+                return None, _busy_refusal(refused)
+            raise
         job.task.add_done_callback(lambda _task: model_gate.release(owner))
         return job, None
 
@@ -625,9 +592,7 @@ class ImageTagJobsMixin:
             return _batch_cancelled(job)
         job.publish({"type": "phase", "phase": "model"})
         job.update(status_line="Loading the tagging model")
-        spec = _Spec(
-            "auto", (), model_type=run.model_type, options=run.options, skip=run.skip
-        )
+        spec = _Spec("auto", (), model_type=run.model_type, options=run.options)
         service = await self._prepare_tagging_model(job, spec, run.owner)
         if service is None:
             return "failed"
@@ -653,7 +618,6 @@ class ImageTagJobsMixin:
             f"Tagging started · {job.scope.get('label') or run.model_type} · "
             f"{_plural(total, 'image')} · {policy}"
         )
-        job.log_line(_skipped_tags_line(spec.skip))
         if job.cancelled:
             return _batch_cancelled(job)
         remaining = await self._autotag_prepass(job, targets, run.existing == "skip")
@@ -663,9 +627,7 @@ class ImageTagJobsMixin:
         spec = dataclasses.replace(
             spec, targets=tuple(item.target for item in remaining)
         )
-        loop_run = _Run(
-            job, spec, epoch, run.owner, service, skip=SkipMatcher(spec.skip)
-        )
+        loop_run = _Run(job, spec, epoch, run.owner, service)
         if not await self._tag_each_file(loop_run, done_before=done):
             job.update(status_line=STORAGE_RESTORED)
             job.log_line(f"Tagging stopped · {STORAGE_RESTORED}")
@@ -771,9 +733,6 @@ class ImageTagJobsMixin:
             started += f" · {spec.model_type}"
         job.log_line(started)
         run = _Run(job, spec, epoch, owner)
-        if spec.mode == "auto":
-            job.log_line(_skipped_tags_line(spec.skip))
-            run.skip = SkipMatcher(spec.skip)
         try:
             if spec.mode == "auto":
                 run.service = await self._prepare_tagging_model(job, spec, owner)
@@ -929,7 +888,6 @@ class ImageTagJobsMixin:
                 capture,
                 spec.model_type,
                 spec.options,
-                run.skip,
                 on_skipped=functools.partial(store.release_use, capture.token),
             )
         except Exception:

py/api/images.py

@@ -34,14 +34,15 @@ from .gallery_listing import (
     WalkOutcome,
     walk_root,
 )
-from . import preview_store, thumbnail_settings
-from .thumbnail_location import location_refusal
+from . import thumbnail_settings
 from .thumbnail_encode import (
     PREVIEW_HELD,
     EncoderClosed,
     PreviewWriteHeld,
+    replace_unless_held,
     run_encoder,
     sweep_stray_temps,
+    temp_sibling,
     thumbnail_frame,
     writer_settings,
     write_thumbnail,
@@ -65,12 +66,6 @@ try:
     from ...database.models import normalize_image_path
     from ...database.run_attribution import recorded_output_lookup
     from ...utils.card_seed import card_seed, header_params, parsed_positive
-    from ...utils.media_folders import (
-        in_skipped_folder,
-        in_trash_below_roots,
-        in_trash_folder,
-        is_skipped_folder,
-    )
     from ...utils.parallel import map_parallel
     from ...utils.json_strict import dumps_strict
     from ...utils.inspection_response import (
@@ -84,7 +79,7 @@ try:
         OpenerUnavailable,
         RevealGate,
         RevealTargetChanged,
-        is_same_origin_request,
+        is_local_request,
         reveal_executor,
         reveal_in_file_manager,
     )
@@ -96,12 +91,6 @@ except ImportError:
     from database.models import normalize_image_path
     from database.run_attribution import recorded_output_lookup
     from utils.card_seed import card_seed, header_params, parsed_positive
-    from utils.media_folders import (
-        in_skipped_folder,
-        in_trash_below_roots,
-        in_trash_folder,
-        is_skipped_folder,
-    )
     from utils.parallel import map_parallel
     from utils.json_strict import dumps_strict
     from utils.inspection_response import (
@@ -115,7 +104,7 @@ except ImportError:
         OpenerUnavailable,
         RevealGate,
         RevealTargetChanged,
-        is_same_origin_request,
+        is_local_request,
         reveal_executor,
         reveal_in_file_manager,
     )
@@ -286,20 +275,10 @@ def _forbidden(message="Access denied"):
     return web.json_response({"success": False, "error": message}, status=403)
 
 
-def _file_not_found():
-    return web.json_response(
-        {"success": False, "error": "Image file not found"},
-        status=404,
-        headers={"Cache-Control": "no-store"},
-    )
-
-
 def _media_access_error(path, allowed_dirs):
-    """The response refusing *path*, or None when it may be read.
+    """Return a 403 response when *path* must not be served, else None.
 
-    Fails closed: an empty *allowed_dirs* denies everything (403). A file in a
-    trash folder below its root is thrown away, not an output: a 404, as if it
-    were not there (#543), also through a link or another spelling.
+    Fails closed: an empty *allowed_dirs* denies everything.
     """
     if Path(path).suffix.lower() not in SERVABLE_EXTENSIONS:
         return _forbidden("Only media files can be served")
@@ -307,8 +286,6 @@ def _media_access_error(path, allowed_dirs):
         return _forbidden("No allowed image directories configured")
     if not any(_is_within(path, root) for root in allowed_dirs):
         return _forbidden()
-    if in_trash_below_roots(path, allowed_dirs):
-        return _file_not_found()
     return None
 
 
@@ -338,6 +315,11 @@ def _thumbnail_batch_size(workers):
     return max(4, workers * 2)
 
 
+# Preview files are written by thumbnail_encode in the configured format
+# (thumbnail_settings, #317); these names stay importable from here.
+_temp_sibling = temp_sibling
+_replace_unless_held = replace_unless_held
+
 # A preview that could not be replaced (#249 S5 M6). Windows refuses to rename
 # over a file another process has open (WinError 5 or 32), such as a preview
 # the gallery is serving; the old preview stays and the file counts as an error.
@@ -390,7 +372,6 @@ def _video_placeholder_image(thumbnail_size):
             font=font,
         )
     except (OSError, AttributeError):
-        # a placeholder without its label still works
         pass
     return img
 
@@ -494,7 +475,6 @@ def _preview_names(folders, folder):
                     except OSError:
                         continue
         except OSError:
-            # an unreadable folder lists as empty; nothing there to cache
             pass
         folders[folder] = names
     return names
@@ -813,12 +793,12 @@ def _reveal_not_found():
     )
 
 
-def _not_same_origin():
+def _not_local():
     return web.json_response(
         {
             "success": False,
-            "code": "not-same-origin",
-            "error": "This page's address does not match the server's.",
+            "code": "not-local",
+            "error": "Show in folder works only on the computer running ComfyUI.",
         },
         status=403,
     )
@@ -935,8 +915,7 @@ def _name_suffix(name):
 def _walk_media(output_path, max_files):
     """Yield the ``os.DirEntry`` of each media file under *output_path*.
 
-    Symlinks are never followed, ``thumbnails/`` and trash folders are
-    skipped (``utils.media_folders``, #501), descent stops
+    Symlinks are never followed, ``thumbnails/`` is skipped, descent stops
     at MAX_SCAN_DEPTH and at most *max_files* entries are produced. The order
     is ``os.walk``'s (top-down, subfolders in ``os.scandir`` order, files by
     name), which the gallery's ties in mtime keep. Each entry's type comes
@@ -948,6 +927,8 @@ def _walk_media(output_path, max_files):
     produced = 0
     while stack:
         top, rel_parts = stack.pop()
+        if "thumbnails" in rel_parts:
+            continue
         dirs, files = [], []
         try:
             with os.scandir(top) as entries:
@@ -971,7 +952,7 @@ def _walk_media(output_path, max_files):
         if len(rel_parts) >= MAX_SCAN_DEPTH:
             continue
         for entry in reversed(dirs):
-            if not entry.is_symlink() and not is_skipped_folder(entry.name):
+            if not entry.is_symlink():
                 stack.append((entry.path, rel_parts + (entry.name,)))
 
 
@@ -995,10 +976,8 @@ def _settled_entry(root, relative):
     *folders, name = relative.split(os.sep)
     if _name_suffix(name).lower() not in MEDIA_EXTENSIONS:
         return None
-    if in_skipped_folder(folders) or len(folders) > MAX_SCAN_DEPTH:
+    if "thumbnails" in folders or len(folders) > MAX_SCAN_DEPTH:
         return None
-    if in_trash_below_roots(path, [root]):
-        return None  # a linked folder on the way leads into a trash folder
     folder = os.fspath(root)
     for part in ("", *folders):
         folder = os.path.join(folder, part) if part else folder
@@ -1069,24 +1048,13 @@ def _iter_media_files(output_path, max_files):
 
 
 def media_thumbnail_rel(rel_path, settings=None):
-    """``thumbnails/<rel>_thumb<ext>`` (POSIX URL text) for the media file
-    *rel_path*: the name the preview gets when it is written now (#317),
-    images and videos alike (``writer_settings``' extension). Where it is on
-    disk is ``media_preview_path``."""
+    """``thumbnails/<rel>_thumb<ext>`` (POSIX) for the media file *rel_path*:
+    the name the preview gets when it is written now (#317), images and
+    videos alike (``writer_settings``' extension)."""
     settings = settings or writer_settings()
     return thumbnail_settings.thumbnail_rel(rel_path, settings.extension)
 
 
-def media_preview_path(output_path, rel_path, settings=None, *, create=False):
-    """Where the preview of *rel_path* is written now (``preview_store``);
-    *create* for a writer (a new source gets its key). None when nothing
-    may be written (the thumbnail folder is unavailable)."""
-    settings = settings or writer_settings()
-    return preview_store.preview_path(
-        output_path, rel_path, settings.extension, create=create
-    )
-
-
 def existing_media_thumbnail(output_path, rel_path):
     """The existing preview *rel_path* owns that a listing or cover shows
     (the format written now first, then older ones), or None. The Images
@@ -1096,27 +1064,6 @@ def existing_media_thumbnail(output_path, rel_path):
     )
 
 
-def listing_thumbnail_url(output_path, rel_path):
-    """The thumbnail URL of an older listing (``_enrich_images``, the
-    auto-tag scan), or None. These run on the event loop: in folder mode
-    (#320) the store is never touched there, so the URL names the preview
-    as it is written now and the serve route finds or makes it off the loop
-    (None while the thumbnail folder is unavailable)."""
-    from .prompts import thumbnail_url_for
-
-    location = preview_store.current()
-    if location.mode == preview_store.FOLDER_MODE:
-        if not location.available:
-            return None
-        quoted = urllib.parse.quote(media_thumbnail_rel(rel_path), safe="/")
-        return f"/prompt_manager/images/serve/{quoted}"
-    existing = thumbnail_settings.existing_thumbnail(output_path, rel_path)
-    if existing is None:
-        return None
-    thumb_rel = thumbnail_settings.thumbnail_stem_rel(rel_path) + existing.suffix
-    return thumbnail_url_for(thumb_rel, existing)
-
-
 def media_thumbnail(output_path, rel_path, root_index, *, root_scope=None):
     """``(thumbnail_url, ready)`` for *rel_path* under *output_path* (a few
     blocking stats). The Images listing, the Needs review queue cards and the
@@ -1212,10 +1159,7 @@ def _workspace_filters(query: Mapping) -> dict:
     the linked positive, and ``favorites=1`` keeps only favorites (the
     Favorites page, #249 D51). ``collection=<id>`` (1 to 9 digits) keeps only
     that collection's members (#331); it wins over ``favorites`` (a page never
-    sets both). ``removed=1`` lists only the files a removal mark hides (#498,
-    Show removed images); such a file has no records, so it never combines
-    with ``favorites``, ``collection``, ``category``, ``tags`` or the rating
-    sort. Raises ValueError for any unknown or oversized value.
+    sets both). Raises ValueError for any unknown or oversized value.
     """
     text = query.get("q", "").strip()
     folded = text.casefold()
@@ -1230,12 +1174,6 @@ def _workspace_filters(query: Mapping) -> dict:
     )
     favorites = query.get("favorites", "0")
     collection = query.get("collection", "")
-    removed = query.get("removed", "0")
-    if removed not in ("0", "1") or (
-        removed == "1"
-        and (favorites == "1" or collection or category or tags or order == "rating")
-    ):
-        raise ValueError("Invalid gallery filters")
     if (
         favorites not in ("0", "1")
         or (collection != "" and _COLLECTION_ID.fullmatch(collection) is None)
@@ -1263,7 +1201,6 @@ def _workspace_filters(query: Mapping) -> dict:
         "tags": tags,
         "favorites": favorites == "1" and not collection,
         "collection": int(collection) if collection else None,
-        "removed": removed == "1",
     }
 
 
@@ -1566,7 +1503,7 @@ class ImageRoutesMixin:
         async def clear_image_favorite_route(request):
             return await self.update_image_favorite(request, favorite=False)
 
-        # POST, same-origin: opens the server computer's file manager (D38).
+        # POST, local-only: opens this computer's file manager (D38).
         @routes.post("/prompt_manager/images/reveal")
         async def reveal_image_route(request):
             return await self.reveal_image(request)
@@ -2135,7 +2072,6 @@ class ImageRoutesMixin:
                         filters["tags"],
                         filters["favorites"],
                         filters["collection"],
-                        filters["removed"],
                     ]
                 ).encode()
             ).hexdigest()
@@ -2165,11 +2101,6 @@ class ImageRoutesMixin:
                     self._select_workspace_page, listings, filters, after, limit, scope
                 )
             )
-            # #498: Show removed images (N), every removed file in the selected
-            # source(s) whatever the filters (the hidden set is cached work).
-            removed_total = len(
-                await self._run_in_executor(self._hidden_entries, listings)
-            )
         except CollectionMissing:
             return collection_not_found()
         except Exception:
@@ -2196,7 +2127,6 @@ class ImageRoutesMixin:
             "limit": limit,
             "has_more": has_more,
             "next_cursor": next_cursor,
-            "removed_total": removed_total,
         }
         if positive_count is _COUNT_OMITTED:
             del result["positive_count"]
@@ -2520,13 +2450,6 @@ class ImageRoutesMixin:
             def key(entry):
                 return _workspace_key(entry, order)
 
-        # #480: files removed from the library stay on disk, hidden here; the
-        # removed view (#498) lists only them.
-        hidden = self._hidden_entries(listings)
-        if filters.get("removed"):
-            entries = [entry for entry in entries if entry.normalized in hidden]
-        elif hidden:
-            entries = [entry for entry in entries if entry.normalized not in hidden]
         return (
             entries,
             key,
@@ -2813,9 +2736,6 @@ class ImageRoutesMixin:
             if _has_traversal(filepath):
                 return _forbidden()
             suffix = Path(filepath).suffix.lower()
-            if in_trash_folder(filepath):
-                # Before any file access, so no preview is made for it (#543).
-                return _file_not_found()
             if suffix not in SERVABLE_EXTENSIONS and not (
                 # A JPEG XL preview is served from thumbnails/ only (#317).
                 suffix in thumbnail_settings.THUMBNAIL_EXTENSIONS
@@ -2831,59 +2751,14 @@ class ImageRoutesMixin:
                     output_dirs[0], filepath, int(root_param), len(outputs)
                 )
 
-            # Preview text is mapped by the resolver (#320); any other text,
-            # ``Thumbnails/...`` media on a case-sensitive disk included,
-            # keeps the plain join.
-            preview_parts = (
-                tuple(filepath.split("/"))
-                if preview_store.is_preview_text(filepath)
-                else None
-            )
-            location = preview_store.current()
-            if location.mode == preview_store.FOLDER_MODE:
-                if preview_parts is None and await self._run_image(
-                    self._in_source_thumbnails, output_dirs, filepath
-                ):
-                    # Previews live in the thumbnail folder: anything else
-                    # under a source's thumbnails/ is a leftover (#320), in
-                    # any case on a case-insensitive disk.
-                    return _forbidden()
-                if preview_parts is not None:
-                    # Store I/O never runs on the event loop (a share may
-                    # stall): the lookup runs on the image pool.
-                    found = await self._run_image(
-                        self._find_preview, output_dirs, preview_parts, location
-                    )
-                    if found == "forbidden":
-                        return _forbidden()
-                    if found is not None:
-                        return self._file_response(found)
             for output_path in output_dirs:
-                if (
-                    preview_parts is not None
-                    and location.mode == preview_store.FOLDER_MODE
-                ):
-                    break  # looked up above
-                if preview_parts is None:
-                    image_path = output_path / filepath
-                else:
-                    image_path = preview_store.request_path(output_path, preview_parts)
-                    if image_path is None:
-                        continue
+                image_path = output_path / filepath
                 if not image_path.exists():
                     continue
-                # A symlink that points outside the root (a preview: outside
-                # the folder holding its store) is a hard deny, not a
-                # fall-through to the next root.
-                container = (
-                    output_path
-                    if preview_parts is None
-                    else preview_store.store_container(output_path)
-                )
-                if not _is_within(image_path, container):
+                # A symlink that points outside the root is a hard deny, not
+                # a fall-through to the next root.
+                if not _is_within(image_path, output_path):
                     return _forbidden()
-                if in_trash_below_roots(image_path, output_dirs):
-                    return _file_not_found()
                 if image_path.is_file():
                     return self._file_response(image_path)
 
@@ -2906,48 +2781,6 @@ class ImageRoutesMixin:
                 {"success": False, "error": _safe_error(e)}, status=500
             )
 
-    @staticmethod
-    def _in_source_thumbnails(output_dirs, filepath):
-        """Whether *filepath* lies in a source's ``thumbnails`` folder: its
-        first part is ``thumbnails`` exactly, or another case of it that is
-        the same folder (a case-insensitive disk). ``Thumbnails/`` media on
-        a case-sensitive disk is another folder and stays served."""
-        first = filepath.split("/", 1)[0]
-        if first == "thumbnails":
-            return True
-        if first.casefold() != "thumbnails":
-            return False
-        for output_path in output_dirs:
-            spelled = output_path / first
-            cache = preview_store.source_folder(output_path)
-            try:
-                if spelled.is_dir() and cache.is_dir() and spelled.samefile(cache):
-                    return True
-            except OSError:
-                continue
-        return False
-
-    @staticmethod
-    def _find_preview(output_dirs, parts, location):
-        """The preview file *parts* names in folder mode, ``"forbidden"``
-        (it resolves out of its store or through a link) or None (blocking;
-        the first root whose store holds it, in ``_select_root`` order)."""
-        for output_path in output_dirs:
-            image_path = preview_store.request_path(output_path, parts, location)
-            if image_path is None:
-                continue
-            try:
-                with preview_store.store_io():
-                    if not os.path.lexists(image_path):
-                        continue
-                    if not preview_store.owns(output_path, image_path, location):
-                        return "forbidden"
-                    if image_path.is_file():
-                        return image_path
-            except OSError:
-                return None
-        return None
-
     def _is_recorded_media(self, path) -> bool:
         """Whether the database records ``path`` as a linked image.
 
@@ -2977,9 +2810,8 @@ class ImageRoutesMixin:
         if _is_thumbnail_cache_path(filepath):
             return _forbidden()
         image_path = root / filepath
-        denied = _media_access_error(image_path, [root])
-        if denied is not None:
-            return denied
+        if not _is_within(image_path, root):
+            return _forbidden()
         if not image_path.is_file():
             return web.json_response(
                 {"success": False, "error": "Image file not found"}, status=404
@@ -3074,9 +2906,6 @@ class ImageRoutesMixin:
         data, error = await _json_body_or_error(request)
         if error is not None:
             return error
-        refused = location_refusal()
-        if refused is not None:
-            return refused
         return await self._run_held(
             THUMBNAILS_JOB_KIND,
             THUMBNAIL_GENERATION_TITLE,
@@ -3096,7 +2925,6 @@ class ImageRoutesMixin:
             result = await self._run_in_executor(
                 self._generate_gallery_thumbnails_sync, output_dirs
             )
-            await self._release_job_memory()
             return web.json_response(result)
 
         except Exception as e:
@@ -3109,7 +2937,6 @@ class ImageRoutesMixin:
         """Blocking thumbnail generation loop (run in executor)."""
         settings = writer_settings(settings)
         start = _time.monotonic()
-        thumbnails_dir = preview_store.given_store(output_path, thumbnails_dir)
         plan = self._plan_thumbnails(output_path, thumbnails_dir, settings=settings)
         payload = self._execute_thumbnail_plan(plan, settings, start)
         payload["thumbnails_path"] = _public_path(thumbnails_dir)
@@ -3122,8 +2949,7 @@ class ImageRoutesMixin:
         start = _time.monotonic()
         plan = self._plan_gallery_thumbnails(output_dirs, settings=settings)
         payload = self._execute_thumbnail_plan(plan, settings, start)
-        store = preview_store.store_dir(output_dirs[0])
-        payload["thumbnails_path"] = None if store is None else _public_path(store)
+        payload["thumbnails_path"] = _public_path(output_dirs[0] / "thumbnails")
         return payload
 
     def _execute_thumbnail_plan(self, plan: dict, settings, start: float) -> dict:
@@ -3166,12 +2992,9 @@ class ImageRoutesMixin:
             if stop is not None and stop():
                 break
             root = Path(root)
-            store = preview_store.ensure_store(root)
-            if store is None:
-                continue  # the thumbnail folder is unavailable
             plan = self._plan_thumbnails(
                 root,
-                store,
+                root / "thumbnails",
                 mode=mode,
                 stop=stop,
                 settings=settings,
@@ -3210,8 +3033,6 @@ class ImageRoutesMixin:
                     "format": writer_settings().format,
                     # Files whose automatic preview failed this session (#249).
                     "failed": self._auto_thumbnail_failures(),
-                    # #320: where previews live (no path here, D6A).
-                    "location": self._thumbnail_location_payload(with_path=False),
                     "collection_id": hashlib.sha256(collection.encode()).hexdigest()[
                         :16
                     ],
@@ -3250,27 +3071,20 @@ class ImageRoutesMixin:
         no symlinks), each preview folder is listed once, and at most
         MAX_THUMBNAIL_FILES targets are queued per batch (a job plans again
         after each batch); ``remaining`` counts the targets beyond that cap.
-        Sources in *exclude* (worked on by an earlier batch) are left out, and
-        so are files removed from the library (#501: a removal mark hides
-        them, and their previews went with their records).
+        Sources in *exclude* (worked on by an earlier batch) are left out.
         ``stop()`` true ends the walk before the next file.
         """
         settings = writer_settings(settings)
         output_path = Path(output_path)
-        thumbnails_dir = preview_store.given_store(output_path, thumbnails_dir)
+        thumbnails_dir = Path(thumbnails_dir)
         plan = {key: 0 for key in _PLAN_COUNTS}
         plan.update(targets=[], fresh_files=[])
-        if thumbnails_dir is None:
-            return plan  # the thumbnail folder is unavailable
         folders = {}
-        removed = self._removal_check_under(output_path)
         for src in _iter_media_files(output_path, MAX_GALLERY_FILES):
             if stop is not None and stop():
                 break
             if exclude and src in exclude:
                 continue
-            if removed(src):
-                continue
             rel_no_ext = src.relative_to(output_path).with_suffix("")
             stem = f"{rel_no_ext.name}{thumbnail_settings.THUMB_SUFFIX}"
             dst = thumbnails_dir / rel_no_ext.parent / (stem + settings.extension)
@@ -3351,9 +3165,6 @@ class ImageRoutesMixin:
             "dir": src.parent.name,
             "type": "video" if is_video else "image",
         }
-        # Taken when the write starts: a thumbnail location switched since
-        # then drops the write at its rename (#320).
-        guard = preview_store.write_guard(guard)
         dst = Path(dst)
         if dst.suffix != settings.extension:
             dst = dst.with_suffix(settings.extension)
@@ -3364,7 +3175,7 @@ class ImageRoutesMixin:
                 return {**result, "action": "error", "error": "File no longer exists"}
             if not rebuild and _thumbnail_is_fresh(src, dst):
                 return {**result, "action": "skipped", "path": str(dst)}
-            preview_store.make_parent(dst)
+            dst.parent.mkdir(parents=True, exist_ok=True)
             if is_video:
                 made = self._generate_video_thumbnail(
                     src,
@@ -3569,12 +3380,8 @@ class ImageRoutesMixin:
 
         Invalid thumbnail directories return 400; unavailable gallery roots
         return 404, and unexpected filesystem failures return 500. Holds the
-        registry as guarded work, like generation. Refused (409) while the
-        thumbnail folder is unavailable (#320).
+        registry as guarded work, like generation.
         """
-        refused = location_refusal()
-        if refused is not None:
-            return refused
         return await self._run_held(
             THUMBNAILS_JOB_KIND,
             THUMBNAIL_CLEAR_TITLE,
@@ -3638,12 +3445,8 @@ class ImageRoutesMixin:
             self.logger.debug(f"No roots to sweep for preview temp files: {exc}")
             return 0
         for output_path in output_dirs:
-            folder = preview_store.store_dir(output_path)
-            if (
-                folder is None
-                or preview_store.store_is_link(folder)
-                or not folder.is_dir()
-            ):
+            folder = Path(output_path) / "thumbnails"
+            if folder.is_symlink() or not folder.is_dir():
                 continue
             removed += sweep_stray_temps(folder)[0]
         if removed:
@@ -3661,16 +3464,13 @@ class ImageRoutesMixin:
         directories = []
         for output_path in output_dirs:
             output_path = Path(output_path)
-            thumbnails_dir = preview_store.store_dir(output_path)
-            if thumbnails_dir is None:
-                continue
+            thumbnails_dir = output_path / "thumbnails"
             if not thumbnails_dir.exists() and not thumbnails_dir.is_symlink():
                 continue
-            container = preview_store.store_container(output_path)
             if (
-                preview_store.store_is_link(thumbnails_dir)
-                or not _is_within(thumbnails_dir, container)
-                or _canonical(thumbnails_dir) == _canonical(container)
+                thumbnails_dir.is_symlink()
+                or not _is_within(thumbnails_dir, output_path)
+                or _canonical(thumbnails_dir) == _canonical(output_path)
             ):
                 raise ValueError(
                     "Safety check failed: invalid thumbnails directory path"
@@ -3685,15 +3485,7 @@ class ImageRoutesMixin:
             temps, temp_bytes = sweep_stray_temps(thumbnails_dir, min_age=0)
             cleared_count += temps
             cleared_size += temp_bytes
-            folder_mode = preview_store.current().mode == preview_store.FOLDER_MODE
-            for root, dirs, files in os.walk(thumbnails_dir):
-                if folder_mode:
-                    # Never into a junction or reparse point (#320).
-                    dirs[:] = [
-                        d
-                        for d in dirs
-                        if not preview_store.store_is_link(Path(root) / d)
-                    ]
+            for root, _dirs, files in os.walk(thumbnails_dir):
                 for name in files:
                     path = Path(root) / name
                     if (
@@ -3701,7 +3493,6 @@ class ImageRoutesMixin:
                         or path.suffix.lower()
                         not in thumbnail_settings.THUMBNAIL_EXTENSIONS
                         or path.is_symlink()
-                        or not preview_store.may_write(path)
                     ):
                         continue
                     try:
@@ -3861,12 +3652,12 @@ class ImageRoutesMixin:
     async def reveal_image(self, request):
         """POST ``{root_index, root_scope, path}``: show the file in its folder.
 
