Merge pull request 'v26.05.24.1: FC-3g Firefox extension + worker resilience + UI/migration fixes' (#7) from dev into main

pg_dump + zstd in runtime image, lift Quart body cap to 1 GiB. See PR #2.

.forgejo/workflows/build.yml

@@ -2,272 +2,27 @@ name: Build images
 
 on:
   push:
-    # `:dev` builds dropped 2026-05-26 — operator tests from `:latest` after
-    # merge-to-main, not from the dev branch image. Saves one full docker
-    # build per dev push.
-    branches: [main]
-    # Tag-push triggers an immutable per-version image build (e.g.
-    # `:v26.05.26.5`) — gives a real rollback story alongside the floating
-    # `:main` / `:latest`. Layer reuse keeps the registry-storage cost
-    # negligible per tag. Doesn't overlap with the push-to-main build (that
-    # one publishes `:main` + `:latest`; the tag-push build publishes only
-    # `:<tag>`).
-    tags: ['v*']
+    branches: [dev, main]
 
 # Requires repo secret RELEASE_TOKEN — a Forgejo PAT with scopes:
 #   - write:package, read:package  (for docker push to git.fabledsword.com)
-#   - write:release                (for ext-<version> release asset cache)
+#   - write:release                (for future release-cutting workflows)
 #   - write:issue                  (for future issue-management automation)
 # The injected GITHUB_TOKEN cannot be used — it lacks write:package.
 
 jobs:
-  # Sign-or-fetch-from-cache: signs the extension via AMO if no ext-<version>
-  # Forgejo release exists yet, otherwise downloads the cached signed XPI.
-  # Result is uploaded as an Actions artifact for build-web to consume.
-  #
-  # Why this lives in build.yml (not a separate workflow): the merge-commit's
-  # docker image tagged `:latest` MUST carry the XPI. A separate sign workflow
-  # racing build.yml leaves `:latest` without the XPI for ~5min (until the
-  # commit-back triggers another build). Inline ordering eliminates the race.
-  # Cache strategy: Forgejo Release Assets — picked 2026-05-25 over Generic
-  # Packages (cleaner API surface) and commit-back-to-side-branch (no extra
-  # branch to manage). AMO blocks re-signing the same version (returns 409),
-  # so signing is intentionally one-shot per version bump.
-  sign-extension:
-    if: github.ref == 'refs/heads/main'
-    runs-on: python-ci
-    container:
-      image: git.fabledsword.com/bvandeusen/ci-python:3.14
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Resolve extension version
-        id: extver
-        run: |
-          VERSION=$(grep -E '"version"' extension/package.json | head -1 | sed -E 's/.*"version"[[:space:]]*:[[:space:]]*"([^"]+)".*/\1/')
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-          echo "Resolved extension version: $VERSION"
-
-      - name: Check Forgejo release-asset cache
-        id: cache
-        env:
-          TOKEN: ${{ secrets.RELEASE_TOKEN }}
-        run: |
-          set -eu
-          VERSION=${{ steps.extver.outputs.version }}
-          STATUS=$(curl -s -o release.json -w "%{http_code}" \
-            -H "Authorization: token $TOKEN" \
-            "https://git.fabledsword.com/api/v1/repos/bvandeusen/FabledCurator/releases/tags/ext-$VERSION" || echo 000)
-          echo "Tag lookup HTTP status: $STATUS"
-          # JSON parsing via python (ci-python:3.14 has stdlib json; jq is
-          # not in the image and adding it per ci-requirements.md is not
-          # warranted for a single consumer — operator-flagged 2026-05-26
-          # after a sign job failed with `jq: not found`).
-          if [ "$STATUS" = "200" ]; then
-            ASSET_ID=$(python3 -c "import json; r=json.load(open('release.json')); xpis=[a for a in r.get('assets', []) if a.get('name','').endswith('.xpi')]; print(xpis[0]['id'] if xpis else '')")
-            if [ -n "$ASSET_ID" ]; then
-              echo "cached=true" >> "$GITHUB_OUTPUT"
-              echo "asset_id=$ASSET_ID" >> "$GITHUB_OUTPUT"
-              echo "Cached XPI exists at ext-$VERSION (asset id $ASSET_ID); skipping AMO sign"
-            else
-              echo "cached=false" >> "$GITHUB_OUTPUT"
-              echo "Release ext-$VERSION exists but has no .xpi asset; will re-sign + re-upload"
-            fi
-          else
-            echo "cached=false" >> "$GITHUB_OUTPUT"
-            echo "No release named ext-$VERSION; will sign via AMO and upload"
-          fi
-
-      # No "download cached XPI in sign-extension" step: build-web
-      # fetches directly from the Forgejo ext-<version> release asset
-      # (removed 2026-05-26 alongside the actions/upload-artifact
-      # removal — sign-extension's job is just to ensure the cache
-      # exists on Forgejo; the build-web side reads it independently).
-
-      - name: Sign via AMO (cache miss)
-        if: steps.cache.outputs.cached != 'true'
-        run: |
-          cd extension && npm install --no-save --no-audit --no-fund && npm run sign
-        env:
-          WEB_EXT_API_KEY: ${{ secrets.MOZILLA_AMO_JWT_KEY }}
-          WEB_EXT_API_SECRET: ${{ secrets.MOZILLA_AMO_JWT_SECRET }}
-
-      - name: Upload signed XPI to ext-<version> release (cache miss)
-        if: steps.cache.outputs.cached != 'true'
-        env:
-          TOKEN: ${{ secrets.RELEASE_TOKEN }}
-        run: |
-          set -eux
-          VERSION=${{ steps.extver.outputs.version }}
-          # AMO renames signed XPIs with its internal addon-id-safe-string;
-          # canonicalize to fabledcurator-<version>.xpi so the FC server's
-          # whitelist (backend/app/frontend.py expects 'fabledcurator-*.xpi')
-          # keeps working.
-          SIGNED=$(ls extension/web-ext-artifacts/*.xpi | head -1)
-          XPI="extension/web-ext-artifacts/fabledcurator-$VERSION.xpi"
-          cp "$SIGNED" "$XPI"
-          # Find-or-create the ext-<version> release. Track whether WE
-          # created it so an upload failure below can roll back (don't
-          # leave an empty release tombstone that the next run's
-          # cache-check mistakes for a partial-failure state).
-          STATUS=$(curl -s -o release.json -w "%{http_code}" \
-            -H "Authorization: token $TOKEN" \
-            "https://git.fabledsword.com/api/v1/repos/bvandeusen/FabledCurator/releases/tags/ext-$VERSION" || echo 000)
-          if [ "$STATUS" = "200" ]; then
-            CREATED_BY_US=false
-          else
-            curl -s -X POST -H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
-              -d "{\"tag_name\":\"ext-$VERSION\",\"name\":\"Extension $VERSION (signed XPI cache)\",\"body\":\"Internal cache for the signed XPI consumed by build.yml's build-web job. Not a user-facing FC release.\",\"target_commitish\":\"main\"}" \
-              -o release.json \
-              "https://git.fabledsword.com/api/v1/repos/bvandeusen/FabledCurator/releases"
-            CREATED_BY_US=true
-          fi
-          RELEASE_ID=$(python3 -c "import json; print(json.load(open('release.json'))['id'])")
-          test -n "$RELEASE_ID"
-          # Rollback-on-failure: if the asset upload fails AND we just
-          # created the release in this run, delete it. Prevents an empty
-          # ext-<version> release from poisoning the next workflow run
-          # (operator-flagged 2026-05-26 — without rollback the next run
-          # saw 'release exists, no asset → cache miss → sign' which AMO
-          # then rejected with 409 'Version already exists').
-          rollback_if_we_created() {
-            if [ "$CREATED_BY_US" = "true" ]; then
-              echo "Rolling back: deleting just-created release $RELEASE_ID"
-              curl -s -X DELETE -H "Authorization: token $TOKEN" \
-                "https://git.fabledsword.com/api/v1/repos/bvandeusen/FabledCurator/releases/$RELEASE_ID" || true
-              curl -s -X DELETE -H "Authorization: token $TOKEN" \
-                "https://git.fabledsword.com/api/v1/repos/bvandeusen/FabledCurator/tags/ext-$VERSION" || true
-            fi
-          }
-          trap 'rollback_if_we_created' EXIT
-          HTTP_CODE=$(curl -s -X POST -H "Authorization: token $TOKEN" \
-            -F "attachment=@$XPI" \
-            -o /dev/null -w "%{http_code}" \
-            "https://git.fabledsword.com/api/v1/repos/bvandeusen/FabledCurator/releases/$RELEASE_ID/assets?name=fabledcurator-$VERSION.xpi")
-          if [ "$HTTP_CODE" != "201" ] && [ "$HTTP_CODE" != "200" ]; then
-            echo "Asset upload failed with HTTP $HTTP_CODE"
-            exit 1
-          fi
-          # Upload succeeded — clear the rollback trap.
-          trap - EXIT
-          echo "Uploaded fabledcurator-$VERSION.xpi to ext-$VERSION release"
-
-      # No actions/upload-artifact step: Forgejo Actions (and our
-       # act_runner) doesn't support upload-artifact@v4+ (GHES limitation
-       # surfaced 2026-05-26). Instead build-web reads the signed XPI
-       # straight from the ext-<version> Forgejo release we just uploaded
-       # to. Same source of truth; no double-store.
-
   build-web:
-    needs: [sign-extension]
-    # sign-extension is main-only; on dev it's skipped, build-web still runs.
-    if: always() && (needs.sign-extension.result == 'success' || needs.sign-extension.result == 'skipped')
     runs-on: python-ci
     container:
       image: git.fabledsword.com/bvandeusen/ci-python:3.14
     steps:
       - uses: actions/checkout@v4
 
-      - name: Download signed XPI from Forgejo release asset (main + tags)
-        # Fires on main-push AND on tag-push. Tag-push builds re-package the
-        # same source code as the preceding main-push build but with an
-        # immutable version tag — they need the XPI too, otherwise the
-        # versioned image ships without the signed extension.
-        #
-        # Tag-push vs main-push race (operator-flagged 2026-05-27 after
-        # v26.05.27.0 hit it): a release cut fires BOTH workflows almost
-        # simultaneously. Main-push runs sign-extension (1-5min AMO round
-        # trip) before publishing the ext-<version> release; tag-push
-        # skips sign-extension (gated to main) and races straight to
-        # this download step. Tag-push lost every time. Fix: poll the
-        # ext-<version> release endpoint with a sleep+retry loop (30s
-        # for up to 10min total) before giving up. Main-push's signing
-        # eventually wins and tag-push picks the release up on a later
-        # iteration.
-        if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')
-        env:
-          TOKEN: ${{ secrets.RELEASE_TOKEN }}
-        run: |
-          set -eux
-          VERSION=$(grep -E '"version"' extension/package.json | head -1 | sed -E 's/.*"version"[[:space:]]*:[[:space:]]*"([^"]+)".*/\1/')
-          # Poll for the ext-<version> release. main-push's sign-extension
-          # step (AMO round-trip, 1-5min) needs to finish + upload before
-          # tag-push can fetch. 30s * 20 = up to 10min wait, then hard-fail.
-          for attempt in $(seq 1 20); do
-            STATUS=$(curl -s -o release.json -w "%{http_code}" \
-              -H "Authorization: token $TOKEN" \
-              "https://git.fabledsword.com/api/v1/repos/bvandeusen/FabledCurator/releases/tags/ext-$VERSION" || echo 000)
-            if [ "$STATUS" = "200" ]; then
-              echo "Found ext-$VERSION release on attempt $attempt"
-              break
-            fi
-            if [ "$attempt" = "20" ]; then
-              echo "ERROR: ext-$VERSION release not available after 10min of polling"
-              echo "Last HTTP status: $STATUS"
-              exit 1
-            fi
-            echo "Attempt $attempt: ext-$VERSION not yet published (HTTP $STATUS); sleeping 30s"
-            sleep 30
-          done
-          # Extract the .xpi asset's browser_download_url (Forgejo's
-          # /releases/assets/<id> endpoint returns ASSET METADATA, not
-          # the binary blob — operator-flagged 2026-05-26: my prior
-          # code curl'd the metadata endpoint without -f and wrote the
-          # resulting 404-page-not-found text into fabledcurator-*.xpi,
-          # which Firefox then rejected as "corrupt").
-          # browser_download_url is the canonical binary endpoint and
-          # is also publicly accessible (no token needed) but we pass
-          # the token anyway for symmetry with private-repo support.
-          DOWNLOAD_URL=$(python3 -c "import json; r=json.load(open('release.json')); xpis=[a for a in r.get('assets', []) if a.get('name','').endswith('.xpi')]; print(xpis[0]['browser_download_url'])")
-          test -n "$DOWNLOAD_URL"
-          echo "Downloading XPI from: $DOWNLOAD_URL"
-          mkdir -p frontend/public/extension
-          DEST="frontend/public/extension/fabledcurator-$VERSION.xpi"
-          # -f = fail on HTTP error (prevents silent corruption like the
-          # 2026-05-26 incident); -L = follow redirects.
-          curl -sfL -H "Authorization: token $TOKEN" -o "$DEST" "$DOWNLOAD_URL"
-          # Sanity check: the binary should start with the ZIP magic (PK\x03\x04).
-          # If it's anything else, the next docker build will ship a corrupt XPI.
-          MAGIC=$(head -c 2 "$DEST" | od -An -c | tr -d ' \n')
-          if [ "$MAGIC" != "PK" ]; then
-            echo "ERROR: downloaded XPI does not start with ZIP magic 'PK' (got '$MAGIC')"
-            echo "File contents preview:"
-            head -c 200 "$DEST"
-            exit 1
-          fi
-          cp "$DEST" "frontend/public/extension/fabledcurator-latest.xpi"
-          ls -la frontend/public/extension/
-
       - name: Determine tag
         id: tag
         run: |
-          # Three trigger shapes:
-          #   refs/tags/v…   → tag-push: opt-in milestone label (vYY.MM.DD,
-          #                    no `.N` per family release-posture rule).
-          #                    Publish ONLY the immutable version tag;
-          #                    don't touch :latest (the main-push build
-          #                    for the merge commit already did that).
-          #   refs/heads/main → push to main: publish :main + :latest
-          #                    (floating) AND :c-<short_sha> (immutable
-          #                    per-commit rollback substrate, per family
-          #                    release-posture rule "Tags are milestones,
-          #                    not gates — commit-SHA images are the
-          #                    rollback unit"). Rollback to any commit
-          #                    becomes `docker pull …:c-<sha>` without a
-          #                    release ceremony.
-          #   anything else  → safety net; shouldn't fire given the `on:`
-          #                    config above. Tag :dev to surface the
-          #                    unexpected run in the registry.
-          # POSIX-safe substring (the runner shell is dash/BusyBox sh, not
-          # bash — `${var:0:7}` errors with "Bad substitution"; cut works
-          # everywhere). Operator-flagged 2026-06-01 after first :c-<sha>
-          # main-push build failed at this step.
-          SHORT_SHA=$(printf '%s' "$GITHUB_SHA" | cut -c1-7)
-          if [ "${GITHUB_REF#refs/tags/}" != "${GITHUB_REF}" ]; then
-            TAG_NAME="${GITHUB_REF#refs/tags/}"
-            echo "tags=git.fabledsword.com/bvandeusen/fabledcurator:${TAG_NAME}" >> "$GITHUB_OUTPUT"
-          elif [ "${GITHUB_REF##*/}" = "main" ]; then
-            echo "tags=git.fabledsword.com/bvandeusen/fabledcurator:main,git.fabledsword.com/bvandeusen/fabledcurator:latest,git.fabledsword.com/bvandeusen/fabledcurator:c-${SHORT_SHA}" >> "$GITHUB_OUTPUT"
+          if [ "${GITHUB_REF##*/}" = "main" ]; then
+            echo "tags=git.fabledsword.com/bvandeusen/fabledcurator:main,git.fabledsword.com/bvandeusen/fabledcurator:latest" >> "$GITHUB_OUTPUT"
           else
             echo "tags=git.fabledsword.com/bvandeusen/fabledcurator:dev" >> "$GITHUB_OUTPUT"
           fi
@@ -297,20 +52,8 @@ jobs:
       - name: Determine tag
         id: tag
         run: |
-          # Mirrors build-web's three-shape logic (tag-push / main-push /
-          # safety-net dev) including the per-commit :c-<short_sha> tag
-          # on main-push per the family release-posture rule. The -ml
-          # image follows the same release cadence as the web image.
-          # POSIX-safe substring (the runner shell is dash/BusyBox sh, not
-          # bash — `${var:0:7}` errors with "Bad substitution"; cut works
-          # everywhere). Operator-flagged 2026-06-01 after first :c-<sha>
-          # main-push build failed at this step.
-          SHORT_SHA=$(printf '%s' "$GITHUB_SHA" | cut -c1-7)
-          if [ "${GITHUB_REF#refs/tags/}" != "${GITHUB_REF}" ]; then
-            TAG_NAME="${GITHUB_REF#refs/tags/}"
-            echo "tags=git.fabledsword.com/bvandeusen/fabledcurator-ml:${TAG_NAME}" >> "$GITHUB_OUTPUT"
-          elif [ "${GITHUB_REF##*/}" = "main" ]; then
-            echo "tags=git.fabledsword.com/bvandeusen/fabledcurator-ml:main,git.fabledsword.com/bvandeusen/fabledcurator-ml:latest,git.fabledsword.com/bvandeusen/fabledcurator-ml:c-${SHORT_SHA}" >> "$GITHUB_OUTPUT"
+          if [ "${GITHUB_REF##*/}" = "main" ]; then
+            echo "tags=git.fabledsword.com/bvandeusen/fabledcurator-ml:main,git.fabledsword.com/bvandeusen/fabledcurator-ml:latest" >> "$GITHUB_OUTPUT"
           else
             echo "tags=git.fabledsword.com/bvandeusen/fabledcurator-ml:dev" >> "$GITHUB_OUTPUT"
           fi

.forgejo/workflows/ci.yml

@@ -1,34 +1,17 @@
 name: CI
 
 # CI lanes per FabledRulebook/forgejo.md "CI philosophy":
-#   - lint: ruff only, no dep install — fast-fail for the common lint bounce.
-#   - backend-lint-and-test: `pytest -m "not integration"`, no service containers.
+#   - backend-lint-and-test: ruff + `pytest -m "not integration"`, no service containers.
 #   - frontend-build: vitest unit + vite build.
 #   - integration: pgvector + redis service containers; alembic + `pytest -m integration`.
 
 on:
   push:
     branches: [dev, main]
-  # pull_request trigger intentionally absent — with branches: [dev, main]
-  # above, every PR commit already fires CI via the push event on dev. Adding
-  # pull_request would duplicate runs on dev→main PRs. FC has no fork PRs
-  # (single-operator Forgejo repo) so push coverage is complete.
+  pull_request:
+    branches: [main]
 
 jobs:
-  # Fast-fail lint lane. ruff is pre-installed in the ci-python image, so
-  # this runs with NO dependency install and surfaces the most common bounce
-  # class (lint: I001 / UP037 / ASYNC109 / W293 …) in seconds — instead of
-  # after the backend job's ~30-60s wheel install. ruff is static analysis,
-  # so no DB/secret env is needed.
-  lint:
-    runs-on: python-ci
-    container:
-      image: git.fabledsword.com/bvandeusen/ci-python:3.14
-    steps:
-      - uses: actions/checkout@v4
-      - name: Ruff lint
-        run: ruff check backend/ tests/ alembic/
-
   backend-lint-and-test:
     runs-on: python-ci
     container:
@@ -41,33 +24,15 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      # Cache step removed 2026-05-26: act_runner's cache backend has been
-      # broken on this homelab runner since 2026-05-15 (first as request-
-      # timeout warnings, then as hard "Cannot find module .../dist/restore/
-      # index.js" failures that tank the whole job). The cache step targeted
-      # ~/.cache/pip but the install below uses `uv pip install` primarily,
-      # whose own cache lives at ~/.cache/uv — so the cache step's real
-      # benefit was marginal even when working. Cost of removal: ~30s of
-      # wheel downloads per job. Future re-enable: mount ~/.cache/uv as a
-      # docker volume at the runner level (skips actions/cache entirely),
-      # or fix the runner-side cache backend (clear /var/run/act/actions/*,
-      # pin act_runner version, etc.).
-
       - name: Install Python deps
         # ruff is pre-installed in the ci-python image (see CI-Runner/CI-python/
         # Dockerfile's RUFF_VERSION). Per FabledRulebook ci-runners.md, toolchain
         # versions live on the runner image, not here.
-        # uv: 5-10x faster wheel resolve than pip for cold caches.
-        # Falls back to pip install on uv-missing runners (older images).
-        run: |
-          if command -v uv >/dev/null 2>&1; then
-            uv pip install --system -r requirements.txt pytest pytest-asyncio
-          else
-            pip install -r requirements.txt pytest pytest-asyncio
-          fi
+        run: pip install -r requirements.txt pytest pytest-asyncio
+
+      - name: Ruff lint
+        run: ruff check backend/ tests/ alembic/
 
-      # Ruff moved to the dedicated fast `lint` job above (fails in seconds,
-      # no dep install). This job is now unit tests only.
       - name: Pytest (unit only — integration runs in the integration job)
         run: pytest tests/ -v -m "not integration"
 
@@ -92,25 +57,17 @@ jobs:
       - run: npm run test:unit
       - run: npm run build
 
-  # Single integration job — collapsed from a 3-way shard split on 2026-06-04.
-  # The shards existed to parallelize ~8.5min of integration tests; once the
-  # throwaway Postgres runs with fsync OFF (the durability step below) the whole
-  # suite runs in ~45s, so the split only triplicated the ~2min fixed overhead
-  # (container + `uv pip install` + `alembic upgrade head`) and burned 3 of 6
-  # runner slots for no wall-clock gain. One job now: spin up once, install
-  # once, migrate once, run every integration test.
-  #
-  # The docker-ps filter scopes to THIS job's own Postgres/Redis service
-  # containers by job name. act_runner strips underscores from job names when
-  # labelling containers (`int_api` matched nothing on 2026-05-25), so the name
-  # stays separator-free (`integration`). The step prints `docker ps -a` first
-  # so a future naming-convention shift surfaces in the log without a
-  # guess-and-push cycle.
-  #
-  # Pre-baking requirements.txt into ci-python:3.14 is intentionally NOT done —
-  # per ci-requirements.md, FC is the only Python consumer of that image and the
-  # CI-Runner "add deps to image when used by >1 project" rule keeps it per-job.
   integration:
+    # This act_runner (swarm-runner v0.6.1) puts service containers on the
+    # default bridge with NO service-name DNS, and publishing fixed host
+    # ports collides with the operator's running docker-compose dev stack on
+    # the same shared daemon. Workaround: publish NO host ports, and reach
+    # each service by its bridge IP — discovered at runtime via the mounted
+    # docker socket (the ci-python image ships /usr/bin/docker). Default-bridge
+    # containers can talk by IP (only embedded DNS is missing), so IP
+    # addressing is reliable here. Everything runs in ONE step so resolved
+    # values don't depend on cross-step env passing. Pattern documented in
+    # FabledRulebook/forgejo.md "CI philosophy".
     runs-on: python-ci
     container:
       image: git.fabledsword.com/bvandeusen/ci-python:3.14
@@ -141,14 +98,15 @@ jobs:
           --health-retries 10
     steps:
       - uses: actions/checkout@v4
+
       - name: Integration suite (resolve service IPs, migrate, test)
         run: |
           set -eux
-          echo "=== container landscape (diagnostic for filter scoping) ==="
-          docker ps -a --format '{{.ID}} {{.Image}} -> {{.Names}}'
-          echo "=== end landscape ==="
-          PG=$(docker ps --filter "name=integration" --filter "ancestor=pgvector/pgvector:pg16" -q | head -n1)
-          RD=$(docker ps --filter "name=integration" --filter "ancestor=redis:7-alpine" -q | head -n1)
+          # Scope to THIS job's service containers (act_runner names them
+          # ...JOB-integration...); the operator's compose stack uses the
+          # same images but different names, so it won't match.
+          PG=$(docker ps --filter "name=JOB-integration" --filter "ancestor=pgvector/pgvector:pg16" -q | head -n1)
+          RD=$(docker ps --filter "name=JOB-integration" --filter "ancestor=redis:7-alpine" -q | head -n1)
           test -n "$PG" && test -n "$RD"
           PG_IP=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$PG")
           RD_IP=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$RD")
@@ -156,23 +114,11 @@ jobs:
           export DB_HOST="$PG_IP"
           export CELERY_BROKER_URL="redis://$RD_IP:6379/0"
           export CELERY_RESULT_BACKEND="redis://$RD_IP:6379/0"
+          # Wait for Postgres to accept TCP (bash /dev/tcp; no extra tools).
           for i in $(seq 1 60); do
             (echo > "/dev/tcp/$PG_IP/5432") >/dev/null 2>&1 && break
             sleep 2
           done
-          if command -v uv >/dev/null 2>&1; then
-            uv pip install --system -r requirements.txt pytest pytest-asyncio
-          else
-            pip install -r requirements.txt pytest pytest-asyncio
-          fi
-          # Relax durability on the throwaway CI Postgres so the per-test
-          # TRUNCATE's commit-fsync — the integration teardown's dominant cost
-          # (~1.5-2s/test, which collapsed the suite from ~13min to ~45s) — is
-          # skipped. fsync/full_page_writes are sighup GUCs and synchronous_commit
-          # is user-context, so ALTER SYSTEM + pg_reload_conf() applies them with
-          # NO restart. Ephemeral DB ⇒ fsync-off is safe. Non-fatal so a perms
-          # surprise can't red the job; fabledcurator is the postgres image's
-          # bootstrap superuser.
-          python -c "import os,psycopg; c=psycopg.connect(host=os.environ['DB_HOST'],port=5432,user=os.environ['DB_USER'],password=os.environ['DB_PASSWORD'],dbname=os.environ['DB_NAME'],autocommit=True); [c.execute(q) for q in ('ALTER SYSTEM SET fsync=off','ALTER SYSTEM SET synchronous_commit=off','ALTER SYSTEM SET full_page_writes=off','SELECT pg_reload_conf()')]; c.close()" || echo 'WARN: durability GUC relax failed (continuing)'
+          pip install -r requirements.txt pytest pytest-asyncio
           alembic upgrade head
-          pytest tests/ -v -m integration --durations=15
+          pytest tests/ -v -m integration

.forgejo/workflows/extension.yml

@@ -1,19 +1,8 @@
 name: extension
-# Lint-only workflow. The sign-and-publish dance moved into build.yml's
-# `sign-extension` job (2026-05-25) — `:latest` now always bundles the XPI
-# because sign-extension runs as a build-web dependency in the SAME workflow,
-# eliminating the prior race between build.yml and a separate extension.yml.
-# Signed XPIs are cached in Forgejo Release Assets named `ext-<version>`.
 on:
   push:
     branches: [dev, main]
-    paths:
-      - 'extension/**'
-      - '.forgejo/workflows/extension.yml'
-  pull_request:
-    branches: [main]
-    paths:
-      - 'extension/**'
+    paths: ['extension/**']
   workflow_dispatch:
 
 jobs:
@@ -27,3 +16,44 @@ jobs:
         run: cd extension && npm install --no-save --no-audit --no-fund
       - name: Lint
         run: cd extension && npm run lint
+
+  sign-and-publish:
+    needs: lint
+    if: github.ref == 'refs/heads/main'
+    runs-on: python-ci
+    container:
+      image: node:22-bookworm-slim
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.RELEASE_TOKEN }}
+      - name: Install web-ext + git
+        run: |
+          apt-get update && apt-get install -y --no-install-recommends git ca-certificates
+          cd extension && npm install --no-save --no-audit --no-fund
+      - name: Sign XPI
+        run: cd extension && npm run sign
+        env:
+          WEB_EXT_API_KEY: ${{ secrets.MOZILLA_AMO_JWT_KEY }}
+          WEB_EXT_API_SECRET: ${{ secrets.MOZILLA_AMO_JWT_SECRET }}
+      - name: Commit signed XPI to frontend/public/extension/
+        run: |
+          set -e
+          XPI=$(ls extension/web-ext-artifacts/fabledcurator-*.xpi | head -1)
+          if [ -z "$XPI" ]; then
+            echo "No XPI produced by web-ext sign — exiting"
+            exit 1
+          fi
+          mkdir -p frontend/public/extension
+          cp "$XPI" frontend/public/extension/
+          # Also copy as -latest.xpi so the FC server can serve a stable URL.
+          cp "$XPI" "frontend/public/extension/fabledcurator-latest.xpi"
+          git config user.name  "FC extension CI"
+          git config user.email "noreply@fabledsword.com"
+          git add frontend/public/extension/
+          if git diff --cached --quiet; then
+            echo "No changes to commit"
+          else
+            git commit -m "ext: publish signed XPI $(basename $XPI)"
+            git push origin HEAD:main
+          fi

.gitignore

@@ -61,9 +61,6 @@ Thumbs.db
 
 # Claude Code per-user local overrides (shared .claude/settings.json is OK to commit)
 .claude/settings.local.json
-# Transient scheduler lock/state (committed by accident in 3f30327)
-.claude/scheduled_tasks.lock
-.claude/scheduled_tasks*.json
 
 # Alembic / DB scratch
 alembic/versions/__pycache__/

alembic/env.py

@@ -2,21 +2,12 @@
 
 from logging.config import fileConfig
 
-from sqlalchemy import engine_from_config, pool, text
+from sqlalchemy import engine_from_config, pool
 
 from alembic import context
 from backend.app.config import get_config
 from backend.app.models import Base
 
-# Arbitrary fixed 64-bit key for the session/transaction advisory lock that
-# serializes concurrent `alembic upgrade head` runs. Every `web` replica runs
-# migrations in its entrypoint, so under `docker stack deploy` two replicas can
-# boot at once and race the same DDL — duplicate CREATE TABLE, then a crashed
-# replica (operator-flagged 2026-06-07: 0040 raced; one backend died with
-# AdminShutdown). The first replica to reach the lock migrates; the rest block,
-# then find the version table already at head and apply nothing.
-_MIGRATION_LOCK_KEY = 0xFCA1E35C
-
 config = context.config
 
 if config.config_file_name is not None:
@@ -53,18 +44,6 @@ def run_migrations_online() -> None:
             compare_type=True,
         )
         with context.begin_transaction():
-            # Serialize concurrent migrators (see _MIGRATION_LOCK_KEY). A
-            # transaction-scoped advisory lock: the first replica to get here
-            # holds it for the whole upgrade and is auto-released when this
-            # transaction ends. A sibling replica blocks on this line, and only
-            # once the leader commits does it proceed to read the version table
-            # — now at head — so it runs zero migrations instead of re-applying
-            # the same DDL. The lock is acquired BEFORE run_migrations() reads
-            # the current revision, which is what makes the no-op correct.
-            connection.execute(
-                text("SELECT pg_advisory_xact_lock(:k)"),
-                {"k": _MIGRATION_LOCK_KEY},
-            )
             context.run_migrations()
 
 

alembic/versions/0016_fc3i_task_run.py

@@ -1,86 +0,0 @@
-"""fc3i: task_run table
-
-Revision ID: 0016
-Revises: 0015
-Create Date: 2026-05-24
-
-Additive only. New table records every Celery task attempt via signal
-handlers (backend.app.celery_signals). Status is plain String(16) not
-Postgres ENUM (per feedback_check_existing_enums: ENUM columns hard-
-fail at INSERT, String columns extend cleanly).
-
-Composite indexes anticipate the three dashboard panes:
-- (queue, started_at desc)   — per-lane recent activity
-- (status, started_at desc)  — recent failures pane
-- (task_name, started_at desc) — drill-down by task
-
-Indexed columns get individual indexes via `index=True` on the model;
-the composites below cover the multi-column lookups.
-"""
-from typing import Sequence, Union
-
-import sqlalchemy as sa
-from alembic import op
-
-revision: str = "0016"
-down_revision: Union[str, None] = "0015"
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
-
-
-def upgrade() -> None:
-    op.create_table(
-        "task_run",
-        sa.Column("id", sa.Integer(), primary_key=True),
-        sa.Column("celery_task_id", sa.String(length=64), nullable=False),
-        sa.Column("queue", sa.String(length=32), nullable=False),
-        sa.Column("task_name", sa.String(length=128), nullable=False),
-        sa.Column("target_id", sa.Integer(), nullable=True),
-        sa.Column("started_at", sa.DateTime(timezone=True), nullable=False),
-        sa.Column("finished_at", sa.DateTime(timezone=True), nullable=True),
-        sa.Column("duration_ms", sa.Integer(), nullable=True),
-        sa.Column(
-            "status", sa.String(length=16), nullable=False,
-            server_default="running",
-        ),
-        sa.Column("error_type", sa.String(length=128), nullable=True),
-        sa.Column("error_message", sa.Text(), nullable=True),
-        sa.Column("retry_count", sa.Integer(), nullable=True),
-        sa.Column("worker_hostname", sa.String(length=128), nullable=True),
-        sa.Column("args_summary", sa.String(length=255), nullable=True),
-    )
-
-    # Single-column indexes (matches Mapped[...].index=True on model).
-    op.create_index("ix_task_run_celery_task_id", "task_run", ["celery_task_id"])
-    op.create_index("ix_task_run_queue", "task_run", ["queue"])
-    op.create_index("ix_task_run_task_name", "task_run", ["task_name"])
-    op.create_index("ix_task_run_started_at", "task_run", ["started_at"])
-    op.create_index("ix_task_run_finished_at", "task_run", ["finished_at"])
-    op.create_index("ix_task_run_status", "task_run", ["status"])
-
-    # Composite indexes for dashboard query patterns.
-    op.create_index(
-        "ix_task_run_queue_started",
-        "task_run", ["queue", sa.text("started_at DESC")],
-    )
-    op.create_index(
-        "ix_task_run_status_started",
-        "task_run", ["status", sa.text("started_at DESC")],
-    )
-    op.create_index(
-        "ix_task_run_name_started",
-        "task_run", ["task_name", sa.text("started_at DESC")],
-    )
-
-
-def downgrade() -> None:
-    op.drop_index("ix_task_run_name_started", table_name="task_run")
-    op.drop_index("ix_task_run_status_started", table_name="task_run")
-    op.drop_index("ix_task_run_queue_started", table_name="task_run")
-    op.drop_index("ix_task_run_status", table_name="task_run")
-    op.drop_index("ix_task_run_finished_at", table_name="task_run")
-    op.drop_index("ix_task_run_started_at", table_name="task_run")
-    op.drop_index("ix_task_run_task_name", table_name="task_run")
-    op.drop_index("ix_task_run_queue", table_name="task_run")
-    op.drop_index("ix_task_run_celery_task_id", table_name="task_run")
-    op.drop_table("task_run")

alembic/versions/0017_fc3h_backup_run.py

@@ -1,82 +0,0 @@
-"""fc3h: backup_run table
-
-Revision ID: 0017
-Revises: 0016
-Create Date: 2026-05-24
-
-Additive. New table records every backup/restore attempt with artifact
-metadata. Lifecycle tracking lives in task_run from FC-3i; this is
-artifact-only (paths, sizes, tag, restore lineage).
-"""
-from typing import Sequence, Union
-
-import sqlalchemy as sa
-from alembic import op
-
-revision: str = "0017"
-down_revision: Union[str, None] = "0016"
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
-
-
-def upgrade() -> None:
-    op.create_table(
-        "backup_run",
-        sa.Column("id", sa.Integer(), primary_key=True),
-        sa.Column("kind", sa.String(length=16), nullable=False),
-        sa.Column(
-            "status", sa.String(length=16), nullable=False,
-            server_default="pending",
-        ),
-        sa.Column("tag", sa.String(length=64), nullable=True),
-        sa.Column("triggered_by", sa.String(length=32), nullable=False),
-        sa.Column("started_at", sa.DateTime(timezone=True), nullable=False),
-        sa.Column("finished_at", sa.DateTime(timezone=True), nullable=True),
-        sa.Column("sql_path", sa.Text(), nullable=True),
-        sa.Column("tar_path", sa.Text(), nullable=True),
-        sa.Column("size_bytes", sa.BigInteger(), nullable=True),
-        sa.Column("error", sa.Text(), nullable=True),
-        sa.Column(
-            "manifest", sa.JSON(), nullable=False, server_default="{}",
-        ),
-        sa.Column(
-            "restored_from_id", sa.Integer(),
-            sa.ForeignKey("backup_run.id", ondelete="SET NULL"),
-            nullable=True,
-        ),
-    )
-
-    # Single-column indexes (matches Mapped[...].index=True).
-    op.create_index("ix_backup_run_kind", "backup_run", ["kind"])
-    op.create_index("ix_backup_run_status", "backup_run", ["status"])
-    op.create_index("ix_backup_run_tag", "backup_run", ["tag"])
-    op.create_index("ix_backup_run_started_at", "backup_run", ["started_at"])
-    op.create_index("ix_backup_run_finished_at", "backup_run", ["finished_at"])
-
-    # Composite indexes for dashboard query patterns.
-    op.create_index(
-        "ix_backup_run_kind_started",
-        "backup_run", ["kind", sa.text("started_at DESC")],
-    )
-    op.create_index(
-        "ix_backup_run_status_finished",
-        "backup_run", ["status", sa.text("finished_at DESC")],
-    )
-    # Partial index: only tagged rows participate in retention-exempt query.
-    op.create_index(
-        "ix_backup_run_tag_partial",
-        "backup_run", ["tag"],
-        postgresql_where=sa.text("tag IS NOT NULL"),
-    )
-
-
-def downgrade() -> None:
-    op.drop_index("ix_backup_run_tag_partial", table_name="backup_run")
-    op.drop_index("ix_backup_run_status_finished", table_name="backup_run")
-    op.drop_index("ix_backup_run_kind_started", table_name="backup_run")
-    op.drop_index("ix_backup_run_finished_at", table_name="backup_run")
-    op.drop_index("ix_backup_run_started_at", table_name="backup_run")
-    op.drop_index("ix_backup_run_tag", table_name="backup_run")
-    op.drop_index("ix_backup_run_status", table_name="backup_run")
-    op.drop_index("ix_backup_run_kind", table_name="backup_run")
-    op.drop_table("backup_run")

alembic/versions/0018_fc3h_backup_settings.py

@@ -1,62 +0,0 @@
-"""fc3h: backup_* knobs on import_settings
-
-Revision ID: 0018
-Revises: 0017
-Create Date: 2026-05-24
-
-Adds four columns to the singleton import_settings row:
-  - backup_db_nightly_enabled (default False — opt-in)
-  - backup_db_nightly_hour_utc (default 3)
-  - backup_db_keep_last_n (default 14)
-  - backup_images_keep_last_n (default 3)
-
-server_default ensures the singleton row is backfilled in place
-without an UPDATE statement.
-"""
-from typing import Sequence, Union
-
-import sqlalchemy as sa
-from alembic import op
-
-revision: str = "0018"
-down_revision: Union[str, None] = "0017"
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
-
-
-def upgrade() -> None:
-    op.add_column(
-        "import_settings",
-        sa.Column(
-            "backup_db_nightly_enabled", sa.Boolean(),
-            nullable=False, server_default=sa.false(),
-        ),
-    )
-    op.add_column(
-        "import_settings",
-        sa.Column(
-            "backup_db_nightly_hour_utc", sa.Integer(),
-            nullable=False, server_default="3",
-        ),
-    )
-    op.add_column(
-        "import_settings",
-        sa.Column(
-            "backup_db_keep_last_n", sa.Integer(),
-            nullable=False, server_default="14",
-        ),
-    )
-    op.add_column(
-        "import_settings",
-        sa.Column(
-            "backup_images_keep_last_n", sa.Integer(),
-            nullable=False, server_default="3",
-        ),
-    )
-
-
-def downgrade() -> None:
-    op.drop_column("import_settings", "backup_images_keep_last_n")
-    op.drop_column("import_settings", "backup_db_keep_last_n")
-    op.drop_column("import_settings", "backup_db_nightly_hour_utc")
-    op.drop_column("import_settings", "backup_db_nightly_enabled")

alembic/versions/0019_import_batch_refreshed.py

@@ -1,38 +0,0 @@
-"""import_batch.refreshed counter for deep-scan sidecar re-application
-
-Revision ID: 0019
-Revises: 0018
-Create Date: 2026-05-25
-
-Adds a `refreshed` counter to `import_batch`, mirroring the existing
-`imported`/`skipped`/`failed`/`attachments` columns. Deep scan now
-re-applies sidecar metadata to already-imported files (the IR feature
-that didn't make the FC port the first time); a "refreshed" outcome
-increments this counter so the UI can surface "X new, Y refreshed"
-instead of the misleading "Scan complete — no new files" message.
-
-server_default=0 backfills existing rows in place — no UPDATE needed.
-"""
-from typing import Sequence, Union
-
-import sqlalchemy as sa
-from alembic import op
-
-revision: str = "0019"
-down_revision: Union[str, None] = "0018"
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
-
-
-def upgrade() -> None:
-    op.add_column(
-        "import_batch",
-        sa.Column(
-            "refreshed", sa.Integer(),
-            nullable=False, server_default=sa.text("0"),
-        ),
-    )
-
-
-def downgrade() -> None:
-    op.drop_column("import_batch", "refreshed")

alembic/versions/0020_library_audit_run.py

@@ -1,65 +0,0 @@
-"""fc-cleanup: library_audit_run table for async transparency/single_color audits
-
-Revision ID: 0020
-Revises: 0019
-Create Date: 2026-05-26
-
-The table backs the async audit lifecycle: rule + params snapshot, status
-state machine ('running' → 'ready' → 'applied'/'cancelled'/'error'), and
-the matched_ids JSONB array that the apply step deletes. Capped at 50k IDs
-per row by the scan task (oversize = rule too aggressive, operator narrows
-before re-running).
-"""
-from typing import Sequence, Union
-
-import sqlalchemy as sa
-from alembic import op
-from sqlalchemy.dialects import postgresql
-
-revision: str = "0020"
-down_revision: Union[str, None] = "0019"
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
-
-
-def upgrade() -> None:
-    op.create_table(
-        "library_audit_run",
-        sa.Column("id", sa.Integer(), primary_key=True),
-        sa.Column("rule", sa.String(32), nullable=False),
-        sa.Column("params", postgresql.JSONB(astext_type=sa.Text()), nullable=False),
-        sa.Column(
-            "status", sa.String(16),
-            nullable=False, server_default="running",
-        ),
-        sa.Column(
-            "started_at", sa.DateTime(timezone=True),
-            nullable=False, server_default=sa.func.now(),
-        ),
-        sa.Column("finished_at", sa.DateTime(timezone=True), nullable=True),
-        sa.Column(
-            "scanned_count", sa.Integer(),
-            nullable=False, server_default="0",
-        ),
-        sa.Column(
-            "matched_count", sa.Integer(),
-            nullable=False, server_default="0",
-        ),
-        sa.Column(
-            "matched_ids", postgresql.JSONB(astext_type=sa.Text()),
-            nullable=False, server_default=sa.text("'[]'::jsonb"),
-        ),
-        sa.Column("error", sa.Text(), nullable=True),
-    )
-    op.create_index(
-        "ix_library_audit_run_rule", "library_audit_run", ["rule"],
-    )
-    op.create_index(
-        "ix_library_audit_run_status", "library_audit_run", ["status"],
-    )
-
-
-def downgrade() -> None:
-    op.drop_index("ix_library_audit_run_status", table_name="library_audit_run")
-    op.drop_index("ix_library_audit_run_rule", table_name="library_audit_run")
-    op.drop_table("library_audit_run")

alembic/versions/0021_image_provenance_unique.py

@@ -1,54 +0,0 @@
-"""provenance-race: dedupe + UNIQUE(image_record_id, post_id) on image_provenance
-
-Revision ID: 0021
-Revises: 0020
-Create Date: 2026-05-26
-
-Closes the race in Importer._apply_sidecar's existence-check + INSERT pattern.
-Two workers writing for the same (image, post) pair both saw no existing row
-and both inserted, leaving duplicates that then broke .scalar_one_or_none()
-on every subsequent deep-scan rederive against those images
-(MultipleResultsFound). Most plausibly seeded when the 5-min recovery sweep
-re-enqueued a still-running long-import task and the second worker collided
-with the first inside _apply_sidecar.
-
-Migration steps:
-  1. DELETE all but min(id) per (image_record_id, post_id) pair. Operator's
-     DB had 2 affected pairs at write-time; harmless no-op if zero.
-  2. Add UNIQUE constraint so the importer's new savepoint+IntegrityError
-     recovery path can trip on collision and re-select, mirroring
-     uq_source_artist_platform_url and uq_post_source_external_id.
-"""
-from typing import Sequence, Union
-
-from alembic import op
-
-revision: str = "0021"
-down_revision: Union[str, None] = "0020"
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
-
-
-def upgrade() -> None:
-    op.execute(
-        """
-        DELETE FROM image_provenance ip1
-        USING image_provenance ip2
-        WHERE ip1.image_record_id = ip2.image_record_id
-          AND ip1.post_id = ip2.post_id
-          AND ip1.id > ip2.id
-        """
-    )
-    op.create_unique_constraint(
-        "uq_image_provenance_image_post",
-        "image_provenance",
-        ["image_record_id", "post_id"],
-    )
-
-
-def downgrade() -> None:
-    op.drop_constraint(
-        "uq_image_provenance_image_post",
-        "image_provenance",
-        type_="unique",
-    )

alembic/versions/0022_source_per_artist_platform.py

@@ -1,223 +0,0 @@
-"""source-collapse: one Source per (artist, platform) — consolidate junk per-post Sources
-
-Revision ID: 0022
-Revises: 0021
-Create Date: 2026-05-26
-
-Closes the operator-flagged 2026-05-26 issue where the filesystem importer
-called _find_or_create_source(url=sd.post_url), creating one Source row per
-imported post URL. Operator's Atole artist had 406 Source rows where there
-should have been 1 (the /cw/Atole subscription Source).
-
-Source represents a subscription feed (one per artist+platform — the
-gallery-dl URL polled by the FC-3 downloader). Posts hang off it. The
-filesystem importer was misusing Source as a per-post key.
-
-Migration steps per (artist_id, platform) group with >1 Source:
-  1. Pick canonical — prefer a URL NOT matching '/posts/<id>$' (real
-     campaign URL like /cw/Atole); else min(id).
-  2. PRE-merge any Posts under non-canonical sources whose
-     external_post_id ALREADY exists under the canonical source. (Same
-     gallery-dl post imported via two different sidecar paths can plant
-     two Post rows with identical external_post_id under different
-     Sources for the same artist.) Repoint ImageProvenance +
-     ImageRecord.primary_post_id to the canonical-side Post, dedupe
-     ImageProvenance against alembic 0021's uq, then delete the
-     non-canonical-side Post. This MUST happen before step 3 — Postgres
-     fires uq_post_source_external_id row-by-row during the bulk UPDATE
-     and the merge-after-reparent ordering 500s on first collision
-     (operator-hit during v26.05.26.1 deploy, 2026-05-26).
-  3. Reparent remaining Posts onto canonical (no collisions possible now).
-  4. Reparent ImageProvenance.source_id off the non-canonical sources.
-  5. Delete the orphan Source rows.
-  6. If the canonical Source's URL still looks like a per-post URL (no
-     campaign URL existed among candidates), rewrite it to
-     'sidecar:<platform>:<artist_slug>' so the artist detail page shows
-     something readable.
-"""
-from typing import Sequence, Union
-
-from alembic import op
-from sqlalchemy import text
-
-revision: str = "0022"
-down_revision: Union[str, None] = "0021"
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
-
-_POST_URL_RE = r"/posts/[^/]+$"
-
-
-def upgrade() -> None:
-    conn = op.get_bind()
-
-    # Find (artist_id, platform) groups with > 1 Source row.
-    groups = conn.execute(text("""
-        SELECT artist_id, platform
-        FROM source
-        GROUP BY artist_id, platform
-        HAVING COUNT(*) > 1
-    """)).fetchall()
-
-    for artist_id, platform in groups:
-        rows = conn.execute(
-            text("""
-                SELECT id, url FROM source
-                WHERE artist_id = :a AND platform = :p
-                ORDER BY id ASC
-            """),
-            {"a": artist_id, "p": platform},
-        ).fetchall()
-
-        # Canonical: first row whose URL doesn't look like a per-post URL;
-        # else min(id).
-        canonical_id = None
-        for sid, url in rows:
-            if not _matches_post_url(url):
-                canonical_id = sid
-                break
-        if canonical_id is None:
-            canonical_id = rows[0][0]
-
-        other_ids = [sid for sid, _ in rows if sid != canonical_id]
-        if not other_ids:
-            continue
-
-        # STEP 2: PRE-merge ALL Posts with duplicate external_post_id
-        # across the entire (canonical + others) group, BEFORE the bulk
-        # reparent. Two cases must both be handled:
-        #   (A) canonical has Post X with epid=N; an "other" source has
-        #       Post Y with epid=N → after bulk UPDATE, (canonical, N)
-        #       collides with itself.
-        #   (B) two different "other" sources each have a Post with
-        #       epid=N; canonical has none → after bulk UPDATE, both
-        #       are repointed to (canonical, N) and the second collides.
-        # The earlier version of this migration only handled (A); the
-        # operator's deploy 2026-05-26 tripped (B) at line 139.
-        # Fix: group ALL Posts in the (artist, platform) by epid; for
-        # any group with count>1, pick the keep (prefer one already
-        # under canonical; else lowest id) and merge the rest into it.
-        all_posts = conn.execute(
-            text("""
-                SELECT external_post_id, id, source_id
-                FROM post
-                WHERE source_id = :canonical OR source_id = ANY(:others)
-                ORDER BY external_post_id, id
-            """),
-            {"canonical": canonical_id, "others": other_ids},
-        ).fetchall()
-        by_epid: dict = {}
-        for epid, post_id, src_id in all_posts:
-            by_epid.setdefault(epid, []).append((post_id, src_id))
-        for _epid, posts in by_epid.items():
-            if len(posts) <= 1:
-                continue
-            # Prefer a Post already under canonical as the keep.
-            canonical_posts = [p for p in posts if p[1] == canonical_id]
-            if canonical_posts:
-                keep_id = canonical_posts[0][0]
-            else:
-                keep_id = posts[0][0]  # already sorted by id ASC
-            drop_ids = [p[0] for p in posts if p[0] != keep_id]
-            for drop_id in drop_ids:
-                # Pre-delete image_provenance rows under drop_ whose
-                # image_record_id ALREADY has a provenance under keep —
-                # the UPDATE below would otherwise repoint them and
-                # trip uq_image_provenance_image_post (alembic 0021)
-                # row-by-row before any after-the-fact dedupe could
-                # run. Operator's v26.05.26.3 deploy 2026-05-26 tripped
-                # this at line 123.
-                conn.execute(
-                    text("""
-                        DELETE FROM image_provenance
-                        WHERE post_id = :drop_
-                          AND image_record_id IN (
-                              SELECT image_record_id FROM image_provenance
-                              WHERE post_id = :keep
-                          )
-                    """),
-                    {"keep": keep_id, "drop_": drop_id},
-                )
-                # Now safe to repoint the survivors.
-                conn.execute(
-                    text("""
-                        UPDATE image_provenance SET post_id = :keep
-                        WHERE post_id = :drop_
-                    """),
-                    {"keep": keep_id, "drop_": drop_id},
-                )
-                conn.execute(
-                    text("""
-                        UPDATE image_record SET primary_post_id = :keep
-                        WHERE primary_post_id = :drop_
-                    """),
-                    {"keep": keep_id, "drop_": drop_id},
-                )
-                conn.execute(
-                    text("DELETE FROM post WHERE id = :drop_"),
-                    {"drop_": drop_id},
-                )
-
-        # STEP 3: Bulk reparent the remaining Posts off the other
-        # Sources. After step 2, no collisions on
-        # (canonical, external_post_id) are possible.
-        conn.execute(
-            text("""
-                UPDATE post SET source_id = :canonical
-                WHERE source_id = ANY(:others)
-            """),
-            {"canonical": canonical_id, "others": other_ids},
-        )
-
-        # STEP 4: Reparent ImageProvenance.source_id (denormalized FK).
-        # No UNIQUE on source_id; safe bulk update.
-        conn.execute(
-            text("""
-                UPDATE image_provenance SET source_id = :canonical
-                WHERE source_id = ANY(:others)
-            """),
-            {"canonical": canonical_id, "others": other_ids},
-        )
-
-        # STEP 5: Drop the orphan Sources.
-        conn.execute(
-            text("DELETE FROM source WHERE id = ANY(:others)"),
-            {"others": other_ids},
-        )
-
-        # If the canonical's URL still looks per-post (no campaign URL
-        # existed among the candidates), rewrite to a synthetic anchor so
-        # the artist detail page renders something readable.
-        canonical_url = conn.execute(
-            text("SELECT url FROM source WHERE id = :id"),
-            {"id": canonical_id},
-        ).scalar_one()
-        if _matches_post_url(canonical_url):
-            slug = conn.execute(
-                text("SELECT slug FROM artist WHERE id = :id"),
-                {"id": artist_id},
-            ).scalar_one()
-            conn.execute(
-                text("""
-                    UPDATE source
-                    SET url = :new_url, enabled = false
-                    WHERE id = :id
-                """),
-                {
-                    "id": canonical_id,
-                    "new_url": f"sidecar:{platform}:{slug}",
-                },
-            )
-
-
-def downgrade() -> None:
-    # Lossy migration — orphan Sources deleted, Posts reparented, Posts
-    # merged. No safe downgrade. If you need to roll back the schema
-    # invariant, fork from 0021 and re-run filesystem imports.
-    pass
-
-
-def _matches_post_url(url: str) -> bool:
-    """True if url ends with /posts/<token> (gallery-dl-style per-post URL)."""
-    import re
-    return bool(re.search(_POST_URL_RE, url or ""))

alembic/versions/0023_drop_meta_rating_tag_kinds.py

@@ -1,99 +0,0 @@
-"""drop meta + rating tag kinds — operator-retired 2026-05-26
-
-Revision ID: 0023
-Revises: 0022
-Create Date: 2026-05-26
-
-Operator decided meta + rating aren't valid tag kinds for FC. Per-row
-behavior: DELETE existing rows (operator chose "clean break" over
-"convert to general"). All cascading FKs (image_tag, tag_alias,
-tag_allowlist, tag_reference_embedding, tag_suggestion_rejection,
-series_page) use ondelete="CASCADE" so a single DELETE on tag cleans
-the related rows in one go.
-
-After the data cleanup, recreate the tag_kind ENUM without 'meta' /
-'rating' (Postgres has no `ALTER TYPE ... DROP VALUE`; standard
-rename-create-cast-drop dance). The server default 'general' is
-dropped before the type swap and restored after.
-"""
-from typing import Sequence, Union
-
-from alembic import op
-
-revision: str = "0023"
-down_revision: Union[str, None] = "0022"
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
-
-
-def upgrade() -> None:
-    # 1. Delete tags of the retired kinds. CASCADE handles related tables.
-    op.execute("DELETE FROM tag WHERE kind IN ('meta', 'rating')")
-
-    # 2. Drop the CHECK constraint that references the enum's literal
-    #    values. Postgres can't resolve `kind = 'character'` across the
-    #    type swap below — the literal would bind to the new tag_kind
-    #    but the column is on tag_kind_old, producing
-    #    "operator does not exist: tag_kind = tag_kind_old".
-    #    (Operator-hit during the v26.05.26.5 deploy attempt; ck was
-    #    originally added by alembic 0002.) Recreated post-swap.
-    op.drop_constraint(
-        "ck_tag_fandom_requires_character", "tag", type_="check"
-    )
-
-    # 3. Drop the server default — ALTER COLUMN TYPE can't carry it
-    #    across the type swap below.
-    op.execute("ALTER TABLE tag ALTER COLUMN kind DROP DEFAULT")
-
-    # 4. Recreate the tag_kind enum without meta/rating.
-    op.execute("ALTER TYPE tag_kind RENAME TO tag_kind_old")
-    op.execute(
-        "CREATE TYPE tag_kind AS ENUM ("
-        "'artist', 'character', 'fandom', 'general', "
-        "'series', 'archive', 'post'"
-        ")"
-    )
-    op.execute(
-        "ALTER TABLE tag "
-        "ALTER COLUMN kind TYPE tag_kind "
-        "USING kind::text::tag_kind"
-    )
-    op.execute("DROP TYPE tag_kind_old")
-
-    # 5. Restore the server default.
-    op.execute("ALTER TABLE tag ALTER COLUMN kind SET DEFAULT 'general'")
-
-    # 6. Restore the CHECK constraint (now bound to the new tag_kind).
-    op.create_check_constraint(
-        "ck_tag_fandom_requires_character",
-        "tag",
-        "(fandom_id IS NULL) OR (kind = 'character')",
-    )
-
-
-def downgrade() -> None:
-    # Add the values back to the enum so old code can boot. The deleted
-    # tag rows are gone permanently — no safe restore.
-    op.drop_constraint(
-        "ck_tag_fandom_requires_character", "tag", type_="check"
-    )
-    op.execute("ALTER TABLE tag ALTER COLUMN kind DROP DEFAULT")
-    op.execute("ALTER TYPE tag_kind RENAME TO tag_kind_old")
-    op.execute(
-        "CREATE TYPE tag_kind AS ENUM ("
-        "'artist', 'character', 'fandom', 'general', "
-        "'series', 'archive', 'post', 'meta', 'rating'"
-        ")"
-    )
-    op.execute(
-        "ALTER TABLE tag "
-        "ALTER COLUMN kind TYPE tag_kind "
-        "USING kind::text::tag_kind"
-    )
-    op.execute("DROP TYPE tag_kind_old")
-    op.execute("ALTER TABLE tag ALTER COLUMN kind SET DEFAULT 'general'")
-    op.create_check_constraint(
-        "ck_tag_fandom_requires_character",
-        "tag",
-        "(fandom_id IS NULL) OR (kind = 'character')",
-    )

alembic/versions/0024_backfill_post_title_from_description.py

@@ -1,80 +0,0 @@
-"""backfill post.post_title from description first-line — 2026-05-27
-
-Revision ID: 0024
-Revises: 0023
-Create Date: 2026-05-27
-
-SubscribeStar gallery-dl always writes `title: ""` and embeds the leading
-sentence inside `content` HTML. FC's sidecar parser was leaving
-post_title NULL for every SubscribeStar post since FC-3 shipped. The
-parser fix (sidecar._first_line_text fallback) now synthesizes a title
-at parse time; this migration applies the same logic retroactively to
-existing rows.
-
-Operator-flagged 2026-05-27 after inspecting
-/mnt/Data/Patreon/Cheunart/subscribestar/ sidecars.
-
-Idempotent: only touches rows where post_title IS NULL or empty AND
-description IS NOT NULL. Re-running the migration is a no-op.
-"""
-from __future__ import annotations
-
-import re
-from typing import Sequence, Union
-
-from alembic import op
-from sqlalchemy import text
-
-revision: str = "0024"
-down_revision: Union[str, None] = "0023"
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
-
-
-_TAG_RE = re.compile(r"<[^>]+>")
-_WS_RE = re.compile(r"\s+")
-
-
-def _first_line_text(body: str, limit: int = 120) -> str | None:
-    """Mirror of sidecar._first_line_text. Kept inline so the migration
-    doesn't carry a runtime import dependency from app code that may
-    have moved by the time the migration is replayed years from now."""
-    if not body:
-        return None
-    text_ = _TAG_RE.sub(" ", body)
-    text_ = text_.replace("\xa0", " ")
-    for line in text_.splitlines():
-        line = _WS_RE.sub(" ", line).strip()
-        if line:
-            if len(line) > limit:
-                return line[: limit - 1].rstrip() + "…"
-            return line
-    return None
-
-
-def upgrade() -> None:
-    bind = op.get_bind()
-    rows = bind.execute(
-        text(
-            "SELECT id, description FROM post "
-            "WHERE (post_title IS NULL OR post_title = '') "
-            "AND description IS NOT NULL AND description <> ''"
-        )
-    ).fetchall()
-    updated = 0
-    for row in rows:
-        derived = _first_line_text(row.description)
-        if not derived:
-            continue
-        bind.execute(
-            text("UPDATE post SET post_title = :t WHERE id = :id"),
-            {"t": derived, "id": row.id},
-        )
-        updated += 1
-    print(f"0024: backfilled post_title on {updated} row(s)")
-
-
-def downgrade() -> None:
-    # No safe restore — we can't tell which post_titles were derived vs
-    # genuinely present. Leave the column alone on rollback.
-    pass

