foundation: full control really does turn the guards off, and the graph is reachable

Full control did half of what it said and never said which half. It disabled
the mid-run crash guard and left every value refusal in place, so the stated
purpose -- a one-step schedule, a width the model cannot use, let them and
warn -- did not work. Worse, a rejected value was quietly replaced by the
default, so asking for 999 gave 0.4 with a warning about 999.

Now one switch turns off both: the value is passed through, every problem is
said as a warning naming that the consequences are the user's, and a run made
without the guards is identifiable as one afterwards. A key NO module
declares is still never kept, whatever the setting -- nothing reads it, so
keeping it cannot honour the request, only disguise the typo.

core/graph.py was thoroughly tested and called from nowhere: the claim that
a built-in node can be replaced or removed was a property of a library
nothing invoked. It has routes now, and tests that drive them over a real
socket -- the modifiers node removed and the sampler rewired, the VAE loader
swapped for core's, and both refusals coming back as reasons.

Those routes separate two things the old shape conflated. "refused" means
the edit did not happen. "incomplete" means it did and the pipeline still is
not ready -- an unset file picker on a fresh install is the normal case, not
a failed edit, and showing them together would say the wrong thing about both.

And build() could not see a missing REQUIRED input at all, because the
schema lookup flattened required and optional into one dict. A slot with no
model file built clean and failed only once queued.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tools/devserver.py

@@ -71,6 +71,19 @@ from core import config, routes, serve as static  # noqa: E402
 P = config.UI_PREFIX
 
 
+def _pipeline_payload():
+    """The same answer the aiohttp route gives, so the preview shows what
+    ComfyUI would."""
+    from core import graph as graph_mod
+    slots = []
+    for _spec, make in routes.modules().providers("default_pipeline"):
+        slots = make()
+        break
+    prompt, incomplete = graph_mod.build(slots)
+    return {"slots": slots, "refused": [], "incomplete": incomplete,
+            "queueable": not incomplete}
+
+
 class Handler(BaseHTTPRequestHandler):
     def do_GET(self):
         parsed = urlparse(self.path)
@@ -78,7 +91,10 @@ class Handler(BaseHTTPRequestHandler):
 
         # The same manifest the aiohttp route serves, so what you see in the
         # browser here is what ComfyUI would send.
-        if path == P + "/api/log":
+        if path == P + "/api/pipeline":
+            body = json.dumps(_pipeline_payload()).encode()
+            served = static.Served(200, body, "application/json")
+        elif path == P + "/api/log":
             query = parse_qs(parsed.query)
             level = (query.get("level") or [None])[0]
             body = json.dumps({"levels": list(routes.log.LEVELS),