-        Same-origin and JSON-only, directly or through a proxy: the folder
-        opens on the computer running ComfyUI, wherever the browser is
-        (maintainer decision, #533). One reveal at a time (429 busy).
+        Local-only (a same-origin browser request from a loopback client, no
+        forwarding header) and JSON-only: the browser must run on the
+        computer whose file manager opens. One reveal at a time (429 busy).
         """
-        if not is_same_origin_request(request.headers, request.scheme):
-            return _not_same_origin()
+        if not is_local_request(request.remote, request.headers, request.scheme):
+            return _not_local()
         if request.content_type != "application/json":
             # A non-JSON POST is a CORS "simple" request with no preflight.
             return web.json_response(
@@ -3944,9 +3735,7 @@ class ImageRoutesMixin:
                 {
                     "success": False,
                     "code": "unavailable",
-                    "error": (
-                        "No file manager is available on the computer running ComfyUI."
-                    ),
+                    "error": "No file manager is available on this computer.",
                 },
                 status=501,
             )
@@ -4151,8 +3940,7 @@ class ImageRoutesMixin:
                     **observed,
                 )
 
-            # Header and text reads: the interactive image pool (#523).
-            body = await self._run_image(inspect)
+            body = await self._run_in_executor(inspect)
             if body is None:
                 return web.json_response(
                     {
@@ -4365,22 +4153,6 @@ class ImageRoutesMixin:
         # (which Windows refuses on open files) is not held up by it.
         return _CardFacts(width, height, *self._card_parse(path, records))
 
-    def _cached_card_facts(self, entry: tuple) -> _CardFacts | None:
-        path, mtime, root, index = entry[:4]
-        return self._workspace_card_cache.get((index, str(root)), {}).get((path, mtime))
-
-    def _card_facts_of(self, entries: list, *, parse: bool) -> list[_CardFacts]:
-        """Card facts of *entries*, in order; files not cached yet are read on
-        the interactive image pool (#523), cached ones answer here."""
-        found = [self._cached_card_facts(entry) for entry in entries]
-        missing = [i for i, facts in enumerate(found) if facts is None]
-        read = self._map_image(
-            lambda i: self._card_facts(entries[i], parse=parse), missing
-        )
-        for i, facts in zip(missing, read):
-            found[i] = facts
-        return found
-
     def _card_facts(self, entry: tuple, *, parse: bool) -> _CardFacts:
         """One listed image's card facts, read once per ``(path, mtime)``.
 
@@ -4389,11 +4161,11 @@ class ImageRoutesMixin:
         and drops the rest, and a roots change drops them all. Only files of
         the current scan are stored, so the cache is bounded by the listing.
         """
-        cached = self._cached_card_facts(entry)
-        if cached is not None:
-            return cached
         path, mtime, root, index = entry[:4]
         root_key, key = (index, str(root)), (path, mtime)
+        cached = self._workspace_card_cache.get(root_key, {}).get(key)
+        if cached is not None:
+            return cached
         facts = self._read_card_facts(path, parse=parse)
         if facts is None:
             # Not stored: a locked or half-written file may read next time.
@@ -4419,17 +4191,15 @@ class ImageRoutesMixin:
             if linked
             else {}
         )
-        # Videos: the card reads no video metadata. Library previews show
-        # no card facts, so they skip the parse (``parse=linked``).
-        stills = [image for image in images if not image["is_video"]]
-        read = self._card_facts_of(
-            [entries[(image["root_index"], image["path"])] for image in stills],
-            parse=linked,
-        )
-        facts_of = {id(image): facts for image, facts in zip(stills, read)}
         for image in images:
             entry = entries[(image["root_index"], image["path"])]
-            facts = facts_of.get(id(image), _NO_CARD_FACTS)
+            # Videos: the card reads no video metadata. Library previews show
+            # no card facts, so they skip the parse (``parse=linked``).
+            facts = (
+                _NO_CARD_FACTS
+                if image["is_video"]
+                else self._card_facts(entry, parse=linked)
+            )
             image["width"], image["height"] = facts.width, facts.height
             if not linked:
                 continue

py/api/job_routes.py

@@ -250,7 +250,7 @@ class JobRoutesMixin:
         try:
             await response.write(_summary_event(job))
             async with contextlib.aclosing(job.events()) as events:
-                async for _ in events:
+                async for _payload in events:
                     await response.write(_summary_event(job))
             # The last event is published before the job takes its final state.
             await response.write(_summary_event(job))

py/api/jobs.py

@@ -123,11 +123,6 @@ MODEL_DOWNLOAD_JOB_KIND = "model_download"
 DUPLICATES_JOB_KIND = "duplicates"
 DUPLICATE_GROUP_NAMES = ("groups_found",)
 DUPLICATE_CLEANUP_GROUP_NAMES = ("removed", "kept", "errors")
-# The workspace Library's Delete… (#443, py/api/library_delete.py): a
-# ``records`` hold around its safety backup and write.
-PROMPT_DELETE_JOB_KIND = "prompt_delete"
-IMAGE_DELETE_JOB_KIND = "image_delete"  # #480
-IMAGE_DELETE_GROUP_NAMES = ("trashed", "removed", "not_changed", "errors")
 # The System health check (py/api/system.py): a read-only ``read`` job with
 # no file outcomes, so it may run beside a scan.
 HEALTH_JOB_KIND = "health"
@@ -204,8 +199,6 @@ class Job:
         self.total = 0
         self.counters = dict.fromkeys(groups, 0)
         self.outcomes = {group: [] for group in groups}
-        # Groups whose report lists every row, beyond MAX_OUTCOME_ROWS (#550).
-        self.complete = {}
         self.log = []
         self._cancel_requested = False
         self.last_event = None
@@ -288,48 +281,42 @@ class Job:
         index = row.get("root_index")
         if isinstance(index, bool) or not isinstance(index, int) or index < 0:
             index = None
-        shaped = {
-            "path": path,
-            "root": str(row.get("root") or ""),
-            "root_index": index,
-            "detail": str(row.get("detail") or ""),
-        }
-        if group in self.complete:  # a group kept whole for the report (#586)
-            self.complete[group].append(dict(shaped))
         if len(rows) < MAX_OUTCOME_ROWS:
-            rows.append(shaped)
+            rows.append(
+                {
+                    "path": path,
+                    "root": str(row.get("root") or ""),
+                    "root_index": index,
+                    "detail": str(row.get("detail") or ""),
+                }
+            )
         self.log_line(log_line)
 
-    def record_counted(self, group, count, rows=(), *, complete=False):
+    def record_counted(self, group, count, rows=()):
         """Count ``count`` outcomes in ``group`` at once, listing ``rows``.
 
         For outcomes that need no log line each (a thumbnail job's already
         fresh previews): the counter is exact, ``rows`` (``record``'s row
         shape) are listed up to MAX_OUTCOME_ROWS, and nothing is logged.
-        ``complete`` also keeps every row for the report (#550: a record of
-        each change that must not be cut short; the caller bounds it).
         """
         if group not in self.counters:
             raise ValueError(f"Unknown outcome group {group!r} for {self.kind}")
         self.counters[group] += max(0, int(count))
         listed = self.outcomes[group]
-        kept = self.complete.setdefault(group, []) if complete else None
         for row in rows:
-            if kept is None and len(listed) >= MAX_OUTCOME_ROWS:
+            if len(listed) >= MAX_OUTCOME_ROWS:
                 break
             index = row.get("root_index")
             if isinstance(index, bool) or not isinstance(index, int) or index < 0:
                 index = None
-            shaped = {
-                "path": _relative_path(row.get("path")),
-                "root": str(row.get("root") or ""),
-                "root_index": index,
-                "detail": str(row.get("detail") or ""),
-            }
-            if kept is not None:
-                kept.append(shaped)
-            if len(listed) < MAX_OUTCOME_ROWS:
-                listed.append(dict(shaped))
+            listed.append(
+                {
+                    "path": _relative_path(row.get("path")),
+                    "root": str(row.get("root") or ""),
+                    "root_index": index,
+                    "detail": str(row.get("detail") or ""),
+                }
+            )
 
     def finish(self, state="finished"):
         """End the job in ``state`` and release every subscriber.
@@ -414,9 +401,8 @@ class Job:
         """The downloadable report: the summary, every outcome group and the log.
 
         Each group carries its exact count, its listed rows (at most
-        MAX_OUTCOME_ROWS, or every row of a ``complete`` group) and whether
-        the list is cut short. Rows and log lines already hold root-relative
-        paths only.
+        MAX_OUTCOME_ROWS) and whether the list is cut short. Rows and log lines
+        already hold root-relative paths only.
         """
         summary = self.summary()
         summary.pop("listed", None)
@@ -426,21 +412,16 @@ class Job:
             "generated_at": self._clock(),
             "job": summary,
             "outcomes": {
-                group: self._report_group(group, rows)
+                group: {
+                    "count": self.counters.get(group, len(rows)),
+                    "rows": [dict(row) for row in rows],
+                    "truncated": self.counters.get(group, len(rows)) > len(rows),
+                }
                 for group, rows in self.outcomes.items()
             },
             "log": list(self.log),
         }
 
-    def _report_group(self, group, listed):
-        rows = self.complete.get(group, listed)
-        count = self.counters.get(group, len(rows))
-        return {
-            "count": count,
-            "rows": [dict(row) for row in rows],
-            "truncated": count > len(rows),
-        }
-
     def report_filename(self):
         """The download name: prompt-manager-KIND-YYYYMMDD-HHMM.json (local time)."""
         stamp = time.strftime("%Y%m%d-%H%M", time.localtime(self._clock()))

py/api/library.py

@@ -157,13 +157,6 @@ def _archive_scope(request: web.Request) -> str:
     return value
 
 
-def _shelf(request: web.Request) -> str:
-    value = request.query.get("shelf", "active")
-    if value not in ("active", "archived"):
-        raise ValueError("shelf must be active or archived")
-    return value
-
-
 def _missing() -> web.Response:
     return web.json_response(
         {"success": False, "error": "Positive prompt not found"}, status=404
@@ -339,9 +332,6 @@ class LibraryRoutesMixin:
             "tags": sorted(set(request.query.getall("tag", []))),
             "tag_mode": request.query.get("tag_mode", "all"),
             "sort": request.query.get("sort", "newest"),
-            # #443: which shelf; part of the cursor scope, so a cursor never
-            # crosses shelves. Not the variant ``archive`` scope of /{id}.
-            "shelf": _shelf(request),
         }
         limit = _page_limit(request)
         cursor = request.query.get("cursor")

py/api/library_delete.py

@@ -1,321 +0,0 @@
-"""Delete or archive selected Library prompts, and restore archived ones (#443).
-
-The workspace Prompt library's Delete… (D152). The legacy ``POST
-/prompt_manager/bulk/delete`` and ``DELETE /prompt_manager/delete/{id}`` are
-separate and unchanged.
-
-- ``POST /prompt_manager/library/delete/preview {prompt_ids, expected_epoch}``
-  classifies the selection (reads only, under a lease): the ids to ``delete``
-  (in no saved pair), to ``archive`` (paired), the ``protected`` ones (tagged
-  ``__protected__``, kept), counts of ``already_archived`` and ``not_found``,
-  the ``image_links`` a delete removes, the safety ``backup`` policy and,
-  when a backup would be taken, the ``disk`` it needs.
-- ``POST /prompt_manager/library/delete {archive_ids, delete_ids,
-  expected_epoch, backup}`` executes that review under a ``records`` hold
-  (refused 409 ``busy`` beside a scan, restore, maintenance, move or
-  Optimize). When a delete remains and a backup was promised (the reviewed
-  ``backup`` was "on" or the policy is on now) it checks the disk (507
-  ``insufficient-space``) and takes a verified safety backup (500
-  ``backup-failed``); then one transaction deletes the reviewed deletes whose
-  fingerprint is unchanged since the backup and archives the paired ones.
-- ``POST /prompt_manager/library/restore {prompt_ids, expected_epoch}``
-  removes the archive mark (under a lease).
-
-A changed storage epoch answers 409 ``storage-changed``; nothing is written.
-"""
-
-import sqlite3
-
-from aiohttp import web
-
-try:
-    from ...database.library_commands import LibraryCommandError
-    from ...database.safety_backup import SafetyBackupFailed
-except ImportError:
-    from database.library_commands import LibraryCommandError
-    from database.safety_backup import SafetyBackupFailed
-
-from . import maintenance as _maintenance
-from .admin import _prune_safety_backups
-from .job_routes import busy_response
-from .jobs import PROMPT_DELETE_JOB_KIND, JobBusy
-from .prompts import parse_bulk_prompt_ids
-
-PREVIEW_URL = "/prompt_manager/library/delete/preview"
-DELETE_URL = "/prompt_manager/library/delete"
-RESTORE_URL = "/prompt_manager/library/restore"
-DELETE_TITLE = "Delete prompts (Library)"
-_SELECTION_KEYS = frozenset({"prompt_ids", "expected_epoch"})
-_DELETE_KEYS = frozenset({"archive_ids", "delete_ids", "expected_epoch", "backup"})
-# #482: Delete permanently, with its digests; both or neither (a #443 body).
-_PAIRED_KEYS = frozenset({"delete_paired_ids", "paired_digests"})
-# #492: the shelf the Delete… runs on, optional on its own (default "active").
-_SHELF_KEYS = frozenset({"shelf"})
-STORAGE_CHANGED = "Prompt storage was restored; refresh the library"
-
-
-def _failure(status, code, error, **extra):
-    return web.json_response(
-        {"success": False, "code": code, "error": error, **extra}, status=status
-    )
-
-
-def _invalid(message):
-    return _failure(400, "invalid-request", message)
-
-
-def _storage_changed(exc):
-    return _failure(409, exc.code, STORAGE_CHANGED, library_epoch=exc.epoch)
-
-
-async def _body(request, keys, *groups):
-    """The JSON object with exactly ``keys``, plus all or none of each group."""
-    try:
-        data = await request.json()
-    except ValueError:
-        raise ValueError("Expected a JSON object") from None
-    if not isinstance(data, dict):
-        raise ValueError("Expected a JSON object")
-    extra = set(data) - keys
-    partial = False
-    for group in groups:
-        if extra & group:
-            partial = partial or not group <= extra
-            extra -= group
-    if not keys <= set(data) or extra or partial:
-        raise ValueError("Request must contain exactly " + ", ".join(sorted(keys)))
-    return data
-
-
-def _shelf(data):
-    """#492: the shelf a Delete… was reviewed on."""
-    shelf = data.get("shelf", "active")
-    if shelf not in ("active", "archived"):
-        raise ValueError("shelf must be active or archived")
-    return shelf
-
-
-def _paired_delete(data, archive_ids):
-    """#482: the reviewed archive ids to delete with their pairs -> digest."""
-    if "delete_paired_ids" not in data:
-        return {}
-    ids = _reviewed_ids(data["delete_paired_ids"], "delete_paired_ids")
-    digests = data["paired_digests"]
-    if not isinstance(digests, dict):
-        raise ValueError("paired_digests must map prompt ids to digests")
-    if not set(ids) <= set(archive_ids):
-        raise ValueError("delete_paired_ids must be reviewed archive ids")
-    chosen = {}
-    for pid in ids:
-        digest = digests.get(str(pid))
-        if not isinstance(digest, str) or len(digest) != 64:
-            raise ValueError("Every delete_paired_ids entry needs its review digest")
-        chosen[pid] = digest
-    return chosen
-
-
-def _reviewed_ids(value, name):
-    """A reviewed id list: possibly empty, else as ``parse_bulk_prompt_ids``."""
-    if value == []:
-        return []
-    try:
-        return parse_bulk_prompt_ids(value)
-    except ValueError as exc:
-        raise ValueError(str(exc).replace("prompt_ids", name)) from None
-
-
-class LibraryDeleteRoutesMixin:
-    """Mixin providing the workspace Library's delete, archive and restore."""
-
-    def _register_library_delete_routes(self, routes):
-        routes.post(PREVIEW_URL)(self.preview_library_delete)
-        routes.post(DELETE_URL)(self.delete_library_prompts)
-        routes.post(RESTORE_URL)(self.restore_library_prompts)
-
-    async def preview_library_delete(self, request):
-        try:
-            data = await _body(request, _SELECTION_KEYS, _SHELF_KEYS)
-            ids = parse_bulk_prompt_ids(data["prompt_ids"])
-            shelf = _shelf(data)
-        except ValueError as exc:
-            return _invalid(str(exc))
-        db = self.db
-        policy = self._safety_backup_policy()
-        try:
-            async with self._jobs.lease("Library delete review"):
-                review = await self._run_in_executor(
-                    db.classify_library_delete,
-                    ids,
-                    expected_epoch=data["expected_epoch"],
-                    shelf=shelf,
-                )
-                disk = None
-                if (review["delete"] or review["deletable"]) and policy == "on":
-                    public, short, _size = await self._run_in_executor(
-                        _maintenance.disk_plan,
-                        db.model.db_path,
-                        backup=True,
-                        vacuum=False,
-                    )
-                    disk = {
-                        **public,
-                        "message": (
-                            None
-                            if short is None
-                            else _maintenance.short_space_message(short)
-                        ),
-                    }
-        except JobBusy as busy:
-            return busy_response(busy)
-        except LibraryCommandError as exc:
-            return _storage_changed(exc)
-        except ValueError as exc:
-            return _invalid(str(exc))
-        except (OSError, sqlite3.Error):
-            self.logger.exception("Library delete review failed")
-            return _failure(500, "review-failed", "The delete could not be reviewed")
-        return web.json_response(
-            {
-                "success": True,
-                "library_epoch": review["library_epoch"],
-                "delete": review["delete"],
-                "archive": review["archive"],
-                "protected": review["protected"],
-                "already_archived": len(review["already_archived"]),
-                "not_archived": len(review["not_archived"]),
-                "not_found": len(review["not_found"]),
-                "image_links": review["image_links"],
-                # #482: the archive ids Delete permanently may delete with pairs.
-                "deletable": review["deletable"],
-                "review_digests": {
-                    str(pid): digest for pid, digest in review["review_digests"].items()
-                },
-                "paired_counts": review["paired_counts"],
-                "paired_image_links": review["paired_image_links"],
-                "backup": policy,
-                "disk": disk,
-            }
-        )
-
-    async def delete_library_prompts(self, request):
-        try:
-            data = await _body(request, _DELETE_KEYS, _PAIRED_KEYS, _SHELF_KEYS)
-            shelf = _shelf(data)
-            archive_ids = _reviewed_ids(data["archive_ids"], "archive_ids")
-            delete_ids = _reviewed_ids(data["delete_ids"], "delete_ids")
-            if not archive_ids and not delete_ids:
-                raise ValueError("Nothing to delete or archive")
-            if len(archive_ids) + len(delete_ids) > 1000:
-                raise ValueError("At most 1000 prompts can be changed at once")
-            if set(archive_ids) & set(delete_ids):
-                raise ValueError("A prompt cannot be both archived and deleted")
-            if data["backup"] not in ("on", "off"):
-                raise ValueError("backup must be on or off")
-            paired = _paired_delete(data, archive_ids)
-        except ValueError as exc:
-            return _invalid(str(exc))
-        busy = self._jobs.blocker(PROMPT_DELETE_JOB_KIND, admission="records")
-        if busy is not None:
-            return busy_response(JobBusy(busy))
-        try:
-            async with self._jobs.hold(
-                PROMPT_DELETE_JOB_KIND, DELETE_TITLE, admission="records"
-            ) as job:
-                response = await self._held_library_delete(
-                    self.db, data, archive_ids, delete_ids, paired, shelf
-                )
-                if response.status >= 400:
-                    job.finish("failed")
-                return response
-        except JobBusy as busy:
-            return busy_response(busy)
-
-    async def _held_library_delete(
-        self, db, data, archive_ids, delete_ids, paired, shelf="active"
-    ):
-        epoch = data["expected_epoch"]
-        promised = data["backup"] == "on" or self._safety_backup_policy() == "on"
-        backup = None
-        try:
-            candidates = None
-            if delete_ids or paired:
-                review = await self._run_in_executor(
-                    db.classify_library_delete,
-                    [*delete_ids, *paired],
-                    expected_epoch=epoch,
-                    # #492: the same shelf, or archived ids would skip the backup.
-                    shelf=shelf,
-                )
-                candidates = review["fingerprints"]
-                # #482: a permanent delete of a prompt in a saved pair is backed up too.
-                if (candidates or review["deletable"]) and promised:
-                    _disk, short, _size = await self._run_in_executor(
-                        _maintenance.disk_plan,
-                        db.model.db_path,
-                        backup=True,
-                        vacuum=False,
-                    )
-                    if short is not None:
-                        return _failure(
-                            507,
-                            "insufficient-space",
-                            _maintenance.short_space_message(short),
-                        )
-                    backup = await self._run_in_executor(
-                        _maintenance.take_safety_backup, db.model
-                    )
-            result = await self._run_in_executor(
-                db.archive_or_delete_library_prompts,
-                archive_ids,
-                delete_ids,
-                expected_epoch=epoch,
-                candidates=candidates if candidates is not None else {},
-                delete_paired=paired,
-                shelf=shelf,
-            )
-        except LibraryCommandError as exc:
-            return _storage_changed(exc)
-        except SafetyBackupFailed as error:
-            self.logger.error("Safety backup before a Library delete failed")
-            return _failure(
-                500, "backup-failed", _maintenance.backup_failed_message(error)
-            )
-        except ValueError as exc:
-            return _invalid(str(exc))
-        except (OSError, sqlite3.Error):
-            self.logger.exception("Library delete failed")
-            return _failure(500, "delete-failed", "The prompts could not be changed")
-        finally:
-            if backup is not None:
-                await self._prune_after_delete(db)
-        return web.json_response({"success": True, **result, "backup": backup})
-
-    async def _prune_after_delete(self, db):
-        try:
-            await self._run_in_executor(_prune_safety_backups, db.model.db_path)
-        except Exception:  # pruning old copies never fails the delete
-            self.logger.exception("Could not prune old safety backups")
-
-    async def restore_library_prompts(self, request):
-        try:
-            data = await _body(request, _SELECTION_KEYS)
-            ids = parse_bulk_prompt_ids(data["prompt_ids"])
-        except ValueError as exc:
-            return _invalid(str(exc))
-        try:
-            async with self._jobs.lease("Library restore"):
-                result = await self._run_in_executor(
-                    self.db.restore_library_prompts,
-                    ids,
-                    expected_epoch=data["expected_epoch"],
-                )
-        except JobBusy as busy:
-            return busy_response(busy)
-        except LibraryCommandError as exc:
-            return _storage_changed(exc)
-        except ValueError as exc:
-            return _invalid(str(exc))
-        except (OSError, sqlite3.Error):
-            self.logger.exception("Library restore failed")
-            return _failure(500, "restore-failed", "The prompts could not be restored")
-        return web.json_response({"success": True, **result})

py/api/library_location.py

@@ -50,7 +50,6 @@ _REFUSAL_STATUS = {
     "not-movable": 400,
     "same-folder": 400,
     "target-invalid": 400,
-    "data-dir-served": 400,
     "target-has-library": 409,
     "target-conflict": 409,
     "insufficient-space": 507,
@@ -75,24 +74,6 @@ def _failure(message, status, code):
     )
 
 
-def _thumbnail_folder():
-    """The thumbnail folder in use, or None (previews inside each source)."""
-    from . import preview_store
-
-    setting = preview_store.setting()
-    return setting.path if setting.mode == preview_store.FOLDER_MODE else None
-
-
-def _inside_thumbnail_folder(path):
-    """Whether *path* lies in the thumbnail folder in use (#320)."""
-    from . import preview_store
-
-    setting = preview_store.setting()
-    if setting.mode != preview_store.FOLDER_MODE or not setting.path:
-        return False
-    return ll._inside_any(path, [setting.path])
-
-
 def _plural(count, one, many=None):
     return f"{count:,} {one if count == 1 else (many or one + 's')}"
 
@@ -226,7 +207,6 @@ class LibraryLocationRoutesMixin:
         try:
             size = os.path.getsize(location.db_path)
         except OSError:
-            # no library file yet: report size 0
             pass
         return {
             "path": self._library_public_path(location.db_path),
@@ -244,8 +224,6 @@ class LibraryLocationRoutesMixin:
             ),
             "problem": location.problem or self._node_folder_risk(location),
             "size_bytes": size,
-            # #320 D201: thumbnails kept in one folder stay there (D8A).
-            "thumbnails_folder": _thumbnail_folder(),
         }
 
     # The node folder (tests point it at a temp tree).
@@ -293,8 +271,6 @@ class LibraryLocationRoutesMixin:
     def _plan_library_move(self):
         """The checked plan (blocking); raises MoveFailed."""
         plan = lm.plan_move(self._live_location())
-        if _inside_thumbnail_folder(plan.target_dir):
-            raise lm.MoveFailed("data-dir-served")
         if lm.space_problem(plan) is not None:
             raise lm.MoveFailed("insufficient-space")
         return plan
@@ -397,7 +373,6 @@ class LibraryLocationRoutesMixin:
         line += ". Logs move at the next restart."
         job.log_line(line)
         job.update(progress=100, status_line=line)
-        return None
 
     @staticmethod
     def _fail_library_move(job, code, message):

py/api/log_cleanup.py

@@ -68,23 +68,6 @@ def _count(count, singular, plural):
     return f"{count} {singular if count == 1 else plural}"
 