alembic/versions/0025_fix_subscribestar_post_ids.py

@@ -1,288 +0,0 @@
-"""sidecar-audit followup: correct external_post_id + post_url across all platforms
-
-Revision ID: 0025
-Revises: 0024
-Create Date: 2026-05-27
-
-Closes the operator-flagged 2026-05-27 sidecar audit findings. Three
-data-correctness bugs across non-Patreon platforms had been silently
-corrupting Posts since FC-3 shipped; the parser fix (sidecar.py, same
-commit) addresses new imports. This migration cleans up existing rows.
-
-Per-platform actions:
-
-  subscribestar — gallery-dl wrote the per-attachment id in `id` and
-    the actual post id in `post_id`. FC's parser picked `id`, so every
-    multi-image SubscribeStar post was fragmented into N Post rows.
-    1. For each SubscribeStar Post, read its sidecar (via the related
-       ImageRecord's on-disk path), pull `post_id`, overwrite
-       external_post_id and post_url.
-    2. Merge groups of Posts under one source that now share an
-       external_post_id (fragments of the same actual post). Same
-       ImageProvenance pre-delete + repoint dance as alembic 0022.
-
-  hentaifoundry — sidecars have NO `url` field; `src` is the image
-    URL. FC's parser stored post_url=NULL. Read each HF Post's sidecar
-    for `user` + `index`, derive the canonical /pictures/user/<u>/<i>
-    permalink. external_post_id (= `index`) was already correct.
-
-  discord — gallery-dl wrote the CDN attachment URL in `url`. FC's
-    parser stored that as post_url. Read each Discord Post's sidecar
-    for the server/channel/message triple, derive the proper
-    discord.com/channels/.../<message> permalink. external_post_id (=
-    `message_id`) was already correct.
-
-  pixiv — pure-SQL backfill: replace any `i.pximg.net`-style URL on
-    Post.post_url with the derived `/artworks/<id>` permalink. Pixiv
-    external_post_id (= `id`) was already correct; no sidecar IO
-    needed.
-
-Idempotent: re-running on already-corrected data is a no-op (skips
-rows whose derived value matches what's already stored).
-
-Posts whose related ImageRecord paths don't resolve on disk (orphaned
-filesystem state) are skipped with a count in the migration output —
-those will be picked up by a future deep-scan.
-"""
-from __future__ import annotations
-
-import json
-import re
-from pathlib import Path
-from typing import Sequence, Union
-
-from alembic import op
-from sqlalchemy import text
-
-revision: str = "0025"
-down_revision: Union[str, None] = "0024"
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
-
-
-# Mirror of sidecar._NUMBERING_PREFIX. Kept inline so the migration is
-# self-contained (the operator's banked rule:
-# reference_postgres_enum_swap_drop_checks.md says migrations shouldn't
-# import from runtime app code).
-_NUMBERING_PREFIX = re.compile(r"^\d+_(.+)$")
-
-
-def _find_sidecar(media_path: Path) -> Path | None:
-    """gallery-dl writes the sidecar under the unprefixed stem
-    (`HOLLOW-ICHIGO.json`) while the media file gets a NN_ ordering
-    prefix (`01_HOLLOW-ICHIGO.png`). Try in order:
-      1. <stem>.json next to the media
-      2. <media>.json next to the media (full-name variant)
-      3. strip the NN_ prefix from the stem, then <stripped>.json
-    """
-    if not media_path:
-        return None
-    cand = media_path.with_suffix(".json")
-    if cand.is_file():
-        return cand
-    cand = media_path.parent / f"{media_path.name}.json"
-    if cand.is_file():
-        return cand
-    m = _NUMBERING_PREFIX.match(media_path.stem)
-    if m:
-        cand = media_path.parent / f"{m.group(1)}.json"
-        if cand.is_file():
-            return cand
-    return None
-
-
-def _str_id(v) -> str | None:
-    """str() a JSON scalar id; reject bool (JSON booleans are ints in
-    Python's eyes but they aren't valid sidecar ids)."""
-    if isinstance(v, bool):
-        return None
-    if isinstance(v, (str, int)) and str(v).strip():
-        return str(v).strip()
-    return None
-
-
-def _str_field(v) -> str | None:
-    if isinstance(v, str) and v.strip():
-        return v.strip()
-    return None
-
-
-def upgrade() -> None:
-    conn = op.get_bind()
-
-    # ── PART 1: Per-platform corrections requiring filesystem IO ─────
-    # SubscribeStar, HentaiFoundry, Discord all need fields from the
-    # sidecar to construct the right post_url. We walk each Post's
-    # related ImageRecord.path to find the sidecar, read it, derive,
-    # and update.
-    targets = conn.execute(text("""
-        SELECT p.id, p.external_post_id, p.post_url, s.platform
-        FROM post p
-        JOIN source s ON s.id = p.source_id
-        WHERE s.platform IN ('subscribestar', 'hentaifoundry', 'discord')
-    """)).fetchall()
-
-    stats: dict[str, dict[str, int]] = {
-        plat: {"read": 0, "updated": 0, "no_sidecar": 0}
-        for plat in ("subscribestar", "hentaifoundry", "discord")
-    }
-    for post_row in targets:
-        plat = post_row.platform
-        path = _first_attachment_path(conn, post_row.id)
-        if not path:
-            stats[plat]["no_sidecar"] += 1
-            continue
-        sidecar = _find_sidecar(Path(path))
-        if sidecar is None:
-            stats[plat]["no_sidecar"] += 1
-            continue
-        try:
-            data = json.loads(sidecar.read_text(encoding="utf-8"))
-        except (OSError, json.JSONDecodeError):
-            stats[plat]["no_sidecar"] += 1
-            continue
-        stats[plat]["read"] += 1
-
-        new_epid = post_row.external_post_id
-        new_url = None
-        if plat == "subscribestar":
-            pid = _str_id(data.get("post_id"))
-            if pid:
-                new_epid = pid
-                new_url = f"https://www.subscribestar.com/posts/{pid}"
-        elif plat == "hentaifoundry":
-            user = _str_field(data.get("user")) or _str_field(data.get("artist"))
-            idx = _str_id(data.get("index"))
-            if user and idx:
-                new_url = f"https://www.hentai-foundry.com/pictures/user/{user}/{idx}"
-        elif plat == "discord":
-            sid = _str_id(data.get("server_id"))
-            cid = _str_id(data.get("channel_id"))
-            mid = _str_id(data.get("message_id"))
-            if sid and cid and mid:
-                new_url = f"https://discord.com/channels/{sid}/{cid}/{mid}"
-
-        # Idempotent: skip if nothing changed.
-        if new_epid == post_row.external_post_id and new_url == post_row.post_url:
-            continue
-        conn.execute(
-            text("""
-                UPDATE post
-                SET external_post_id = :epid, post_url = :url
-                WHERE id = :id
-            """),
-            {"epid": new_epid, "url": new_url, "id": post_row.id},
-        )
-        stats[plat]["updated"] += 1
-
-    for plat, s in stats.items():
-        print(
-            f"0025: {plat} — read {s['read']} sidecars, "
-            f"updated {s['updated']} Posts, "
-            f"{s['no_sidecar']} Posts had no resolvable sidecar"
-        )
-
-    # ── PART 2: Merge SubscribeStar fragments now sharing epid ───────
-    # After Part 1, each group of Posts under one source with the SAME
-    # new external_post_id is a fragment-set of the same actual post.
-    # Merge to one canonical row. Pre-handle the same ImageProvenance
-    # collision pattern as alembic 0022 (uq_image_provenance_image_post).
-    fragment_groups = conn.execute(text("""
-        SELECT p.source_id, p.external_post_id,
-               ARRAY_AGG(p.id ORDER BY p.id ASC) AS post_ids
-        FROM post p
-        JOIN source s ON s.id = p.source_id
-        WHERE s.platform = 'subscribestar'
-          AND p.external_post_id IS NOT NULL
-        GROUP BY p.source_id, p.external_post_id
-        HAVING COUNT(*) > 1
-    """)).fetchall()
-
-    merged = 0
-    for grp in fragment_groups:
-        post_ids = list(grp.post_ids)
-        keep_id, *drop_ids = post_ids
-        for drop_id in drop_ids:
-            # Pre-DELETE colliding ImageProvenance under drop_ that
-            # already exist under keep (alembic 0022 banked the pattern).
-            conn.execute(
-                text("""
-                    DELETE FROM image_provenance
-                    WHERE post_id = :drop_
-                      AND image_record_id IN (
-                          SELECT image_record_id FROM image_provenance
-                          WHERE post_id = :keep
-                      )
-                """),
-                {"keep": keep_id, "drop_": drop_id},
-            )
-            conn.execute(
-                text("""
-                    UPDATE image_provenance SET post_id = :keep
-                    WHERE post_id = :drop_
-                """),
-                {"keep": keep_id, "drop_": drop_id},
-            )
-            conn.execute(
-                text("""
-                    UPDATE image_record SET primary_post_id = :keep
-                    WHERE primary_post_id = :drop_
-                """),
-                {"keep": keep_id, "drop_": drop_id},
-            )
-            conn.execute(
-                text("""
-                    UPDATE post_attachment SET post_id = :keep
-                    WHERE post_id = :drop_
-                """),
-                {"keep": keep_id, "drop_": drop_id},
-            )
-            conn.execute(
-                text("DELETE FROM post WHERE id = :drop_"),
-                {"drop_": drop_id},
-            )
-            merged += 1
-    print(f"0025: subscribestar — merged {merged} duplicate Post fragments")
-
-    # ── PART 3: Pixiv post_url backfill (pure SQL) ───────────────────
-    # Pixiv's external_post_id is already correct (gallery-dl's `id` is
-    # the post id). Only post_url needs derivation: replace anything
-    # under i.pximg.net (the file URL) with the /artworks/<id> permalink.
-    pixiv_updated = conn.execute(text("""
-        UPDATE post p
-        SET post_url = 'https://www.pixiv.net/artworks/' || p.external_post_id
-        FROM source s
-        WHERE p.source_id = s.id
-          AND s.platform = 'pixiv'
-          AND p.external_post_id IS NOT NULL
-          AND (p.post_url IS NULL
-               OR p.post_url LIKE 'https://i.pximg.net/%'
-               OR p.post_url LIKE 'http://i.pximg.net/%')
-    """)).rowcount
-    print(f"0025: pixiv — backfilled post_url on {pixiv_updated} Posts")
-
-
-def _first_attachment_path(conn, post_id: int) -> str | None:
-    """Return any ImageRecord.path attached to this post (via
-    ImageProvenance). Lowest-id row keeps the migration deterministic
-    so re-running on the same DB picks the same sidecar."""
-    row = conn.execute(
-        text("""
-            SELECT ir.path
-            FROM image_provenance ip
-            JOIN image_record ir ON ir.id = ip.image_record_id
-            WHERE ip.post_id = :pid
-            ORDER BY ip.id ASC
-            LIMIT 1
-        """),
-        {"pid": post_id},
-    ).first()
-    return row[0] if row else None
-
-
-def downgrade() -> None:
-    # Lossy: external_post_id values were overwritten with the correct
-    # post_id; original per-attachment ids weren't preserved. Post-merge
-    # also deleted drop rows. No safe restore. To roll back the schema
-    # invariant, fork from 0024 and re-run sidecar imports.
-    pass

alembic/versions/0026_import_task_recovery_count_refetched.py

@@ -1,53 +0,0 @@
-"""import_task.recovery_count + refetched — poison-pill circuit breaker
-
-Revision ID: 0026
-Revises: 0025
-Create Date: 2026-05-28
-
-Backs the import-task resilience work (operator-flagged 2026-05-28):
-
-- recovery_count: how many times recover_interrupted_tasks has
-  re-queued this row from a stuck 'processing' state. A row that
-  hard-crashes the worker (OOM / segfault on a corrupt or oversized
-  input) leaves no terminal flip, so the sweep re-queues it — and
-  without a cap it would loop forever, re-crashing the worker each
-  time. After MAX_RECOVERY_ATTEMPTS the sweep marks it 'failed' with a
-  diagnostic instead.
-
-- refetched: whether a one-shot re-download has already been attempted
-  for this task's file. Bounds the Layer-2 re-fetch remediation to a
-  single attempt so source-side corruption doesn't loop.
-
-Both default to 0 / false; additive, no backfill needed.
-"""
-from typing import Sequence, Union
-
-import sqlalchemy as sa
-from alembic import op
-
-revision: str = "0026"
-down_revision: Union[str, None] = "0025"
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
-
-
-def upgrade() -> None:
-    op.add_column(
-        "import_task",
-        sa.Column(
-            "recovery_count", sa.Integer(), nullable=False,
-            server_default="0",
-        ),
-    )
-    op.add_column(
-        "import_task",
-        sa.Column(
-            "refetched", sa.Boolean(), nullable=False,
-            server_default=sa.false(),
-        ),
-    )
-
-
-def downgrade() -> None:
-    op.drop_column("import_task", "refetched")
-    op.drop_column("import_task", "recovery_count")

alembic/versions/0027_drop_migration_run.py

@@ -1,50 +0,0 @@
-"""drop migration_run — one-and-done GS/IR migration tooling removed
-
-Revision ID: 0027
-Revises: 0026
-Create Date: 2026-05-29
-
-The GS/IR migration tooling (services/migrators, /api/migrate, the
-run_migration task, LegacyMigrationCard, and the MigrationRun model) was
-removed after the migration cutover completed. This drops its now-orphaned
-run-log table. Downgrade recreates the table (mirrors the old model) so the
-migration is reversible.
-"""
-from typing import Sequence, Union
-
-import sqlalchemy as sa
-from alembic import op
-from sqlalchemy.dialects.postgresql import JSONB
-
-revision: str = "0027"
-down_revision: Union[str, None] = "0026"
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
-
-
-def upgrade() -> None:
-    op.drop_table("migration_run")
-
-
-def downgrade() -> None:
-    op.create_table(
-        "migration_run",
-        sa.Column("id", sa.Integer(), primary_key=True),
-        sa.Column("kind", sa.String(length=32), nullable=False),
-        sa.Column("status", sa.String(length=32), nullable=False),
-        sa.Column("dry_run", sa.Boolean(), nullable=False, server_default=sa.false()),
-        sa.Column(
-            "started_at", sa.DateTime(timezone=True), nullable=False,
-            server_default=sa.func.now(),
-        ),
-        sa.Column("finished_at", sa.DateTime(timezone=True), nullable=True),
-        sa.Column(
-            "counts", JSONB(), nullable=False, server_default=sa.text("'{}'::jsonb"),
-        ),
-        sa.Column("error", sa.Text(), nullable=True),
-        sa.Column(
-            "metadata", JSONB(), nullable=False, server_default=sa.text("'{}'::jsonb"),
-        ),
-    )
-    op.create_index("ix_migration_run_kind", "migration_run", ["kind"])
-    op.create_index("ix_migration_run_status", "migration_run", ["status"])

alembic/versions/0028_collapse_sidecar_synthetics_into_real_sources.py

@@ -1,190 +0,0 @@
-"""collapse-sidecar-synthetic: repoint Posts/ImageProvenance/DownloadEvents
-from `sidecar:<platform>:<slug>` synthetic Source anchors onto the real
-Source for the same (artist, platform) when one exists, then delete the
-synthetic.
-
-Revision ID: 0028
-Revises: 0027
-Create Date: 2026-05-31
-
-Background: alembic 0022 (2026-05-26) consolidated the old per-post-URL
-Source rows into one canonical Source per (artist, platform). When NO
-real campaign URL was salvageable among the candidates, it rewrote the
-canonical row to url='sidecar:<platform>:<slug>' enabled=false as a
-disabled anchor for any Posts already attached.
-
-That was fine while it was the only Source for that artist+platform.
-But: the unique constraint on Source is (artist_id, platform, url), not
-(artist_id, platform). When the operator later added the real
-subscription via the UI / extension / etc., a SECOND row landed —
-the real one — with id > the synthetic. Both coexisted.
-
-Two follow-on problems surfaced 2026-05-31:
-
-  1. The Subscriptions UI listed both rows. The synthetic was disabled
-     so the scheduler never polled it, but it looked like a phantom
-     subscription. (Fixed in same commit by SourceService.list filter.)
-  2. importer._source_for_sidecar picked Source by `ORDER BY id ASC
-     LIMIT 1`, so EVERY gallery-dl download since the real Source was
-     added attached its Post to the SYNTHETIC anchor, not the real
-     Source. (Fixed in same commit by preferring non-sidecar URLs.)
-
-This migration is the data half of the cleanup: for every (artist,
-platform) with both a synthetic AND a real Source, repoint the
-synthetic's children (Posts, ImageProvenance, DownloadEvents) onto the
-real Source and delete the synthetic. Reuses the same epid/provenance
-collision dance from alembic 0022 because the same uniqueness
-constraints fire row-by-row during bulk UPDATEs.
-
-Lone synthetic anchors — those where no real Source for the same
-(artist, platform) exists (e.g., filesystem-imported artist with no
-subscription added) — are LEFT INTACT. They anchor real imported
-content; deleting them would CASCADE-delete the Posts the operator
-imported. The SourceService.list filter hides them from the UI; the
-operator can delete them by hand if they want the underlying imports
-gone.
-"""
-from typing import Sequence, Union
-
-from alembic import op
-from sqlalchemy import text
-
-revision: str = "0028"
-down_revision: Union[str, None] = "0027"
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
-
-
-def upgrade() -> None:
-    conn = op.get_bind()
-
-    # Find (artist_id, platform) groups where BOTH a sidecar synthetic
-    # and at least one real Source exist.
-    groups = conn.execute(text("""
-        SELECT artist_id, platform
-        FROM source
-        GROUP BY artist_id, platform
-        HAVING bool_or(url LIKE 'sidecar:%')
-           AND bool_or(url NOT LIKE 'sidecar:%')
-    """)).fetchall()
-
-    for artist_id, platform in groups:
-        rows = conn.execute(
-            text("""
-                SELECT id, url FROM source
-                WHERE artist_id = :a AND platform = :p
-                ORDER BY id ASC
-            """),
-            {"a": artist_id, "p": platform},
-        ).fetchall()
-
-        synthetic_ids = [sid for sid, url in rows if url.startswith("sidecar:")]
-        real_rows = [(sid, url) for sid, url in rows if not url.startswith("sidecar:")]
-        if not synthetic_ids or not real_rows:
-            continue  # belt+suspenders; the GROUP BY already filtered
-
-        # Canonical real: lowest-id non-sidecar Source.
-        canonical_id = real_rows[0][0]
-
-        # STEP A: PRE-merge Post collisions on (canonical, external_post_id).
-        # Mirror alembic 0022's pre-merge logic — when synth has Post X
-        # epid=N and real has Post Y epid=N, the bulk UPDATE below would
-        # trip uq_post_source_external_id row-by-row. Group all Posts
-        # under (canonical + synthetics) by epid; for any group >1,
-        # pick a keep (prefer one already under canonical, else lowest
-        # id) and merge the rest into it.
-        all_posts = conn.execute(
-            text("""
-                SELECT external_post_id, id, source_id
-                FROM post
-                WHERE source_id = :canonical OR source_id = ANY(:synths)
-                ORDER BY external_post_id, id
-            """),
-            {"canonical": canonical_id, "synths": synthetic_ids},
-        ).fetchall()
-        by_epid: dict = {}
-        for epid, post_id, src_id in all_posts:
-            by_epid.setdefault(epid, []).append((post_id, src_id))
-        for _epid, posts in by_epid.items():
-            if len(posts) <= 1:
-                continue
-            canonical_side = [p for p in posts if p[1] == canonical_id]
-            keep_id = canonical_side[0][0] if canonical_side else posts[0][0]
-            drop_ids = [p[0] for p in posts if p[0] != keep_id]
-            for drop_id in drop_ids:
-                # Pre-delete image_provenance rows under drop_ whose
-                # image_record_id already has provenance under keep —
-                # avoids tripping uq_image_provenance_image_post (0021)
-                # row-by-row during the repoint UPDATE.
-                conn.execute(
-                    text("""
-                        DELETE FROM image_provenance
-                        WHERE post_id = :drop_
-                          AND image_record_id IN (
-                              SELECT image_record_id FROM image_provenance
-                              WHERE post_id = :keep
-                          )
-                    """),
-                    {"keep": keep_id, "drop_": drop_id},
-                )
-                conn.execute(
-                    text("""
-                        UPDATE image_provenance SET post_id = :keep
-                        WHERE post_id = :drop_
-                    """),
-                    {"keep": keep_id, "drop_": drop_id},
-                )
-                conn.execute(
-                    text("""
-                        UPDATE image_record SET primary_post_id = :keep
-                        WHERE primary_post_id = :drop_
-                    """),
-                    {"keep": keep_id, "drop_": drop_id},
-                )
-                conn.execute(
-                    text("DELETE FROM post WHERE id = :drop_"),
-                    {"drop_": drop_id},
-                )
-
-        # STEP B: Bulk reparent the remaining Posts off the synthetics.
-        conn.execute(
-            text("""
-                UPDATE post SET source_id = :canonical
-                WHERE source_id = ANY(:synths)
-            """),
-            {"canonical": canonical_id, "synths": synthetic_ids},
-        )
-
-        # STEP C: Reparent ImageProvenance.source_id (denormalized FK;
-        # no UNIQUE on source_id, safe bulk).
-        conn.execute(
-            text("""
-                UPDATE image_provenance SET source_id = :canonical
-                WHERE source_id = ANY(:synths)
-            """),
-            {"canonical": canonical_id, "synths": synthetic_ids},
-        )
-
-        # STEP D: Reparent any DownloadEvent.source_id. Synthetics are
-        # enabled=false so the scheduler never created events for them;
-        # this is belt+suspenders for any rows planted by manual force
-        # or older code paths.
-        conn.execute(
-            text("""
-                UPDATE download_event SET source_id = :canonical
-                WHERE source_id = ANY(:synths)
-            """),
-            {"canonical": canonical_id, "synths": synthetic_ids},
-        )
-
-        # STEP E: Drop the now-empty synthetics.
-        conn.execute(
-            text("DELETE FROM source WHERE id = ANY(:synths)"),
-            {"synths": synthetic_ids},
-        )
-
-
-def downgrade() -> None:
-    # Lossy migration — synthetic Sources deleted, Posts repointed and
-    # potentially merged. No safe downgrade.
-    pass

alembic/versions/0029_drop_artist_copyright_ml_thresholds.py

@@ -1,71 +0,0 @@
-"""drop artist + copyright ml thresholds; lower general default to 0.50
-
-Revision ID: 0029
-Revises: 0028
-Create Date: 2026-06-01
-
-Operator-flagged 2026-06-01: the view modal's Suggestions panel hides
-most general-category predictions because the default threshold is
-0.95. Lowering the default to 0.50 (matches character) so general
-suggestions surface more aggressively; the value remains tunable in
-Settings → ML.
-
-Same change retires two ML suggestion categories whose Tag.kind
-surfaces are unused:
-
-- `artist`: retired in FC-2d-vii-c — artist identity is acquisition-
-  derived (image_record.artist_id), never ML-inferred. The threshold
-  column was a leftover from before that retirement.
-- `copyright`: retired 2026-06-01 — the app uses `fandom` for the
-  franchise/copyright concept (per TagsView.vue's doc comment); no
-  Tag rows of kind=copyright exist, and the threshold column never
-  fed anything user-visible.
-
-Both columns are dropped from ml_settings; the existing row's
-suggestion_threshold_general value is bumped from 0.95 to 0.50 iff
-it's still at the old default, so deployed installs pick up the new
-UX without overriding any operator tuning.
-"""
-from typing import Sequence, Union
-
-from alembic import op
-from sqlalchemy import text
-
-revision: str = "0029"
-down_revision: Union[str, None] = "0028"
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
-
-
-def upgrade() -> None:
-    # Bump the general threshold for installs still at the old default.
-    op.execute(text(
-        "UPDATE ml_settings "
-        "SET suggestion_threshold_general = 0.50 "
-        "WHERE id = 1 AND suggestion_threshold_general = 0.95"
-    ))
-    op.drop_column("ml_settings", "suggestion_threshold_artist")
-    op.drop_column("ml_settings", "suggestion_threshold_copyright")
-
-
-def downgrade() -> None:
-    # Restore the columns with their prior defaults. The bump from
-    # 0.95 → 0.50 isn't reversible without remembering whether the
-    # operator had explicitly set 0.95 (unlikely — that was just the
-    # default) so we leave the current general value as-is.
-    from sqlalchemy import Column, Float
-
-    op.add_column(
-        "ml_settings",
-        Column(
-            "suggestion_threshold_artist",
-            Float, nullable=False, server_default="0.30",
-        ),
-    )
-    op.add_column(
-        "ml_settings",
-        Column(
-            "suggestion_threshold_copyright",
-            Float, nullable=False, server_default="0.50",
-        ),
-    )

alembic/versions/0030_nullable_post_source_id_denorm_artist_id.py

@@ -1,145 +0,0 @@
-"""nullable post.source_id + denormalized post.artist_id; retire sidecar synthetics
-
-Revision ID: 0030
-Revises: 0029
-Create Date: 2026-06-01
-
-Operator-asked 2026-06-01 after the Dymkens orphan investigation: the
-sidecar synthetic Source pattern (`sidecar:<platform>:<slug>` rows
-with enabled=false) was technically correct but misled the operator
-into thinking they had phantom subscriptions. The synthetics existed
-solely to satisfy `Post.source_id NOT NULL` for filesystem-imported
-content with no real subscription.
-
-This migration makes the data model honest:
-
-1. **Post gets a denormalized `artist_id` column** so artist filters
-   work without traversing `Post → Source.artist_id`. Backfilled from
-   the existing Source linkage, then NOT NULL'd.
-2. **`Post.source_id` becomes nullable**, FK ondelete `CASCADE` → `SET
-   NULL`. Deleting a Source detaches its Posts instead of destroying
-   imported content (semantically: subscription ends, archive stays).
-3. **`ImageProvenance.source_id` becomes nullable** with the same FK
-   semantic change.
-4. **Sidecar synthetic Sources are deleted** — first NULL out the
-   FKs from Post + ImageProvenance pointing at them (so the implicit
-   CASCADE doesn't fire), then delete. DownloadEvent FK is unchanged
-   (still CASCADE'd, NOT NULL'd) — synthetics have `enabled=false`
-   so no events exist for them.
-
-Uniqueness handling: the existing `uq_post_source_external_id`
-(source_id, external_post_id) keeps working for source-bound Posts
-(Postgres treats NULL != NULL so NULL-source rows aren't deduped by
-it). A second partial unique index covers the NULL-source case on
-(artist_id, external_post_id) so filesystem-imported posts still
-dedupe within an artist.
-"""
-from typing import Sequence, Union
-
-import sqlalchemy as sa
-from alembic import op
-from sqlalchemy import text
-
-revision: str = "0030"
-down_revision: Union[str, None] = "0029"
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
-
-
-def upgrade() -> None:
-    conn = op.get_bind()
-
-    # Step 1: add Post.artist_id, initially nullable for backfill.
-    # FK naming follows the Base.metadata naming_convention
-    # (fk_<table>_<column>_<referred_table>) — alembic 0001 set this up.
-    op.add_column(
-        "post",
-        sa.Column("artist_id", sa.Integer, nullable=True),
-    )
-    op.create_foreign_key(
-        "fk_post_artist_id_artist", "post", "artist",
-        ["artist_id"], ["id"], ondelete="CASCADE",
-    )
-
-    # Step 2: backfill from Source.artist_id (every existing Post has a
-    # Source today, so every row gets populated).
-    conn.execute(text("""
-        UPDATE post p
-        SET artist_id = s.artist_id
-        FROM source s
-        WHERE p.source_id = s.id AND p.artist_id IS NULL
-    """))
-
-    # Sanity: count any remaining NULLs. Should be zero pre-this-migration.
-    remaining = conn.execute(text(
-        "SELECT COUNT(*) FROM post WHERE artist_id IS NULL"
-    )).scalar_one()
-    if remaining:
-        raise RuntimeError(
-            f"alembic 0030: {remaining} post rows have no resolvable "
-            f"artist_id after backfill. Investigate before continuing."
-        )
-
-    # Step 3: enforce NOT NULL + add index for artist-filter queries.
-    op.alter_column("post", "artist_id", nullable=False)
-    op.create_index("ix_post_artist_id", "post", ["artist_id"])
-
-    # Step 4: relax post.source_id + flip FK to SET NULL. The original FK
-    # name from alembic 0001 is `fk_post_source_id_source` per the
-    # NAMING_CONVENTION in models/base.py.
-    op.alter_column("post", "source_id", nullable=True)
-    op.drop_constraint("fk_post_source_id_source", "post", type_="foreignkey")
-    op.create_foreign_key(
-        "fk_post_source_id_source", "post", "source",
-        ["source_id"], ["id"], ondelete="SET NULL",
-    )
-
-    # Step 5: relax image_provenance.source_id + flip FK to SET NULL.
-    op.alter_column("image_provenance", "source_id", nullable=True)
-    op.drop_constraint(
-        "fk_image_provenance_source_id_source", "image_provenance",
-        type_="foreignkey",
-    )
-    op.create_foreign_key(
-        "fk_image_provenance_source_id_source", "image_provenance", "source",
-        ["source_id"], ["id"], ondelete="SET NULL",
-    )
-
-    # Step 6: partial unique index on (artist_id, external_post_id) for
-    # NULL-source Posts. The existing uq_post_source_external_id keeps
-    # guarding source-bound rows; NULL-source rows now dedupe within
-    # an artist.
-    op.execute(
-        "CREATE UNIQUE INDEX uq_post_artist_external_id_null_source "
-        "ON post (artist_id, external_post_id) "
-        "WHERE source_id IS NULL"
-    )
-
-    # Step 7: retire sidecar synthetic Sources. NULL out the references
-    # FIRST (the new FK is SET NULL so CASCADE wouldn't fire anyway, but
-    # being explicit makes the intent clear). Then delete the synthetic
-    # source rows. Any DownloadEvent rows under synthetics CASCADE-die
-    # with the source — synthetics have enabled=false so there shouldn't
-    # be any in practice.
-    conn.execute(text("""
-        UPDATE post
-        SET source_id = NULL
-        WHERE source_id IN (SELECT id FROM source WHERE url LIKE 'sidecar:%')
-    """))
-    conn.execute(text("""
-        UPDATE image_provenance
-        SET source_id = NULL
-        WHERE source_id IN (SELECT id FROM source WHERE url LIKE 'sidecar:%')
-    """))
-    deleted = conn.execute(text(
-        "DELETE FROM source WHERE url LIKE 'sidecar:%' RETURNING id"
-    )).rowcount
-    print(f"alembic 0030: deleted {deleted} sidecar synthetic source rows")
-
-
-def downgrade() -> None:
-    # Lossy migration — the deleted sidecar synthetics can't be
-    # restored from the orphan post.source_id / image_provenance.source_id
-    # values, and the partial unique index encodes a constraint that
-    # NULL-source Posts may now exist. No safe downgrade.
-    pass

alembic/versions/0031_source_backfill_runs_remaining.py

@@ -1,45 +0,0 @@
-"""source.backfill_runs_remaining: sticky deep-scan mode
-
-Revision ID: 0031
-Revises: 0030
-Create Date: 2026-06-01
-
-Tick vs backfill mode for subscription downloads. When
-`backfill_runs_remaining > 0`, the next N download runs use
-`skip: True` + 30-min timeout (walk full history). When 0, runs use
-`skip: "exit:20"` + 14.5-min timeout (catch-up mode, exits early once
-20 contiguous archived items are seen).
-
-Operator-flagged 2026-06-01 (Knuxy run #38887): a creator with ~550
-archived posts saturates the 870s catch-up timeout even when there is
-no new content, because gallery-dl's default `skip: True` keeps walking.
-Tick mode short-circuits that; backfill mode is the explicit opt-in for
-deep history scans.
-
-Default 0 (all existing subscriptions start in tick mode).
-"""
-from typing import Sequence, Union
-
-import sqlalchemy as sa
-from alembic import op
-
-revision: str = "0031"
-down_revision: Union[str, None] = "0030"
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
-
-
-def upgrade() -> None:
-    op.add_column(
-        "source",
-        sa.Column(
-            "backfill_runs_remaining",
-            sa.Integer,
-            nullable=False,
-            server_default="0",
-        ),
-    )
-
-
-def downgrade() -> None:
-    op.drop_column("source", "backfill_runs_remaining")

alembic/versions/0032_source_error_type.py

@@ -1,41 +0,0 @@
-"""source.error_type: surface ErrorType taxonomy in FailingSourcesCard
-
-Revision ID: 0032
-Revises: 0031
-Create Date: 2026-06-02
-
-Audit 2026-06-02: the backend computes 13 ErrorType categories (auth_error,
-rate_limited, not_found, access_denied, validation_failed, etc.) and
-stamps each one on DownloadEvent.metadata, but the Source row only carried
-the free-text last_error. Operators couldn't bulk-triage failing sources
-("all auth_error → rotate cookies, all rate_limited → just wait") without
-opening Logs per row.
-
-This column receives the last error_type from _update_source_health
-and gets cleared on a successful run. Nullable + indexed so the failing-
-sources rollup can filter/group cheaply.
-"""
-from typing import Sequence, Union
-
-import sqlalchemy as sa
-from alembic import op
-
-revision: str = "0032"
-down_revision: Union[str, None] = "0031"
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
-
-
-def upgrade() -> None:
-    op.add_column(
-        "source",
-        sa.Column("error_type", sa.String(length=32), nullable=True),
-    )
-    op.create_index(
-        "ix_source_error_type", "source", ["error_type"],
-    )
-
-
-def downgrade() -> None:
-    op.drop_index("ix_source_error_type", table_name="source")
-    op.drop_column("source", "error_type")

alembic/versions/0033_suggestion_threshold_default_070.py

@@ -1,48 +0,0 @@
-"""suggestion_threshold default 0.50 → 0.70
-
-Revision ID: 0033
-Revises: 0032
-Create Date: 2026-06-02
-
-Operator-flagged 2026-06-02 — the 0.50 default (set on 2026-06-01) is
-too noisy in practice; raise to 0.70 for both suggestion categories.
-
-Only conditionally updates singletons whose current value is still the
-2026-06-01 default (0.50). Operators who deliberately tuned their row
-to some other value (0.55, 0.65, 0.80, etc. via the Settings UI) keep
-their pick — the migration only catches the unchanged-default case.
-"""
-from typing import Sequence, Union
-
-from alembic import op
-
-revision: str = "0033"
-down_revision: Union[str, None] = "0032"
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
-
-
-def upgrade() -> None:
-    op.execute(
-        "UPDATE ml_settings "
-        "SET suggestion_threshold_character = 0.70 "
-        "WHERE id = 1 AND suggestion_threshold_character = 0.50"
-    )
-    op.execute(
-        "UPDATE ml_settings "
-        "SET suggestion_threshold_general = 0.70 "
-        "WHERE id = 1 AND suggestion_threshold_general = 0.50"
-    )
-
-
-def downgrade() -> None:
-    op.execute(
-        "UPDATE ml_settings "
-        "SET suggestion_threshold_character = 0.50 "
-        "WHERE id = 1 AND suggestion_threshold_character = 0.70"
-    )
-    op.execute(
-        "UPDATE ml_settings "
-        "SET suggestion_threshold_general = 0.50 "
-        "WHERE id = 1 AND suggestion_threshold_general = 0.70"
-    )

alembic/versions/0034_artist_visit.py

@@ -1,53 +0,0 @@
-"""artist_visit: per-artist last-viewed timestamp for the "+N new" badge
-
-Revision ID: 0034
-Revises: 0033
-Create Date: 2026-06-03
-
-Powers the artists-directory "+N new since last visit" badge + ArtistView
-banner. Single row per artist (no user_id yet — rule #47 multi-user ACL
-is aspirational; widens to (user_id, artist_id) PK when User lands).
-
-Seed every existing artist with `last_viewed_at = NOW()` so the badge
-starts at 0 across the board — no noisy "you have 5000 unseen images"
-on first deploy. New artists auto-get a row via
-`ArtistService.find_or_create`.
-"""
-from typing import Sequence, Union
-
-import sqlalchemy as sa
-from alembic import op
-
-revision: str = "0034"
-down_revision: Union[str, None] = "0033"
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
-
-
-def upgrade() -> None:
-    op.create_table(
-        "artist_visit",
-        sa.Column(
-            "artist_id",
-            sa.Integer,
-            sa.ForeignKey("artist.id", ondelete="CASCADE"),
-            primary_key=True,
-        ),
-        sa.Column(
-            "last_viewed_at",
-            sa.DateTime(timezone=True),
-            nullable=False,
-            server_default=sa.text("NOW()"),
-        ),
-    )
-    # Seed: every existing artist starts "fully caught up". Without this,
-    # every operator with N artists would see N badges (worth of every
-    # image ever imported) on first deploy.
-    op.execute(
-        "INSERT INTO artist_visit (artist_id, last_viewed_at) "
-        "SELECT id, NOW() FROM artist"
-    )
-
-
-def downgrade() -> None:
-    op.drop_table("artist_visit")

alembic/versions/0035_image_record_effective_date.py

@@ -1,70 +0,0 @@
-"""image_record.effective_date: materialized gallery sort key + index
-
-Revision ID: 0035
-Revises: 0034
-Create Date: 2026-06-04
-
-The gallery ordered/cursored on COALESCE(post.post_date,
-image_record.created_at) across the Post outer join. That expression spans
-two tables, so no index can serve it — every /scroll sorted a large slice
-of the library, and the frontend fired ten of them serially per initial
-load. Materialize the value into image_record.effective_date and index
-(effective_date DESC, id DESC) so the cursor scroll is an index range scan.
-
-Backfill = COALESCE(primary post's post_date, created_at) so existing rows
-keep their exact ordering. New rows get the created_at-equivalent server
-default; services/importer.py overrides it with the post's date when a
-primary post with a date is linked.
-"""
-from typing import Sequence, Union
-
-import sqlalchemy as sa
-from alembic import op
-
-revision: str = "0035"
-down_revision: Union[str, None] = "0034"
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
-
-
-def upgrade() -> None:
-    # Add nullable first so the backfill can populate before NOT NULL.
-    op.add_column(
-        "image_record",
-        sa.Column("effective_date", sa.DateTime(timezone=True), nullable=True),
-    )
-    # Pure set-based UPDATEs (no per-row params) — immune to the 65535
-    # bind-parameter ceiling regardless of library size.
-    op.execute(
-        """
-        UPDATE image_record AS ir
-        SET effective_date = COALESCE(p.post_date, ir.created_at)
-        FROM post AS p
-        WHERE ir.primary_post_id = p.id
-        """
-    )
-    op.execute(
-        """
-        UPDATE image_record
-        SET effective_date = created_at
-        WHERE effective_date IS NULL
-        """
-    )
-    op.alter_column(
-        "image_record",
-        "effective_date",
-        nullable=False,
-        server_default=sa.text("now()"),
-    )
-    # DESC/DESC matches the gallery's ORDER BY effective_date DESC, id DESC
-    # so the scroll is a forward index scan; raw SQL because alembic's
-    # column list doesn't express per-column DESC cleanly.
-    op.execute(
-        "CREATE INDEX ix_image_record_effective_date "
-        "ON image_record (effective_date DESC, id DESC)"
-    )
-
-
-def downgrade() -> None:
-    op.drop_index("ix_image_record_effective_date", table_name="image_record")
-    op.drop_column("image_record", "effective_date")

alembic/versions/0036_siglip_embedding_hnsw_index.py

@@ -1,41 +0,0 @@
-"""image_record.siglip_embedding: HNSW cosine index for "more like this"
-
-Revision ID: 0036
-Revises: 0035
-Create Date: 2026-06-04
-
-Gallery Phase 3 (visual similarity search) ranks images by
-`siglip_embedding.cosine_distance(source_embedding)`. Without an index that's
-a sequential scan computing a 1152-dim distance for every row — fine at small
-scale, but it grows linearly with the library. Add an HNSW index with
-`vector_cosine_ops` so the top-N nearest search is sub-50ms ANN.
-
-1152 dims is under pgvector's 2000-dim HNSW limit, so HNSW (no training,
-better recall than IVFFlat) is the right choice. ONE-TIME COST: building the
-index over the existing embeddings (~57k vectors on the operator's library)
-locks image_record for ~30-60s during this migration on deploy — acceptable
-for a single-operator homelab. NULL embeddings (videos / not-yet-embedded
-rows) are simply not indexed.
-"""
-from typing import Sequence, Union
-
-from alembic import op
-
-revision: str = "0036"
-down_revision: Union[str, None] = "0035"
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
-
-
-def upgrade() -> None:
-    # Raw SQL: alembic's create_index doesn't express the `USING hnsw (...
-    # vector_cosine_ops)` access-method + opclass cleanly. Must match the
-    # query's cosine_distance operator class to be usable by the planner.
-    op.execute(
-        "CREATE INDEX ix_image_record_siglip_hnsw "
-        "ON image_record USING hnsw (siglip_embedding vector_cosine_ops)"
-    )
-
-
-def downgrade() -> None:
-    op.drop_index("ix_image_record_siglip_hnsw", table_name="image_record")

alembic/versions/0037_patreon_seen_media.py

@@ -1,53 +0,0 @@
-"""patreon_seen_media: per-source ledger of already-ingested Patreon media
-
-Revision ID: 0037
-Revises: 0036
-Create Date: 2026-06-05
-
-Native Patreon ingester (build step 2a). Replaces gallery-dl's
-archive.sqlite3 with our own queryable table. The downloader upserts one
-row per (source, media) so routine walks skip media we've already
-processed; a future "recovery" mode bypasses the ledger to re-walk.
-
-`filehash` is a 32-hex Patreon CDN MD5, OR a video sentinel of the form
-``video:<post_id>:<media_id>`` — hence String(128). The unique
-constraint on (source_id, filehash) is the dedup upsert key.
-"""
-from typing import Sequence, Union
-
-import sqlalchemy as sa
-from alembic import op
-
-revision: str = "0037"
-down_revision: Union[str, None] = "0036"
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
-
-
-def upgrade() -> None:
-    op.create_table(
-        "patreon_seen_media",
-        sa.Column("id", sa.Integer, primary_key=True),
-        sa.Column(
-            "source_id",
-            sa.Integer,
-            sa.ForeignKey("source.id", ondelete="CASCADE"),
-            nullable=False,
-            index=True,
-        ),
-        sa.Column("filehash", sa.String(128), nullable=False),
-        sa.Column("post_id", sa.String(64), nullable=True),
-        sa.Column(
-            "seen_at",
-            sa.DateTime(timezone=True),
-            nullable=False,
-            server_default=sa.text("NOW()"),
-        ),
-        sa.UniqueConstraint(
-            "source_id", "filehash", name="uq_patreon_seen_media_source_id"
-        ),
-    )
-
-
-def downgrade() -> None:
-    op.drop_table("patreon_seen_media")

alembic/versions/0038_patreon_failed_media.py

@@ -1,58 +0,0 @@
-"""patreon_failed_media: per-source dead-letter ledger for failing Patreon media
-
-Revision ID: 0038
-Revises: 0037
-Create Date: 2026-06-06
-
-Plan #705 (#7). Media that keeps failing to download/validate (404'd CDN,
-deleted post, geo-blocked Mux, persistently-corrupt bytes) gets recorded here
-with an attempt counter; once it crosses the dead-letter threshold the ingester
-skips it on routine walks (recovery still re-attempts). A clean download clears
-the row. UNIQUE (source_id, filehash) is the upsert key (same media key the
-seen-ledger uses).
-"""
-from typing import Sequence, Union
-
-import sqlalchemy as sa
-from alembic import op
-
-revision: str = "0038"
-down_revision: Union[str, None] = "0037"
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
-
-
-def upgrade() -> None:
-    op.create_table(
-        "patreon_failed_media",
-        sa.Column("id", sa.Integer, primary_key=True),
-        sa.Column(
-            "source_id",
-            sa.Integer,
-            sa.ForeignKey("source.id", ondelete="CASCADE"),
-            nullable=False,
-            index=True,
-        ),
-        sa.Column("filehash", sa.String(128), nullable=False),
-        sa.Column("attempts", sa.Integer, nullable=False, server_default="1"),
-        sa.Column("last_error", sa.Text, nullable=True),
-        sa.Column(
-            "first_failed_at",
-            sa.DateTime(timezone=True),
-            nullable=False,
-            server_default=sa.text("NOW()"),
-        ),
-        sa.Column(
-            "last_failed_at",
-            sa.DateTime(timezone=True),
-            nullable=False,
-            server_default=sa.text("NOW()"),
-        ),
-        sa.UniqueConstraint(
-            "source_id", "filehash", name="uq_patreon_failed_media_source_id"
-        ),
-    )
-
-
-def downgrade() -> None:
-    op.drop_table("patreon_failed_media")

alembic/versions/0039_library_audit_resume.py

@@ -1,40 +0,0 @@
-"""library_audit_run: resume cursor + progress timestamp for chunked scans
-
-Revision ID: 0039
-Revises: 0038
-Create Date: 2026-06-07
-
-scan_library_for_rule used to run one 2h pass that timed out on large libraries
-and monopolized the concurrency-1 maintenance queue (operator-flagged). It now
-runs short time-boxed chunks that re-enqueue: `resume_after_id` persists the
-keyset cursor so the next chunk continues where it left off, and
-`last_progress_at` lets the recovery sweep tell a progressing multi-chunk audit
-from a genuinely stuck one.
-"""
-from typing import Sequence, Union
-
-import sqlalchemy as sa
-from alembic import op
-
-revision: str = "0039"
-down_revision: Union[str, None] = "0038"
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
-
-
-def upgrade() -> None:
-    op.add_column(
-        "library_audit_run",
-        sa.Column(
-            "resume_after_id", sa.Integer, nullable=False, server_default="0"
-        ),
-    )
-    op.add_column(
-        "library_audit_run",
-        sa.Column("last_progress_at", sa.DateTime(timezone=True), nullable=True),
-    )
-
-
-def downgrade() -> None:
-    op.drop_column("library_audit_run", "last_progress_at")
-    op.drop_column("library_audit_run", "resume_after_id")

alembic/versions/0040_series_chapters.py

@@ -1,108 +0,0 @@
-"""series chapters: chapter layer over series_page (FC-6.1)
-
-Revision ID: 0040
-Revises: 0039
-Create Date: 2026-06-07
-
-A series (Tag kind='series') gains an ordered chapter layer. Reading order
-becomes (series_chapter.chapter_number, series_page.page_number). Every existing
-series is backfilled into a single auto-chapter (chapter_number=1) holding its
-current flat pages, so no data is lost and the old flat ordering is preserved.
-"""
-from typing import Sequence, Union
-
-import sqlalchemy as sa
-from alembic import op
-
-revision: str = "0040"
-down_revision: Union[str, None] = "0039"
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
-
-
-def upgrade() -> None:
-    op.create_table(
-        "series_chapter",
-        sa.Column("id", sa.Integer, primary_key=True),
-        sa.Column(
-            "series_tag_id",
-            sa.Integer,
-            sa.ForeignKey("tag.id", ondelete="CASCADE"),
-            nullable=False,
-        ),
-        sa.Column("chapter_number", sa.Integer, nullable=False),
-        sa.Column("title", sa.Text, nullable=True),
-        sa.Column(
-            "is_placeholder", sa.Boolean, nullable=False, server_default="false"
-        ),
-        sa.Column("stated_page_start", sa.Integer, nullable=True),
-        sa.Column("stated_page_end", sa.Integer, nullable=True),
-        sa.Column(
-            "created_at",
-            sa.DateTime(timezone=True),
-            nullable=False,
-            server_default=sa.text("now()"),
-        ),
-        sa.Column(
-            "updated_at",
-            sa.DateTime(timezone=True),
-            nullable=False,
-            server_default=sa.text("now()"),
-        ),
-    )
-    op.create_index(
-        "ix_series_chapter_series_tag_id", "series_chapter", ["series_tag_id"]
-    )
-
-    # New columns on series_page; chapter_id starts nullable so we can backfill.
-    op.add_column(
-        "series_page", sa.Column("chapter_id", sa.Integer, nullable=True)
-    )
-    op.add_column(
-        "series_page", sa.Column("stated_page", sa.Integer, nullable=True)
-    )
-
-    conn = op.get_bind()
-    # One auto-chapter per existing series (any series_tag_id present in pages).
-    conn.execute(
-        sa.text(
-            "INSERT INTO series_chapter "
-            "(series_tag_id, chapter_number, is_placeholder, created_at, updated_at) "
-            "SELECT DISTINCT series_tag_id, 1, false, now(), now() "
-            "FROM series_page"
-        )
-    )
-    # Point every existing page at its series' auto-chapter.
-    conn.execute(
-        sa.text(
-            "UPDATE series_page sp "
-            "SET chapter_id = sc.id "
-            "FROM series_chapter sc "
-            "WHERE sc.series_tag_id = sp.series_tag_id"
-        )
-    )
-
-    # Now lock chapter_id down: NOT NULL + FK (cascade) + index.
-    op.alter_column("series_page", "chapter_id", nullable=False)
-    op.create_foreign_key(
-        "fk_series_page_chapter_id",
-        "series_page",
-        "series_chapter",
-        ["chapter_id"],
-        ["id"],
-        ondelete="CASCADE",
-    )
-    op.create_index(
-        "ix_series_page_chapter_id", "series_page", ["chapter_id"]
-    )
-
-
-def downgrade() -> None:
-    op.drop_index("ix_series_page_chapter_id", table_name="series_page")
-    op.drop_constraint(
-        "fk_series_page_chapter_id", "series_page", type_="foreignkey"
-    )
-    op.drop_column("series_page", "stated_page")
-    op.drop_column("series_page", "chapter_id")
-    op.drop_index("ix_series_chapter_series_tag_id", table_name="series_chapter")
-    op.drop_table("series_chapter")

alembic/versions/0041_series_suggestions.py

@@ -1,98 +0,0 @@
-"""series suggestions: assisted-continuation matcher (FC-6.3)
-
-Revision ID: 0041
-Revises: 0040
-Create Date: 2026-06-07
-
-A confirm-only queue of "this post may continue this series" hints, plus two
-import_settings knobs (enable + score threshold) for the matcher.
-"""
-from typing import Sequence, Union
-
-import sqlalchemy as sa
-from alembic import op
-
-revision: str = "0041"
-down_revision: Union[str, None] = "0040"
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
-
-
-def upgrade() -> None:
-    op.create_table(
-        "series_suggestion",
-        sa.Column("id", sa.Integer, primary_key=True),
-        sa.Column(
-            "post_id",
-            sa.Integer,
-            sa.ForeignKey("post.id", ondelete="CASCADE"),
-            nullable=False,
-        ),
-        sa.Column(
-            "series_tag_id",
-            sa.Integer,
-            sa.ForeignKey("tag.id", ondelete="CASCADE"),
-            nullable=False,
-        ),
-        sa.Column("score", sa.Float, nullable=False),
-        sa.Column("signals", sa.JSON, nullable=True),
-        sa.Column(
-            "status", sa.String(16), nullable=False, server_default="pending"
-        ),
-        sa.Column(
-            "created_at",
-            sa.DateTime(timezone=True),
-            nullable=False,
-            server_default=sa.text("now()"),
-        ),
-        sa.Column(
-            "updated_at",
-            sa.DateTime(timezone=True),
-            nullable=False,
-            server_default=sa.text("now()"),
-        ),
-        sa.UniqueConstraint(
-            "post_id", "series_tag_id", name="uq_series_suggestion_post_series"
-        ),
-    )
-    op.create_index(
-        "ix_series_suggestion_post_id", "series_suggestion", ["post_id"]
-    )
-    op.create_index(
-        "ix_series_suggestion_series_tag_id",
-        "series_suggestion",
-        ["series_tag_id"],
-    )
-    op.create_index(
-        "ix_series_suggestion_status", "series_suggestion", ["status"]
-    )
-
-    op.add_column(
-        "import_settings",
-        sa.Column(
-            "series_suggest_enabled",
-            sa.Boolean,
-            nullable=False,
-            server_default=sa.true(),
-        ),
-    )
-    op.add_column(
-        "import_settings",
-        sa.Column(
-            "series_suggest_threshold",
-            sa.Float,
-            nullable=False,
-            server_default="0.5",
-        ),
-    )
-
-
-def downgrade() -> None:
-    op.drop_column("import_settings", "series_suggest_threshold")
-    op.drop_column("import_settings", "series_suggest_enabled")
-    op.drop_index("ix_series_suggestion_status", table_name="series_suggestion")
-    op.drop_index(
-        "ix_series_suggestion_series_tag_id", table_name="series_suggestion"
-    )
-    op.drop_index("ix_series_suggestion_post_id", table_name="series_suggestion")
-    op.drop_table("series_suggestion")

backend/app/__init__.py

@@ -3,23 +3,13 @@
 import logging
 from pathlib import Path
 
-from quart import Quart, request
+from quart import Quart
 
 from .api import all_blueprints
 from .config import get_config
 from .frontend import frontend_bp
 from .services.credential_crypto import CredentialCrypto
 
-# Browser-extension origins. The FabledCurator extension fetches from
-# moz-extension://<uuid>/ on Firefox and chrome-extension://<uuid>/ on
-# Chromium-based browsers. Operator-flagged 2026-05-26: extension's
-# 'Test connection' returned `NetworkError` because the X-Extension-Key
-# header on /api/credentials triggers a CORS preflight that our routes
-# don't handle. Whitelisting only these two schemes (not opening CORS
-# up generally) lets the extension talk to a plain-HTTP self-hosted FC
-# without weakening the no-CORS posture for normal browser usage.
-_EXTENSION_ORIGIN_SCHEMES = ("moz-extension://", "chrome-extension://")
-
 _CREDENTIAL_KEY_PATH = Path("/images/secrets/credential_key.b64")
 
 
@@ -33,39 +23,18 @@ def create_app() -> Quart:
 
     app = Quart(__name__)
     app.secret_key = cfg.secret_key
+    # FC-5: legacy IR ingest JSON can run to tens of MB (hundreds of
+    # thousands of image_tag_associations). Werkzeug's default form
+    # memory cap is 500KB; raise both ceilings so the multipart upload
+    # for /api/migrate/ir_ingest doesn't 413.
+    app.config["MAX_CONTENT_LENGTH"] = 1024 * 1024 * 1024   # 1 GB
+    app.config["MAX_FORM_MEMORY_SIZE"] = 1024 * 1024 * 1024  # 1 GB
 
     for bp in all_blueprints():
         app.register_blueprint(bp)
     # Registered last so /api/* routes win over the SPA catch-all.
     app.register_blueprint(frontend_bp)
 
-    @app.before_request
-    async def _extension_cors_preflight():
-        # Short-circuit OPTIONS preflight from the browser extension with a
-        # 204 + CORS headers (the after_request hook below adds them).
-        # Without this, OPTIONS lands on routes that only declared POST/GET
-        # methods and 405s before the after_request gets a chance.
-        if request.method != "OPTIONS":
-            return None
-        origin = request.headers.get("Origin", "")
-        if any(origin.startswith(s) for s in _EXTENSION_ORIGIN_SCHEMES):
-            return "", 204
-        return None
-
-    @app.after_request
-    async def _extension_cors_headers(response):
-        origin = request.headers.get("Origin", "")
-        if any(origin.startswith(s) for s in _EXTENSION_ORIGIN_SCHEMES):
-            response.headers["Access-Control-Allow-Origin"] = origin
-            response.headers["Access-Control-Allow-Methods"] = (
-                "GET, POST, PATCH, DELETE, OPTIONS"
-            )
-            response.headers["Access-Control-Allow-Headers"] = (
-                "Content-Type, X-Extension-Key"
-            )
-            response.headers["Access-Control-Max-Age"] = "86400"
-        return response
-
     @app.after_serving
     async def _dispose_db_engine() -> None:
         from .extensions import dispose_engine

backend/app/api/__init__.py

@@ -14,18 +14,17 @@ api_bp.add_url_rule("/health", view_func=health.get_health, methods=["GET"])
 
 
 def all_blueprints() -> list[Blueprint]:
-    from .admin import admin_bp
     from .aliases import aliases_bp
     from .allowlist import allowlist_bp
     from .artist import artist_bp
     from .artists import artists_bp
     from .attachments import attachments_bp
-    from .cleanup import cleanup_bp
     from .credentials import credentials_bp
     from .downloads import downloads_bp
     from .extension import extension_bp
     from .gallery import gallery_bp
     from .import_admin import import_admin_bp
+    from .migrate import migrate_bp
     from .ml_admin import ml_admin_bp
     from .platforms import platforms_bp
     from .posts import posts_bp
@@ -34,10 +33,7 @@ def all_blueprints() -> list[Blueprint]:
     from .showcase import showcase_bp
     from .sources import sources_bp
     from .suggestions import suggestions_bp
-    from .system_activity import system_activity_bp
-    from .system_backup import system_backup_bp
     from .tags import tags_bp
-    from .thumbnails import thumbnails_bp
     return [
         api_bp,
         attachments_bp,
@@ -48,16 +44,12 @@ def all_blueprints() -> list[Blueprint]:
         artists_bp,
         showcase_bp,
         settings_bp,
-        system_activity_bp,
-        system_backup_bp,
-        admin_bp,
-        cleanup_bp,
         import_admin_bp,
+        migrate_bp,
         suggestions_bp,
         allowlist_bp,
         aliases_bp,
         ml_admin_bp,
-        thumbnails_bp,
         sources_bp,
         platforms_bp,
         posts_bp,

backend/app/api/_responses.py

@@ -1,16 +0,0 @@
-"""Shared API response helpers."""
-
-from quart import jsonify
-
-
-def error_response(
-    error: str, *, status: int = 400, detail: str | None = None, **extra,
-):
-    """JSON error body + HTTP status. `detail` is included only when given;
-    `extra` keys are merged into the body. Returns the (response, status)
-    tuple Quart expects. Imported as `_bad` by the blueprints."""
-    body = {"error": error}
-    if detail is not None:
-        body["detail"] = detail
-    body.update(extra)
-    return jsonify(body), status

backend/app/api/admin.py

@@ -1,328 +0,0 @@
-"""FC-3k: /api/admin — destructive admin actions.
-
-Five action surfaces:
-  POST   /api/admin/artists/<slug>/cascade-delete  (Tier C)
-  POST   /api/admin/images/bulk-delete             (Tier C)
-  DELETE /api/admin/tags/<int:tag_id>              (Tier B)
-  POST   /api/admin/tags/<int:dest_id>/merge       (Tier B)
-  POST   /api/admin/tags/prune-unused              (Tier A)
-  POST   /api/admin/tags/purge-legacy              (Tier A)
-  GET    /api/admin/tags/<int:tag_id>/usage-count  (helper)
-
-Tier-C ops take a dry_run body flag (returns projection inline,
-no dispatch) and a confirm body field (server-recomputed token).
-Long-running ops dispatch a maintenance-queue Celery task; the UI
-tails FC-3i's /api/system/activity/runs to surface progress.
-"""
-from __future__ import annotations
-
-import hashlib
-
-from quart import Blueprint, jsonify, request
-from sqlalchemy import select, text
-
-from ..extensions import get_session
-from ..models import Artist
-from ..services.cleanup_service import project_artist_cascade, project_bulk_image_delete
-from ._responses import error_response as _bad
-
-admin_bp = Blueprint("admin", __name__, url_prefix="/api/admin")
-
-
-def _bulk_image_confirm_token(image_ids: list[int]) -> str:
-    """Stable 8-hex token derived from the sorted id list. Mutates
-    when the selection changes; stays the same across modal opens of
-    the same selection so the operator can paste without confusion."""
-    canon = ",".join(str(i) for i in sorted(image_ids))
-    digest = hashlib.sha256(canon.encode("utf-8")).hexdigest()
-    return digest[:8]
-
-
-@admin_bp.route("/artists/<slug>/cascade-delete", methods=["POST"])
-async def artist_cascade_delete(slug: str):
-    body = await request.get_json(silent=True) or {}
-    dry_run = bool(body.get("dry_run", False))
-    supplied_confirm = body.get("confirm", "")
-
-    async with get_session() as session:
-        artist = (await session.execute(
-            select(Artist).where(Artist.slug == slug)
-        )).scalar_one_or_none()
-        if artist is None:
-            return _bad("not_found", status=404)
-        artist_id = artist.id
-
-        projected = await session.run_sync(
-            lambda sync_sess: project_artist_cascade(sync_sess, slug=slug)
-        )
-
-    if dry_run:
-        return jsonify(projected)
-
-    expected = f"delete-artist-{artist_id}"
-    if supplied_confirm != expected:
-        return _bad(
-            "confirm_mismatch",
-            detail=f"confirm must equal {expected!r}",
-            expected=expected,
-        )
-
-    from ..tasks.admin import delete_artist_cascade_task
-    async_result = delete_artist_cascade_task.delay(artist_id=artist_id)
-    return jsonify({"task_id": async_result.id}), 202
-
-
-@admin_bp.route("/images/bulk-delete", methods=["POST"])
-async def images_bulk_delete():
-    body = await request.get_json(silent=True) or {}
-    image_ids = body.get("image_ids")
-    if not isinstance(image_ids, list) or not image_ids:
-        return _bad("invalid_image_ids", detail="image_ids must be non-empty list of int")
-    try:
-        image_ids = [int(i) for i in image_ids]
-    except (TypeError, ValueError):
-        return _bad("invalid_image_ids", detail="image_ids must contain only ints")
-
-    dry_run = bool(body.get("dry_run", False))
-    supplied_confirm = body.get("confirm", "")
-
-    async with get_session() as session:
-        projected = await session.run_sync(
-            lambda sync_sess: project_bulk_image_delete(
-                sync_sess, image_ids=image_ids,
-            )
-        )
-
-    sha8 = _bulk_image_confirm_token(image_ids)
-    expected = f"delete-images-{sha8}"
-
-    if dry_run:
-        # Hand the canonical Tier-C confirm token back with the
-        # projection so the frontend doesn't have to recompute SHA-256
-        # client-side via crypto.subtle (Secure-Context-gated,
-        # undefined on plain-HTTP origins per the homelab posture).
-        # Operator-flagged 2026-05-27.
-        projected["confirm_token"] = expected
-        return jsonify(projected)
-
-
-    if supplied_confirm != expected:
-        return _bad(
-            "confirm_mismatch",
-            detail=f"confirm must equal {expected!r}",
-            expected=expected,
-        )
-
-    from ..tasks.admin import bulk_delete_images_task
-    async_result = bulk_delete_images_task.delay(image_ids=image_ids)
-    return jsonify({"task_id": async_result.id}), 202
-
-
-@admin_bp.route("/tags/<int:tag_id>", methods=["DELETE"])
-async def tag_delete(tag_id: int):
-    """Tier-B sync delete. UI yes/no modal is the only confirmation."""
-    from ..services.cleanup_service import delete_tag
-
-    async with get_session() as session:
-        try:
-            result = await session.run_sync(
-                lambda sync_sess: delete_tag(sync_sess, tag_id=tag_id)
-            )
-        except LookupError:
-            return _bad("not_found", status=404)
-    return jsonify(result)
-
-
-@admin_bp.route("/tags/<int:dest_id>/merge", methods=["POST"])
-async def tag_merge(dest_id: int):
-    """Wraps TagService.merge. Source repoints to dest, dest survives,
-    source row deleted, protective alias auto-created if source was
-    ML-applied or allowlisted."""
-    from ..services.tag_service import TagMergeConflict, TagService, TagValidationError
-
-    body = await request.get_json(silent=True) or {}
-    source_id = body.get("source_id")
-    if not isinstance(source_id, int) or source_id == dest_id:
-        return _bad("invalid_source_id", detail="source_id must be int and differ from dest")
-
-    async with get_session() as session:
-        try:
-            result = await TagService(session).merge(
-                source_id=source_id, target_id=dest_id,
-            )
-        except TagMergeConflict as exc:
-            return _bad("merge_conflict", status=409, detail=str(exc))
-        except TagValidationError as exc:
-            return _bad("tag_kind_mismatch", detail=str(exc))
-        except LookupError:
-            return _bad("not_found", status=404)
-
-    # MergeResult is a frozen dataclass — flatten to dict.
-    return jsonify({
-        "result": {
-            "target_id": result.target_id,
-            "target_name": result.target_name,
-            "target_kind": result.target_kind,
-            "merged_count": result.merged_count,
-            "alias_created": result.alias_created,
-            "source_deleted": result.source_deleted,
-        },
-    })
-
-
-@admin_bp.route("/tags/<int:tag_id>/usage-count", methods=["GET"])
-async def tag_usage_count(tag_id: int):
-    """Helper for the Tier-B yes/no prompt; surfaces "N associations"
-    in the dialog so the operator knows what they're nuking."""
-    from ..services.cleanup_service import count_tag_associations
-
-    async with get_session() as session:
-        count = await session.run_sync(
-            lambda sync_sess: count_tag_associations(
-                sync_sess, tag_id=tag_id,
-            )
-        )
-    return jsonify({"count": count})
-
-
-@admin_bp.route("/tags/prune-unused", methods=["POST"])
-async def tags_prune_unused():
-    """Tier-A: dry-run preview list IS the prompt. UI calls with
-    dry_run=true first, shows the list, operator clicks button to
-    re-call with dry_run=false."""
-    from ..services.cleanup_service import prune_unused_tags
-
-    body = await request.get_json(silent=True) or {}
-    dry_run = bool(body.get("dry_run", False))
-
-    async with get_session() as session:
-        result = await session.run_sync(
-            lambda sync_sess: prune_unused_tags(
-                sync_sess, dry_run=dry_run,
-            )
-        )
-    return jsonify(result)
-
-
-@admin_bp.route("/tags/purge-legacy", methods=["POST"])
-async def tags_purge_legacy():
-    """Tier-A: delete legacy IR-migration tags — archive/post/artist
-    kinds (e.g. `BlenderKnight:Hannah_BJ_Loops`) PLUS general tags with
-    a legacy name prefix (`source:*`, from IR's source kind that fell
-    back to general). dry-run preview returns per-kind + per-prefix
-    counts + a sample so the UI shows exactly what'll go before the
-    operator confirms with dry_run=false."""
-    from ..services.cleanup_service import purge_legacy_tags
-
-    body = await request.get_json(silent=True) or {}
-    dry_run = bool(body.get("dry_run", False))
-
-    async with get_session() as session:
-        result = await session.run_sync(
-            lambda sync_sess: purge_legacy_tags(sync_sess, dry_run=dry_run)
-        )
-    return jsonify(result)
-
-
-@admin_bp.route("/tags/reset-content", methods=["POST"])
-async def tags_reset_content():
-    """Tier-A: delete ALL general + character tags (the Camie-suggestable
-    content vocabulary) so the operator can re-tag from scratch via
-    auto-suggest. fandom + series tags + series_page ordering are preserved,
-    and image tagger_predictions are untouched so suggestions repopulate.
-    dry-run preview returns per-kind counts + applications + a sample so the
-    UI shows exactly what'll go before the operator confirms (dry_run=false).
-    Irreversible except via DB backup restore."""
-    from ..services.cleanup_service import reset_content_tagging
-
-    body = await request.get_json(silent=True) or {}
-    dry_run = bool(body.get("dry_run", False))
-
-    async with get_session() as session:
-        result = await session.run_sync(
-            lambda sync_sess: reset_content_tagging(sync_sess, dry_run=dry_run)
-        )
-    return jsonify(result)
-
-
-@admin_bp.route("/tags/normalize", methods=["POST"])
-async def tags_normalize():
-    """#714: retro-normalize existing tags to the #701 canonical form (Title
-    Case + collapsed whitespace) and merge case/whitespace-variant duplicates.
-
-    dry_run=true (default) returns a projection inline — group/collision/rename
-    counts + a sample of the changes — so the UI shows exactly what'll happen.
-    dry_run=false dispatches the long-running maintenance task (the merge FK
-    repoints can touch many tags); the UI tails the activity dashboard for the
-    summary. Idempotent; back up first (the merges are irreversible)."""
-    from ..services.tag_service import normalize_existing_tags
-
-    body = await request.get_json(silent=True) or {}
-    dry_run = bool(body.get("dry_run", True))
-
-    if dry_run:
-        async with get_session() as session:
-            result = await normalize_existing_tags(session, dry_run=True)
-        return jsonify(result)
-
-    from ..tasks.admin import normalize_tags_task
-
-    async_result = normalize_tags_task.delay()
-    return jsonify({"task_id": async_result.id, "status": "queued"}), 202
-
-
-@admin_bp.route("/maintenance/db-stats", methods=["GET"])
-async def db_stats():
-    """Per-table bloat readout (pg_stat_user_tables) for the high-churn tables
-    so the operator can see when a VACUUM is worth running."""
-    from ..tasks.maintenance import VACUUM_TABLES
-
-    wanted = set(VACUUM_TABLES)
-    async with get_session() as session:
-        rows = (await session.execute(text(
-            "SELECT relname, n_live_tup, n_dead_tup, last_vacuum, "
-            "last_autovacuum, last_analyze FROM pg_stat_user_tables"
-        ))).all()
-
-    def _iso(v):
-        return v.isoformat() if v is not None else None
-
-    out = []
-    for r in rows:
-        if r.relname not in wanted:
-            continue
-        live = r.n_live_tup or 0
-        dead = r.n_dead_tup or 0
-        total = live + dead
-        out.append({
-            "table": r.relname,
-            "live": live,
-            "dead": dead,
-            "dead_pct": round(100 * dead / total, 1) if total else 0.0,
-            "last_vacuum": _iso(r.last_vacuum),
-            "last_autovacuum": _iso(r.last_autovacuum),
-            "last_analyze": _iso(r.last_analyze),
-        })
-    out.sort(key=lambda t: t["dead"], reverse=True)
-    return jsonify({"tables": out})
-
-
-@admin_bp.route("/maintenance/vacuum", methods=["POST"])
-async def trigger_vacuum():
-    """Operator-triggered VACUUM (ANALYZE) over the high-churn tables — the
-    same maintenance-queue task the weekly Beat schedule runs."""
-    from ..tasks.maintenance import vacuum_analyze
-
-    vacuum_analyze.delay()
-    return jsonify({"status": "queued"}), 202
-
-
-@admin_bp.route("/maintenance/reextract-archives", methods=["POST"])
-async def trigger_reextract_archives():
-    """Operator-triggered re-extract (#713): PostAttachments that are actually
-    archives but were filed opaquely (pre magic-byte gate) get extracted and
-    their members linked to the post. Idempotent; runs on the maintenance queue."""
-    from ..tasks.admin import reextract_archive_attachments_task
-
-    async_result = reextract_archive_attachments_task.delay()
-    return jsonify({"task_id": async_result.id, "status": "queued"}), 202