 
-# Each kept entry's row in the job (#586), in the review's "Kept: ..." words.
-KEPT_DETAILS = {
-    "active": "Kept: the active log",
-    "link": "Kept: a link",
-    "other": "Kept: another file",
-}
-
-
-def _kept_files(rows):
-    """``{name, kind}`` of each entry the cleanup keeps, in folder order."""
-    return [
-        {"name": row["name"], "kind": row["kind"]}
-        for row in rows
-        if row["kind"] in KEPT_DETAILS
-    ]
-
-
 def _protected_reasons(rows):
     """The plan's Protected reasons: what the cleanup keeps, zero counts left out."""
     active = sum(1 for row in rows if row["kind"] == "active")
@@ -146,7 +129,7 @@ class LogCleanupMixin:
             token = store.issue(
                 ROTATED_LOGS,
                 json.dumps(files, sort_keys=True),
-                {"files": files, "protected": protected, "kept": _kept_files(rows)},
+                {"files": files, "protected": protected},
                 (),
             )
         except ScopeTooLarge:
@@ -215,15 +198,10 @@ class LogCleanupMixin:
             job.record(
                 "errors", {"path": name, "detail": detail}, f"! {name} · {detail}"
             )
-        kept = [
-            {"path": row["name"], "detail": KEPT_DETAILS[row["kind"]]}
-            for row in plan.payload["kept"]
-        ]
-        job.record_counted("protected", len(kept), kept, complete=True)
+        job.record_counted("protected", plan.payload["protected"])
         removed, failed = len(result["removed"]), len(result["failed"])
         line = f"Deleted {_count(removed, 'rotated log copy', 'rotated log copies')}"
         if failed:
             line += f", {failed} could not be deleted"
         job.log_line(line)
         job.update(processed=len(files), progress=100, status_line=line)
-        return None

py/api/lora_import_routes.py

@@ -436,7 +436,7 @@ class LoraImportRoutesMixin:
             job.log_line(f"{CANCELLED} {CACHE_NOTE}")
             job.update(status_line=CANCELLED)
             job.finish("cancelled")
-            return None
+            return
         except Exception:
             self.logger.exception("LoRA import staging failed")
             return _fail_job(job, "import-failed", f"{FAILED} {CACHE_NOTE}")
@@ -455,10 +455,10 @@ class LoraImportRoutesMixin:
             job.log_line(f"{CANCELLED} {CACHE_NOTE}")
             job.update(status_line=CANCELLED)
             job.finish("cancelled")
-            return None
+            return
         ok, _backup = await self._safety_backup_step(job, db, backup_on)
         if not ok:
-            return None
+            return
         # I1: the files are listed and fingerprinted again right before the
         # replace, so a file changed, removed or added while the downloads ran
         # (LoraManager refreshing its CivitAI info) aborts with nothing deleted.
@@ -466,7 +466,6 @@ class LoraImportRoutesMixin:
             return _fail_job(job, "plan-changed", f"{SOURCE_CHANGED} {CACHE_NOTE}")
         job.update(status_line="Replacing the LoRA collection", progress=95)
         await self._replace_in_job(job, db, plan, staged)
-        return None
 
     def _count_downloads(self, job, staged):
         downloaded = staged.stats.get("downloaded", 0)
@@ -519,4 +518,3 @@ class LoraImportRoutesMixin:
             staged.stats.get("download_errors", 0),
         )
         job.update(progress=100, processed=job.total, status_line=line)
-        return None

py/api/lora_integration.py

@@ -44,7 +44,6 @@ _FILES_CHANGED = (
     "The LoRA metadata files changed during the scan; the previous imports "
     "were kept. Run the scan again."
 )
-_LORA_SCAN_FAILED = "The LoRA import failed. Check the server log for details."
 _IMPORTS_CHANGED = (
     "The imported LoRA prompts changed during the scan; the previous imports "
     "were kept. Run the scan again."
@@ -408,21 +407,10 @@ class LoraIntegrationMixin:
             return
         if isinstance(error, PlanChanged):
             message = _IMPORTS_CHANGED
-        elif isinstance(
-            error,
-            (
-                LoraFilesChanged,
-                LoraSettingsUnusable,
-                EmptyReplacement,
-                PairDependencyError,
-            ),
-        ):
+        elif isinstance(error, (LoraFilesChanged, LoraSettingsUnusable)):
             message = str(error)
-        elif isinstance(error, OSError):
-            # Reduced to its reason and the file's basename.
-            message = self._public_error(error)
         else:
-            message = _LORA_SCAN_FAILED
+            message = self._public_error(error)
         if isinstance(
             error,
             (
@@ -548,7 +536,6 @@ class LoraIntegrationMixin:
                 except asyncio.CancelledError:
                     interrupted = True
                 except Exception:
-                    # the await after this loop raises it for the caller
                     pass
             if interrupted:
                 raise asyncio.CancelledError

py/api/maintenance.py

@@ -1,9 +1,8 @@
 """Maintenance routes: reviewed, read-only plans (#249 System S6).
 
 ``POST /prompt_manager/maintenance/preview {operation, options:{}}`` reviews
-one operation (``duplicate_prompts``, ``optimize``, ``unused_components``,
-``missing_links`` or ``pair_metadata``, #550; ``database/maintenance.py``;
-``duplicate_files``,
+one operation (``duplicate_prompts``, ``optimize``, ``unused_components`` or
+``missing_links``; ``database/maintenance.py``; ``duplicate_files``,
 ``py/api/duplicate_files.py``; ``rotated_logs``, the rotated log copies,
 ``py/api/log_cleanup.py``, which has its own apply job) off the event loop and
 answers a ``Plan``: ``{success, token, operation, expires_at, scope:{count,
@@ -98,11 +97,7 @@ MAINTENANCE_TITLES = {
     "unused_components": "Unused prompt components",
     "missing_links": "Missing-file links",
     "workflow_storage": "Store each workflow once",
-    # #550, beyond the concept: fills old Pair prompts' empty category and tags.
-    "pair_metadata": "Pair category and tags",
 }
-# Operations whose job keeps every changed row for its report (#550).
-COMPLETE_RECORD = frozenset({"pair_metadata"})
 _OPERATION_ERROR = "operation must be one of: " + ", ".join(PREVIEW_OPERATIONS)
 MAINTENANCE_GROUPS = ("changed", "protected", "errors")
 MAX_TOKEN_LENGTH = 128
@@ -286,27 +281,9 @@ def short_space_message(short):
     )
 
 
-def _pair_metadata_line(result):
-    count = result["changed"]
-    noun = (
-        "prompt from its saved pairs"
-        if count == 1
-        else "prompts from their saved pairs"
-    )
-    categories = result.get("categories", 0)
-    tag_sets = result.get("tag_sets", 0)
-    return (
-        f"Filled {count:,} {noun} "
-        f"({categories:,} {'category' if categories == 1 else 'categories'}, "
-        f"{tag_sets:,} {'tag set' if tag_sets == 1 else 'tag sets'})"
-    )
-
-
-def _changed_line(operation, count, marks=0, result=None):
+def _changed_line(operation, count):
     if operation == "optimize":
         return "Optimized the database"
-    if operation == "pair_metadata":
-        return _pair_metadata_line(result or {"changed": count})
     if operation == "duplicate_prompts":
         noun = "duplicate prompt" if count == 1 else "duplicate prompts"
         return f"Merged {count:,} {noun}"
@@ -314,11 +291,7 @@ def _changed_line(operation, count, marks=0, result=None):
         noun = "unused prompt component" if count == 1 else "unused prompt components"
         return f"Removed {count:,} {noun}"
     noun = "link to a missing file" if count == 1 else "links to missing files"
-    line = f"Removed {count:,} {noun}"
-    if marks:
-        gone = "removed image" if marks == 1 else "removed images"
-        line += f"; forgot {marks:,} {gone} whose files are gone or changed"
-    return line
+    return f"Removed {count:,} {noun}"
 
 
 def take_safety_backup(model, label="backup"):
@@ -446,7 +419,6 @@ class MaintenanceRoutesMixin:
             draft.public(),
             {
                 "targets": draft.targets,
-                "marks": draft.marks,
                 "roots": roots,
                 "protected": draft.protected["count"],
                 "rows": draft.scope["count"],
@@ -516,9 +488,7 @@ class MaintenanceRoutesMixin:
     # ── apply ─────────────────────────────────────────────────────────
 
     async def apply_maintenance_plan(self, request):
-        from .image_delete import IMAGE_DELETE, parse_mode
-
-        data, error = await self._read_maintenance_body(request, ("token", "mode"))
+        data, error = await self._read_maintenance_body(request, ("token",))
         if error is not None:
             return error
         token = data.get("token")
@@ -527,13 +497,6 @@ class MaintenanceRoutesMixin:
         plan, refused = self._peek_plan(token)
         if refused is not None:
             return refused
-        mode = None
-        if plan.operation == IMAGE_DELETE:
-            mode = parse_mode(data.get("mode"))
-            if mode is None:
-                return _invalid('mode must be "library" or "trash"')
-        elif "mode" in data:
-            return _invalid("Unknown field: mode")
         store = self._maintenance_plans
         if plan.operation == ROTATED_LOGS:
             # Log files only: no database identity, backup or disk check.
@@ -581,8 +544,6 @@ class MaintenanceRoutesMixin:
         try:
             if plan.operation == DUPLICATE_FILES:
                 job = self._start_duplicate_cleanup(db, plan, backup)
-            elif plan.operation == IMAGE_DELETE:
-                job = self._start_image_delete(db, plan, mode, backup)
             elif plan.operation == WORKFLOW_STORAGE:
                 job = self._start_workflow_storage(db, backup)
             else:
@@ -681,7 +642,6 @@ class MaintenanceRoutesMixin:
                 plan.fingerprint,
                 payload["targets"],
                 payload["roots"],
-                payload.get("marks", ()),
             )
         except PlanChanged:
             return _fail_job(job, "plan-changed", PLAN_CHANGED)
@@ -691,66 +651,11 @@ class MaintenanceRoutesMixin:
         rows = await self._run_in_executor(
             self._maintenance_rows, plan.operation, result["rows"]
         )
-        job.record_counted(
-            "changed",
-            result["changed"],
-            rows,
-            complete=plan.operation in COMPLETE_RECORD,
-        )
-        kept = await self._run_in_executor(self._kept_rows, db, plan, result)
-        if kept is None:
-            job.record_counted("protected", payload["protected"])  # none kept
-        else:
-            # #550, #586: each kept record with its reason, like the changed
-            # ones, and every one of them in the report.
-            job.record_counted("protected", len(kept), kept, complete=True)
-        line = _changed_line(
-            plan.operation, result["changed"], result.get("marks", 0), result
-        )
+        job.record_counted("changed", result["changed"], rows)
+        job.record_counted("protected", payload["protected"])
+        line = _changed_line(plan.operation, result["changed"])
         job.log_line(line)
         job.update(progress=100, status_line=f"{line} · {backup_note(backup)}")
-        return None
-
-    def _kept_rows(self, db, plan, result):
-        """Outcome rows for the records the apply kept (blocking), or None.
-
-        Prompts are records (no path); a missing-links plan's kept links
-        name their file, relative to its output root, so Activity can open
-        and locate it (#586); one under a source that is gone keeps its path
-        under that source's label. None for an operation that keeps nothing
-        (Optimize).
-        """
-        if plan.operation == "missing_links":
-            roots = _scan_roots(self._get_all_output_dirs())
-            judged = plan.payload["roots"]
-            rows = []
-            for item in db.kept_links(judged):
-                path, label, index = _scan_location(item["image_path"], roots)
-                if index is None and item["owner"] is not None:
-                    # A source that is gone is not listed: name the file
-                    # under it, with no listing index to open it by.
-                    source = judged[item["owner"]]
-                    where = [(os.path.abspath(source), self._public_path(source), None)]
-                    path, label, index = _scan_location(item["image_path"], where)
-                rows.append(
-                    {
-                        "path": path,
-                        "root": label,
-                        "root_index": index,
-                        "detail": f"Kept: {item['reason']}",
-                    }
-                )
-            return rows
-        if "kept" not in result:
-            return None
-        return [
-            {
-                "path": "",
-                "detail": f"Prompt {item['prompt_id']}: kept, "
-                + "; ".join(item["reasons"]),
-            }
-            for item in result["kept"]
-        ]
 
     def _maintenance_rows(self, operation, described):
         """Outcome rows for the changed records (root-relative paths only)."""
@@ -768,8 +673,6 @@ class MaintenanceRoutesMixin:
                     }
                 )
             return rows
-        if operation == "pair_metadata":
-            return [{"path": "", "detail": _filled_detail(item)} for item in described]
         if operation == "duplicate_prompts":
             return [
                 {
@@ -787,16 +690,6 @@ class MaintenanceRoutesMixin:
         ]
 
 
-def _filled_detail(item):
-    """``Prompt 12: category “portrait”; tags a, b``: one filled prompt (#550)."""
-    parts = []
-    if "category" in item:
-        parts.append(f"category “{item['category']}”")
-    if item.get("tags"):
-        parts.append("tags " + ", ".join(item["tags"]))
-    return f"Prompt {item['prompt_id']}: " + "; ".join(parts)
-
-
 def backup_note(backup):
     """The status line's backup part: the file name, or that there is none."""
     return f"Safety backup {backup}" if backup else NO_BACKUP

py/api/media_target.py

@@ -9,15 +9,13 @@ by the caller.
 import os
 import re
 
-from .images import _file_not_found, _forbidden, _has_traversal
+from .images import _forbidden, _has_traversal
 from .prompts import bad_request
 
 try:
     from ...utils.media_capture import CAPTURE_EXTENSIONS
-    from ...utils.media_folders import in_trash_folder
 except ImportError:
     from utils.media_capture import CAPTURE_EXTENSIONS
-    from utils.media_folders import in_trash_folder
 
 MAX_TARGET_PATH = 1024
 TARGET_FIELDS = frozenset({"root_index", "root_scope", "path"})
@@ -31,9 +29,7 @@ def media_target(data: object, *, media_message: str = TAGGING_MEDIA_MESSAGE):
     Only the listing identity is accepted: an int root index, the root's
     64-hex scope and a bounded root-relative POSIX media path, never an
     absolute, drive-qualified, backslash or ``..`` path (a 400 for a malformed
-    shape, a 403 for an unsafe or non-media path, carrying *media_message*, a
-    404 for a path in a trash folder, #543). A link or a short-name spelling
-    is refused later by the capture store's alias check.
+    shape, a 403 for an unsafe or non-media path, carrying *media_message*).
     """
     if not isinstance(data, dict) or set(data) != TARGET_FIELDS:
         return None, bad_request("target must name root_index, root_scope and path")
@@ -55,6 +51,4 @@ def media_target(data: object, *, media_message: str = TAGGING_MEDIA_MESSAGE):
         return None, _forbidden()
     if os.path.splitext(parts[-1])[1].lower() not in CAPTURE_EXTENSIONS:
         return None, _forbidden(media_message)
-    if in_trash_folder(relative):
-        return None, _file_not_found()
     return (index, scope, relative), None

py/api/pairs.py

@@ -102,12 +102,7 @@ class PairRoutesMixin:
             validate_prompt_text(negative)
         fields = metadata_fields(data)
         pair_id = await self._run_in_executor(
-            self.db.save_prompt_pair,
-            positive,
-            negative,
-            # The node's Save pair button: as a run, a new prompt gets the metadata.
-            fill_new_positive=True,
-            **fields,
+            self.db.save_prompt_pair, positive, negative, **fields
         )
         pair = await self._run_in_executor(self.db.get_prompt_pair, pair_id)
         return web.json_response({"success": True, "pair": pair})