backend/app/api/cleanup.py

@@ -1,198 +0,0 @@
-"""FC-Cleanup: /api/cleanup/* — retroactive enforcement of import filters.
-
-Endpoints:
-  POST /min-dimension/preview     synchronous SQL audit
-  POST /min-dimension/delete      synchronous SQL delete (Tier-C token)
-  POST /audit                      async transparency / single_color start
-  GET  /audit                      list recent audit_run rows
-  GET  /audit/<id>                 single audit_run row
-  POST /audit/<id>/apply           apply matched_ids deletes (Tier-C token)
-  POST /audit/<id>/cancel          flip running audit to cancelled
-
-Unused-tags retroactive prune intentionally NOT in this namespace —
-TagMaintenanceCard (Maintenance tab → moved to Cleanup tab in v26.05.25.7)
-uses the existing /api/admin/tags/prune-unused endpoint via the admin
-store. No duplicate route here.
-
-Confirm-token format matches modal/DestructiveConfirmModal.vue convention:
-  `delete-min-dim-<sha8(w,h)>` for min-dim delete
-  `delete-audit-<id>` for audit apply
-(Modal hardcodes action ∈ {'restore', 'delete'}; "apply audit" is semantically a delete of the matched images, so we use `delete-audit-<id>`.)
-"""
-
-from __future__ import annotations
-
-import hashlib
-from pathlib import Path
-
-from quart import Blueprint, jsonify, request
-from sqlalchemy import select
-
-from ..extensions import get_session
-from ..models import LibraryAuditRun
-from ..services import cleanup_service
-from ._responses import error_response as _bad
-
-cleanup_bp = Blueprint("cleanup", __name__, url_prefix="/api/cleanup")
-
-IMAGES_ROOT = Path("/images")
-
-
-def _min_dim_token(min_w: int, min_h: int) -> str:
-    # SHA-256 (not MD5) — Web Crypto's subtle.digest rejects MD5; both
-    # sides use SHA-256 truncated to 8 hex chars.
-    canon = f"{min_w}x{min_h}"
-    return f"delete-min-dim-{hashlib.sha256(canon.encode()).hexdigest()[:8]}"
-
-
-def _serialize_audit_run(audit: LibraryAuditRun) -> dict:
-    return {
-        "id": audit.id,
-        "rule": audit.rule,
-        "params": audit.params,
-        "status": audit.status,
-        "started_at": audit.started_at.isoformat() if audit.started_at else None,
-        "finished_at": audit.finished_at.isoformat() if audit.finished_at else None,
-        "scanned_count": audit.scanned_count,
-        "matched_count": audit.matched_count,
-        "matched_ids": audit.matched_ids,
-        "error": audit.error,
-    }
-
-
-@cleanup_bp.route("/min-dimension/preview", methods=["POST"])
-async def min_dim_preview():
-    body = await request.get_json(silent=True) or {}
-    try:
-        min_w = int(body.get("min_width", 0))
-        min_h = int(body.get("min_height", 0))
-    except (TypeError, ValueError):
-        return _bad("invalid_dimensions")
-    if min_w < 0 or min_h < 0:
-        return _bad("invalid_dimensions")
-    async with get_session() as session:
-        projection = await session.run_sync(
-            lambda s: cleanup_service.project_min_dimension_violations(
-                s, min_width=min_w, min_height=min_h,
-            )
-        )
-    # Hand the canonical Tier-C delete token back with the preview so
-    # the frontend doesn't have to recompute SHA-256 client-side.
-    # window.crypto.subtle is Secure-Context-gated and undefined on
-    # plain-HTTP origins (homelab posture); without this the Delete
-    # button silently swallowed the TypeError and never opened the
-    # confirm modal. Operator-flagged 2026-05-27.
-    projection["confirm_token"] = _min_dim_token(min_w, min_h)
-    return jsonify(projection)
-
-
-@cleanup_bp.route("/min-dimension/delete", methods=["POST"])
-async def min_dim_delete():
-    body = await request.get_json(silent=True) or {}
-    try:
-        min_w = int(body.get("min_width", 0))
-        min_h = int(body.get("min_height", 0))
-    except (TypeError, ValueError):
-        return _bad("invalid_dimensions")
-    if min_w < 0 or min_h < 0:
-        return _bad("invalid_dimensions")
-    supplied = body.get("confirm", "")
-    expected = _min_dim_token(min_w, min_h)
-    if supplied != expected:
-        return _bad("confirm_mismatch", expected=expected)
-    async with get_session() as session:
-        deleted = await session.run_sync(
-            lambda s: cleanup_service.delete_min_dimension_violations(
-                s, min_width=min_w, min_height=min_h, images_root=IMAGES_ROOT,
-            )
-        )
-        await session.commit()
-    return jsonify({"deleted": deleted})
-
-
-@cleanup_bp.route("/audit", methods=["POST"])
-async def audit_create():
-    body = await request.get_json(silent=True) or {}
-    rule = body.get("rule")
-    params = body.get("params") or {}
-    if rule not in ("transparency", "single_color"):
-        return _bad("invalid_rule")
-    if not isinstance(params, dict):
-        return _bad("invalid_params")
-    async with get_session() as session:
-        try:
-            audit_id = await session.run_sync(
-                lambda s: cleanup_service.start_audit_run(
-                    s, rule=rule, params=params,
-                )
-            )
-        except cleanup_service.AuditAlreadyRunning as running_id:
-            return _bad(
-                "audit_already_running", status=409,
-                running_id=int(str(running_id)),
-            )
-        except ValueError as exc:
-            return _bad(str(exc))
-        await session.commit()
-    return jsonify({"audit_id": audit_id, "status": "running"}), 202
-
-
-@cleanup_bp.route("/audit/<int:audit_id>", methods=["GET"])
-async def audit_get(audit_id: int):
-    async with get_session() as session:
-        audit = (await session.execute(
-            select(LibraryAuditRun).where(LibraryAuditRun.id == audit_id)
-        )).scalar_one_or_none()
-        if audit is None:
-            return _bad("not_found", status=404)
-        return jsonify(_serialize_audit_run(audit))
-
-
-@cleanup_bp.route("/audit", methods=["GET"])
-async def audit_history():
-    try:
-        limit = min(int(request.args.get("limit", "20")), 100)
-    except ValueError:
-        return _bad("invalid_limit")
-    # Optional rule filter so a card can reconnect to ITS latest run on mount
-    # (?rule=transparency&limit=1) — the audit survives navigation; the UI
-    # rehydrates from this rather than losing the in-flight scan.
-    rule = request.args.get("rule") or None
-    async with get_session() as session:
-        stmt = select(LibraryAuditRun).order_by(LibraryAuditRun.id.desc())
-        if rule is not None:
-            stmt = stmt.where(LibraryAuditRun.rule == rule)
-        rows = (await session.execute(stmt.limit(limit))).scalars().all()
-        return jsonify({"runs": [_serialize_audit_run(r) for r in rows]})
-
-
-@cleanup_bp.route("/audit/<int:audit_id>/apply", methods=["POST"])
-async def audit_apply(audit_id: int):
-    body = await request.get_json(silent=True) or {}
-    confirm = body.get("confirm", "")
-    async with get_session() as session:
-        try:
-            deleted = await session.run_sync(
-                lambda s: cleanup_service.apply_audit_run(
-                    s, audit_id=audit_id, confirm_token=confirm,
-                    images_root=IMAGES_ROOT,
-                )
-            )
-        except cleanup_service.AuditNotReady as exc:
-            return _bad("audit_not_ready", current_status=str(exc))
-        except cleanup_service.ConfirmTokenMismatch as exc:
-            return _bad("confirm_mismatch", expected=str(exc))
-        except ValueError as exc:
-            return _bad("not_found", status=404, detail=str(exc))
-        await session.commit()
-    return jsonify({"deleted": deleted})
-
-
-@cleanup_bp.route("/audit/<int:audit_id>/cancel", methods=["POST"])
-async def audit_cancel(audit_id: int):
-    async with get_session() as session:
-        await session.run_sync(
-            lambda s: cleanup_service.cancel_audit_run(s, audit_id=audit_id)
-        )
-        await session.commit()
-    return jsonify({"cancelled": True})

backend/app/api/credentials.py

@@ -20,7 +20,6 @@ from ..services.credential_service import (
     UnknownPlatformError,
     WrongAuthTypeError,
 )
-from ._responses import error_response as _bad
 
 credentials_bp = Blueprint("credentials", __name__, url_prefix="/api/credentials")
 
@@ -39,6 +38,14 @@ def _get_crypto() -> CredentialCrypto:
     return _crypto
 
 
+def _bad(error: str, *, status: int = 400, detail: str | None = None, **extra):
+    body = {"error": error}
+    if detail is not None:
+        body["detail"] = detail
+    body.update(extra)
+    return jsonify(body), status
+
+
 async def _ext_key_ok(session) -> bool:
     """If X-Extension-Key is supplied, it must match the stored value.
     Missing header → True (browser path; accepted per homelab posture).
@@ -117,58 +124,3 @@ async def delete_credential(platform: str):
         except LookupError:
             return _bad("not_found", status=404)
     return "", 204
-
-
-@credentials_bp.route("/<platform>/verify", methods=["POST"])
-async def verify_credential(platform: str):
-    """Test the stored credential against one of the platform's enabled sources,
-    WITHOUT downloading. Routes through the platform's backend
-    (download_backends.verify_credential) — native ingester for Patreon, an
-    authenticated API page; gallery-dl --simulate for the rest. On success
-    stamps last_verified. Returns {valid: bool|null, reason, last_verified?};
-    valid=null means "couldn't test" (no credential, no enabled source, or an
-    inconclusive network/drift result)."""
-    from ..models import Artist, Source
-    from ..services.download_backends import verify_source_credential
-
-    async with get_session() as session:
-        if not await _ext_key_ok(session):
-            return _bad("unauthorized", status=401)
-        svc = CredentialService(session, _get_crypto())
-        record = await svc.get(platform)
-        if record is None:
-            return jsonify({"valid": None, "reason": "No credential stored for this platform."})
-
-        # Pick an enabled source for this platform to point the probe at.
-        row = (await session.execute(
-            select(Source, Artist)
-            .join(Artist, Artist.id == Source.artist_id)
-            .where(Source.platform == platform, Source.enabled.is_(True))
-            .order_by(Source.id.asc())
-        )).first()
-        if row is None:
-            return jsonify({
-                "valid": None,
-                "reason": "No enabled source for this platform to verify against — add a subscription first.",
-            })
-        source, artist = row
-
-        cookies_path = await svc.get_cookies_path(platform)
-        auth_token = await svc.get_token(platform)
-
-    ok, message = await verify_source_credential(
-        platform=platform,
-        url=source.url,
-        artist_slug=artist.slug,
-        config_overrides=source.config_overrides or {},
-        cookies_path=str(cookies_path) if cookies_path else None,
-        auth_token=auth_token,
-        images_root=Path("/images"),
-    )
-
-    last_verified = None
-    if ok:
-        async with get_session() as session:
-            ts = await CredentialService(session, _get_crypto()).mark_verified(platform)
-            last_verified = ts.isoformat() if ts else None
-    return jsonify({"valid": ok, "reason": message, "last_verified": last_verified})

backend/app/api/downloads.py

@@ -5,10 +5,8 @@ status/source/artist. Returns slim records.
 Detail view: full DownloadEvent including the metadata JSONB.
 """
 
-from datetime import UTC, datetime, timedelta
-
 from quart import Blueprint, jsonify, request
-from sqlalchemy import func, select
+from sqlalchemy import select
 
 from ..extensions import get_session
 from ..models import Artist, DownloadEvent, Source
@@ -44,9 +42,6 @@ def _list_record(event: DownloadEvent, source: Source | None, artist: Artist | N
         "bytes_downloaded": event.bytes_downloaded,
         "error": event.error,
         "summary": _summary_from_metadata(event.metadata_),
-        # plan #709: mid-walk live counts for a RUNNING native-ingester event
-        # (None otherwise; phase 3 overwrites metadata with run_stats on finish).
-        "live": (event.metadata_ or {}).get("live"),
     }
 
 
@@ -100,83 +95,6 @@ async def list_downloads():
     return jsonify([_list_record(e, s, a) for e, s, a in rows])
 
 
-@downloads_bp.route("/stats", methods=["GET"])
-async def downloads_stats():
-    """Status-grouped count over download_event for the dashboard stat chips.
-
-    `?window_hours=` (default 24) bounds by `started_at`. The full set of
-    statuses is always present in the response (zero for missing) so the
-    UI doesn't have to fill in defaults.
-    """
-    try:
-        window_hours = int(request.args.get("window_hours", "24"))
-    except ValueError:
-        return jsonify({"error": "invalid_window_hours"}), 400
-    if window_hours < 1 or window_hours > 24 * 365:
-        return jsonify({"error": "invalid_window_hours"}), 400
-
-    since = datetime.now(UTC) - timedelta(hours=window_hours)
-    out = {"pending": 0, "running": 0, "ok": 0, "error": 0, "skipped": 0}
-    async with get_session() as session:
-        stmt = (
-            select(DownloadEvent.status, func.count())
-            .where(DownloadEvent.started_at >= since)
-            .group_by(DownloadEvent.status)
-        )
-        for status, n in (await session.execute(stmt)).all():
-            if status in out:
-                out[status] = int(n)
-    return jsonify(out)
-
-
-@downloads_bp.route("/activity", methods=["GET"])
-async def downloads_activity():
-    """Hourly download-event counts over the last `?hours=` (default 24).
-
-    Returns a fixed-length, oldest-first bucket array so the UI can render
-    a sparkline directly. Bucketing is done in Python against UTC to dodge
-    session-timezone ambiguity in SQL date_trunc.
-    """
-    try:
-        hours = int(request.args.get("hours", "24"))
-    except ValueError:
-        return jsonify({"error": "invalid_hours"}), 400
-    hours = max(1, min(168, hours))
-
-    now = datetime.now(UTC)
-    end = now.replace(minute=0, second=0, microsecond=0)
-    start = end - timedelta(hours=hours - 1)
-    buckets = [
-        {"hour": (start + timedelta(hours=i)).isoformat(),
-         "ok": 0, "error": 0, "other": 0, "total": 0}
-        for i in range(hours)
-    ]
-
-    async with get_session() as session:
-        rows = (await session.execute(
-            select(DownloadEvent.started_at, DownloadEvent.status)
-            .where(DownloadEvent.started_at >= start)
-        )).all()
-
-    for started_at, status in rows:
-        if started_at is None:
-            continue
-        sa = started_at if started_at.tzinfo else started_at.replace(tzinfo=UTC)
-        idx = int((sa - start).total_seconds() // 3600)
-        if not (0 <= idx < hours):
-            continue
-        b = buckets[idx]
-        if status == "ok":
-            b["ok"] += 1
-        elif status == "error":
-            b["error"] += 1
-        else:
-            b["other"] += 1
-        b["total"] += 1
-
-    return jsonify({"hours": hours, "buckets": buckets})
-
-
 @downloads_bp.route("/<int:event_id>", methods=["GET"])
 async def get_download(event_id: int):
     async with get_session() as session:
@@ -190,20 +108,3 @@ async def get_download(event_id: int):
             return jsonify({"error": "not_found"}), 404
         event, source, artist = row
     return jsonify(_detail_record(event, source, artist))
-
-
-@downloads_bp.route("/recover-stalled", methods=["POST"])
-async def recover_stalled():
-    """Trigger the recover_stalled_download_events sweep on demand.
-
-    The same sweep runs every 5 min via Beat (see celery_app.beat_schedule);
-    this endpoint exists so the operator can force-clear stuck pending/
-    running download_events from the Subscriptions → Downloads maintenance
-    menu without waiting for the next scheduled tick.
-    """
-    # Local import: avoids registering maintenance tasks during blueprint
-    # import (Celery task discovery races with the API import otherwise).
-    from ..tasks.maintenance import recover_stalled_download_events
-
-    recover_stalled_download_events.delay()
-    return jsonify({"queued": True}), 202

backend/app/api/extension.py

@@ -20,7 +20,6 @@ from ..services.extension_service import (
     UnknownPlatformError,
 )
 from ..services.source_service import KNOWN_PLATFORMS
-from ._responses import error_response as _bad
 
 extension_bp = Blueprint("extension", __name__, url_prefix="/api/extension")
 
@@ -31,6 +30,12 @@ XPI_DIR = Path("/app/frontend/dist/extension")
 _XPI_VERSION_RE = re.compile(r"fabledcurator-(?P<version>[\w.-]+)\.xpi$")
 
 
+def _bad(error: str, *, status: int = 400, **extra):
+    body = {"error": error}
+    body.update(extra)
+    return jsonify(body), status
+
+
 async def _ext_key_required(session) -> bool:
     """Unlike /api/credentials (which accepts the browser path with no
     header), quick-add-source writes server state and must be explicitly
@@ -57,24 +62,6 @@ def _sha256(path: Path) -> str:
     return h.hexdigest()
 
 
-@extension_bp.route("/probe", methods=["GET"])
-async def probe_source():
-    """Read-only resolution of a creator-page URL: tells the extension
-    whether this URL is already a Source, is for an Artist that exists
-    but with a different URL, is brand new, or doesn't match any known
-    platform pattern. Drives the content-script chip's color/copy
-    BEFORE the operator clicks, so the button can show 'already added'
-    without requiring an add-attempt."""
-    url = (request.args.get("url") or "").strip()
-    if not url:
-        return _bad("invalid_body", detail="url query parameter is required")
-    async with get_session() as session:
-        if not await _ext_key_required(session):
-            return _bad("unauthorized", status=401)
-        result = await ExtensionService(session).probe(url)
-    return jsonify(result)
-
-
 @extension_bp.route("/quick-add-source", methods=["POST"])
 async def quick_add_source():
     body = await request.get_json(silent=True)
@@ -106,20 +93,10 @@ def _read_manifest_sync() -> dict | None:
     asyncio.to_thread (ASYNC240: no pathlib I/O in async functions)."""
     if not XPI_DIR.is_dir():
         return None
-    # Exclude the `fabledcurator-latest.xpi` alias when picking the file to
-    # extract a version from — it's a copy of the latest versioned XPI,
-    # written at the same mtime by build.yml, and would otherwise tie or
-    # win the sort (operator-flagged 2026-05-26: UI displayed "v latest"
-    # because `_extract_version("fabledcurator-latest.xpi")` returns
-    # the literal "latest"). The alias still serves as `latest_url`.
-    versioned = [
-        p for p in XPI_DIR.glob("fabledcurator-*.xpi")
-        if p.name != "fabledcurator-latest.xpi"
-    ]
-    if not versioned:
+    xpis = sorted(XPI_DIR.glob("fabledcurator-*.xpi"), key=lambda p: p.stat().st_mtime)
+    if not xpis:
         return None
-    versioned.sort(key=lambda p: p.stat().st_mtime)
-    latest = versioned[-1]
+    latest = xpis[-1]
     return {
         "installed": True,
         "version": _extract_version(latest.name),

backend/app/api/gallery.py

@@ -1,6 +1,4 @@
-"""Gallery API: cursor scroll, timeline, jump, image detail, facets."""
-
-from datetime import UTC, datetime, timedelta
+"""Gallery API: cursor scroll, timeline, jump, image detail."""
 
 from quart import Blueprint, jsonify, request
 
@@ -10,88 +8,45 @@ from ..services.gallery_service import GalleryService
 gallery_bp = Blueprint("gallery", __name__, url_prefix="/api/gallery")
 
 
-def _image_json(i):
-    """Serialize a GalleryImage for the scroll/similar list responses."""
-    return {
-        "id": i.id,
-        "sha256": i.sha256,
-        "mime": i.mime,
-        "width": i.width,
-        "height": i.height,
-        "created_at": i.created_at.isoformat(),
-        "posted_at": i.posted_at.isoformat() if i.posted_at else None,
-        "thumbnail_url": i.thumbnail_url,
-        "artist": i.artist,
-    }
-
-
-def _parse_date(raw):
-    """Parse a YYYY-MM-DD query value to a UTC midnight datetime, or None.
-    Raises ValueError (→ 400) on a malformed value."""
-    if not raw:
-        return None
-    return datetime.strptime(raw, "%Y-%m-%d").replace(tzinfo=UTC)
-
-
-def _parse_filters():
-    """Parse the composable gallery filters from query args, returning
-    ``(filters_dict, sort)``. Raises ValueError (→ 400) on malformed ids/dates.
-
-    `tag_id` accepts a single id or a comma-separated list (AND); `media` is
-    image|video; `sort` is newest|oldest; `platform` selects one platform
-    (or the UNSOURCED_PLATFORM sentinel); `untagged`/`no_artist` are boolean
-    flags; `date_from`/`date_to` are inclusive calendar-day bounds (date_to is
-    widened by a day so the whole day is covered by the service's half-open
-    `< date_to`)."""
-    tag_raw = request.args.get("tag_id")
-    tag_ids = (
-        [int(x) for x in tag_raw.split(",") if x.strip()] if tag_raw else None
-    ) or None
-    post_id_raw = request.args.get("post_id")
-    post_id = int(post_id_raw) if post_id_raw else None
-    artist_id_raw = request.args.get("artist_id")
-    artist_id = int(artist_id_raw) if artist_id_raw else None
-    media = request.args.get("media")
-    media_type = media if media in ("image", "video") else None
-    sort = request.args.get("sort")
-    sort = sort if sort in ("newest", "oldest") else "newest"
-    platform = request.args.get("platform") or None
-    untagged = request.args.get("untagged") in ("1", "true", "yes")
-    no_artist = request.args.get("no_artist") in ("1", "true", "yes")
-    date_from = _parse_date(request.args.get("date_from"))
-    date_to = _parse_date(request.args.get("date_to"))
-    if date_to is not None:
-        date_to += timedelta(days=1)  # inclusive of the date_to calendar day
-    filters = {
-        "tag_ids": tag_ids, "post_id": post_id, "artist_id": artist_id,
-        "media_type": media_type, "platform": platform,
-        "untagged": untagged, "no_artist": no_artist,
-        "date_from": date_from, "date_to": date_to,
-    }
-    return filters, sort
-
-
 @gallery_bp.route("/scroll", methods=["GET"])
 async def scroll():
     cursor = request.args.get("cursor") or None
     try:
         limit = int(request.args.get("limit", "50"))
-        filters, sort = _parse_filters()
     except ValueError:
-        return jsonify({"error": "invalid filter or limit parameter"}), 400
+        return jsonify({"error": "limit must be an integer"}), 400
+    tag_id_raw = request.args.get("tag_id")
+    tag_id = int(tag_id_raw) if tag_id_raw else None
+    post_id_raw = request.args.get("post_id")
+    post_id = int(post_id_raw) if post_id_raw else None
+    artist_id_raw = request.args.get("artist_id")
+    artist_id = int(artist_id_raw) if artist_id_raw else None
 
     async with get_session() as session:
         svc = GalleryService(session)
         try:
             page = await svc.scroll(
-                cursor=cursor, limit=limit, sort=sort, **filters,
+                cursor=cursor, limit=limit, tag_id=tag_id,
+                post_id=post_id, artist_id=artist_id,
             )
         except ValueError as exc:
             return jsonify({"error": str(exc)}), 400
 
     return jsonify(
         {
-            "images": [_image_json(i) for i in page.images],
+            "images": [
+                {
+                    "id": i.id,
+                    "sha256": i.sha256,
+                    "mime": i.mime,
+                    "width": i.width,
+                    "height": i.height,
+                    "created_at": i.created_at.isoformat(),
+                    "thumbnail_url": i.thumbnail_url,
+                    "artist": i.artist,
+                }
+                for i in page.images
+            ],
             "next_cursor": page.next_cursor,
             "date_groups": [
                 {"year": y, "month": m, "image_ids": ids} for y, m, ids in page.date_groups
@@ -100,46 +55,20 @@ async def scroll():
     )
 
 
-@gallery_bp.route("/similar", methods=["GET"])
-async def similar():
-    """Visual "more like this": images ranked by cosine distance to the
-    `similar_to` image's embedding. Composes with the scope filters (AND) but
-    ignores post_id and sort. Bounded top-N, no cursor."""
-    try:
-        similar_to = int(request.args["similar_to"])
-        limit = int(request.args.get("limit", "100"))
-        filters, _sort = _parse_filters()
-    except (KeyError, ValueError):
-        return jsonify({"error": "similar_to query param required"}), 400
-    # post_id is the exclusive post-detail view — not a similarity scope.
-    scope = {k: v for k, v in filters.items() if k != "post_id"}
-    async with get_session() as session:
-        svc = GalleryService(session)
-        try:
-            images = await svc.similar(image_id=similar_to, limit=limit, **scope)
-        except ValueError as exc:
-            return jsonify({"error": str(exc)}), 400
-    if images is None:
-        return jsonify({"error": "not found"}), 404
-    return jsonify(
-        {
-            "images": [_image_json(i) for i in images],
-            "next_cursor": None,
-            "date_groups": [],
-        }
-    )
-
-
 @gallery_bp.route("/timeline", methods=["GET"])
 async def timeline():
-    try:
-        filters, _sort = _parse_filters()
-    except ValueError:
-        return jsonify({"error": "invalid filter parameter"}), 400
+    tag_id_raw = request.args.get("tag_id")
+    tag_id = int(tag_id_raw) if tag_id_raw else None
+    post_id_raw = request.args.get("post_id")
+    post_id = int(post_id_raw) if post_id_raw else None
+    artist_id_raw = request.args.get("artist_id")
+    artist_id = int(artist_id_raw) if artist_id_raw else None
     async with get_session() as session:
         svc = GalleryService(session)
         try:
-            buckets = await svc.timeline(**filters)
+            buckets = await svc.timeline(
+                tag_id=tag_id, post_id=post_id, artist_id=artist_id
+            )
         except ValueError as exc:
             return jsonify({"error": str(exc)}), 400
     return jsonify(
@@ -147,43 +76,25 @@ async def timeline():
     )
 
 
-@gallery_bp.route("/facets", methods=["GET"])
-async def facets():
-    try:
-        filters, _sort = _parse_filters()
-    except ValueError:
-        return jsonify({"error": "invalid filter parameter"}), 400
-    async with get_session() as session:
-        svc = GalleryService(session)
-        try:
-            f = await svc.facets(**filters)
-        except ValueError as exc:
-            return jsonify({"error": str(exc)}), 400
-    return jsonify(
-        {
-            "total": f.total,
-            "platforms": f.platforms,
-            "untagged": f.untagged,
-            "no_artist": f.no_artist,
-            "date_min": f.date_min.isoformat() if f.date_min else None,
-            "date_max": f.date_max.isoformat() if f.date_max else None,
-        }
-    )
-
-
 @gallery_bp.route("/jump", methods=["GET"])
 async def jump():
     try:
         year = int(request.args["year"])
         month = int(request.args["month"])
-        filters, sort = _parse_filters()
     except (KeyError, ValueError):
         return jsonify({"error": "year and month query params required"}), 400
+    tag_id_raw = request.args.get("tag_id")
+    tag_id = int(tag_id_raw) if tag_id_raw else None
+    post_id_raw = request.args.get("post_id")
+    post_id = int(post_id_raw) if post_id_raw else None
+    artist_id_raw = request.args.get("artist_id")
+    artist_id = int(artist_id_raw) if artist_id_raw else None
     async with get_session() as session:
         svc = GalleryService(session)
         try:
             cursor = await svc.jump_cursor(
-                year=year, month=month, sort=sort, **filters,
+                year=year, month=month, tag_id=tag_id,
+                post_id=post_id, artist_id=artist_id,
             )
         except ValueError as exc:
             return jsonify({"error": str(exc)}), 400

backend/app/api/import_admin.py

@@ -35,26 +35,10 @@ async def trigger_scan():
 @import_admin_bp.route("/status", methods=["GET"])
 async def status():
     async with get_session() as session:
-        # Active batch = running batch that still has outstanding work.
-        # Plain "most recent running" picks freshly-created scans that
-        # enqueued zero new files and hides the older batch that's
-        # actually being processed. Mirrors the EXISTS predicate
-        # /api/system/stats already uses (api/settings.py:145-160).
-        # Audit 2026-06-02 — /api/import/status and /api/system/stats
-        # used to disagree on the active-batch predicate; the UI banner
-        # said "Scanning…" indefinitely while the stats card said idle.
         active = (
             await session.execute(
                 select(ImportBatch)
-                .where(
-                    ImportBatch.status == "running",
-                    select(ImportTask.id)
-                    .where(
-                        ImportTask.batch_id == ImportBatch.id,
-                        ImportTask.status.in_(["pending", "queued", "processing"]),
-                    )
-                    .exists(),
-                )
+                .where(ImportBatch.status == "running")
                 .order_by(ImportBatch.started_at.desc())
                 .limit(1)
             )
@@ -63,13 +47,10 @@ async def status():
         if active:
             payload["active_batch"] = {
                 "id": active.id,
-                "source_path": active.source_path,
-                "scan_mode": active.scan_mode,
                 "total_files": active.total_files,
                 "imported": active.imported,
                 "skipped": active.skipped,
                 "failed": active.failed,
-                "refreshed": active.refreshed,
                 "started_at": active.started_at.isoformat(),
             }
         return jsonify(payload)
@@ -119,139 +100,24 @@ async def list_tasks():
 
 @import_admin_bp.route("/retry-failed", methods=["POST"])
 async def retry_failed():
-    # Fold SELECT into UPDATE…WHERE…RETURNING — the prior SELECT-then-
-    # UPDATE-WHERE-id-IN pattern blew past psycopg's 65535-parameter
-    # ceiling once failed_ids exceeded ~65k rows.
     async with get_session() as session:
-        result = await session.execute(
-            update(ImportTask)
-            .where(ImportTask.status == "failed")
-            .values(
-                status="queued", error=None,
-                started_at=None, finished_at=None,
-            )
-            .returning(ImportTask.id, ImportTask.task_type)
-        )
-        failed = result.all()
-        if not failed:
-            return jsonify({"retried": 0})
-        await session.commit()
-
-    from ..tasks.import_file import enqueue_import
-    for tid, task_type in failed:
-        enqueue_import(tid, task_type)
-
-    return jsonify({"retried": len(failed)})
-
-
-@import_admin_bp.route("/tasks/<int:task_id>/refetch", methods=["POST"])
-async def refetch_task(task_id: int):
-    """Layer-2 one-shot re-download: delete the (corrupt) file behind a
-    failed import task and re-run its source's downloader to fetch a
-    fresh copy. Only works for files that resolve to an enabled,
-    real-URL subscription Source; filesystem-only imports return
-    no_source.
-
-    Returns one of: refetch_queued (+source_id) / no_source /
-    already_refetched / not_found / not_failed.
-    """
-    async with get_session() as session:
-        result = await session.run_sync(_refetch_task_sync, task_id)
-    if result["status"] == "not_found":
-        return jsonify(result), 404
-    if result["status"] == "not_failed":
-        return jsonify(result), 400
-    return jsonify(result)
-
-
-def _refetch_task_sync(session, task_id: int) -> dict:
-    from pathlib import Path
-
-    from ..models import ImportSettings
-    from ..services.refetch_service import attempt_refetch
-
-    task = session.get(ImportTask, task_id)
-    if task is None:
-        return {"status": "not_found"}
-    if task.status != "failed":
-        return {"status": "not_failed"}
-    settings = ImportSettings.load_sync(session)
-    return attempt_refetch(session, task, Path(settings.import_scan_path))
-
-
-@import_admin_bp.route("/clear-stuck", methods=["POST"])
-async def clear_stuck():
-    """Force any non-terminal ImportTask (status in pending/queued/
-    processing) to 'failed' AND finalize any ImportBatch that ends up
-    with no active children. Escape hatch for the operator when the
-    automatic recover_interrupted_tasks sweep keeps re-queueing the
-    same stuck row forever (e.g., underlying file is genuinely broken
-    and the import keeps OSError-looping at PIL load).
-
-    Idempotent + non-destructive: rows survive as 'failed' so the
-    Retry-Failed button can re-attempt them once whatever was broken
-    is fixed. Banked 2026-05-25 — operator hit 3 large PNGs that
-    autoretry-looped for 2 days after a corrupt-data PIL OSError.
-    """
-    async with get_session() as session:
-        # Fold SELECT into UPDATE…WHERE — see /retry-failed for the
-        # 65535-parameter ceiling rationale. rowcount is enough here
-        # because we don't need the ids afterward (no .delay()).
-        clear_result = await session.execute(
-            update(ImportTask)
-            .where(
-                ImportTask.status.in_(["pending", "queued", "processing"])
-            )
-            .values(
-                status="failed",
-                finished_at=datetime.now(UTC),
-                error=(
-                    "manually cleared via /api/import/clear-stuck "
-                    "— stuck in non-terminal state; retry once "
-                    "underlying cause (corrupt file, missing model, "
-                    "etc.) is resolved"
-                ),
-            )
-        )
-        tasks_failed = clear_result.rowcount or 0
-
-        # Finalize any 'running' ImportBatch that no longer has any
-        # active children. The "Scanning..." banner is driven by
-        # /api/import/status finding a running batch; left untouched,
-        # it would persist forever after the stuck-task clear.
-        running_batches = (
-            await session.execute(
-                select(ImportBatch.id).where(ImportBatch.status == "running")
-            )
+        failed_ids = (
+            await session.execute(select(ImportTask.id).where(ImportTask.status == "failed"))
         ).scalars().all()
-        finalized_batches = 0
-        for batch_id in running_batches:
-            still_active = (
-                await session.execute(
-                    select(ImportTask.id)
-                    .where(ImportTask.batch_id == batch_id)
-                    .where(ImportTask.status.in_(
-                        ["pending", "queued", "processing"]
-                    ))
-                    .limit(1)
-                )
-            ).scalar_one_or_none()
-            if still_active is None:
-                await session.execute(
-                    update(ImportBatch)
-                    .where(ImportBatch.id == batch_id)
-                    .values(
-                        status="complete",
-                        finished_at=datetime.now(UTC),
-                    )
-                )
-                finalized_batches += 1
+        if not failed_ids:
+            return jsonify({"retried": 0})
+        await session.execute(
+            update(ImportTask)
+            .where(ImportTask.id.in_(failed_ids))
+            .values(status="queued", error=None, started_at=None, finished_at=None)
+        )
         await session.commit()
 
-    return jsonify({
-        "tasks_failed": tasks_failed,
-        "batches_finalized": finalized_batches,
-    })
+    from ..tasks.import_file import import_media_file
+    for tid in failed_ids:
+        import_media_file.delay(tid)
+
+    return jsonify({"retried": len(failed_ids)})
 
 
 @import_admin_bp.route("/clear-completed", methods=["POST"])

backend/app/api/migrate.py

@@ -0,0 +1,141 @@
+"""FC-5: /api/migrate — trigger and poll migration runs.
+
+Ingest kinds (gs_ingest, ir_ingest) accept multipart/form-data with an
+`export_file` field. All other kinds accept JSON. Apply-without-backup
+guard rejects non-dry-run ingests unless a pre_migration-tagged backup
+exists in the last 24h (override with body.force=true).
+"""
+
+import json
+from datetime import UTC, datetime, timedelta
+from pathlib import Path
+
+from quart import Blueprint, jsonify, request
+from sqlalchemy import select
+
+from ..extensions import get_session
+from ..models import MigrationRun
+from ..tasks.migration import run_migration
+
+migrate_bp = Blueprint("migrate", __name__, url_prefix="/api/migrate")
+
+_VALID_KINDS = frozenset({
+    "backup", "gs_ingest", "ir_ingest", "tag_apply",
+    "ml_queue", "verify", "rollback", "cleanup",
+})
+_INGEST_KINDS = frozenset({"gs_ingest", "ir_ingest"})
+_APPLY_KINDS = frozenset({"gs_ingest", "ir_ingest", "tag_apply", "rollback", "cleanup"})
+
+
+def _bad(error: str, *, status: int = 400, **extra):
+    body = {"error": error}
+    body.update(extra)
+    return jsonify(body), status
+
+
+def _has_recent_pre_migration_backup() -> bool:
+    from ..services.migrators import backup as backup_mod
+    images_root = Path("/images")
+    manifest = backup_mod.find_latest_backup(images_root, tag="pre_migration")
+    if manifest is None:
+        return False
+    created_at_str = manifest.get("created_at")
+    if not created_at_str:
+        return False
+    created_at = datetime.fromisoformat(created_at_str)
+    return (datetime.now(UTC) - created_at) < timedelta(hours=24)
+
+
+def _run_to_dict(run: MigrationRun) -> dict:
+    return {
+        "id": run.id,
+        "kind": run.kind,
+        "status": run.status,
+        "dry_run": run.dry_run,
+        "started_at": run.started_at.isoformat(),
+        "finished_at": run.finished_at.isoformat() if run.finished_at else None,
+        "counts": run.counts or {},
+        "error": run.error,
+        "metadata": run.metadata_ or {},
+    }
+
+
+@migrate_bp.route("/<kind>", methods=["POST"])
+async def create_run(kind: str):
+    if kind not in _VALID_KINDS:
+        return _bad("unknown_kind", detail=f"kind must be one of {sorted(_VALID_KINDS)}")
+
+    # Ingest kinds accept multipart/form-data; everything else takes JSON.
+    if kind in _INGEST_KINDS:
+        form = await request.form
+        files = await request.files
+        if "export_file" not in files:
+            return _bad("missing_export_file", detail="multipart export_file required")
+        export_file = files["export_file"]
+        try:
+            raw = export_file.read()
+            data = json.loads(raw.decode("utf-8"))
+        except (UnicodeDecodeError, json.JSONDecodeError) as exc:
+            return _bad("invalid_export_file", detail=str(exc))
+        dry_run = str(form.get("dry_run", "false")).lower() in ("true", "1", "yes")
+        force = str(form.get("force", "false")).lower() in ("true", "1", "yes")
+        params: dict = {"data": data, "dry_run": dry_run}
+    else:
+        body = await request.get_json()
+        if body is None:
+            body = {}
+        if not isinstance(body, dict):
+            return _bad("invalid_body")
+        dry_run = bool(body.get("dry_run", False))
+        force = bool(body.get("force", False))
+        params = dict(body)
+
+    is_apply = (kind in _APPLY_KINDS) and not dry_run
+    if is_apply and not force and not _has_recent_pre_migration_backup():
+        return _bad(
+            "no_backup",
+            detail="apply action requires a pre_migration-tagged backup "
+                   "in the last 24h (or force=true).",
+        )
+
+    if kind == "backup":
+        params.setdefault("tag", "pre_migration")
+
+    async with get_session() as session:
+        run = MigrationRun(kind=kind, status="pending", dry_run=dry_run)
+        session.add(run)
+        await session.commit()
+        await session.refresh(run)
+        run_id = run.id
+
+    run_migration.delay(run_id, kind, params)
+    return jsonify({"run_id": run_id, "status": "pending"}), 202
+
+
+@migrate_bp.route("/runs/<int:run_id>", methods=["GET"])
+async def get_run(run_id: int):
+    async with get_session() as session:
+        run = (await session.execute(
+            select(MigrationRun).where(MigrationRun.id == run_id)
+        )).scalar_one_or_none()
+    if run is None:
+        return _bad("not_found", status=404)
+    return jsonify(_run_to_dict(run))
+
+
+@migrate_bp.route("/runs", methods=["GET"])
+async def list_runs():
+    try:
+        limit = int(request.args.get("limit", "10"))
+    except ValueError:
+        return _bad("invalid_limit")
+    if limit < 1 or limit > 100:
+        return _bad("invalid_limit")
+
+    async with get_session() as session:
+        rows = (await session.execute(
+            select(MigrationRun)
+            .order_by(MigrationRun.id.desc())
+            .limit(limit)
+        )).scalars().all()
+    return jsonify([_run_to_dict(r) for r in rows])

backend/app/api/ml_admin.py

@@ -9,7 +9,9 @@ ml_admin_bp = Blueprint("ml_admin", __name__, url_prefix="/api/ml")
 
 
 _EDITABLE = (
+    "suggestion_threshold_artist",
     "suggestion_threshold_character",
+    "suggestion_threshold_copyright",
     "suggestion_threshold_general",
     "centroid_similarity_threshold",
     "min_reference_images",
@@ -26,7 +28,9 @@ async def get_settings():
         ).scalar_one()
     return jsonify(
         {
+            "suggestion_threshold_artist": s.suggestion_threshold_artist,
             "suggestion_threshold_character": s.suggestion_threshold_character,
+            "suggestion_threshold_copyright": s.suggestion_threshold_copyright,
             "suggestion_threshold_general": s.suggestion_threshold_general,
             "centroid_similarity_threshold": s.centroid_similarity_threshold,
             "min_reference_images": s.min_reference_images,

backend/app/api/posts.py

@@ -5,11 +5,18 @@ from quart import Blueprint, jsonify, request
 from ..extensions import get_session
 from ..services.post_feed_service import PostFeedService
 from ..services.source_service import KNOWN_PLATFORMS
-from ._responses import error_response as _bad
 
 posts_bp = Blueprint("posts", __name__, url_prefix="/api/posts")
 
 
+def _bad(error: str, *, status: int = 400, detail: str | None = None, **extra):
+    body = {"error": error}
+    if detail is not None:
+        body["detail"] = detail
+    body.update(extra)
+    return jsonify(body), status
+
+
 @posts_bp.route("", methods=["GET"])
 async def list_posts():
     args = request.args
@@ -18,8 +25,6 @@ async def list_posts():
     artist_id_raw = args.get("artist_id")
     platform = args.get("platform") or None
     limit_raw = args.get("limit", "24")
-    direction = args.get("direction", "older")
-    around_raw = args.get("around")
 
     try:
         limit = int(limit_raw)
@@ -28,16 +33,6 @@ async def list_posts():
     if limit < 1 or limit > 100:
         return _bad("invalid_limit", detail="limit must be between 1 and 100")
 
-    if direction not in ("older", "newer"):
-        return _bad("invalid_direction", detail="direction must be 'older' or 'newer'")
-
-    around_id = None
-    if around_raw is not None:
-        try:
-            around_id = int(around_raw)
-        except ValueError:
-            return _bad("invalid_around", detail="around must be an integer post id")
-
     artist_id = None
     if artist_id_raw is not None:
         try:
@@ -52,19 +47,10 @@ async def list_posts():
         )
 
     async with get_session() as session:
-        svc = PostFeedService(session)
-        if around_id is not None:
-            result = await svc.around(
-                post_id=around_id, artist_id=artist_id,
-                platform=platform, limit=limit,
-            )
-            if result is None:
-                return _bad("not_found", status=404, detail=f"post id={around_id}")
-            return jsonify(result)
         try:
-            page = await svc.scroll(
+            page = await PostFeedService(session).scroll(
                 cursor=cursor, artist_id=artist_id,
-                platform=platform, limit=limit, direction=direction,
+                platform=platform, limit=limit,
             )
         except ValueError as exc:
             # Service raises ValueError for malformed cursors only;

backend/app/api/settings.py

@@ -25,15 +25,15 @@ _EDITABLE_FIELDS = (
     "download_schedule_default_seconds",
     "download_event_retention_days",
     "download_failure_warning_threshold",
-    "series_suggest_enabled",
-    "series_suggest_threshold",
 )
 
 
 @settings_bp.route("/settings/import", methods=["GET"])
 async def get_import_settings():
     async with get_session() as session:
-        row = await ImportSettings.load(session)
+        row = (
+            await session.execute(select(ImportSettings).where(ImportSettings.id == 1))
+        ).scalar_one()
     return jsonify({
         "min_width": row.min_width,
         "min_height": row.min_height,
@@ -48,8 +48,6 @@ async def get_import_settings():
         "download_schedule_default_seconds": row.download_schedule_default_seconds,
         "download_event_retention_days": row.download_event_retention_days,
         "download_failure_warning_threshold": row.download_failure_warning_threshold,
-        "series_suggest_enabled": row.series_suggest_enabled,
-        "series_suggest_threshold": row.series_suggest_threshold,
     })
 
 
@@ -100,21 +98,10 @@ async def update_import_settings():
         if not isinstance(v, int) or isinstance(v, bool) or v < 1 or v > 100:
             return _bad_int("download_failure_warning_threshold", 1, 100)
 
-    if "series_suggest_enabled" in body and not isinstance(
-        body["series_suggest_enabled"], bool
-    ):
-        return jsonify(
-            {"error": "series_suggest_enabled must be a boolean"}
-        ), 400
-    if "series_suggest_threshold" in body:
-        v = body["series_suggest_threshold"]
-        if not isinstance(v, (int, float)) or isinstance(v, bool) or v < 0 or v > 1:
-            return jsonify(
-                {"error": "series_suggest_threshold must be a number in [0, 1]"}
-            ), 400
-
     async with get_session() as session:
-        row = await ImportSettings.load(session)
+        row = (
+            await session.execute(select(ImportSettings).where(ImportSettings.id == 1))
+        ).scalar_one()
         for field in _EDITABLE_FIELDS:
             if field in body:
                 setattr(row, field, body[field])

backend/app/api/sources.py

@@ -5,7 +5,6 @@ from sqlalchemy import select
 
 from ..extensions import get_session
 from ..models import DownloadEvent, Source
-from ..services.scheduler_service import active_platform_cooldowns, scheduler_status
 from ..services.source_service import (
     KNOWN_PLATFORMS,
     ArtistNotFoundError,
@@ -15,11 +14,18 @@ from ..services.source_service import (
     SourceService,
     UnknownPlatformError,
 )
-from ._responses import error_response as _bad
 
 sources_bp = Blueprint("sources", __name__, url_prefix="/api/sources")
 
 
+def _bad(error: str, *, status: int = 400, detail: str | None = None, **extra):
+    body = {"error": error}
+    if detail is not None:
+        body["detail"] = detail
+    body.update(extra)
+    return jsonify(body), status
+
+
 @sources_bp.route("", methods=["GET"])
 async def list_sources():
     artist_id_raw = request.args.get("artist_id")
@@ -29,19 +35,11 @@ async def list_sources():
             artist_id = int(artist_id_raw)
         except ValueError:
             return _bad("invalid_artist_id", detail="artist_id must be an integer")
-    failing = request.args.get("failing", "").lower() in ("1", "true", "yes")
     async with get_session() as session:
-        records = await SourceService(session).list(artist_id=artist_id, failing=failing)
+        records = await SourceService(session).list(artist_id=artist_id)
     return jsonify([r.to_dict() for r in records])
 
 
-@sources_bp.route("/schedule-status", methods=["GET"])
-async def schedule_status():
-    """FC-dashboards: scheduler health for the Subscriptions hub."""
-    async with get_session() as session:
-        return jsonify(await scheduler_status(session))
-
-
 @sources_bp.route("/<int:source_id>", methods=["GET"])
 async def get_source(source_id: int):
     async with get_session() as session:
@@ -85,22 +83,6 @@ async def create_source():
             return _bad("empty_url", detail=str(exc))
         except DuplicateSourceError as exc:
             return _bad("duplicate", status=409, existing_id=exc.existing_id)
-
-        # Immediate kickoff: a new enabled source is armed for backfill (#693)
-        # but would otherwise sit idle until the next scheduler tick (~60s).
-        # Enqueue the first walk now, skipping only if the platform is in a
-        # rate-limit cooldown (the scheduler picks it up when that clears).
-        dispatch_id = None
-        if record.enabled:
-            cooldowns = await active_platform_cooldowns(session)
-            if record.platform not in cooldowns:
-                session.add(DownloadEvent(source_id=record.id, status="pending"))
-                await session.commit()
-                dispatch_id = record.id
-
-    if dispatch_id is not None:
-        from ..tasks.download import download_source
-        download_source.delay(dispatch_id)
     return jsonify(record.to_dict()), 201
 
 
@@ -136,136 +118,12 @@ async def delete_source(source_id: int):
     return "", 204
 
 
-@sources_bp.route("/<int:source_id>/backfill", methods=["POST"])
-async def set_backfill(source_id: int):
-    """Plan #693/#697: start/stop a run-until-done backfill, or start a recovery.
-    Body: `{"action": "start" | "stop" | "recover"}` (default "start"). 'start'
-    walks the full post history in time-boxed chunks until it reaches the bottom
-    (then the source shows 'complete'); 'recover' is the same walk but bypasses
-    the Patreon seen-ledger to re-fetch dropped-and-deleted near-dups under the
-    current pHash threshold; 'stop' cancels either back to tick mode. Returns the
-    updated source dict (incl. backfill_state / backfill_chunks /
-    backfill_bypass_seen)."""
-    from pathlib import Path
-
-    from ..services.credential_service import CredentialService
-    from ..services.download_backends import (
-        uses_native_ingester,
-        verify_source_credential,
-    )
-    from .credentials import _get_crypto
-
-    payload = await request.get_json(silent=True) or {}
-    action = payload.get("action", "start")
-    if action not in ("start", "stop", "recover"):
-        return _bad(
-            "invalid_action",
-            detail="action must be 'start', 'stop', or 'recover'",
-        )
-
-    # Pre-flight (plan #703 #2): before arming a deep walk on a native-ingester
-    # platform (where verify is one cheap API page), refuse if the credential is
-    # DEFINITIVELY rejected — don't burn chunks against expired cookies. Proceed
-    # on valid OR inconclusive (a network blip shouldn't block). Gated to native
-    # platforms: gallery-dl verify is a slow --simulate subprocess, too heavy for
-    # an arm action. The credential read happens in a session that's CLOSED
-    # before the verify network call (don't hold a DB conn across the request).
-    if action in ("start", "recover"):
-        async with get_session() as session:
-            rec = await SourceService(session).get(source_id)
-            if rec is None:
-                return _bad("not_found", status=404)
-            native = uses_native_ingester(rec.platform)
-            if native:
-                cred = CredentialService(session, _get_crypto())
-                cookies_path = await cred.get_cookies_path(rec.platform)
-                auth_token = await cred.get_token(rec.platform)
-        if native:
-            ok, message = await verify_source_credential(
-                platform=rec.platform,
-                url=rec.url,
-                artist_slug=rec.artist_slug,
-                config_overrides=rec.config_overrides or {},
-                cookies_path=str(cookies_path) if cookies_path else None,
-                auth_token=auth_token,
-                images_root=Path("/images"),
-            )
-            if ok is False:
-                return _bad("credential_rejected", detail=message, status=409)
-
-    async with get_session() as session:
-        try:
-            svc = SourceService(session)
-            if action == "start":
-                record = await svc.start_backfill(source_id)
-            elif action == "recover":
-                record = await svc.start_recovery(source_id)
-            else:
-                record = await svc.stop_backfill(source_id)
-        except LookupError:
-            return _bad("not_found", status=404)
-    return jsonify(record.to_dict())
-
-
-@sources_bp.route("/<int:source_id>/preview", methods=["POST"])
-async def preview_source_endpoint(source_id: int):
-    """Plan #708 B4: dry-run — count what a backfill WOULD download for a native
-    platform (Patreon today), without downloading. Walks the first few feed pages
-    and counts media not already in the seen/dead ledgers. Returns
-    {total_new, posts_scanned, pages_scanned, has_more, sample[]} or 409 + reason
-    (unresolvable campaign id / auth / drift). 400 for gallery-dl platforms (no
-    cheap dry-run — their verify is a slow --simulate)."""
-    from pathlib import Path
-
-    from ..services.credential_service import CredentialService
-    from ..services.download_backends import preview_source, uses_native_ingester
-    from ..tasks._sync_engine import sync_session_factory
-    from .credentials import _get_crypto
-
-    async with get_session() as session:
-        rec = await SourceService(session).get(source_id)
-        if rec is None:
-            return _bad("not_found", status=404)
-        if not uses_native_ingester(rec.platform):
-            return _bad(
-                "unsupported",
-                detail="Preview is only available for native-ingester platforms.",
-                status=400,
-            )
-        cred = CredentialService(session, _get_crypto())
-        cookies_path = await cred.get_cookies_path(rec.platform)
-
-    # The walk + ledger reads are sync (run off the request loop); the process
-    # sync engine is the same one the download task uses.
-    result = await preview_source(
-        platform=rec.platform,
-        url=rec.url,
-        source_id=source_id,
-        config_overrides=rec.config_overrides or {},
-        cookies_path=str(cookies_path) if cookies_path else None,
-        images_root=Path("/images"),
-        sync_session_factory=sync_session_factory(),
-    )
-    if "error" in result:
-        return _bad("preview_failed", detail=result["error"], status=409)
-    return jsonify(result)
-
-
 @sources_bp.route("/<int:source_id>/check", methods=["POST"])
 async def check_source(source_id: int):
     """FC-3c: enqueue a download for this source.
 