py/api/preview_location.py

@@ -1,728 +0,0 @@
-"""The thumbnail location setting (#320): parsing, validation, source keys
-and the thumbnail folder's marker.
-
-``preview_store`` holds the runtime state and maps paths; this module holds
-the rules it applies. Nothing here keeps state.
-
-Schema (config.json ``thumbnails.location``)::
-
-    {"mode": "folder", "path": "D:\\\\Thumbs", "id": "<uuid4>",
-     "install": "<uuid4>", "cleanup": []}
-
-The default (and a missing key) is ``{"mode": "source"}``: previews inside
-each source. An invalid value never falls back to the sources: it parses as
-a folder location with problem ``invalid``, so nothing is written anywhere.
-
-Layout in folder mode: ``<folder>/<source key>/<rel dir>/<stem>_thumb<ext>``.
-A source key is a readable slug plus a short hash of the source's identity
-(``output-3f9a2c1b``), assigned once and stored in the marker
-``.promptmanager-thumbnails.json`` with the identity it belongs to.
-"""
-
-import errno
-import hashlib
-import json
-import logging
-import ntpath
-import os
-import posixpath
-import re
-import stat as stat_module
-import threading
-import time
-import unicodedata
-import uuid
-from contextlib import contextmanager
-from dataclasses import dataclass, field
-
-try:
-    from ...utils import library_location
-except ImportError:  # tests import the package top-level
-    from utils import library_location
-
-logger = logging.getLogger("prompt_manager.thumbnails")
-
-SOURCE_MODE = "source"
-FOLDER_MODE = "folder"
-MARKER_NAME = ".promptmanager-thumbnails.json"
-MARKER_VERSION = 1
-# Beside the marker while one process re-reads, changes and replaces it.
-MARKER_LOCK_NAME = ".promptmanager-thumbnails.lock"
-MARKER_LOCK_TIMEOUT = 1.5  # a writer waits this long (under preview_store.IO_BUDGET)
-MARKER_LOCK_STALE = 30.0  # a lock this old was left by a writer that died
-MARKER_LOCK_POLL = 0.02
-# A source key: one folder name, a slug and a 8-16 hex hash (``source_key``).
-KEY_PATTERN = re.compile(r"^[a-z0-9_-]{1,24}-[0-9a-f]{8,16}$")
-# A marker is a few keys; anything larger is not ours.
-MAX_MARKER_BYTES = 4 * 2**20
-# OS metadata files a folder may hold and still count as empty.
-OS_METADATA = frozenset({"thumbs.db", "desktop.ini", ".ds_store"})
-KEY_HASH_LENGTHS = (8, 12, 16)
-SLUG_LENGTH = 24
-# Folder + the longest key (24 + 1 + 16) + this margin must fit (Windows).
-WINDOWS_FOLDER_LIMIT = 247
-LONGEST_KEY = SLUG_LENGTH + 1 + KEY_HASH_LENGTHS[-1]
-PATH_MARGIN = 40
-# A validation stat on a share that does not answer in time is unavailable.
-VALIDATION_TIMEOUT = 5.0
-FILE_ATTRIBUTE_REPARSE_POINT = 0x400
-
-_RESERVED = re.compile(r"^(con|prn|aux|nul|com[1-9]|lpt[1-9])(\..*)?$", re.IGNORECASE)
-_BAD_CHARS = re.compile(r'[<>:"|?*\x00-\x1f]')
-
-# Problem codes, their HTTP status and the text the UI shows (no path).
-MESSAGES = {
-    "location-not-absolute": (
-        400,
-        "Enter a full folder path, such as D:\\Thumbnails or /mnt/fast/thumbnails.",
-    ),
-    "location-device-path": (
-        400,
-        "Enter the folder as a drive letter or \\\\server\\share path, "
-        "without \\\\?\\.",
-    ),
-    "location-invalid-name": (
-        400,
-        "This folder name can't be used on Windows. Choose another name.",
-    ),
-    "location-too-broad": (
-        400,
-        "Choose a folder inside a drive or share, not the drive itself.",
-    ),
-    "location-served": (
-        400,
-        "Choose a folder outside your image sources and ComfyUI's output, input "
-        "and temp folders.",
-    ),
-    "location-node-folder": (
-        400,
-        "Choose a folder outside the Prompt Manager node folder.",
-    ),
-    "location-contains-source": (
-        400,
-        "This folder contains an image source. Choose a folder beside it instead.",
-    ),
-    "location-same": (400, "Thumbnails are already stored here."),
-    "location-inside-current": (
-        400,
-        "This folder is inside the thumbnail folder in use. Choose a folder "
-        "outside it.",
-    ),
-    "location-parent-missing": (
-        400,
-        "The folder that would hold it doesn't exist. Check the path and that its "
-        "drive is connected.",
-    ),
-    "location-unavailable": (
-        409,
-        "This folder can't be reached right now. Check that its drive or share is "
-        "connected.",
-    ),
-    "location-not-empty": (
-        409,
-        "This folder already holds other files. Choose an empty folder or one "
-        "Prompt Manager used before.",
-    ),
-    "location-not-writable": (
-        409,
-        "Prompt Manager can't write to this folder. Check its permissions.",
-    ),
-    "location-path-too-long": (
-        400,
-        "This path is too long for Windows. Choose a shorter folder path.",
-    ),
-    "insufficient-space": (
-        507,
-        "There is not enough space for the thumbnails. Free some space or choose "
-        "another folder.",
-    ),
-    "location-needs-move": (
-        409,
-        "Use Move thumbnails in System › Sources & scans.",
-    ),
-}
-HOLDS_THUMBNAILS_REASON = "This folder holds Prompt Manager's thumbnails."
-
-
-def message(code):
-    """``(status, text)`` of a problem code."""
-    return MESSAGES[code]
-
-
-# ── parsing ──────────────────────────────────────────────────────────
-
-
-@dataclass(frozen=True)
-class ParsedLocation:
-    """A ``thumbnails.location`` value, checked as data (no filesystem)."""
-
-    mode: str = SOURCE_MODE
-    path: str | None = None
-    id: str | None = None
-    install: str | None = None
-    cleanup: tuple = field(default_factory=tuple)
-    problem: str | None = None
-
-    def to_config(self):
-        """The config.json form (``invalid`` values are never written)."""
-        if self.mode == SOURCE_MODE:
-            value = {"mode": SOURCE_MODE}
-        else:
-            value = {"mode": FOLDER_MODE, "path": self.path, "id": self.id}
-        if self.install:
-            value["install"] = self.install
-        value["cleanup"] = list(self.cleanup)
-        return value
-
-
-def _cleanup(value):
-    if not isinstance(value, list):
-        return ()
-    return tuple(item for item in value if isinstance(item, dict))
-
-
-def parse_location(value, *, flavor=os.path):
-    """The location a ``thumbnails.location`` value names.
-
-    Missing: inside each source. Anything else that is not a well-formed
-    location (an unknown mode, a relative path, a missing id) becomes a
-    folder location with problem ``invalid``: never a silent fall-back.
-    """
-    if value is None:
-        return ParsedLocation()
-    if not isinstance(value, dict):
-        return ParsedLocation(mode=FOLDER_MODE, problem="invalid")
-    mode = value.get("mode", SOURCE_MODE)
-    install = value.get("install") if isinstance(value.get("install"), str) else None
-    cleanup = _cleanup(value.get("cleanup"))
-    if mode == SOURCE_MODE:
-        return ParsedLocation(install=install, cleanup=cleanup)
-    if mode != FOLDER_MODE:
-        return ParsedLocation(mode=FOLDER_MODE, problem="invalid", cleanup=cleanup)
-    path, marker_id = value.get("path"), value.get("id")
-    if (
-        not isinstance(path, str)
-        or form_problem(path, flavor=flavor) is not None
-        or not isinstance(marker_id, str)
-        or not marker_id.strip()
-    ):
-        return ParsedLocation(
-            mode=FOLDER_MODE,
-            path=path if isinstance(path, str) else None,
-            problem="invalid",
-            cleanup=cleanup,
-        )
-    return ParsedLocation(
-        mode=FOLDER_MODE,
-        path=flavor.abspath(path),
-        id=marker_id,
-        install=install,
-        cleanup=cleanup,
-    )
-
-
-# ── form (text only) ─────────────────────────────────────────────────
-
-
-def _is_windows(flavor):
-    return flavor is ntpath or getattr(flavor, "__name__", "") == "ntpath"
-
-
-def form_problem(path, *, flavor=os.path):
-    """The text-only problem of *path*, or None (no filesystem access).
-
-    ``\\\\?\\`` and ``\\\\.\\`` prefixes, relative, drive-relative (``C:x``)
-    and root-relative (``\\x``) spellings, and names Windows cannot hold
-    (checked on every OS: the folder may be moved to Windows).
-    """
-    if not isinstance(path, str) or not path.strip() or path != path.lstrip():
-        return "location-not-absolute"
-    if path.replace("/", "\\").startswith(("\\\\?\\", "\\\\.\\")):
-        return "location-device-path"
-    if _is_windows(flavor):
-        drive, rest = ntpath.splitdrive(path)
-        if not drive or not rest.startswith(("\\", "/")):
-            return "location-not-absolute"
-    elif not posixpath.isabs(path):
-        return "location-not-absolute"
-    drive, rest = flavor.splitdrive(path)
-    for part in re.split(r"[\\/]+", rest):
-        if not part:
-            continue
-        if (
-            _RESERVED.match(part)
-            or part.endswith((".", " "))
-            or _BAD_CHARS.search(part)
-        ):
-            return "location-invalid-name"
-    return None
-
-
-def is_too_broad(path, *, home=None, flavor=os.path):
-    """A filesystem or share root, or the home folder itself."""
-    normalized = flavor.normpath(path)
-    drive, rest = flavor.splitdrive(normalized)
-    if rest in ("", "\\", "/"):
-        return True
-    home = home if home is not None else os.path.expanduser("~")
-    return bool(home) and flavor.normcase(normalized) == flavor.normcase(
-        flavor.normpath(home)
-    )
-
-
-def too_long_for_windows(path, long_paths=None):
-    """Folder + the longest key + a margin over the folder limit (Windows
-    without long paths; *long_paths* injects the registry answer)."""
-    if long_paths is None:
-        long_paths = long_paths_enabled()
-    if long_paths:
-        return False
-    return len(path) + 1 + LONGEST_KEY + PATH_MARGIN > WINDOWS_FOLDER_LIMIT
-
-
-def long_paths_enabled():
-    """``LongPathsEnabled`` on Windows (True on other systems)."""
-    if os.name != "nt":
-        return True
-    try:
-        import winreg
-
-        with winreg.OpenKey(
-            winreg.HKEY_LOCAL_MACHINE,
-            r"SYSTEM\CurrentControlSet\Control\FileSystem",
-        ) as key:
-            return winreg.QueryValueEx(key, "LongPathsEnabled")[0] == 1
-    except OSError:
-        return False
-
-
-# ── links ────────────────────────────────────────────────────────────
-
-
-def is_link_like(path):
-    """A symlink, a junction or any reparse point (one lstat), or missing.
-
-    Raises OSError other than "not found" (an unreachable share).
-    """
-    try:
-        info = os.lstat(path)
-    except FileNotFoundError:
-        return False
-    if stat_module.S_ISLNK(info.st_mode):
-        return True
-    attributes = getattr(info, "st_file_attributes", 0)
-    if attributes & FILE_ATTRIBUTE_REPARSE_POINT:
-        return True
-    is_junction = getattr(os.path, "isjunction", None)
-    return bool(is_junction and is_junction(path))
-
-
-# ── source keys ──────────────────────────────────────────────────────
-
-
-def slug(name):
-    """``NFKD`` to ASCII, lower case, runs outside ``[a-z0-9_]`` as ``-``,
-    trimmed and cut to 24 characters; empty becomes ``source``."""
-    text = unicodedata.normalize("NFKD", str(name))
-    text = text.encode("ascii", "ignore").decode("ascii").lower()
-    text = re.sub(r"[^a-z0-9_]+", "-", text).strip("-")
-    text = text[:SLUG_LENGTH].strip("-")
-    return text or "source"
-
-
-def source_key(spelling, identity, taken):
-    """The key of a source: ``slug(basename) + "-" + sha256(identity)[:n]``.
-
-    *taken* maps existing keys to their identity; a key taken by another
-    identity grows its hash to 12, then 16 characters.
-    """
-    base = slug(ntpath.basename(str(spelling).rstrip("\\/")))
-    digest = hashlib.sha256(str(identity).encode("utf-8")).hexdigest()
-    for length in KEY_HASH_LENGTHS:
-        key = f"{base}-{digest[:length]}"
-        owner = taken.get(key)
-        if owner is None or owner == identity:
-            return key
-    raise ValueError("no free source key")
-
-
-def file_identity(path):
-    """``[st_dev, st_ino]`` of an existing folder, or None (no file ids)."""
-    try:
-        info = os.stat(path)
-    except (OSError, ValueError):
-        return None
-    if not info.st_ino:
-        return None
-    return [info.st_dev, info.st_ino]
-
-
-def find_key(keys, spelling, identity, dev_ino):
-    """The marker key of a source: the same configured spelling, then the
-    same identity text, then the same file id; or None."""
-    keys = {k: v for k, v in keys.items() if valid_key(k) and isinstance(v, dict)}
-    for key, entry in keys.items():
-        if entry.get("path") == spelling:
-            return key
-    for key, entry in keys.items():
-        if entry.get("identity") == identity:
-            return key
-    if dev_ino:
-        for key, entry in keys.items():
-            if entry.get("dev_ino") == list(dev_ino):
-                return key
-    return None
-
-
-# ── the marker ───────────────────────────────────────────────────────
-
-
-def marker_path(folder):
-    return os.path.join(folder, MARKER_NAME)
-
-
-def read_marker(folder):
-    """The marker in *folder* as a dict, or None (absent or unreadable as
-    ours). OSError other than "not found" propagates (an unreachable share)."""
-    try:
-        with open(marker_path(folder), "r", encoding="utf-8") as handle:
-            text = handle.read(MAX_MARKER_BYTES + 1)
-    except FileNotFoundError:
-        return None
-    except (ValueError, UnicodeDecodeError):
-        return None
-    if len(text) > MAX_MARKER_BYTES:
-        return None
-    try:
-        data = json.loads(text)
-    except ValueError:
-        return None
-    if not isinstance(data, dict) or not isinstance(data.get("id"), str):
-        return None
-    data["keys"] = valid_keys(data.get("keys"))
-    return data
-
-
-def valid_key(key):
-    """Whether *key* can name a source's folder: one folder name of the
-    ``source_key`` form, never a separator, ``..`` or a drive."""
-    return isinstance(key, str) and KEY_PATTERN.fullmatch(key) is not None
-
-
-def valid_keys(keys):
-    """The marker's keys that are safe to join onto the folder; a hand-edited
-    or foreign entry that is not is dropped (and logged), never followed."""
-    if not isinstance(keys, dict):
-        return {}
-    kept = {}
-    for key, entry in keys.items():
-        if valid_key(key) and isinstance(entry, dict):
-            kept[key] = entry
-        else:
-            logger.warning(
-                "Ignoring a thumbnail folder marker entry that is not a source " "key"
-            )
-    return kept
-
-
-@contextmanager
-def _marker_lock(folder):
-    """Hold the folder's marker lock: a file made with ``O_CREAT | O_EXCL``
-    (atomic on local disks and SMB/NFS shares, unlike ``flock``), so installs
-    sharing the folder change the marker one at a time. A lock older than
-    MARKER_LOCK_STALE was left by a writer that died and is taken over;
-    waiting longer than MARKER_LOCK_TIMEOUT raises TimeoutError."""
-    lock = os.path.join(folder, MARKER_LOCK_NAME)
-    deadline = time.monotonic() + MARKER_LOCK_TIMEOUT
-    while True:
-        try:
-            handle = os.open(lock, os.O_CREAT | os.O_EXCL | os.O_WRONLY, 0o644)
-        except FileExistsError:
-            _break_stale_lock(lock)
-            if time.monotonic() >= deadline:
-                raise TimeoutError(
-                    errno.ETIMEDOUT, "the thumbnail folder marker is locked", lock
-                )
-            time.sleep(MARKER_LOCK_POLL)
-            continue
-        try:
-            os.write(handle, f"{os.getpid()}\n".encode("ascii"))
-        finally:
-            os.close(handle)  # closed before any unlink (Windows)
-        break
-    try:
-        yield
-    finally:
-        try:
-            os.unlink(lock)
-        except FileNotFoundError:
-            pass  # taken over as stale by another writer: nothing to release
-
-
-def _break_stale_lock(lock):
-    """Remove *lock* when it is older than MARKER_LOCK_STALE (its writer
-    died); a lock that changed since it was looked at is left alone."""
-    try:
-        before = os.stat(lock)
-    except FileNotFoundError:
-        return
-    if time.time() - before.st_mtime < MARKER_LOCK_STALE:
-        return
-    logger.warning(f"Taking over a stale thumbnail folder lock: {lock}")
-    try:
-        after = os.stat(lock)
-        if (after.st_ino, after.st_mtime_ns) == (before.st_ino, before.st_mtime_ns):
-            os.unlink(lock)
-    except FileNotFoundError:
-        pass  # another writer took it over first
-
-
-def write_marker(folder, mutate):
-    """Re-read the marker, apply ``mutate(marker)`` and write it atomically
-    (a temp sibling renamed over it), all under the folder's marker lock so a
-    second install sharing the folder never drops this one's change (and
-    the other way round). Callers hold ``preview_store.write_lock`` (threads
-    of this process). Returns the marker written; TimeoutError when another
-    writer holds the lock too long."""
-    with _marker_lock(folder):
-        return _write_marker_locked(folder, mutate)
-
-
-def _write_marker_locked(folder, mutate):
-    current = read_marker(folder) or {}
-    marker = {
-        "version": MARKER_VERSION,
-        "id": current.get("id"),
-        "created_by_pm": bool(current.get("created_by_pm", False)),
-        "keys": dict(current.get("keys") or {}),
-    }
-    mutate(marker)
-    if not marker.get("id"):
-        raise ValueError("a marker needs an id")
-    target = marker_path(folder)
-    temp = os.path.join(
-        folder, f".{MARKER_NAME}.{os.getpid()}-{threading.get_ident()}.tmp"
-    )
-    try:
-        with open(temp, "w", encoding="utf-8") as handle:
-            json.dump(marker, handle, indent=2, sort_keys=True)
-            handle.flush()
-            os.fsync(handle.fileno())
-        os.replace(temp, target)
-    finally:
-        try:
-            os.unlink(temp)
-        except OSError:
-            pass  # gone with the rename; a leftover is swept with the temps
-    return marker
-
-
-def new_id():
-    return str(uuid.uuid4())
-
-
-def init_folder(folder, *, created_by_pm=False):
-    """The marker id of *folder*: an existing marker is adopted; a folder
-    without one gets a new marker (new id, no keys)."""
-    existing = read_marker(folder)
-    if existing is not None:
-        return existing["id"]
-
-    def create(marker):
-        if not marker.get("id"):
-            marker["id"] = new_id()
-            marker["created_by_pm"] = created_by_pm
-
-    return write_marker(folder, create)["id"]
-
-
-def folder_state(path, expected_id):
-    """``(available, problem, marker)`` of a configured thumbnail folder.
-
-    Available: the folder exists, is a directory and not a link, junction or
-    reparse point, and holds our marker with *expected_id*. Raises OSError
-    when the folder cannot be reached (an I/O error other than not found).
-    """
-    try:
-        info = os.lstat(path)
-    except FileNotFoundError:
-        return False, "missing", None
-    except OSError as error:
-        if error.errno in (errno.ENOENT, errno.ENOTDIR):
-            return False, "missing", None
-        raise
-    if is_link_like(path):
-        return False, "invalid", None
-    if not stat_module.S_ISDIR(info.st_mode):
-        return False, "invalid", None
-    marker = read_marker(path)
-    if marker is None:
-        return False, "missing", None
-    if marker["id"] != expected_id:
-        return False, "marker-mismatch", marker
-    return True, None, marker
-
-
-def holds_only_metadata(path):
-    """Whether an existing folder is empty but for OS metadata files."""
-    with os.scandir(path) as entries:
-        for entry in entries:
-            name = entry.name.lower()
-            if name in OS_METADATA or name.startswith("._"):
-                continue
-            return False
-    return True
-
-
-# ── validation ───────────────────────────────────────────────────────
-
-
-@dataclass(frozen=True)
-class Context:
-    """What a location is checked against (gathered by the caller)."""
-
-    roots: tuple = ()  # every image source of every root list
-    contained: tuple = ()  # ComfyUI output/input/temp and the library folder
-    node_folder: str | None = None
-    default_path: str | None = None
-    current_path: str | None = None  # the folder in use (folder mode)
-    home: str | None = None
-    flavor: object = os.path
-    long_paths: bool | None = None
-    environ: object = None
-    # ComfyUI's folder_paths module (None: none; unset: imported).
-    folder_paths: object = library_location._UNSET
-
-
-def _timed(func, timeout):
-    """``func()`` on a daemon thread; raises TimeoutError past *timeout*.
-    A stuck call is left to finish on its own thread."""
-    result = {}
-    done = threading.Event()
-
-    def run():
-        try:
-            result["value"] = func()
-        except BaseException as error:  # _timed() re-raises it in the caller
-            result["error"] = error
-        finally:
-            done.set()
-
-    threading.Thread(target=run, name="pm-preview-stat", daemon=True).start()
-    if not done.wait(timeout):
-        raise TimeoutError("the folder did not answer in time")
-    if "error" in result:
-        raise result["error"]
-    return result.get("value")
-
-
-def _inside(path, folders):
-    return library_location._inside_any(path, folders)
-
-
-def _same(first, second):
-    return library_location.same_folder(first, second) or os.path.normcase(
-        os.path.realpath(first)
-    ) == os.path.normcase(os.path.realpath(second))
-
-
-def _served(path, context):
-    environ = os.environ if context.environ is None else context.environ
-    return (
-        library_location.data_dir_problem(
-            path,
-            folder_paths=context.folder_paths,
-            environ=environ,
-            gallery_roots=list(context.roots),
-        )
-        == "data-dir-served"
-    )
-
-
-def _probe_write(path):
-    """Create and delete a probe file in *path*; False when refused."""
-    probe = os.path.join(path, f".pm-probe-{uuid.uuid4().hex[:8]}.tmp")
-    try:
-        with open(probe, "wb") as handle:
-            handle.write(b"")
-    except OSError:
-        return False
-    try:
-        os.unlink(probe)
-    except OSError:
-        return False
-    return True
-
-
-def location_problem(path, *, purpose, context, timeout=VALIDATION_TIMEOUT):
-    """Why *path* cannot be the thumbnail folder, as a code, or None.
-
-    *purpose*: ``move`` (every rule), ``startup`` (no ``same``, ``empty``,
-    ``writable`` or parent rules: availability covers them) or ``recreate``
-    (the folder is missing and is made again).
-    """
-    flavor = context.flavor
-    code = form_problem(path, flavor=flavor)
-    if code is not None:
-        return code
-    path = flavor.abspath(path)
-    default = bool(context.default_path) and flavor.normcase(path) == flavor.normcase(
-        flavor.abspath(context.default_path)
-    )
-    if is_too_broad(path, home=context.home, flavor=flavor):
-        return "location-too-broad"
-    try:
-        return _timed(
-            lambda: _filesystem_problem(path, purpose, context, default), timeout
-        )
-    except (TimeoutError, OSError):
-        return "location-unavailable"
-
-
-def _filesystem_problem(path, purpose, context, default):
-    if _served(path, context):
-        return "location-served"
-    if context.node_folder and not default and _inside(path, [context.node_folder]):
-        return "location-node-folder"
-    inner = list(context.roots) + list(context.contained)
-    if any(folder and _inside(folder, [path]) for folder in inner):
-        if not default:
-            return "location-contains-source"
-    if (
-        purpose == "move"
-        and context.current_path
-        and (
-            os.path.normcase(path) == os.path.normcase(context.current_path)
-            or (os.path.isdir(path) and _same(path, context.current_path))
-        )
-    ):
-        return "location-same"
-    if (
-        purpose == "move"
-        and context.current_path
-        and _inside(path, [context.current_path])
-    ):
-        # The old key folders are removed after the move, and with them a
-        # target nested inside one of them.
-        return "location-inside-current"
-    # Windows, or a test injecting its limit (``long_paths=False``).
-    if os.name == "nt" or context.long_paths is False:
-        if too_long_for_windows(path, context.long_paths):
-            return "location-path-too-long"
-    if purpose == "startup":
-        return None
-    if is_link_like(path):
-        # Never through a link: the folder itself must be a real folder.
-        return "location-not-empty"
-    exists = os.path.isdir(path)
-    if not exists:
-        if os.path.lexists(path):
-            return "location-not-empty"
-        if not default and not os.path.isdir(os.path.dirname(path)):
-            return "location-parent-missing"
-        return None
-    if read_marker(path) is None and not holds_only_metadata(path):
-        return "location-not-empty"
-    if not _probe_write(path):
-        return "location-not-writable"
-    return None

py/api/preview_store.py

@@ -1,728 +0,0 @@
-"""Where previews live on disk (#320): the one resolver.
-
-Every mapping between an image source (a "root"), one of its media files and
-that file's preview on disk goes through this module. URL text stays in
-``thumbnail_settings`` (``thumbnail_rel``: ``thumbnails/<rel>_thumb<ext>``,
-the shape the serve route, ``inspection-state.mjs`` and ``admin.js`` share);
-this module answers where such a preview is on disk.
-
-The store of a source is where its previews live. With the default location
-(mode ``source``, "Inside each source") it is ``<source>/thumbnails``, exactly
-the folder every caller joined by hand before, so nothing moves.
-
-Writes and the switch: every preview writer takes ``write_guard`` when it
-starts (it records the location's ``generation``); the final rename runs
-under ``write_lock`` and only when the generation is unchanged and no hold
-applies (``thumbnail_encode.replace_unless_held``). Changing the location
-bumps the generation under the same lock, so no write that began before can
-land in the old store afterwards. Nothing reads or commits config while
-``write_lock`` is held. The hold check runs under it too, so hold checks take
-no lock (the job registry's ``running()`` is a lock-free snapshot) and
-``bump_generation`` is never called with a registry or config lock held.
-
-All functions are blocking: call them off the event loop.
-"""
-
-import errno
-import logging
-import os
-import threading
-import time
-from contextlib import contextmanager
-from dataclasses import dataclass, replace
-from pathlib import Path
-
-from . import preview_location, thumbnail_settings
-
-try:
-    from ...utils.media_folders import PREVIEW_FOLDER
-except ImportError:  # tests import the package top-level
-    from utils.media_folders import PREVIEW_FOLDER
-
-logger = logging.getLogger("prompt_manager.thumbnails")
-
-SOURCE_MODE = preview_location.SOURCE_MODE
-FOLDER_MODE = preview_location.FOLDER_MODE
-# The probe checks the folder this often, and a check (or a store call)
-# taking longer than the budget marks it unreachable.
-PROBE_INTERVAL = 5.0
-IO_BUDGET = 2.0
-PROBE_THREAD = "pm-preview-probe"
-
-
-@dataclass(frozen=True)
-class Location:
-    """One snapshot of the thumbnail location (take one per request or job)."""
-
-    mode: str = SOURCE_MODE
-    path: str | None = None
-    available: bool = True
-    problem: str | None = None
-    generation: int = 0
-
-
-write_lock = threading.Lock()
-_generation = 0
-# The runtime location: the parsed setting, availability and the marker keys
-# last read. Swapped as a whole; readers take one snapshot.
-_state_lock = threading.Lock()
-_parsed = preview_location.ParsedLocation()
-_available = True
-_problem = None
-# The newest check whose answer was published.
-_published_order = 0
-_keys = {}
-_key_cache = {}
-_clock = time.monotonic
-
-
-def current():
-    """The thumbnail location now."""
-    with _state_lock:
-        parsed, available, problem, generation_now = (
-            _parsed,
-            _available,
-            _problem,
-            _generation,
-        )
-    if parsed.mode == SOURCE_MODE:
-        return Location(generation=generation_now)
-    return Location(FOLDER_MODE, parsed.path, available, problem, generation_now)
-
-
-def setting():
-    """The parsed setting in use (``preview_location.ParsedLocation``)."""
-    return _parsed
-
-
-def generation():
-    return _generation
-
-
-def bump_generation():
-    """Invalidate every write that started before (under ``write_lock``)."""
-    global _generation
-    with write_lock:
-        _generation += 1
-        return _generation
-
-
-def _canonical(path):
-    """Resolved and case-folded, so paths compare on every OS."""
-    return Path(os.path.normcase(os.path.realpath(str(path))))
-
-
-def _within(path, folder):
-    return _canonical(path).is_relative_to(_canonical(folder))
-
-
-# ── the setting and availability ─────────────────────────────────────
-
-
-def configure(value, *, context=None, check=True):
-    """Use the ``thumbnails.location`` *value* (config.json) from now on.
-
-    A folder location is validated against *context* (``startup`` rules: a
-    problem other than an unreachable folder makes it ``invalid``), then
-    checked once; the probe keeps checking it. Swapped under ``write_lock``
-    with a generation bump, so no write that started before lands.
-    """
-    global _parsed, _available, _problem, _generation
-    parsed = preview_location.parse_location(value)
-    problem = parsed.problem
-    if parsed.mode == FOLDER_MODE and problem is None and context is not None:
-        code = preview_location.location_problem(
-            parsed.path, purpose="startup", context=context
-        )
-        if code == "location-unavailable":
-            problem = "unreachable"
-        elif code is not None:
-            problem = "invalid"
-            parsed = preview_location.ParsedLocation(
-                mode=FOLDER_MODE,
-                path=parsed.path,
-                id=parsed.id,
-                install=parsed.install,
-                cleanup=parsed.cleanup,
-                problem="invalid",
-            )
-    with write_lock:
-        with _state_lock:
-            _parsed = parsed
-            _available = parsed.mode == SOURCE_MODE
-            _problem = problem if parsed.mode == FOLDER_MODE else None
-            _keys.clear()
-            _key_cache.clear()
-        _generation += 1
-    if parsed.mode == FOLDER_MODE:
-        if check and parsed.problem is None:
-            refresh()
-        _probe.start()
-    else:
-        _probe.stop()
-    return current()
-
-
-def refresh():
-    """Check the folder now (bounded by IO_BUDGET); returns availability."""
-    parsed = _parsed
-    if parsed.mode != FOLDER_MODE or parsed.problem is not None:
-        return parsed.mode == SOURCE_MODE
-    try:
-        (available, problem, marker), order = _probe.ordered_check(
-            parsed.path, parsed.id
-        )
-    except (OSError, TimeoutError, RuntimeError):
-        available, problem, marker = False, "unreachable", None
-        order = _probe.latest_order()
-    _set_state(parsed, available, problem, marker, order)
-    return available
-
-
-def _set_keys(parsed, marker):
-    """Take the keys of a marker just written (availability unchanged)."""
-    with _state_lock:
-        if _parsed is not parsed:
-            return
-        keys = dict((marker or {}).get("keys") or {})
-        if keys != _keys:
-            _keys.clear()
-            _keys.update(keys)
-            _key_cache.clear()
-
-
-def set_cleanup(entries):
-    """The setting's ``cleanup`` after a removal was committed."""
-    global _parsed
-    with _state_lock:
-        _parsed = replace(_parsed, cleanup=tuple(entries))
-
-
-def mark_invalid():
-    """The setting cannot be used (a startup check that failed): folder
-    mode stays in force, unavailable, so nothing is written anywhere."""
-    global _parsed, _available, _problem
-    with _state_lock:
-        if _parsed.mode != FOLDER_MODE:
-            _parsed = preview_location.ParsedLocation(
-                mode=FOLDER_MODE, problem="invalid"
-            )
-        else:
-            _parsed = replace(_parsed, problem="invalid")
-        _available, _problem = False, "invalid"
-
-
-def _set_state(parsed, available, problem, marker, order):
-    """Publish a check's answer, unless a check that started later already
-    published (two callers can finish out of order, #611)."""
-    global _available, _problem, _published_order
-    with _state_lock:
-        if _parsed is not parsed:
-            return  # the setting changed meanwhile
-        if order < _published_order:
-            return
-        _published_order = order
-        _available, _problem = available, problem
-        keys = dict((marker or {}).get("keys") or {})
-        if keys != _keys:
-            _keys.clear()
-            _keys.update(keys)
-            _key_cache.clear()
-
-
-def note_failure():
-    """A store call failed or stalled: unreachable until the probe finds the
-    folder again (requests do no store I/O meanwhile)."""
-    global _available, _problem
-    if _parsed.mode != FOLDER_MODE:
-        return
-    with _state_lock:
-        _available, _problem = False, "unreachable"
-    _probe.wake()
-
-
-@contextmanager
-def store_io():
-    """Around a store call in folder mode: an I/O error (other than a file
-    that is not there) or a call over IO_BUDGET marks the folder
-    unreachable."""
-    if _parsed.mode != FOLDER_MODE:
-        yield
-        return
-    started = _clock()
-    try:
-        yield
-    except OSError as error:
-        if not isinstance(error, (FileNotFoundError, NotADirectoryError)):
-            note_failure()
-        raise
-    finally:
-        if _clock() - started > IO_BUDGET:
-            note_failure()
-
-
-class _Probe:
-    """The background check of the thumbnail folder (one thread, one check
-    at a time; a stuck check is left to finish on its own thread)."""
-
-    def __init__(self):
-        self._lock = threading.Lock()
-        self._wake = threading.Event()
-        self._stop = threading.Event()
-        self._thread = None
-        self._checking = None
-        self._order = 0
-
-    def check(self, path, expected_id):
-        """``folder_state`` within IO_BUDGET; see :meth:`ordered_check`."""
-        return self.ordered_check(path, expected_id)[0]
-
-    def latest_order(self):
-        """The order number of the check started last."""
-        with self._lock:
-            return self._order
-
-    def ordered_check(self, path, expected_id):
-        """``(folder_state, order)`` within IO_BUDGET; raises TimeoutError.
-
-        ``order`` grows with each check started, so answers can be published
-        in the order they looked. The answer comes from a check that started
-        after this call: one already running may have looked before what the
-        caller just did, so it is waited for (never run twice at once; a stuck
-        one times out here) and followed by a new one."""
-        key = (path, expected_id)
-        with self._lock:
-            earlier = self._running(key)
-            pending = None if earlier else self._start_check(path, expected_id)
-        if earlier:
-            self._wait(earlier)
-            with self._lock:
-                # One another caller started meanwhile is new enough to join.
-                pending = self._running(key) or self._start_check(path, expected_id)
-        self._wait(pending)
-        with self._lock:
-            if self._checking is pending:
-                self._checking = None
-        if "error" in pending[2]:
-            raise pending[2]["error"]
-        return pending[2]["value"], pending[2]["order"]
-
-    def _running(self, key):
-        """The check of *key* still running (lock held), else None."""
-        pending = self._checking
-        if pending is None or pending[0] != key or pending[1].is_set():
-            return None
-        return pending
-
-    @staticmethod
-    def _wait(pending):
-        if not pending[1].wait(IO_BUDGET):
-            raise TimeoutError("the thumbnail folder did not answer in time")
-
-    def _start_check(self, path, expected_id):
-        """Start one check on its own thread (lock held)."""
-        self._order += 1
-        result = {"order": self._order}
-        done = threading.Event()
-
-        def run():
-            try:
-                result["value"] = preview_location.folder_state(path, expected_id)
-            except BaseException as error:  # check() re-raises it in the caller
-                result["error"] = error
-            finally:
-                done.set()
-
-        pending = ((path, expected_id), done, result)
-        self._checking = pending
-        threading.Thread(target=run, name=PROBE_THREAD + "-check", daemon=True).start()
-        return pending
-
-    def start(self):
-        with self._lock:
-            if self._thread is not None and self._thread.is_alive():
-                return
-            # Each thread has its own stop: a stopped one never resumes.
-            stop = self._stop = threading.Event()
-            thread = threading.Thread(
-                target=self._run, args=(stop,), name=PROBE_THREAD, daemon=True
-            )
-            try:
-                thread.start()
-            except RuntimeError:
-                return  # refused at interpreter exit: no probe
-            self._thread = thread
-
-    def _run(self, stop):
-        while not stop.is_set():
-            self._wake.wait(PROBE_INTERVAL)
-            self._wake.clear()
-            if stop.is_set():
-                return
-            try:
-                refresh()
-            except Exception:  # one failed check never stops the probe
-                logger.debug("Thumbnail folder check failed", exc_info=True)
-
-    def wake(self):
-        self._wake.set()
-
-    def stop(self, timeout=2.0):
-        """Stop the probe; True when its thread ended."""
-        with self._lock:
-            thread, self._thread = self._thread, None
-        self._stop.set()
-        self._wake.set()
-        if thread is None or thread is threading.current_thread():
-            return True
-        thread.join(timeout)
-        return not thread.is_alive()
-
-
-_probe = _Probe()
-
-
-def stop_probe(timeout=2.0):
-    """Stop the folder probe (the package teardown, tests)."""
-    return _probe.stop(timeout)
-
-
-# ── stores ───────────────────────────────────────────────────────────
-
-
-def source_folder(root):
-    """``<source>/thumbnails``: the store in source mode, a leftover in
-    folder mode."""
-    return Path(root) / PREVIEW_FOLDER
-
-
-def store_container(root, location=None):
-    """The folder a store of *root* must stay inside: the source itself, or
-    the thumbnail folder in folder mode."""
-    location = location or current()
-    if location.mode == FOLDER_MODE:
-        return Path(location.path) if location.path else None
-    return Path(root)
-
-
-def _identity(root):
-    return os.path.normcase(os.path.realpath(str(root)))
-
-
-def _lookup_key(root):
-    spelling = str(root)
-    with _state_lock:
-        if spelling in _key_cache:
-            return _key_cache[spelling]
-        keys = dict(_keys)
-    key = preview_location.find_key(
-        keys,
-        spelling,
-        _identity(root),
-        preview_location.file_identity(root),
-    )
-    if key is not None:
-        with _state_lock:
-            _key_cache[spelling] = key
-    return key
-
-
-def store_dir(root, location=None):
-    """The store of *root*: ``<source>/thumbnails``, or in folder mode
-    ``<folder>/<key>`` (None while the folder is unavailable or before the
-    source has a key: a reader then finds no preview)."""
-    location = location or current()
-    if location.mode == SOURCE_MODE:
-        return Path(root) / PREVIEW_FOLDER
-    if not location.available or not location.path:
-        return None
-    key = _lookup_key(root)
-    return None if key is None else _key_folder(location.path, key)
-
-
-def _key_folder(folder, key):
-    """``<folder>/<key>``, only for a key that is one folder name directly
-    below the thumbnail folder (a marker is data, never a path)."""
-    if not preview_location.valid_key(key):
-        return None
-    store = Path(folder) / key
-    if store.parent != Path(folder) or store.name != key:
-        return None
-    return store
-
-
-def ensure_store(root, location=None, *, create=False):
-    """``store_dir`` for a writer: in folder mode a source without a key gets
-    one (recorded in the marker); with *create* its key folder is made (never
-    the thumbnail folder itself). None while the folder is unavailable, and
-    for a key folder that is a link, junction or reparse point: nothing is
-    planned, written or removed through it."""
-    location = location or current()
-    store = store_dir(root, location)
-    if location.mode == SOURCE_MODE or (store is None and not location.available):
-        return store
-    if store is None:
-        store = _assign_key(root, location)
-        if store is None:
-            return None
-    try:
-        with store_io():
-            linked = preview_location.is_link_like(store)
-    except OSError:
-        return None
-    if linked:
-        logger.warning(f"Skipping the thumbnail folder {store}: it is a link")
-        return None
-    if create:
-        try:
-            with store_io():
-                os.mkdir(store)
-        except FileExistsError:
-            pass  # already there: another writer made the key folder
-        except OSError:
-            return None
-    return store
-
-
-def _assign_key(root, location):
-    parsed = _parsed
-    if location.path != parsed.path:
-        return None
-    spelling = str(root)
-    identity = _identity(root)
-    dev_ino = preview_location.file_identity(root)
-    assigned = {}
-
-    def add(marker):
-        if marker.get("id") != parsed.id:
-            raise ValueError("another folder's marker")  # marker-mismatch
-        keys = marker["keys"]
-        key = preview_location.find_key(keys, spelling, identity, dev_ino)
-        if key is None:
-            taken = {k: v.get("identity") for k, v in keys.items()}
-            key = preview_location.source_key(spelling, identity, taken)
-            keys[key] = {
-                "path": spelling,
-                "identity": identity,
-                "dev_ino": dev_ino,
-                "install": parsed.install,
-            }
-        assigned["key"] = key
-
-    try:
-        with write_lock, store_io():
-            marker = preview_location.write_marker(location.path, add)
-    except (OSError, ValueError):
-        return None
-    _set_keys(parsed, marker)
-    return _key_folder(location.path, assigned["key"])
-
-
-def may_write(path, location=None):
-    """The one ownership check every preview write and delete passes.
-
-    Source mode: True (the callers' own root rules apply, as before). Folder
-    mode: *path* lies below a source key folder of the thumbnail folder,
-    lexically and resolved, and no link, junction or reparse point sits
-    anywhere from the key folder down to it (the file itself included).
-    """
-    location = location or current()
-    if location.mode == SOURCE_MODE:
-        return True
-    if not location.path:
-        return False
-    folder = Path(os.path.abspath(location.path))
-    path = Path(os.path.abspath(path))
-    try:
-        relative = path.relative_to(folder)
-    except ValueError:
-        return False
-    if len(relative.parts) < 2 or ".." in relative.parts:
-        return False
-    store = _key_folder(folder, relative.parts[0])
-    if store is None or not _within(path, folder):
-        return False
-    try:
-        return _no_link_below(store, path)
-    except OSError:
-        note_failure()
-        return False
-
-
-def make_parent(dst, location=None):
-    """Make the folders a preview *dst* is written into. In folder mode only
-    folders below the thumbnail folder are made, never the folder itself,
-    and only while it holds this install's marker (an unplugged drive or an
-    unmounted mount point raises FileNotFoundError); a *dst* that does not
-    pass ``may_write`` raises PermissionError."""
-    location = location or current()
-    dst = Path(dst)
-    if location.mode == SOURCE_MODE or not location.path:
-        if location.mode != SOURCE_MODE:
-            raise FileNotFoundError(errno.ENOENT, "thumbnail folder unavailable")
-        dst.parent.mkdir(parents=True, exist_ok=True)
-        return
-    folder = Path(os.path.abspath(location.path))
-    with store_io():
-        if not location.available or not folder.is_dir():
-            raise FileNotFoundError(errno.ENOENT, "thumbnail folder unavailable")
-        marker = preview_location.read_marker(str(folder))
-        if marker is None or marker.get("id") != _parsed.id:
-            note_failure()
-            raise FileNotFoundError(errno.ENOENT, "thumbnail folder unavailable")
-        if not may_write(dst, location):
-            raise PermissionError(errno.EACCES, "outside the thumbnail folder")
-        current_folder = folder
-        for part in Path(os.path.abspath(dst.parent)).relative_to(folder).parts:
-            current_folder = current_folder / part
-            try:
-                os.mkdir(current_folder)
-            except FileExistsError:
-                pass  # already there: another writer made this folder
-            if preview_location.is_link_like(current_folder):
-                raise PermissionError(errno.EACCES, "a link in the thumbnail folder")
-
-
-def store_is_link(store, location=None):
-    """Whether a store folder is a link (a junction or reparse point too in
-    folder mode): it is skipped by sweeps and refused by clears."""
-    location = location or current()
-    if location.mode == SOURCE_MODE:
-        return Path(store).is_symlink()
-    return preview_location.is_link_like(store)
-
-
-def given_store(root, store):
-    """A caller's explicit store argument: the default spelling
-    (``<root>/thumbnails``) means the resolver's store; another folder (only
-    tests pass one) is used as given."""
-    store = Path(store)
-    if store == Path(root) / PREVIEW_FOLDER:
-        return store_dir(root)
-    return store
-
-
-def preview_path(root, media_rel, ext=None, location=None, *, create=False):
-    """Where the preview of *media_rel* (relative to *root*) is, or is to be
-    written (*create*: a writer, which gives a new source its key), in *ext*
-    (the extension written now when None)."""
-    if create:
-        store = ensure_store(root, location)
-    else:
-        store = store_dir(root, location)
-    if store is None:
-        return None
-    if ext is None:
-        from .thumbnail_encode import writer_settings
-
-        ext = writer_settings().extension
-    return store / (thumbnail_settings.preview_stem(media_rel) + ext)
-
-
-def request_path(root, parts, location=None):
-    """The disk path of the URL parts ``("thumbnails", ...)``, or None when
-    *parts* is not under an exact ``thumbnails`` first part or the store has
-    no place for it. The text is checked before (``is_preview_text``)."""
-    parts = tuple(parts)
-    if len(parts) < 2 or parts[0] != PREVIEW_FOLDER:
-        return None
-    store = store_dir(root, location)
-    if store is None:
-        return None
-    return store.joinpath(*parts[1:])
-
-
-def _no_link_below(store, path):
-    """No folder from *store* down to *path* (and *store* itself) is a link,
-    junction or reparse point (lexical walk, one lstat each)."""
-    store = Path(os.path.abspath(store))
-    path = Path(os.path.abspath(path))
-    try:
-        relative = path.relative_to(store)
-    except ValueError:
-        return False
-    current = store
-    for part in ("",) + relative.parts:
-        current = current / part if part else current
-        if preview_location.is_link_like(current):
-            return False
-    return True
-
-
-def owns(root, path, location=None):
-    """Whether *path* lies inside the store of *root*, resolved: the store
-    stays inside its container and no link takes *path* out of the store.
-    In folder mode no link, junction or reparse point may sit anywhere from
-    the store down to *path*."""
-    location = location or current()
-    store = store_dir(root, location)
-    if store is None:
-        return False
-    container = store_container(root, location)
-    if not (_within(store, container) and _within(path, store)):
-        return False
-    if location.mode == SOURCE_MODE:
-        return True
-    return may_write(path, location)
-
-
-# ── preview text ─────────────────────────────────────────────────────
-
-
-def is_preview_text(filepath):
-    """URL text naming a preview: ``thumbnails/<...>/<name>_thumb<ext>``.
-
-    Text only, before any join: no backslash, drive or stream colon, and no
-    empty, ``.`` or ``..`` segment; ``thumbnails`` exactly as the first part
-    and nowhere else among the folders; the extension, in any case, one a
-    preview may carry (``X_thumb.JPG`` of an older release included).
-    """
-    if not filepath or "\\" in filepath or ":" in filepath:
-        return False
-    parts = filepath.split("/")
-    if len(parts) < 2 or parts[0] != PREVIEW_FOLDER:
-        return False
-    if any(part in ("", ".", "..") for part in parts):
-        return False
-    if PREVIEW_FOLDER in parts[1:-1]:
-        return False
-    stem, extension = os.path.splitext(parts[-1])
-    return (
-        stem.endswith(thumbnail_settings.THUMB_SUFFIX)
-        and len(stem) > len(thumbnail_settings.THUMB_SUFFIX)
-        and extension.lower() in thumbnail_settings.THUMBNAIL_EXTENSIONS
-    )
-
-
-# ── writes ───────────────────────────────────────────────────────────
-
-
-class _WriteGuard:
-    """``guard()`` for one preview write: true while the location has not
-    changed since the write started and *hold* (if any) allows it."""
-
-    __slots__ = ("generation", "_hold")
-
-    def __init__(self, hold=None):
-        self.generation = _generation
-        self._hold = hold
-
-    def __call__(self):
-        if self.generation != _generation:
-            return False
-        return self._hold is None or bool(self._hold())
-
-
-def write_guard(hold=None):
-    """Take when a preview write starts; hand to its final rename."""
-    if isinstance(hold, _WriteGuard):
-        return hold
-    return _WriteGuard(hold)
-
-
-@contextmanager
-def committed(guard=None):
-    """Around a preview's final rename: holds ``write_lock`` and yields
-    whether the write may land (``guard()``, re-checked under the lock)."""
-    with write_lock:
-        yield guard is None or bool(guard())