     Returns 202 with the new DownloadEvent id. If a pending/running
-    event already exists for this source, returns 409 with that id. If
-    the source's platform is currently in a rate-limit cooldown, returns
-    **202 with `{status: "deferred", cooldown_until, platform}`** and
-    does NOT create an event or dispatch — the bulk retry path uses this
-    to avoid bowling N sources right back into the rate limit the
-    cooldown is preventing. Single-click "retry this one source" passes
-    `?force=true` to override the cooldown (operator-explicit, useful
-    for rapid auth-fix testing). The in-flight guard always applies.
-    """
-    force = (request.args.get("force") or "").lower() in ("1", "true", "yes")
+    event already exists for this source, returns 409 with that id."""
     async with get_session() as session:
         source = (await session.execute(
             select(Source).where(Source.id == source_id)
@@ -275,19 +133,6 @@ async def check_source(source_id: int):
         if not source.enabled:
             return _bad("source_disabled", detail="enable the source first")
 
-        # Cooldown gate (unless explicitly overridden). Checked before the
-        # in-flight guard because a deferred retry doesn't need to create
-        # or check for an event at all.
-        if not force:
-            cooldowns = await active_platform_cooldowns(session)
-            expires_at = cooldowns.get(source.platform)
-            if expires_at is not None:
-                return jsonify({
-                    "status": "deferred",
-                    "platform": source.platform,
-                    "cooldown_until": expires_at.isoformat(),
-                }), 202
-
         in_flight = (await session.execute(
             select(DownloadEvent.id).where(
                 DownloadEvent.source_id == source_id,

backend/app/api/system_activity.py

@@ -1,244 +0,0 @@
-"""FC-3i: system activity dashboard endpoints.
-
-Read-only. Combines Redis-broker queue depths (LLEN per queue),
-Celery worker introspection (celery inspect), and the task_run DB
-history into the surfaces the SystemActivityTab UI consumes.
-
-All filesystem/sync-client work goes through asyncio.to_thread per
-ASYNC230/240 (mirrors backend.app.api.extension's pattern).
-"""
-
-from __future__ import annotations
-
-import asyncio
-import time
-from datetime import UTC, datetime, timedelta
-
-from quart import Blueprint, jsonify, request
-from sqlalchemy import desc, func, select
-
-from ..config import get_config
-from ..extensions import get_session
-from ..models import TaskRun
-from ..services.scheduler_service import scheduler_status
-
-system_activity_bp = Blueprint(
-    "system_activity", __name__, url_prefix="/api/system/activity",
-)
-
-# Canonical queue order — must match celery_app.task_routes. UI renders
-# in this order; queues with no LLEN response show as null rather than
-# absent.
-_QUEUE_NAMES = (
-    "default", "import", "thumbnail", "ml",
-    "download", "scan", "maintenance", "maintenance_long",
-)
-
-# Cache module-level so all requests share the cache between polls.
-# Tests can reset via direct dict mutation if needed.
-_QUEUE_CACHE: dict = {"ts": 0.0, "data": None}
-_WORKER_CACHE: dict = {"ts": 0.0, "data": None}
-_QUEUE_CACHE_TTL = 2.0
-_WORKER_CACHE_TTL = 5.0
-
-
-def _read_queues_sync() -> dict:
-    """Reads each queue's LLEN from the broker. Sync — caller wraps in
-    asyncio.to_thread. Per-queue try/except returns None on failure so
-    one bad queue doesn't break the whole response."""
-    import redis  # local import; only this endpoint needs it
-
-    cfg = get_config()
-    client = redis.Redis.from_url(cfg.celery_broker_url)
-    out: dict = {}
-    for name in _QUEUE_NAMES:
-        try:
-            out[name] = int(client.llen(name))
-        except Exception:  # noqa: BLE001 — broker hiccup shouldn't break UI
-            out[name] = None
-    return {
-        "queues": out,
-        "fetched_at": datetime.now(UTC).isoformat(),
-    }
-
-
-def _read_workers_sync() -> dict:
-    """celery inspect active_queues + active. Returns per-worker info."""
-    from ..celery_app import celery as celery_app
-
-    insp = celery_app.control.inspect(timeout=2.0)
-    active_queues = insp.active_queues() or {}
-    active_tasks = insp.active() or {}
-
-    workers: dict = {}
-    for hostname, queues in active_queues.items():
-        workers[hostname] = {
-            "queues": sorted({q["name"] for q in queues}),
-            "active_count": len(active_tasks.get(hostname, [])),
-        }
-    return {
-        "workers": workers,
-        "fetched_at": datetime.now(UTC).isoformat(),
-    }
-
-
-async def _queues_cached() -> dict:
-    """Per-queue Redis LLEN, cached 2s. Shared by /queues and /summary."""
-    now = time.time()
-    if _QUEUE_CACHE["data"] is None or (now - _QUEUE_CACHE["ts"]) > _QUEUE_CACHE_TTL:
-        _QUEUE_CACHE["data"] = await asyncio.to_thread(_read_queues_sync)
-        _QUEUE_CACHE["ts"] = now
-    return _QUEUE_CACHE["data"]
-
-
-@system_activity_bp.route("/queues", methods=["GET"])
-async def get_queues():
-    """Per-queue Redis LLEN. Cached 2s.
-
-    Response: {queues: {name: depth_or_null}, fetched_at: iso8601}
-    """
-    return jsonify(await _queues_cached())
-
-
-@system_activity_bp.route("/workers", methods=["GET"])
-async def get_workers():
-    """Live celery inspect. Cached 5s.
-
-    Response: {workers: {hostname: {queues, active_count}}, fetched_at}
-    """
-    now = time.time()
-    if _WORKER_CACHE["data"] is None or (now - _WORKER_CACHE["ts"]) > _WORKER_CACHE_TTL:
-        _WORKER_CACHE["data"] = await asyncio.to_thread(_read_workers_sync)
-        _WORKER_CACHE["ts"] = now
-    return jsonify(_WORKER_CACHE["data"])
-
-
-@system_activity_bp.route("/summary", methods=["GET"])
-async def get_summary():
-    """One-call rollup for the always-on TopNav pipeline indicator:
-    scheduler health, per-queue pending depths, currently-running count, and
-    recent (24h) failure count. Cheap — cached queue LLENs + two TaskRun
-    counts — so it's safe to poll app-wide."""
-    queues_data = await _queues_cached()
-    depths = queues_data.get("queues", {})
-    queued_total = sum(v for v in depths.values() if isinstance(v, int))
-    since = datetime.now(UTC) - timedelta(hours=24)
-    async with get_session() as session:
-        scheduler = await scheduler_status(session)
-        running = (await session.execute(
-            select(func.count(TaskRun.id)).where(TaskRun.status == "running")
-        )).scalar_one()
-        failing = (await session.execute(
-            select(func.count(TaskRun.id))
-            .where(TaskRun.status.in_(["error", "timeout"]))
-            .where(TaskRun.finished_at >= since)
-        )).scalar_one()
-    return jsonify({
-        "scheduler": scheduler,
-        "queues": depths,
-        "queued_total": queued_total,
-        "running": int(running),
-        "failing": int(failing),
-    })
-
-
-@system_activity_bp.route("/runs", methods=["GET"])
-async def list_runs():
-    """Paginated task_run history. Query params:
-      queue=<name>     filter to one queue
-      status=<status>  filter to one status (running/ok/error/timeout/retry)
-      limit=<int>      default 50, max 200
-      before_id=<int>  cursor for keyset pagination
-
-    Response: {runs: [...], next_cursor: id|null}
-    """
-    try:
-        limit = min(int(request.args.get("limit", "50")), 200)
-    except ValueError:
-        return jsonify({"error": "invalid_limit"}), 400
-    if limit < 1:
-        return jsonify({"error": "invalid_limit"}), 400
-
-    queue = request.args.get("queue")
-    status = request.args.get("status")
-    before_id_raw = request.args.get("before_id")
-    before_id = int(before_id_raw) if before_id_raw else None
-
-    async with get_session() as session:
-        stmt = select(TaskRun).order_by(desc(TaskRun.id))
-        if queue:
-            stmt = stmt.where(TaskRun.queue == queue)
-        if status:
-            stmt = stmt.where(TaskRun.status == status)
-        if before_id is not None:
-            stmt = stmt.where(TaskRun.id < before_id)
-        stmt = stmt.limit(limit + 1)
-        rows = (await session.execute(stmt)).scalars().all()
-
-    has_more = len(rows) > limit
-    rows = rows[:limit]
-    return jsonify({
-        "runs": [_row_to_dict(r) for r in rows],
-        "next_cursor": rows[-1].id if has_more and rows else None,
-    })
-
-
-@system_activity_bp.route("/failures", methods=["GET"])
-async def list_failures():
-    """Recent failures across all lanes (24h window).
-
-    Response: {recent: [...], count_by_type: {ErrorClass: n}, since}
-    """
-    try:
-        limit = min(int(request.args.get("limit", "50")), 200)
-    except ValueError:
-        return jsonify({"error": "invalid_limit"}), 400
-
-    since = datetime.now(UTC) - timedelta(hours=24)
-
-    async with get_session() as session:
-        recent_stmt = (
-            select(TaskRun)
-            .where(TaskRun.status.in_(["error", "timeout"]))
-            .where(TaskRun.finished_at >= since)
-            .order_by(desc(TaskRun.finished_at))
-            .limit(limit)
-        )
-        recent = (await session.execute(recent_stmt)).scalars().all()
-
-        count_stmt = (
-            select(TaskRun.error_type, func.count(TaskRun.id))
-            .where(TaskRun.status.in_(["error", "timeout"]))
-            .where(TaskRun.finished_at >= since)
-            .group_by(TaskRun.error_type)
-            .order_by(desc(func.count(TaskRun.id)))
-        )
-        counts = (await session.execute(count_stmt)).all()
-
-    return jsonify({
-        "recent": [_row_to_dict(r) for r in recent],
-        "count_by_type": {
-            (row[0] or "Unknown"): row[1]
-            for row in counts
-        },
-        "since": since.isoformat(),
-    })
-
-
-def _row_to_dict(r: TaskRun) -> dict:
-    return {
-        "id": r.id,
-        "queue": r.queue,
-        "task_name": r.task_name,
-        "target_id": r.target_id,
-        "celery_task_id": r.celery_task_id,
-        "started_at": r.started_at.isoformat() if r.started_at else None,
-        "finished_at": r.finished_at.isoformat() if r.finished_at else None,
-        "duration_ms": r.duration_ms,
-        "status": r.status,
-        "error_type": r.error_type,
-        "error_message": r.error_message,
-        "retry_count": r.retry_count,
-        "worker_hostname": r.worker_hostname,
-        "args_summary": r.args_summary,
-    }

backend/app/api/system_backup.py

@@ -1,255 +0,0 @@
-"""FC-3h: /api/system/backup — create/list/restore/delete/tag for
-DB + image backups.
-
-Read endpoints are public on FC (operator-facing internal API; same
-posture as /api/system/activity). Write endpoints take a typed
-`confirm` body field that must match a server-generated token for
-that backup row, to prevent click-to-destroy by stale browser tabs
-or accidental cURL.
-"""
-from __future__ import annotations
-
-from quart import Blueprint, jsonify, request
-from sqlalchemy import desc, select
-
-from ..extensions import get_session
-from ..models import BackupRun, ImportSettings
-from ._responses import error_response as _bad
-
-system_backup_bp = Blueprint(
-    "system_backup", __name__, url_prefix="/api/system/backup",
-)
-
-_KINDS = frozenset({"db", "images"})
-_TAG_MAX_LEN = 64
-_BACKUP_SETTINGS_FIELDS = (
-    "backup_db_nightly_enabled",
-    "backup_db_nightly_hour_utc",
-    "backup_db_keep_last_n",
-    "backup_images_keep_last_n",
-)
-
-
-def _row_to_dict(r: BackupRun) -> dict:
-    return {
-        "id": r.id,
-        "kind": r.kind,
-        "status": r.status,
-        "tag": r.tag,
-        "triggered_by": r.triggered_by,
-        "started_at": r.started_at.isoformat() if r.started_at else None,
-        "finished_at": r.finished_at.isoformat() if r.finished_at else None,
-        "duration_seconds": (
-            int((r.finished_at - r.started_at).total_seconds())
-            if r.finished_at and r.started_at else None
-        ),
-        "sql_path": r.sql_path,
-        "tar_path": r.tar_path,
-        "size_bytes": r.size_bytes,
-        "error": r.error,
-        "restored_from_id": r.restored_from_id,
-        "manifest": r.manifest or {},
-    }
-
-
-def _validate_tag(tag):
-    if tag is None:
-        return None
-    if not isinstance(tag, str):
-        return _bad("invalid_tag", detail="tag must be string or null")
-    tag = tag.strip()
-    if not tag:
-        return None
-    if len(tag) > _TAG_MAX_LEN:
-        return _bad("invalid_tag", detail=f"tag too long (max {_TAG_MAX_LEN})")
-    return tag
-
-
-def _validate_backup_settings_patch(body: dict):
-    if "backup_db_nightly_enabled" in body and not isinstance(
-        body["backup_db_nightly_enabled"], bool,
-    ):
-        return _bad("invalid_value", detail="backup_db_nightly_enabled must be bool")
-    if "backup_db_nightly_hour_utc" in body:
-        v = body["backup_db_nightly_hour_utc"]
-        if not isinstance(v, int) or isinstance(v, bool) or not (0 <= v <= 23):
-            return _bad("invalid_value", detail="backup_db_nightly_hour_utc must be 0..23")
-    if "backup_db_keep_last_n" in body:
-        v = body["backup_db_keep_last_n"]
-        if not isinstance(v, int) or isinstance(v, bool) or not (1 <= v <= 365):
-            return _bad("invalid_value", detail="backup_db_keep_last_n must be 1..365")
-    if "backup_images_keep_last_n" in body:
-        v = body["backup_images_keep_last_n"]
-        if not isinstance(v, int) or isinstance(v, bool) or not (1 <= v <= 100):
-            return _bad("invalid_value", detail="backup_images_keep_last_n must be 1..100")
-    return None
-
-
-@system_backup_bp.route("/db", methods=["POST"])
-async def trigger_db_backup():
-    body = await request.get_json(silent=True) or {}
-    tag = _validate_tag(body.get("tag"))
-    if isinstance(tag, tuple):
-        return tag
-    from ..tasks.backup import backup_db_task
-    backup_db_task.delay(tag=tag, triggered_by="manual")
-    return jsonify({"status": "dispatched"}), 202
-
-
-@system_backup_bp.route("/images", methods=["POST"])
-async def trigger_images_backup():
-    body = await request.get_json(silent=True) or {}
-    tag = _validate_tag(body.get("tag"))
-    if isinstance(tag, tuple):
-        return tag
-    from ..tasks.backup import backup_images_task
-    backup_images_task.delay(tag=tag, triggered_by="manual")
-    return jsonify({"status": "dispatched"}), 202
-
-
-@system_backup_bp.route("/runs", methods=["GET"])
-async def list_runs():
-    try:
-        limit = min(int(request.args.get("limit", "50")), 200)
-    except ValueError:
-        return _bad("invalid_limit")
-    if limit < 1:
-        return _bad("invalid_limit")
-    kind = request.args.get("kind")
-    if kind is not None and kind not in _KINDS:
-        return _bad("invalid_kind", detail=f"kind must be one of {sorted(_KINDS)}")
-    before_id_raw = request.args.get("before_id")
-    before_id = int(before_id_raw) if before_id_raw else None
-
-    async with get_session() as session:
-        stmt = select(BackupRun).order_by(desc(BackupRun.id))
-        if kind:
-            stmt = stmt.where(BackupRun.kind == kind)
-        if before_id is not None:
-            stmt = stmt.where(BackupRun.id < before_id)
-        stmt = stmt.limit(limit + 1)
-        rows = (await session.execute(stmt)).scalars().all()
-
-    has_more = len(rows) > limit
-    rows = rows[:limit]
-    return jsonify({
-        "runs": [_row_to_dict(r) for r in rows],
-        "next_cursor": rows[-1].id if has_more and rows else None,
-    })
-
-
-@system_backup_bp.route("/runs/<int:run_id>", methods=["GET"])
-async def get_run(run_id: int):
-    async with get_session() as session:
-        row = await session.get(BackupRun, run_id)
-    if row is None:
-        return _bad("not_found", status=404)
-    return jsonify(_row_to_dict(row))
-
-
-@system_backup_bp.route("/runs/<int:run_id>", methods=["PATCH"])
-async def patch_run(run_id: int):
-    body = await request.get_json(silent=True) or {}
-    if "tag" not in body:
-        return _bad("invalid_body", detail="tag required")
-    tag = _validate_tag(body["tag"])
-    if isinstance(tag, tuple):
-        return tag
-
-    async with get_session() as session:
-        row = await session.get(BackupRun, run_id)
-        if row is None:
-            return _bad("not_found", status=404)
-        row.tag = tag
-        await session.commit()
-        await session.refresh(row)
-    return jsonify(_row_to_dict(row))
-
-
-@system_backup_bp.route("/runs/<int:run_id>/restore", methods=["POST"])
-async def trigger_restore(run_id: int):
-    body = await request.get_json(silent=True) or {}
-    supplied = body.get("confirm", "")
-
-    async with get_session() as session:
-        row = await session.get(BackupRun, run_id)
-        if row is None:
-            return _bad("not_found", status=404)
-        if row.status != "ok":
-            return _bad(
-                "not_restorable",
-                detail=f"source backup status={row.status!r}; only 'ok' rows are restorable",
-            )
-        expected = f"restore-{row.kind}-{row.id}"
-        if supplied != expected:
-            return _bad(
-                "confirm_mismatch",
-                detail=f"confirm must equal {expected!r}",
-                expected=expected,
-            )
-        kind = row.kind
-
-    if kind == "db":
-        from ..tasks.backup import restore_db_task
-        restore_db_task.delay(source_backup_run_id=run_id)
-    else:  # 'images' (the only other value _KINDS allows via the trigger path)
-        from ..tasks.backup import restore_images_task
-        restore_images_task.delay(source_backup_run_id=run_id)
-    return jsonify({"status": "dispatched", "kind": kind}), 202
-
-
-@system_backup_bp.route("/runs/<int:run_id>", methods=["DELETE"])
-async def delete_run(run_id: int):
-    body = await request.get_json(silent=True) or {}
-    supplied = body.get("confirm", "")
-
-    async with get_session() as session:
-        row = await session.get(BackupRun, run_id)
-        if row is None:
-            return _bad("not_found", status=404)
-        expected = f"delete-{row.kind}-{row.id}"
-        if supplied != expected:
-            return _bad(
-                "confirm_mismatch",
-                detail=f"confirm must equal {expected!r}",
-                expected=expected,
-            )
-        from ..services import backup_service
-        backup_service.unlink_artifact_files(
-            sql_path=row.sql_path, tar_path=row.tar_path,
-            manifest_path=(row.manifest or {}).get("manifest_path"),
-        )
-        await session.delete(row)
-        await session.commit()
-    return "", 204
-
-
-@system_backup_bp.route("/settings", methods=["GET"])
-async def get_settings():
-    async with get_session() as session:
-        row = await ImportSettings.load(session)
-    return jsonify({
-        "backup_db_nightly_enabled": row.backup_db_nightly_enabled,
-        "backup_db_nightly_hour_utc": row.backup_db_nightly_hour_utc,
-        "backup_db_keep_last_n": row.backup_db_keep_last_n,
-        "backup_images_keep_last_n": row.backup_images_keep_last_n,
-    })
-
-
-@system_backup_bp.route("/settings", methods=["PATCH"])
-async def patch_settings():
-    body = await request.get_json(silent=True)
-    if not isinstance(body, dict):
-        return _bad("invalid_body", detail="body must be a JSON object")
-
-    err = _validate_backup_settings_patch(body)
-    if err is not None:
-        return err
-
-    async with get_session() as session:
-        row = await ImportSettings.load(session)
-        for field in _BACKUP_SETTINGS_FIELDS:
-            if field in body:
-                setattr(row, field, body[field])
-        await session.commit()
-    return await get_settings()

backend/app/api/tags.py

@@ -8,16 +8,13 @@ from ..extensions import get_session
 from ..models import Tag, TagKind
 from ..models.tag_allowlist import TagAllowlist
 from ..services.bulk_tag_service import BulkTagService
-from ..services.series_match_service import SeriesMatchService
 from ..services.series_service import SeriesError, SeriesService
 from ..services.tag_directory_service import TagDirectoryService
 from ..services.tag_service import (
     TagMergeConflict,
     TagService,
     TagValidationError,
-    normalize_tag_name,
 )
-from ..utils.tag_prefix import parse_kind_prefix
 
 tags_bp = Blueprint("tags", __name__, url_prefix="/api")
 
@@ -108,46 +105,15 @@ async def directory():
 
 @tags_bp.route("/tags", methods=["POST"])
 async def create_tag():
-    """Create a tag. Two input shapes accepted:
-      1. Explicit: {name, kind, fandom_id?} — caller already split, kind wins.
-      2. IR-suffix: {name} where name = "kind:Name" (e.g. "artist:Eric").
-         The server runs parse_kind_prefix(name) to derive kind; the colon
-         and prefix are stripped from the stored tag name. If no recognized
-         prefix is present, the kind defaults to `general`.
-    Explicit kind ALWAYS wins (backward-compat for existing callers).
-    """
     body = await request.get_json()
-    if not body or "name" not in body:
-        return jsonify({"error": "name required"}), 400
+    if not body or "name" not in body or "kind" not in body:
+        return jsonify({"error": "name and kind required"}), 400
     name = body["name"]
-    explicit_kind_raw = body.get("kind")
-
-    if explicit_kind_raw is not None:
-        # Caller provided kind — honor it; don't re-parse.
-        kind = _coerce_kind(explicit_kind_raw)
-        if kind is None:
-            return jsonify({"error": f"invalid kind {explicit_kind_raw!r}"}), 400
-    else:
-        # IR-style: parse "kind:Name" from the raw name.
-        parsed_kind, parsed_name = parse_kind_prefix(name)
-        if parsed_kind is not None:
-            name = parsed_name
-            kind = _coerce_kind(parsed_kind)
-            # parse_kind_prefix only returns kinds from KNOWN_KINDS which
-            # are all valid TagKind members, so _coerce_kind can't return
-            # None here — but defensive.
-            if kind is None:
-                return jsonify({"error": f"invalid kind {parsed_kind!r}"}), 400
-        else:
-            kind = TagKind.general
-
+    kind = _coerce_kind(body["kind"])
+    if kind is None:
+        return jsonify({"error": f"invalid kind {body['kind']!r}"}), 400
     fandom_id = body.get("fandom_id")
 
-    # #701: Title-Case operator-entered tags. Only here (the explicit create
-    # endpoint), NOT in the shared find_or_create — the ML tagger uses that path
-    # and must keep the booru vocabulary's casing for allowlist matching.
-    name = normalize_tag_name(name)
-
     async with get_session() as session:
         svc = TagService(session)
         try:
@@ -201,46 +167,15 @@ async def remove_tag_from_image(image_id: int, tag_id: int):
     return "", 204
 
 
-@tags_bp.route("/tags/<int:tag_id>", methods=["GET"])
-async def get_tag(tag_id: int):
-    """Resolve a single tag (used by the gallery to label its active
-    tag-filter chip)."""
-    async with get_session() as session:
-        tag = await session.get(Tag, tag_id)
-        if tag is None:
-            return jsonify({"error": "tag not found"}), 404
-        return jsonify(
-            {
-                "id": tag.id,
-                "name": tag.name,
-                "kind": tag.kind.value,
-                "fandom_id": tag.fandom_id,
-            }
-        )
-
-
 @tags_bp.route("/tags/<int:tag_id>", methods=["PATCH"])
-async def update_tag(tag_id: int):
-    """Rename and/or re-fandom a tag. Body may carry `name` and/or
-    `fandom_id` (a fandom tag id, or null to clear — character tags only).
-    `merge: true` resolves a collision by merging into the existing tag.
-    """
-    body = await request.get_json() or {}
-    has_name = "name" in body
-    has_fandom = "fandom_id" in body
-    if not has_name and not has_fandom:
-        return jsonify({"error": "name or fandom_id required"}), 400
-    do_merge = bool(body.get("merge"))
+async def rename_tag(tag_id: int):
+    body = await request.get_json()
+    if not body or "name" not in body:
+        return jsonify({"error": "name required"}), 400
     async with get_session() as session:
         svc = TagService(session)
         try:
-            tag = None
-            if has_name:
-                tag = await svc.rename(tag_id, body["name"])
-            if has_fandom:
-                tag = await svc.set_fandom(
-                    tag_id, body["fandom_id"], merge=do_merge
-                )
+            tag = await svc.rename(tag_id, body["name"])
         except TagMergeConflict as exc:
             return jsonify(
                 {
@@ -257,12 +192,7 @@ async def update_tag(tag_id: int):
             return jsonify({"error": str(exc)}), 400
         await session.commit()
         return jsonify(
-            {
-                "id": tag.id,
-                "name": tag.name,
-                "kind": tag.kind.value,
-                "fandom_id": tag.fandom_id,
-            }
+            {"id": tag.id, "name": tag.name, "kind": tag.kind.value}
         )
 
 
@@ -288,12 +218,6 @@ async def merge_tag(source_id: int):
         from ..tasks.ml import apply_allowlist_tags
 
         apply_allowlist_tags.delay(tag_id=result.target_id)
-    # Tag merge invalidates the target's centroid (the merged-in source
-    # tag's images now contribute to it). Daily list_drifted catches it
-    # within 24h, but eager recompute closes the suggestion-quality dip
-    # in the meantime. Audit 2026-06-02.
-    from ..tasks.ml import recompute_centroid
-    recompute_centroid.delay(result.target_id)
     return jsonify(
         {
             "target": {
@@ -369,31 +293,6 @@ def _series_err(exc: SeriesError):
     return jsonify({"error": msg}), status
 
 
-def _opt_int(body, key: str):
-    """(value, error) — value is None when absent, error is (json, status)."""
-    if not body or body.get(key) is None:
-        return None, None
-    try:
-        return int(body[key]), None
-    except (TypeError, ValueError):
-        return None, (jsonify({"error": f"{key} must be an integer"}), 400)
-
-
-def _parse_int_list(body, key: str, *, max_ids: int = 500):
-    """(list, error) for a required list of ints under `key`."""
-    if not body or key not in body:
-        return None, (jsonify({"error": f"{key} required"}), 400)
-    raw = body[key]
-    if not isinstance(raw, list) or not raw:
-        return None, (jsonify({"error": f"{key} must be a non-empty list"}), 400)
-    if len(raw) > max_ids:
-        return None, (jsonify({"error": f"too many ids (max {max_ids})"}), 400)
-    try:
-        return [int(x) for x in raw], None
-    except (TypeError, ValueError):
-        return None, (jsonify({"error": f"{key} must be integers"}), 400)
-
-
 @tags_bp.route("/series/<int:tag_id>/pages", methods=["GET"])
 async def series_pages(tag_id: int):
     async with get_session() as session:
@@ -410,14 +309,9 @@ async def series_add(tag_id: int):
     ids, err = _parse_bulk_ids(body, max_ids=500)
     if err:
         return err
-    chapter_id, cerr = _opt_int(body, "chapter_id")
-    if cerr:
-        return cerr
     async with get_session() as session:
         try:
-            n = await SeriesService(session).add_images(
-                tag_id, ids, chapter_id=chapter_id
-            )
+            n = await SeriesService(session).add_images(tag_id, ids)
         except SeriesError as exc:
             return _series_err(exc)
         await session.commit()
@@ -470,227 +364,3 @@ async def series_cover(tag_id: int):
             return _series_err(exc)
         await session.commit()
     return jsonify({"ok": True})
-
-
-# ---- chapters (FC-6.1) ----------------------------------------------------
-
-
-@tags_bp.route("/series/<int:tag_id>/chapters", methods=["POST"])
-async def series_chapter_create(tag_id: int):
-    body = await request.get_json() or {}
-    title = body.get("title")
-    if title is not None and not isinstance(title, str):
-        return jsonify({"error": "title must be a string"}), 400
-    is_placeholder = bool(body.get("is_placeholder", False))
-    start, serr = _opt_int(body, "stated_page_start")
-    if serr:
-        return serr
-    end, eerr = _opt_int(body, "stated_page_end")
-    if eerr:
-        return eerr
-    async with get_session() as session:
-        try:
-            ch = await SeriesService(session).create_chapter(
-                tag_id,
-                title=title,
-                is_placeholder=is_placeholder,
-                stated_page_start=start,
-                stated_page_end=end,
-            )
-        except SeriesError as exc:
-            return _series_err(exc)
-        await session.commit()
-    return jsonify(ch)
-
-
-@tags_bp.route("/series/<int:tag_id>/chapters/reorder", methods=["POST"])
-async def series_chapter_reorder(tag_id: int):
-    body = await request.get_json()
-    ids, err = _parse_int_list(body, "chapter_ids")
-    if err:
-        return err
-    async with get_session() as session:
-        try:
-            await SeriesService(session).reorder_chapters(tag_id, ids)
-        except SeriesError as exc:
-            return _series_err(exc)
-        await session.commit()
-    return jsonify({"ok": True})
-
-
-@tags_bp.route(
-    "/series/<int:tag_id>/chapters/<int:chapter_id>", methods=["PATCH"]
-)
-async def series_chapter_update(tag_id: int, chapter_id: int):
-    body = await request.get_json() or {}
-    kwargs: dict = {}
-    if "title" in body:
-        if body["title"] is not None and not isinstance(body["title"], str):
-            return jsonify({"error": "title must be a string"}), 400
-        kwargs.update(set_title=True, title=body["title"])
-    if "stated_page_start" in body:
-        start, serr = _opt_int(body, "stated_page_start")
-        if serr:
-            return serr
-        kwargs.update(set_start=True, stated_page_start=start)
-    if "stated_page_end" in body:
-        end, eerr = _opt_int(body, "stated_page_end")
-        if eerr:
-            return eerr
-        kwargs.update(set_end=True, stated_page_end=end)
-    async with get_session() as session:
-        try:
-            await SeriesService(session).update_chapter(
-                tag_id, chapter_id, **kwargs
-            )
-        except SeriesError as exc:
-            return _series_err(exc)
-        await session.commit()
-    return jsonify({"ok": True})
-
-
-@tags_bp.route(
-    "/series/<int:tag_id>/chapters/<int:chapter_id>", methods=["DELETE"]
-)
-async def series_chapter_delete(tag_id: int, chapter_id: int):
-    async with get_session() as session:
-        try:
-            await SeriesService(session).delete_chapter(tag_id, chapter_id)
-        except SeriesError as exc:
-            return _series_err(exc)
-        await session.commit()
-    return jsonify({"ok": True})
-
-
-@tags_bp.route(
-    "/series/<int:tag_id>/chapters/<int:chapter_id>/merge", methods=["POST"]
-)
-async def series_chapter_merge(tag_id: int, chapter_id: int):
-    body = await request.get_json()
-    target, terr = _opt_int(body, "target_chapter_id")
-    if terr:
-        return terr
-    if target is None:
-        return jsonify({"error": "target_chapter_id required"}), 400
-    async with get_session() as session:
-        try:
-            moved = await SeriesService(session).merge_chapter(
-                tag_id, chapter_id, target
-            )
-        except SeriesError as exc:
-            return _series_err(exc)
-        await session.commit()
-    return jsonify({"moved_count": moved})
-
-
-@tags_bp.route(
-    "/series/<int:tag_id>/chapters/<int:chapter_id>/reorder", methods=["POST"]
-)
-async def series_chapter_reorder_pages(tag_id: int, chapter_id: int):
-    body = await request.get_json()
-    ids, err = _parse_bulk_ids(body, max_ids=500)
-    if err:
-        return err
-    async with get_session() as session:
-        try:
-            await SeriesService(session).reorder_pages(tag_id, chapter_id, ids)
-        except SeriesError as exc:
-            return _series_err(exc)
-        await session.commit()
-    return jsonify({"ok": True})
-
-
-# ---- browse list + post→series flows (FC-6.2) -----------------------------
-
-
-@tags_bp.route("/series", methods=["GET"])
-async def series_list():
-    args = request.args
-    sort = args.get("sort", "recent")
-    if sort not in ("recent", "name", "size"):
-        return jsonify({"error": "sort must be recent|name|size"}), 400
-    artist_id = None
-    if args.get("artist_id") is not None:
-        try:
-            artist_id = int(args["artist_id"])
-        except ValueError:
-            return jsonify({"error": "artist_id must be an integer"}), 400
-    async with get_session() as session:
-        rows = await SeriesService(session).list_series(
-            sort=sort, artist_id=artist_id
-        )
-    return jsonify({"series": rows})
-
-
-@tags_bp.route("/series/from-post", methods=["POST"])
-async def series_from_post():
-    body = await request.get_json()
-    post_id, err = _opt_int(body, "post_id")
-    if err:
-        return err
-    if post_id is None:
-        return jsonify({"error": "post_id required"}), 400
-    async with get_session() as session:
-        try:
-            out = await SeriesService(session).promote_post_to_series(post_id)
-        except SeriesError as exc:
-            return _series_err(exc)
-        await session.commit()
-    return jsonify(out)
-
-
-@tags_bp.route("/series/<int:tag_id>/add-post", methods=["POST"])
-async def series_add_post(tag_id: int):
-    body = await request.get_json()
-    post_id, err = _opt_int(body, "post_id")
-    if err:
-        return err
-    if post_id is None:
-        return jsonify({"error": "post_id required"}), 400
-    async with get_session() as session:
-        try:
-            out = await SeriesService(session).add_post_as_chapter(tag_id, post_id)
-        except SeriesError as exc:
-            return _series_err(exc)
-        await session.commit()
-    return jsonify(out)
-
-
-# ---- suggestion queue (FC-6.3) --------------------------------------------
-
-
-@tags_bp.route("/series/suggestions", methods=["GET"])
-async def series_suggestions_list():
-    async with get_session() as session:
-        rows = await SeriesMatchService(session).list_pending()
-    return jsonify({"suggestions": rows})
-
-
-@tags_bp.route("/series/suggestions/<int:sid>/accept", methods=["POST"])
-async def series_suggestion_accept(sid: int):
-    async with get_session() as session:
-        try:
-            out = await SeriesMatchService(session).accept(sid)
-        except SeriesError as exc:
-            return _series_err(exc)
-        await session.commit()
-    return jsonify(out)
-
-
-@tags_bp.route("/series/suggestions/<int:sid>/dismiss", methods=["POST"])
-async def series_suggestion_dismiss(sid: int):
-    async with get_session() as session:
-        try:
-            await SeriesMatchService(session).dismiss(sid)
-        except SeriesError as exc:
-            return _series_err(exc)
-        await session.commit()
-    return jsonify({"ok": True})
-
-
-@tags_bp.route("/series/suggestions/rescan", methods=["POST"])
-async def series_suggestions_rescan():
-    from ..tasks.admin import rescan_series_suggestions_task
-
-    res = rescan_series_suggestions_task.delay()
-    return jsonify({"task_id": res.id})

backend/app/api/thumbnails.py

@@ -1,28 +0,0 @@
-"""Thumbnail admin API: backfill trigger."""
-
-import asyncio
-
-from quart import Blueprint, jsonify
-
-thumbnails_bp = Blueprint("thumbnails", __name__, url_prefix="/api/thumbnails")
-
-
-@thumbnails_bp.route("/backfill", methods=["POST"])
-async def trigger_backfill():
-    """Run the backfill scan synchronously, return the counts. The actual
-    thumbnail generation work is still off-loaded to the thumbnail Celery
-    queue via `generate_thumbnail.delay()` per missing row — so this
-    handler is fast even on a 100k-image library (a scan is just SELECT
-    id, thumbnail_path + a file.stat() per row, no heavy work).
-
-    Operator-flagged 2026-06-01: the previous fire-and-forget shape
-    returned `{celery_task_id}` only, so the admin UI had no idea whether
-    backfill found 0 or 5000 candidates — \"found nothing\" was
-    indistinguishable from \"the worker isn't picking up the task.\""""
-    from ..tasks.thumbnail import _run_backfill_scan
-
-    # Sync scan inside an executor so we don't block the event loop.
-    counts = await asyncio.get_running_loop().run_in_executor(
-        None, _run_backfill_scan,
-    )
-    return jsonify(counts), 200

backend/app/celery_app.py

@@ -28,11 +28,9 @@ def make_celery() -> Celery:
             "backend.app.tasks.import_file",
             "backend.app.tasks.thumbnail",
             "backend.app.tasks.maintenance",
+            "backend.app.tasks.migration",
             "backend.app.tasks.ml",
             "backend.app.tasks.download",
-            "backend.app.tasks.backup",
-            "backend.app.tasks.admin",
-            "backend.app.tasks.library_audit",
         ],
     )
     app.conf.update(
@@ -43,16 +41,8 @@ def make_celery() -> Celery:
             "backend.app.tasks.thumbnail.*": {"queue": "thumbnail"},
             "backend.app.tasks.download.*": {"queue": "download"},
             "backend.app.tasks.scan.*": {"queue": "scan"},
-            # `maintenance` is the QUICK lane — recovery sweeps, vacuum, cleanup
-            # (concurrency-1 on the scheduler). The long one-shots (DB backups,
-            # library audits, admin maintenance: normalize/re-extract/cascade-
-            # delete) run on a SEPARATE `maintenance_long` lane + worker so they
-            # can never starve the quick self-healing sweeps (operator-flagged
-            # 2026-06-07: a 2h audit blocked vacuum/backup/normalize for hours).
             "backend.app.tasks.maintenance.*": {"queue": "maintenance"},
-            "backend.app.tasks.backup.*": {"queue": "maintenance_long"},
-            "backend.app.tasks.admin.*": {"queue": "maintenance_long"},
-            "backend.app.tasks.library_audit.*": {"queue": "maintenance_long"},
+            "backend.app.tasks.migration.*": {"queue": "maintenance"},
         },
         # Heavy ML tasks need fair dispatch — see ImageRepo's precedent.
         task_acks_late=True,
@@ -91,71 +81,9 @@ def make_celery() -> Celery:
                 "task": "backend.app.tasks.maintenance.cleanup_old_download_events",
                 "schedule": 86400.0,  # daily
             },
-            "recover-stalled-download-events": {
-                "task": "backend.app.tasks.maintenance.recover_stalled_download_events",
-                "schedule": 300.0,  # every 5 min, matches recover-interrupted-tasks
-            },
-            "recover-stalled-task-runs": {
-                "task": "backend.app.tasks.maintenance.recover_stalled_task_runs",
-                "schedule": 300.0,  # every 5 min, matches recover-interrupted-tasks
-            },
-            "prune-task-runs": {
-                "task": "backend.app.tasks.maintenance.prune_task_runs",
-                "schedule": 86400.0,  # daily
-            },
-            "vacuum-analyze": {
-                "task": "backend.app.tasks.maintenance.vacuum_analyze",
-                "schedule": 604800.0,  # weekly — reclaim dead-tuple bloat + refresh stats
-            },
-            "fc3h-backup-db-nightly": {
-                "task": "backend.app.tasks.backup.backup_db_nightly",
-                "schedule": 3600.0,  # hourly tick; task self-gates on configured UTC hour
-            },
-            "fc3h-prune-backups": {
-                "task": "backend.app.tasks.backup.prune_backups",
-                "schedule": 86400.0,  # daily
-            },
-            # Audit 2026-06-02 — three new per-entity recovery sweeps.
-            # Each runs every 5 min like the other recover_stalled_*
-            # sweeps; each is a no-op when nothing is stuck.
-            "recover-stalled-backup-runs": {
-                "task": "backend.app.tasks.maintenance.recover_stalled_backup_runs",
-                "schedule": 300.0,
-            },
-            "recover-stalled-library-audit-runs": {
-                "task": "backend.app.tasks.maintenance.recover_stalled_library_audit_runs",
-                "schedule": 300.0,
-            },
-            "recover-stalled-import-batches": {
-                "task": "backend.app.tasks.maintenance.recover_stalled_import_batches",
-                "schedule": 300.0,
-            },
-            # Audit 2026-06-02 — daily retention for two entities
-            # whose terminal rows otherwise accumulate forever.
-            "prune-library-audit-runs": {
-                "task": "backend.app.tasks.maintenance.prune_library_audit_runs",
-                "schedule": 86400.0,
-            },
-            "prune-import-batches": {
-                "task": "backend.app.tasks.maintenance.prune_import_batches",
-                "schedule": 86400.0,
-            },
-            # Audit 2026-06-02 — backfill_thumbnails's docstring claimed
-            # "periodic Beat" but the entry was never registered, so the
-            # library got no self-healing thumbnail repair; only the
-            # manual admin-UI button fired it. Daily cadence is gentle
-            # (the task is idempotent and only enqueues regen for rows
-            # whose stored thumbnails are missing or corrupt).
-            "backfill-thumbnails-daily": {
-                "task": "backend.app.tasks.thumbnail.backfill_thumbnails",
-                "schedule": 86400.0,
-            },
         },
         timezone="UTC",
     )
-    # FC-3i: register task_run signal handlers (side-effect import).
-    from . import celery_signals  # noqa: F401
-
     return app
 
 

backend/app/celery_signals.py

@@ -1,219 +0,0 @@
-"""FC-3i: task_run lifecycle via Celery signals.
-
-Subscribes to task_prerun / task_postrun / task_failure / task_retry
-and persists one task_run row per task attempt. Drop-in for every
-existing and future Celery task — no per-task instrumentation.
-
-Signal handlers run inside the worker process (sync context); DB
-writes go through the existing shared sync engine
-(backend.app.tasks._sync_engine.sync_session_factory) — one engine
-per worker process, not per-task, so we don't blow Postgres
-max_connections under load (the reason FC-3g shared-engine fix
-existed).
-
-Failure-mode discipline (operator-pressed point): every handler is
-wrapped in try/except that swallows + logs. If the DB is down or the
-handler has a bug, the real task still runs — the dashboard goes
-dark for that interval. Monitoring NEVER breaks the thing it's
-monitoring.
-"""
-
-import logging
-from datetime import UTC, datetime
-
-from celery.exceptions import SoftTimeLimitExceeded
-from celery.signals import task_failure, task_postrun, task_prerun, task_retry
-
-from .models import TaskRun
-from .tasks._sync_engine import sync_session_factory
-
-log = logging.getLogger(__name__)
-
-# Celery-internal tasks that would generate dashboard noise without
-# operational value. Conservative list; extend only when a specific
-# task proves noisy.
-_UNTRACKED_TASK_NAMES = frozenset({
-    "celery.chord_unlock",
-    "celery.backend_cleanup",
-    "celery.chunks",
-})
-
-_MAX_ERROR_MESSAGE_LEN = 2000
-_MAX_ARGS_SUMMARY_LEN = 255
-_MAX_WORKER_HOSTNAME_LEN = 128
-
-# PostgreSQL Integer is signed 32-bit. Tasks called with a first-arg
-# int outside this range (e.g. an absurdly large mock value, or a
-# string-of-digits coercible to int but bigger than 2^31-1) would crash
-# the INSERT with NumericValueOutOfRange. Bound the recorded value to
-# the column's range; values outside become None (target_id is
-# nullable, so this is safe).
-_INT32_MAX = 2_147_483_647
-_INT32_MIN = -2_147_483_648
-
-
-def _queue_for(task) -> str:
-    """Reverse the task→queue routing from celery_app.task_routes.
-    Keep in sync if task_routes is reordered.
-
-    Audit 2026-06-02: backup/admin/library_audit prefixes were
-    missing here even though task_routes sent all three to
-    'maintenance'. The TaskRun.queue column then lied for those
-    rows (claimed 'default') so per-queue dashboard filters and
-    per-queue threshold overrides silently missed them.
-    """
-    name = getattr(task, "name", "") or ""
-    if name.startswith("backend.app.tasks.import_file."):
-        return "import"
-    if name.startswith("backend.app.tasks.ml."):
-        return "ml"
-    if name.startswith("backend.app.tasks.thumbnail."):
-        return "thumbnail"
-    if name.startswith("backend.app.tasks.download."):
-        return "download"
-    if name.startswith("backend.app.tasks.scan."):
-        return "scan"
-    if name.startswith((
-        "backend.app.tasks.maintenance.",
-        "backend.app.tasks.backup.",
-        "backend.app.tasks.admin.",
-        "backend.app.tasks.library_audit.",
-    )):
-        return "maintenance"
-    return "default"
-
-
-def _target_id_from_args(args) -> int | None:
-    """Best-effort: if the first positional arg parses as int AND fits
-    in the column's signed-32-bit range, record it as target_id
-    (image_id, source_id, etc.). Never raises."""
-    if not args:
-        return None
-    try:
-        value = int(args[0])
-    except (TypeError, ValueError):
-        return None
-    if value < _INT32_MIN or value > _INT32_MAX:
-        return None
-    return value
-
-
-def _truncate(s, limit: int) -> str | None:
-    if s is None:
-        return None
-    text = str(s)
-    return text if len(text) <= limit else text[:limit]
-
-
-def _is_tracked(task_name: str | None) -> bool:
-    return bool(task_name) and task_name not in _UNTRACKED_TASK_NAMES
-
-
-@task_prerun.connect
-def _on_prerun(sender=None, task_id=None, task=None, args=None,
-               kwargs=None, **_):
-    if not _is_tracked(getattr(task, "name", None)):
-        return
-    try:
-        Session = sync_session_factory()
-        with Session() as session:
-            session.add(TaskRun(
-                celery_task_id=task_id or "",
-                queue=_queue_for(task),
-                task_name=task.name,
-                target_id=_target_id_from_args(args),
-                started_at=datetime.now(UTC),
-                status="running",
-                args_summary=_truncate(repr(args), _MAX_ARGS_SUMMARY_LEN),
-                worker_hostname=_truncate(
-                    getattr(sender, "hostname", None),
-                    _MAX_WORKER_HOSTNAME_LEN,
-                ),
-            ))
-            session.commit()
-    except Exception:  # noqa: BLE001 — never break the worker
-        log.exception("task_run prerun insert failed (task=%s)",
-                      getattr(task, "name", "?"))
-
-
-def _finalize(task_id: str, *, status: str,
-              error_type: str | None = None,
-              error_message: str | None = None,
-              retry_count: int | None = None) -> None:
-    """Shared write path for postrun/failure/retry. Picks the most-
-    recent task_run row for this celery_task_id that's still 'running'
-    (retries reuse the same celery_task_id; each new attempt's prerun
-    inserts a fresh row, so finalize targets the latest running row)."""
-    try:
-        from sqlalchemy import select
-
-        Session = sync_session_factory()
-        now = datetime.now(UTC)
-        with Session() as session:
-            row = session.execute(
-                select(TaskRun)
-                .where(TaskRun.celery_task_id == task_id)
-                .where(TaskRun.status == "running")
-                .order_by(TaskRun.id.desc())
-                .limit(1)
-            ).scalar_one_or_none()
-            if row is None:
-                return  # no prerun row (untracked, insert failed, or already finalized)
-            row.finished_at = now
-            row.duration_ms = int(
-                (now - row.started_at).total_seconds() * 1000
-            )
-            row.status = status
-            if error_type is not None:
-                row.error_type = _truncate(error_type, 128)
-            if error_message is not None:
-                row.error_message = _truncate(error_message, _MAX_ERROR_MESSAGE_LEN)
-            if retry_count is not None:
-                row.retry_count = retry_count
-            session.commit()
-    except Exception:  # noqa: BLE001
-        log.exception("task_run finalize failed (task_id=%s)", task_id)
-
-
-@task_postrun.connect
-def _on_postrun(sender=None, task_id=None, task=None, args=None,
-                kwargs=None, retval=None, state=None, **_):
-    if not _is_tracked(getattr(task, "name", None)):
-        return
-    # state is one of SUCCESS/FAILURE/RETRY/etc. Only handle SUCCESS;
-    # task_failure handles FAILURE explicitly (with the exception).
-    if state != "SUCCESS":
-        return
-    _finalize(task_id, status="ok")
-
-
-@task_failure.connect
-def _on_failure(sender=None, task_id=None, exception=None,
-                args=None, kwargs=None, einfo=None, **_):
-    if not _is_tracked(getattr(sender, "name", None)):
-        return
-    status = ("timeout"
-              if isinstance(exception, SoftTimeLimitExceeded)
-              else "error")
-    _finalize(
-        task_id, status=status,
-        error_type=type(exception).__name__ if exception else "Unknown",
-        error_message=str(exception) if exception else None,
-    )
-
-
-@task_retry.connect
-def _on_retry(sender=None, request=None, reason=None, einfo=None, **_):
-    if not _is_tracked(getattr(sender, "name", None)):
-        return
-    task_id = getattr(request, "id", None)
-    if not task_id:
-        return
-    # Mark current attempt's row as 'retry' (terminal for this row).
-    # The next attempt's task_prerun inserts a fresh row.
-    _finalize(
-        task_id, status="retry",
-        error_type=type(reason).__name__ if reason else "Retry",
-        error_message=str(reason) if reason else None,
-        retry_count=getattr(request, "retries", 0),
-    )

backend/app/models/__init__.py

@@ -2,8 +2,6 @@
 
 from .app_setting import AppSetting
 from .artist import Artist
-from .artist_visit import ArtistVisit
-from .backup_run import BackupRun
 from .base import Base
 from .credential import Credential
 from .download_event import DownloadEvent
@@ -12,38 +10,27 @@ from .image_record import ImageRecord
 from .import_batch import ImportBatch
 from .import_settings import ImportSettings
 from .import_task import ImportTask
-from .library_audit_run import LibraryAuditRun
+from .migration_run import MigrationRun
 from .ml_settings import MLSettings
-from .patreon_failed_media import PatreonFailedMedia
-from .patreon_seen_media import PatreonSeenMedia
 from .post import Post
 from .post_attachment import PostAttachment
-from .series_chapter import SeriesChapter
 from .series_page import SeriesPage
-from .series_suggestion import SeriesSuggestion
 from .source import Source
 from .tag import Tag, TagKind, image_tag
 from .tag_alias import TagAlias
 from .tag_allowlist import TagAllowlist
 from .tag_reference_embedding import TagReferenceEmbedding
 from .tag_suggestion_rejection import TagSuggestionRejection
-from .task_run import TaskRun
 
 __all__ = [
     "Base",
     "AppSetting",
     "Artist",
-    "ArtistVisit",
-    "BackupRun",
     "Source",
     "Credential",
-    "PatreonFailedMedia",
-    "PatreonSeenMedia",
     "Post",
     "PostAttachment",
-    "SeriesChapter",
     "SeriesPage",
-    "SeriesSuggestion",
     "ImageRecord",
     "ImageProvenance",
     "Tag",
@@ -53,11 +40,10 @@ __all__ = [
     "ImportBatch",
     "ImportTask",
     "ImportSettings",
-    "LibraryAuditRun",
     "MLSettings",
+    "MigrationRun",
     "TagAlias",
     "TagAllowlist",
     "TagReferenceEmbedding",
     "TagSuggestionRejection",
-    "TaskRun",
 ]

backend/app/models/artist_visit.py

@@ -1,36 +0,0 @@
-"""ArtistVisit — per-artist 'last viewed' timestamp.
-
-Powers the "+N new since last visit" badge on the artists directory and
-the matching banner on `ArtistView`. One row per artist, single global
-operator. When the multi-user model lands, the PK widens to
-`(user_id, artist_id)` — currently aspirational only (no User model,
-no services/access.py); operator approved skipping `user_id` for now
-under rule #22 (breaking changes welcome).
-
-Seed at migration time: every existing artist gets `last_viewed_at = NOW()`
-so the badge starts at 0 across the board (no noisy "5000 unseen" on
-first deploy). New artists also auto-get a row via
-`ArtistService.find_or_create`.
-"""
-
-from datetime import datetime
-
-from sqlalchemy import DateTime, ForeignKey, Integer, func
-from sqlalchemy.orm import Mapped, mapped_column
-
-from .base import Base
-
-
-class ArtistVisit(Base):
-    __tablename__ = "artist_visit"
-
-    artist_id: Mapped[int] = mapped_column(
-        Integer,
-        ForeignKey("artist.id", ondelete="CASCADE"),
-        primary_key=True,
-    )
-    last_viewed_at: Mapped[datetime] = mapped_column(
-        DateTime(timezone=True),
-        nullable=False,
-        server_default=func.now(),
-    )

backend/app/models/backup_run.py

@@ -1,55 +0,0 @@
-"""FC-3h: backup_run — operator-facing artifact record for a backup run.
-
-One row per backup attempt (kind='db' or 'images'). Lifecycle
-tracking (started_at/finished_at/duration_ms/exception text) lives
-in task_run from FC-3i — this row records artifact metadata: file
-paths, sizes, tag (retention protection), and restore lineage via
-restored_from_id.
-
-Status values (String, not Postgres ENUM — per
-feedback_check_existing_enums):
-  pending   — created but task hasn't started yet (rare; usually
-              status starts as 'running' from the task body).
-  running   — backup task is in flight.
-  ok        — artifact successfully written.
-  error     — task raised; error column populated.
-  restoring — this row represents a restore attempt (kind = restored
-              kind); linked to source via restored_from_id.
-  restored  — restore completed successfully.
-"""
-
-from datetime import datetime
-
-from sqlalchemy import JSON, BigInteger, DateTime, ForeignKey, Integer, String, Text
-from sqlalchemy.orm import Mapped, mapped_column
-
-from .base import Base
-
-
-class BackupRun(Base):
-    __tablename__ = "backup_run"
-
-    id: Mapped[int] = mapped_column(Integer, primary_key=True)
-    kind: Mapped[str] = mapped_column(String(16), nullable=False, index=True)
-    status: Mapped[str] = mapped_column(
-        String(16), nullable=False, default="pending", index=True,
-    )
-    tag: Mapped[str | None] = mapped_column(String(64), nullable=True, index=True)
-    triggered_by: Mapped[str] = mapped_column(String(32), nullable=False)
-    started_at: Mapped[datetime] = mapped_column(
-        DateTime(timezone=True), nullable=False, index=True,
-    )
-    finished_at: Mapped[datetime | None] = mapped_column(
-        DateTime(timezone=True), nullable=True, index=True,
-    )
-    sql_path: Mapped[str | None] = mapped_column(Text, nullable=True)
-    tar_path: Mapped[str | None] = mapped_column(Text, nullable=True)
-    size_bytes: Mapped[int | None] = mapped_column(BigInteger, nullable=True)
-    error: Mapped[str | None] = mapped_column(Text, nullable=True)
-    manifest: Mapped[dict] = mapped_column(
-        JSON, nullable=False, default=dict, server_default="{}",
-    )
-    restored_from_id: Mapped[int | None] = mapped_column(
-        ForeignKey("backup_run.id", ondelete="SET NULL"),
-        nullable=True,
-    )

backend/app/models/image_provenance.py

@@ -1,18 +1,14 @@
 """ImageProvenance — links an ImageRecord to a Post.
 
-One image can have many provenance rows — different posts each contribute
-metadata (enrich-on-duplicate rule, spec §3: a downloaded image that is a
-pHash dupe of an existing record gets a NEW provenance row for the new post
-appended, rather than the metadata being dropped). But the (image, post)
-pair is unique — alembic 0021 enforces uq_image_provenance_image_post
-after operator-flagged 2026-05-26 saw _apply_sidecar's existence-check +
-INSERT race plant duplicates that then broke .scalar_one_or_none() on
-every later deep-scan rederive (MultipleResultsFound).
+Many-to-one (one image, many provenance rows) enables the enrich-on-duplicate
+rule (spec §3): when a downloaded image is a pHash dupe of an existing
+record, we append a new provenance row to the existing record rather than
+dropping the metadata.
 """
 
 from datetime import datetime
 
-from sqlalchemy import JSON, DateTime, ForeignKey, Integer, UniqueConstraint, func
+from sqlalchemy import JSON, DateTime, ForeignKey, Integer, func
 from sqlalchemy.orm import Mapped, mapped_column
 
 from .base import Base
@@ -20,12 +16,6 @@ from .base import Base
 
 class ImageProvenance(Base):
     __tablename__ = "image_provenance"
-    __table_args__ = (
-        UniqueConstraint(
-            "image_record_id", "post_id",
-            name="uq_image_provenance_image_post",
-        ),
-    )
 
     id: Mapped[int] = mapped_column(Integer, primary_key=True)
     image_record_id: Mapped[int] = mapped_column(
@@ -34,12 +24,8 @@ class ImageProvenance(Base):
     post_id: Mapped[int] = mapped_column(
         ForeignKey("post.id", ondelete="CASCADE"), nullable=False, index=True
     )
-    # Nullable since alembic 0030 — provenance rows for filesystem-imported
-    # content with no subscription have NULL source_id. FK ondelete SET
-    # NULL so deleting a Source detaches its provenance rows instead of
-    # destroying the linkage between image and post.
-    source_id: Mapped[int | None] = mapped_column(
-        ForeignKey("source.id", ondelete="SET NULL"), nullable=True, index=True
+    source_id: Mapped[int] = mapped_column(
+        ForeignKey("source.id", ondelete="CASCADE"), nullable=False, index=True
     )
     captured_metadata: Mapped[dict | None] = mapped_column(JSON, nullable=True)
     captured_at: Mapped[datetime] = mapped_column(

backend/app/models/image_record.py

@@ -74,17 +74,6 @@ class ImageRecord(Base):
     created_at: Mapped[datetime] = mapped_column(
         DateTime(timezone=True), nullable=False, server_default=func.now()
     )
-    # Denormalized gallery sort key = COALESCE(primary post's post_date,
-    # created_at) (alembic 0035). The gallery used to compute this as a
-    # COALESCE across the Post outer join on every /scroll, which can't use
-    # an index and re-sorted a large slice of the library per page (×10 with
-    # the old serial batching). Materializing it lets the cursor scroll read
-    # ix_image_record_effective_date directly. Maintained by the importer
-    # (services/importer.py _apply_sidecar) when a primary post with a date
-    # is linked; plain inserts keep the created_at-equivalent server default.
-    effective_date: Mapped[datetime] = mapped_column(
-        DateTime(timezone=True), nullable=False, server_default=func.now()
-    )
     updated_at: Mapped[datetime] = mapped_column(
         DateTime(timezone=True),
         nullable=False,

backend/app/models/import_batch.py

@@ -26,10 +26,6 @@ class ImportBatch(Base):
     skipped: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
     failed: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
     attachments: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
-    # Deep-scan only: count of already-imported files whose sidecar metadata
-    # got re-applied this run (post/source/provenance upsert). Stays 0 on
-    # quick-scan batches. See `Importer.import_one(deep_scan=True)`.
-    refreshed: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
 
     status: Mapped[str] = mapped_column(String(16), nullable=False, default="running", index=True)
     # running | complete | cancelled

backend/app/models/import_settings.py

@@ -4,7 +4,7 @@ Enforced as a single row via a CHECK (id = 1) constraint. The application
 always SELECTs id=1 and never inserts/deletes after the initial migration.
 """
 
-from sqlalchemy import Boolean, CheckConstraint, Float, Integer, Text, select
+from sqlalchemy import Boolean, CheckConstraint, Float, Integer, Text
 from sqlalchemy.orm import Mapped, mapped_column
 
 from .base import Base
@@ -49,36 +49,3 @@ class ImportSettings(Base):
     download_failure_warning_threshold: Mapped[int] = mapped_column(
         Integer, nullable=False, default=5
     )
-
-    # FC-3h backup knobs.
-    backup_db_nightly_enabled: Mapped[bool] = mapped_column(
-        Boolean, nullable=False, default=False,
-    )
-    backup_db_nightly_hour_utc: Mapped[int] = mapped_column(
-        Integer, nullable=False, default=3,
-    )
-    backup_db_keep_last_n: Mapped[int] = mapped_column(
-        Integer, nullable=False, default=14,
-    )
-    backup_images_keep_last_n: Mapped[int] = mapped_column(
-        Integer, nullable=False, default=3,
-    )
-
-    # FC-6.3 series continuation matcher. enabled gates the rescan; threshold is
-    # the weighted-score cut-off (0..1) above which a pending suggestion is made.
-    series_suggest_enabled: Mapped[bool] = mapped_column(
-        Boolean, nullable=False, default=True,
-    )
-    series_suggest_threshold: Mapped[float] = mapped_column(
-        Float, nullable=False, default=0.5,
-    )
-
-    @classmethod
-    async def load(cls, session) -> ImportSettings:
-        """The singleton settings row (id=1), via an async session."""
-        return (await session.execute(select(cls).where(cls.id == 1))).scalar_one()
-
-    @classmethod
-    def load_sync(cls, session) -> ImportSettings:
-        """The singleton settings row (id=1), via a sync session."""
-        return session.execute(select(cls).where(cls.id == 1)).scalar_one()

backend/app/models/import_task.py

@@ -8,16 +8,7 @@ been processing longer than the stuck-task threshold.
 
 from datetime import datetime
 
-from sqlalchemy import (
-    BigInteger,
-    Boolean,
-    DateTime,
-    ForeignKey,
-    Integer,
-    String,
-    Text,
-    func,
-)
+from sqlalchemy import BigInteger, DateTime, ForeignKey, Integer, String, Text, func
 from sqlalchemy.orm import Mapped, mapped_column, relationship
 
 from .base import Base
@@ -35,13 +26,6 @@ class ImportTask(Base):
     task_type: Mapped[str] = mapped_column(String(16), nullable=False)  # media|archive
     status: Mapped[str] = mapped_column(String(16), nullable=False, default="pending", index=True)
 
-    # Poison-pill circuit breaker (alembic 0026). recovery_count tracks
-    # how many times the stuck-task sweep has re-queued this row; after
-    # the cap it's failed with a diagnostic instead of looping. refetched
-    # bounds the one-shot re-download remediation to a single attempt.
-    recovery_count: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
-    refetched: Mapped[bool] = mapped_column(Boolean, nullable=False, default=False)
-
     result_image_id: Mapped[int | None] = mapped_column(
         ForeignKey("image_record.id", ondelete="SET NULL"), nullable=True
     )

backend/app/models/library_audit_run.py

@@ -1,44 +0,0 @@
-"""LibraryAuditRun — async transparency / single_color audit lifecycle.
-
-State machine: running → ready → applied / cancelled / error.
-matched_ids JSONB is appended-to by scan_library_for_rule; apply_audit_run
-reads it and routes through cleanup_service.delete_images.
-"""
-
-from datetime import datetime
-from typing import Any
-
-from sqlalchemy import DateTime, Integer, String, Text, func
-from sqlalchemy.dialects.postgresql import JSONB
-from sqlalchemy.orm import Mapped, mapped_column
-
-from .base import Base
-
-
-class LibraryAuditRun(Base):
-    __tablename__ = "library_audit_run"
-
-    id: Mapped[int] = mapped_column(Integer, primary_key=True)
-    rule: Mapped[str] = mapped_column(String(32), nullable=False, index=True)
-    params: Mapped[dict[str, Any]] = mapped_column(JSONB, nullable=False)
-    status: Mapped[str] = mapped_column(
-        String(16), nullable=False, default="running", index=True,
-    )
-    # running | ready | applied | cancelled | error
-    started_at: Mapped[datetime] = mapped_column(
-        DateTime(timezone=True), nullable=False, server_default=func.now(),
-    )
-    finished_at: Mapped[datetime | None] = mapped_column(
-        DateTime(timezone=True), nullable=True,
-    )
-    scanned_count: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
-    matched_count: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
-    matched_ids: Mapped[list[int]] = mapped_column(JSONB, nullable=False, default=list)
-    error: Mapped[str | None] = mapped_column(Text, nullable=True)
-    # Chunked-scan state (alembic 0039): keyset cursor the next chunk resumes
-    # from, and the last time a chunk made progress (so the recovery sweep can
-    # tell a progressing multi-chunk audit from a stuck one).
-    resume_after_id: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
-    last_progress_at: Mapped[datetime | None] = mapped_column(
-        DateTime(timezone=True), nullable=True,
-    )

backend/app/models/migration_run.py

@@ -0,0 +1,37 @@
+"""MigrationRun — tracks each FC-5 migration invocation (backup/gs/ir/etc).
+
+kind/status are String(32) not Postgres ENUM so adding kinds later
+doesn't need a schema migration. The API layer validates values.
+"""
+
+from datetime import datetime
+
+import sqlalchemy as sa
+from sqlalchemy import Boolean, DateTime, Integer, String, Text, func
+from sqlalchemy.dialects.postgresql import JSONB
+from sqlalchemy.orm import Mapped, mapped_column
+
+from .base import Base
+
+
+class MigrationRun(Base):
+    __tablename__ = "migration_run"
+
+    id: Mapped[int] = mapped_column(Integer, primary_key=True)
+    kind: Mapped[str] = mapped_column(String(32), nullable=False, index=True)
+    status: Mapped[str] = mapped_column(String(32), nullable=False, index=True)
+    dry_run: Mapped[bool] = mapped_column(Boolean, nullable=False, default=False)
+    started_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False, server_default=func.now(),
+    )
+    finished_at: Mapped[datetime | None] = mapped_column(
+        DateTime(timezone=True), nullable=True,
+    )
+    counts: Mapped[dict] = mapped_column(
+        JSONB, nullable=False, default=dict, server_default=sa.text("'{}'::jsonb"),
+    )
+    error: Mapped[str | None] = mapped_column(Text, nullable=True)
+    metadata_: Mapped[dict] = mapped_column(
+        "metadata", JSONB, nullable=False, default=dict,
+        server_default=sa.text("'{}'::jsonb"),
+    )

backend/app/models/ml_settings.py

@@ -15,15 +15,17 @@ class MLSettings(Base):
     __table_args__ = (CheckConstraint("id = 1", name="singleton"),)
 
     id: Mapped[int] = mapped_column(Integer, primary_key=True)
+    suggestion_threshold_artist: Mapped[float] = mapped_column(
+        Float, nullable=False, default=0.30
+    )
     suggestion_threshold_character: Mapped[float] = mapped_column(
-        Float, nullable=False, default=0.70
+        Float, nullable=False, default=0.50
+    )
+    suggestion_threshold_copyright: Mapped[float] = mapped_column(
+        Float, nullable=False, default=0.50
     )
-    # Default raised 0.50 → 0.70 on 2026-06-02 — operator-flagged 0.50
-    # surfaced too many low-confidence picks; 0.70 keeps the rail
-    # signal-rich while still surfacing more than the original 0.95
-    # which hid almost everything. Operator-tunable via Settings → ML.
     suggestion_threshold_general: Mapped[float] = mapped_column(
-        Float, nullable=False, default=0.70
+        Float, nullable=False, default=0.95
     )
     centroid_similarity_threshold: Mapped[float] = mapped_column(
         Float, nullable=False, default=0.55

backend/app/models/patreon_failed_media.py

@@ -1,45 +0,0 @@
-"""PatreonFailedMedia — per-source dead-letter ledger of Patreon media that
-keeps failing to download/validate.
-
-Plan #705 (#7). A media that fails every walk (404'd CDN URL, deleted post,
-geo-blocked Mux stream, persistently-corrupt bytes) would otherwise re-error
-forever and re-burn backfill chunks. After ``attempts`` reaches the dead-letter
-threshold the ingester skips it on routine tick/backfill walks (recovery still
-re-attempts it — the operator's "try everything again"). A later clean download
-clears the row (the media recovered).
-
-`filehash` is the same per-media key the seen-ledger uses (32-hex CDN MD5, or a
-``video:`` / ``post:filename`` synthesized key) — hence String(128). UNIQUE
-(source_id, filehash) is the upsert key.
-"""
-
-from datetime import datetime
-
-from sqlalchemy import ForeignKey, Integer, String, Text, UniqueConstraint, func
-from sqlalchemy.orm import Mapped, mapped_column
-from sqlalchemy.types import DateTime
-
-from .base import Base
-
-
-class PatreonFailedMedia(Base):
-    __tablename__ = "patreon_failed_media"
-    __table_args__ = (
-        UniqueConstraint(
-            "source_id", "filehash", name="uq_patreon_failed_media_source_id"
-        ),
-    )
-
-    id: Mapped[int] = mapped_column(Integer, primary_key=True)
-    source_id: Mapped[int] = mapped_column(
-        ForeignKey("source.id", ondelete="CASCADE"), nullable=False, index=True
-    )
-    filehash: Mapped[str] = mapped_column(String(128), nullable=False)
-    attempts: Mapped[int] = mapped_column(Integer, nullable=False, default=1)
-    last_error: Mapped[str | None] = mapped_column(Text, nullable=True)
-    first_failed_at: Mapped[datetime] = mapped_column(
-        DateTime(timezone=True), nullable=False, server_default=func.now()
-    )
-    last_failed_at: Mapped[datetime] = mapped_column(
-        DateTime(timezone=True), nullable=False, server_default=func.now()
-    )

backend/app/models/patreon_seen_media.py

@@ -1,38 +0,0 @@
-"""PatreonSeenMedia — per-source ledger of Patreon media already
-downloaded+processed.
-
-Replaces gallery-dl's archive.sqlite3 with our own queryable table so
-routine walks can skip media we've already ingested (and a future
-"recovery" mode can deliberately bypass the ledger to re-walk).
-
-`filehash` is normally a Patreon CDN MD5 (32 hex chars), but videos —
-which have no stable content hash at discovery time — use a sentinel of
-the form ``video:<post_id>:<media_id>``, hence String(128) rather than 32.
-"""
-
-from datetime import datetime
-
-from sqlalchemy import ForeignKey, Integer, String, UniqueConstraint, func
-from sqlalchemy.orm import Mapped, mapped_column
-from sqlalchemy.types import DateTime
-
-from .base import Base
-
-
-class PatreonSeenMedia(Base):
-    __tablename__ = "patreon_seen_media"
-    __table_args__ = (
-        # Dedup key the downloader upserts against: one ledger row per
-        # (source, media). A second sighting of the same media is a no-op.
-        UniqueConstraint("source_id", "filehash", name="uq_patreon_seen_media_source_id"),
-    )
-
-    id: Mapped[int] = mapped_column(Integer, primary_key=True)
-    source_id: Mapped[int] = mapped_column(
-        ForeignKey("source.id", ondelete="CASCADE"), nullable=False, index=True
-    )
-    filehash: Mapped[str] = mapped_column(String(128), nullable=False)
-    post_id: Mapped[str | None] = mapped_column(String(64), nullable=True)
-    seen_at: Mapped[datetime] = mapped_column(
-        DateTime(timezone=True), nullable=False, server_default=func.now()
-    )

backend/app/models/post.py

@@ -1,9 +1,6 @@
-"""Post — provenance anchor for one creator post (may contain many images).
+"""Post — provenance anchor for content downloaded from a Source.
 
-`source_id` is nullable since alembic 0030 — filesystem-imported posts
-with no live subscription have NULL source_id. `artist_id` is the
-denormalized always-present link to the creator (added in 0030 so
-artist-filter queries don't depend on the Source detour).
+A Post is one creator post; it may contain many images/videos.
 """
 
 from datetime import datetime
@@ -17,25 +14,12 @@ from .base import Base
 class Post(Base):
     __tablename__ = "post"
     __table_args__ = (
-        # Source-bound dedup. Postgres treats NULL != NULL so rows
-        # with source_id IS NULL aren't deduped by this constraint;
-        # the partial unique index `uq_post_artist_external_id_null_source`
-        # (created in alembic 0030) covers that case via
-        # (artist_id, external_post_id).
         UniqueConstraint("source_id", "external_post_id", name="uq_post_source_external_id"),
     )
 
     id: Mapped[int] = mapped_column(Integer, primary_key=True)
-    source_id: Mapped[int | None] = mapped_column(
-        ForeignKey("source.id", ondelete="SET NULL"), nullable=True, index=True
-    )
-    # Denormalized; always equals source.artist_id when source_id is set
-    # (the importer is responsible for keeping them consistent on insert).
-    # Filter queries (artist detail, artist-scoped posts feed) use this
-    # directly instead of joining through Source.
-    artist_id: Mapped[int] = mapped_column(
-        ForeignKey("artist.id", ondelete="CASCADE"),
-        nullable=False, index=True,
+    source_id: Mapped[int] = mapped_column(
+        ForeignKey("source.id", ondelete="CASCADE"), nullable=False, index=True
     )
     external_post_id: Mapped[str] = mapped_column(String(128), nullable=False)
     post_url: Mapped[str | None] = mapped_column(Text, nullable=True)

backend/app/models/series_chapter.py

@@ -1,47 +0,0 @@
-"""SeriesChapter — an ordered chapter/part within a series.
-
-A series IS a Tag(kind='series'); a chapter groups ordered SeriesPages under it.
-Reading order is (chapter.chapter_number, series_page.page_number): chapter_number
-sets the order of chapters, page_number orders pages within a chapter.
-
-chapter_number is an ordering key only (not unique) — reorder rewrites 1..N
-wholesale, mirroring series_page.page_number, so a reorder can't transiently
-collide on a unique index.
-
-A chapter may be a placeholder (is_placeholder=True) — a reserved empty slot for
-a section the operator doesn't have yet; it holds no pages and shows as a gap in
-the reader. stated_page_start/end carry the page range parsed from the source
-post (FC-6.2), used to flag missing-page gaps; both are nullable when unknown.
-"""
-
-from datetime import datetime
-
-from sqlalchemy import Boolean, DateTime, ForeignKey, Integer, Text, func
-from sqlalchemy.orm import Mapped, mapped_column
-
-from .base import Base
-
-
-class SeriesChapter(Base):
-    __tablename__ = "series_chapter"
-
-    id: Mapped[int] = mapped_column(Integer, primary_key=True)
-    series_tag_id: Mapped[int] = mapped_column(
-        ForeignKey("tag.id", ondelete="CASCADE"), nullable=False, index=True
-    )
-    chapter_number: Mapped[int] = mapped_column(Integer, nullable=False)
-    title: Mapped[str | None] = mapped_column(Text, nullable=True)
-    is_placeholder: Mapped[bool] = mapped_column(
-        Boolean, nullable=False, server_default="false"
-    )
-    stated_page_start: Mapped[int | None] = mapped_column(Integer, nullable=True)
-    stated_page_end: Mapped[int | None] = mapped_column(Integer, nullable=True)
-    created_at: Mapped[datetime] = mapped_column(
-        DateTime(timezone=True), nullable=False, server_default=func.now()
-    )
-    updated_at: Mapped[datetime] = mapped_column(
-        DateTime(timezone=True),
-        nullable=False,
-        server_default=func.now(),
-        onupdate=func.now(),
-    )

backend/app/models/series_page.py

@@ -1,12 +1,9 @@
 """SeriesPage — ordered image membership for a series-kind Tag.
 
-A series IS a Tag with kind='series'; series_page gives it ordered pages,
-grouped into chapters (FC-6). An image belongs to at most one series
-(UNIQUE image_id) ⇒ at most one chapter. Reading order is
-(chapter.chapter_number, series_page.page_number): page_number orders pages
-WITHIN a chapter and is an ordering key only (not unique) — reorder rewrites
-1..N wholesale. stated_page carries the page number parsed from the source
-post (FC-6.2), nullable when unknown.
+A series IS a Tag with kind='series'; series_page gives it ordered pages.
+An image belongs to at most one series (UNIQUE image_id). Cover = the
+lowest page_number. page_number is an ordering key only (not unique) —
+reorder rewrites 1..N wholesale.
 """
 
 from datetime import datetime
@@ -24,18 +21,12 @@ class SeriesPage(Base):
     series_tag_id: Mapped[int] = mapped_column(
         ForeignKey("tag.id", ondelete="CASCADE"), nullable=False, index=True
     )
-    chapter_id: Mapped[int] = mapped_column(
-        ForeignKey("series_chapter.id", ondelete="CASCADE"),
-        nullable=False,
-        index=True,
-    )
     image_id: Mapped[int] = mapped_column(
         ForeignKey("image_record.id", ondelete="CASCADE"),
         nullable=False,
         unique=True,
     )
     page_number: Mapped[int] = mapped_column(Integer, nullable=False)
-    stated_page: Mapped[int | None] = mapped_column(Integer, nullable=True)
     created_at: Mapped[datetime] = mapped_column(
         DateTime(timezone=True), nullable=False, server_default=func.now()
     )

backend/app/models/series_suggestion.py

@@ -1,55 +0,0 @@
-"""SeriesSuggestion — a confirm-only "this post may continue this series" hint.
-
-The matcher (FC-6.3) scores a (post, candidate series) pair from several weighted
-signals and, above the configured threshold, records a pending suggestion. The
-operator confirms (→ the post is added as a chapter) or dismisses it; FC never
-files a post into a series on its own. status is a plain string (no Postgres
-ENUM — see the check-existing-enums lesson): pending | added | dismissed.
-"""
-
-from datetime import datetime
-
-from sqlalchemy import (
-    JSON,
-    DateTime,
-    Float,
-    ForeignKey,
-    Integer,
-    String,
-    UniqueConstraint,
-    func,
-)
-from sqlalchemy.orm import Mapped, mapped_column
-
-from .base import Base
-
-
-class SeriesSuggestion(Base):
-    __tablename__ = "series_suggestion"
-    __table_args__ = (
-        UniqueConstraint(
-            "post_id", "series_tag_id", name="uq_series_suggestion_post_series"
-        ),
-    )
-
-    id: Mapped[int] = mapped_column(Integer, primary_key=True)
-    post_id: Mapped[int] = mapped_column(
-        ForeignKey("post.id", ondelete="CASCADE"), nullable=False, index=True
-    )
-    series_tag_id: Mapped[int] = mapped_column(
-        ForeignKey("tag.id", ondelete="CASCADE"), nullable=False, index=True
-    )
-    score: Mapped[float] = mapped_column(Float, nullable=False)
-    signals: Mapped[dict | None] = mapped_column(JSON, nullable=True)
-    status: Mapped[str] = mapped_column(
-        String(16), nullable=False, server_default="pending", index=True
-    )
-    created_at: Mapped[datetime] = mapped_column(
-        DateTime(timezone=True), nullable=False, server_default=func.now()
-    )
-    updated_at: Mapped[datetime] = mapped_column(
-        DateTime(timezone=True),
-        nullable=False,
-        server_default=func.now(),
-        onupdate=func.now(),
-    )

backend/app/models/source.py

@@ -26,21 +26,7 @@ class Source(Base):
 
     last_checked_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
     last_error: Mapped[str | None] = mapped_column(Text, nullable=True)
-    # alembic 0032: last ErrorType category (auth_error, rate_limited,
-    # not_found, ...). Lets FailingSourcesCard surface the taxonomy as
-    # a colored chip so operators can bulk-triage by error class. Set
-    # by _update_source_health alongside last_error; cleared on 'ok'.
-    error_type: Mapped[str | None] = mapped_column(String(32), nullable=True, index=True)
     check_interval_override: Mapped[int | None] = mapped_column(Integer, nullable=True)
     consecutive_failures: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
 
-    # alembic 0031: sticky deep-scan budget. When > 0, the next N download
-    # runs use gallery-dl's full-walk config (skip: True + 1800s timeout);
-    # when 0, runs use tick mode (skip: "exit:20" + 870s, exits early once
-    # 20 contiguous archived items are seen). Auto-decrements per run, with
-    # an auto-reset to 0 on clean exit + zero downloads (queue drained).
-    backfill_runs_remaining: Mapped[int] = mapped_column(
-        Integer, nullable=False, default=0, server_default="0",
-    )
-
     artist = relationship("Artist", back_populates="sources")

backend/app/models/tag.py

@@ -35,10 +35,8 @@ class TagKind(StrEnum):
     series = "series"
     archive = "archive"
     post = "post"
-    # `meta` and `rating` retired by operator 2026-05-26 (alembic 0023).
-    # `artist` retired in FC-2d-vii-c — artists are first-class entities
-    # via Artist/Source rows now, not tags — but the enum value stays
-    # to keep historic tag rows queryable.
+    meta = "meta"
+    rating = "rating"
 
 
 image_tag = Table(

backend/app/models/task_run.py

@@ -1,48 +0,0 @@
-"""FC-3i: task_run — per-Celery-task lifecycle audit row.
-
-One row inserted by the task_prerun signal at task start, updated by
-task_postrun / task_failure / task_retry. The shape supports the
-SystemActivity dashboard's three panes: per-queue queue+worker summary,
-recent failures (24h, grouped by error_type), and full paginated
-activity history.
-
-Retention: ok rows pruned after 24h, error/timeout after 7d (see
-backend.app.tasks.maintenance.prune_task_runs).
-
-Recovery: rows stuck in 'running' for >5 min flipped to 'error' by
-backend.app.tasks.maintenance.recover_stalled_task_runs (Beat 5 min).
-"""
-
-from datetime import datetime
-
-from sqlalchemy import DateTime, Integer, String, Text
-from sqlalchemy.orm import Mapped, mapped_column
-
-from .base import Base
-
-
-class TaskRun(Base):
-    __tablename__ = "task_run"
-
-    id: Mapped[int] = mapped_column(Integer, primary_key=True)
-    celery_task_id: Mapped[str] = mapped_column(
-        String(64), nullable=False, index=True,
-    )
-    queue: Mapped[str] = mapped_column(String(32), nullable=False, index=True)
-    task_name: Mapped[str] = mapped_column(String(128), nullable=False, index=True)
-    target_id: Mapped[int | None] = mapped_column(Integer, nullable=True)
-    started_at: Mapped[datetime] = mapped_column(
-        DateTime(timezone=True), nullable=False, index=True,
-    )
-    finished_at: Mapped[datetime | None] = mapped_column(
-        DateTime(timezone=True), nullable=True, index=True,
-    )
-    duration_ms: Mapped[int | None] = mapped_column(Integer, nullable=True)
-    status: Mapped[str] = mapped_column(
-        String(16), nullable=False, default="running", index=True,
-    )
-    error_type: Mapped[str | None] = mapped_column(String(128), nullable=True)
-    error_message: Mapped[str | None] = mapped_column(Text, nullable=True)
-    retry_count: Mapped[int | None] = mapped_column(Integer, nullable=True)
-    worker_hostname: Mapped[str | None] = mapped_column(String(128), nullable=True)
-    args_summary: Mapped[str | None] = mapped_column(String(255), nullable=True)

backend/app/scripts/download_models.py

@@ -25,31 +25,12 @@ def _snapshot(repo_id: str, dest: Path, allow_patterns: list[str] | None) -> Non
 
 
 def ensure_camie() -> None:
-    """Fetch Camie v2 weights + metadata.
-
-    v2 layout (HuggingFace Camais03/camie-tagger-v2): the ONNX file is
-    named camie-tagger-v2.onnx (not model.onnx) and tags ship inside
-    camie-tagger-v2-metadata.json (not selected_tags.csv). Both at root.
-    The repo also contains app/, game/, training/, images/ subdirs full
-    of setup/demo files we don't need — allow_patterns scopes the fetch
-    to just the inference essentials (~790 MB instead of ~2 GB).
-    """
     dest = MODEL_ROOT / "camie"
-    model_file = dest / "camie-tagger-v2.onnx"
-    meta_file = dest / "camie-tagger-v2-metadata.json"
-    if model_file.is_file() and meta_file.is_file():
+    if (dest / "model.onnx").is_file() and (dest / "selected_tags.csv").is_file():
         print(f"[download_models] Camie present at {dest}")
         return
     print(f"[download_models] Fetching {CAMIE_REPO} -> {dest}")
-    _snapshot(
-        CAMIE_REPO, dest,
-        [
-            "camie-tagger-v2.onnx",
-            "camie-tagger-v2-metadata.json",
-            "config.json",
-            "config.yaml",
-        ],
-    )
+    _snapshot(CAMIE_REPO, dest, ["model.onnx", "selected_tags.csv", "*.json"])
 
 
 def ensure_siglip() -> None:

backend/app/services/archive_extractor.py

@@ -16,45 +16,9 @@ log = logging.getLogger(__name__)
 
 ARCHIVE_EXTS = {".zip", ".cbz", ".rar", ".7z"}
 
-# Magic-byte signatures, so an archive with a mangled / extension-less filename
-# is still recognised. Patreon attachment download URLs sanitize to names like
-# `01_https___www.patreon.com_media-u_v3_131083093`, whose `Path.suffix` is junk
-# (`.com_media-u_v3_131083093`), never `.zip` — an extension-only gate filed
-# those as opaque PostAttachments and NEVER extracted them (operator-flagged
-# 2026-06-06). Detection is by extension first (cheap), then header sniff.
-_RAR_MAGIC = b"Rar!\x1a\x07"
-_7Z_MAGIC = b"7z\xbc\xaf\x27\x1c"
-
-
-def detect_archive_format(path: Path) -> str | None:
-    """Return "zip" | "rar" | "7z" for an archive, else None.
-
-    Trusts a known extension first, then falls back to magic-byte sniffing so a
-    mis-named or extension-less archive is still handled. (zip covers .cbz too.)
-    """
-    ext = Path(path).suffix.lower()
-    if ext in (".zip", ".cbz"):
-        return "zip"
-    if ext == ".rar":
-        return "rar"
-    if ext == ".7z":
-        return "7z"
-    try:
-        if zipfile.is_zipfile(path):
-            return "zip"
-        with open(path, "rb") as fh:
-            head = fh.read(8)
-    except OSError:
-        return None
-    if head.startswith(_RAR_MAGIC):
-        return "rar"
-    if head.startswith(_7Z_MAGIC):
-        return "7z"
-    return None
-
 
 def is_archive(path: Path) -> bool:
-    return detect_archive_format(path) is not None
+    return Path(path).suffix.lower() in ARCHIVE_EXTS
 
 
 @contextmanager
@@ -68,16 +32,16 @@ def extract_archive(path: Path):
     members: list[tuple[str, Path]] = []
     try:
         try:
-            fmt = detect_archive_format(path)
-            if fmt == "zip":
+            ext = Path(path).suffix.lower()
+            if ext in (".zip", ".cbz"):
                 with zipfile.ZipFile(path) as zf:
                     zf.extractall(base)
-            elif fmt == "rar":
+            elif ext == ".rar":
                 import rarfile
 
                 with rarfile.RarFile(path) as rf:
                     rf.extractall(base)
-            elif fmt == "7z":
+            elif ext == ".7z":
                 import py7zr
 
                 with py7zr.SevenZipFile(path, "r") as zf:

backend/app/services/artist_directory_service.py

@@ -13,10 +13,10 @@ from __future__ import annotations
 import base64
 from dataclasses import dataclass
 
-from sqlalchemy import and_, case, exists, func, or_, select
+from sqlalchemy import and_, exists, func, or_, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from ..models import Artist, ArtistVisit, ImageRecord, Source
+from ..models import Artist, ImageRecord, Source
 from .gallery_service import thumbnail_url
 
 _SEP = "|"
@@ -58,27 +58,9 @@ class ArtistDirectoryService:
             raise ValueError("limit must be between 1 and 200")
 
         count_col = func.count(ImageRecord.id).label("image_count")
-        # Unseen = images imported since the artist's last_viewed_at.
-        # NULL last_viewed_at (artist created before alembic 0034 seed
-        # or before find_or_create autoseed) defensively counts as
-        # "never visited" → all images unseen. Single grouped query, no
-        # N+1.
-        unseen_col = func.count(
-            case(
-                (
-                    or_(
-                        ArtistVisit.last_viewed_at.is_(None),
-                        ImageRecord.created_at > ArtistVisit.last_viewed_at,
-                    ),
-                    ImageRecord.id,
-                ),
-                else_=None,
-            )
-        ).label("unseen_count")
         stmt = (
-            select(Artist, count_col, unseen_col)
+            select(Artist, count_col)
             .outerjoin(ImageRecord, ImageRecord.artist_id == Artist.id)
-            .outerjoin(ArtistVisit, ArtistVisit.artist_id == Artist.id)
             .group_by(Artist.id)
         )
         if q:
@@ -112,7 +94,7 @@ class ArtistDirectoryService:
             next_cursor = _encode(last_artist.name, last_artist.id)
             rows = rows[:limit]
 
-        artist_ids = [a.id for a, _, _ in rows]
+        artist_ids = [a.id for a, _ in rows]
         previews = await self._previews(artist_ids)
 
         cards = [
@@ -122,10 +104,9 @@ class ArtistDirectoryService:
                 "slug": artist.slug,
                 "is_subscription": bool(artist.is_subscription),
                 "image_count": int(image_count),
-                "unseen_count": int(unseen_count),
                 "preview_thumbnails": previews.get(artist.id, []),
             }
-            for artist, image_count, unseen_count in rows
+            for artist, image_count in rows
         ]
         return DirectoryPage(cards=cards, next_cursor=next_cursor)
 
@@ -146,20 +127,17 @@ class ArtistDirectoryService:
                 ImageRecord.artist_id.label("artist_id"),
                 ImageRecord.sha256.label("sha256"),
                 ImageRecord.mime.label("mime"),
-                ImageRecord.thumbnail_path.label("thumbnail_path"),
                 rn,
             )
             .where(ImageRecord.artist_id.in_(artist_ids))
             .subquery()
         )
         stmt = (
-            select(
-                sub.c.artist_id, sub.c.sha256, sub.c.mime, sub.c.thumbnail_path,
-            )
+            select(sub.c.artist_id, sub.c.sha256, sub.c.mime)
             .where(sub.c.rn <= _PREVIEW_COUNT)
             .order_by(sub.c.artist_id, sub.c.rn)
         )
         out: dict[int, list[str]] = {}
-        for aid, sha, mime, tp in (await self.session.execute(stmt)).all():
-            out.setdefault(aid, []).append(thumbnail_url(tp, sha, mime))
+        for aid, sha, mime in (await self.session.execute(stmt)).all():
+            out.setdefault(aid, []).append(thumbnail_url(sha, mime))
         return out

backend/app/services/artist_service.py

@@ -9,13 +9,11 @@ Dates come from Post.post_date via ImageProvenance.post_id.
 from dataclasses import dataclass
 
 from sqlalchemy import and_, case, func, or_, select
-from sqlalchemy.dialects.postgresql import insert as pg_insert
 from sqlalchemy.exc import IntegrityError
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from ..models import (
     Artist,
-    ArtistVisit,
     ImageProvenance,
     ImageRecord,
     Post,
@@ -60,17 +58,13 @@ class ArtistService:
             )
         ).scalar_one()
 
-        # Posts under this artist that have at least one image attached.
-        # Use Post.artist_id (alembic 0030) for the artist filter; keep
-        # the ImageProvenance JOIN so date bounds reflect only image-
-        # bearing posts (matches the original semantic). NULL-source
-        # posts now surface too.
         date_row = (
             await self.session.execute(
                 select(func.min(Post.post_date), func.max(Post.post_date))
                 .select_from(Post)
                 .join(ImageProvenance, ImageProvenance.post_id == Post.id)
-                .where(Post.artist_id == aid)
+                .join(Source, Source.id == ImageProvenance.source_id)
+                .where(Source.artist_id == aid)
             )
         ).first()
         dmin, dmax = date_row if date_row else (None, None)
@@ -104,40 +98,25 @@ class ArtistService:
             )
         ).all()
 
-        # Same Post.artist_id direct filter — counts NULL-source posts too.
         month = func.date_trunc("month", Post.post_date).label("m")
         activity = (
             await self.session.execute(
                 select(month, func.count(func.distinct(ImageProvenance.image_record_id)))
                 .select_from(Post)
                 .join(ImageProvenance, ImageProvenance.post_id == Post.id)
-                .where(and_(Post.artist_id == aid, Post.post_date.isnot(None)))
+                .join(Source, Source.id == ImageProvenance.source_id)
+                .where(and_(Source.artist_id == aid, Post.post_date.isnot(None)))
                 .group_by(month)
                 .order_by(month)
             )
         ).all()
 
-        post_count = (
-            await self.session.execute(
-                select(func.count(func.distinct(Post.id)))
-                .where(Post.artist_id == aid)
-            )
-        ).scalar_one()
-
-        # Mark this artist as "visited now"; the returned count is what
-        # the operator should see in the banner ("N new since last
-        # visit"). Done LAST so the read aggregates above all see the
-        # pre-visit state (cosmetic — none depend on visit data).
-        unseen_at_visit = await self._mark_visited_returning_unseen(aid)
-
         return {
             "id": artist.id,
             "name": artist.name,
             "slug": artist.slug,
             "is_subscription": bool(artist.is_subscription),
             "image_count": int(image_count),
-            "post_count": int(post_count),
-            "unseen_count_at_visit": unseen_at_visit,
             "date_range": {
                 "min": dmin.isoformat() if dmin else None,
                 "max": dmax.isoformat() if dmax else None,
@@ -166,39 +145,6 @@ class ArtistService:
             ],
         }
 
-    async def _mark_visited_returning_unseen(self, artist_id: int) -> int:
-        """Read pre-visit `last_viewed_at`, count images added since,
-        then upsert `last_viewed_at = NOW()`. Returns the count BEFORE
-        the upsert so the banner has data to render.
-
-        Postgres UPSERT (`ON CONFLICT DO UPDATE`) keeps the write
-        atomic — no SELECT-then-INSERT race per
-        `reference_scalar_one_or_none_duplicates`.
-        """
-        prev = (
-            await self.session.execute(
-                select(ArtistVisit.last_viewed_at).where(
-                    ArtistVisit.artist_id == artist_id
-                )
-            )
-        ).scalar_one_or_none()
-
-        count_stmt = select(func.count(ImageRecord.id)).where(
-            ImageRecord.artist_id == artist_id
-        )
-        if prev is not None:
-            count_stmt = count_stmt.where(ImageRecord.created_at > prev)
-        unseen = (await self.session.execute(count_stmt)).scalar_one()
-
-        upsert = pg_insert(ArtistVisit.__table__).values(artist_id=artist_id)
-        upsert = upsert.on_conflict_do_update(
-            index_elements=["artist_id"],
-            set_={"last_viewed_at": func.now()},
-        )
-        await self.session.execute(upsert)
-        await self.session.commit()
-        return int(unseen)
-
     async def images(
         self, slug: str, cursor: str | None, limit: int = 60
     ) -> ArtistImagesPage | None:
@@ -242,7 +188,7 @@ class ArtistService:
                     "mime": r.mime,
                     "width": r.width,
                     "height": r.height,
-                    "thumbnail_url": thumbnail_url(r.thumbnail_path, r.sha256, r.mime),
+                    "thumbnail_url": thumbnail_url(r.sha256, r.mime),
                 }
                 for r in rows
             ],
@@ -250,39 +196,27 @@ class ArtistService:
         )
 
     async def find_or_create(self, name: str) -> tuple[Artist, bool]:
-        """Return (artist, created). Slug-keyed; idempotent under races.
-
-        Audit 2026-06-02: switched from session.rollback() to a
-        begin_nested savepoint + IntegrityError recovery so a lost
-        race doesn't unwind the calling request's surrounding work.
-        Mirrors importer._get_or_create.
-        """
+        """Return (artist, created). Slug-keyed; idempotent under races."""
         cleaned = (name or "").strip()
         if not cleaned:
             raise ValueError("artist name must not be empty")
         slug = slugify(cleaned)
 
-        select_existing = select(Artist).where(Artist.slug == slug)
-        existing = (await self.session.execute(select_existing)).scalar_one_or_none()
+        existing = (await self.session.execute(
+            select(Artist).where(Artist.slug == slug)
+        )).scalar_one_or_none()
         if existing is not None:
             return existing, False
 
-        sp = await self.session.begin_nested()
+        artist = Artist(name=cleaned, slug=slug)
+        self.session.add(artist)
         try:
-            artist = Artist(name=cleaned, slug=slug)
-            self.session.add(artist)
             await self.session.flush()
-            # New artist starts "caught up" — seed ArtistVisit so the
-            # directory's `+N new` badge stays at 0 until real new
-            # content arrives. Without this, the unseen-count query
-            # treats NULL last_viewed_at as "never visited" and would
-            # count every image imported in the same session.
-            self.session.add(ArtistVisit(artist_id=artist.id))
-            await self.session.flush()
-            await sp.commit()
         except IntegrityError:
-            await sp.rollback()
-            existing = (await self.session.execute(select_existing)).scalar_one()
+            await self.session.rollback()
+            existing = (await self.session.execute(
+                select(Artist).where(Artist.slug == slug)
+            )).scalar_one()
             return existing, False
         await self.session.commit()
         return artist, True

backend/app/services/audits/__init__.py

@@ -1,6 +0,0 @@
-"""Audit rule modules. Each module exposes evaluate(pil_image, **params) -> bool.
-
-The retroactive library-cleanup tab and (future) import-time filter logic
-both consume these. Importers should NOT inline rule logic going forward;
-add the rule here and call from both sides.
-"""

backend/app/services/audits/single_color.py

@@ -1,53 +0,0 @@
-"""Single-color audit: matches images where one color dominates beyond
-the threshold (within the given Euclidean RGB tolerance). The first
-canonical implementation — the import-side filter (SkipReason.single_color)
-was never wired; FC-Cleanup's audit module is the source of truth and a
-future spec can adopt it on the import path too.
-"""
-
-from PIL import Image
-
-_THUMB_SIZE = (64, 64)
-
-
-def evaluate(
-    pil_image,
-    *,
-    threshold: float,
-    tolerance: int,
-) -> bool:
-    """True iff the fraction of pixels within `tolerance` (Euclidean RGB
-    distance) of the dominant color exceeds `threshold`.
-
-    Downsamples to 64x64 for speed (~4ms regardless of source size).
-    Alpha channels are stripped; only RGB is considered. Animated images
-    use frame 0 (PIL's default after Image.open without seek).
-    """
-    im = pil_image
-    if im.mode == "RGBA":
-        im = im.convert("RGB")
-    elif im.mode not in ("RGB", "L"):
-        im = im.convert("RGB")
-    if im.size != _THUMB_SIZE:
-        im = im.resize(_THUMB_SIZE, Image.Resampling.BILINEAR)
-    pixels = list(im.getdata())
-    if not pixels:
-        return False
-    # Normalize L-mode pixels to RGB tuples for distance math.
-    if isinstance(pixels[0], int):
-        pixels = [(p, p, p) for p in pixels]
-    # Dominant color = mean RGB.
-    n = len(pixels)
-    sum_r = sum(p[0] for p in pixels)
-    sum_g = sum(p[1] for p in pixels)
-    sum_b = sum(p[2] for p in pixels)
-    dom = (sum_r / n, sum_g / n, sum_b / n)
-    tol_sq = tolerance * tolerance
-    within = 0
-    for r, g, b in pixels:
-        dr = r - dom[0]
-        dg = g - dom[1]
-        db = b - dom[2]
-        if dr * dr + dg * dg + db * db <= tol_sq:
-            within += 1
-    return (within / n) > threshold

backend/app/services/audits/transparency.py

@@ -1,27 +0,0 @@
-"""Transparency audit: matches images whose transparent-pixel fraction
-exceeds the threshold. Animated images short-circuit (skipped) to avoid
-the multi-frame PIL decode that hits Celery's hard time limit."""
-
-
-def evaluate(pil_image, *, threshold: float) -> bool:
-    """True iff the image's transparent-pixel fraction exceeds threshold.
-
-    False for non-alpha modes and animated images. Mirrors the import-side
-    Importer._transparency_pct logic so retroactive enforcement matches
-    prospective filtering.
-    """
-    if getattr(pil_image, "is_animated", False):
-        return False
-    if pil_image.mode not in ("RGBA", "LA") and not (
-        pil_image.mode == "P" and "transparency" in pil_image.info
-    ):
-        return False
-    im = pil_image
-    if im.mode != "RGBA":
-        im = im.convert("RGBA")
-    alpha = im.getchannel("A")
-    histogram = alpha.histogram()
-    transparent = histogram[0]
-    total = sum(histogram)
-    pct = transparent / total if total else 0.0
-    return pct > threshold

backend/app/services/backup_service.py

@@ -1,241 +0,0 @@
-"""FC-3h: first-class backup/restore service for FC.
-
-Two independent backup kinds:
-  - 'db'     — pg_dump only; fast; nightly via Beat (settings-gated)
-  - 'images' — tar+zstd of /images; slow; manual trigger only
-
-Files live under <images_root>/_backups/. Each backup writes:
-  fc_<kind>_<ts>.{sql|tar.zst}        — the artifact
-  fc_<kind>_<ts>.json                 — manifest (kind/tag/triggered_by)
-
-Service functions are sync (subprocess-bound). Celery tasks in
-backend.app.tasks.backup wrap each one with task_run-tracked
-lifecycle + soft/hard time limits + retention bookkeeping.
-"""
-from __future__ import annotations
-
-import json
-import os
-import shutil
-import subprocess
-import tempfile
-from datetime import UTC, datetime
-from pathlib import Path
-
-_BACKUPS_DIRNAME = "_backups"
-
-# Subprocess-level guardrails BEYOND the Celery soft_time_limit. The
-# Celery soft limit signals the Python process; subprocess.Popen in a
-# blocking syscall ignores that signal. These bound the worst case.
-_DB_SUBPROCESS_TIMEOUT_S = 12 * 60        # 12 min (Celery soft is 10 min)
-_IMAGES_SUBPROCESS_TIMEOUT_S = 7 * 60 * 60  # 7 hr (Celery soft is 6 hr)
-# Grace after SIGKILL to reap the child. If it can't be reaped in this window
-# (an uninterruptible NFS D-state — the failure mode that wedged the
-# concurrency-1 maintenance lane for hours, operator-flagged 2026-06-07), we
-# STOP waiting and fail fast, freeing the worker slot. The orphan is reaped by
-# the OS once its blocking syscall clears.
-_KILL_REAP_GRACE_S = 10
-
-
-def _run_bounded(cmd: list[str], timeout: int) -> None:
-    """subprocess.run(check=True, timeout) whose reaper can't itself hang.
-
-    subprocess.run's timeout path SIGKILLs the child then blocks in wait() to
-    reap it — but a process stuck in uninterruptible I/O (NFS) can't be reaped,
-    so wait() blocks for hours. Here we bound the post-kill reap and re-raise
-    TimeoutExpired regardless, so the caller fails fast instead of wedging."""
-    proc = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
-    try:
-        out, err = proc.communicate(timeout=timeout)
-    except subprocess.TimeoutExpired:
-        proc.kill()
-        try:
-            proc.communicate(timeout=_KILL_REAP_GRACE_S)
-        except subprocess.TimeoutExpired:
-            pass  # unkillable (D-state) — abandon the reap, fail fast
-        raise
-    if proc.returncode != 0:
-        raise subprocess.CalledProcessError(
-            proc.returncode, cmd, output=out, stderr=err
-        )
-
-
-def _libpq_url(sa_url: str) -> str:
-    """Strip SQLAlchemy +psycopg/+asyncpg driver suffix for pg_dump/psql."""
-    for driver in (
-        "postgresql+psycopg",
-        "postgresql+asyncpg",
-        "postgresql+psycopg2",
-    ):
-        if sa_url.startswith(driver + "://"):
-            return "postgresql://" + sa_url[len(driver) + 3:]
-    return sa_url
-
-
-def _backups_dir(images_root: Path) -> Path:
-    p = images_root / _BACKUPS_DIRNAME
-    p.mkdir(parents=True, exist_ok=True)
-    return p
-
-
-def _now_ts() -> str:
-    return datetime.now(UTC).strftime("%Y%m%dT%H%M%SZ")
-
-
-def _file_size_or_none(path: Path) -> int | None:
-    try:
-        return path.stat().st_size
-    except OSError:
-        return None
-
-
-def _write_manifest(
-    out_dir: Path, *, kind: str, ts: str,
-    tag: str | None, triggered_by: str,
-    artifact_path: Path,
-) -> Path:
-    manifest = {
-        "kind": kind,
-        "backup_id": f"fc_{kind}_{ts}",
-        "tag": tag,
-        "triggered_by": triggered_by,
-        "created_at": datetime.now(UTC).isoformat(),
-        "artifact_path": str(artifact_path),
-    }
-    mf = out_dir / f"fc_{kind}_{ts}.json"
-    mf.write_text(json.dumps(manifest, indent=2))
-    return mf
-
-
-def backup_db(
-    *, db_url: str, images_root: Path,
-    tag: str | None = None, triggered_by: str = "manual",
-) -> dict:
-    """Run pg_dump; write .sql + manifest; return dict for the caller
-    to persist into BackupRun. Raises on subprocess failure."""
-    ts = _now_ts()
-    out_dir = _backups_dir(images_root)
-    sql_path = out_dir / f"fc_db_{ts}.sql"
-    # Dump to LOCAL disk first, then move the finished file to the (NFS) backups
-    # dir. pg_dump's long phase is then a DB-socket wait + local writes — both
-    # killable — instead of an NFS write that can hang uninterruptibly. Only the
-    # final move touches NFS, and it's a bounded single-file step.
-    fd, tmp_name = tempfile.mkstemp(prefix="fc_db_", suffix=".sql")
-    os.close(fd)
-    tmp_path = Path(tmp_name)
-    try:
-        _run_bounded(
-            [
-                "pg_dump", "--no-owner", "--no-acl",
-                "-f", str(tmp_path), _libpq_url(db_url),
-            ],
-            _DB_SUBPROCESS_TIMEOUT_S,
-        )
-        shutil.move(str(tmp_path), str(sql_path))
-    finally:
-        if tmp_path.exists():
-            tmp_path.unlink(missing_ok=True)
-    manifest_path = _write_manifest(
-        out_dir, kind="db", ts=ts, tag=tag, triggered_by=triggered_by,
-        artifact_path=sql_path,
-    )
-    return {
-        "kind": "db",
-        "ts": ts,
-        "sql_path": str(sql_path),
-        "tar_path": None,
-        "manifest_path": str(manifest_path),
-        "size_bytes": _file_size_or_none(sql_path),
-    }
-
-
-def backup_images(
-    *, images_root: Path,
-    tag: str | None = None, triggered_by: str = "manual",
-) -> dict:
-    """Run tar --zstd over images_root; write .tar.zst + manifest."""
-    ts = _now_ts()
-    out_dir = _backups_dir(images_root)
-    tar_path = out_dir / f"fc_images_{ts}.tar.zst"
-    # No local-temp here (the archive is hundreds of GB — it can't stage in
-    # /tmp), but bounded-kill still applies so a tar wedged on NFS fails fast
-    # rather than holding the lane for hours.
-    _run_bounded(
-        [
-            "tar", "--zstd", "-cf", str(tar_path),
-            "-C", str(images_root.parent), images_root.name,
-            f"--exclude={images_root.name}/_backups",
-            f"--exclude={images_root.name}/_quarantine",
-        ],
-        _IMAGES_SUBPROCESS_TIMEOUT_S,
-    )
-    manifest_path = _write_manifest(
-        out_dir, kind="images", ts=ts, tag=tag, triggered_by=triggered_by,
-        artifact_path=tar_path,
-    )
-    return {
-        "kind": "images",
-        "ts": ts,
-        "sql_path": None,
-        "tar_path": str(tar_path),
-        "manifest_path": str(manifest_path),
-        "size_bytes": _file_size_or_none(tar_path),
-    }
-
-
-def restore_db(*, db_url: str, sql_path: Path) -> None:
-    """Wipe public schema, then load from .sql. Raises on subprocess
-    failure; partial-restore state is the caller's concern."""
-    libpq = _libpq_url(db_url)
-    subprocess.run(
-        [
-            "psql", libpq, "-c",
-            "DROP SCHEMA IF EXISTS public CASCADE; CREATE SCHEMA public;",
-        ],
-        capture_output=True, check=True, timeout=120,
-    )
-    subprocess.run(
-        ["psql", libpq, "-f", str(sql_path)],
-        capture_output=True, check=True,
-        timeout=_DB_SUBPROCESS_TIMEOUT_S,
-    )
-
-
-def restore_images(*, images_root: Path, tar_path: Path) -> None:
-    """Untar over images_root.parent. Additive — files NOT in the
-    tarball are NOT removed. Caller wipes first if a clean restore
-    is needed."""
-    subprocess.run(
-        [
-            "tar", "--zstd", "-xf", str(tar_path),
-            "-C", str(images_root.parent),
-        ],
-        capture_output=True, check=True,
-        timeout=_IMAGES_SUBPROCESS_TIMEOUT_S,
-    )
-
-
-def unlink_artifact_files(
-    *,
-    sql_path: str | None,
-    tar_path: str | None,
-    manifest_path: str | None,
-) -> dict:
-    """Best-effort unlink of all on-disk files for a BackupRun row.
-    Returns dict keyed by label with True/False per file. Missing
-    files count as success (missing_ok semantics)."""
-    deleted: dict = {}
-    for label, p in (
-        ("sql", sql_path),
-        ("tar", tar_path),
-        ("manifest", manifest_path),
-    ):
-        if not p:
-            continue
-        path = Path(p)
-        try:
-            path.unlink(missing_ok=True)
-            deleted[label] = True
-        except OSError:
-            deleted[label] = False
-    return deleted

backend/app/services/cleanup_service.py

@@ -1,838 +0,0 @@
-"""FC-3k: first-class admin destructive operations.
-
-Projections are pure SELECTs used by both dry-run preview endpoints
-and Tier-B count prompts. Mutations (Task 2) are called from sync
-HTTP handlers (small ops) and from Celery tasks in
-backend.app.tasks.admin (long ops).
-
-This module is the PERMANENT home of artist-cascade + image-unlink
-logic. (The legacy migrators/cleanup.py copy was removed with the rest of
-the one-and-done GS/IR migration tooling.)
-"""
-from __future__ import annotations
-
-import logging
-import time
-from datetime import UTC, datetime, timedelta
-from pathlib import Path
-from typing import Any
-
-from sqlalchemy import func, or_, select, update
-from sqlalchemy.orm import Session
-
-from ..models import Artist, ImageRecord, LibraryAuditRun, Tag
-from ..models.series_page import SeriesPage
-from ..models.tag import image_tag
-
-log = logging.getLogger(__name__)
-
-
-def project_artist_cascade(session: Session, *, slug: str) -> dict:
-    """Read-only projection of what delete_artist_cascade would touch.
-
-    Returns:
-        {
-          "artist": {"id": int, "name": str, "slug": str},
-          "projected": {
-            "images": int,
-            "sources": int,
-            "thumbs": int,        # images with a thumbnail_path set
-            "import_tasks": int,  # ImportTask rows referencing the artist's images
-            "bytes_on_disk": int, # SUM(image_record.size_bytes) — column is NOT NULL
-          },
-        }
-    Raises LookupError if slug not found. No mutations.
-    """
-    from ..models.import_task import ImportTask
-    from ..models.source import Source
-
-    artist = session.execute(
-        select(Artist).where(Artist.slug == slug)
-    ).scalar_one_or_none()
-    if artist is None:
-        raise LookupError(f"artist slug not found: {slug!r}")
-
-    images_count = session.execute(
-        select(func.count(ImageRecord.id))
-        .where(ImageRecord.artist_id == artist.id)
-    ).scalar_one()
-    sources_count = session.execute(
-        select(func.count(Source.id))
-        .where(Source.artist_id == artist.id)
-    ).scalar_one()
-    thumbs_count = session.execute(
-        select(func.count(ImageRecord.id))
-        .where(ImageRecord.artist_id == artist.id)
-        .where(ImageRecord.thumbnail_path.is_not(None))
-    ).scalar_one()
-    import_tasks_count = session.execute(
-        select(func.count(ImportTask.id))
-        .where(
-            ImportTask.result_image_id.in_(
-                select(ImageRecord.id).where(ImageRecord.artist_id == artist.id)
-            )
-        )
-    ).scalar_one()
-    bytes_on_disk = session.execute(
-        select(func.coalesce(func.sum(ImageRecord.size_bytes), 0))
-        .where(ImageRecord.artist_id == artist.id)
-    ).scalar_one()
-
-    return {
-        "artist": {"id": artist.id, "name": artist.name, "slug": artist.slug},
-        "projected": {
-            "images": images_count,
-            "sources": sources_count,
-            "thumbs": thumbs_count,
-            "import_tasks": import_tasks_count,
-            "bytes_on_disk": int(bytes_on_disk),
-        },
-    }
-
-
-def project_bulk_image_delete(
-    session: Session, *, image_ids: list[int],
-) -> dict:
-    """Read-only projection of what delete_images would touch.
-
-    Returns:
-        {
-          "images_found": int,
-          "thumbs_to_unlink": int,
-          "bytes_on_disk": int,
-          "missing_ids": list[int],   # ids passed in that don't exist
-        }
-    No mutations.
-    """
-    if not image_ids:
-        return {
-            "images_found": 0,
-            "thumbs_to_unlink": 0,
-            "bytes_on_disk": 0,
-            "missing_ids": [],
-        }
-
-    rows = session.execute(
-        select(
-            ImageRecord.id,
-            ImageRecord.thumbnail_path,
-            ImageRecord.size_bytes,
-        ).where(ImageRecord.id.in_(image_ids))
-    ).all()
-    found_ids = {r.id for r in rows}
-    missing = sorted(set(image_ids) - found_ids)
-    return {
-        "images_found": len(rows),
-        "thumbs_to_unlink": sum(1 for r in rows if r.thumbnail_path),
-        "bytes_on_disk": sum(r.size_bytes for r in rows),
-        "missing_ids": missing,
-    }
-
-
-def count_tag_associations(session: Session, *, tag_id: int) -> int:
-    """COUNT(*) FROM image_tag WHERE tag_id=?. For Tier-B prompt."""
-    return session.execute(
-        select(func.count())
-        .select_from(image_tag)
-        .where(image_tag.c.tag_id == tag_id)
-    ).scalar_one()
-
-
-def find_unused_tags(
-    session: Session, *, limit: int | None = None,
-) -> list[Tag]:
-    """Tags with no image_tag rows AND no series_page rows.
-
-    Sorted by name. Used by both dry-run preview and the live prune.
-    A tag is "unused" iff it has zero rows in image_tag AND zero rows
-    in series_page (so we don't accidentally prune a series tag that
-    happens to have no images yet).
-    """
-    used_via_image_tag = select(image_tag.c.tag_id).distinct()
-    used_via_series = select(SeriesPage.series_tag_id).where(
-        SeriesPage.series_tag_id.is_not(None)
-    ).distinct()
-    stmt = (
-        select(Tag)
-        .where(Tag.id.not_in(used_via_image_tag))
-        .where(Tag.id.not_in(used_via_series))
-        .order_by(Tag.name)
-    )
-    if limit is not None:
-        stmt = stmt.limit(limit)
-    return list(session.execute(stmt).scalars().all())
-
-
-def unlink_image_files(
-    image: ImageRecord, images_root: Path,
-) -> dict:
-    """Best-effort unlink of all on-disk files for an ImageRecord.
-
-    Targets: image.path (original), image.thumbnail_path (cached
-    thumbnail), and the computed thumbs path at
-    /images/thumbs/<sha256[:3]>/<sha256>.(jpg|png|webp) (tries all
-    three extensions; missing extension is silently OK).
-
-    Returns {"original": bool, "thumbnail": bool}. Missing files
-    count as success (missing_ok semantics). OSErrors are swallowed
-    and reported as False so the calling DB delete still proceeds.
-    """
-    out = {"original": False, "thumbnail": False}
-    if image.path:
-        try:
-            Path(image.path).unlink(missing_ok=True)
-            out["original"] = True
-        except OSError:
-            out["original"] = False
-    # Custom thumbnail_path (when set) — try it first.
-    if image.thumbnail_path:
-        try:
-            Path(image.thumbnail_path).unlink(missing_ok=True)
-            out["thumbnail"] = True
-        except OSError:
-            out["thumbnail"] = False
-    # Convention thumbs dir — try both extensions thumbnailer writes
-    # (.jpg for opaque, .png for alpha). `.webp` used to be in this
-    # tuple but the thumbnailer never writes it (operator-flagged in
-    # the 2026-06-02 audit) — keep the tuple aligned with what
-    # actually lands on disk.
-    if image.sha256:
-        bucket = image.sha256[:3]
-        for ext in ("jpg", "png"):
-            try:
-                (images_root / "thumbs" / bucket / f"{image.sha256}.{ext}").unlink(
-                    missing_ok=True,
-                )
-            except OSError:
-                pass
-    return out
-
-
-def delete_artist_cascade(
-    session: Session, *, artist_id: int, images_root: Path,
-) -> dict:
-    """Batched delete of an artist's images + the artist row.
-
-    Mirrors the cleanup_artist_async pattern: 500-row batches,
-    commit between batches so partial progress survives a worker
-    kill. Idempotent on missing artist (returns zeroed counts).
-    Postgres cascades handle image_tag / image_provenance /
-    series_page / tag_suggestion_rejection from ImageRecord delete,
-    and source / post / download_event / etc. from Artist delete
-    (via Artist.sources cascade="all, delete-orphan").
-    """
-    artist = session.get(Artist, artist_id)
-    if artist is None:
-        return {
-            "artist": None,
-            "summary": {
-                "images_deleted": 0,
-                "files_deleted": 0,
-                "thumbs_deleted": 0,
-                "import_tasks_nulled": 0,
-                "files_failed": 0,
-            },
-        }
-    artist_info = {"id": artist.id, "name": artist.name, "slug": artist.slug}
-
-    images_deleted = 0
-    files_deleted = 0
-    thumbs_deleted = 0
-    files_failed = 0
-
-    while True:
-        rows = session.execute(
-            select(ImageRecord)
-            .where(ImageRecord.artist_id == artist.id)
-            .limit(500)
-        ).scalars().all()
-        if not rows:
-            break
-        for img in rows:
-            unlinked = unlink_image_files(img, images_root)
-            if unlinked["original"]:
-                files_deleted += 1
-            else:
-                files_failed += 1
-            if unlinked["thumbnail"]:
-                thumbs_deleted += 1
-            session.delete(img)
-            images_deleted += 1
-        session.commit()
-
-    # ImportTask.result_image_id FK is SET NULL on image delete (Postgres
-    # handles this in the cascade above). We don't separately count those
-    # in FC-3k — the legacy cleanup_artist_async did it via
-    # source_path_prefix matching that's out of scope here.
-    import_tasks_nulled = 0
-
-    session.delete(artist)
-    session.commit()
-
-    return {
-        "artist": artist_info,
-        "summary": {
-            "images_deleted": images_deleted,
-            "files_deleted": files_deleted,
-            "thumbs_deleted": thumbs_deleted,
-            "import_tasks_nulled": import_tasks_nulled,
-            "files_failed": files_failed,
-        },
-    }
-
-
-def delete_images(
-    session: Session, *, image_ids: list[int], images_root: Path,
-) -> dict:
-    """Delete a list of images in 500-row batches with commit between.
-
-    Postgres CASCADE on image_tag / image_provenance / series_page /
-    tag_suggestion_rejection / post_attachment(FK SET NULL) handles
-    the DB side; this function handles file unlinks first then row
-    deletes. Idempotent on missing IDs (returned as missing_ids;
-    no error). On partial OSError, the row is still deleted and
-    files_failed is incremented.
-    """
-    if not image_ids:
-        return {
-            "images_deleted": 0,
-            "files_deleted": 0,
-            "thumbs_deleted": 0,
-            "files_failed": 0,
-            "missing_ids": [],
-        }
-
-    seen_ids: set[int] = set()
-    images_deleted = 0
-    files_deleted = 0
-    thumbs_deleted = 0
-    files_failed = 0
-
-    pending = list(image_ids)
-    while pending:
-        batch_ids = pending[:500]
-        pending = pending[500:]
-        rows = session.execute(
-            select(ImageRecord).where(ImageRecord.id.in_(batch_ids))
-        ).scalars().all()
-        for img in rows:
-            seen_ids.add(img.id)
-            unlinked = unlink_image_files(img, images_root)
-            if unlinked["original"]:
-                files_deleted += 1
-            else:
-                files_failed += 1
-            if unlinked["thumbnail"]:
-                thumbs_deleted += 1
-            session.delete(img)
-            images_deleted += 1
-        session.commit()
-
-    missing = sorted(set(image_ids) - seen_ids)
-    return {
-        "images_deleted": images_deleted,
-        "files_deleted": files_deleted,
-        "thumbs_deleted": thumbs_deleted,
-        "files_failed": files_failed,
-        "missing_ids": missing,
-    }
-
-
-def delete_tag(session: Session, *, tag_id: int) -> dict:
-    """Simple DELETE FROM tag WHERE id=?.
-
-    Postgres cascades the rest (image_tag, tag_alias, tag_allowlist,
-    tag_reference_embedding, tag_suggestion_rejection, series_page).
-    Returns counts BEFORE delete so the caller can surface them.
-    Raises LookupError if tag_id not found.
-    """
-    tag = session.get(Tag, tag_id)
-    if tag is None:
-        raise LookupError(f"tag id not found: {tag_id}")
-    associations_count = count_tag_associations(session, tag_id=tag_id)
-    info = {"id": tag.id, "name": tag.name, "kind": tag.kind.value}
-    session.delete(tag)
-    session.commit()
-    return {"deleted": info, "associations_removed": associations_count}
-
-
-def prune_unused_tags(session: Session, *, dry_run: bool = False) -> dict:
-    """Find tags with zero references and (unless dry_run) delete them.
-
-    Returns:
-      dry_run=True:  {"count": N, "sample_names": [first 50]}
-      dry_run=False: {"deleted": N, "sample_names": [first 50]}
-
-    Implementation note: the previous SELECT-ids → DELETE-WHERE-IN
-    pattern was vulnerable to the psycopg 65535-parameter ceiling on
-    libraries with tag explosions. The live delete now runs a single
-    DELETE with the same NOT-IN predicate find_unused_tags uses, so
-    the row count scales without binding every id as a parameter.
-    Audit 2026-06-02.
-    """
-    sample_rows = find_unused_tags(session, limit=50)
-    sample = [t.name for t in sample_rows]
-    used_via_image_tag = select(image_tag.c.tag_id).distinct()
-    used_via_series = select(SeriesPage.series_tag_id).where(
-        SeriesPage.series_tag_id.is_not(None)
-    ).distinct()
-    if dry_run:
-        count = session.execute(
-            select(func.count())
-            .select_from(Tag)
-            .where(Tag.id.not_in(used_via_image_tag))
-            .where(Tag.id.not_in(used_via_series))
-        ).scalar_one()
-        return {"count": count, "sample_names": sample}
-    result = session.execute(
-        Tag.__table__.delete()
-        .where(Tag.id.not_in(used_via_image_tag))
-        .where(Tag.id.not_in(used_via_series))
-    )
-    session.commit()
-    return {"deleted": result.rowcount or 0, "sample_names": sample}
-
-
-# Legacy tags FC no longer uses, in two shapes:
-#   (1) kinds the tag input never produces — archive/post/artist.
-#       provenance (post grouping) + archive membership are their own
-#       systems now, and artists are first-class Artist/Source rows.
-#       meta/rating were already hard-deleted by alembic 0023.
-#   (2) name prefixes from IR kinds FC never adopted — `source:*`.
-#       ImageRepo had a `source` kind; FC's enum doesn't, so ir_ingest
-#       fell those back to `general` (kind=general, name="source:patreon"
-#       etc.). They can't be caught by kind, so we match the name prefix.
-PURGEABLE_TAG_KINDS = ("archive", "post", "artist")
-LEGACY_NAME_PREFIXES = ("source:",)
-
-
-def _legacy_tag_predicate():
-    name_clauses = [Tag.name.like(f"{p}%") for p in LEGACY_NAME_PREFIXES]
-    return or_(Tag.kind.in_(PURGEABLE_TAG_KINDS), *name_clauses)
-
-
-def purge_legacy_tags(session: Session, *, dry_run: bool = False) -> dict:
-    """Count (dry_run) or delete legacy IR-migration tags: archive/post/
-    artist-kind tags PLUS general tags whose name matches a legacy
-    prefix (source:*).
-
-    CASCADE on image_tag / tag_alias / tag_allowlist /
-    tag_reference_embedding / tag_suggestion_rejection / series_page
-    clears the related rows on the parent DELETE.
-
-    Returns:
-      {"by_kind": {kind: count, ...},        # kind-matched rows
-       "by_prefix": {"source:*": count},     # name-prefix-matched rows
-       "count": total, "sample_names": [first 50],
-       and on live runs "deleted": total}
-    """
-    predicate = _legacy_tag_predicate()
-    rows = session.execute(
-        select(Tag.id, Tag.name, Tag.kind).where(predicate)
-    ).all()
-    by_kind: dict[str, int] = {}
-    by_prefix: dict[str, int] = {}
-    for _id, name, kind in rows:
-        # Classify by name-prefix first so a source:* row counts once,
-        # under the prefix bucket, regardless of its (general) kind.
-        matched_prefix = next(
-            (p for p in LEGACY_NAME_PREFIXES if name.startswith(p)), None,
-        )
-        if matched_prefix is not None:
-            label = f"{matched_prefix}*"
-            by_prefix[label] = by_prefix.get(label, 0) + 1
-        else:
-            key = kind.value if hasattr(kind, "value") else str(kind)
-            by_kind[key] = by_kind.get(key, 0) + 1
-    sample = [name for _id, name, _kind in rows[:50]]
-    total = len(rows)
-    result = {
-        "by_kind": by_kind, "by_prefix": by_prefix,
-        "count": total, "sample_names": sample,
-    }
-    if dry_run:
-        return result
-    if total:
-        session.execute(Tag.__table__.delete().where(predicate))
-        session.commit()
-    result["deleted"] = total
-    return result
-
-
-# The Camie-suggestable CONTENT vocabulary. "Reset content tagging" wipes
-# these so the operator can re-tag from scratch via auto-suggest. fandom +
-# series (and series_page ordering) are deliberately NOT here — they're kept.
-RESETTABLE_TAG_KINDS = ("general", "character")
-
-
-def reset_content_tagging(session: Session, *, dry_run: bool = False) -> dict:
-    """Count (dry_run) or DELETE every general + character tag so the operator
-    can re-tag from scratch via the Camie auto-suggest.
-
-    PRESERVED: fandom + series tags and their series_page ordering, plus every
-    image's image_record.tagger_predictions (untouched) so suggestions
-    repopulate immediately. CASCADE on image_tag / tag_alias / tag_allowlist /
-    tag_reference_embedding / tag_suggestion_rejection clears each deleted
-    tag's applications + metadata. Tag.fandom_id is SET NULL, so deleting
-    character tags never touches the fandom rows. Irreversible except via DB
-    backup restore.
-
-    Returns:
-      {"by_kind": {"general": N, "character": M},
-       "count": total tags,
-       "applications": image_tag rows that will be / were removed,
-       "sample_names": [first 50],
-       and on live runs "deleted": total}
-    """
-    predicate = Tag.kind.in_(RESETTABLE_TAG_KINDS)
-    rows = session.execute(
-        select(Tag.id, Tag.name, Tag.kind).where(predicate)
-    ).all()
-    by_kind: dict[str, int] = {}
-    for _id, _name, kind in rows:
-        key = kind.value if hasattr(kind, "value") else str(kind)
-        by_kind[key] = by_kind.get(key, 0) + 1
-    # Headline impact: applications (image_tag rows) that vanish via cascade.
-    applications = session.execute(
-        select(func.count())
-        .select_from(image_tag)
-        .where(image_tag.c.tag_id.in_(select(Tag.id).where(predicate)))
-    ).scalar_one()
-    sample = [name for _id, name, _kind in rows[:50]]
-    total = len(rows)
-    result = {
-        "by_kind": by_kind,
-        "count": total,
-        "applications": applications,
-        "sample_names": sample,
-    }
-    if dry_run:
-        return result
-    if total:
-        session.execute(Tag.__table__.delete().where(predicate))
-        session.commit()
-    result["deleted"] = total
-    return result
-
-
-# ---------------------------------------------------------------------------
-# FC-Cleanup additions (2026-05-26): retroactive audit of import-filter rules.
-# ---------------------------------------------------------------------------
-
-_MIN_DIM_SAMPLE_CAP = 50
-
-
-def project_min_dimension_violations(
-    session: Session, *, min_width: int, min_height: int,
-) -> dict:
-    """Return {count, sample_ids} for image_record rows with width or
-    height below the thresholds. Synchronous SQL — no PIL inspection
-    needed since width/height are stored columns."""
-    base = select(ImageRecord.id).where(
-        (ImageRecord.width < min_width) | (ImageRecord.height < min_height)
-    )
-    count = session.execute(
-        select(func.count()).select_from(base.subquery())
-    ).scalar_one()
-    sample_ids = session.execute(
-        base.order_by(ImageRecord.id).limit(_MIN_DIM_SAMPLE_CAP)
-    ).scalars().all()
-    return {"count": count, "sample_ids": list(sample_ids)}
-
-
-def delete_min_dimension_violations(
-    session: Session, *, min_width: int, min_height: int, images_root: Path,
-) -> int:
-    """Delete every image_record where width<min_w OR height<min_h.
-    Routes through delete_images so file-unlink + cascading FKs
-    (image_tag / image_provenance / etc.) are handled uniformly."""
-    ids = session.execute(
-        select(ImageRecord.id).where(
-            (ImageRecord.width < min_width) | (ImageRecord.height < min_height)
-        )
-    ).scalars().all()
-    if not ids:
-        return 0
-    result = delete_images(
-        session, image_ids=list(ids), images_root=images_root,
-    )
-    return result["images_deleted"]
-
-
-# ---------------------------------------------------------------------------
-# Audit lifecycle (transparency + single_color async scans).
-# ---------------------------------------------------------------------------
-
-
-class AuditAlreadyRunning(Exception):
-    """Another audit_run is currently in status='running' — wait or
-    cancel it before starting a new one. Surfaces as HTTP 409 in the
-    /api/cleanup/audit POST endpoint."""
-
-
-class AuditNotReady(Exception):
-    """apply_audit_run called on an audit whose status is not 'ready'."""
-
-
-class ConfirmTokenMismatch(Exception):
-    """Operator-supplied confirm token did not match server-recomputed token."""
-
-
-_VALID_RULES = ("transparency", "single_color")
-
-
-_AUDIT_GUARD_THRESHOLD_MINUTES = 135  # matches LIBRARY_AUDIT_STALL_THRESHOLD_MINUTES
-
-
-def start_audit_run(
-    session: Session, *, rule: str, params: dict[str, Any],
-) -> int:
-    """Create a LibraryAuditRun row in status='running' and dispatch the
-    scan_library_for_rule Celery task. Returns the new audit_id.
-
-    Concurrent-runs guard: raises AuditAlreadyRunning if any audit_run
-    has status='running' AND started recently. Audit 2026-06-02 made
-    the guard age-aware: a SIGKILL'd run leaves a row in 'running'
-    that the recovery sweep flips on its next pass (~5 min), but a
-    fresh start_audit_run between the SIGKILL and the sweep would
-    previously block forever. Past the threshold, treat the running
-    row as stale and let the sweep clean it up — the new run still
-    gets to start.
-    """
-    if rule not in _VALID_RULES:
-        raise ValueError(f"unknown rule {rule!r}; expected one of {_VALID_RULES}")
-    cutoff = datetime.now(UTC) - timedelta(minutes=_AUDIT_GUARD_THRESHOLD_MINUTES)
-    existing = session.execute(
-        select(LibraryAuditRun.id)
-        .where(LibraryAuditRun.status == "running")
-        .where(LibraryAuditRun.started_at >= cutoff)
-    ).scalar_one_or_none()
-    if existing is not None:
-        raise AuditAlreadyRunning(existing)
-    audit = LibraryAuditRun(
-        rule=rule,
-        params=params,
-        status="running",
-        scanned_count=0,
-        matched_count=0,
-        matched_ids=[],
-    )
-    session.add(audit)
-    session.flush()
-    audit_id = audit.id
-    # Dispatch after flush so audit_id is populated; commit happens in
-    # the API handler so the audit row + dispatch are visible together.
-    from ..tasks.library_audit import scan_library_for_rule
-    scan_library_for_rule.delay(audit_id)
-    return audit_id
-
-
-def apply_audit_run(
-    session: Session, *, audit_id: int, confirm_token: str, images_root: Path,
-) -> int:
-    """Delete all images in audit_run.matched_ids after confirming token.
-    Marks audit status='applied'. Routes through delete_images so files
-    + cascading FK rows are handled uniformly."""
-    audit = session.execute(
-        select(LibraryAuditRun).where(LibraryAuditRun.id == audit_id)
-    ).scalar_one_or_none()
-    if audit is None:
-        raise ValueError(f"audit_run {audit_id} not found")
-    if audit.status != "ready":
-        raise AuditNotReady(audit.status)
-    # Token format matches modal/DestructiveConfirmModal.vue convention:
-    # ${action}-${kind}-${runId}. The modal hardcodes action ∈ {'restore',
-    # 'delete'}; "apply audit" is semantically a delete of the matched
-    # images, so we use 'delete-audit-<id>' (not 'apply-audit-<id>').
-    expected = f"delete-audit-{audit_id}"
-    if confirm_token != expected:
-        raise ConfirmTokenMismatch(expected)
-    ids = list(audit.matched_ids or [])
-    deleted = 0
-    if ids:
-        result = delete_images(session, image_ids=ids, images_root=images_root)
-        deleted = result["images_deleted"]
-    session.execute(
-        update(LibraryAuditRun)
-        .where(LibraryAuditRun.id == audit_id)
-        .values(status="applied", finished_at=datetime.now(UTC))
-    )
-    return deleted
-
-
-def cancel_audit_run(session: Session, *, audit_id: int) -> None:
-    """Flip a running audit_run to 'cancelled'. The scan task checks
-    for status=='cancelled' between batches and exits cleanly."""
-    session.execute(
-        update(LibraryAuditRun)
-        .where(LibraryAuditRun.id == audit_id)
-        .where(LibraryAuditRun.status == "running")
-        .values(status="cancelled", finished_at=datetime.now(UTC))
-    )
-
-
-# -- archive-attachment re-extraction (#713 part 2) ------------------------
-
-_ARCHIVE_EXT_FOR_FORMAT = {"zip": ".zip", "rar": ".rar", "7z": ".7z"}
-
-
-def _reextract_archive_to_post(
-    importer, archive_path: Path, post, source_row, artist, images_root: Path,
-) -> list[int]:
-    """Extract one stored archive and link its members to `post`.
-
-    The stored attachment has no adjacent sidecar (it lives in the sha-addressed
-    attachment store). Stage a copy + a reconstructed sidecar UNDER the artist's
-    library dir (`images_root/<slug>/<platform>/<post>/`) — the importer
-    re-derives the artist from the path AND copies members relative to it, so the
-    members land in the real library and resolve to the right artist — then re-run
-    `attach_in_place`: the archive extracts and `find_or_create_post` re-attaches
-    the members to the SAME Post (source_id + external_post_id). Removes only the
-    staged archive + sidecar afterward; the imported member files stay. Returns
-    the new member image ids.
-    """
-    import json
-    import shutil
-
-    from .archive_extractor import detect_archive_format
-
-    fmt = detect_archive_format(archive_path)
-    ext = _ARCHIVE_EXT_FOR_FORMAT.get(fmt or "", ".zip")
-    platform = source_row.platform if source_row is not None else "imported"
-    sidecar = {
-        "category": source_row.platform if source_row is not None
-        else (post.raw_metadata or {}).get("category"),
-        "id": post.external_post_id,
-        "title": post.post_title or "",
-        "content": post.description or "",
-        "published_at": post.post_date.isoformat() if post.post_date else None,
-        "url": post.post_url,
-    }
-    work = images_root / artist.slug / platform / str(post.external_post_id)
-    work.mkdir(parents=True, exist_ok=True)
-    staged = work / f"archive{ext}"  # clean ext → is_archive + find_sidecar
-    sidecar_path = staged.with_suffix(".json")
-    try:
-        shutil.copy2(archive_path, staged)
-        sidecar_path.write_text(json.dumps(sidecar))
-        res = importer.attach_in_place(staged, artist=artist, source=source_row)
-        return list(res.member_image_ids or [])
-    finally:
-        # Drop only the staged archive + sidecar; the extracted member files
-        # were copied into the library alongside them and must stay.
-        staged.unlink(missing_ok=True)
-        sidecar_path.unlink(missing_ok=True)
-
-
-def reextract_archive_attachments(
-    session: Session,
-    *,
-    images_root: Path,
-    time_budget_seconds: float | None = None,
-    after_id: int = 0,
-) -> dict:
-    """Re-process existing PostAttachments that are ACTUALLY archives but were
-    filed opaquely before #713 part 1 (extension-only is_archive missed mangled /
-    extension-less Patreon attachment names). For each: extract the members,
-    import them, and link them to the attachment's post.
-
-    Idempotent — members dedupe by sha256, the archive dedupes by sha — so it's
-    safe to run repeatedly. Returns a summary dict for task_run.metadata.
-
-    Time-boxed + resumable: scans PostAttachments in ascending id order starting
-    after ``after_id``. When ``time_budget_seconds`` elapses, stops and reports
-    ``partial=True`` + ``resume_after_id`` (the last scanned id) so the task can
-    re-enqueue itself and continue — a large archive back-catalog can't run the
-    task into the Celery time limit or hog the maintenance lane. A bare re-run
-    (after_id=0) would never advance because an already-extracted archive is
-    still an archive on disk, so the cursor is what guarantees forward progress.
-    """
-    from ..models import ImportSettings, Post, PostAttachment, Source
-    from ..tasks.ml import tag_and_embed
-    from ..tasks.thumbnail import generate_thumbnail
-    from .archive_extractor import is_archive
-    from .importer import Importer
-    from .thumbnailer import Thumbnailer
-
-    summary = {
-        "scanned": 0, "archives": 0, "members_imported": 0,
-        "posts_touched": 0, "skipped_no_post": 0, "skipped_no_artist": 0,
-        "errors": 0, "partial": False, "resume_after_id": after_id,
-    }
-    settings = ImportSettings.load_sync(session)
-    importer = Importer(
-        session=session, images_root=images_root, import_root=images_root,
-        thumbnailer=Thumbnailer(images_root=images_root), settings=settings,
-    )
-
-    attachments = session.execute(
-        select(PostAttachment)
-        .where(PostAttachment.id > after_id)
-        .order_by(PostAttachment.id)
-    ).scalars().all()
-    enqueue_ids: list[int] = []
-    start = time.monotonic()
-    for att in attachments:
-        summary["scanned"] += 1
-        summary["resume_after_id"] = att.id
-        stored = Path(att.path)
-        try:
-            if not stored.is_file() or not is_archive(stored):
-                continue
-        except OSError:
-            continue
-        summary["archives"] += 1
-        if att.post_id is None:
-            summary["skipped_no_post"] += 1
-            continue
-        post = session.get(Post, att.post_id)
-        if post is None:
-            summary["skipped_no_post"] += 1
-            continue
-        artist = session.get(Artist, att.artist_id) if att.artist_id else None
-        if artist is None and post.artist_id:
-            artist = session.get(Artist, post.artist_id)
-        if artist is None or not artist.slug:
-            # The importer re-derives the artist from the staged path, so we need
-            # a real artist+slug to anchor under. (Shouldn't happen for
-            # subscription posts; skip rather than orphan the members.)
-            summary["skipped_no_artist"] += 1
-            continue
-        source_row = session.get(Source, post.source_id) if post.source_id else None
-        try:
-            ids = _reextract_archive_to_post(
-                importer, stored, post, source_row, artist, images_root,
-            )
-            session.commit()
-        except Exception as exc:  # one bad archive must not strand the rest
-            session.rollback()
-            summary["errors"] += 1
-            log.warning("re-extract failed for attachment %s: %s", att.id, exc)
-            continue
-        if ids:
-            summary["members_imported"] += len(ids)
-            summary["posts_touched"] += 1
-            enqueue_ids.extend(ids)
-
-        # Time-box the chunk. resume_after_id already points at this attachment,
-        # so the next run starts strictly after it. Checked after the commit so a
-        # half-extracted archive never straddles the boundary.
-        if (
-            time_budget_seconds is not None
-            and time.monotonic() - start >= time_budget_seconds
-        ):
-            summary["partial"] = True
-            break
-    else:
-        # Loop ran to exhaustion — nothing left to resume.
-        summary["partial"] = False
-
-    # Thumbnails + ML for the newly-imported members (best-effort; off the
-    # critical path — a Redis hiccup must not fail the whole re-extract).
-    for img_id in enqueue_ids:
-        try:
-            generate_thumbnail.delay(img_id)
-            tag_and_embed.delay(img_id)
-        except Exception as exc:
-            log.warning("re-extract enqueue failed for image %s: %s", img_id, exc)
-    return summary