py/api/revalidation.py

@@ -1,47 +0,0 @@
-"""Revalidated responses for the pages and static files PromptManager serves.
-
-``Cache-Control: no-cache`` lets the browser keep a copy but makes it ask the
-server before every reuse, so a PromptManager update reaches the browser on a
-normal reload (#478). The ETag lets an unchanged file answer 304 without a
-body, which keeps that reload cheap.
-
-The tag hashes the bytes rather than the file's mtime and size: an update can
-keep both (an archive extract, a same-length edit within one clock tick), and
-the handlers read the whole file anyway. It is weak because the gzip
-middleware may send the same content in a different encoding.
-"""
-
-import hashlib
-
-from aiohttp import web
-
-REVALIDATE = "no-cache"
-
-
-def entity_tag(body: bytes) -> str:
-    """Weak ETag for ``body``."""
-    return f'W/"{hashlib.sha256(body).hexdigest()[:32]}"'
-
-
-def etag_matches(if_none_match, etag: str) -> bool:
-    """True when an If-None-Match header names ``etag`` (weak comparison)."""
-    if not if_none_match:
-        return False
-    if if_none_match.strip() == "*":
-        return True
-    opaque = etag.removeprefix("W/")
-    return any(
-        candidate.strip().removeprefix("W/") == opaque
-        for candidate in if_none_match.split(",")
-    )
-
-
-def revalidated_response(request, body: bytes, content_type: str, charset=None):
-    """200 with ``body``, or 304 when the request already holds this version."""
-    etag = entity_tag(body)
-    headers = {"Cache-Control": REVALIDATE, "ETag": etag}
-    if etag_matches(request.headers.get("If-None-Match"), etag):
-        return web.Response(status=304, headers=headers)
-    return web.Response(
-        body=body, content_type=content_type, charset=charset, headers=headers
-    )

py/api/review.py

@@ -9,10 +9,7 @@ candidates and the dependency fingerprint. ``POST .../items/{id}/decision``
 records one explicit decision: Apply links the chosen sampler's pair only
 when the capture is the item's bytes, the current file still hashes to them,
 the evidence they yield is unchanged and the ingester's compatible-only rules
-allow it; Leave unresolved links nothing. ``POST .../items/{id}/link`` (#536)
-links a Library prompt the reviewer chose, under the same capture and
-compatibility guards; it is their choice, so what the bytes resolve to is not
-asked.
+allow it; Leave unresolved links nothing.
 
 Targets are formatted from the recorded spelling against the current roots
 (no file access beyond the roots' real paths); a file under no current root
@@ -31,13 +28,12 @@ import urllib.parse
 
 from aiohttp import web
 
-from .annotations import _capture_error, _error
+from .annotations import _HEX64, _TOKEN, _UUID, _capture_error, _error
 from .images import media_thumbnail_url
 from .inspection_service import VIDEO_EXTENSIONS
 from .job_routes import busy_response
 from .jobs import JobBusy
 from .prompts import bad_request
-from .review_guards import UNRESOLVED, _decision_guards, _link_guards
 
 try:
     from ...database.library import display_title
@@ -63,6 +59,17 @@ MAX_CURSOR = 4096
 MAX_BODY_BYTES = 64 * 1024
 # The serialized detail stays under this; past it the detail is ``limited``.
 MAX_DETAIL_BYTES = 8 * 1024 * 1024
+UNRESOLVED = "unresolved"
+_DECISION_FIELDS = frozenset(
+    {
+        "expected_epoch",
+        "expected_revision",
+        "capture_token",
+        "sha256",
+        "dependency_fingerprint",
+        "choice",
+    }
+)
 _CURSOR_SECRET = os.urandom(32)
 # The real path of a spelling; module-level so a test can fake a junction.
 _realpath = os.path.realpath
@@ -77,7 +84,6 @@ _STATUS = {
     "storage-changed": 409,
     "source-changed": 409,
     "capture-expired": 409,
-    "prompt-missing": 409,
 }
 _MESSAGES = {
     "review-missing": "This review item no longer exists. Reload the queue.",
@@ -89,9 +95,6 @@ _MESSAGES = {
         "sampler path cannot be attached safely. The existing links were "
         "preserved."
     ),
-    "prompt-missing": (
-        "That prompt or recipe is no longer in the Library. Search again."
-    ),
     "dependencies-changed": (
         "The image's saved links changed since this item was opened. Reopen it "
         "to see the current association."
@@ -248,7 +251,6 @@ class ReviewRoutesMixin:
         routes.get(ITEMS_URL)(self.list_review_items)
         routes.get(ITEMS_URL + "/{item_id}")(self.get_review_item)
         routes.post(ITEMS_URL + "/{item_id}/decision")(self.decide_review_item)
-        routes.post(ITEMS_URL + "/{item_id}/link")(self.link_review_item)
 
     # -- shared ----------------------------------------------------------------
 
@@ -462,43 +464,6 @@ class ReviewRoutesMixin:
         except JobBusy as busy:
             return busy_response(busy)
 
-    async def link_review_item(self, request: web.Request) -> web.Response:
-        """POST the Library prompt the reviewer chose for one pending item.
-
-        Under the same lease as a decision. The capture must be the item's
-        current bytes; the choice and the file's links are checked in the
-        decision's transaction.
-        """
-        try:
-            async with self._jobs.lease(REVIEW_DECISION_LEASE):
-                return await self._link_review_item(request)
-        except JobBusy as busy:
-            return busy_response(busy)
-
-    async def _link_review_item(self, request: web.Request) -> web.Response:
-        data, error = await self._read_json_body(request, max_bytes=MAX_BODY_BYTES)
-        if error is not None:
-            return error
-        guards, error = _link_guards(data)
-        if error is not None:
-            return error
-        try:
-            item = await self._run_in_executor(
-                self.db.review_item, request.match_info["item_id"]
-            )
-        except Exception:
-            self.logger.exception("Review item read failed")
-            return _failed()
-        if item is None:
-            return _coded("review-missing")
-        verified, error = await self._verified_review_capture(
-            item, guards, need_metadata=True
-        )
-        if error is not None:
-            return error
-        manual = {"positive_id": guards["positive_id"], "pair_id": guards["pair_id"]}
-        return await self._record_decision(item, guards, None, verified, manual)
-
     async def _decide_review_item(self, request: web.Request) -> web.Response:
         data, error = await self._read_json_body(request, max_bytes=MAX_BODY_BYTES)
         if error is not None:
@@ -584,25 +549,22 @@ class ReviewRoutesMixin:
             return None, _coded("file-changed")
         metadata = None
         if need_metadata:
-            # A manual link has no ``choice``: it rests on the bytes alone.
-            if captured is None or (
-                "choice" in guards
-                and not _candidate_still_offered(captured[1], guards["choice"])
+            if captured is None or not _candidate_still_offered(
+                captured[1], guards["choice"]
             ):
                 return None, _coded("review-conflict", "evidence-changed")
             metadata = captured[0]
         image_path = os.path.join(str(root), *relative.split("/"))
         return (capture, facts, image_path, metadata), None
 
-    def _decide_sync(self, item, guards, candidate, verified, manual=None):
+    def _decide_sync(self, item, guards, candidate, verified):
         """Worker thread: resolve the file's spellings, decide, build the view.
 
         Returns ``(result, view)``; a refusal raises with ``exc.view`` set.
         """
         _capture, facts, image_path, metadata = verified or (None, None, None, None)
         aliases, known = (), None
-        selected = candidate is not None or manual is not None
-        if selected:
+        if candidate is not None:
             aliases, known = physical_spellings(self.db, image_path, item["locator"])
         try:
             result = self.db.decide_review_item(
@@ -611,9 +573,8 @@ class ReviewRoutesMixin:
                 expected_revision=guards["expected_revision"],
                 # The bytes the re-hash proved, or the body's for Leave unresolved.
                 sha256=facts.sha256 if facts is not None else guards["sha256"],
-                outcome="selected" if selected else UNRESOLVED,
+                outcome="selected" if candidate is not None else UNRESOLVED,
                 candidate=candidate,
-                manual=manual,
                 image_path=image_path,
                 metadata=metadata,
                 expected_fingerprint=guards["dependency_fingerprint"],
@@ -628,11 +589,11 @@ class ReviewRoutesMixin:
         roots, real_roots = self._review_roots()
         return result, self._review_view(result["item"], roots, real_roots)
 
-    async def _record_decision(self, item, guards, candidate, verified, manual=None):
+    async def _record_decision(self, item, guards, candidate, verified):
         capture = verified[0] if verified else None
         try:
             result, view = await self._run_in_executor(
-                self._decide_sync, item, guards, candidate, verified, manual
+                self._decide_sync, item, guards, candidate, verified
             )
         except ReviewCommandError as exc:
             return self._decision_refused(exc)
@@ -668,6 +629,36 @@ class ReviewRoutesMixin:
         return _coded(exc.code, message, **extra)
 
 
+def _decision_guards(data: dict):
+    """The validated decision fields, or ``(None, error)``."""
+    if set(data) != _DECISION_FIELDS:
+        return None, bad_request(
+            "Request must contain exactly " + ", ".join(sorted(_DECISION_FIELDS))
+        )
+    epoch, revision = data["expected_epoch"], data["expected_revision"]
+    if not isinstance(epoch, str) or _UUID.fullmatch(epoch) is None:
+        return None, bad_request("expected_epoch must be a canonical UUID")
+    if type(revision) is not int or revision < 0:
+        return None, bad_request("expected_revision must be a non-negative integer")
+    token = data["capture_token"]
+    if token is not None and (
+        not isinstance(token, str) or _TOKEN.fullmatch(token) is None
+    ):
+        return None, bad_request("Invalid capture token")
+    for name in ("sha256", "dependency_fingerprint"):
+        value = data[name]
+        if not isinstance(value, str) or _HEX64.fullmatch(value) is None:
+            return None, bad_request(
+                f"{name} must be 64 lowercase hexadecimal characters"
+            )
+    choice = data["choice"]
+    if not isinstance(choice, str) or (
+        choice != UNRESOLVED and _HEX64.fullmatch(choice) is None
+    ):
+        return None, bad_request("choice must be a candidate hash or unresolved")
+    return {**data}, None
+
+
 def _verify_and_read(store, capture, item, root, need_metadata: bool):
     """Worker thread: ``(relative, facts, captured)``, or None off the root.
 

py/api/review_guards.py

@@ -1,66 +0,0 @@
-"""Body validation of Needs review decisions and manual links (#249 E3, #536)."""
-
-from .annotations import _HEX64, _TOKEN, _UUID
-from .prompts import bad_request
-
-UNRESOLVED = "unresolved"
-_GUARD_FIELDS = frozenset(
-    {
-        "expected_epoch",
-        "expected_revision",
-        "capture_token",
-        "sha256",
-        "dependency_fingerprint",
-    }
-)
-_DECISION_FIELDS = _GUARD_FIELDS | {"choice"}
-_LINK_FIELDS = _GUARD_FIELDS | {"positive_id", "pair_id"}
-
-
-def _guard_error(data: dict, fields: frozenset):
-    """The first problem with a decision's shared fields, as a response."""
-    if set(data) != fields:
-        return bad_request("Request must contain exactly " + ", ".join(sorted(fields)))
-    epoch, revision = data["expected_epoch"], data["expected_revision"]
-    if not isinstance(epoch, str) or _UUID.fullmatch(epoch) is None:
-        return bad_request("expected_epoch must be a canonical UUID")
-    if type(revision) is not int or revision < 0:
-        return bad_request("expected_revision must be a non-negative integer")
-    token = data["capture_token"]
-    if token is not None and (
-        not isinstance(token, str) or _TOKEN.fullmatch(token) is None
-    ):
-        return bad_request("Invalid capture token")
-    for name in ("sha256", "dependency_fingerprint"):
-        value = data[name]
-        if not isinstance(value, str) or _HEX64.fullmatch(value) is None:
-            return bad_request(f"{name} must be 64 lowercase hexadecimal characters")
-    return None
-
-
-def _decision_guards(data: dict):
-    """The validated decision fields, or ``(None, error)``."""
-    error = _guard_error(data, _DECISION_FIELDS)
-    if error is not None:
-        return None, error
-    choice = data["choice"]
-    if not isinstance(choice, str) or (
-        choice != UNRESOLVED and _HEX64.fullmatch(choice) is None
-    ):
-        return None, bad_request("choice must be a candidate hash or unresolved")
-    return {**data}, None
-
-
-def _link_guards(data: dict):
-    """The validated manual link fields, or ``(None, error)``."""
-    error = _guard_error(data, _LINK_FIELDS)
-    if error is not None:
-        return None, error
-    if data["capture_token"] is None:
-        return None, bad_request("A link needs a capture of the file")
-    positive, pair = data["positive_id"], data["pair_id"]
-    if type(positive) is not int or positive < 1:
-        return None, bad_request("positive_id must be a positive integer")
-    if pair is not None and (type(pair) is not int or pair < 1):
-        return None, bad_request("pair_id must be a positive integer or null")
-    return {**data}, None

py/api/settings_routes.py

@@ -30,7 +30,6 @@ from . import thumbnail_settings
 from .admin import _current_image_monitor
 from .job_routes import busy_response
 from .jobs import THUMBNAILS_JOB_KIND, JobBusy
-from .thumbnail_location import needs_move_response
 
 try:
     from ...utils.validators import validate_result_timeout, validate_worker_threads
@@ -55,25 +54,9 @@ _SETTINGS_FILE_KEYS = {
     "AUTOTAG_EXISTING": ("autotag", "defaults", "existing"),
     "AUTOTAG_GENERAL_THRESHOLD": ("autotag", "defaults", "general_threshold"),
     "AUTOTAG_CHARACTER_THRESHOLD": ("autotag", "defaults", "character_threshold"),
+    "AUTOTAG_TEMPLATE": ("autotag", "defaults", "template"),
     "AUTOTAG_SUGGESTION_LIMIT": ("autotag", "defaults", "suggestion_limit"),
-    "AUTOTAG_SKIPPED_TAGS": ("autotag", "defaults", "skipped_tags"),
-    # #431: the saved instructions and each engine's default, always written
-    # together (server-side pairing).
-    "AUTOTAG_INSTRUCTIONS": ("autotag", "defaults", "instructions"),
-    "AUTOTAG_DEFAULT_INSTRUCTIONS": ("autotag", "defaults", "default_instructions"),
 }
-# The old single template: written only as the GGUF default's mirror for a
-# downgrade (#431 B1.1), deleted when that default is Built-in.
-_TEMPLATE_MIRROR_KEY = ("autotag", "defaults", "template")
-TEMPLATE_REPLACED_ERROR = (
-    "LLM tag template was replaced by Saved instructions. Reload the page."
-)
-# Whole-list settings (#431): a save without ``expected_revision`` would merge
-# a stale copy over a list changed elsewhere, so it is refused.
-_REVISION_REQUIRED = frozenset(
-    {"autotag_skipped_tags", "autotag_instructions", "autotag_default_instructions"}
-)
-REVISION_REQUIRED_ERROR = "Reload the page and try again."
 # The thumbnail settings a running Convert outdated job fixes (#317).
 _THUMBNAIL_SETTINGS = ("THUMBNAIL_FORMAT", "THUMBNAIL_QUALITY", "THUMBNAIL_EDGE")
 # Attributes that live on GalleryConfig; the others on PromptManagerConfig.
@@ -154,20 +137,13 @@ def _settings_mutation(updates, new_roots):
     """The config commit for a settings save: only the submitted keys change.
 
     Every other section and key (integrations and the CivitAI key, database,
-    unknown sections) is kept as it is on disk. A save of the instructions
-    also writes the old ``template`` key as the GGUF default's mirror.
+    unknown sections) is kept as it is on disk.
     """
 
     def mutate(config):
         for name, value in updates.items():
             *sections, key = _SETTINGS_FILE_KEYS[name]
-            _set_nested(config, sections, key, _jsonable(value))
-        if "AUTOTAG_INSTRUCTIONS" in updates:
-            *sections, key = _TEMPLATE_MIRROR_KEY
-            mirror = _mirror_text(
-                updates["AUTOTAG_INSTRUCTIONS"], updates["AUTOTAG_DEFAULT_INSTRUCTIONS"]
-            )
-            _set_nested(config, sections, key, _DELETE if mirror is None else mirror)
+            _set_nested(config, sections, key, value)
         if new_roots is not None:
             gallery = _section(config, "gallery")
             monitoring = _section(gallery, "monitoring")
@@ -179,37 +155,10 @@ def _settings_mutation(updates, new_roots):
     return mutate
 
 
-# ``_set_nested``'s value that removes the key instead of setting it.
-_DELETE = object()
-
-
-def _jsonable(value):
-    """A runtime value as config.json holds it (tuples become lists)."""
-    if isinstance(value, (list, tuple)):
-        return [_jsonable(item) for item in value]
-    if isinstance(value, dict):
-        return {key: _jsonable(item) for key, item in value.items()}
-    return value
-
-
-def _mirror_text(entries, defaults):
-    """The GGUF default's text, or None when it is Built-in (#431 B1.1)."""
-    from ..tagging_defaults import BUILTIN_INSTRUCTIONS_ID
-
-    for item in entries:
-        if item["id"] == defaults["gguf"] != BUILTIN_INSTRUCTIONS_ID:
-            return item["text"]
-    return None
-
-
 def _set_nested(config, sections, key, value):
-    """``config[s1][s2]...[key] = value``, each section a fresh dict;
-    ``_DELETE`` removes the key."""
+    """``config[s1][s2]...[key] = value``, each section a fresh dict."""
     if not sections:
-        if value is _DELETE:
-            config.pop(key, None)
-        else:
-            config[key] = value
+        config[key] = value
         return
     merged = _section(config, sections[0])
     _set_nested(merged, sections[1:], key, value)
@@ -227,7 +176,7 @@ def _validate_autotag_settings(data):
         MAX_SUGGESTION_LIMIT,
         MODEL_TYPES,
         validate_saved_threshold,
-        validate_skipped_tags,
+        validate_template,
     )
 
     updates = {}
@@ -256,7 +205,12 @@ def _validate_autotag_settings(data):
                 raise ValueError(f"{error}.") from None
             updates[key.upper()] = value
     if "autotag_template" in data:
-        raise ValueError(TEMPLATE_REPLACED_ERROR)
+        try:
+            updates["AUTOTAG_TEMPLATE"] = validate_template(
+                data["autotag_template"], "LLM tag template"
+            )
+        except ValueError as error:
+            raise ValueError(f"{error}.") from None
     if "autotag_suggestion_limit" in data:
         value = data["autotag_suggestion_limit"]
         if type(value) is not int or not 1 <= value <= MAX_SUGGESTION_LIMIT:
@@ -265,41 +219,9 @@ def _validate_autotag_settings(data):
                 f"{MAX_SUGGESTION_LIMIT}."
             )
         updates["AUTOTAG_SUGGESTION_LIMIT"] = value
-    if "autotag_skipped_tags" in data:
-        updates["AUTOTAG_SKIPPED_TAGS"] = tuple(
-            validate_skipped_tags(data["autotag_skipped_tags"])
-        )
-    updates.update(_validate_instruction_settings(data))
     return updates
 
 
-def _validate_instruction_settings(data):
-    """Server-side pairing (#431): a save that carries either instruction key
-    gets the other from the running configuration (which holds the migrated
-    list), the defaults are checked against the merged list, and both are
-    written. Empty when the save carries neither."""
-    from ..config import AutotagConfig
-    from ..tagging_defaults import (
-        validate_default_instructions,
-        validate_instructions,
-    )
-
-    if not {"autotag_instructions", "autotag_default_instructions"} & set(data):
-        return {}
-    if "autotag_instructions" in data:
-        entries = validate_instructions(data["autotag_instructions"])
-    else:
-        entries = [dict(item) for item in AutotagConfig.INSTRUCTIONS]
-    defaults = data.get(
-        "autotag_default_instructions", dict(AutotagConfig.DEFAULT_INSTRUCTIONS)
-    )
-    defaults = validate_default_instructions(defaults, entries)
-    return {
-        "AUTOTAG_INSTRUCTIONS": tuple(entries),
-        "AUTOTAG_DEFAULT_INSTRUCTIONS": defaults,
-    }
-
-
 async def _read_json(request):
     """Parse a JSON object body through the package's capped reader."""
     from . import _read_json_body
@@ -327,7 +249,6 @@ class SettingsRoutesMixin:
         """Get current settings."""
         try:
             from ..config import AutotagConfig, PromptManagerConfig, GalleryConfig
-            from ..tagging_defaults import DEFAULT_TAG_TEMPLATE
 
             root_paths = [
                 self._public_path(d) for d in GalleryConfig.MONITORING_DIRECTORIES
@@ -343,12 +264,6 @@ class SettingsRoutesMixin:
                     "sources": source_status,
                     "monitor": monitor,
                     "thumbnail_encoders": encoders,
-                    # #320: the full path only here (D6A).
-                    "thumbnail_location": await self._run_in_executor(
-                        functools.partial(
-                            self._thumbnail_location_payload, with_path=True
-                        )
-                    ),
                     "settings": {
                         "monitoring_enabled": GalleryConfig.MONITORING_ENABLED,
                         "save_foreign_runs": GalleryConfig.SAVE_FOREIGN_RUNS,
@@ -366,21 +281,8 @@ class SettingsRoutesMixin:
                         "autotag_character_threshold": (
                             AutotagConfig.CHARACTER_THRESHOLD
                         ),
-                        # Read-only for one release (#431): a page cached
-                        # from before the upgrade still renders.
-                        "autotag_template": AutotagConfig.default_instructions_text(
-                            "gguf"
-                        ),
-                        "autotag_instructions": [
-                            dict(item) for item in AutotagConfig.INSTRUCTIONS
-                        ],
-                        "autotag_default_instructions": dict(
-                            AutotagConfig.DEFAULT_INSTRUCTIONS
-                        ),
-                        # Built-in's text, which System shows read-only.
-                        "autotag_builtin_instructions": DEFAULT_TAG_TEMPLATE,
+                        "autotag_template": AutotagConfig.TEMPLATE,
                         "autotag_suggestion_limit": AutotagConfig.SUGGESTION_LIMIT,
-                        "autotag_skipped_tags": list(AutotagConfig.SKIPPED_TAGS),
                         "cpu_count": PromptManagerConfig.max_worker_threads(),
                         "gallery_root_paths": root_paths,
                         "gallery_root_path": root_paths[0] if root_paths else "",
@@ -475,19 +377,12 @@ class SettingsRoutesMixin:
             if error_response is not None:
                 return error_response
 
-            if "thumbnail_location" in data:
-                # #320: only the Move thumbnails job changes the location.
-                return needs_move_response()
             expected_revision = data.get("expected_revision")
             if expected_revision is not None and not isinstance(expected_revision, str):
                 return web.json_response(
                     {"success": False, "error": "expected_revision must be a string"},
                     status=400,
                 )
-            if expected_revision is None and _REVISION_REQUIRED & set(data):
-                return web.json_response(
-                    {"success": False, "error": REVISION_REQUIRED_ERROR}, status=400
-                )
             try:
                 updates = self._validate_settings(data)
             except ValueError as ve:
@@ -586,8 +481,7 @@ class SettingsRoutesMixin:
             for key in _THUMBNAIL_SETTINGS
         )
         job = self._jobs.active(THUMBNAILS_JOB_KIND) if changed else None
-        # A move copies previews of the current settings (#320).
-        if job is None or job.scope.get("mode") not in ("convert", "move"):
+        if job is None or job.scope.get("mode") != "convert":
             return None
         return web.json_response(
             {
@@ -617,12 +511,6 @@ class SettingsRoutesMixin:
             if name in _AUTOTAG_SETTINGS:
                 setattr(AutotagConfig, name[len(_AUTOTAG_PREFIX) :], value)
                 continue
-        if "AUTOTAG_INSTRUCTIONS" in updates:
-            # What config.json now holds as the old key (the mirror).
-            AutotagConfig._LEGACY_TEMPLATE = AutotagConfig.mirror_template()
-        for name, value in updates.items():
-            if name in _AUTOTAG_SETTINGS:
-                continue
             owner = GalleryConfig if name in _GALLERY_SETTINGS else PromptManagerConfig
             setattr(owner, name, value)
         restart_fields = []

py/api/source_rescope.py

@@ -41,13 +41,6 @@ def _coded(status: int, code: str, message: str) -> web.Response:
     )
 
 
-def _missing_if_not_found(response: web.Response) -> web.Response:
-    """A file in a trash folder answers as a missing file does (#543)."""
-    if response.status == 404:
-        return _coded(404, "file-missing", "Image file not found")
-    return response
-
-
 def _no_store(response: web.Response) -> web.Response:
     response.headers["Cache-Control"] = "no-store"
     return response
@@ -78,7 +71,7 @@ class SourceRescopeMixin:
         path = root / relative
         denied = _media_access_error(path, [root])
         if denied is not None:
-            return _missing_if_not_found(denied)
+            return denied
         try:
             mtime = path.stat().st_mtime if path.is_file() else None
         except OSError:
@@ -96,7 +89,7 @@ class SourceRescopeMixin:
             return bad_request("Send exactly one target")
         target, error = media_target(data["target"])
         if error is not None:
-            return _missing_if_not_found(error)
+            return error
         old_index, scope, relative = target
         if old_index > MAX_ROOT_INDEX:
             return bad_request("Invalid gallery root")

py/api/sources.py

@@ -30,8 +30,6 @@ import ntpath
 import os
 import re
 
-from .preview_location import HOLDS_THUMBNAILS_REASON
-
 logger = logging.getLogger("prompt_manager.api")
 
 MAX_SOURCE_PATH = 4096  # characters
@@ -116,26 +114,7 @@ def source_problem(text):
     code = source_form_error(text)
     if code is not None:
         return code, FORM_REASONS[code]
-    code, reason = GalleryConfig.gallery_root_problem(text)
-    if code is None and _holds_thumbnails(GalleryConfig.resolve_gallery_root(text)):
-        return "holds-thumbnails", HOLDS_THUMBNAILS_REASON
-    return code, reason
-
-
-def _holds_thumbnails(path):
-    """Whether *path* is inside or around the thumbnail folder in use (#320):
-    a source there would list Prompt Manager's own previews."""
-    from . import preview_store
-
-    try:
-        from ...utils.library_location import _inside_any
-    except ImportError:  # tests import the package top-level
-        from utils.library_location import _inside_any
-
-    setting = preview_store.setting()
-    if setting.mode != preview_store.FOLDER_MODE or not setting.path:
-        return False
-    return _inside_any(path, [setting.path]) or _inside_any(setting.path, [path])
+    return GalleryConfig.gallery_root_problem(text)
 
 
 def public_spelling(text):

py/api/thumbnail_auto.py

@@ -8,8 +8,7 @@ previews behind those URLs are made here, in three ways:
 - **On first view.** ``GET /prompt_manager/images/serve/thumbnails/<rel>_thumb
   <ext>`` for a preview that does not exist yet is admitted on the event loop
   (``_PreviewGate``): at most ``ON_DEMAND_LIMIT`` previews are written at once,
-  on this API's interactive image pool (``IMAGE_POOL_SIZE`` threads, shared
-  with card facts and inspector reads; never the default executor), one flight runs
+  on this API's own small pool (never the default executor), one flight runs
   per file, and the requests waiting are capped (``MAX_WAITING``); past the
   cap a request gets its fallback at once. Inside the admission the preview is
   mapped back to its media file under the same root (the request text is
@@ -25,8 +24,7 @@ previews behind those URLs are made here, in three ways:
 - **On capture.** The image monitor hands every new output it settles to
   ``queue_capture_thumbnail``, which queues its preview for one background
   worker thread (``AutoThumbnailer``). Each wake takes at most Worker threads
-  (``WORKER_THREADS``) files and writes them on the long-lived job pool
-  (``utils.parallel``, shared with scans and thumbnail jobs); enqueuing
+  (``WORKER_THREADS``) files and writes them on that many threads; enqueuing
   is O(1), so the monitor and ComfyUI's queue never wait. A file already
   queued is not queued again, the queue is bounded (``MAX_QUEUED``) and a
   preview left out is made on its first view instead.
@@ -51,7 +49,7 @@ write starts (after its slot) and again just before its rename.
 
 Shutdown: ``close_auto_thumbnails`` stops the worker at a file boundary,
 kills a running ffmpeg, waits a bounded time (and logs when the wait ran
-out) and shuts the image pool down; after the app's cleanup
+out) and shuts the view pool down; after the app's cleanup
 (``final=True``) nothing starts a worker again. Importing this module again
 (a package reload) stops the workers the previous import left.
 """
@@ -62,14 +60,13 @@ import functools
 import io
 import os
 import threading
-from concurrent.futures import CancelledError, ThreadPoolExecutor
+from concurrent.futures import ThreadPoolExecutor
 from pathlib import Path
 
 from aiohttp import web
 
-from . import preview_store, thumbnail_settings
+from . import thumbnail_settings
 from .images import (
-    in_trash_below_roots,
     MEDIA_EXTENSIONS,
     THUMBNAIL_CLEAR_TITLE,
     VIDEO_EXTENSIONS,
@@ -78,7 +75,7 @@ from .images import (
     _thumbnail_is_fresh,
     _video_placeholder_image,
     _worker_threads,
-    media_preview_path,
+    media_thumbnail_rel,
 )
 from .jobs import (
     DUPLICATE_CLEANUP_JOB_KIND,
@@ -106,11 +103,8 @@ PLACEHOLDER_SIZE = (thumbnail_settings.DEFAULT_EDGE, thumbnail_settings.DEFAULT_
 PLACEHOLDER_QUALITY = 85
 # Source extensions in the order a shared preview name looks for them (R2).
 _SOURCE_ORDER = thumbnail_settings.IMAGE_SOURCE_ORDER + tuple(sorted(VIDEO_EXTENSIONS))
-# Threads of the interactive image pool (#523): view previews, card facts and
-# inspector reads. Fixed, so image buffers stay in a few threads' arenas.
-IMAGE_POOL_SIZE = 3
-# Previews views may write at once (the whole image pool).
-ON_DEMAND_LIMIT = IMAGE_POOL_SIZE
+# Previews views may write at once (the size of the view pool).
+ON_DEMAND_LIMIT = 3
 # View requests that may wait on the gate; one more gets its fallback at once.
 MAX_WAITING = 64
 # How long a pool thread waits for the capture worker's flight of the same file.
@@ -129,7 +123,7 @@ AUTO_REFUSED_KINDS = frozenset(
     {RESTORE_JOB_KIND, DUPLICATE_CLEANUP_JOB_KIND, SOURCE_CHANGE_JOB_KIND}
 )
 WORKER_NAME = "PromptManagerThumbnailWorker"
-POOL_PREFIX = "pm-image"
+POOL_PREFIX = "pm-preview"
 # Identifies this import's workers: a reload stops the ones it did not start.
 _MODULE_TOKEN = object()
 
@@ -158,36 +152,6 @@ def _dst_key(dst):
     return flight_key(Path(dst).parent, (Path(dst).name,))
 
 
-class DeferredPreview:
-    """The preview of *rel* under *root*, resolved when its write starts
-    (#320): a queued capture follows the thumbnail location at write time,
-    not the one when it was queued."""
-
-    __slots__ = ("root", "rel", "strict")
-
-    def __init__(self, root, rel, *, strict=True):
-        self.root = Path(root)
-        self.rel = Path(rel)
-        # A capture refuses a store linked out of its container (the serve
-        # route's rule); a planned target keeps the plan's rule: inside the
-        # store, as the thumbnail job writes it.
-        self.strict = strict
-
-    def resolve(self):
-        """The preview's path now, or None when nothing may be written."""
-        dst = media_preview_path(self.root, self.rel, create=True)
-        if dst is None:
-            return None
-        if self.strict:
-            return dst if preview_store.owns(self.root, dst) else None
-        store = preview_store.store_dir(self.root)
-        return dst if _is_within(dst, store) else None
-
-
-def _resolved(dst):
-    return dst.resolve() if isinstance(dst, DeferredPreview) else Path(dst)
-
-
 @functools.lru_cache(maxsize=1)
 def video_placeholder_jpeg():
     """The placeholder frame as JPEG bytes (a video whose preview is missing)."""
@@ -245,19 +209,10 @@ def _candidates(parts):
 def _current_preview(root, parts):
     """The preview *parts* names, in the format written now (#317): a request
     for an older name (``_thumb.png`` before a conversion) is answered with
-    the current file. None when the store of *root* has no place for it."""
+    the current file."""
     _folder, base, _wanted = _candidates(parts)
     name = base + thumbnail_settings.THUMB_SUFFIX + writer_settings().extension
-    return preview_store.request_path(root, (*parts[:-1], name))
-
-
-def _request_key(root, parts):
-    """The flight key of the preview *parts* under *root*: the key of its
-    disk path (so the serve and history routes share one flight)."""
-    path = preview_store.request_path(root, parts)
-    if path is None:
-        return flight_key(root, parts)
-    return _dst_key(path)
+    return Path(root).joinpath(*parts[:-1], name)
 
 
 def _quick_source(root, parts):
@@ -269,8 +224,6 @@ def _quick_source(root, parts):
         for name in (base + extension, base + extension.upper()):
             path = folder / name
             if _regular_file(path) and _is_within(path, root):
-                if in_trash_below_roots(path, [root]):
-                    return None  # also the fallback past the gate's cap (#543)
                 return path, extension in VIDEO_EXTENSIONS
     return None
 
@@ -295,17 +248,13 @@ def _thumbnail_source(root, parts):
         found = _scan_folder(root.joinpath(*folder_parts), base, set(wanted))
         if found is None or not _is_within(found, root):
             return None
-    if in_trash_below_roots(found, [root]):
-        return None
     rel = Path(*folder_parts, found.name)
-    dst = media_preview_path(root, rel, create=True)
-    if dst is None:
-        # Nowhere to write (the thumbnail folder is unavailable): the
-        # original is served and nothing is written.
-        return found, None, found.suffix.lower() in VIDEO_EXTENSIONS
+    dst = root / media_thumbnail_rel(rel)
     if dst != _current_preview(root, parts):
         return None
-    if not preview_store.owns(root, dst):
+    if not _is_within(root / "thumbnails", root) or not _is_within(
+        dst, root / "thumbnails"
+    ):
         dst = None
     return found, dst, found.suffix.lower() in VIDEO_EXTENSIONS
 
@@ -325,21 +274,6 @@ def _scan_folder(folder, base, extensions):
     return None
 
 
-def _deferred(roots, src, dst):
-    """The ``DeferredPreview`` of a planned ``(src, dst)``: the root whose
-    store the plan wrote *dst* into (nested roots plan one each); *dst* as
-    planned when none matches."""
-    src = Path(src)
-    for root in roots:
-        root = Path(root)
-        if not src.is_relative_to(root):
-            continue
-        rel = src.relative_to(root)
-        if media_preview_path(root, rel) == Path(dst):
-            return DeferredPreview(root, rel, strict=False)
-    return dst
-
-
 def _stop_stale_workers():
     """Stop capture workers a previous import of this module started."""
     for thread in threading.enumerate():
@@ -355,7 +289,7 @@ class AutoThumbnailer:
     ``generate(src, dst, is_video, *, stop, guard, track)`` writes one
     preview and returns ``_generate_one``'s result dict; ``may_write()``
     says whether automatic previews may be written now. Views call
-    ``ensure`` on the image pool, the monitor calls ``enqueue`` from its
+    ``ensure`` on the view pool, the monitor calls ``enqueue`` from its
     thread.
     """
 
@@ -481,23 +415,16 @@ class AutoThumbnailer:
 
     def enqueue(self, src, dst, is_video):
         """Queue *dst*'s preview for the worker; False when already queued,
-        full, closed, nowhere to write it or its worker is refused at
-        interpreter exit. Never blocks on a write. *dst* may be a
-        ``DeferredPreview``: its path is resolved again when the write
-        starts."""
-        now = _resolved(dst)
-        if now is None:
-            return False
-        key = _dst_key(now)
-        if not isinstance(dst, DeferredPreview):
-            dst = now
+        full, closed or its worker is refused at interpreter exit. Never
+        blocks on a write."""
+        key = _dst_key(dst)
         with self._changed:
             if self._closed or key in self._queued:
                 return False
             if len(self._queue) >= self._max_queued:
                 return False
             self._queued.add(key)
-            self._queue.append((key, Path(src), dst, bool(is_video)))
+            self._queue.append((key, Path(src), Path(dst), bool(is_video)))
             self._busy = True
             started = True
             if self._start_worker and not self._worker_running:
@@ -559,15 +486,12 @@ class AutoThumbnailer:
                     self._worker_running = False
                     self._changed.notify_all()
                     return
-                workers = max(1, int(self._workers() or 1))
-                take = min(len(self._queue), workers)
+                take = min(len(self._queue), max(1, int(self._workers() or 1)))
                 batch = [self._queue.popleft() for _ in range(take)]
                 self._batch = len(batch)
                 self._changed.notify_all()
             try:
-                # The job pool's size is the setting; a smaller batch uses
-                # fewer of its threads (#523: one long-lived pool).
-                map_parallel(self._write_queued, batch, workers)
+                map_parallel(self._write_queued, batch, len(batch))
             finally:
                 with self._changed:
                     self._batch = 0
@@ -577,9 +501,6 @@ class AutoThumbnailer:
     def _write_queued(self, item):
         _key, src, dst, is_video = item
         try:
-            dst = _resolved(dst)
-            if dst is None:
-                return  # nowhere to write it now: made on its first view
             self.ensure(src, dst, is_video)
         except Exception:  # one file never stops the worker
             self._logger.warning(
@@ -607,7 +528,6 @@ class AutoThumbnailer:
             try:
                 process.kill()
             except OSError:
-                # the process has already exited
                 pass
         if worker is None:
             return True
@@ -641,7 +561,7 @@ class _PreviewGate:
     """Admission of view requests on the event loop (#249 I2).
 
     Waiters are coroutines: at most ``limit`` previews are written at once
-    on the image pool, one flight runs per key, and past ``MAX_WAITING``
+    on the view pool, one flight runs per key, and past ``MAX_WAITING``
     waiting requests ``run`` answers ``OVER`` at once.
     """
 
@@ -696,17 +616,13 @@ class _PreviewGate:
                 flight.set_result(result)
 
 
-def _on_image_thread():
-    return threading.current_thread().name.startswith(POOL_PREFIX + "_")
-
-
 class AutoThumbnailMixin:
     """Automatic previews on the API: views, the monitor's queue, scans."""
 
     _auto_thumbnailer = None
     _auto_thumbnails_shut = False
     _preview_gate_obj = None
-    _image_pool_obj = None
+    _preview_pool_obj = None
     _auto_thumbnailer_lock = threading.Lock()
 
     def _auto_thumbnails(self):
@@ -729,7 +645,7 @@ class AutoThumbnailMixin:
             self._auto_thumbnails_shut = True
 
     def close_auto_thumbnails(self, final=False, timeout=None):
-        """Stop the capture worker and the image pool, and forget them.
+        """Stop the capture worker and the view pool, and forget them.
 