backend/app/services/credential_crypto.py

@@ -1,82 +1,40 @@
 """Fernet-based encryption for credential blobs.
 
 The key is a single 32-byte value (urlsafe-base64-encoded; what
-Fernet.generate_key produces) stored at /images/secrets/credential_key.b64
-(mode 0600, parent dir 0700). The 2026-06-02 audit caught a silent
-key-regeneration path: on a partial disaster restore where the DB was
-restored but the secrets dir was lost, the old `_load_or_create_key`
-would mint a fresh key with no log, producing a working-looking system
-where every authenticated download failed AUTH_ERROR until the operator
-re-uploaded every credential by hand. Now the constructor refuses to
-auto-generate unless either:
+Fernet.generate_key produces) stored at a fixed path inside the
+images/data root. Created on first boot if absent; mode 0600. No KDF
+needed — the file contents are already maximum-entropy random bytes.
 
-  * the caller explicitly passes `bootstrap_ok=True` (tests, scripts), or
-  * the env var `CURATOR_BOOTSTRAP_NEW_KEY=1` is set (operator opt-in
-    during first-time setup).
-
-Otherwise it raises `MissingCredentialKey` so the app fails fast at
-startup and the operator can restore the key file from backup.
-
-Operator backup procedure must include /images/secrets/ alongside the
-rest of /images/ — losing the key file makes existing encrypted_blob
-rows undecryptable (recovery = delete the rows and re-upload).
+Operator backup procedure must include this file alongside the rest
+of /images/ — losing it makes existing encrypted_blob rows
+undecryptable (recovery = delete the rows and re-upload).
 """
 
-import logging
 import os
 from pathlib import Path
 
 from cryptography.fernet import Fernet, InvalidToken
 
-log = logging.getLogger(__name__)
-
-_BOOTSTRAP_ENV_VAR = "CURATOR_BOOTSTRAP_NEW_KEY"
-
 
 class InvalidCredentialBlob(Exception):
     """Raised when decryption fails (wrong key, tampered blob, …)."""
 
 
-class MissingCredentialKey(Exception):
-    """The Fernet key file is missing AND the caller hasn't opted in to
-    generating a new one. Audit 2026-06-02: prevents silent key
-    regeneration on partial DB-restored / secrets-lost deployments.
-    Set CURATOR_BOOTSTRAP_NEW_KEY=1 for first-time setup, or restore the
-    key file from backup."""
-
-
 class CredentialCrypto:
     """Fernet encrypt/decrypt with an on-disk key file.
 
-    Instantiate with a path; the file is loaded if present, or created
-    if absent AND the caller has opted in (bootstrap_ok=True or
-    CURATOR_BOOTSTRAP_NEW_KEY=1 env var). Production sites:
+    Instantiate with a path; the file is created on first access and
+    reused thereafter. Tests pass a tmp_path; production calls with
     `IMAGES_ROOT / "secrets" / "credential_key.b64"`.
     """
 
-    def __init__(self, key_path: Path, *, bootstrap_ok: bool | None = None):
+    def __init__(self, key_path: Path):
         self._key_path = Path(key_path)
-        if bootstrap_ok is None:
-            bootstrap_ok = os.environ.get(_BOOTSTRAP_ENV_VAR) == "1"
-        self._fernet = Fernet(self._load_or_create_key(bootstrap_ok))
+        self._fernet = Fernet(self._load_or_create_key())
 
-    def _load_or_create_key(self, bootstrap_ok: bool) -> bytes:
+    def _load_or_create_key(self) -> bytes:
         if self._key_path.exists():
             return self._key_path.read_bytes()
-        if not bootstrap_ok:
-            raise MissingCredentialKey(
-                f"Fernet key file not found at {self._key_path}. "
-                f"For first-time setup, set {_BOOTSTRAP_ENV_VAR}=1. "
-                f"If this is a restored instance, restore the key file "
-                f"from backup — generating a new one would make every "
-                f"existing Credential row undecryptable."
-            )
-        log.warning(
-            "Generating NEW Fernet credential key at %s. Any existing "
-            "encrypted_blob rows in the DB will be undecryptable — "
-            "re-upload each credential after this completes.",
-            self._key_path,
-        )
         parent = self._key_path.parent
         parent.mkdir(parents=True, exist_ok=True)
         os.chmod(parent, 0o700)

backend/app/services/credential_service.py

@@ -7,7 +7,7 @@ from __future__ import annotations
 import json
 import os
 from dataclasses import dataclass
-from datetime import UTC, datetime
+from datetime import datetime
 from pathlib import Path
 
 from sqlalchemy import select
@@ -148,7 +148,6 @@ class CredentialService:
             return None
         plaintext = self.crypto.decrypt(row.encrypted_blob)
         netscape = _to_netscape(plaintext)
-        netscape = _augment_cookies(platform, netscape)
         self.cookies_dir.mkdir(parents=True, exist_ok=True)
         out = self.cookies_dir / f"{platform}_cookies.txt"
         out.write_text(netscape)
@@ -163,32 +162,6 @@ class CredentialService:
             return None
         return self.crypto.decrypt(row.encrypted_blob)
 
-    async def mark_verified(self, platform: str) -> datetime | None:
-        """Stamp last_verified=now after a successful verify. Returns the
-        timestamp, or None if the credential is gone."""
-        row = (await self.session.execute(
-            select(Credential).where(Credential.platform == platform)
-        )).scalar_one_or_none()
-        if row is None:
-            return None
-        ts = datetime.now(UTC)
-        row.last_verified = ts
-        await self.session.commit()
-        return ts
-
-
-def _augment_cookies(platform: str, netscape: str) -> str:
-    """Delegate to the platform's `augment_cookies` hook if one is
-    registered (subscribestar, hentaifoundry, etc. — see
-    `services/platforms/<name>.py`). No-op when the platform doesn't
-    register a hook (Patreon, DeviantArt). Centralizing the
-    quirks-per-platform in the platforms package means adding a new
-    platform's cookie quirks doesn't require touching this file."""
-    info = PLATFORMS.get(platform)
-    if info is None or info.augment_cookies is None:
-        return netscape
-    return info.augment_cookies(netscape)
-
 
 def _to_netscape(plaintext: str) -> str:
     """Accept either Netscape-format text (the extension's output) or a

backend/app/services/download_backends.py

@@ -1,241 +0,0 @@
-"""Platform → download-backend dispatch (one place that knows which platforms
-are served by the native FC ingester vs. the gallery-dl subprocess).
-
-gallery-dl wasn't built to be driven by an automated scheduler — no native
-checkpoint/resume, no structured logs, per-file HEADs that dominate wall-clock.
-The native ingester (services/patreon_ingester.py, plan #697) replaces it for
-Patreon and is the path we grow as more platforms migrate. To keep that
-migration DRY, every caller that has to behave differently per backend —
-download routing, the credential-verify probe, cursor handling — asks THIS
-module instead of testing ``platform == "patreon"`` inline. When a platform gets
-a native ingester, it moves into ``NATIVE_INGESTER_PLATFORMS`` here and both the
-download path and verify switch over together.
-
-The backend surfaces share a UNIFORM signature so a caller invokes the same
-function regardless of platform:
-  - verify_credential(...)  → (ok: bool|None, message: str)
-  - (download stays in download_service for now; uses_native_ingester() is the
-    shared predicate it routes on, so the decision lives here too.)
-"""
-
-from __future__ import annotations
-
-import asyncio
-from pathlib import Path
-
-from .gallery_dl import DownloadResult, ErrorType
-from .patreon_ingester import PatreonIngester
-from .patreon_resolver import extract_vanity, resolve_campaign_id_for_source
-
-# Platforms whose download + verify go through the native ingester rather than
-# gallery-dl. gallery-dl still serves every other platform (subscribestar,
-# hentaifoundry, discord, pixiv, deviantart) unchanged.
-NATIVE_INGESTER_PLATFORMS = frozenset({"patreon"})
-
-# Mirrors patreon_resolver._CAMPAIGNS_URL — surfaced in resolution-failure
-# messages so the operator sees the exact lookup endpoint that was hit.
-_CAMPAIGNS_API = "https://www.patreon.com/api/campaigns"
-
-
-def uses_native_ingester(platform: str) -> bool:
-    """True when `platform` is served by the native ingester (not gallery-dl).
-    The single predicate the download path and verify both route on."""
-    return platform in NATIVE_INGESTER_PLATFORMS
-
-
-async def run_download(
-    *,
-    ctx: dict,
-    source_config,
-    skip_value: bool | str,
-    mode: str | None,
-    gdl,
-    sync_session_factory,
-) -> tuple[DownloadResult, str | None]:
-    """Uniform download across backends — the download counterpart to
-    `verify_source_credential`, so this module is the ONE place that knows how
-    each platform both downloads AND verifies (the seam that makes adding a
-    platform a bounded job).
-
-    Returns `(DownloadResult, resolved_campaign_id)`; `resolved_campaign_id` is
-    non-None only when a native vanity lookup ran this call (so phase 3 caches
-    it). Native platforms route through their ingester in `mode`
-    (tick/backfill/recovery); gallery-dl platforms run the subprocess. The caller
-    (download_service) prepares `source_config`/`skip_value`/`mode` from the
-    backfill state machine and owns phase 3.
-    """
-    platform = ctx["platform"]
-    if uses_native_ingester(platform):
-        return await _run_native_ingester(
-            ctx, source_config, mode, gdl, sync_session_factory
-        )
-    result = await gdl.download(
-        url=ctx["url"],
-        artist_slug=ctx["artist_slug"],
-        platform=platform,
-        source_config=source_config,
-        cookies_path=ctx["cookies_path"],
-        auth_token=ctx["auth_token"],
-        skip_value=skip_value,
-    )
-    return result, None
-
-
-async def _run_native_ingester(
-    ctx: dict, source_config, mode: str | None, gdl, sync_session_factory,
-) -> tuple[DownloadResult, str | None]:
-    """Patreon (today the only native platform): resolve the campaign id, then run
-    the native ingester in a worker thread (it is sync requests/subprocess).
-
-    `resolved_campaign_id` is non-None only when we had to look it up from the
-    vanity URL this run, so phase 3 caches it the way the old gallery-dl retry
-    did. A campaign id we cannot resolve is a loud NOT_FOUND — never a silent
-    empty success.
-    """
-    overrides = ctx["config_overrides"] or {}
-    campaign_id, resolved_campaign_id = await resolve_campaign_id_for_source(
-        ctx["url"], ctx["cookies_path"], overrides
-    )
-    if not campaign_id:
-        url = ctx["url"]
-        vanity = extract_vanity(url)
-        return (
-            DownloadResult(
-                success=False,
-                url=url,
-                artist_slug=ctx["artist_slug"],
-                platform="patreon",
-                error_type=ErrorType.NOT_FOUND,
-                error_message=(
-                    f"Could not resolve Patreon campaign id. source_url={url!r}; "
-                    f"vanity={vanity!r}; "
-                    f"lookup=GET {_CAMPAIGNS_API}?filter[vanity]={vanity or ''} "
-                    "(vanity lookup failed — cookies expired or creator moved?)"
-                ),
-            ),
-            None,
-        )
-
-    # Honor the operator's existing rate-limit knobs on the native path (plan
-    # #703): the global download_rate_limit_seconds (gallery-dl's `rate_limit`,
-    # here on the gdl service) paces media downloads; page fetches use the
-    # per-source sleep_request override, else `max(0.5, rate_limit/4)` — the same
-    # API-pacing default gallery-dl applied as its `sleep-request`.
-    rate_limit = gdl._rate_limit
-    request_sleep = (
-        source_config.sleep_request
-        if source_config.sleep_request is not None
-        else max(0.5, rate_limit / 4)
-    )
-    ingester = PatreonIngester(
-        images_root=gdl.images_root,
-        cookies_path=ctx["cookies_path"],
-        session_factory=sync_session_factory,
-        validate=gdl._validate_files,
-        rate_limit=rate_limit,
-        request_sleep=request_sleep,
-    )
-    loop = asyncio.get_running_loop()
-    dl_result = await loop.run_in_executor(
-        None,
-        lambda: ingester.run(
-            source_id=ctx["source_id"],
-            campaign_id=campaign_id,
-            artist_slug=ctx["artist_slug"],
-            url=ctx["url"],
-            mode=mode,
-            resume_cursor=source_config.resume_cursor,
-            time_budget_seconds=source_config.timeout,
-            posts_base=int(overrides.get("_backfill_posts", 0)),
-            # plan #709: live progress writes to this running event mid-walk.
-            event_id=ctx.get("event_id"),
-        ),
-    )
-    return dl_result, resolved_campaign_id
-
-
-async def preview_source(
-    *,
-    platform: str,
-    url: str,
-    source_id: int,
-    config_overrides: dict | None,
-    cookies_path: str | None,
-    images_root: Path,
-    sync_session_factory,
-    page_limit: int = 3,
-) -> dict:
-    """Dry-run preview for a native platform (plan #708 B4): resolve the campaign
-    id, then walk a few pages counting media not already seen/dead — no download.
-
-    Returns the preview dict (total_new / posts_scanned / pages_scanned /
-    has_more / sample), or `{"error": msg}` on a resolve / auth / drift failure.
-    Native-only — the caller gates on `uses_native_ingester`.
-    """
-    import asyncio
-
-    from .patreon_client import PatreonAPIError
-
-    campaign_id, _ = await resolve_campaign_id_for_source(
-        url, cookies_path, config_overrides or {}
-    )
-    if not campaign_id:
-        vanity = extract_vanity(url)
-        return {
-            "error": (
-                f"Couldn't resolve the campaign id. source_url={url!r}; "
-                f"vanity={vanity!r}; lookup=GET {_CAMPAIGNS_API}?filter[vanity]={vanity or ''} "
-                "(cookies expired, or the creator moved/renamed?)."
-            )
-        }
-    ingester = PatreonIngester(
-        images_root=images_root,
-        cookies_path=cookies_path,
-        session_factory=sync_session_factory,
-    )
-    loop = asyncio.get_running_loop()
-    try:
-        result = await loop.run_in_executor(
-            None,
-            lambda: ingester.preview(source_id, campaign_id, page_limit=page_limit),
-        )
-    except PatreonAPIError as exc:
-        return {"error": f"Couldn't preview: {exc}"}
-    return result
-
-
-async def verify_source_credential(
-    *,
-    platform: str,
-    url: str,
-    artist_slug: str,
-    config_overrides: dict | None,
-    cookies_path: str | None,
-    auth_token: str | None,
-    images_root: Path,
-) -> tuple[bool | None, str]:
-    """Uniform credential probe across backends. Returns `(ok, message)`:
-    True = authenticated, False = rejected, None = inconclusive (drift /
-    network / nothing to test). Callers don't branch on platform — they call
-    this and render the result.
-    """
-    if uses_native_ingester(platform):
-        # Native ingester platforms verify via their own lightweight auth probe
-        # (resolve campaign id + one authenticated API page). Patreon today.
-        from .patreon_ingester import verify_patreon_credential
-
-        return await verify_patreon_credential(url, cookies_path, config_overrides)
-
-    # gallery-dl platforms: --simulate one item; the extractor errors before it
-    # can list if auth is bad.
-    from .gallery_dl import GalleryDLService, SourceConfig
-
-    gdl = GalleryDLService(images_root=images_root)
-    return await gdl.verify(
-        url=url,
-        artist_slug=artist_slug,
-        platform=platform,
-        source_config=SourceConfig.from_dict(config_overrides or {}),
-        cookies_path=cookies_path,
-        auth_token=auth_token,
-    )

backend/app/services/download_service.py

@@ -13,6 +13,7 @@ from __future__ import annotations
 
 import asyncio
 import logging
+import re
 from datetime import UTC, datetime
 from pathlib import Path
 from typing import Any
@@ -24,25 +25,35 @@ from sqlalchemy.orm import joinedload
 
 from ..models import Artist, DownloadEvent, Source
 from .credential_service import CredentialService
-from .download_backends import run_download, uses_native_ingester
-from .gallery_dl import (
-    BACKFILL_CHUNK_SECONDS,
-    BACKFILL_SKIP_VALUE,
-    TICK_SKIP_VALUE,
-    DownloadResult,
-    ErrorType,
-    GalleryDLService,
-    SourceConfig,
-    extract_errors_warnings,
-    truncate_log,
-)
+from .gallery_dl import GalleryDLService, SourceConfig
 from .importer import Importer
-from .platforms import auth_type_for
-from .scheduler_service import set_platform_cooldown
+from .patreon_resolver import resolve_campaign_id
 
 log = logging.getLogger(__name__)
 
 
+_PATREON_VANITY_RE = re.compile(
+    r"^https?://(?:www\.)?patreon\.com/(?:c/)?(?!id:)([^/?#]+)",
+    re.IGNORECASE,
+)
+_CAMPAIGN_ID_FAILURE_PATTERN = "failed to extract campaign id"
+
+
+def _extract_patreon_vanity(url: str) -> str | None:
+    m = _PATREON_VANITY_RE.match(url)
+    return m.group(1) if m else None
+
+
+def _looks_like_campaign_id_failure(stdout: str, stderr: str) -> bool:
+    return _CAMPAIGN_ID_FAILURE_PATTERN in f"{stdout}\n{stderr}".lower()
+
+
+def _effective_url(platform: str, source_url: str, overrides: dict) -> str:
+    if platform == "patreon" and overrides.get("patreon_campaign_id"):
+        return f"https://www.patreon.com/id:{overrides['patreon_campaign_id']}"
+    return source_url
+
+
 class DownloadService:
     """Async orchestrator. The Celery task runs `asyncio.run(svc.download_source(N))`.
 
@@ -57,18 +68,12 @@ class DownloadService:
         gdl: GalleryDLService,
         importer: Importer,
         cred_service: CredentialService,
-        sync_session_factory=None,
     ):
         self.async_session = async_session
         self.sync_session = sync_session
         self.gdl = gdl
         self.importer = importer
         self.cred_service = cred_service
-        # Sync sessionmaker the native Patreon ingester opens SHORT-LIVED
-        # sessions from for its seen-ledger reads/writes (never one held across
-        # the multi-minute walk — see PatreonIngester). Only the patreon branch
-        # of phase 2 uses it; gallery-dl sources leave it None.
-        self.sync_session_factory = sync_session_factory
 
     async def download_source(self, source_id: int) -> int:
         """Returns DownloadEvent.id. Idempotent: in-flight events are returned as-is."""
@@ -77,101 +82,50 @@ class DownloadService:
             return setup["event_id"]
         ctx = setup
 
-        # Release the phase-1 DB connections before the (up to ~19.5-min in
-        # backfill) gallery-dl subprocess. Held checked-out across that idle
-        # window, the asyncpg/psycopg connections get reaped by the server,
-        # and phase 3's first query then hits a dead socket
-        # (asyncpg ConnectionDoesNotExistError) → download_source autoretry →
-        # _phase1_setup's in-flight guard no-ops the retry → the event
-        # strands empty for the recovery sweep (Anduo #40014, 2026-06-04).
-        # pool_pre_ping can't help a *held* connection — it only validates on
-        # pool checkout. Closing returns them to the pool so phase 3 re-
-        # acquires a live one (the async task engine uses NullPool, the sync
-        # engine pre_ping + pool_recycle=300). This is what makes the
-        # "Phase 2 — no DB connection" contract in the class docstring true.
-        await self.async_session.close()
-        self.sync_session.close()
-
         source_config = SourceConfig.from_dict(ctx["config_overrides"] or {})
-        # Backfill mode (plan #693): the source's `_backfill_state == "running"`
-        # selects a time-boxed deep-walk chunk — skip: True (walk full history)
-        # + the BACKFILL_CHUNK_SECONDS budget, resuming from the cursor
-        # checkpoint (plan #689). State is the single source of truth; it stays
-        # "running" across ticks until the walk reaches the bottom (phase 3
-        # flips it to "complete"). Otherwise tick mode: exit gallery-dl after
-        # 20 contiguous archived items (skip: "exit:20" + the default 870s).
-        # Operator drives this via POST /api/sources/{id}/backfill {action}.
-        overrides = ctx["config_overrides"] or {}
-        in_backfill = overrides.get("_backfill_state") == "running"
-        # Recovery (plan #697) reuses the entire #693 backfill state machine —
-        # cursor checkpoint, time-boxed chunks, complete/stall lifecycle — and
-        # differs only in bypassing the tier-1 seen-ledger so dropped-and-deleted
-        # near-dups get re-fetched and re-evaluated under the CURRENT pHash
-        # threshold (tier-2 disk still spares files we kept). The
-        # `_backfill_bypass_seen` flag rides alongside the running backfill state;
-        # download mode is "recovery" when both are set.
-        bypass_seen = bool(overrides.get("_backfill_bypass_seen"))
-        if in_backfill:
-            skip_value: bool | str = BACKFILL_SKIP_VALUE
-            source_config.timeout = BACKFILL_CHUNK_SECONDS
-            pending_cursor = overrides.get("_backfill_cursor")
-            if uses_native_ingester(ctx["platform"]) and pending_cursor:
-                source_config.resume_cursor = pending_cursor
-        else:
-            skip_value = TICK_SKIP_VALUE
-
-        # Phase 2 dispatch is uniform across backends (download_backends.
-        # run_download — the download counterpart to verify_source_credential):
-        # native platforms run their ingester in `mode` (zero per-file HEADs,
-        # native cursor/resume, loud drift detection); gallery-dl platforms run
-        # the subprocess. Either returns a DownloadResult-shaped object so phase 3
-        # is untouched. `mode` is None for gallery-dl (run_download ignores it).
-        mode: str | None = None
-        if uses_native_ingester(ctx["platform"]):
-            if in_backfill and bypass_seen:
-                mode = "recovery"
-            elif in_backfill:
-                mode = "backfill"
-            else:
-                mode = "tick"
-        dl_result, resolved_campaign_id = await self._run_download(
-            ctx=ctx, source_config=source_config, skip_value=skip_value, mode=mode,
+        effective_url = _effective_url(
+            ctx["platform"], ctx["url"], ctx["config_overrides"] or {}
         )
 
-        # A backfill chunk that hit its time-box but made forward progress is
-        # NORMAL, not a failure — reclassify TIMEOUT → PARTIAL so it reads as
-        # "ok/progress" (PARTIAL maps to status "ok"), not a red error, and the
-        # next chunk just resumes from the new cursor (plan #693). A chunk that
-        # timed out with NO progress stays TIMEOUT and feeds phase 3's
-        # stall-guard. Leave RATE_LIMITED alone so the platform-cooldown fires.
-        if in_backfill and dl_result.error_type == ErrorType.TIMEOUT:
-            new_cursor = dl_result.cursor  # plan #704: structured, not scraped
-            advanced = bool(
-                (new_cursor and new_cursor != overrides.get("_backfill_cursor"))
-                or dl_result.files_downloaded > 0
-            )
-            if advanced:
-                dl_result.error_type = ErrorType.PARTIAL
-                dl_result.error_message = (
-                    f"Backfill chunk: {dl_result.files_downloaded} file(s) — continuing"
+        dl_result = await self.gdl.download(
+            url=effective_url,
+            artist_slug=ctx["artist_slug"],
+            platform=ctx["platform"],
+            source_config=source_config,
+            cookies_path=ctx["cookies_path"],
+            auth_token=ctx["auth_token"],
+        )
+
+        resolved_campaign_id: str | None = None
+        if (
+            ctx["platform"] == "patreon"
+            and not dl_result.success
+            and "patreon_campaign_id" not in (ctx["config_overrides"] or {})
+            and _looks_like_campaign_id_failure(dl_result.stdout, dl_result.stderr)
+        ):
+            vanity = _extract_patreon_vanity(ctx["url"])
+            if vanity:
+                log.info(
+                    "Attempting campaign-ID resolution for %s (%s)",
+                    ctx["artist_slug"], vanity,
                 )
+                resolved_campaign_id = await resolve_campaign_id(
+                    vanity, ctx["cookies_path"]
+                )
+                if resolved_campaign_id:
+                    dl_result = await self.gdl.download(
+                        url=f"https://www.patreon.com/id:{resolved_campaign_id}",
+                        artist_slug=ctx["artist_slug"],
+                        platform=ctx["platform"],
+                        source_config=source_config,
+                        cookies_path=ctx["cookies_path"],
+                        auth_token=ctx["auth_token"],
+                    )
 
         return await self._phase3_persist(
             ctx["event_id"], ctx, dl_result, resolved_campaign_id,
         )
 
-    async def _run_download(
-        self, *, ctx: dict, source_config, skip_value, mode: str | None,
-    ) -> tuple[DownloadResult, str | None]:
-        """Phase-2 dispatch → `download_backends.run_download`, passing this
-        service's gdl + sync sessionmaker. Kept as a thin instance method so tests
-        can stub the whole phase-2 dispatch on the service, and so the per-backend
-        construction lives in download_backends (the backend registry)."""
-        return await run_download(
-            ctx=ctx, source_config=source_config, skip_value=skip_value, mode=mode,
-            gdl=self.gdl, sync_session_factory=self.sync_session_factory,
-        )
-
     async def _phase1_setup(self, source_id: int) -> dict[str, Any]:
         source = (await self.async_session.execute(
             select(Source).options(joinedload(Source.artist)).where(Source.id == source_id)
@@ -201,13 +155,6 @@ class DownloadService:
             return {"status": "in_flight", "event_id": existing.id}
         if existing and existing.status == "pending":
             existing.status = "running"
-            # Reset started_at on the pending→running transition so the
-            # recovery sweep (DOWNLOAD_STALL_THRESHOLD_MINUTES, 30 min)
-            # measures from real start, not from enqueue. On heavy-queue
-            # days a freshly-promoted event whose original started_at
-            # predated the cutoff would otherwise get swept mid-flight,
-            # racing phase3's commit. Audit 2026-06-02.
-            existing.started_at = datetime.now(UTC)
             await self.async_session.commit()
             event_id = existing.id
         else:
@@ -218,12 +165,7 @@ class DownloadService:
             event_id = ev.id
 
         artist = source.artist
-        # Drive cookies-vs-token selection from the platform registry's
-        # auth_type so a new 7th token-platform automatically picks the
-        # right credential path. The hardcoded tuple here used to drift
-        # out of sync with credential_service's auth_type_for(). Audit
-        # 2026-06-02.
-        if auth_type_for(source.platform) == "token":
+        if source.platform in ("discord", "pixiv"):
             cookies_path = None
             auth_token = await self.cred_service.get_token(source.platform)
         else:
@@ -242,7 +184,6 @@ class DownloadService:
             "config_overrides": dict(source.config_overrides or {}),
             "cookies_path": cookies_path,
             "auth_token": auth_token,
-            "backfill_runs_remaining": source.backfill_runs_remaining or 0,
         }
 
     async def _phase3_persist(
@@ -269,11 +210,6 @@ class DownloadService:
         source_row = self.sync_session.get(Source, ctx["source_id"])
 
         import_summary = {"attached": 0, "skipped": 0, "errors": 0}
-        # Archives detected but captured WITHOUT extracting any image (probe
-        # rejected / corrupt / missing extractor backend). Surfaced on the event
-        # so a post showing "no images" beside a zip is diagnosable (plan
-        # follow-up 2026-06-06 — the recurring archive-association report).
-        unextracted_archives: list[dict] = []
         bytes_downloaded = 0
 
         loop = asyncio.get_running_loop()
@@ -301,51 +237,6 @@ class DownloadService:
                     bytes_downloaded += path.stat().st_size  # noqa: ASYNC240
                 except OSError:
                     pass
-                # Enqueue thumbnail + ML for newly-attached images, matching
-                # the filesystem-import path (tasks/import_file.py:228-239).
-                # Importer.attach_in_place deliberately skips inline thumb
-                # generation to keep the import queue moving; the calling
-                # task is responsible for the enqueue. Operator-flagged
-                # 2026-06-01: without this, every downloaded image stayed
-                # at thumbnail_path=NULL until a periodic backfill swept
-                # it up, surfacing as broken-thumbnail tiles in the gallery
-                # for hours after a download landed. Lazy import to avoid
-                # circular-import risk between this service and the
-                # tasks/* modules that import it.
-                from ..tasks.ml import tag_and_embed
-                from ..tasks.thumbnail import generate_thumbnail
-                ids = list(result.member_image_ids)
-                if result.image_id is not None and result.image_id not in ids:
-                    ids.append(result.image_id)
-                for img_id in ids:
-                    generate_thumbnail.delay(img_id)
-                    tag_and_embed.delay(img_id)
-            elif result.status == "attached":
-                # Non-media or extracted archive captured as PostAttachment
-                # (FC-2d-iii). The canonical copy lives in the attachments
-                # store; the original download path is now redundant —
-                # mirror duplicate_hash cleanup so we don't keep two copies.
-                # Operator-flagged 2026-06-02 (Lustria OST zip).
-                import_summary["attached"] += 1
-                # An archive captured WITHOUT extracting any image carries a
-                # reason on result.error — record it so the event explains the
-                # "no images beside a zip" symptom instead of staying silent.
-                if result.error:
-                    unextracted_archives.append(
-                        {"file": path.name, "reason": result.error}
-                    )
-                    log.warning(
-                        "archive captured unextracted (%s): %s",
-                        path.name, result.error,
-                    )
-                try:
-                    bytes_downloaded += path.stat().st_size  # noqa: ASYNC240
-                except OSError:
-                    pass
-                try:
-                    path.unlink(missing_ok=True)  # noqa: ASYNC240
-                except OSError:
-                    pass
             elif result.status == "skipped" and result.skip_reason and result.skip_reason.value in (
                 "duplicate_hash", "duplicate_phash",
             ):
@@ -354,29 +245,6 @@ class DownloadService:
                     path.unlink(missing_ok=True)  # noqa: ASYNC240
                 except OSError:
                     pass
-            elif result.status == "skipped":
-                # Soft skip (too_small, too_transparent, invalid_image) —
-                # the file just didn't qualify, not a download/ingest
-                # failure. Don't flag the run as error; the file stays
-                # on disk for operator inspection.
-                import_summary["skipped"] += 1
-            elif result.status == "failed":
-                # Hard failure (today only: archive probe crash/timeout).
-                # The original archive sits in /images/ as an orphan; the
-                # filesystem scanner would re-import and re-crash on the
-                # same file, so delete the source file and surface the
-                # error in import_summary. Audit 2026-06-02.
-                import_summary["errors"] += 1
-                try:
-                    path.unlink(missing_ok=True)  # noqa: ASYNC240
-                except OSError:
-                    pass
-            elif result.status == "refreshed":
-                # Currently unreachable from attach_in_place (the download
-                # path never runs in deep=True mode), but the importer's
-                # ImportResult contract enumerates it. Treat the same as
-                # 'attached' — work happened, no error. Audit 2026-06-02.
-                import_summary["attached"] += 1
             else:
                 import_summary["errors"] += 1
 
@@ -384,158 +252,42 @@ class DownloadService:
             select(DownloadEvent).where(DownloadEvent.id == event_id)
         )).scalar_one()
 
-        # plan #704: the native ingester returns structured run_stats; only the
-        # gallery-dl path needs the regex-over-stdout reconstruction.
-        if dl_result.run_stats is not None:
-            run_stats = dict(dl_result.run_stats)
-        else:
-            run_stats = self.gdl._compute_run_stats(
-                dl_result.return_code, dl_result.stdout, dl_result.stderr
-            )
+        run_stats = self.gdl._compute_run_stats(
+            dl_result.return_code, dl_result.stdout, dl_result.stderr
+        )
         run_stats["quarantined_count"] = dl_result.files_quarantined
-        stderr_summary = extract_errors_warnings(dl_result.stderr)
+        stderr_summary = self.gdl._extract_errors_warnings(dl_result.stderr)
 
-        # Plan #544: PARTIAL means the run downloaded ≥1 file but the
-        # subprocess didn't finish in budget (typically wall-clock timeout
-        # mid-walk). Real work happened; the next tick continues via
-        # gallery-dl's archive. NOT a failure for status purposes.
-        if dl_result.success and import_summary["errors"] == 0:
-            status = "ok"
-        elif dl_result.error_type == ErrorType.PARTIAL and import_summary["errors"] == 0:
-            status = "ok"
-        else:
-            status = "error"
+        status = "ok" if (dl_result.success and import_summary["errors"] == 0) else "error"
         ev.status = status
         ev.finished_at = datetime.now(UTC)
         ev.files_count = import_summary["attached"]
         ev.bytes_downloaded = bytes_downloaded
-        ev.error = dl_result.error_message if status == "error" else None
+        ev.error = dl_result.error_message if not dl_result.success else None
         ev.metadata_ = {
             "run_stats": run_stats,
             "error_type": dl_result.error_type.value if dl_result.error_type else None,
-            "stdout": truncate_log(dl_result.stdout) or None,
-            "stderr": truncate_log(dl_result.stderr) or None,
+            "stdout": self.gdl._truncate_log(dl_result.stdout) or None,
+            "stderr": self.gdl._truncate_log(dl_result.stderr) or None,
             "stderr_errors_warnings": stderr_summary or None,
             "duration_seconds": dl_result.duration_seconds,
             "quarantined_paths": dl_result.quarantined_paths or None,
             "import_summary": import_summary,
-            # Archives detected but captured without extracting an image — the
-            # recurring "post shows a zip but no images" report. Each entry is
-            # {file, reason}; None when every archive extracted cleanly.
-            "unextracted_archives": unextracted_archives or None,
         }
         await self._update_source_health(
             source_id=ctx["source_id"], status=status, error_message=ev.error,
-            error_type=dl_result.error_type.value if dl_result.error_type else None,
-            retry_after_seconds=getattr(dl_result, "retry_after_seconds", None),
         )
-        await self._apply_backfill_lifecycle(ctx, dl_result)
         await self.async_session.commit()
         return event_id
 
-    async def _apply_backfill_lifecycle(self, ctx: dict, dl_result) -> None:
-        """Backfill state machine (plan #693, building on the cursor of #689).
-
-        A backfill runs in time-boxed chunks while
-        `config_overrides["_backfill_state"] == "running"`. Each chunk:
-          - COMPLETES the walk → clean rc=0 (gallery-dl with skip:True exits 0
-            only after exhausting the newest→oldest walk; a chunk cut short by
-            its time-box returns success=False / rc<0 via TimeoutExpired). On
-            completion: state="complete", clear the cursor, return to tick mode.
-          - made PROGRESS (cursor advanced and/or files written) → stay
-            "running", checkpoint the new cursor, bump the chunk counter, and
-            spend one of the safety-cap chunks (backfill_runs_remaining). If the
-            cap is exhausted without finishing → state="stalled".
-          - made NO progress → increment the stall counter; two strikes →
-            state="stalled", clear the cursor (a wedged walk can't loop).
-
-        State is the single source of truth; the cursor lives only inside a
-        running backfill. config_overrides is reassigned (not mutated in place)
-        for SQLAlchemy JSON change detection.
-        """
-        overrides = ctx["config_overrides"] or {}
-        if overrides.get("_backfill_state") != "running":
-            return  # not backfilling — tick mode, nothing to do
-
-        old_cursor = overrides.get("_backfill_cursor")
-        cap_remaining = ctx.get("backfill_runs_remaining", 0) or 0
-
-        src = (await self.async_session.execute(
-            select(Source).where(Source.id == ctx["source_id"])
-        )).scalar_one()
-        new_overrides = dict(src.config_overrides or {})
-        chunks = int(new_overrides.get("_backfill_chunks", 0)) + 1
-        new_overrides["_backfill_chunks"] = chunks
-        # plan #704 (#5): _backfill_posts (the live progress badge) is OWNED by the
-        # ingester now — it writes a monotonic absolute mid-walk at each page
-        # boundary (ingest_core._checkpoint_posts), so the badge climbs DURING a
-        # chunk instead of jumping once per chunk here, and the re-walked resume
-        # page is no longer double-counted. new_overrides (read fresh above)
-        # carries the ingester's committed value forward untouched.
-
-        completed = (
-            dl_result.success
-            and dl_result.error_type is None
-            and dl_result.return_code == 0
-        )
-        if completed:
-            new_overrides["_backfill_state"] = "complete"
-            new_overrides.pop("_backfill_cursor", None)
-            new_overrides.pop("_backfill_cursor_stalls", None)
-            # plan #697: a recovery walk shares this lifecycle; clear its bypass
-            # flag on completion so the next routine tick honors the seen-ledger.
-            new_overrides.pop("_backfill_bypass_seen", None)
-            src.config_overrides = new_overrides
-            src.backfill_runs_remaining = 0
-            return
-
-        # Did not finish. The native ingester checkpoints + resumes via cursor
-        # (carried structurally on the result, plan #704); gallery-dl platforms
-        # have no resumable cursor (every chunk re-walks from the top), so they
-        # advance only by the download archive growing.
-        new_cursor = (
-            dl_result.cursor if uses_native_ingester(ctx["platform"]) else None
-        )
-        advanced = bool(
-            (new_cursor and new_cursor != old_cursor)
-            or dl_result.files_downloaded > 0
-        )
-        if advanced:
-            if new_cursor:
-                new_overrides["_backfill_cursor"] = new_cursor
-            new_overrides.pop("_backfill_cursor_stalls", None)
-            cap_remaining = max(0, cap_remaining - 1)
-            src.backfill_runs_remaining = cap_remaining
-            if cap_remaining == 0:
-                # Safety cap hit before reaching the bottom — pause, don't loop.
-                new_overrides["_backfill_state"] = "stalled"
-        else:
-            stalls = int(new_overrides.get("_backfill_cursor_stalls", 0)) + 1
-            if stalls >= 2:
-                new_overrides["_backfill_state"] = "stalled"
-                new_overrides.pop("_backfill_cursor", None)
-                new_overrides.pop("_backfill_cursor_stalls", None)
-            else:
-                new_overrides["_backfill_cursor_stalls"] = stalls
-
-        src.config_overrides = new_overrides
-
     async def _update_source_health(
         self, *, source_id: int, status: str, error_message: str | None,
-        error_type: str | None = None, retry_after_seconds: float | None = None,
     ) -> None:
         """FC-3d: update Source.{consecutive_failures, last_error, last_checked_at}.
 
         ok      -> failures = 0, error = None, checked_at = now
         error   -> failures += 1, error = error_message, checked_at = now
         skipped -> failures unchanged, error = None, checked_at = now
-
-        When error_type == 'rate_limited', also stamps a platform-wide
-        cooldown via scheduler_service.set_platform_cooldown so the next
-        scan tick skips every source on this platform until the cooldown
-        expires. Preventive half of the burst-prevention pair —
-        consecutive_failures still backs the offending source off across
-        ticks.
         """
         source = (await self.async_session.execute(
             select(Source).where(Source.id == source_id)
@@ -544,27 +296,9 @@ class DownloadService:
         if status == "ok":
             source.consecutive_failures = 0
             source.last_error = None
-            # alembic 0032 — clear the failure-class chip on success.
-            source.error_type = None
         elif status == "error":
             source.consecutive_failures = (source.consecutive_failures or 0) + 1
             source.last_error = error_message
-            # alembic 0032 — stamp the failure-class so FailingSourcesCard
-            # can render a colored chip and operators can bulk-triage
-            # by error class without opening Logs per row.
-            source.error_type = error_type
-            if error_type == "rate_limited":
-                # plan #708 B1: honor the server's Retry-After when the native
-                # client surfaced one (clamped to a sane [60, 3600] window so a
-                # tiny hint can't leave the platform effectively un-cooled and a
-                # huge one can't strand it for hours); else the flat default.
-                if retry_after_seconds is not None:
-                    seconds = int(min(max(retry_after_seconds, 60), 3600))
-                    await set_platform_cooldown(
-                        self.async_session, source.platform, seconds=seconds,
-                    )
-                else:
-                    await set_platform_cooldown(self.async_session, source.platform)
         elif status == "skipped":
             source.last_error = None
         source.last_checked_at = now

backend/app/services/extension_service.py

@@ -11,12 +11,10 @@ from __future__ import annotations
 import re
 
 from sqlalchemy import select
-from sqlalchemy.exc import IntegrityError
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from ..models import Artist, Source
 from ..utils.slug import slugify
-from .source_service import BACKFILL_MAX_CHUNKS
 
 
 class UnknownPlatformError(Exception):
@@ -87,67 +85,6 @@ class ExtensionService:
             "created_artist": created_artist,
         }
 
-    async def probe(self, url: str) -> dict:
-        """Read-only resolution of a creator-page URL against the FC DB.
-        Returns one of:
-          - {state: 'unknown_platform'}            — URL didn't match any
-            platform's strict artist-page pattern
-          - {state: 'new',          platform, slug} — would create both
-            artist and source on quick-add
-          - {state: 'artist_match', platform, slug, artist}
-                                                   — artist exists, this
-            exact URL isn't a Source yet (collapses the sidecar-synthetic
-            case too — the synthetic anchor counts as an existing artist
-            row but not as a pollable Source for this URL)
-          - {state: 'source_match', platform, slug, artist, source}
-                                                   — exact (artist, platform,
-            url) Source already exists
-
-        Side-effect-free: two SELECTs at most.
-        """
-        try:
-            platform, raw_slug = self._derive(url)
-        except (UnknownPlatformError, InvalidUrlError):
-            return {"state": "unknown_platform"}
-
-        slug = slugify(raw_slug)
-        artist = (await self.session.execute(
-            select(Artist).where(Artist.slug == slug)
-        )).scalar_one_or_none()
-        if artist is None:
-            return {"state": "new", "platform": platform, "slug": slug}
-
-        artist_payload = {"id": artist.id, "name": artist.name, "slug": artist.slug}
-
-        source = (await self.session.execute(
-            select(Source).where(
-                Source.artist_id == artist.id,
-                Source.platform == platform,
-                Source.url == url,
-            )
-        )).scalar_one_or_none()
-        if source is None:
-            return {
-                "state": "artist_match",
-                "platform": platform,
-                "slug": slug,
-                "artist": artist_payload,
-            }
-
-        return {
-            "state": "source_match",
-            "platform": platform,
-            "slug": slug,
-            "artist": artist_payload,
-            "source": {
-                "id": source.id,
-                "artist_id": source.artist_id,
-                "platform": source.platform,
-                "url": source.url,
-                "enabled": source.enabled,
-            },
-        }
-
     def _derive(self, url: str) -> tuple[str, str]:
         if not isinstance(url, str) or not url.strip():
             raise InvalidUrlError("url is empty")
@@ -160,40 +97,20 @@ class ExtensionService:
         raise UnknownPlatformError(f"no platform pattern matched {url!r}")
 
     async def _find_or_create_artist(self, raw_name: str) -> tuple[Artist, bool]:
-        """Race-safe find-or-create on Artist by slug. Mirrors the
-        savepoint + IntegrityError recovery pattern used in
-        Importer._find_or_create_source/post (see
-        reference_scalar_one_or_none_duplicates memory). Without this,
-        two concurrent quick-add-source calls hitting the same artist
-        would both miss the existence check and the second INSERT would
-        500 against uq_artist_slug.
-        """
         slug = slugify(raw_name)
         existing = (await self.session.execute(
             select(Artist).where(Artist.slug == slug)
         )).scalar_one_or_none()
         if existing is not None:
             return existing, False
-        sp = await self.session.begin_nested()
-        try:
-            artist = Artist(name=raw_name, slug=slug, is_subscription=True)
-            self.session.add(artist)
-            await self.session.flush()
-            await sp.commit()
-            return artist, True
-        except IntegrityError:
-            await sp.rollback()
-            recovered = (await self.session.execute(
-                select(Artist).where(Artist.slug == slug)
-            )).scalar_one()
-            return recovered, False
+        artist = Artist(name=raw_name, slug=slug, is_subscription=True)
+        self.session.add(artist)
+        await self.session.flush()
+        return artist, True
 
     async def _find_or_create_source(
         self, *, artist_id: int, platform: str, url: str,
     ) -> tuple[Source, bool]:
-        """Race-safe — same pattern as _find_or_create_artist above. The
-        uq_source_artist_platform_url constraint catches the duplicate
-        insert; we roll the savepoint back and re-select."""
         existing = (await self.session.execute(
             select(Source).where(
                 Source.artist_id == artist_id,
@@ -203,32 +120,8 @@ class ExtensionService:
         )).scalar_one_or_none()
         if existing is not None:
             return existing, False
-        sp = await self.session.begin_nested()
-        try:
-            # New subscription sources arm run-until-done backfill (plan #693)
-            # so the first ticks walk the full history (otherwise gallery-dl's
-            # exit:20 short-circuits before the archive is built). Mirrors
-            # SourceService.create — without it, Firefox quick-add on a creator
-            # with >20 unsynced posts would surface as "check failed" with no
-            # diagnosis. Audit 2026-06-02.
-            src = Source(
-                artist_id=artist_id, platform=platform,
-                url=url, enabled=True,
-                config_overrides={"_backfill_state": "running"},
-                backfill_runs_remaining=BACKFILL_MAX_CHUNKS,
-            )
-            self.session.add(src)
-            await self.session.flush()
-            await sp.commit()
-        except IntegrityError:
-            await sp.rollback()
-            recovered = (await self.session.execute(
-                select(Source).where(
-                    Source.artist_id == artist_id,
-                    Source.platform == platform,
-                    Source.url == url,
-                )
-            )).scalar_one()
-            return recovered, False
+        src = Source(artist_id=artist_id, platform=platform, url=url, enabled=True)
+        self.session.add(src)
+        await self.session.flush()
         await self.session.commit()
         return src, True

backend/app/services/file_validator.py

@@ -11,15 +11,9 @@ expected to write.
 
 from __future__ import annotations
 
-import json
-import logging
-import shutil
 from dataclasses import dataclass
-from datetime import UTC, datetime
 from pathlib import Path
 
-log = logging.getLogger(__name__)
-
 JPEG_HEAD = b"\xff\xd8\xff"
 JPEG_TAIL = b"\xff\xd9"
 
@@ -114,52 +108,3 @@ def validate_file(path: Path) -> ValidationResult:
         return ValidationResult(ok=True, format="webp", size=size)
 
     return ValidationResult(ok=True, format=None, size=size)
-
-
-def quarantine_file(
-    images_root: Path,
-    path: Path,
-    artist_slug: str,
-    platform: str,
-    *,
-    url: str | None,
-    result: ValidationResult,
-) -> Path | None:
-    """Move a validation-failed file to `_quarantine/<slug>/<platform>` and write
-    a `.quarantine.json` provenance sidecar next to it.
-
-    Returns the destination path, or None if the move itself failed (file left
-    in place — the caller decides what to report). The caller has already run
-    `validate_file` and seen `result.ok is False`. ONE implementation for both
-    download backends — gallery-dl's batch post-process and the native ingester's
-    per-media path — so the quarantine layout + provenance sidecar can't drift.
-    """
-    quarantine_root = images_root / "_quarantine" / artist_slug / platform
-    try:
-        quarantine_root.mkdir(parents=True, exist_ok=True)
-        dest = quarantine_root / path.name
-        counter = 1
-        while dest.exists():
-            dest = quarantine_root / f"{path.stem}.{counter}{path.suffix}"
-            counter += 1
-        shutil.move(str(path), str(dest))
-        sidecar = dest.with_suffix(dest.suffix + ".quarantine.json")
-        sidecar.write_text(
-            json.dumps(
-                {
-                    "original_path": str(path),
-                    "source_url": url,
-                    "artist_slug": artist_slug,
-                    "platform": platform,
-                    "format": result.format,
-                    "reason": result.reason,
-                    "size": result.size,
-                    "quarantined_at": datetime.now(UTC).isoformat(),
-                },
-                indent=2,
-            )
-        )
-    except OSError as exc:
-        log.error("Failed to quarantine %s: %s. File left in place.", path, exc)
-        return None
-    return dest

backend/app/services/gallery_dl.py

@@ -22,7 +22,7 @@ from datetime import UTC, datetime
 from enum import StrEnum
 from pathlib import Path
 
-from .file_validator import is_validatable, quarantine_file, validate_file
+from .file_validator import is_validatable, validate_file
 
 log = logging.getLogger(__name__)
 
@@ -39,90 +39,19 @@ class ErrorType(StrEnum):
     HTTP_ERROR = "http_error"
     UNSUPPORTED_URL = "unsupported_url"
     VALIDATION_FAILED = "validation_failed"
-    # Native Patreon ingester only (plan #697): a response parsed as JSON but
-    # didn't match the JSON:API shape the ingester depends on (missing `data`,
-    # media lacking `file_name`/`url`, etc.). Distinct from AUTH_ERROR — the fix
-    # is updating the ingester's field-set/parser, not rotating credentials. The
-    # contract test guards against silently shipping this.
-    API_DRIFT = "api_drift"
-    # Run made real progress (downloaded ≥1 file) but did not finish in the
-    # subprocess budget. Distinct from UNKNOWN_ERROR — the downstream status
-    # mapping classifies this as "ok" because the next tick continues.
-    PARTIAL = "partial"
     UNKNOWN_ERROR = "unknown_error"
 
 
-# Tick mode (routine cron polls): skip ≤20 contiguous already-archived
-# items, then exit gallery-dl. Established subscription with zero new
-# content exits in ~30s of HEAD requests instead of walking to the bottom
-# of the post history (which can be hours for prolific creators). 20 (not
-# 5) is operator-set headroom against any edge case where paywalled or
-# otherwise-non-downloadable items might interleave with archived ones —
-# 20 contiguous HEADs is still negligible.
-TICK_SKIP_VALUE = "exit:20"
-
-# Backfill mode (operator-triggered deep scan): walk the full history,
-# one TIME-BOXED CHUNK per run (plan #693). config_overrides["_backfill_state"]
-# == "running" selects this mode; the cursor checkpoint (plan #689) lets each
-# chunk resume where the last stopped, so the walk advances across chunks
-# until gallery-dl exits cleanly (= reached the bottom).
-#
-# The chunk budget is deliberately FAR below download_source's Celery
-# soft_time_limit (DOWNLOAD_SOFT_TIME_LIMIT=1350, tasks/download.py), not
-# "just under" it. Hitting this budget is the NORMAL chunk boundary, not a
-# failure: subprocess.run raises TimeoutExpired (which captures partial
-# stdout/stderr + the last emitted cursor), and download_service reclassifies
-# a chunk that made progress as PARTIAL (status "ok"), not an error. The huge
-# headroom means a stuck file or a slow chunk can never let Celery's
-# SoftTimeLimitExceeded preempt TimeoutExpired (the failure mode behind Knuxy
-# #38275 / Anduo #39912/#40411). Earlier we ran one ~1170s run-to-the-wall
-# per arming; that died as a timeout error every time on large catalogs.
-BACKFILL_SKIP_VALUE = True
-BACKFILL_CHUNK_SECONDS = 600
-
-
-# Sits well below download_source's Celery soft_time_limit
-# (DOWNLOAD_SOFT_TIME_LIMIT=1350, tasks/download.py). subprocess.run MUST
-# raise TimeoutExpired before Celery raises SoftTimeLimitExceeded —
-# otherwise Celery wins the race, SIGKILLs the worker, in-memory
-# stdout/stderr is lost, and the DownloadEvent ends up empty-logged with
-# "stranded by recovery sweep" (operator-flagged 2026-05-31, Knuxy event
-# #38275; recurred in backfill mode as Anduo #39912). Per-source bumps
-# still live in source.config_overrides for legitimately long syncs —
-# keep any override below the soft limit, or the soft-limit salvage path
-# in tasks/download.py (_finalize_soft_limited) is the only safety net.
-_DEFAULT_GDL_TIMEOUT_SECONDS = 870
-
-
 @dataclass
 class SourceConfig:
-    """Per-source overrides loaded from Source.config_overrides JSON.
-
-    Note: the gallery-dl `skip` value (tick vs backfill, see TICK_SKIP_VALUE /
-    BACKFILL_SKIP_VALUE) is NOT carried here — it derives from the
-    Source.backfill_runs_remaining column at the download_service layer
-    and is passed to _build_config_for_source as `skip_value`. Same for
-    the per-run subprocess timeout.
-
-    `resume_cursor` is RUNTIME state, not persisted operator config: the
-    cursor-paged backfill checkpoint (see parse_last_cursor + the
-    download_service backfill lifecycle). It is consumed only by the native
-    Patreon ingester (the sole cursor-paged platform; gallery-dl's Patreon path
-    was removed at the #697 cutover): on a backfill/recovery run the ingester
-    resumes its newest→oldest walk from that pagination cursor instead of
-    restarting from the top. download_service threads it from
-    config_overrides["_backfill_cursor"]; SourceConfig deliberately does NOT read
-    it in from_dict (config_overrides also holds operator config, and
-    resume_cursor must only apply in backfill/recovery mode).
-    """
     content_types: list[str] = field(default_factory=lambda: ["all"])
     sleep: float | None = None
     sleep_request: float | None = None
     directory_pattern: str | None = None
     filename_pattern: str | None = None
+    skip_existing: bool = True
     save_metadata: bool = True
-    timeout: int = _DEFAULT_GDL_TIMEOUT_SECONDS
-    resume_cursor: str | None = None
+    timeout: int = 3600
 
     @classmethod
     def from_dict(cls, data: dict) -> SourceConfig:
@@ -132,8 +61,9 @@ class SourceConfig:
             sleep_request=data.get("sleep_request"),
             directory_pattern=data.get("directory_pattern"),
             filename_pattern=data.get("filename_pattern"),
+            skip_existing=data.get("skip_existing", True),
             save_metadata=data.get("save_metadata", True),
-            timeout=data.get("timeout", _DEFAULT_GDL_TIMEOUT_SECONDS),
+            timeout=data.get("timeout", 3600),
         )
 
 
@@ -155,51 +85,6 @@ class DownloadResult:
     duration_seconds: float = 0.0
     started_at: str | None = None
     completed_at: str | None = None
-    # Plan #704 — structured fields the NATIVE ingester populates directly (None
-    # on the gallery-dl path, which keeps the regex-over-stdout route). When set,
-    # phase 3 reads these instead of scraping the text it would otherwise have to
-    # reconstruct: `run_stats` mirrors _compute_run_stats' shape; `cursor` is the
-    # backfill checkpoint the ingester knows exactly (no parse_last_cursor).
-    run_stats: dict | None = None
-    cursor: str | None = None
-    posts_processed: int = 0
-    # Plan #708 B1 — the server's Retry-After seconds on a RATE_LIMITED result, so
-    # the platform cooldown matches the hint instead of a flat default. None when
-    # unknown (no header, or not a rate-limit failure).
-    retry_after_seconds: float | None = None
-
-
-def extract_errors_warnings(stderr: str) -> str:
-    """Keep only the `[error]`/`[warning]` lines from a captured stderr blob.
-
-    A generic download-log helper (module-level so the native-ingester result
-    path can shape its logs without reaching through a GalleryDLService instance).
-    """
-    if not stderr:
-        return ""
-    kept = [
-        line for line in stderr.splitlines()
-        if "][error]" in line.lower() or "][warning]" in line.lower()
-    ]
-    return "\n".join(kept)
-
-
-def truncate_log(text: str, max_bytes: int = 500_000) -> str:
-    """Cap a captured log to `max_bytes`, eliding the middle (head + tail kept)."""
-    if not text:
-        return text
-    encoded = text.encode("utf-8")
-    if len(encoded) <= max_bytes:
-        return text
-    half = max_bytes // 2
-    head = encoded[:half].decode("utf-8", errors="ignore")
-    tail = encoded[-half:].decode("utf-8", errors="ignore")
-    head_lines = head.count("\n")
-    tail_lines = tail.count("\n")
-    total_lines = text.count("\n")
-    elided = max(0, total_lines - head_lines - tail_lines)
-    marker = f"\n\n... [{elided} lines elided, {len(encoded) - max_bytes} bytes] ...\n\n"
-    return head + marker + tail
 
 
 def _summarize_validation_failures(failures: list[dict]) -> str:
@@ -216,40 +101,6 @@ def _summarize_validation_failures(failures: list[dict]) -> str:
     return f"{n} files quarantined ({top_count}× {top_reason}, mixed)"
 
 
-# (parse_last_cursor was removed in plan #704: the native ingester now carries
-# its checkpoint cursor as a structured DownloadResult.cursor field, so there is
-# no log text to scrape — and gallery-dl platforms never had a cursor.)
-
-
-def make_run_stats(
-    *,
-    exit_code: int = 0,
-    downloaded_count: int = 0,
-    skipped_count: int = 0,
-    per_item_failures: int = 0,
-    warning_count: int = 0,
-    tier_gated_count: int = 0,
-    quarantined_count: int = 0,
-    dead_lettered_count: int = 0,
-) -> dict:
-    """The canonical `run_stats` dict shape, in ONE place.
-
-    Both result producers — gallery-dl's `_compute_run_stats` (log scrape) and the
-    native ingester's per-outcome tally (ingest_core) — build through this so the
-    key set can't drift between backends. Phase 3 + the Logs UI read these keys.
-    """
-    return {
-        "exit_code": exit_code,
-        "downloaded_count": downloaded_count,
-        "skipped_count": skipped_count,
-        "per_item_failures": per_item_failures,
-        "warning_count": warning_count,
-        "tier_gated_count": tier_gated_count,
-        "quarantined_count": quarantined_count,
-        "dead_lettered_count": dead_lettered_count,
-    }
-
-
 class GalleryDLService:
     """Service for executing gallery-dl downloads."""
 