         Bounded by ``timeout`` (see AutoThumbnailer.close). ``final`` (the
         package teardown) also keeps a late monitor event from starting a
@@ -740,7 +656,7 @@ class AutoThumbnailMixin:
             if final:
                 self._auto_thumbnails_shut = True
             thumbnailer, self._auto_thumbnailer = self._auto_thumbnailer, None
-            pool, self._image_pool_obj = self._image_pool_obj, None
+            pool, self._preview_pool_obj = self._preview_pool_obj, None
             self._preview_gate_obj = None
         closed = True
         if thumbnailer is not None:
@@ -749,8 +665,6 @@ class AutoThumbnailMixin:
             pool.shutdown(wait=False, cancel_futures=True)
         if final:
             shutdown_encoders()  # kill JPEG XL / ffmpeg encoders still running
-            # The thumbnail folder's probe (#320), bounded like the rest.
-            closed = preview_store.stop_probe() and closed
         return closed
 
     def _auto_thumbnail_failures(self):
@@ -775,9 +689,6 @@ class AutoThumbnailMixin:
                 return job
             if job.kind == THUMBNAILS_JOB_KIND and job.title == THUMBNAIL_CLEAR_TITLE:
                 return job
-            # Move thumbnails holds automatic previews for its whole run (D2A).
-            if job.kind == THUMBNAILS_JOB_KIND and job.scope.get("mode") == "move":
-                return job
         return None
 
     # ── the view admission ────────────────────────────────────────────
@@ -789,67 +700,16 @@ class AutoThumbnailMixin:
             gate = self._preview_gate_obj = _PreviewGate(ON_DEMAND_LIMIT, self.logger)
         return gate
 
-    def _image_pool(self):
-        """The interactive image pool (#523): IMAGE_POOL_SIZE threads for view
-        previews (behind their gate), card facts and inspector reads, so
-        image buffers never spread over the default executor's threads.
-
-        None after the package teardown (``close_auto_thumbnails(final=True)``):
-        a late request then runs on the default executor (``run_in_executor``
-        with None) and starts no thread the teardown no longer stops.
-        """
+    def _preview_pool(self):
         with AutoThumbnailMixin._auto_thumbnailer_lock:
-            if self._image_pool_obj is None and not self._auto_thumbnails_shut:
-                self._image_pool_obj = ThreadPoolExecutor(
-                    IMAGE_POOL_SIZE, thread_name_prefix=POOL_PREFIX
+            if self._preview_pool_obj is None:
+                self._preview_pool_obj = ThreadPoolExecutor(
+                    ON_DEMAND_LIMIT, thread_name_prefix=POOL_PREFIX
                 )
-            return self._image_pool_obj
+            return self._preview_pool_obj
 
-    async def _run_image(self, func, *args, **kwargs):
-        """``_run_in_executor`` for interactive image work: the image pool.
-
-        After the teardown, or with the pool shut down in between (a test
-        reset), the call runs on the default executor as before.
-        """
-        call = functools.partial(func, *args, **kwargs)
-        loop = asyncio.get_running_loop()
-        try:
-            future = loop.run_in_executor(self._image_pool(), call)
-        except RuntimeError:  # submit refused: the pool was shut down
-            future = loop.run_in_executor(None, call)
-        return await future
-
-    def _map_image(self, func, items):
-        """``func`` over *items* on the image pool, in order (blocking).
-
-        Called from an image pool thread, after the teardown, or with the
-        pool shut down in between (its queued items are cancelled), the
-        items it did not run run on the calling thread.
-        """
-        items = list(items)
-        pool = None if not items or _on_image_thread() else self._image_pool()
-        if pool is None:
-            return [func(item) for item in items]
-        futures = []
-        try:
-            for item in items:
-                futures.append(pool.submit(func, item))
-        except RuntimeError:
-            pass  # shut down in between: the rest run here
-        results = []
-        for index, item in enumerate(items):
-            future = futures[index] if index < len(futures) else None
-            if future is None or future.cancelled():
-                results.append(func(item))
-                continue
-            try:
-                results.append(future.result())
-            except CancelledError:  # cancelled while this caller waited
-                results.append(func(item))
-        return results
-
-    def _image_pool_threads(self):
-        pool = self._image_pool_obj
+    def _preview_pool_threads(self):
+        pool = self._preview_pool_obj
         return [] if pool is None else list(getattr(pool, "_threads", ()))
 
     def _video_placeholder_bytes(self):
@@ -864,7 +724,7 @@ class AutoThumbnailMixin:
         return await self._preview_gate().run(
             flight_key(Path(dst).parent, (Path(dst).name,)),
             functools.partial(self._ensure_view, src, dst, is_video),
-            self._image_pool(),
+            self._preview_pool(),
         )
 
     def _ensure_view(self, src, dst, is_video):
@@ -908,17 +768,17 @@ class AutoThumbnailMixin:
         The flight answers only the outcome (a history flight may be the one
         joined); the file it previews is derived here: the preview path is
         the request's own, and a fallback looks its source up again on the
-        image pool (bounded by it, never the default executor).
+        view pool (bounded by it, never the default executor).
         """
         if _has_traversal(filepath) or not _is_preview_request(filepath):
             return None
         parts = tuple(filepath.split("/"))
         gate = self._preview_gate()
-        pool = self._image_pool()
+        pool = self._preview_pool()
         for root in output_dirs:
             root = Path(root)
             outcome = await gate.run(
-                _request_key(root, parts),
+                flight_key(root, parts),
                 functools.partial(self._preview_on_demand, root, parts),
                 pool,
             )
@@ -931,7 +791,7 @@ class AutoThumbnailMixin:
                     continue
                 return self._preview_response(BUSY, quick[0], None, quick[1])
             dst = _current_preview(root, parts)
-            if outcome == READY and dst is not None:
+            if outcome == READY:
                 return self._file_response(dst)
             located = await gate.loop.run_in_executor(
                 pool, _thumbnail_source, root, parts
@@ -954,31 +814,17 @@ class AutoThumbnailMixin:
         """
         if self._auto_thumbnails_shut:
             return "skipped"
-        located = self._capture_source(image_path)
+        located = self._capture_target(image_path)
         if located is None:
             return "skipped"
-        src, root, rel, is_video = located
-        dst = DeferredPreview(root, rel).resolve()
-        if dst is None:
-            return "skipped"
+        src, dst, is_video = located
         if _thumbnail_is_fresh(src, dst):
             return "fresh"
-        if self._auto_thumbnails().enqueue(src, DeferredPreview(root, rel), is_video):
+        if self._auto_thumbnails().enqueue(src, dst, is_video):
             return "queued"
         return "skipped"
 
     def _capture_target(self, image_path):
-        """``(src, dst, is_video)`` of a new output's preview now, or None."""
-        located = self._capture_source(image_path)
-        if located is None:
-            return None
-        src, root, rel, is_video = located
-        dst = DeferredPreview(root, rel).resolve()
-        return None if dst is None else (src, dst, is_video)
-
-    def _capture_source(self, image_path):
-        """``(src, root, rel, is_video)`` of a media file under a current
-        root (not a preview, a link or in a trash folder), or None."""
         path = Path(os.path.abspath(str(image_path)))
         if path.suffix.lower() not in MEDIA_EXTENSIONS or not _regular_file(path):
             return None
@@ -989,9 +835,14 @@ class AutoThumbnailMixin:
             if not folded.startswith(base) or not _is_within(path, root):
                 continue
             rel = Path(os.path.relpath(path, root))
-            if "thumbnails" in rel.parts[:-1] or in_trash_below_roots(path, [root]):
+            if "thumbnails" in rel.parts[:-1]:
                 return None
-            return path, root, rel, path.suffix.lower() in VIDEO_EXTENSIONS
+            dst = root / media_thumbnail_rel(rel)
+            if not _is_within(root / "thumbnails", root) or not _is_within(
+                dst, root / "thumbnails"
+            ):
+                return None
+            return path, dst, path.suffix.lower() in VIDEO_EXTENSIONS
         return None
 
     # ── after a scan ──────────────────────────────────────────────────
@@ -1033,7 +884,7 @@ class AutoThumbnailMixin:
             return "none"
         thumbnailer = self._auto_thumbnails()
         for src, dst, is_video in plan["targets"]:
-            thumbnailer.enqueue(src, _deferred(output_dirs, src, dst), is_video)
+            thumbnailer.enqueue(src, dst, is_video)
         self.logger.info(f"{missing:,} previews missing after the scan; queued")
         return "queued"
 

py/api/thumbnail_convert.py

@@ -44,7 +44,7 @@ import os
 import time
 from pathlib import Path
 
-from . import preview_store, thumbnail_settings
+from . import thumbnail_settings
 from .thumbnail_encode import ThumbnailVerifyError, verify_thumbnail, writer_settings
 from .admin import _plural, _scan_location, _scan_roots, _scan_status_line
 from .images import _thumbnail_is_fresh, _worker_threads, _thumbnail_batch_size
@@ -153,7 +153,6 @@ class ThumbnailConvertMixin:
             job.log_line("Conversion failed · internal error")
             state = "failed"
         job.finish(state)
-        await self._release_job_memory()
 
     async def _convert_job_body(self, job, options):
         output_dirs = await self._run_in_executor(self._get_all_output_dirs)
@@ -393,12 +392,6 @@ class ThumbnailConvertMixin:
         removed, with no bytes (another run or a sibling removed it)."""
         removed, kept = 0, []
         for path, size in old:
-            if not preview_store.may_write(path):
-                # Folder mode: never a file outside a key folder, or one
-                # reached through a link (checked at the moment of the delete).
-                self.logger.warning(f"Not removing {path}: outside the thumbnails")
-                kept.append(path)
-                continue
             try:
                 os.remove(path)
             except FileNotFoundError:

py/api/thumbnail_encode.py

@@ -46,7 +46,7 @@ from pathlib import Path
 
 from PIL import Image
 
-from . import preview_location, preview_store, thumbnail_settings
+from . import thumbnail_settings
 
 try:
     from ...utils.logging_config import get_logger
@@ -101,20 +101,14 @@ def temp_sibling(dst, tag="part"):
 
 
 def replace_unless_held(tmp, dst, guard=None):
-    """Rename *tmp* over *dst*, unless ``guard()`` is false (PreviewWriteHeld).
-
-    The check and the rename run under ``preview_store.write_lock`` (#320): a
-    guard from ``preview_store.write_guard`` also refuses a write that started
-    before the thumbnail location changed."""
-    with preview_store.committed(guard) as allowed:
-        if not allowed:
-            raise PreviewWriteHeld(PREVIEW_HELD)
-        os.replace(tmp, dst)
+    """Rename *tmp* over *dst*, unless ``guard()`` is false (PreviewWriteHeld)."""
+    if guard is not None and not guard():
+        raise PreviewWriteHeld(PREVIEW_HELD)
+    os.replace(tmp, dst)
 
 
 # ``temp_sibling``'s names: ``.<stem>.<tag>-<pid>-<thread id><ext>``.
 _TEMP_NAME = re.compile(r"^\..+\.(?:part|src)-(\d+)-\d+\.[A-Za-z0-9]+$")
-_MOVE_TEMP_NAME = re.compile(r"\.pm-move-[0-9a-f]{8}\.tmp$")
 # A temp at least this old (seconds) outlived its write: no encode runs longer.
 STRAY_TEMP_AGE = 4 * ENCODE_TIMEOUT
 # When this process started (this module's import): a temp carrying its PID
@@ -126,10 +120,7 @@ def sweep_stray_temps(folder, min_age=None):
     """Remove the temp files a crashed write left under *folder* (a preview
     folder, walked without following links); returns ``(count, bytes)``.
 
-    Only ``temp_sibling`` names are touched, never a link: a folder that is a
-    link, junction or reparse point is not walked into (Windows walks into a
-    junction even without ``followlinks``), and each file passes
-    ``preview_store.may_write`` before it goes. With *min_age*
+    Only ``temp_sibling`` names are touched, never a link. With *min_age*
     (seconds, the startup sweep) a temp younger than that, or one this
     process wrote since it started (it may still be writing it), is left;
     ``min_age=0`` (the clear, which holds every preview write) removes them
@@ -139,39 +130,19 @@ def sweep_stray_temps(folder, min_age=None):
     now = time.time()
     own = str(os.getpid())
     count = size = 0
-    try:
-        if preview_location.is_link_like(folder):
-            return count, size
-    except OSError as exc:
-        logger.debug(f"Not sweeping {folder}: {exc}")
-        return count, size
-    for root, dirs, files in os.walk(folder):
-        dirs[:] = [d for d in dirs if not _link_like(Path(root) / d)]
+    for root, _dirs, files in os.walk(folder):
         for name in files:
             match = _TEMP_NAME.match(name)
-            # A move's copy temp (#320): ``<name>.pm-move-<8 hex>.tmp``.
-            move_temp = match is None and _MOVE_TEMP_NAME.search(name)
-            if match is None and not move_temp:
+            if match is None:
                 continue
             path = Path(root) / name
             try:
                 stat = path.lstat()
-                if (
-                    path.is_symlink()
-                    or not path.is_file()
-                    or _link_like(path)
-                    or not preview_store.may_write(path)
-                ):
+                if path.is_symlink() or not path.is_file():
                     continue
                 if min_age and (
                     now - stat.st_mtime < min_age
-                    or move_temp
-                    and stat.st_mtime >= PROCESS_STARTED
-                    or (
-                        match is not None
-                        and match.group(1) == own
-                        and stat.st_mtime >= PROCESS_STARTED
-                    )
+                    or (match.group(1) == own and stat.st_mtime >= PROCESS_STARTED)
                 ):
                     continue
                 path.unlink()
@@ -183,19 +154,10 @@ def sweep_stray_temps(folder, min_age=None):
     return count, size
 
 
-def _link_like(path):
-    """``is_link_like``, with a path that cannot be checked counted as one."""
-    try:
-        return preview_location.is_link_like(path)
-    except OSError:
-        return True
-
-
 def _unlink_quietly(path):
     try:
         Path(path).unlink()
     except FileNotFoundError:
-        # already gone, which is what was wanted
         pass
     except OSError as exc:
         logger.debug(f"Could not remove temp file {Path(path).name}: {exc}")
@@ -259,7 +221,6 @@ def shutdown_encoders():
         try:
             process.kill()
         except OSError:
-            # the process has already exited
             pass
 
 
@@ -398,12 +359,10 @@ def thumbnail_frame(img, edge):
     try:
         img.seek(0)
     except (EOFError, AttributeError, ValueError):
-        # not seekable or a single frame: use the current one
         pass
     try:
         img.draft("RGB", (edge, edge))  # JPEG: decode at a reduced scale
     except (AttributeError, ValueError, OSError):
-        # draft is only a speedup; the full decode below still works
         pass
     frame = img.convert("RGB") if img.mode != "RGB" else img.copy()
     frame.thumbnail((edge, edge), Image.Resampling.LANCZOS)

py/api/thumbnail_jobs.py

@@ -49,7 +49,6 @@ from .images import (
     _worker_threads,
 )
 from .job_routes import busy_response
-from .thumbnail_location import location_refusal
 from .jobs import THUMBNAIL_GROUP_NAMES, THUMBNAILS_JOB_KIND, JobBusy
 from .thumbnail_convert import CONVERT_JOB_TITLE
 from .thumbnail_encode import writer_settings
@@ -132,10 +131,7 @@ class ThumbnailJobsMixin:
     """The thumbnail plan, the thumbnail job and the legacy stream on it."""
 
     async def get_thumbnail_plan(self, request):
-        """What a thumbnail run would do (read-only; capped like a run).
-        ``mode=prune`` lists the removed sources' thumbnails (#320)."""
-        if request.query.get("mode") == "prune":
-            return await self.get_prune_plan()
+        """What a thumbnail run would do (read-only; capped like a run)."""
         options, error = thumbnail_options(request.query, from_query=True)
         if error:
             return _invalid(error)
@@ -183,39 +179,15 @@ class ThumbnailJobsMixin:
                 )
             except (ValueError, UnicodeDecodeError):
                 return _invalid(_OPTIONS_ERROR)
-        if isinstance(body, dict) and body.get("mode") in ("move", "prune"):
-            return await self._start_location_job(body)
         options, error = thumbnail_options(body)
         if error:
             return _invalid(error)
-        refused = location_refusal()
-        if refused is not None:
-            return refused
         try:
             job = self._start_thumbnail_job(options)
         except JobBusy as busy:
             return busy_response(busy)
         return web.json_response({"success": True, "job": job.summary()}, status=202)
 
-    async def _start_location_job(self, body):
-        """Move thumbnails or Remove thumbnails of removed sources (#320)."""
-        if body["mode"] == "prune":
-            refused = location_refusal()
-            if refused is not None:
-                return refused
-        try:
-            if body["mode"] == "move":
-                started = self.start_thumbnail_move(body)
-            else:
-                started = self.start_thumbnail_prune()
-        except JobBusy as busy:
-            return busy_response(busy)
-        if isinstance(started, web.Response):
-            return started
-        return web.json_response(
-            {"success": True, "job": started.summary()}, status=202
-        )
-
     def _start_thumbnail_job(self, options):
         """Register the thumbnail job synchronously; raises JobBusy.
 
@@ -254,7 +226,6 @@ class ThumbnailJobsMixin:
             )
             state = "failed"
         job.finish(state)
-        await self._release_job_memory()
 
     async def _thumbnail_job_body(self, job, options):
         """Plan, then generate in worker batches; returns the final state.
@@ -487,12 +458,8 @@ class ThumbnailJobsMixin:
         or attaches to the running thumbnail job, and streams its frames. A
         legacy hold (the blocking generate or clear) or a record-changing
         job refuses it with the stream's error frame. The job goes on when
-        the client goes away. Refused (409) while the thumbnail folder is
-        unavailable (#320).
+        the client goes away.
         """
-        refused = location_refusal()
-        if refused is not None:
-            return refused
         response = web.StreamResponse(
             status=200,
             headers={
@@ -539,12 +506,8 @@ class ThumbnailJobsMixin:
         the way.
         """
         running = self._jobs.active(THUMBNAILS_JOB_KIND)
-        if running is not None and running.scope.get("mode") in (
-            "convert",
-            "move",
-            "prune",
-        ):
-            return None, False, running  # no legacy frames to follow (#317, #320)
+        if running is not None and running.scope.get("mode") == "convert":
+            return None, False, running  # no legacy frames to follow (#317)
         if running is not None and running.cancellable:
             return running, False, None
         busy = self._jobs.blocker(THUMBNAILS_JOB_KIND, admission="guarded")

py/api/thumbnail_location.py

@@ -1,162 +0,0 @@
-"""The thumbnail location on the API (#320): startup, the settings payload
-and the refusals while the thumbnail folder is unavailable.
-
-The setting itself is config.json ``thumbnails.location``
-(``preview_location``); the runtime state is ``preview_store``. POST
-``/settings`` never changes it (409 ``location-needs-move``): the Move
-thumbnails job is its only writer.
-"""
-
-import os
-
-from aiohttp import web
-
-from . import preview_location, preview_store
-
-try:
-    from ...utils import library_location
-except ImportError:  # tests import the package top-level
-    from utils import library_location
-
-# The node folder (its web/ is served and a reinstall wipes it).
-NODE_FOLDER = os.path.dirname(
-    os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
-)
-
-
-def default_path():
-    """``<data folder>/data/thumbnails`` (D7B), or None when unknown."""
-    try:
-        return library_location.cache_dir("thumbnails")
-    except Exception:  # no data folder can be decided: no default
-        return None
-
-
-def location_refusal(location=None):
-    """The 409 ``location-unavailable`` response while the thumbnail folder
-    is unavailable, else None (thumbnail generate, convert, clear, prune)."""
-    location = location or preview_store.current()
-    if location.mode != preview_store.FOLDER_MODE or location.available:
-        return None
-    status, text = preview_location.message("location-unavailable")
-    return web.json_response(
-        {"success": False, "code": "location-unavailable", "error": text},
-        status=status,
-    )
-
-
-def needs_move_response():
-    status, text = preview_location.message("location-needs-move")
-    return web.json_response(
-        {"success": False, "code": "location-needs-move", "error": text},
-        status=status,
-    )
-
-
-class ThumbnailLocationMixin:
-    """Startup check and payloads of the thumbnail location."""
-
-    def _all_source_roots(self):
-        """Every image source of every root list: the Images roots, the
-        configured sources and the extra gallery roots (as strings)."""
-        from ..config import GalleryConfig, _extra_gallery_roots
-
-        roots = [str(root) for root in self._get_all_output_dirs()]
-        roots += [str(root) for root in GalleryConfig.MONITORING_DIRECTORIES]
-        roots += list(_extra_gallery_roots())
-        return tuple(dict.fromkeys(root for root in roots if root))
-
-    def _thumbnail_location_context(self):
-        """What a thumbnail folder is validated against (blocking)."""
-        contained = []
-        try:
-            import folder_paths
-
-            for name in (
-                "get_output_directory",
-                "get_input_directory",
-                "get_temp_directory",
-            ):
-                getter = getattr(folder_paths, name, None)
-                folder = getter() if getter is not None else None
-                if folder:
-                    contained.append(str(folder))
-        except ImportError:
-            pass  # folder_paths exists only inside ComfyUI (tests run without it)
-        try:
-            contained.append(library_location.config_location()[1])
-        except Exception:  # no data folder can be decided
-            self.logger.debug("No library folder for the thumbnail check")
-        setting = preview_store.setting()
-        return preview_location.Context(
-            roots=self._all_source_roots(),
-            contained=tuple(contained),
-            node_folder=NODE_FOLDER,
-            default_path=default_path(),
-            current_path=(
-                setting.path if setting.mode == preview_store.FOLDER_MODE else None
-            ),
-        )
-
-    def use_preview_location(self):
-        """Put the configured location in force at once, unchecked (the
-        package's import, before any request): folder mode is unavailable
-        until ``start_preview_location`` has checked it, so nothing is ever
-        written to the sources meanwhile. No filesystem access."""
-        from ..config import PromptManagerConfig
-
-        try:
-            return preview_store.configure(
-                PromptManagerConfig.THUMBNAIL_LOCATION, check=False
-            )
-        except Exception:
-            self.logger.warning("The thumbnail location is unusable", exc_info=True)
-            preview_store.mark_invalid()
-            return preview_store.current()
-
-    def start_preview_location(self):
-        """Parse and check the configured location once (startup thread);
-        the probe takes over. Never raises; a check that fails leaves a
-        folder location unavailable (``invalid``), never the sources."""
-        from ..config import PromptManagerConfig
-
-        try:
-            value = PromptManagerConfig.THUMBNAIL_LOCATION
-            parsed = preview_location.parse_location(value)
-            context = None
-            if parsed.mode == preview_store.FOLDER_MODE:
-                context = self._thumbnail_location_context()
-            location = preview_store.configure(value, context=context)
-        except Exception:
-            self.logger.warning("The thumbnail location check failed", exc_info=True)
-            if (
-                preview_location.parse_location(
-                    PromptManagerConfig.THUMBNAIL_LOCATION
-                ).mode
-                == preview_store.FOLDER_MODE
-            ):
-                preview_store.mark_invalid()
-            return preview_store.current()
-        if location.mode == preview_store.FOLDER_MODE and not location.available:
-            self.logger.warning(
-                "The thumbnail folder is unavailable "
-                f"({location.problem or 'checking'}): originals are shown and "
-                "no thumbnails are written until it is back"
-            )
-        return location
-
-    def _thumbnail_location_payload(self, *, with_path):
-        """``{mode, available, problem}`` plus, for the settings GET only,
-        ``path`` and ``default_path`` (D6A)."""
-        location = preview_store.current()
-        payload = {
-            "mode": location.mode,
-            "available": location.available,
-            "problem": location.problem,
-        }
-        if with_path:
-            payload["path"] = location.path
-            payload["default_path"] = default_path()
-            # Old copies a move still has to remove (#320 Part 3).
-            payload["cleanup_pending"] = len(preview_store.setting().cleanup)
-        return payload