@@ -283,10 +134,16 @@ class GalleryDLService:
         "permission denied", "tier required", "pledge required",
     ]
 
-    # Per-platform defaults for the gallery-dl-backed platforms. Patreon was
-    # removed at the plan-#697 cutover — it now uses the native ingester
-    # (services/patreon_ingester.py), not gallery-dl.
+    # Per-platform defaults. Lifted from GS — same six platforms FC supports.
     PLATFORM_DEFAULTS = {
+        "patreon": {
+            "content_types": ["images", "image_large", "attachments", "postfile", "content"],
+            "directory": ["{date:%Y-%m-%d}_{id}_{title[:40]}"],
+            "filename": "{num:>02}_{filename}.{extension}",
+            "videos": True,
+            "embeds": True,
+            "cursor": True,
+        },
         "subscribestar": {
             "content_types": ["all"],
             "directory": ["{date:%Y-%m-%d}_{id}_{title[:40]}"],
@@ -345,12 +202,7 @@ class GalleryDLService:
                 "skip": True,
                 "sleep": self._rate_limit,
                 "sleep-request": max(0.5, self._rate_limit / 4),
-                # 2 (not 3) retries — a stuck CDN host shouldn't burn a whole
-                # backfill chunk on one file. Anduo #40838 spent ~600s on a
-                # single image (4 extractor HEAD retries × 30s + 4 downloader
-                # GET retries × 120s); halving retries + the downloader
-                # timeout below caps a wedged file at ~1-2 min instead.
-                "retries": 2,
+                "retries": 3,
                 "timeout": 30.0,
                 "verify": True,
                 "postprocessors": [
@@ -365,17 +217,8 @@ class GalleryDLService:
             "downloader": {
                 "part": True,
                 "part-directory": str(self._config_dir / "temp"),
-                # See the extractor retries note above (Anduo #40838): 2
-                # retries + a 60s read-timeout (was 120) so a stalled
-                # connection fails fast. 60s is a per-read timeout, not a
-                # transfer cap — large GIFs that keep streaming are unaffected.
-                "retries": 2,
-                "timeout": 60.0,
-                # NOTE: the Patreon/Mux yt-dlp Referer/Origin forwarding lived
-                # here until the plan-#697 cutover. It was Patreon-specific (and
-                # would have wrongly tagged the other platforms' yt-dlp fetches);
-                # Patreon video is now handled by the native ingester's
-                # downloader (patreon_downloader._VIDEO_HEADERS), so it's gone.
+                "retries": 3,
+                "timeout": 120.0,
             },
             "output": {"progress": True},
         }
@@ -390,18 +233,7 @@ class GalleryDLService:
         platform: str,
         source_config: SourceConfig,
         artist_slug: str,
-        skip_value: bool | str = BACKFILL_SKIP_VALUE,
     ) -> dict:
-        """`skip_value` controls gallery-dl's archive-walk behavior:
-            - True (BACKFILL_SKIP_VALUE): walk full post history, skipping
-              archived items but continuing past them. Used in backfill mode.
-            - "exit:20" (TICK_SKIP_VALUE): exit gallery-dl after 20
-              contiguous archived items. Used in tick (routine catch-up)
-              mode for fast no-op syncs on creators with deep history.
-            - False: don't skip — redownload everything (not used in FC).
-        The caller (download_service) chooses based on
-        Source.backfill_runs_remaining.
-        """
         config = json.loads(json.dumps(self._get_default_config()))  # deep copy
 
         destination = str(self.images_root / artist_slug / platform)
@@ -411,7 +243,7 @@ class GalleryDLService:
             config["extractor"]["sleep"] = source_config.sleep
         if source_config.sleep_request is not None:
             config["extractor"]["sleep-request"] = source_config.sleep_request
-        config["extractor"]["skip"] = skip_value
+        config["extractor"]["skip"] = source_config.skip_existing
 
         if source_config.save_metadata:
             config["extractor"]["postprocessors"] = [
@@ -427,7 +259,14 @@ class GalleryDLService:
 
         platform_section = config["extractor"].setdefault(platform, {})
 
-        if platform == "hentaifoundry":
+        if platform == "patreon":
+            if "all" in source_config.content_types:
+                platform_section["files"] = [
+                    "images", "image_large", "attachments", "postfile", "content",
+                ]
+            else:
+                platform_section["files"] = source_config.content_types
+        elif platform == "hentaifoundry":
             if "pictures" in source_config.content_types or "all" in source_config.content_types:
                 platform_section["include"] = "all"
 
@@ -521,17 +360,7 @@ class GalleryDLService:
         if return_code in (1, 4) and (skip_line_count > 0 or has_skip_text) and not has_actual_error:
             return ErrorType.NO_NEW_CONTENT, "No new content to download"
 
-        # Tier-gated classification used to require `return_code in (1, 4)`,
-        # which silently fell through to UNKNOWN_ERROR when gallery-dl
-        # returned a different exit code for mixed-failure runs (e.g.
-        # paywall warnings + a missing yt-dlp dep flipping the exit bits).
-        # The artist then surfaced as "needs attention" purely because a
-        # paywall blocked posts the operator wasn't paying to see —
-        # operator-flagged 2026-05-31. Now: if no source-level error
-        # category fired AND tier-gated warnings are present, classify
-        # as TIER_LIMITED regardless of return code. Same priority order
-        # as before (auth/rate/access/not_found/network/http still win).
-        if not has_actual_error:
+        if return_code in (1, 4) and not has_actual_error:
             tier_gated_lines = [
                 line for line in combined.split("\n")
                 if "][warning]" in line and "not allowed to view post" in line
@@ -543,22 +372,6 @@ class GalleryDLService:
                     f"Subscription tier does not grant access to {count} post{'s' if count != 1 else ''}",
                 )
 
-        # Partial-success: the subprocess exited non-zero (typically because
-        # the wall-clock timeout fired mid-walk), but it had downloaded ≥1
-        # file by then and no source-level error category fired. The work
-        # the run DID do is real; gallery-dl's archive will pick up where
-        # it left off on the next tick. Mapped to status="ok" downstream
-        # (download_service.py) so this doesn't flag the source as
-        # "needs attention." Operator-flagged 2026-06-01 after a Knuxy
-        # patreon run downloaded hundreds of files then ran red on timeout.
-        files_downloaded = self._count_downloaded_files(stdout)
-        if not has_actual_error and files_downloaded > 0:
-            return (
-                ErrorType.PARTIAL,
-                f"Downloaded {files_downloaded} file{'s' if files_downloaded != 1 else ''}; "
-                "run did not complete in budget — next tick will continue",
-            )
-
         return ErrorType.UNKNOWN_ERROR, f"Unknown error (return code: {return_code})"
 
     def _count_downloaded_files(self, stdout: str) -> int:
@@ -587,6 +400,10 @@ class GalleryDLService:
         if not written_paths:
             return quarantined_relpaths, failures
 
+        quarantine_root = (
+            self.images_root / "_quarantine" / artist_slug / platform
+        )
+
         for path in written_paths:
             if not is_validatable(path):
                 continue
@@ -597,14 +414,34 @@ class GalleryDLService:
                 continue
             if result.ok:
                 continue
-            # Shared move+sidecar (file_validator.quarantine_file) — same impl the
-            # native ingester uses, so the layout + provenance sidecar can't drift.
-            dest = quarantine_file(
-                self.images_root, path, artist_slug, platform,
-                url=url, result=result,
-            )
-            if dest is None:
-                continue  # move failed → left in place, not counted
+            try:
+                quarantine_root.mkdir(parents=True, exist_ok=True)
+                dest = quarantine_root / path.name
+                counter = 1
+                while dest.exists():
+                    dest = quarantine_root / f"{path.stem}.{counter}{path.suffix}"
+                    counter += 1
+                path.rename(dest)
+                sidecar = dest.with_suffix(dest.suffix + ".quarantine.json")
+                sidecar.write_text(
+                    json.dumps(
+                        {
+                            "original_path": str(path),
+                            "source_url": url,
+                            "artist_slug": artist_slug,
+                            "platform": platform,
+                            "format": result.format,
+                            "reason": result.reason,
+                            "size": result.size,
+                            "quarantined_at": datetime.now(UTC).isoformat(),
+                        },
+                        indent=2,
+                    )
+                )
+            except OSError as exc:
+                log.error("Failed to quarantine %s: %s. File left in place.", path, exc)
+                continue
+
             log.warning(
                 "Quarantined corrupt file: %s → %s (%s: %s)",
                 path, dest, result.format, result.reason,
@@ -642,24 +479,41 @@ class GalleryDLService:
             if "][warning]" in line.lower() and "not allowed to view post" in line.lower()
         )
 
-        return make_run_stats(
-            exit_code=return_code,
-            downloaded_count=self._count_downloaded_files(stdout),
-            skipped_count=skipped_stdout + skipped_stderr,
-            per_item_failures=per_item_failures,
-            warning_count=warning_count,
-            tier_gated_count=tier_gated_count,
-        )
+        return {
+            "exit_code": return_code,
+            "downloaded_count": self._count_downloaded_files(stdout),
+            "skipped_count": skipped_stdout + skipped_stderr,
+            "per_item_failures": per_item_failures,
+            "warning_count": warning_count,
+            "tier_gated_count": tier_gated_count,
+        }
 
     @staticmethod
     def _extract_errors_warnings(stderr: str) -> str:
-        # Thin delegator to the module-level helper (kept for existing callers).
-        return extract_errors_warnings(stderr)
+        if not stderr:
+            return ""
+        kept = [
+            line for line in stderr.splitlines()
+            if "][error]" in line.lower() or "][warning]" in line.lower()
+        ]
+        return "\n".join(kept)
 
     @staticmethod
     def _truncate_log(text: str, max_bytes: int = 500_000) -> str:
-        # Thin delegator to the module-level helper (kept for existing callers).
-        return truncate_log(text, max_bytes)
+        if not text:
+            return text
+        encoded = text.encode("utf-8")
+        if len(encoded) <= max_bytes:
+            return text
+        half = max_bytes // 2
+        head = encoded[:half].decode("utf-8", errors="ignore")
+        tail = encoded[-half:].decode("utf-8", errors="ignore")
+        head_lines = head.count("\n")
+        tail_lines = tail.count("\n")
+        total_lines = text.count("\n")
+        elided = max(0, total_lines - head_lines - tail_lines)
+        marker = f"\n\n... [{elided} lines elided, {len(encoded) - max_bytes} bytes] ...\n\n"
+        return head + marker + tail
 
     async def download(
         self,
@@ -669,7 +523,6 @@ class GalleryDLService:
         source_config: SourceConfig | None = None,
         cookies_path: str | None = None,
         auth_token: str | None = None,
-        skip_value: bool | str = BACKFILL_SKIP_VALUE,
     ) -> DownloadResult:
         start_time = time.time()
         started_at = datetime.now(UTC).isoformat()
@@ -677,9 +530,7 @@ class GalleryDLService:
         if source_config is None:
             source_config = SourceConfig()
 
-        config = self._build_config_for_source(
-            platform, source_config, artist_slug, skip_value=skip_value,
-        )
+        config = self._build_config_for_source(platform, source_config, artist_slug)
 
         if cookies_path:
             config["extractor"]["cookies"] = cookies_path
@@ -781,57 +632,13 @@ class GalleryDLService:
                 started_at=started_at, completed_at=completed_at,
             )
 
-        except subprocess.TimeoutExpired as e:
+        except subprocess.TimeoutExpired:
             duration = time.time() - start_time
-            # subprocess.run(text=True) makes these str if non-None, but the
-            # caller may have raised TimeoutExpired manually with None or
-            # bytes (tests do); coerce both cases to str.
-            partial_stdout = e.stdout or ""
-            partial_stderr = e.stderr or ""
-            if isinstance(partial_stdout, bytes):
-                partial_stdout = partial_stdout.decode("utf-8", "replace")
-            if isinstance(partial_stderr, bytes):
-                partial_stderr = partial_stderr.decode("utf-8", "replace")
-
-            files_so_far = self._count_downloaded_files(partial_stdout)
-            written_so_far = [str(p) for p in self._written_paths(partial_stdout)]
-            stderr_lines = partial_stderr.strip().splitlines()
-            tail_hint = stderr_lines[-1] if stderr_lines else "no stderr output"
-
-            # If the partial output already shows a rate-limit pattern, the
-            # timeout was almost certainly gallery-dl spinning on retries —
-            # promote to RATE_LIMITED so _update_source_health stamps the
-            # platform cooldown (same code path as a clean-exit rate limit).
-            # Otherwise stay TIMEOUT and let the captured stdout/stderr +
-            # files_so_far tell the operator whether it was "lots of
-            # content" vs "stuck retrying" vs "hung silent".
-            combined = (partial_stdout + "\n" + partial_stderr).lower()
-            if any(p in combined for p in self.RATE_LIMIT_PATTERNS):
-                error_type = ErrorType.RATE_LIMITED
-                error_message = (
-                    f"Rate-limited and never completed within "
-                    f"{source_config.timeout}s ({files_so_far} files written)"
-                )
-            else:
-                error_type = ErrorType.TIMEOUT
-                error_message = (
-                    f"Download timed out after {source_config.timeout}s — "
-                    f"{files_so_far} file(s) written; last stderr: {tail_hint}"
-                )
-
-            log.error(
-                "Download timeout for %s/%s after %.1fs (%d files written, "
-                "last stderr: %s)",
-                artist_slug, platform, duration, files_so_far, tail_hint,
-            )
-
+            log.error("Download timeout for %s/%s after %.1fs", artist_slug, platform, duration)
             return DownloadResult(
                 success=False, url=url, artist_slug=artist_slug, platform=platform,
-                files_downloaded=files_so_far,
-                written_paths=written_so_far,
-                stdout=partial_stdout, stderr=partial_stderr,
-                return_code=-1,  # killed by timeout, no real exit code
-                error_type=error_type, error_message=error_message,
+                error_type=ErrorType.TIMEOUT,
+                error_message=f"Download timed out after {source_config.timeout} seconds",
                 duration_seconds=duration,
                 started_at=started_at,
                 completed_at=datetime.now(UTC).isoformat(),
@@ -851,70 +658,3 @@ class GalleryDLService:
                 Path(temp_config_path).unlink()  # noqa: ASYNC240
             except Exception:
                 pass
-
-    async def verify(
-        self,
-        url: str,
-        artist_slug: str,
-        platform: str,
-        source_config: SourceConfig | None = None,
-        cookies_path: str | None = None,
-        auth_token: str | None = None,
-        timeout: float = 45.0,  # noqa: ASYNC109 — subprocess.run timeout, not a coroutine deadline
-    ) -> tuple[bool, str]:
-        """Test that credentials authenticate against `url` WITHOUT
-        downloading anything. Runs gallery-dl in --simulate mode limited
-        to the first item; if auth is bad the extractor errors before it
-        can list, which _categorize_error flags as AUTH_ERROR. Returns
-        (ok, message). Used by the credential Verify button."""
-        if source_config is None:
-            source_config = SourceConfig()
-        config = self._build_config_for_source(platform, source_config, artist_slug)
-        if cookies_path:
-            config["extractor"]["cookies"] = cookies_path
-        if auth_token and platform == "discord":
-            config["extractor"].setdefault("discord", {})["token"] = auth_token
-        if auth_token and platform == "pixiv":
-            config["extractor"].setdefault("pixiv", {})["refresh-token"] = auth_token
-
-        with tempfile.NamedTemporaryFile(
-            mode="w", suffix=".json", delete=False, dir=str(self._config_dir),
-        ) as fh:
-            json.dump(config, fh, indent=2)
-            temp_config_path = fh.name
-        try:
-            cmd = [
-                sys.executable, "-m", "gallery_dl",
-                "--config", temp_config_path,
-                "--simulate", "--range", "1-1", "--verbose", url,
-            ]
-            loop = asyncio.get_running_loop()
-            proc = await loop.run_in_executor(
-                None,
-                lambda: subprocess.run(
-                    cmd, capture_output=True, text=True, timeout=timeout,
-                ),
-            )
-            etype, msg = self._categorize_error(proc.returncode, proc.stdout, proc.stderr)
-            # TIER_LIMITED proves auth worked — gallery-dl reached the
-            # post, was told it's tier-gated. The download path treats
-            # this as success (line 712); verify must too, or operators
-            # rotate working cookies for no reason. Audit 2026-06-02.
-            if proc.returncode == 0 or etype in (
-                ErrorType.NO_NEW_CONTENT, ErrorType.TIER_LIMITED,
-            ):
-                return True, "Credentials valid — the feed authenticated."
-            if etype == ErrorType.AUTH_ERROR:
-                return False, msg
-            # Network / not-found / rate-limit / unknown: inconclusive,
-            # not a definitive credential failure. Surface the reason.
-            return False, f"Could not confirm ({etype.value}): {msg}"
-        except subprocess.TimeoutExpired:
-            return False, f"Verification timed out after {timeout:.0f}s"
-        except Exception as exc:  # noqa: BLE001
-            return False, f"Verification error: {exc}"
-        finally:
-            try:
-                Path(temp_config_path).unlink()  # noqa: ASYNC240
-            except Exception:
-                pass

backend/app/services/gallery_service.py

@@ -1,42 +1,26 @@
 """Cursor-paginated gallery queries.
 
-Cursor format: opaque base64-encoded "<iso8601_effective_date>:<image_id>".
-
-Pagination key is (effective_date DESC, id DESC) where effective_date is
-COALESCE(post.post_date, image_record.created_at) so the gallery surfaces
-images by ORIGINAL publish date when known, falling back to FC's scan
-date. Important for migrated content: ~57k IR images scanned in a single
-week would otherwise all share the same created_at and pile up in one
-month bucket. The effective_date spreads them across the years they
-were originally published.
-
-Decoding rejects malformed cursors with a ValueError; the API layer
-translates that to HTTP 400.
+Cursor format: opaque base64-encoded "<iso8601_created_at>:<image_id>".
+Pagination key is (created_at DESC, id DESC) so we don't drift when new
+imports arrive between page loads. Decoding rejects malformed cursors with
+a ValueError; the API layer translates that to HTTP 400.
 """
 
 import base64
 from dataclasses import dataclass
 from datetime import datetime
 
-from sqlalchemy import Select, and_, distinct, exists, func, or_, select
+from sqlalchemy import and_, exists, func, or_, select
 from sqlalchemy.ext.asyncio import AsyncSession
-from sqlalchemy.orm import aliased
 
-from ..models import Artist, ImageProvenance, ImageRecord, Post, Source, Tag
+from ..models import Artist, ImageProvenance, ImageRecord, Source, Tag
 from ..models.tag import image_tag
 
 CURSOR_SEPARATOR = "|"
 
-# Reserved `platform` filter value selecting images with NO platformed
-# provenance (filesystem imports). Returned by facets() as a null-valued
-# bucket; the frontend maps that null back to this sentinel in the URL so the
-# bucket is selectable. Underscore-wrapped so it can't collide with a real
-# gallery-dl platform name (patreon/pixiv/...).
-UNSOURCED_PLATFORM = "__unsourced__"
 
-
-def encode_cursor(effective_date: datetime, image_id: int) -> str:
-    raw = f"{effective_date.isoformat()}{CURSOR_SEPARATOR}{image_id}"
+def encode_cursor(created_at: datetime, image_id: int) -> str:
+    raw = f"{created_at.isoformat()}{CURSOR_SEPARATOR}{image_id}"
     return base64.urlsafe_b64encode(raw.encode()).decode()
 
 
@@ -49,27 +33,6 @@ def decode_cursor(cursor: str) -> tuple[datetime, int]:
         raise ValueError(f"invalid cursor: {cursor!r}") from exc
 
 
-def _effective_date_col():
-    """The materialized gallery sort key: image_record.effective_date
-    (alembic 0035) = COALESCE(primary post's post_date, created_at),
-    maintained at write time by the importer.
-
-    Canonical sort/group/filter key across the gallery so images attached
-    to a post surface at their original publish date, not their FC import
-    date — and, now that it's a single indexed column rather than a
-    COALESCE across the Post outer join, the cursor scroll is an index
-    range scan instead of a full re-sort per page.
-    """
-    return ImageRecord.effective_date
-
-
-def _outer_join_primary_post(stmt: Select) -> Select:
-    """LEFT JOIN Post on ImageRecord.primary_post_id so the COALESCE
-    above sees Post.post_date when available. Images without a post
-    survive the join as NULL on the Post side; COALESCE handles it."""
-    return stmt.outerjoin(Post, Post.id == ImageRecord.primary_post_id)
-
-
 @dataclass(frozen=True)
 class GalleryImage:
     id: int
@@ -78,9 +41,7 @@ class GalleryImage:
     mime: str
     width: int | None
     height: int | None
-    created_at: datetime          # FC's row-insert time
-    effective_date: datetime      # COALESCE(post.post_date, created_at)
-    posted_at: datetime | None    # post.post_date if known, else None
+    created_at: datetime
     thumbnail_url: str
     artist: dict | None = None
 
@@ -99,173 +60,39 @@ class TimelineBucket:
     count: int
 
 
-@dataclass(frozen=True)
-class GalleryFacets:
-    total: int                       # images matching the FULL active filter
-    platforms: list[dict]            # [{"value": str|None, "count": int}], null = unsourced
-    untagged: int                    # how many the Untagged flag would isolate
-    no_artist: int                   # how many the No-artist flag would isolate
-    date_min: datetime | None
-    date_max: datetime | None
-
-
-def thumbnail_url(thumbnail_path: str | None, sha256_hex: str, mime: str) -> str:
-    """Return the URL to fetch a thumbnail.
-
-    Prefers the stored thumbnail_path verbatim — Quart serves /images/*
-    1:1 from the volume (frontend.py:20-36), so the URL IS the disk
-    path. Falls back to deriving from (sha256, mime) only when the
-    record's thumbnail_path is NULL (thumbnailer hasn't run yet); that
-    URL will 404 until backfill catches it, same as before the path
-    was tracked.
-
-    Pre-2026-05-30 this was derived only from (sha256, mime), which
-    disagreed with the actual on-disk extension when the thumbnailer
-    chose its format from transparency rather than MIME — every PNG
-    source without alpha (extension was .jpg on disk) and every WebP
-    source with alpha (extension was .png on disk) silently 404'd
-    despite the thumbnail file existing.
-    """
-    if thumbnail_path:
-        return thumbnail_path
-    # Fallback for records with no thumbnail recorded yet — preserves
-    # prior behavior (URL exists but 404s until backfill regenerates).
+def thumbnail_url(sha256_hex: str, mime: str) -> str:
+    # Quart serves /images/* via the frontend blueprint (FC-1); thumbnails go
+    # under /images/thumbs/. The MIME determines the extension.
     ext = ".png" if mime in ("image/png", "image/gif") else ".jpg"
     bucket = sha256_hex[:3]
     return f"/images/thumbs/{bucket}/{sha256_hex}{ext}"
 
 
-def _require_single_filter(tag_ids, post_id, artist_id) -> None:
-    """post_id is the post-detail view — it can't combine with the
-    composable filters. tag_ids + artist_id (+ media_type) compose freely
-    (AND)."""
-    if post_id is not None and (tag_ids or artist_id is not None):
+def _require_single_filter(tag_id, post_id, artist_id) -> None:
+    if sum(x is not None for x in (tag_id, post_id, artist_id)) > 1:
         raise ValueError(
-            "post_id cannot be combined with tag or artist filters"
+            "tag_id, post_id, artist_id are mutually exclusive"
         )
 
 
-def _apply_scope(
-    stmt, *, tag_ids, post_id, artist_id, media_type,
-    platform=None, untagged=False, no_artist=False,
-    date_from=None, date_to=None,
-):
-    """Apply the composable gallery filters to a statement.
-
-    All clauses are correlated EXISTS / scalar predicates on ImageRecord, so
-    they AND together without row-multiplication and don't require any join to
-    be present on `stmt` (the artist/platform paths alias Post/Source inside
-    their own EXISTS).
-
-    - tag_ids: image must carry ALL of them — one correlated EXISTS per tag.
-    - post_id / artist_id: provenance EXISTS (post_id is exclusive, guarded
-      by _require_single_filter).
-    - media_type: 'image' | 'video' narrows by mime prefix.
-    - platform: EXISTS a provenance→source with that platform; the
-      UNSOURCED_PLATFORM sentinel inverts it (NO platformed provenance).
-    - untagged: NOT EXISTS any image_tag row.
-    - no_artist: ImageRecord.artist_id IS NULL.
-    - date_from / date_to: half-open [from, to) bounds on effective_date.
-    """
-    for tid in tag_ids or []:
-        stmt = stmt.where(
-            exists().where(
-                image_tag.c.image_record_id == ImageRecord.id,
-                image_tag.c.tag_id == tid,
-            )
-        )
-    prov = _provenance_clause(post_id, artist_id)
-    if prov is not None:
-        stmt = stmt.where(prov)
-    if media_type == "image":
-        stmt = stmt.where(ImageRecord.mime.like("image/%"))
-    elif media_type == "video":
-        stmt = stmt.where(ImageRecord.mime.like("video/%"))
-    if platform is not None:
-        stmt = stmt.where(_platform_clause(platform))
-    if untagged:
-        stmt = stmt.where(
-            ~exists().where(image_tag.c.image_record_id == ImageRecord.id)
-        )
-    if no_artist:
-        stmt = stmt.where(ImageRecord.artist_id.is_(None))
-    eff = _effective_date_col()
-    if date_from is not None:
-        stmt = stmt.where(eff >= date_from)
-    if date_to is not None:
-        stmt = stmt.where(eff < date_to)
-    return stmt
-
-
-def _platform_clause(platform):
-    """Correlated EXISTS on a provenance row whose Source carries `platform`.
-    The UNSOURCED_PLATFORM sentinel inverts to NOT EXISTS(any sourced
-    provenance) — i.e. filesystem-imported content with no platform."""
-    src = aliased(Source)
-    if platform == UNSOURCED_PLATFORM:
-        return ~exists().where(
-            ImageProvenance.image_record_id == ImageRecord.id,
-            ImageProvenance.source_id == src.id,
-        )
-    return exists().where(
-        ImageProvenance.image_record_id == ImageRecord.id,
-        ImageProvenance.source_id == src.id,
-        src.platform == platform,
-    )
-
-
 def _provenance_clause(post_id, artist_id):
     """Correlated EXISTS clause (NOT a join) so an image with multiple
     matching provenance rows is returned exactly once and the
-    (effective_date DESC, id DESC) cursor ordering is unaffected."""
+    (created_at DESC, id DESC) cursor ordering is unaffected."""
     if post_id is not None:
         return exists().where(
             ImageProvenance.image_record_id == ImageRecord.id,
             ImageProvenance.post_id == post_id,
         )
     if artist_id is not None:
-        # Use Post.artist_id (alembic 0030 denormalized column) instead
-        # of joining through ImageProvenance.source_id → Source.artist_id.
-        # The denormalization is the always-present linkage; the source
-        # path now drops NULL-source provenance rows (filesystem-imported
-        # content) which would otherwise vanish from artist-filtered
-        # gallery views.
-        # ALIAS Post: the gallery query outer-joins Post on
-        # ImageRecord.primary_post_id (`_outer_join_primary_post`).
-        # SQLAlchemy would otherwise correlate a bare `Post` reference
-        # in this EXISTS subquery to that outer Post (which is NULL for
-        # images with no primary post), and the filter would silently
-        # match nothing.
-        post_inner = aliased(Post)
         return exists().where(
             ImageProvenance.image_record_id == ImageRecord.id,
-            ImageProvenance.post_id == post_inner.id,
-            post_inner.artist_id == artist_id,
+            ImageProvenance.source_id == Source.id,
+            Source.artist_id == artist_id,
         )
     return None
 
 
-def _gallery_images(rows, artists: dict[int, dict]) -> list[GalleryImage]:
-    """Build GalleryImage list from (record, posted_at, eff_date) rows + the
-    artist hydration map. Shared by scroll() and similar()."""
-    return [
-        GalleryImage(
-            id=record.id,
-            path=record.path,
-            sha256=record.sha256,
-            mime=record.mime,
-            width=record.width,
-            height=record.height,
-            created_at=record.created_at,
-            effective_date=eff_date,
-            posted_at=posted_at,
-            thumbnail_url=thumbnail_url(record.thumbnail_path, record.sha256, record.mime),
-            artist=artists.get(record.id),
-        )
-        for record, posted_at, eff_date in rows
-    ]
-
-
 async def _artists_for(session, image_ids: list[int]) -> dict[int, dict]:
     """Map image_id -> {"name","slug"} via the canonical
     image_record.artist_id (FC-2d-vii-c). Bounded by page size."""
@@ -290,62 +117,56 @@ class GalleryService:
         self,
         cursor: str | None,
         limit: int = 50,
-        tag_ids: list[int] | None = None,
+        tag_id: int | None = None,
         post_id: int | None = None,
         artist_id: int | None = None,
-        media_type: str | None = None,
-        sort: str = "newest",
-        platform: str | None = None,
-        untagged: bool = False,
-        no_artist: bool = False,
-        date_from: datetime | None = None,
-        date_to: datetime | None = None,
     ) -> GalleryPage:
         if limit < 1 or limit > 200:
             raise ValueError("limit must be between 1 and 200")
-        _require_single_filter(tag_ids, post_id, artist_id)
+        _require_single_filter(tag_id, post_id, artist_id)
 
-        eff = _effective_date_col()
-        stmt = select(ImageRecord, Post.post_date, eff.label("eff"))
-        stmt = _outer_join_primary_post(stmt)
-        stmt = _apply_scope(
-            stmt, tag_ids=tag_ids, post_id=post_id,
-            artist_id=artist_id, media_type=media_type,
-            platform=platform, untagged=untagged, no_artist=no_artist,
-            date_from=date_from, date_to=date_to,
-        )
+        stmt = select(ImageRecord)
+        if tag_id is not None:
+            stmt = stmt.join(image_tag, image_tag.c.image_record_id == ImageRecord.id).where(
+                image_tag.c.tag_id == tag_id
+            )
+        prov = _provenance_clause(post_id, artist_id)
+        if prov is not None:
+            stmt = stmt.where(prov)
 
-        descending = sort != "oldest"
         if cursor:
             cur_ts, cur_id = decode_cursor(cursor)
-            # The cursor is just (last eff, last id); the request's sort
-            # decides which side of it the next page lies on.
-            if descending:
-                stmt = stmt.where(
-                    or_(eff < cur_ts, and_(eff == cur_ts, ImageRecord.id < cur_id))
-                )
-            else:
-                stmt = stmt.where(
-                    or_(eff > cur_ts, and_(eff == cur_ts, ImageRecord.id > cur_id))
+            stmt = stmt.where(
+                or_(
+                    ImageRecord.created_at < cur_ts,
+                    and_(ImageRecord.created_at == cur_ts, ImageRecord.id < cur_id),
                 )
+            )
 
-        if descending:
-            stmt = stmt.order_by(eff.desc(), ImageRecord.id.desc())
-        else:
-            stmt = stmt.order_by(eff.asc(), ImageRecord.id.asc())
-        stmt = stmt.limit(limit + 1)
-        rows = (await self.session.execute(stmt)).all()
+        stmt = stmt.order_by(ImageRecord.created_at.desc(), ImageRecord.id.desc()).limit(limit + 1)
+        rows = (await self.session.execute(stmt)).scalars().all()
 
         next_cursor = None
         if len(rows) > limit:
-            last_record, _last_posted_at, last_eff = rows[limit - 1]
-            next_cursor = encode_cursor(last_eff, last_record.id)
+            last = rows[limit - 1]
+            next_cursor = encode_cursor(last.created_at, last.id)
             rows = rows[:limit]
 
-        artists = await _artists_for(
-            self.session, [r[0].id for r in rows]
-        )
-        images = _gallery_images(rows, artists)
+        artists = await _artists_for(self.session, [r.id for r in rows])
+        images = [
+            GalleryImage(
+                id=r.id,
+                path=r.path,
+                sha256=r.sha256,
+                mime=r.mime,
+                width=r.width,
+                height=r.height,
+                created_at=r.created_at,
+                thumbnail_url=thumbnail_url(r.sha256, r.mime),
+                artist=artists.get(r.id),
+            )
+            for r in rows
+        ]
         return GalleryPage(
             images=images,
             next_cursor=next_cursor,
@@ -354,205 +175,55 @@ class GalleryService:
 
     async def timeline(
         self,
-        tag_ids: list[int] | None = None,
+        tag_id: int | None = None,
         post_id: int | None = None,
         artist_id: int | None = None,
-        media_type: str | None = None,
-        platform: str | None = None,
-        untagged: bool = False,
-        no_artist: bool = False,
-        date_from: datetime | None = None,
-        date_to: datetime | None = None,
     ) -> list[TimelineBucket]:
-        eff = _effective_date_col()
-        year_col = func.date_part("year", eff).label("yr")
-        month_col = func.date_part("month", eff).label("mo")
+        year_col = func.date_part("year", ImageRecord.created_at).label("yr")
+        month_col = func.date_part("month", ImageRecord.created_at).label("mo")
         stmt = select(
             year_col, month_col, func.count(ImageRecord.id).label("cnt")
         )
-        stmt = _outer_join_primary_post(stmt)
-        _require_single_filter(tag_ids, post_id, artist_id)
-        stmt = _apply_scope(
-            stmt, tag_ids=tag_ids, post_id=post_id,
-            artist_id=artist_id, media_type=media_type,
-            platform=platform, untagged=untagged, no_artist=no_artist,
-            date_from=date_from, date_to=date_to,
-        )
+        _require_single_filter(tag_id, post_id, artist_id)
+        if tag_id is not None:
+            stmt = stmt.join(image_tag, image_tag.c.image_record_id == ImageRecord.id).where(
+                image_tag.c.tag_id == tag_id
+            )
+        prov = _provenance_clause(post_id, artist_id)
+        if prov is not None:
+            stmt = stmt.where(prov)
         stmt = stmt.group_by(year_col, month_col).order_by(year_col.desc(), month_col.desc())
         rows = (await self.session.execute(stmt)).all()
         return [TimelineBucket(year=int(r.yr), month=int(r.mo), count=int(r.cnt)) for r in rows]
 
     async def jump_cursor(
-        self, year: int, month: int, tag_ids: list[int] | None = None,
+        self, year: int, month: int, tag_id: int | None = None,
         post_id: int | None = None, artist_id: int | None = None,
-        media_type: str | None = None, sort: str = "newest",
-        platform: str | None = None, untagged: bool = False,
-        no_artist: bool = False, date_from: datetime | None = None,
-        date_to: datetime | None = None,
     ) -> str | None:
-        """Returns a cursor that, when passed to scroll() with the same sort,
-        positions at the first image of the given year-month. None if the
-        bucket is empty.
+        """Returns a cursor that, when passed to scroll(), positions at the
+        first image of the given year-month. None if the bucket is empty.
         """
         from sqlalchemy import extract
 
-        eff = _effective_date_col()
-        stmt = select(ImageRecord, eff.label("eff")).where(
-            extract("year", eff) == year,
-            extract("month", eff) == month,
+        stmt = select(ImageRecord).where(
+            extract("year", ImageRecord.created_at) == year,
+            extract("month", ImageRecord.created_at) == month,
         )
-        stmt = _outer_join_primary_post(stmt)
-        _require_single_filter(tag_ids, post_id, artist_id)
-        stmt = _apply_scope(
-            stmt, tag_ids=tag_ids, post_id=post_id,
-            artist_id=artist_id, media_type=media_type,
-            platform=platform, untagged=untagged, no_artist=no_artist,
-            date_from=date_from, date_to=date_to,
-        )
-        descending = sort != "oldest"
-        if descending:
-            stmt = stmt.order_by(eff.desc(), ImageRecord.id.desc())
-        else:
-            stmt = stmt.order_by(eff.asc(), ImageRecord.id.asc())
-        first = (await self.session.execute(stmt.limit(1))).first()
+        _require_single_filter(tag_id, post_id, artist_id)
+        if tag_id is not None:
+            stmt = stmt.join(image_tag, image_tag.c.image_record_id == ImageRecord.id).where(
+                image_tag.c.tag_id == tag_id
+            )
+        prov = _provenance_clause(post_id, artist_id)
+        if prov is not None:
+            stmt = stmt.where(prov)
+        stmt = stmt.order_by(ImageRecord.created_at.desc(), ImageRecord.id.desc()).limit(1)
+        first = (await self.session.execute(stmt)).scalar_one_or_none()
         if first is None:
             return None
-        record, eff_date = first
-        # Cursor is exclusive; nudge the id one past the boundary row (in the
-        # scan direction) so the row itself is the first result of scroll().
-        boundary = record.id + 1 if descending else record.id - 1
-        return encode_cursor(eff_date, boundary)
-
-    async def facets(
-        self, *, tag_ids: list[int] | None = None,
-        post_id: int | None = None, artist_id: int | None = None,
-        media_type: str | None = None, platform: str | None = None,
-        untagged: bool = False, no_artist: bool = False,
-        date_from: datetime | None = None, date_to: datetime | None = None,
-    ) -> GalleryFacets:
-        """Live facet counts scoped to the current filter. Each facet GROUP is
-        computed with all OTHER active filters applied but its OWN selection
-        ignored ("minus-self"), so sibling options stay visible/switchable.
-        No outer join is needed — every clause is a correlated EXISTS or a
-        column predicate on ImageRecord.
-        """
-        _require_single_filter(tag_ids, post_id, artist_id)
-        common = {
-            "tag_ids": tag_ids, "post_id": post_id,
-            "artist_id": artist_id, "media_type": media_type,
-        }
-
-        # total — the full active filter (the headline result count).
-        total = (await self.session.execute(
-            _apply_scope(
-                select(func.count(ImageRecord.id)), **common,
-                platform=platform, untagged=untagged, no_artist=no_artist,
-                date_from=date_from, date_to=date_to,
-            )
-        )).scalar_one()
-
-        # platforms — scope minus the platform selection. Inner-join
-        # provenance→source and COUNT(DISTINCT image) per platform (a
-        # cross-posted image counts under each of its platforms).
-        plat_scope = {
-            **common, "untagged": untagged, "no_artist": no_artist,
-            "date_from": date_from, "date_to": date_to,
-        }
-        src = aliased(Source)
-        plat_stmt = (
-            select(src.platform, func.count(distinct(ImageRecord.id)))
-            .select_from(ImageRecord)
-            .join(ImageProvenance, ImageProvenance.image_record_id == ImageRecord.id)
-            .join(src, src.id == ImageProvenance.source_id)
-        )
-        plat_stmt = _apply_scope(plat_stmt, **plat_scope).group_by(src.platform)
-        platforms = [
-            {"value": p, "count": c}
-            for p, c in (await self.session.execute(plat_stmt)).all()
-        ]
-        # Unsourced (filesystem) bucket — same minus-platform scope.
-        unsourced = (await self.session.execute(
-            _apply_scope(
-                select(func.count(ImageRecord.id)), **plat_scope,
-                platform=UNSOURCED_PLATFORM,
-            )
-        )).scalar_one()
-        if unsourced:
-            platforms.append({"value": None, "count": unsourced})
-
-        # curation flags — each minus its OWN flag.
-        untagged_count = (await self.session.execute(
-            _apply_scope(
-                select(func.count(ImageRecord.id)), **common,
-                platform=platform, no_artist=no_artist,
-                date_from=date_from, date_to=date_to, untagged=True,
-            )
-        )).scalar_one()
-        no_artist_count = (await self.session.execute(
-            _apply_scope(
-                select(func.count(ImageRecord.id)), **common,
-                platform=platform, untagged=untagged,
-                date_from=date_from, date_to=date_to, no_artist=True,
-            )
-        )).scalar_one()
-
-        # date bounds — scope minus the date params (those drive the picker).
-        eff = _effective_date_col()
-        dmin, dmax = (await self.session.execute(
-            _apply_scope(
-                select(func.min(eff), func.max(eff)), **common,
-                platform=platform, untagged=untagged, no_artist=no_artist,
-            )
-        )).one()
-
-        return GalleryFacets(
-            total=total, platforms=platforms,
-            untagged=untagged_count, no_artist=no_artist_count,
-            date_min=dmin, date_max=dmax,
-        )
-
-    async def similar(
-        self, image_id: int, limit: int = 100, *,
-        tag_ids: list[int] | None = None, artist_id: int | None = None,
-        media_type: str | None = None, platform: str | None = None,
-        untagged: bool = False, no_artist: bool = False,
-        date_from: datetime | None = None, date_to: datetime | None = None,
-    ) -> list[GalleryImage] | None:
-        """Visual "more like this": images ranked by cosine distance to
-        `image_id`'s SigLIP embedding (pgvector, HNSW-indexed — alembic 0036).
-        No ML inference here; the embedding was computed at import.
-
-        Returns None if the source image doesn't exist (→ 404), [] if it has
-        no embedding (a video / not-yet-embedded). Composes with the Phase-1/2
-        scope filters (AND) but REPLACES the date sort — always nearest-first,
-        bounded to `limit` (no cursor; distance-ranking has no date cursor).
-        """
-        if limit < 1 or limit > 200:
-            raise ValueError("limit must be between 1 and 200")
-        src = await self.session.get(ImageRecord, image_id)
-        if src is None:
-            return None
-        if src.siglip_embedding is None:
-            return []
-
-        distance = ImageRecord.siglip_embedding.cosine_distance(src.siglip_embedding)
-        eff = _effective_date_col()
-        stmt = select(ImageRecord, Post.post_date, eff.label("eff"))
-        stmt = _outer_join_primary_post(stmt)
-        stmt = stmt.where(
-            ImageRecord.siglip_embedding.is_not(None),
-            ImageRecord.id != image_id,
-        )
-        stmt = _apply_scope(
-            stmt, tag_ids=tag_ids, post_id=None,
-            artist_id=artist_id, media_type=media_type,
-            platform=platform, untagged=untagged, no_artist=no_artist,
-            date_from=date_from, date_to=date_to,
-        )
-        stmt = stmt.order_by(distance.asc()).limit(limit)
-        rows = (await self.session.execute(stmt)).all()
-        artists = await _artists_for(self.session, [r[0].id for r in rows])
-        return _gallery_images(rows, artists)
+        # Cursor is exclusive; we encode a cursor with id+1 so the row itself
+        # is the first result in the next scroll().
+        return encode_cursor(first.created_at, first.id + 1)
 
     async def get_image_with_tags(self, image_id: int) -> dict | None:
         record = await self.session.get(ImageRecord, image_id)
@@ -565,23 +236,7 @@ class GalleryService:
             .order_by(Tag.kind.asc(), Tag.name.asc())
         )
         tags = (await self.session.execute(tag_stmt)).scalars().all()
-        # Fetch the canonical post.post_date for this image (if any) so
-        # the modal can show "Posted on <date>" alongside import date.
-        posted_at = None
-        if record.primary_post_id is not None:
-            posted_at = (await self.session.execute(
-                select(Post.post_date).where(Post.id == record.primary_post_id)
-            )).scalar_one_or_none()
         neighbors = await self._neighbors(record)
-        # Direct artist FK — used by the modal's ProvenancePanel as a
-        # fallback when ImageProvenance is empty (i.e., filesystem-
-        # imported images without a post-track provenance row). The
-        # source of truth for richer post-level data is still
-        # ImageProvenance/Post; this is just the "we at least know who
-        # made it" line.
-        artist = None
-        if record.artist_id is not None:
-            artist = await self.session.get(Artist, record.artist_id)
         return {
             "id": record.id,
             "path": record.path,
@@ -591,17 +246,9 @@ class GalleryService:
             "height": record.height,
             "size_bytes": record.size_bytes,
             "integrity_status": record.integrity_status,
-            # Phase 3: lets the modal hide the "Related"/find-similar surface
-            # for images that have no embedding yet (videos / pending ML).
-            "has_embedding": record.siglip_embedding is not None,
             "created_at": record.created_at.isoformat(),
-            "posted_at": posted_at.isoformat() if posted_at else None,
-            "thumbnail_url": thumbnail_url(record.thumbnail_path, record.sha256, record.mime),
+            "thumbnail_url": thumbnail_url(record.sha256, record.mime),
             "image_url": f"/images/{record.path.split('/images/', 1)[-1]}",
-            "artist": (
-                {"id": artist.id, "name": artist.name, "slug": artist.slug}
-                if artist is not None else None
-            ),
             "tags": [
                 {
                     "id": t.id,
@@ -615,34 +262,34 @@ class GalleryService:
         }
 
     async def _neighbors(self, record: ImageRecord) -> dict:
-        # The boundary image's sort key is materialized on the row now
-        # (alembic 0035) — read it directly instead of re-deriving COALESCE
-        # via an extra Post lookup.
-        boundary_eff = record.effective_date
-
-        eff = _effective_date_col()
-        prev_stmt = _outer_join_primary_post(
-            select(ImageRecord.id).where(
+        prev_stmt = (
+            select(ImageRecord.id)
+            .where(
                 or_(
-                    eff > boundary_eff,
+                    ImageRecord.created_at > record.created_at,
                     and_(
-                        eff == boundary_eff,
+                        ImageRecord.created_at == record.created_at,
                         ImageRecord.id > record.id,
                     ),
                 )
             )
-        ).order_by(eff.asc(), ImageRecord.id.asc()).limit(1)
-        next_stmt = _outer_join_primary_post(
-            select(ImageRecord.id).where(
+            .order_by(ImageRecord.created_at.asc(), ImageRecord.id.asc())
+            .limit(1)
+        )
+        next_stmt = (
+            select(ImageRecord.id)
+            .where(
                 or_(
-                    eff < boundary_eff,
+                    ImageRecord.created_at < record.created_at,
                     and_(
-                        eff == boundary_eff,
+                        ImageRecord.created_at == record.created_at,
                         ImageRecord.id < record.id,
                     ),
                 )
             )
-        ).order_by(eff.desc(), ImageRecord.id.desc()).limit(1)
+            .order_by(ImageRecord.created_at.desc(), ImageRecord.id.desc())
+            .limit(1)
+        )
         prev_id = (await self.session.execute(prev_stmt)).scalar_one_or_none()
         next_id = (await self.session.execute(next_stmt)).scalar_one_or_none()
         return {"prev_id": prev_id, "next_id": next_id}
@@ -651,11 +298,9 @@ class GalleryService:
 def _group_by_year_month(
     images: list[GalleryImage],
 ) -> list[tuple[int, int, list[int]]]:
-    """Group by effective_date's year/month so migrated content surfaces
-    in the publish-date buckets, not the FC-scan-date bucket."""
     groups: list[tuple[int, int, list[int]]] = []
     for img in images:
-        y, m = img.effective_date.year, img.effective_date.month
+        y, m = img.created_at.year, img.created_at.month
         if groups and groups[-1][0] == y and groups[-1][1] == m:
             groups[-1][2].append(img.id)
         else:

backend/app/services/importer.py

@@ -18,7 +18,6 @@ from pathlib import Path
 
 from PIL import Image
 from sqlalchemy import select
-from sqlalchemy.exc import IntegrityError
 from sqlalchemy.orm import Session
 
 from ..models import (
@@ -30,13 +29,7 @@ from ..models import (
     PostAttachment,
     Source,
 )
-from ..utils import safe_probe
-from ..utils.paths import (
-    derive_subdir,
-    derive_top_level_artist,
-    hash_suffixed_name,
-    safe_ext,
-)
+from ..utils.paths import derive_subdir, derive_top_level_artist, hash_suffixed_name
 from ..utils.phash import compute_phash, find_similar
 from ..utils.sidecar import find_sidecar, parse_sidecar
 from ..utils.slug import slugify
@@ -58,14 +51,7 @@ class SkipReason(StrEnum):
 
 @dataclass(frozen=True)
 class ImportResult:
-    # 'imported'   — new ImageRecord row created
-    # 'superseded' — existing ImageRecord row got the new file (larger) + sidecar
-    # 'attached'   — non-media saved as PostAttachment
-    # 'refreshed'  — deep scan re-applied sidecar / filled NULL phash / NULL
-    #                artist on an already-imported row (no new ImageRecord)
-    # 'skipped'    — no work done (true duplicate, too small, etc.)
-    # 'failed'     — pipeline error
-    status: str
+    status: str  # 'imported'|'skipped'|'failed'|'superseded'|'attached'
     image_id: int | None = None
     skip_reason: SkipReason | None = None
     error: str | None = None
@@ -85,13 +71,6 @@ def is_video(path: Path) -> bool:
     return path.suffix.lower() in VIDEO_EXTS
 
 
-def _safe_ext(path: Path) -> str:
-    """Conservatively extract a file extension for PostAttachment.ext
-    (varchar(32)). Thin wrapper over the shared `utils.paths.safe_ext` (kept for
-    the Path-typed call sites + the [[path_suffix_sanitize]] memory pointer)."""
-    return safe_ext(path)
-
-
 def _mime_for(path: Path) -> str:
     suffix = path.suffix.lower()
     image_mimes = {
@@ -147,163 +126,6 @@ class Importer:
         self.settings = settings
         self.deep = deep
         self.attachments = AttachmentStore(images_root)
-        # phash near-dup candidate cache. Archive imports call _import_media
-        # per-member; without this cache the per-member SELECT *FROM
-        # image_record WHERE phash IS NOT NULL fetch repeats N times and a
-        # large library × many-member archive blew past soft_time_limit
-        # (300s) — operator-flagged 2026-05-25. Loaded lazily on first
-        # need, appended to on every imported/superseded outcome, never
-        # invalidated mid-Importer (Importer instances are per-task /
-        # per-archive-import so cross-instance staleness is harmless).
-        self._phash_candidates: list[tuple] | None = None
-
-    def _phash_candidates_cache(self) -> list[tuple]:
-        """Cached `(phash, width, height, id)` rows from image_record.
-        Loaded on first call, appended-to on subsequent imported/
-        superseded outcomes. Soft-timeout pattern: an archive with N
-        members + a library of M existing rows used to do N × M-row
-        fetches (operator-flagged 2026-05-25); now it's exactly one.
-
-        The per-task lifecycle of Importer (instantiated fresh by
-        import_media_file) bounds the cache's staleness window: cross-
-        process changes (other workers importing concurrently) won't
-        be reflected, but that's the same race the un-cached version
-        had — `find_similar` is best-effort anyway."""
-        if self._phash_candidates is None:
-            rows = self.session.execute(
-                select(
-                    ImageRecord.phash,
-                    ImageRecord.width,
-                    ImageRecord.height,
-                    ImageRecord.id,
-                ).where(ImageRecord.phash.is_not(None))
-            ).all()
-            self._phash_candidates = [
-                (r.phash, r.width or 0, r.height or 0, r.id) for r in rows
-            ]
-        return self._phash_candidates
-
-    def _phash_cache_append(self, phash, width, height, image_id) -> None:
-        """Append a freshly-imported row to the cache so subsequent
-        members of the same archive can match against it."""
-        if self._phash_candidates is not None and phash is not None:
-            self._phash_candidates.append(
-                (phash, width or 0, height or 0, image_id)
-            )
-
-    def _get_or_create(self, stmt, factory):
-        """Race-safe find-or-create. Run `stmt` (scalar_one_or_none); if a
-        row exists, return it. Otherwise open a savepoint and INSERT
-        ``factory()``; on IntegrityError (a concurrent worker inserted the
-        same row first) roll the savepoint back — NOT the outer transaction,
-        which would lose the surrounding scan's progress — and re-run `stmt`
-        (scalar_one) to return the row the other worker created.
-
-        Centralizes the pattern shared by _find_or_create_source and
-        _find_or_create_post. The plain SELECT-then-INSERT version lost
-        races under the 5-min recovery sweep (operator-flagged
-        2026-05-26)."""
-        existing = self.session.execute(stmt).scalar_one_or_none()
-        if existing is not None:
-            return existing
-        sp = self.session.begin_nested()
-        try:
-            row = factory()
-            self.session.add(row)
-            self.session.flush()
-            sp.commit()
-            return row
-        except IntegrityError:
-            sp.rollback()
-            return self.session.execute(stmt).scalar_one()
-
-    def _find_or_create_source(
-        self, *, artist_id: int, platform: str, url: str,
-    ) -> Source:
-        """Race-safe find-or-create on `source` keyed by
-        (artist_id, platform, url) — the same key as the
-        `uq_source_artist_platform_url` constraint.
-
-        Two concurrent workers processing different files in the same
-        post can both find no existing Source row then both INSERT,
-        which trips the unique constraint and poisons the session with
-        `psycopg.errors.UniqueViolation`. Operator-flagged 2026-05-26.
-
-        Pattern: select; if absent, open a savepoint and INSERT.
-        On IntegrityError, roll the savepoint back (NOT the outer
-        transaction, which would lose the surrounding scan's progress)
-        and re-select — the concurrent op just created the row we
-        wanted, so the second select will find it.
-        """
-        stmt = select(Source).where(
-            Source.artist_id == artist_id,
-            Source.platform == platform,
-            Source.url == url,
-        )
-        return self._get_or_create(
-            stmt,
-            lambda: Source(artist_id=artist_id, platform=platform, url=url),
-        )
-
-    def _lookup_source_for_sidecar(
-        self, *, artist_id: int, platform: str,
-    ) -> Source | None:
-        """Find the real subscription Source for (artist, platform), or
-        None if no subscription exists.
-
-        Pre-alembic-0030 this method would CREATE a synthetic
-        `sidecar:<platform>:<slug>` Source when no real one existed —
-        because `Post.source_id` was NOT NULL and the importer needed
-        something to attach Posts to. Alembic 0030 relaxed both
-        `Post.source_id` and `ImageProvenance.source_id` to nullable, so
-        synthetic anchors are obsolete; the importer now leaves
-        source_id as None when no subscription exists for the (artist,
-        platform). Operator-asked 2026-06-01: synthetic Sources had
-        leaked into the Subscriptions UI as phantom subscriptions and
-        the operator wanted the data model to truthfully say "this
-        content has no live subscription."
-        """
-        stmt = (
-            select(Source)
-            .where(
-                Source.artist_id == artist_id,
-                Source.platform == platform,
-            )
-            .order_by(Source.id.asc())
-            .limit(1)
-        )
-        return self.session.execute(stmt).scalar_one_or_none()
-
-    def _find_or_create_post(
-        self, *, source_id: int | None, external_post_id: str,
-        artist_id: int,
-    ) -> Post:
-        """Race-safe find-or-create on `post`. Keyed by
-        (source_id, external_post_id) when source_id is set — the
-        `uq_post_source_external_id` constraint guards. For NULL-source
-        posts the existence check matches on (artist_id, external_post_id),
-        which the partial unique index `uq_post_artist_external_id_null_source`
-        (alembic 0030) guards. Same savepoint + IntegrityError-recovery
-        pattern as the rest of the helpers."""
-        if source_id is not None:
-            stmt = select(Post).where(
-                Post.source_id == source_id,
-                Post.external_post_id == external_post_id,
-            )
-        else:
-            stmt = select(Post).where(
-                Post.source_id.is_(None),
-                Post.artist_id == artist_id,
-                Post.external_post_id == external_post_id,
-            )
-        return self._get_or_create(
-            stmt,
-            lambda: Post(
-                source_id=source_id,
-                artist_id=artist_id,
-                external_post_id=external_post_id,
-            ),
-        )
 
     def import_one(self, source: Path) -> ImportResult:
         """Dispatch by kind. Media → normal pipeline. Archive → extract
@@ -343,15 +165,30 @@ class Importer:
             return None
         sd = parse_sidecar(data)
         platform = sd.platform or "unknown"
-        src = self._lookup_source_for_sidecar(
-            artist_id=artist.id, platform=platform,
-        )
+        url = sd.post_url or f"sidecar:{platform}"
+        src = self.session.execute(
+            select(Source).where(
+                Source.artist_id == artist.id,
+                Source.platform == platform,
+                Source.url == url,
+            )
+        ).scalar_one_or_none()
+        if src is None:
+            src = Source(artist_id=artist.id, platform=platform, url=url)
+            self.session.add(src)
+            self.session.flush()
         epid = sd.external_post_id or sc.stem
-        return self._find_or_create_post(
-            source_id=src.id if src else None,
-            external_post_id=epid,
-            artist_id=artist.id,
-        )
+        post = self.session.execute(
+            select(Post).where(
+                Post.source_id == src.id,
+                Post.external_post_id == epid,
+            )
+        ).scalar_one_or_none()
+        if post is None:
+            post = Post(source_id=src.id, external_post_id=epid)
+            self.session.add(post)
+            self.session.flush()
+        return post
 
     def _capture_attachment(
         self, source: Path, *, post: Post | None = None,
@@ -361,19 +198,10 @@ class Importer:
             artist = self._resolve_artist(source)
             post = self._post_for_sidecar(source, artist)
         sha = _sha256_of(source)
-        select_existing = select(PostAttachment).where(PostAttachment.sha256 == sha)
-        existing = self.session.execute(select_existing).scalar_one_or_none()
-        if existing is not None:
-            self.session.commit()
-            return ImportResult(status="attached")
-        # Savepoint + IntegrityError recovery — PostAttachment.sha256 is
-        # UNIQUE, so two workers can both pass the SELECT and only the
-        # second INSERT fails. Without savepoint, the outer transaction
-        # poisons and the calling task crashes. attachments.store is
-        # sha-addressed so both workers race to write the same target
-        # path; shutil.copy2 + rename is idempotent. Audit 2026-06-02.
-        sp = self.session.begin_nested()
-        try:
+        existing = self.session.execute(
+            select(PostAttachment).where(PostAttachment.sha256 == sha)
+        ).scalar_one_or_none()
+        if existing is None:
             stored = self.attachments.store(source, sha)
             self.session.add(PostAttachment(
                 post_id=post.id if post else None,
@@ -381,99 +209,38 @@ class Importer:
                 sha256=sha,
                 path=stored,
                 original_filename=source.name,
-                ext=_safe_ext(source),
+                ext=source.suffix.lower(),
                 mime=_mime_for(source),
                 size_bytes=source.stat().st_size,
             ))
             self.session.flush()
-            sp.commit()
-        except IntegrityError:
-            sp.rollback()
-            # Lost the race — the other worker's row is canonical.
-            self.session.execute(select_existing).scalar_one()
         self.session.commit()
         return ImportResult(status="attached")
 
-    def _import_archive(
-        self, source: Path, *,
-        artist: Artist | None = None,
-        source_row: Source | None = None,
-    ) -> ImportResult:
-        # Layer-3 isolation: bomb-size guard + integrity test in a
-        # spawned child BEFORE extracting in this process. A
-        # decompression bomb or a native-lib crash on a malformed
-        # archive is contained to the child; we reject the file cleanly
-        # instead of OOMing/segfaulting the import worker. extract_archive
-        # is already fail-soft for plain exceptions, so this only adds
-        # the hard-crash protection.
-        #
-        # Audit 2026-06-02: optional artist/source_row kwargs let the
-        # download path thread its explicit subscription context
-        # through instead of having _resolve_artist re-derive from
-        # path-walk (which works by coincidence today because gallery-dl
-        # lays files out under /images/<artist_slug>/...). Filesystem
-        # import still calls bare _import_archive(source) and falls
-        # back to the path-walk derivation as before.
-        probe = safe_probe.probe_archive(source)
-        if not probe.ok:
-            if probe.crashed:
-                return ImportResult(
-                    status="failed",
-                    error=f"archive probe crashed/timed out: {probe.reason}",
-                )
-            # Clean rejection (bomb cap exceeded, integrity mismatch):
-            # still preserve the archive file itself as an attachment so
-            # nothing silently vanishes, matching extract_archive's
-            # fail-soft contract.
-            artist_use = artist if artist is not None else self._resolve_artist(source)
-            post = self._post_for_sidecar(source, artist_use)
-            self._capture_attachment(
-                source, post=post, artist=artist_use, resolved=True,
-            )
-            reason = f"archive probe rejected, captured unextracted: {probe.reason}"
-            log.warning("%s: %s", source.name, reason)
-            return ImportResult(status="attached", error=reason)
-
-        artist_use = artist if artist is not None else self._resolve_artist(source)
-        post = self._post_for_sidecar(source, artist_use)
+    def _import_archive(self, source: Path) -> ImportResult:
+        artist = self._resolve_artist(source)
+        post = self._post_for_sidecar(source, artist)
         member_ids: list[int] = []
-        member_total = 0
         with extract_archive(source) as members:
             for _name, member_path in members:
-                member_total += 1
                 if not is_supported(member_path):
                     continue  # non-media preserved via the stored archive
-                res = self._import_media(
-                    member_path, source, explicit_source=source_row,
-                )
+                res = self._import_media(member_path, source)
                 if res.status in ("imported", "superseded") and res.image_id:
                     member_ids.append(res.image_id)
         # Preserve the archive itself (links to the same Post/Artist).
         self._capture_attachment(
-            source, post=post, artist=artist_use, resolved=True
+            source, post=post, artist=artist, resolved=True
         )
         if member_ids:
             return ImportResult(
                 status="imported", image_id=member_ids[0],
                 member_image_ids=member_ids,
             )
-        # No images landed — surface WHY so a post showing "no images" beside an
-        # archive is diagnosable instead of silent. Zero members usually means
-        # the extractor backend is missing/failed (unar for rar, py7zr for 7z)
-        # or the file is corrupt; non-zero-but-no-images means it held only
-        # non-media files.
-        reason = (
-            "archive extracted but held no supported image/video members"
-            if member_total
-            else "archive yielded no members (unsupported/corrupt, or the "
-            "extractor backend failed)"
-        )
-        log.warning("%s: %s", source.name, reason)
-        return ImportResult(status="attached", error=reason)
+        return ImportResult(status="attached")
 
     def _import_media(
-        self, source: Path, attribution_path: Path,
-        *, explicit_source: Source | None = None,
+        self, source: Path, attribution_path: Path
     ) -> ImportResult:
         """The media import pipeline (filters, dedup, copy, provenance).
 