py/api/thumbnail_move.py

@@ -1,579 +0,0 @@
-"""Move thumbnails (#320 Part 3): the reviewed job that changes where previews
-live, the removal of old copies after it, recovery at startup and the
-"Remove thumbnails of removed sources" scope (Part 5).
-
-Kind ``thumbnails`` with ``mode: "move"`` (D1A): admission ``guarded``, so
-scans, deletes, tagging, source changes and every other thumbnail job wait
-for it, while the monitor's Needs review recording runs beside it.
-Automatic previews are held for the whole job (D2A, ``_auto_thumbnail_blocker``).
-
-Phases: review (``POST /images/thumbnails/plan``, no writes but the
-validation probe), start (a plan token), hold (generation bump, journal,
-target folder), copy (cancellable at every file boundary, on the job pool
-in small chunks, D3A), switch (one config commit sets the location and
-records the old stores under ``cleanup``; not cancellable from here),
-remove old copies, end. Per-file errors switch anyway (D10A); a folder-wide
-error or a cancel before the switch removes what the job wrote and changes
-nothing. The move is the only writer of the setting (D4B).
-
-Moving away from a thumbnail folder also removes the previews of this
-install's sources that are no longer listed (Q320-8: remove).
-"""
-
-import functools
-import os
-import time
-from pathlib import Path
-
-from aiohttp import web
-
-from . import preview_location, preview_store
-from . import thumbnail_move_files as files
-from .jobs import THUMBNAILS_JOB_KIND
-from .thumbnail_move_plan import (
-    MOVE_GROUPS,
-    MOVE_TITLE,
-    PLAN_TTL,
-    _number,
-    _plural,
-    _remove,
-    _roots_revision,
-    _volume,
-    _is_network,
-    _write_json,
-)
-from . import thumbnail_move_plan as move_plan
-
-try:
-    from ...utils import exit_signal
-    from ...utils.parallel import map_parallel
-except ImportError:  # tests import the package top-level
-    from utils import exit_signal
-    from utils.parallel import map_parallel
-
-
-class ThumbnailMoveMixin:
-    """Start and run the move job; the removal of old copies."""
-
-    # ── start ─────────────────────────────────────────────────────────
-
-    def _take_move_plan(self, body):
-        """The plan a start names, or ``(status, code)``."""
-        token = body.get("token")
-        plan = (self._move_plans or {}).get(token) if isinstance(token, str) else None
-        if plan is None or time.monotonic() - plan.created > PLAN_TTL:
-            return 409, "plan-stale"
-        roots = [str(root) for root in self._get_all_output_dirs()]
-        if _roots_revision(roots) != plan.revision:
-            return 409, "plan-stale"
-        if preview_store.setting() != plan.old:
-            return 409, "plan-stale"
-        if plan.confirm_required and body.get("confirmed") is not True:
-            return 400, "confirmation-required"
-        return plan
-
-    def start_thumbnail_move(self, body):
-        """Start the move job (sync, on the loop); raises JobBusy. Returns
-        the job or a refusal response."""
-        if not self._move_recovered:
-            blocker = self._jobs.active(THUMBNAILS_JOB_KIND)
-            return web.json_response(
-                {
-                    "success": False,
-                    "code": "busy",
-                    "error": "Prompt Manager is still checking an earlier move. "
-                    "Try again in a moment.",
-                    "running": None if blocker is None else {"id": blocker.id},
-                },
-                status=409,
-            )
-        taken = self._take_move_plan(body)
-        if isinstance(taken, tuple):
-            status, code = taken
-            text = {
-                "plan-stale": "The review is out of date. Review the move again.",
-                "confirmation-required": "Confirm that Prompt Manager may "
-                "create its folders there.",
-            }[code]
-            return web.json_response(
-                {"success": False, "code": code, "error": text}, status=status
-            )
-        plan = taken
-        self._move_plans.pop(plan.token, None)
-        return self._jobs.start(
-            THUMBNAILS_JOB_KIND,
-            MOVE_TITLE,
-            admission="guarded",
-            cancellable=True,
-            scope={
-                "mode": "move",
-                "from": plan.old.mode,
-                "to": plan.target["mode"],
-                "to_path": plan.target["path"],
-            },
-            groups=MOVE_GROUPS,
-            runner=functools.partial(self._run_thumbnail_move, plan=plan),
-        )
-
-    # ── the job ───────────────────────────────────────────────────────
-
-    async def _run_thumbnail_move(self, job, *, plan):
-        state = {"written": [], "created": [], "created_folder": False}
-        try:
-            await self._run_in_executor(self._move_hold, job, plan, state)
-        except (OSError, ValueError) as error:
-            await self._run_in_executor(self._move_rollback, plan, state)
-            self._end_move(
-                job, "failed", "The new folder could not be made; nothing changed."
-            )
-            self.logger.warning(f"Move thumbnails could not start: {error}")
-            return
-        left = [
-            {
-                "path": "/".join(item),
-                "root": s.label,
-                "detail": "Not a thumbnail; left in place",
-            }
-            for s in plan.sources
-            if s.scan is not None
-            for item in s.scan.left
-        ]
-        if left:
-            job.record_counted("left", len(left), left)
-        items = [
-            (source, item)
-            for source in plan.sources
-            if source.scan is not None
-            for item in source.scan.copy
-        ]
-        total = len(items)
-        job.update(total=total, processed=0, progress=0)
-        chunk = await self._run_in_executor(self._move_chunk, plan)
-        workers = self._move_workers()
-        done = 0
-        for start in range(0, total, chunk):
-            if job.cancelled:
-                await self._move_cancelled(job, plan, state)
-                return
-            batch = items[start : start + chunk]
-            try:
-                results = await self._run_in_executor(
-                    map_parallel,
-                    functools.partial(self._move_copy_one, state=state),
-                    batch,
-                    workers,
-                )
-            except exit_signal.ExitRequested:
-                return  # exiting: the next start undoes the copies (journal)
-            except files.FolderGone as error:
-                self.logger.warning(f"Move thumbnails stopped: {error}")
-                await self._run_in_executor(self._move_rollback, plan, state)
-                self._end_move(
-                    job,
-                    "failed",
-                    "The new folder could not be reached or is full; nothing changed.",
-                )
-                return
-            except Exception:
-                # Anything else before the switch: undo, never half a move.
-                self.logger.exception("Move thumbnails failed while copying")
-                await self._run_in_executor(self._move_rollback, plan, state)
-                self._end_move(job, "failed", "The copy failed; nothing changed.")
-                return
-            for (source, item), (outcome, detail) in zip(batch, results):
-                row = {
-                    "path": "/".join(item[0]),
-                    "root": source.label,
-                    "detail": detail,
-                }
-                job.record(
-                    "moved" if outcome == "moved" else outcome,
-                    row,
-                    f"{outcome}: {source.label} · {'/'.join(item[0])}",
-                )
-            done += len(batch)
-            label = batch[-1][0].label
-            job.update(
-                processed=done,
-                progress=int(done * 90 / total) if total else 90,
-                status_line=(
-                    f"Copying {_number(done)} of {_number(total)} previews · {label}"
-                ),
-            )
-            job.publish({"type": "progress", "summary": job.summary()})
-        if job.cancelled:
-            await self._move_cancelled(job, plan, state)
-            return
-        # The switch: not cancellable from here (an exit still stops between
-        # files and leaves the cleanup to the next start).
-        job.cancellable = False
-        job.update(status_line="Switching to the new location", progress=92)
-        job.publish({"type": "progress", "summary": job.summary()})
-        try:
-            await self._run_in_executor(self._move_switch, plan)
-        except Exception:
-            self.logger.exception("Move thumbnails could not switch")
-            await self._run_in_executor(self._move_rollback, plan, state)
-            self._end_move(
-                job, "failed", "The setting could not be saved; nothing changed."
-            )
-            return
-        await self._remove_old_copies(job, plan)
-        moved = job.counters.get("moved", 0) + job.counters.get("skipped", 0)
-        errors = job.counters.get("errors", 0)
-        where = plan.target["path"] or "inside each source"
-        parts = [f"{_number(moved)} moved"]
-        if errors:
-            parts.append(_plural(errors, "error"))
-        parts.append(
-            "old copies removed"
-            if not job.scope.get("cleanup_left")
-            else "some old copies are removed at the next start"
-        )
-        self._end_move(
-            job, "finished", f"Thumbnails moved to {where}: " + " · ".join(parts) + "."
-        )
-
-    def _end_move(self, job, state, line):
-        job.update(status_line=line, progress=100)
-        job.log_line(line)
-        job.publish({"type": "complete", "summary": job.summary()})
-        job.finish(state)
-
-    def _move_workers(self):
-        from .images import _worker_threads
-
-        return max(1, int(_worker_threads() or 1))
-
-    def _move_chunk(self, plan):
-        """2 files at a time across volumes or to/from a share, else 4, never
-        more than Worker threads (D3A: the pool keeps its size)."""
-        sides = [plan.target["path"] or ""] + [s.old_store or "" for s in plan.sources]
-        sides += [s.new_store for s in plan.sources]
-        network = any(_is_network(side) for side in sides if side)
-        volumes = {_volume(side) for side in sides if side}
-        size = 2 if network or len(volumes) > 1 else 4
-        return max(1, min(size, self._move_workers()))
-
-    def _move_hold(self, job, plan, state):
-        """Phase 3: bump the generation, write the journal, make the target."""
-        preview_store.bump_generation()
-        if plan.to_folder:
-            folder = plan.target["path"]
-            if not os.path.isdir(folder):
-                if plan.target_default:
-                    os.makedirs(folder, exist_ok=True)
-                else:
-                    os.mkdir(folder)
-                state["created_folder"] = True
-            plan.target_id = preview_location.init_folder(
-                folder, created_by_pm=state["created_folder"]
-            )
-            install = plan.install
-
-            def add_keys(marker):
-                for source in plan.sources:
-                    if source.key and source.key not in marker["keys"]:
-                        marker["keys"][source.key] = {
-                            "path": source.root,
-                            "identity": os.path.normcase(os.path.realpath(source.root)),
-                            "dev_ino": preview_location.file_identity(source.root),
-                            "install": install,
-                        }
-
-            with preview_store.write_lock:
-                preview_location.write_marker(folder, add_keys)
-        _write_json(
-            move_plan.journal_path(),
-            {
-                "state": "copying",
-                "from": plan.old.to_config(),
-                "to": plan.target,
-                "stores": [s.new_store for s in plan.sources],
-                # Stores that do not exist yet are made by this job only:
-                # after a crash everything in them goes (B4).
-                "created_dirs": [
-                    s.new_store for s in plan.sources if not os.path.isdir(s.new_store)
-                ],
-                "created_folder": state["created_folder"],
-                "install": plan.install,
-            },
-        )
-        job.log_line(
-            f"Move thumbnails started: {plan.old.path or 'inside each source'} → "
-            f"{plan.target['path'] or 'inside each source'}"
-        )
-
-    def _move_copy_one(self, pair, *, state):
-        """Copy one preview (a pool thread); ``(group, detail)``."""
-        source, (relative, size, mtime_ns) = pair
-        destination = Path(source.new_store).joinpath(*relative)
-        try:
-            if not os.path.isdir(destination.parent):
-                base = Path(source.new_store)
-                if not base.is_dir():
-                    if plan_parent_missing(base):
-                        raise files.FolderGone("the new folder is gone")
-                    created = []
-                    files._make_folders(base.parent, (base.name,), created)
-                    state["created"].extend(created)
-                created = []
-                files._make_folders(base, relative[:-1], created)
-                state["created"].extend(created)
-            # Also when the folders already exist (Codex P1 on #592).
-            files.refuse_links(source.new_store, relative[:-1])
-            outcome = files.copy_one(
-                Path(source.old_store).joinpath(*relative),
-                destination,
-                size,
-                mtime_ns,
-                state["created"],
-            )
-        except files.CopyFailed as error:
-            return "errors", str(error)
-        if outcome == "moved":
-            state["written"].append(str(destination))
-            return "moved", "Copied and checked"
-        return "skipped", "Already there"
-
-    async def _move_cancelled(self, job, plan, state):
-        if exit_signal.requested():
-            return  # the next start removes the partial copies (journal)
-        await self._run_in_executor(self._move_rollback, plan, state)
-        self._end_move(job, "cancelled", "Move cancelled: nothing changed.")
-
-    def _move_rollback(self, plan, state):
-        """Remove what this job wrote (files, folders it made, a folder and
-        marker it created) and the journal: nothing changed."""
-        for path in state["written"]:
-            files.remove_file(path)
-        for folder in reversed(state["created"]):
-            files.remove_empty_folders(folder)
-        if plan.to_folder and state.get("created_folder"):
-            folder = plan.target["path"]
-            try:
-                names = os.listdir(folder)
-            except OSError:
-                names = None
-            if names is not None and set(names) <= {preview_location.MARKER_NAME}:
-                _remove(preview_location.marker_path(folder))
-                files.remove_empty_folders(folder)
-        _remove(move_plan.journal_path())
-
-    def _move_switch(self, plan):
-        """Phase 5: one config commit sets the location and records the old
-        stores under ``cleanup``; the runtime follows under the write lock."""
-        from ..config import PromptManagerConfig
-        from ..config_store import get_config_store
-
-        entry = {
-            "from": plan.old.mode,
-            "folder": plan.old.path if plan.from_folder else None,
-            "stores": [s.old_store for s in plan.sources if s.old_store],
-            "drop_keys": self._old_keys_to_drop(plan),
-            "install": plan.install,
-        }
-        # An older entry never removes a store the move just filled (a move
-        # back while old copies still waited).
-        filled = {os.path.normcase(s.new_store) for s in plan.sources}
-        cleanup = []
-        for old_entry in plan.old.cleanup:
-            stores = [
-                store
-                for store in old_entry.get("stores") or []
-                if isinstance(store, str) and os.path.normcase(store) not in filled
-            ]
-            folder = old_entry.get("folder")
-            drop = [
-                key
-                for key in old_entry.get("drop_keys") or []
-                if not folder
-                or os.path.normcase(os.path.join(folder, key)) not in filled
-            ]
-            cleanup.append({**old_entry, "stores": stores, "drop_keys": drop})
-        cleanup.append(entry)
-        if plan.to_folder:
-            value = {
-                "mode": preview_store.FOLDER_MODE,
-                "path": plan.target["path"],
-                "id": plan.target_id,
-                "install": plan.install,
-                "cleanup": cleanup,
-            }
-        else:
-            value = {
-                "mode": preview_store.SOURCE_MODE,
-                "install": plan.install,
-                "cleanup": cleanup,
-            }
-
-        def mutate(config):
-            section = config.get("thumbnails")
-            if not isinstance(section, dict):
-                section = {}
-            section["location"] = value
-            config["thumbnails"] = section
-            return config
-
-        def publish(_config):
-            PromptManagerConfig.THUMBNAIL_LOCATION = value
-            preview_store.configure(value, check=False)
-
-        get_config_store().commit(mutate, expected_revision=None, publish=publish)
-        # The switch is made: what follows never undoes it.
-        try:
-            preview_store.refresh()
-            _remove(move_plan.journal_path())
-        except OSError as error:
-            self.logger.warning(
-                f"The thumbnail move journal stays until the next start: {error}"
-            )
-
-    def _old_keys_to_drop(self, plan):
-        if not plan.from_folder:
-            return []
-        keys = [s.old_store and os.path.basename(s.old_store) for s in plan.sources]
-        keys = [key for key in keys if key]
-        if plan.to_folder and os.path.normcase(plan.old.path or "") == os.path.normcase(
-            plan.target["path"] or ""
-        ):
-            return []
-        return keys + [key for key, _store, _scan in plan.unlisted]
-
-    async def _remove_old_copies(self, job, plan):
-        """Phase 6: run the cleanup the switch recorded (and earlier ones)."""
-        job.update(status_line="Removing old copies", progress=95)
-        job.publish({"type": "progress", "summary": job.summary()})
-        left = await self._run_in_executor(self._run_cleanup, job)
-        if left:
-            job.scope["cleanup_left"] = True
-
-    def _run_cleanup(self, job=None):
-        """Remove every recorded old store's previews, temps and empty
-        folders; keep in ``cleanup`` what could not go. Returns how many
-        entries are left (blocking)."""
-        setting = preview_store.setting()
-        remaining = []
-        for entry in setting.cleanup:
-            if not self._cleanup_entry(entry, job):
-                remaining.append(entry)
-        if list(setting.cleanup) != remaining:
-            self._commit_cleanup(remaining)
-        return len(remaining)
-
-    def _cleanup_entry(self, entry, job):
-        """One recorded removal; True when it is complete."""
-        folder = entry.get("folder")
-        stores = [
-            store for store in entry.get("stores") or [] if isinstance(store, str)
-        ]
-        if folder:
-            if not os.path.isdir(folder):
-                return False  # the old folder is not reachable: kept for later
-            folder_marker = preview_location.read_marker(folder) or {}
-            keys = folder_marker.get("keys") or {}
-            stores += [
-                os.path.join(folder, key)
-                for key in entry.get("drop_keys") or []
-                if preview_location.valid_key(key) and key in keys
-            ]
-        complete = True
-        for store in dict.fromkeys(stores):
-            if not self._remove_store(store, folder, job):
-                complete = False
-        if folder and complete:
-            drop = set(entry.get("drop_keys") or [])
-
-            def forget(marker):
-                for key in drop:
-                    marker["keys"].pop(key, None)
-
-            try:
-                with preview_store.write_lock:
-                    marker = preview_location.write_marker(folder, forget)
-            except (OSError, ValueError):
-                return False
-            if not marker["keys"] and marker.get("created_by_pm"):
-                names = set(os.listdir(folder))
-                rest = {n for n in names if not files.is_os_metadata(n)}
-                if rest <= {preview_location.MARKER_NAME}:
-                    _remove(preview_location.marker_path(folder))
-                    files.remove_empty_folders(folder)
-        return complete
-
-    def _remove_store(self, store, folder, job):
-        """Remove the previews and temps of one old store; True when done."""
-        store = Path(store)
-        if folder:
-            # A key folder directly in the old thumbnail folder, nothing else.
-            if not preview_location.valid_key(store.name) or os.path.normcase(
-                str(store.parent)
-            ) != os.path.normcase(str(folder)):
-                return True
-        elif store.name != "thumbnails":
-            return True  # a hand-edited entry never names another folder
-        if not store.exists():
-            return True
-        if preview_location.is_link_like(store):
-            return True  # never through a link; nothing of ours there
-        complete = True
-        removed = 0
-        for current, dirs, names in os.walk(store):
-            dirs[:] = [
-                d for d in dirs if not preview_location.is_link_like(Path(current) / d)
-            ]
-            for name in names:
-                path = Path(current) / name
-                if files.is_temp_name(name) or files._preview_parts(name):
-                    if preview_location.is_link_like(path):
-                        continue
-                    if exit_signal.requested():
-                        return False  # exiting: the next start finishes it
-                    if files.remove_file(path):
-                        removed += 1
-                    else:
-                        complete = False
-                        relative = path.relative_to(store).as_posix()
-                        self.logger.warning(
-                            f"Could not remove the old thumbnail {path}; it is "
-                            "removed at the next start"
-                        )
-                        if job is not None:
-                            # D10A: a removal that failed is an error the job lists.
-                            job.record(
-                                "errors",
-                                {
-                                    "path": relative,
-                                    "root": store.name,
-                                    "detail": "In use by another program; removed "
-                                    "at the next start",
-                                },
-                                f"In use by another program; removed at the next "
-                                f"start: {store.name}/{relative}",
-                            )
-        files.remove_empty_folders(store)
-        if job is not None and removed:
-            job.log_line(f"Removed {_number(removed)} old files from {store.name}")
-        return complete
-
-    def _commit_cleanup(self, remaining):
-        from ..config import PromptManagerConfig
-        from ..config_store import get_config_store
-
-        def mutate(config):
-            section = config.get("thumbnails")
-            if isinstance(section, dict) and isinstance(section.get("location"), dict):
-                section["location"]["cleanup"] = remaining
-            return config
-
-        def publish(config):
-            value = (config.get("thumbnails") or {}).get("location")
-            PromptManagerConfig.THUMBNAIL_LOCATION = value
-            preview_store.set_cleanup(remaining)
-
-        get_config_store().commit(mutate, expected_revision=None, publish=publish)
-
-
-def plan_parent_missing(store):
-    """A key folder's parent (the thumbnail folder) is gone mid-copy."""
-    return not Path(store).parent.is_dir()

py/api/thumbnail_move_files.py

@@ -1,348 +0,0 @@
-"""The file side of Move thumbnails (#320 Part 3): what is copied, how a
-copy is made and checked, and how old copies are removed.
-
-No job, HTTP or config code lives here; ``thumbnail_move`` drives it.
-
-Copy set (B5): each old store is walked with ``os.scandir``, never through a
-symlink, junction or reparse point (counted as "skipped link"). A regular
-file is
-
-- copied when it has the preview grammar (``<name>_thumb<ext>``, any written
-  or legacy extension) and its original still exists in the source;
-- removed with the old copies, not copied, when it is an orphan (no
-  original), lies under a trash folder, or is a temp sibling of a write
-  (``.<stem>.part-…``) or of a move (``….pm-move-<8 hex>.tmp``);
-- left in place otherwise ("Left in place"). OS metadata files (``Thumbs.db``,
-  ``desktop.ini``, ``.DS_Store``, ``._*``) are removed only when they alone
-  keep a preview folder from being removed.
-
-A copy goes to ``<name>.pm-move-<8 hex>.tmp`` beside its destination, its
-size is compared, its mtime is set to the source preview's rounded up to the
-next 2-second step (FAT/exFAT keep it fresh, a stale preview stays stale),
-then it is renamed into place. Every handle is closed before a rename or an
-unlink (Windows).
-"""
-
-import errno
-import logging
-import os
-import re
-import secrets
-import shutil
-import stat as stat_module
-import time
-from dataclasses import dataclass, field
-from pathlib import Path
-
-from . import preview_location, thumbnail_settings
-from .thumbnail_encode import _TEMP_NAME
-
-try:
-    from ...utils.media_folders import in_trash_folder
-except ImportError:  # tests import the package top-level
-    from utils.media_folders import in_trash_folder
-
-logger = logging.getLogger("prompt_manager.thumbnails")
-
-MOVE_TEMP = re.compile(r"\.pm-move-[0-9a-f]{8}\.tmp$")
-MOVE_TEMP_SUFFIX = ".pm-move-{token}.tmp"
-# The temp name adds this much to a destination path (".pm-move-xxxxxxxx.tmp").
-TEMP_EXTRA = 21
-WINDOWS_FILE_LIMIT = 259
-MTIME_STEP_NS = 2_000_000_000
-# A file another program holds open (Windows) is retried this often.
-REMOVE_RETRIES = (0.5, 1.0, 2.0)
-_WINDOWS_IN_USE = {32, 33}  # ERROR_SHARING_VIOLATION, ERROR_LOCK_VIOLATION
-
-
-def is_os_metadata(name):
-    folded = name.lower()
-    return folded in preview_location.OS_METADATA or folded.startswith("._")
-
-
-def is_temp_name(name):
-    return bool(_TEMP_NAME.match(name) or MOVE_TEMP.search(name))
-
-
-def _preview_parts(name):
-    """``(base, extension)`` of a preview file name, or None."""
-    stem, extension = os.path.splitext(name)
-    suffix = thumbnail_settings.THUMB_SUFFIX
-    if not stem.endswith(suffix) or len(stem) <= len(suffix):
-        return None
-    if extension.lower() not in thumbnail_settings.THUMBNAIL_EXTENSIONS:
-        return None
-    return stem[: -len(suffix)], extension
-
-
-def _has_original(root, rel_dir, base, extension):
-    """Whether a media file in ``<root>/<rel_dir>`` owns this preview."""
-    folder = Path(root).joinpath(*rel_dir)
-    try:
-        with os.scandir(folder) as entries:
-            for entry in entries:
-                stem, source_ext = os.path.splitext(entry.name)
-                if stem != base or not source_ext:
-                    continue
-                if not thumbnail_settings.owns(extension, source_ext):
-                    continue
-                if entry.is_file(follow_symlinks=False):
-                    return True
-    except OSError:
-        return False
-    return False
-
-
-@dataclass
-class StoreScan:
-    """One old store's files, sorted into what the move does with them."""
-
-    store: Path
-    copy: list = field(default_factory=list)  # (relative parts, size, mtime_ns)
-    orphans: list = field(default_factory=list)  # relative parts
-    temps: list = field(default_factory=list)
-    left: list = field(default_factory=list)
-    links: int = 0
-    bytes: int = 0
-
-    @property
-    def removable(self):
-        return [item[0] for item in self.copy] + self.orphans + self.temps
-
-
-def scan_store(store, root, *, stop=None):
-    """Sort the files of *store* (the previews of the source *root*).
-
-    A store that does not exist, or is itself a link, scans empty (a link
-    counts once).
-    """
-    store = Path(store)
-    scan = StoreScan(store)
-    try:
-        if preview_location.is_link_like(store):
-            scan.links += 1
-            return scan
-        if not store.is_dir():
-            return scan
-    except OSError:
-        return scan
-    _walk(scan, store, (), root, stop)
-    return scan
-
-
-def _walk(scan, folder, rel_dir, root, stop):
-    try:
-        with os.scandir(folder) as iterator:
-            entries = list(iterator)
-    except OSError:
-        return
-    for entry in entries:
-        if stop is not None and stop():
-            return
-        relative = rel_dir + (entry.name,)
-        path = Path(entry.path)
-        try:
-            if preview_location.is_link_like(path):
-                scan.links += 1
-                continue
-            info = entry.stat(follow_symlinks=False)
-        except OSError:
-            continue
-        if stat_module.S_ISDIR(info.st_mode):
-            _walk(scan, path, relative, root, stop)
-            continue
-        if not stat_module.S_ISREG(info.st_mode):
-            scan.left.append(relative)
-            continue
-        if is_temp_name(entry.name):
-            scan.temps.append(relative)
-            continue
-        if is_os_metadata(entry.name):
-            continue  # removed only when it alone keeps a folder (rmdir)
-        parts = _preview_parts(entry.name)
-        if parts is None:
-            scan.left.append(relative)
-            continue
-        if in_trash_folder("/".join(relative)) or not _has_original(
-            root, rel_dir, *parts
-        ):
-            scan.orphans.append(relative)
-            continue
-        scan.copy.append((relative, info.st_size, info.st_mtime_ns))
-        scan.bytes += info.st_size
-
-
-# ── copying ──────────────────────────────────────────────────────────
-
-
-def rounded_mtime_ns(mtime_ns):
-    """*mtime_ns* rounded up to the next 2-second step (FAT/exFAT)."""
-    return -(-mtime_ns // MTIME_STEP_NS) * MTIME_STEP_NS
-
-
-def too_long(path, long_paths=None):
-    """A destination (with its temp name) over Windows' file limit."""
-    if os.name != "nt" and long_paths is not False:
-        return False
-    if long_paths is None:
-        long_paths = preview_location.long_paths_enabled()
-    if long_paths:
-        return False
-    return len(str(path)) + TEMP_EXTRA > WINDOWS_FILE_LIMIT
-
-
-class CopyFailed(Exception):
-    """One preview could not be copied (a per-file error, D10A)."""
-
-
-class FolderGone(Exception):
-    """The destination cannot take writes any more (abort the move)."""
-
-
-def _make_folders(base, relative_dir, created):
-    """Make ``base/relative_dir`` one folder at a time (*base* must exist);
-    every folder made is added to *created*."""
-    current = Path(base)
-    for part in relative_dir:
-        current = current / part
-        try:
-            os.mkdir(current)
-            created.append(str(current))
-        except FileExistsError:
-            pass  # already there: made by an earlier copy into this folder
-        except OSError as error:
-            if error.errno in (errno.ENOSPC, errno.EDQUOT, errno.EROFS):
-                raise FolderGone(str(error)) from error
-            raise CopyFailed(
-                "Its folder could not be made; made again on view"
-            ) from error
-        if preview_location.is_link_like(current):
-            raise CopyFailed("a link in the destination")
-
-
-def refuse_links(base, relative_dir):
-    """Raise CopyFailed when *base* or an existing folder on the way to
-    ``base/relative_dir`` is a link (never copy through one)."""
-    current = Path(base)
-    for part in (None, *relative_dir):
-        if part is not None:
-            current = current / part
-        if preview_location.is_link_like(current):
-            raise CopyFailed("a link in the destination")
-
-
-def copy_one(source, destination, size, mtime_ns, created, *, long_paths=None):
-    """Copy one preview; returns ``"moved"`` or ``"skipped"`` (already
-    there). Raises CopyFailed (this file) or FolderGone (the destination)."""
-    destination = Path(destination)
-    if too_long(destination, long_paths):
-        raise CopyFailed("Path too long for Windows; the original is shown")
-    wanted = rounded_mtime_ns(mtime_ns)
-    try:
-        existing = os.stat(destination, follow_symlinks=False)
-    except FileNotFoundError:
-        existing = None
-    except OSError as error:
-        raise FolderGone(str(error)) from error
-    if (
-        existing is not None
-        and stat_module.S_ISREG(existing.st_mode)
-        and existing.st_size == size
-        and existing.st_mtime_ns == wanted
-    ):
-        return "skipped"
-    temp = destination.with_name(
-        destination.name + MOVE_TEMP_SUFFIX.format(token=secrets.token_hex(4))
-    )
-    try:
-        shutil.copyfile(source, temp)
-        if os.stat(temp).st_size != size:
-            raise CopyFailed("The copy did not match; made again on view")
-        os.utime(temp, ns=(wanted, wanted))
-        os.replace(temp, destination)
-    except CopyFailed:
-        _unlink(temp)
-        raise
-    except FileNotFoundError as error:
-        _unlink(temp)
-        if not Path(source).exists():
-            raise CopyFailed("Could not be read; made again on view") from error
-        raise FolderGone(str(error)) from error
-    except OSError as error:
-        _unlink(temp)
-        if error.errno in (errno.ENOSPC, errno.EDQUOT, errno.EROFS):
-            raise FolderGone(str(error)) from error
-        raise CopyFailed("Could not be copied; made again on view") from error
-    return "moved"
-
-
-def _unlink(path):
-    """Remove a copy's temp file after a failed copy; True when it is gone.
-
-    One that cannot go (a Windows lock, permissions) is logged with its path;
-    the next start's temp sweep removes it (``.pm-move-*.tmp``)."""
-    try:
-        os.unlink(path)
-        return True
-    except FileNotFoundError:
-        return True  # never written, or already renamed into place
-    except OSError as error:
-        logger.warning(f"Could not remove the move's temp file {path}: {error}")
-        return False
-
-
-# ── removing ─────────────────────────────────────────────────────────
-
-
-def _in_use(error):
-    return getattr(error, "winerror", None) in _WINDOWS_IN_USE
-
-
-def remove_file(path, *, sleep=time.sleep):
-    """Remove one file; a file another program holds open (Windows) is
-    retried 3 times. Returns True when it is gone."""
-    for wait in (0.0,) + REMOVE_RETRIES:
-        if wait:
-            sleep(wait)
-        try:
-            os.unlink(path)
-            return True
-        except FileNotFoundError:
-            return True
-        except OSError as error:
-            if not _in_use(error):
-                return False
-    return False
-
-
-def remove_empty_folders(top, *, keep_top=False):
-    """``rmdir`` the empty folders below *top* (and *top*), bottom-up, never
-    through a link. A folder holding only OS metadata files loses them first.
-    Returns the folders that could not be removed."""
-    top = Path(top)
-    left = []
-    if not top.is_dir() or preview_location.is_link_like(top):
-        return left
-    # Top-down, pruning every link, junction or reparse point, then bottom-up:
-    # never into a folder outside *top* (Windows junctions included).
-    folders = []
-    for folder, dirs, _files in os.walk(top):
-        folder = Path(folder)
-        dirs[:] = [d for d in dirs if not preview_location.is_link_like(folder / d)]
-        folders.append(folder)
-    for folder in reversed(folders):
-        if folder == top and keep_top:
-            continue
-        try:
-            names = os.listdir(folder)
-        except OSError:
-            left.append(folder)
-            continue
-        if names and all(is_os_metadata(name) for name in names):
-            for name in names:
-                remove_file(folder / name)
-        try:
-            os.rmdir(folder)
-        except OSError:
-            left.append(folder)
-    return left