@@ -490,25 +257,7 @@ class Importer:
         # Compute file dimensions (images only) and apply filters.
         width = height = None
         has_alpha = False
-        if is_video(source):
-            # Layer-3 isolation: validate the container via ffprobe (a
-            # separate process) before the rest of the pipeline touches
-            # it. A corrupt video that would crash a decoder is rejected
-            # cleanly here, and we capture width/height for free (the
-            # importer didn't previously record video dimensions).
-            probe = safe_probe.probe_video(source)
-            if not probe.ok:
-                if probe.crashed:
-                    return ImportResult(
-                        status="failed",
-                        error=f"video probe crashed/timed out: {probe.reason}",
-                    )
-                return ImportResult(
-                    status="skipped", skip_reason=SkipReason.invalid_image,
-                    error=probe.reason,
-                )
-            width, height = probe.width, probe.height
-        else:
+        if not is_video(source):
             try:
                 with Image.open(source) as im:
                     im.verify()
@@ -531,18 +280,7 @@ class Importer:
                 )
 
             if self.settings.skip_transparent and has_alpha:
-                try:
-                    pct = self._transparency_pct(source)
-                except OSError as exc:
-                    # PIL.verify() at line 263 only validates header structure;
-                    # truncated/corrupt pixel data only surfaces when load()
-                    # actually decodes (here via getchannel('A')). Convert to
-                    # invalid_image skip so the Celery autoretry loop doesn't
-                    # bounce the same broken file forever.
-                    return ImportResult(
-                        status="skipped", skip_reason=SkipReason.invalid_image,
-                        error=f"PIL load failed during transparency check: {exc}",
-                    )
+                pct = self._transparency_pct(source)
                 if pct >= self.settings.transparency_threshold:
                     return ImportResult(
                         status="skipped", skip_reason=SkipReason.too_transparent,
@@ -564,18 +302,21 @@ class Importer:
         # Perceptual near-dup (images only; videos keep phash NULL).
         phash = None
         if not is_video(source):
-            try:
-                with Image.open(source) as im:
-                    phash = compute_phash(im)
-            except OSError as exc:
-                # Same rationale as the transparency-check guard above:
-                # broken-pixel-data files pass verify() but blow up here.
-                return ImportResult(
-                    status="skipped", skip_reason=SkipReason.invalid_image,
-                    error=f"PIL load failed during phash compute: {exc}",
-                )
+            with Image.open(source) as im:
+                phash = compute_phash(im)
             if phash is not None:
-                candidates = self._phash_candidates_cache()
+                cand_rows = self.session.execute(
+                    select(
+                        ImageRecord.phash,
+                        ImageRecord.width,
+                        ImageRecord.height,
+                        ImageRecord.id,
+                    ).where(ImageRecord.phash.is_not(None))
+                ).all()
+                candidates = [
+                    (c.phash, c.width or 0, c.height or 0, c.id)
+                    for c in cand_rows
+                ]
                 rel, match_id = find_similar(
                     phash, width or 0, height or 0,
                     candidates, self.settings.phash_threshold,
@@ -609,7 +350,6 @@ class Importer:
         )
         self.session.add(record)
         self.session.flush()
-        self._phash_cache_append(phash, width, height, record.id)
 
         # Folder→artist (anchored to attribution_path).
         artist = None
@@ -620,15 +360,7 @@ class Importer:
             artist = self._attach_artist(record, artist_name)
 
         # Sidecar provenance (best-effort; never fails the import).
-        # explicit_source lets the FC-3c download path bind the new
-        # ImageProvenance row to its subscription Source instead of
-        # having _apply_sidecar re-derive via _lookup_source_for_sidecar.
-        # Audit 2026-06-02 — archive members extracted from a
-        # subscription-downloaded zip previously lost subscription
-        # linkage if the on-disk layout didn't match assumptions.
-        self._apply_sidecar(
-            record, attribution_path, artist, explicit_source=explicit_source,
-        )
+        self._apply_sidecar(record, attribution_path, artist)
 
         # Thumbnail is queued separately by the calling task; the importer
         # does not generate thumbnails inline so the import queue stays moving.
@@ -641,27 +373,13 @@ class Importer:
     ) -> ImportResult:
         """Deep scan: backfill phash/provenance/artist on an
         already-imported record. METADATA ONLY — never re-runs the pHash
-        near-dup / supersede path. NULL-only on phash/artist, additive on
-        sidecar Post/Source/ImageProvenance (via _apply_sidecar).
-        Idempotent: a second deep-scan over the same file finds nothing
-        to refresh and is a no-op.
-
-        Returns status="refreshed" so the UI can surface the work done
-        instead of the prior misleading "skipped/duplicate_hash" reading.
-        Operator-flagged 2026-05-25 — IR has had this; FC inherited it
-        as a no-op skip during the original port and the UI showed deep
-        scan as "completed with no changes" even when sidecar metadata
-        actually got re-applied to N existing rows.
-        """
+        near-dup / supersede path. NULL-only, idempotent."""
         if existing.phash is None and not is_video(source):
             try:
                 with Image.open(source) as im:
                     ph = compute_phash(im)
                 if ph is not None:
                     existing.phash = ph
-                    # Promoted from NULL to non-NULL → cache is now stale
-                    # (this row would newly qualify for the candidates set).
-                    self._phash_candidates = None
             except Exception as exc:
                 log.warning("deep rephash failed for %s: %s", source, exc)
 
@@ -674,7 +392,10 @@ class Importer:
 
         self._apply_sidecar(existing, attribution_path, artist)
         self.session.commit()
-        return ImportResult(status="refreshed", image_id=existing.id)
+        return ImportResult(
+            status="skipped", skip_reason=SkipReason.duplicate_hash,
+            image_id=existing.id, error="deep: re-derived",
+        )
 
     def attach_in_place(
         self,
@@ -692,36 +413,16 @@ class Importer:
         them through. The sidecar JSON gallery-dl emits next to each
         downloaded file is read by `_apply_sidecar` via `find_sidecar`.
 
-        File-type dispatch parity with `import_one` (FC-2d-iii): zips,
-        PDFs, audio etc. become PostAttachments; archives are extracted.
-        Without this dispatch, gallery-dl-downloaded non-media bounced
-        back as `skipped+invalid_image`, which DownloadService counted
-        as an ingest error and flipped otherwise-successful runs to
-        status="error". Operator-flagged 2026-06-02 after a Lustria
-        patreon run with a 94MB OST zip went red despite 21 successful
-        image attaches.
-
         Caller's responsibilities after this returns:
           - duplicate_hash / duplicate_phash skip → delete the on-disk file
           - superseded → file stays where it is (now canonical)
           - imported → file stays where it is
-          - attached → the file's been copied into the attachments store;
-            caller may delete the on-disk original (mirrors duplicate_hash)
           - failed → file untouched; caller decides
         """
-        if path.suffix.lower() == ".json":
+        if not is_supported(path):
             return ImportResult(
                 status="skipped", skip_reason=SkipReason.invalid_image,
-                error="sidecar json is metadata, not content",
-            )
-        if is_archive(path):
-            return self._import_archive(
-                path, artist=artist, source_row=source,
-            )
-        if not is_supported(path):
-            post = self._post_for_sidecar(path, artist) if artist else None
-            return self._capture_attachment(
-                path, post=post, artist=artist, resolved=True,
+                error=f"unsupported extension {path.suffix}",
             )
 
         # Format / dimension / transparency filters (mirror _import_media).
@@ -778,7 +479,18 @@ class Importer:
             except Exception:
                 phash = None
             if phash is not None:
-                candidates = self._phash_candidates_cache()
+                cand_rows = self.session.execute(
+                    select(
+                        ImageRecord.phash,
+                        ImageRecord.width,
+                        ImageRecord.height,
+                        ImageRecord.id,
+                    ).where(ImageRecord.phash.is_not(None))
+                ).all()
+                candidates = [
+                    (c.phash, c.width or 0, c.height or 0, c.id)
+                    for c in cand_rows
+                ]
                 rel, match_id = find_similar(
                     phash, width or 0, height or 0,
                     candidates, self.settings.phash_threshold,
@@ -793,8 +505,7 @@ class Importer:
                 if rel == "smaller_exists":
                     target = self.session.get(ImageRecord, match_id)
                     self._supersede(
-                        target, path, sha, phash, width, height,
-                        new_path=path, artist=artist, source_row=source,
+                        target, path, sha, phash, width, height, new_path=path
                     )
                     return ImportResult(status="superseded", image_id=match_id)
 
@@ -814,7 +525,6 @@ class Importer:
             record.artist_id = artist.id
         self.session.add(record)
         self.session.flush()
-        self._phash_cache_append(phash, width, height, record.id)
 
         # Sidecar provenance (best-effort). When `source` is passed, link
         # the post to that subscription Source instead of creating a new
@@ -909,16 +619,30 @@ class Importer:
             src = explicit_source
         else:
             platform = sd.platform or "unknown"
-            src = self._lookup_source_for_sidecar(
-                artist_id=artist.id, platform=platform,
-            )
+            url = sd.post_url or f"sidecar:{platform}"
+            src = self.session.execute(
+                select(Source).where(
+                    Source.artist_id == artist.id,
+                    Source.platform == platform,
+                    Source.url == url,
+                )
+            ).scalar_one_or_none()
+            if src is None:
+                src = Source(artist_id=artist.id, platform=platform, url=url)
+                self.session.add(src)
+                self.session.flush()
 
         epid = sd.external_post_id or sc.stem
-        post = self._find_or_create_post(
-            source_id=src.id if src else None,
-            external_post_id=epid,
-            artist_id=artist.id,
-        )
+        post = self.session.execute(
+            select(Post).where(
+                Post.source_id == src.id,
+                Post.external_post_id == epid,
+            )
+        ).scalar_one_or_none()
+        if post is None:
+            post = Post(source_id=src.id, external_post_id=epid)
+            self.session.add(post)
+            self.session.flush()
         if sd.post_url is not None:
             post.post_url = sd.post_url
         if sd.post_title is not None:
@@ -931,15 +655,6 @@ class Importer:
             post.attachment_count = sd.attachment_count
         post.raw_metadata = sd.raw
 
-        # Race-safe (image_record_id, post_id) upsert — mirrors the
-        # _find_or_create_source/post savepoint pattern. The plain
-        # SELECT-then-INSERT pattern lost a race when two workers ran
-        # _apply_sidecar on the same (image, post) pair (e.g. the 5-min
-        # recovery sweep re-enqueued a still-running long import), planting
-        # duplicates that then broke .scalar_one_or_none() on every later
-        # deep-scan rederive (MultipleResultsFound). Alembic 0021 adds the
-        # uq_image_provenance_image_post UNIQUE so this savepoint actually
-        # trips on collision.
         exists = self.session.execute(
             select(ImageProvenance.id).where(
                 ImageProvenance.image_record_id == record.id,
@@ -947,30 +662,16 @@ class Importer:
             )
         ).scalar_one_or_none()
         if exists is None:
-            sp = self.session.begin_nested()
-            try:
-                self.session.add(
-                    ImageProvenance(
-                        image_record_id=record.id,
-                        post_id=post.id,
-                        source_id=src.id if src else None,
-                        captured_metadata=sd.raw,
-                    )
+            self.session.add(
+                ImageProvenance(
+                    image_record_id=record.id,
+                    post_id=post.id,
+                    source_id=src.id,
+                    captured_metadata=sd.raw,
                 )
-                self.session.flush()
-                sp.commit()
-            except IntegrityError:
-                sp.rollback()
+            )
         if record.primary_post_id is None:
             record.primary_post_id = post.id
-        # Keep the denormalized gallery sort key (alembic 0035) aligned with
-        # the primary post's publish date so /scroll orders off
-        # ix_image_record_effective_date instead of COALESCE-ing across the
-        # post join. Only override when THIS post is the primary AND carries
-        # a date; otherwise the column keeps its created_at-equivalent server
-        # default (matches the old COALESCE(post_date, created_at) fallback).
-        if record.primary_post_id == post.id and post.post_date is not None:
-            record.effective_date = post.post_date
         self.session.flush()
 
     def _copy_to_library(
@@ -997,22 +698,11 @@ class Importer:
         self, existing: ImageRecord, source: Path, sha: str,
         phash: str, width: int | None, height: int | None,
         *, new_path: Path | None = None,
-        artist: Artist | None = None,
-        source_row: Source | None = None,
     ) -> None:
         """Replace `existing`'s file with the larger `source`, keeping the
         row id (so tags/series/curation stay attached). ML is cleared so
         the import task re-derives it on the new pixels.
 
-        After the file swap, the new file's adjacent gallery-dl sidecar
-        (if any) is applied via _apply_sidecar — operator-flagged
-        2026-05-25: scanning a GS download dir with smaller IR-migrated
-        images on the receiving end used to swap files but lose the GS
-        sidecar's post metadata entirely. _apply_sidecar is additive
-        (find-or-create Post / Source / ImageProvenance, NULL-only
-        primary_post_id update) so any pre-existing Post linkage
-        survives untouched.
-
         If `new_path` is provided, `source` is assumed to ALREADY be at
         that path (FC-3c attach_in_place case) — skip the copy step.
         Otherwise the file is copied via _copy_to_library."""
@@ -1041,32 +731,6 @@ class Importer:
         # created_at intentionally preserved; updated_at auto-bumps.
         self.session.flush()
         self.session.commit()
-        # The phash candidate cache (used to avoid N+1 selects during
-        # archive imports) is now stale for `existing.id` — the row's
-        # phash/dimensions changed. Invalidate; the next call re-fetches.
-        self._phash_candidates = None
-
-        # Sidecar enrichment from the new (larger) file's location.
-        # _apply_sidecar resolves artist from the sidecar itself if the
-        # existing row has none, and is internally guarded against
-        # missing-or-malformed sidecars (silent return).
-        # Audit 2026-06-02: thread artist/source_row from the
-        # download-path caller (attach_in_place smaller_exists branch)
-        # so the supersede preserves explicit subscription linkage
-        # instead of re-deriving via path-walk.
-        try:
-            self._apply_sidecar(
-                existing, source, artist, explicit_source=source_row,
-            )
-        except Exception as exc:
-            # Don't unwind the supersede DB swap if sidecar parsing
-            # blows up unexpectedly — the file replacement is the
-            # critical operation, sidecar is enrichment.
-            log.warning(
-                "sidecar enrichment failed during supersede of "
-                "image_record.id=%s from %s: %s",
-                existing.id, source, exc,
-            )
 
         for stale in (old_path, old_thumb):
             if not stale or stale == str(dest):
@@ -1082,26 +746,8 @@ class Importer:
                 pass
 
     def _transparency_pct(self, source: Path) -> float:
-        """Fraction of fully-transparent pixels in the image. 0.0 if no alpha.
-
-        For animated formats (multi-frame WebP / GIF / APNG), short-circuit
-        to 0.0 instead of decoding every frame. PIL's `getchannel("A")`
-        forces a full decode of all frames in an animated image, which for
-        a large animated WebP takes 5+ minutes and blows past the Celery
-        soft+hard time limits (300s/360s → SIGKILL). Operator-flagged
-        2026-05-26. Transparency analysis on a multi-frame image isn't
-        meaningful for art-curation purposes anyway — different frames
-        have different alpha — so the existing too_transparent skip rule
-        is bypassed entirely for animated content.
-        """
+        """Fraction of fully-transparent pixels in the image. 0.0 if no alpha."""
         with Image.open(source) as im:
-            if getattr(im, "is_animated", False):
-                log.info(
-                    "skipping transparency check for animated image %s "
-                    "(n_frames=%d) — avoids multi-frame decode timeout",
-                    source, getattr(im, "n_frames", 0),
-                )
-                return 0.0
             if im.mode not in ("RGBA", "LA") and not (
                 im.mode == "P" and "transparency" in im.info
             ):

backend/app/services/ingest_core.py

@@ -1,647 +0,0 @@
-"""Platform-agnostic native-ingest core (plan #706, build on #697/#703/#704/#705).
-
-The orchestration that drives a native subscription walk — page a feed →
-extract media → tiered skip (seen-ledger / on-disk / dead-letter) → download →
-mark-seen / record-failures / checkpoint-cursor → return a gallery-dl-shaped
-`DownloadResult`, across tick/backfill/recovery modes — is identical for every
-platform. Only four things are platform-specific, and they're INJECTED at
-construction by a thin adapter (e.g. `PatreonIngester`):
-
-  - `client`    — `.iter_posts(feed_id, cursor)` yielding `(post, included,
-                  page_cursor)` + `.extract_media(post, included) -> [media]`.
-  - `downloader`— `.download_post(post, media, artist_slug, is_seen,
-                  should_stop) -> [MediaOutcome]` (status in downloaded/
-                  skipped_seen/skipped_disk/quarantined/error;
-                  `.path`/`.error`/`.post_id`). `should_stop()` is polled
-                  between media so the time-box is honoured mid-post.
-  - ledger      — `seen_model` + `failed_model` SQLAlchemy models (+ their
-                  on-conflict UNIQUE constraint names) and a `ledger_key(media)`.
-  - failure map — the adapter overrides `_failure_result` (platform exception
-                  → DownloadResult.error_type) and supplies `error_base` (the
-                  exception type the walk catches) + `platform` (result label).
-
-Everything DB touches a SHORT-LIVED sync session from the injected sessionmaker —
-never held across a network fetch ([[db-connection-held-across-subprocess]]).
-Plain-HTTP homelab: no secure-context Web API.
-"""
-
-from __future__ import annotations
-
-import json
-import logging
-import time
-from collections.abc import Callable
-
-from sqlalchemy import delete, func, select, text
-from sqlalchemy.dialects.postgresql import insert as pg_insert
-
-from .gallery_dl import DownloadResult, ErrorType, make_run_stats
-
-log = logging.getLogger(__name__)
-
-# Stop a tick after this many CONTIGUOUS already-have-it media (seen-ledger or
-# on-disk) — the cheap native equivalent of gallery-dl's `exit:20`, now free of
-# per-file HEADs. Headroom against paywalled/undownloadable items interleaving.
-_TICK_SEEN_THRESHOLD = 20
-
-# plan #705 #7: after this many failed download/validate attempts a media is
-# "dead-lettered" and skipped on routine tick/backfill walks (recovery still
-# re-attempts it). Stops a permanently-broken media re-erroring forever.
-DEAD_LETTER_THRESHOLD = 3
-# last_error is Text but bound it so a giant traceback doesn't bloat the row.
-_ERROR_MAX = 1000
-
-# plan #709: throttle the live-progress write to the running DownloadEvent to one
-# every ~5s — a steady cadence for the Downloads view regardless of how big/slow a
-# page is (page boundaries can be minutes apart on image-dense backfills, so a
-# page-tied update would lurch). Trivial churn (~one single-row UPDATE / 5s).
-_LIVE_PROGRESS_INTERVAL = 5.0
-
-
-class Ingester:
-    """Generic native-ingest orchestration. Subclass with a platform adapter
-    (see the module docstring) — or construct directly with the keyword seams."""
-
-    def __init__(
-        self,
-        *,
-        client,
-        downloader,
-        session_factory: Callable[[], object],
-        seen_model,
-        failed_model,
-        seen_constraint: str,
-        failed_constraint: str,
-        ledger_key: Callable[[object], str],
-        platform: str,
-        error_base: type[Exception],
-    ):
-        self.client = client
-        self.downloader = downloader
-        self.session_factory = session_factory
-        self._seen_model = seen_model
-        self._failed_model = failed_model
-        self._seen_constraint = seen_constraint
-        self._failed_constraint = failed_constraint
-        self._ledger_key = ledger_key
-        self._platform = platform
-        self._error_base = error_base
-
-    # -- public ------------------------------------------------------------
-
-    def run(
-        self,
-        *,
-        source_id: int,
-        campaign_id: str,
-        artist_slug: str,
-        url: str,
-        mode: str,
-        resume_cursor: str | None = None,
-        time_budget_seconds: float = 870.0,
-        seen_threshold: int = _TICK_SEEN_THRESHOLD,
-        posts_base: int = 0,
-        event_id: int | None = None,
-    ) -> DownloadResult:
-        """Walk + download for one source, returning a gallery-dl-shaped result.
-
-        `mode` is "tick" | "backfill" | "recovery". Recovery bypasses the tier-1
-        seen-ledger AND the dead-letter ledger (tier-2 disk still skips kept
-        files). The walk stops on:
-          - budget exhaustion (time_budget_seconds)         → TIMEOUT / PARTIAL
-          - tick early-out (seen_threshold contiguous seen)  → success
-          - reaching the bottom of the feed                  → success (rc 0)
-        A client-level failure (drift / auth / network) fails the whole run loud.
-        """
-        bypass_seen = mode == "recovery"
-        # Only deep walks checkpoint their cursor mid-flight (plan #705 #6); a
-        # tick has no resumable backfill state.
-        checkpoint = mode in ("backfill", "recovery")
-        ledger_key = self._ledger_key
-        start = time.monotonic()
-        last_live = start  # plan #709: last live-progress write timestamp
-        log_lines: list[str] = []
-        written: list[str] = []
-        quarantined_paths: list[str] = []
-        downloaded = 0
-        errors = 0
-        quarantined = 0
-        dead_lettered = 0
-        skipped_count = 0
-        posts_processed = 0
-        # Net-new posts THIS chunk for the live progress badge (plan #704 #5);
-        # excludes the re-walked resume page so _backfill_posts stays a monotonic
-        # absolute across chunks instead of an inflating sum. posts_processed
-        # stays the gross per-chunk count used for the run summary.
-        chunk_new_posts = 0
-        consecutive_seen = 0
-        emitted_cursor: str | None = None
-        reached_bottom = False
-        budget_hit = False
-        early_out = False
-        stopped = False  # plan #708 B4: operator hit Stop mid-walk
-        cancel_armed = False  # latched once we observe a live "running" state
-
-        def _result(
-            *, success: bool, return_code: int,
-            error_type: ErrorType | None, error_message: str | None,
-        ) -> DownloadResult:
-            # plan #704: return STRUCTURED data — phase 3 reads run_stats/cursor
-            # directly instead of regex-scraping a reconstructed stdout. stdout
-            # stays a human-readable summary (no fake `Cursor:` lines).
-            return DownloadResult(
-                success=success,
-                url=url,
-                artist_slug=artist_slug,
-                platform=self._platform,
-                files_downloaded=downloaded,
-                files_quarantined=quarantined,
-                quarantined_paths=list(quarantined_paths),
-                written_paths=written,
-                stdout="\n".join(log_lines),
-                stderr="",
-                return_code=return_code,
-                error_type=error_type,
-                error_message=error_message,
-                duration_seconds=time.monotonic() - start,
-                cursor=emitted_cursor,
-                posts_processed=posts_processed,
-                run_stats=make_run_stats(
-                    exit_code=return_code,
-                    downloaded_count=downloaded,
-                    skipped_count=skipped_count,
-                    per_item_failures=errors,
-                    quarantined_count=quarantined,
-                    dead_lettered_count=dead_lettered,
-                ),
-            )
-
-        try:
-            for post, included, page_cursor in self.client.iter_posts(
-                campaign_id, cursor=resume_cursor
-            ):
-                # Checkpoint the cursor that FETCHED this page the moment we
-                # START it — so a chunk cut mid-page resumes the page, not the one
-                # after it. Carried as DownloadResult.cursor (plan #704).
-                if page_cursor and page_cursor != emitted_cursor:
-                    emitted_cursor = page_cursor
-                    # plan #705 #6: persist the cursor at each page boundary so a
-                    # worker SIGKILL mid-chunk resumes near the crash, not the
-                    # chunk start. (phase 3 still writes the final cursor — same
-                    # value; this is the crash-safety net.) plan #704 #5: persist
-                    # the live posts count alongside it so the badge climbs DURING
-                    # the chunk, not only when it ends.
-                    if checkpoint:
-                        # plan #708 B4: an operator Stop pops `_backfill_state` —
-                        # bail at the page boundary (progress already checkpointed)
-                        # before more network work, so the live chunk halts
-                        # promptly instead of running to its time-box. LATCH on the
-                        # first observed "running" state, so a run invoked WITHOUT a
-                        # running state (a unit test, or a stale call) never
-                        # spuriously self-cancels. A short SELECT, never held.
-                        if self._still_running(source_id):
-                            cancel_armed = True
-                        elif cancel_armed:
-                            stopped = True
-                            break
-                        self._checkpoint_cursor(source_id, emitted_cursor)
-                        self._checkpoint_posts(source_id, posts_base + chunk_new_posts)
-
-                # Time-box check at the post boundary (coarse, like a gallery-dl
-                # chunk). Backfill/recovery resume from emitted_cursor next chunk.
-                if time.monotonic() - start >= time_budget_seconds:
-                    budget_hit = True
-                    break
-
-                posts_processed += 1
-                # The resume page (its cursor == resume_cursor) was already
-                # counted by the chunk that checkpointed it — don't re-count it
-                # into the persisted badge (plan #704 #5). First chunk has
-                # resume_cursor None, so everything counts.
-                if not (resume_cursor and page_cursor == resume_cursor):
-                    chunk_new_posts += 1
-                media = self.client.extract_media(post, included)
-                if not media:
-                    continue
-
-                keys = [ledger_key(m) for m in media]
-                # Recovery bypasses BOTH the seen-ledger AND the dead-letter
-                # ledger (the operator's "try everything again"); routine walks
-                # skip seen + dead media (tier-1 + tier-1.5, plan #705 #7).
-                dead = set() if bypass_seen else self._dead_keys(source_id, keys)
-                seen = (
-                    set()
-                    if bypass_seen
-                    else self._seen_keys(source_id, keys)
-                )
-                skip = seen | dead
-
-                def _is_skip(m, _skip=skip) -> bool:
-                    return ledger_key(m) in _skip
-
-                # Honour the time-box DURING a media-dense post too, not only at
-                # the per-post boundary below — else one heavy post can blow the
-                # chunk budget out to the Celery soft limit (Pocketacer, 2026-06-07).
-                outcomes = self.downloader.download_post(
-                    post, media, artist_slug, is_seen=_is_skip,
-                    should_stop=lambda: time.monotonic() - start >= time_budget_seconds,
-                )
-
-                to_mark: list[tuple[str, str]] = []
-                to_clear: list[str] = []  # recovered → drop any dead-letter row
-                to_fail: list[tuple[str, str, str]] = []  # (key, post_id, error)
-                for media_item, outcome in zip(media, outcomes, strict=False):
-                    key = ledger_key(media_item)
-                    if key in dead:
-                        dead_lettered += 1  # skipped because previously dead
-                    if outcome.status == "downloaded":
-                        downloaded += 1
-                        if outcome.path is not None:
-                            written.append(str(outcome.path))
-                        to_mark.append((key, media_item.post_id))
-                        to_clear.append(key)
-                        consecutive_seen = 0
-                    elif outcome.status == "skipped_disk":
-                        # Already on disk (a prior run). Reconcile the ledger so a
-                        # later tick skips it at tier-1 without a disk stat, but
-                        # do NOT re-feed it to phase 3 — attach_in_place would see
-                        # the duplicate sha256 and unlink the on-disk copy.
-                        to_mark.append((key, media_item.post_id))
-                        to_clear.append(key)
-                        skipped_count += 1
-                        consecutive_seen += 1
-                    elif outcome.status == "skipped_seen":
-                        skipped_count += 1
-                        consecutive_seen += 1
-                    elif outcome.status == "quarantined":
-                        # New content that failed validation (corrupt) — counted
-                        # distinctly so the run surfaces a real quarantined total.
-                        # Not marked seen (a later walk may re-fetch a fixed file);
-                        # it IS new content, so it breaks the run-of-seen. Counts
-                        # toward the dead-letter ledger (plan #705 #7).
-                        quarantined += 1
-                        if outcome.path is not None:
-                            quarantined_paths.append(str(outcome.path))
-                        to_fail.append((key, media_item.post_id, outcome.error or "quarantined"))
-                        consecutive_seen = 0
-                    elif outcome.status == "error":
-                        errors += 1
-                        to_fail.append((key, media_item.post_id, outcome.error or "error"))
-                        # An error neither advances nor resets the run-of-seen.
-
-                    if mode == "tick" and consecutive_seen >= seen_threshold:
-                        early_out = True
-                        break
-
-                # Persist ledger changes AFTER the network fetch, on short
-                # sessions: mark downloaded/on-disk seen, clear any dead-letter
-                # for recovered media, and record failures (plan #705 #7).
-                if to_mark:
-                    self._mark_seen(source_id, to_mark)
-                if to_clear:
-                    self._clear_failures(source_id, to_clear)
-                if to_fail:
-                    self._record_failures(source_id, to_fail)
-
-                # plan #709: time-throttled live progress to the running event so
-                # the Downloads view ticks ~every 5s, independent of page size.
-                now = time.monotonic()
-                if event_id is not None and (now - last_live) >= _LIVE_PROGRESS_INTERVAL:
-                    last_live = now
-                    self._write_live_progress(event_id, {
-                        "downloaded": downloaded,
-                        "skipped": skipped_count,
-                        "errors": errors,
-                        "quarantined": quarantined,
-                        "posts": posts_processed,
-                    })
-
-                if early_out:
-                    break
-            else:
-                reached_bottom = True
-        except self._error_base as exc:
-            # The platform's client-error base — _failure_result (adapter)
-            # maps it to a typed error.
-            return self._failure_result(exc, _result)
-
-        # plan #708 B4: a Stop already popped the backfill state (incl. cursor +
-        # posts), so don't re-write them — return PARTIAL (reads as "ok/progress",
-        # the lifecycle no-ops since state is gone) instead of a false "complete".
-        if stopped:
-            return _result(
-                success=False, return_code=-1,
-                error_type=ErrorType.PARTIAL,
-                error_message=f"Stopped by operator: {downloaded} file(s) this chunk",
-            )
-
-        # Final authoritative posts count for the badge — captures the last page
-        # after the last boundary write and the time-box break (plan #704 #5).
-        if checkpoint:
-            self._checkpoint_posts(source_id, posts_base + chunk_new_posts)
-
-        if errors:
-            log_lines.append(f"{errors} media item(s) failed")
-        if quarantined:
-            log_lines.append(f"{quarantined} media item(s) quarantined (invalid)")
-        if dead_lettered:
-            log_lines.append(f"{dead_lettered} media item(s) skipped (dead-lettered)")
-        log_lines.append(
-            f"{self._platform} ingest ({mode}): {downloaded} downloaded, "
-            f"{skipped_count} skipped, {quarantined} quarantined, "
-            f"{dead_lettered} dead-lettered, {errors} error(s), "
-            f"{posts_processed} post(s)"
-            + (", reached end" if reached_bottom else "")
-            + (", time-boxed" if budget_hit else "")
-        )
-
-        if budget_hit:
-            # A chunk that hit its time-box but made forward progress is a
-            # NORMAL chunk boundary, not a failure (PARTIAL → status "ok"); the
-            # next chunk resumes from the emitted cursor. No progress → TIMEOUT,
-            # which feeds download_service's backfill stall-guard. rc<0 mirrors
-            # subprocess TimeoutExpired so completion detection stays false.
-            made_progress = downloaded > 0 or emitted_cursor != resume_cursor
-            if made_progress:
-                return _result(
-                    success=False, return_code=-1,
-                    error_type=ErrorType.PARTIAL,
-                    error_message=(
-                        f"Backfill chunk: {downloaded} file(s) — continuing"
-                    ),
-                )
-            return _result(
-                success=False, return_code=-1,
-                error_type=ErrorType.TIMEOUT,
-                error_message="Chunk timed out with no progress",
-            )
-
-        # Normal success: reached the bottom, or a tick that early-outed. rc 0 +
-        # error_type None is REQUIRED for a backfill/recovery walk that reached
-        # the bottom to be marked COMPLETE by
-        # download_service._apply_backfill_lifecycle — so we return None even
-        # when downloaded == 0 (a re-confirming walk that found nothing new still
-        # completed). success=True maps to status "ok" regardless. A tick that
-        # early-outed also returns here; ticks never set backfill state so the
-        # lifecycle is a no-op for them.
-        return _result(
-            success=True, return_code=0,
-            error_type=None, error_message=None,
-        )
-
-    # -- preview (dry-run) -------------------------------------------------
-
-    def preview(
-        self,
-        source_id: int,
-        campaign_id: str,
-        *,
-        page_limit: int = 3,
-        sample_size: int = 10,
-    ) -> dict:
-        """Dry-run (plan #708 B4): walk up to `page_limit` pages and count media
-        NOT already in the seen/dead ledgers, WITHOUT downloading anything.
-
-        Read-only — only the seen/dead SELECTs touch the DB (short sessions). Lets
-        an operator gauge "is this source worth a backfill?" cheaply. Returns:
-            {total_new, posts_scanned, pages_scanned, has_more,
-             sample: [{title, date, new}, ...]}  # sample = posts with new media
-        A client-level failure (auth/drift) propagates to the caller.
-        """
-        total_new = 0
-        posts_scanned = 0
-        pages_scanned = 0
-        has_more = False
-        sample: list[dict] = []
-        unset = object()
-        last_page: object = unset
-        for post, included, page_cursor in self.client.iter_posts(
-            campaign_id, cursor=None
-        ):
-            if page_cursor != last_page:
-                last_page = page_cursor
-                pages_scanned += 1
-                if pages_scanned > page_limit:
-                    has_more = True
-                    pages_scanned = page_limit
-                    break
-            posts_scanned += 1
-            media = self.client.extract_media(post, included)
-            if not media:
-                continue
-            keys = [self._ledger_key(m) for m in media]
-            skip = self._seen_keys(source_id, keys) | self._dead_keys(source_id, keys)
-            new_count = sum(1 for m in media if self._ledger_key(m) not in skip)
-            total_new += new_count
-            if new_count > 0 and len(sample) < sample_size:
-                meta = self.client.post_meta(post)
-                sample.append(
-                    {
-                        "title": meta.get("title") or "(untitled)",
-                        "date": meta.get("date"),
-                        "new": new_count,
-                    }
-                )
-        return {
-            "total_new": total_new,
-            "posts_scanned": posts_scanned,
-            "pages_scanned": pages_scanned,
-            "has_more": has_more,
-            "sample": sample,
-        }
-
-    # -- failure mapping (adapter overrides) -------------------------------
-
-    def _failure_result(self, exc: Exception, _result) -> DownloadResult:
-        """Map a platform client-error to a typed failed DownloadResult. The base
-        gives a safe default; adapters override with their exception taxonomy."""
-        log.warning("%s ingest failed: %s", self._platform, exc)
-        return _result(
-            success=False, return_code=1,
-            error_type=ErrorType.UNKNOWN_ERROR, error_message=str(exc),
-        )
-
-    # -- seen-ledger (short-lived sessions) --------------------------------
-
-    def _seen_keys(self, source_id: int, keys: list[str]) -> set[str]:
-        """Which of `keys` are already in the seen-ledger for this source.
-
-        One short SELECT on its own session — opened and closed without any
-        network in between (the GETs happen after, in download_post).
-        """
-        if not keys:
-            return set()
-        with self.session_factory() as session:
-            rows = session.execute(
-                select(self._seen_model.filehash).where(
-                    self._seen_model.source_id == source_id,
-                    self._seen_model.filehash.in_(keys),
-                )
-            ).scalars().all()
-        return set(rows)
-
-    def _checkpoint_cursor(self, source_id: int, cursor: str) -> None:
-        """Persist the in-progress backfill cursor mid-walk (plan #705 #6).
-
-        ATOMIC, single-key UPDATE: cast the JSON column to jsonb, set just
-        `_backfill_cursor`, cast back — so it never clobbers operator config or
-        the other backfill keys (no read-modify-write race). The in-flight guard
-        means only this source's one download runs at a time; a concurrent
-        operator stop is benign (a stray cursor with no `_backfill_state` is
-        ignored by tick mode and cleared on the next start).
-        """
-        with self.session_factory() as session:
-            session.execute(
-                text(
-                    "UPDATE source SET config_overrides = jsonb_set("
-                    "  coalesce(config_overrides::jsonb, '{}'::jsonb),"
-                    "  '{_backfill_cursor}', to_jsonb(cast(:cur AS text))"
-                    ")::json WHERE id = :sid"
-                ),
-                {"cur": cursor, "sid": source_id},
-            )
-            session.commit()
-
-    def _write_live_progress(self, event_id: int, counts: dict) -> None:
-        """Throttled mid-walk write of live counts to the RUNNING download_event
-        (plan #709) so the Downloads view shows progress before the chunk
-        finishes. A short session (never held across the walk); the `status =
-        'running'` guard avoids clobbering an event phase 3 already finalized.
-        `metadata` is JSONB — jsonb_set sets just the `live` key, leaving the rest
-        for phase 3 to overwrite with the final run_stats."""
-        with self.session_factory() as session:
-            session.execute(
-                text(
-                    "UPDATE download_event SET metadata = jsonb_set("
-                    "  coalesce(metadata, '{}'::jsonb), '{live}',"
-                    "  cast(:live AS jsonb)) "
-                    "WHERE id = :eid AND status = 'running'"
-                ),
-                {"live": json.dumps(counts), "eid": event_id},
-            )
-            session.commit()
-
-    def _still_running(self, source_id: int) -> bool:
-        """True while the source is armed for a deep walk (plan #708 B4).
-
-        An operator Stop (`source_service.stop_backfill`) pops `_backfill_state`,
-        so a False here means "cancel this chunk now". One short SELECT on its own
-        session — never held across the walk
-        ([[db-connection-held-across-subprocess]])."""
-        with self.session_factory() as session:
-            state = session.execute(
-                text(
-                    "SELECT config_overrides::jsonb ->> '_backfill_state' "
-                    "FROM source WHERE id = :sid"
-                ),
-                {"sid": source_id},
-            ).scalar_one_or_none()
-        return state == "running"
-
-    def _checkpoint_posts(self, source_id: int, posts: int) -> None:
-        """Persist the live backfill posts-processed count mid-walk (plan #704 #5).
-
-        Same atomic single-key jsonb_set dance as _checkpoint_cursor, on the
-        `_backfill_posts` key (cast to a JSON number) — so the progress badge
-        climbs DURING a chunk without clobbering operator config or the cursor.
-        The ingester OWNS this key now; download_service no longer accumulates it
-        post-chunk (which lagged a whole chunk and over-counted the resume page).
-        """
-        with self.session_factory() as session:
-            session.execute(
-                text(
-                    "UPDATE source SET config_overrides = jsonb_set("
-                    "  coalesce(config_overrides::jsonb, '{}'::jsonb),"
-                    "  '{_backfill_posts}', to_jsonb(cast(:posts AS int))"
-                    ")::json WHERE id = :sid"
-                ),
-                {"posts": posts, "sid": source_id},
-            )
-            session.commit()
-
-    def _mark_seen(self, source_id: int, items: list[tuple[str, str]]) -> None:
-        """Idempotent upsert of (filehash, post_id) seen-ledger rows for a page.
-
-        ON CONFLICT DO NOTHING against the (source_id, filehash) UNIQUE so a
-        re-sighting — or a concurrent walk — is a harmless no-op
-        ([[scalar_one_or_none-duplicates]]: never check-then-insert without the
-        DB constraint backing it). De-dup the batch locally first so a single
-        page can't present the same key twice to one INSERT.
-        """
-        seen_local: set[str] = set()
-        values = []
-        for key, post_id in items:
-            if key in seen_local:
-                continue
-            seen_local.add(key)
-            values.append(
-                {"source_id": source_id, "filehash": key, "post_id": post_id}
-            )
-        if not values:
-            return
-        with self.session_factory() as session:
-            stmt = pg_insert(self._seen_model).values(values)
-            stmt = stmt.on_conflict_do_nothing(constraint=self._seen_constraint)
-            session.execute(stmt)
-            session.commit()
-
-    # -- dead-letter ledger (plan #705 #7) ---------------------------------
-
-    def _dead_keys(self, source_id: int, keys: list[str]) -> set[str]:
-        """Which of `keys` have failed >= DEAD_LETTER_THRESHOLD times (dead).
-        One short SELECT; recovery never calls this (it re-attempts dead media)."""
-        if not keys:
-            return set()
-        with self.session_factory() as session:
-            rows = session.execute(
-                select(self._failed_model.filehash).where(
-                    self._failed_model.source_id == source_id,
-                    self._failed_model.filehash.in_(keys),
-                    self._failed_model.attempts >= DEAD_LETTER_THRESHOLD,
-                )
-            ).scalars().all()
-        return set(rows)
-
-    def _record_failures(
-        self, source_id: int, items: list[tuple[str, str, str]]
-    ) -> None:
-        """Upsert-increment the dead-letter ledger for failed media. On conflict
-        bump `attempts` and refresh last_error/last_failed_at (UNIQUE backs the
-        upsert — no check-then-insert). De-dup the batch (one row/key, last error
-        wins)."""
-        by_key: dict[str, str] = {}
-        for key, _post_id, err in items:
-            by_key[key] = (err or "")[:_ERROR_MAX]
-        if not by_key:
-            return
-        values = [
-            {"source_id": source_id, "filehash": k, "attempts": 1, "last_error": e}
-            for k, e in by_key.items()
-        ]
-        with self.session_factory() as session:
-            stmt = pg_insert(self._failed_model).values(values)
-            stmt = stmt.on_conflict_do_update(
-                constraint=self._failed_constraint,
-                set_={
-                    "attempts": self._failed_model.attempts + 1,
-                    "last_error": stmt.excluded.last_error,
-                    "last_failed_at": func.now(),
-                },
-            )
-            session.execute(stmt)
-            session.commit()
-
-    def _clear_failures(self, source_id: int, keys: list[str]) -> None:
-        """Drop dead-letter rows for media that just downloaded cleanly — they
-        recovered. A no-op DELETE for keys that were never failing."""
-        unique = list(dict.fromkeys(keys))
-        if not unique:
-            return
-        with self.session_factory() as session:
-            session.execute(
-                delete(self._failed_model).where(
-                    self._failed_model.source_id == source_id,
-                    self._failed_model.filehash.in_(unique),
-                )
-            )
-            session.commit()

backend/app/services/migrators/__init__.py

@@ -0,0 +1,6 @@
+"""FC-5 migration tooling.
+
+One module per concern (backup/rollback/gs/ir/overlap/ml_queue/verify).
+Each migrator returns a counts dict; the run_migration task wires
+that dict into MigrationRun.counts so the UI polling shows progress.
+"""

backend/app/services/migrators/backup.py

@@ -0,0 +1,146 @@
+"""pg_dump + tar.zst-based backup, restorable via pair of subprocess calls.
+
+Backups live under <images_root>/_backups/. Each backup is two files
+(SQL + tarball) plus a manifest JSON. Tagged backups (e.g. tag='pre_migration')
+are how rollback.py finds the most recent restorable snapshot.
+"""
+from __future__ import annotations
+
+import json
+import shutil
+import subprocess
+from datetime import UTC, datetime
+from pathlib import Path
+from typing import Any
+
+_BACKUPS_DIRNAME = "_backups"
+
+
+def _libpq_url(sa_url: str) -> str:
+    """Strip SQLAlchemy driver suffix so pg_dump/psql accept the URL.
+
+    SQLAlchemy uses URLs like `postgresql+psycopg://...` or
+    `postgresql+asyncpg://...`. libpq tools (pg_dump, psql) only know
+    the plain `postgresql://` scheme.
+    """
+    for driver in ("postgresql+psycopg", "postgresql+asyncpg", "postgresql+psycopg2"):
+        if sa_url.startswith(driver + "://"):
+            return "postgresql://" + sa_url[len(driver) + 3:]
+    return sa_url
+
+
+def _backups_dir(images_root: Path | None = None) -> Path:
+    # Overridable for tests via monkeypatch.
+    root = images_root if images_root is not None else Path("/images")
+    p = root / _BACKUPS_DIRNAME
+    p.mkdir(parents=True, exist_ok=True)
+    return p
+
+
+_DEFAULT_SUBPROCESS_TIMEOUT_S = 30 * 60  # 30 minutes
+
+
+def _run_subprocess(cmd: list[str], **kwargs: Any):
+    # Overridable for tests via monkeypatch. Hard wall-clock timeout
+    # guards against pg_dump / tar / zstd hangs on NFS — without it the
+    # task pretends to be 'running' forever (operator hit this 2026-05-
+    # 23 with two backups stuck in MigrationRun). On timeout
+    # subprocess.run raises TimeoutExpired which the caller surfaces as
+    # a task error.
+    return subprocess.run(
+        cmd,
+        capture_output=True,
+        check=True,
+        timeout=_DEFAULT_SUBPROCESS_TIMEOUT_S,
+        **{k: v for k, v in kwargs.items() if not k.startswith("_")},
+    )
+
+
+def create_backup(
+    *, db_url: str, images_root: Path, tag: str = "manual",
+) -> dict:
+    """Create a backup: pg_dump SQL + tar.zst of images.
+
+    Returns a manifest dict. Writes <ts>.sql, <ts>.tar.zst, <ts>.json into
+    <images_root>/_backups/.
+    """
+    ts = datetime.now(UTC).strftime("%Y%m%dT%H%M%SZ")
+    out_dir = _backups_dir(images_root)
+    sql_path = out_dir / f"fc_{ts}.sql"
+    tar_path = out_dir / f"fc_{ts}.tar.zst"
+    manifest_path = out_dir / f"fc_{ts}.json"
+
+    _run_subprocess(
+        ["pg_dump", "--no-owner", "--no-acl", "-f", str(sql_path), _libpq_url(db_url)],
+        _test_ts=ts,
+    )
+    _run_subprocess(
+        [
+            "tar", "--zstd", "-cf", str(tar_path),
+            "-C", str(images_root.parent), images_root.name,
+            f"--exclude={images_root.name}/_backups",
+            f"--exclude={images_root.name}/_quarantine",
+        ],
+        _test_ts=ts,
+    )
+
+    manifest = {
+        "backup_id": ts,
+        "tag": tag,
+        "created_at": datetime.now(UTC).isoformat(),
+        "sql_path": str(sql_path),
+        "tar_path": str(tar_path),
+    }
+    manifest_path.write_text(json.dumps(manifest, indent=2))
+    return manifest
+
+
+def list_backups(images_root: Path) -> list[dict]:
+    out_dir = _backups_dir(images_root)
+    items = []
+    for mf in sorted(out_dir.glob("fc_*.json"), reverse=True):
+        try:
+            items.append(json.loads(mf.read_text()))
+        except Exception:
+            continue
+    return items
+
+
+def find_latest_backup(images_root: Path, *, tag: str) -> dict | None:
+    for mf in list_backups(images_root):
+        if mf.get("tag") == tag:
+            return mf
+    return None
+
+
+def restore_backup(
+    *, manifest: dict, db_url: str, images_root: Path,
+) -> dict:
+    """Restore from a backup manifest.
+
+    1. Replay the .sql via psql.
+    2. Wipe /images/ contents (except _backups/, which holds the file we're using).
+    3. Untar the .tar.zst into /images/.
+    """
+    sql_path = Path(manifest["sql_path"])
+    tar_path = Path(manifest["tar_path"])
+
+    _run_subprocess(
+        ["psql", "-d", _libpq_url(db_url), "-f", str(sql_path)],
+    )
+
+    # Wipe everything in images_root EXCEPT _backups/ (we'd delete the backup
+    # we're restoring from!).
+    for entry in images_root.iterdir():
+        if entry.name == _BACKUPS_DIRNAME:
+            continue
+        if entry.is_dir():
+            shutil.rmtree(entry)
+        else:
+            entry.unlink()
+
+    _run_subprocess(
+        ["tar", "--zstd", "-xf", str(tar_path), "-C", str(images_root.parent)],
+    )
+
+    return {"restored_from": manifest["backup_id"]}

backend/app/services/migrators/cleanup.py

@@ -0,0 +1,182 @@
+"""Targeted cleanup migrator: delete every image attributed to one Artist.
+
+Built for the IR-migration rescue case where the filesystem scan derived
+a bogus 'imagerepo' artist from a mismatched bind-mount layout. Every
+image attributed to that artist (40k+ rows) needs to be removed — DB
+rows, original files under `/images/<bucket>/...`, and thumbnails under
+`/images/thumbs/...` — before the operator remounts and re-scans.
+
+CASCADE handles image_tag, image_provenance, series_page, and
+tag_suggestion_rejection child rows; import_task.result_image_id is
+SET NULL by FK. We also delete ImportTask rows whose source_path starts
+with the (still-existing) IR scan prefix so the next scan isn't fooled
+by them.
+"""
+from __future__ import annotations
+
+import logging
+from pathlib import Path
+
+from sqlalchemy import delete, func, select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from ...models import Artist, ImageRecord, ImportBatch, ImportTask
+
+log = logging.getLogger(__name__)
+
+_BATCH_SIZE = 500
+
+
+def _zero_counts() -> dict:
+    return {
+        "rows_processed": 0, "rows_inserted": 0, "rows_skipped": 0,
+        "files_copied": 0, "bytes_copied": 0, "conflicts": 0,
+    }
+
+
+def _thumb_path(images_root: Path, sha256_hex: str) -> tuple[Path, Path]:
+    """Return both possible thumbnail paths (.jpg and .png). We try both
+    because the extension is chosen at generate-time based on the source
+    image's mode (alpha → .png, otherwise → .jpg)."""
+    bucket = sha256_hex[:3]
+    base = images_root / "thumbs" / bucket / sha256_hex
+    return base.with_suffix(".jpg"), base.with_suffix(".png")
+
+
+def _delete_file(path: Path) -> bool:
+    """Best-effort unlink; True if the file was actually removed."""
+    try:
+        path.unlink(missing_ok=True)
+        return True
+    except OSError as exc:
+        log.warning("cleanup: failed to unlink %s: %s", path, exc)
+        return False
+
+
+async def cleanup_artist_async(
+    db: AsyncSession,
+    *,
+    slug: str,
+    images_root: Path | None = None,
+    dry_run: bool = False,
+    source_path_prefix: str | None = None,
+) -> dict:
+    """Delete every image attributed to the Artist with this slug,
+    along with the artist row itself and any associated import tasks.
+
+    Args:
+        slug: artist.slug to target (e.g. 'imagerepo').
+        images_root: defaults to /images.
+        dry_run: skip filesystem + DB writes; still walk rows for counts.
+        source_path_prefix: if set, ImportTask rows whose source_path
+            starts with this string are deleted too (use the IR scan
+            mount prefix, e.g. '/import/imagerepo').
+    """
+    root = images_root if images_root is not None else Path("/images")
+
+    artist = (await db.execute(
+        select(Artist).where(Artist.slug == slug)
+    )).scalar_one_or_none()
+    if artist is None:
+        raise ValueError(f"no Artist with slug={slug!r}")
+
+    artist_id = artist.id
+    artist_name = artist.name
+
+    total_images = (await db.execute(
+        select(func.count(ImageRecord.id)).where(ImageRecord.artist_id == artist_id)
+    )).scalar_one()
+
+    counts = _zero_counts()
+    files_deleted = 0
+    thumbs_deleted = 0
+    images_deleted = 0
+
+    # Batched delete loop. CASCADE handles image_tag, image_provenance,
+    # series_page, tag_suggestion_rejection. import_task.result_image_id
+    # is SET NULL by FK.
+    while True:
+        rows = (await db.execute(
+            select(ImageRecord.id, ImageRecord.path, ImageRecord.sha256)
+            .where(ImageRecord.artist_id == artist_id)
+            .limit(_BATCH_SIZE)
+        )).all()
+        if not rows:
+            break
+
+        ids = [r.id for r in rows]
+        counts["rows_processed"] += len(ids)
+
+        if not dry_run:
+            for r in rows:
+                if r.path:
+                    if _delete_file(Path(r.path)):
+                        files_deleted += 1
+                if r.sha256:
+                    jpg, png = _thumb_path(root, r.sha256)
+                    if _delete_file(jpg):
+                        thumbs_deleted += 1
+                    if _delete_file(png):
+                        thumbs_deleted += 1
+
+            await db.execute(
+                delete(ImageRecord).where(ImageRecord.id.in_(ids))
+            )
+            await db.commit()
+
+        images_deleted += len(ids)
+
+        if dry_run:
+            # Nothing was actually deleted from the DB; bail after one
+            # pass so we don't loop forever.
+            break
+
+    import_tasks_deleted = 0
+    if source_path_prefix and not dry_run:
+        # Delete ImportTask rows whose source_path is under the bad mount
+        # prefix. These are mostly orphaned now (result_image_id was set
+        # NULL by CASCADE) but their presence still blocks the
+        # idempotency check in scan_directory if the operator remounts
+        # the same prefix.
+        like_pattern = source_path_prefix.rstrip("/") + "/%"
+        result = await db.execute(
+            delete(ImportTask).where(ImportTask.source_path.like(like_pattern))
+        )
+        import_tasks_deleted = result.rowcount or 0
+        await db.commit()
+
+    # Sweep ImportBatch rows that are now empty.
+    empty_batches_deleted = 0
+    if not dry_run:
+        empty_batch_ids = (await db.execute(
+            select(ImportBatch.id).where(
+                ~select(ImportTask.id)
+                .where(ImportTask.batch_id == ImportBatch.id)
+                .exists()
+            )
+        )).scalars().all()
+        if empty_batch_ids:
+            result = await db.execute(
+                delete(ImportBatch).where(ImportBatch.id.in_(empty_batch_ids))
+            )
+            empty_batches_deleted = result.rowcount or 0
+            await db.commit()
+
+    # Finally, the artist row.
+    if not dry_run:
+        await db.execute(delete(Artist).where(Artist.id == artist_id))
+        await db.commit()
+
+    return {
+        "counts": counts,
+        "artist": {"id": artist_id, "name": artist_name, "slug": slug},
+        "summary": {
+            "images_targeted": total_images,
+            "images_deleted": images_deleted,
+            "files_deleted": files_deleted,
+            "thumbs_deleted": thumbs_deleted,
+            "import_tasks_deleted": import_tasks_deleted,
+            "empty_batches_deleted": empty_batches_deleted,
+            "dry_run": dry_run,
+        },
+    }

backend/app/services/migrators/gs_ingest.py

@@ -0,0 +1,126 @@
+"""GallerySubscriber export → FabledCurator ingest.
+
+Reads a parsed gallerysubscriber-export-v1.json dict (no DB connection
+to GS). Creates Artist (from subscriptions) + Source (nested under each
+subscription) + Credential (re-encrypted with FC's key). Idempotent on
+natural keys: Artist.slug, (artist_id, platform, url), Credential.platform.
+
+Credentials arrive plaintext in the export — GS's export script
+decrypts using GS's Fernet key in GS's own process. FC re-encrypts
+with FC's CredentialCrypto.
+"""
+from __future__ import annotations
+
+import json
+
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from ...models import Artist, Credential, Source
+from ...utils.slug import slugify
+from ..credential_crypto import CredentialCrypto
+
+
+def _zero_counts() -> dict:
+    return {
+        "rows_processed": 0, "rows_inserted": 0, "rows_skipped": 0,
+        "files_copied": 0, "bytes_copied": 0, "conflicts": 0,
+    }
+
+
+async def migrate_async(
+    db: AsyncSession,
+    *,
+    data: dict,
+    fc_crypto: CredentialCrypto | None = None,
+    dry_run: bool = False,
+) -> dict:
+    """Ingest a parsed gallerysubscriber-export-v1.json dict."""
+    if data.get("source_app") != "gallerysubscriber":
+        raise ValueError("export source_app must be 'gallerysubscriber'")
+    if data.get("schema_version") != 1:
+        raise ValueError(f"unsupported schema_version: {data.get('schema_version')}")
+
+    counts = _zero_counts()
+
+    # Phase 1: subscriptions → Artist; nested sources within each.
+    for sub in data.get("subscriptions", []):
+        counts["rows_processed"] += 1
+        slug = slugify(sub["name"])
+        artist = (await db.execute(
+            select(Artist).where(Artist.slug == slug)
+        )).scalar_one_or_none()
+        if artist is None:
+            if dry_run:
+                counts["rows_inserted"] += 1
+                # Continue to nested sources, but they can't link without an artist row.
+                continue
+            notes = json.dumps(sub.get("metadata"), indent=2) if sub.get("metadata") else None
+            artist = Artist(
+                name=sub["name"], slug=slug,
+                is_subscription=True,
+                auto_check=bool(sub.get("enabled", True)),
+                notes=notes,
+            )
+            db.add(artist)
+            await db.flush()
+            counts["rows_inserted"] += 1
+        else:
+            counts["rows_skipped"] += 1
+
+        # Nested sources under this subscription.
+        for src in sub.get("sources", []):
+            counts["rows_processed"] += 1
+            existing = (await db.execute(
+                select(Source).where(
+                    Source.artist_id == artist.id,
+                    Source.platform == src["platform"],
+                    Source.url == src["url"],
+                )
+            )).scalar_one_or_none()
+            if existing is not None:
+                counts["rows_skipped"] += 1
+                continue
+            if dry_run:
+                counts["rows_inserted"] += 1
+                continue
+            db.add(Source(
+                artist_id=artist.id,
+                platform=src["platform"],
+                url=src["url"],
+                enabled=bool(src.get("enabled", True)),
+                check_interval_override=src.get("check_interval"),
+                config_overrides=src.get("metadata") or {},
+            ))
+            counts["rows_inserted"] += 1
+
+    # Phase 2: credentials.
+    for cred in data.get("credentials", []):
+        counts["rows_processed"] += 1
+        existing = (await db.execute(
+            select(Credential).where(Credential.platform == cred["platform"])
+        )).scalar_one_or_none()
+        if existing is not None:
+            counts["rows_skipped"] += 1
+            continue
+        if dry_run:
+            counts["rows_inserted"] += 1
+            continue
+        if fc_crypto is None:
+            # Without a crypto helper we can't encrypt — skip rather than
+            # store plaintext.
+            counts["rows_skipped"] += 1
+            counts["conflicts"] += 1
+            continue
+        encrypted = fc_crypto.encrypt(cred["plaintext"])
+        db.add(Credential(
+            platform=cred["platform"],
+            credential_type=cred.get("credential_type") or "cookies",
+            encrypted_blob=encrypted,
+            expires_at=cred.get("expires_at"),
+        ))
+        counts["rows_inserted"] += 1
+
+    if not dry_run:
+        await db.commit()
+    return counts

backend/app/services/migrators/ir_ingest.py

@@ -0,0 +1,141 @@
+"""ImageRepo export → FabledCurator ingest.
+
+Reads a parsed imagerepo-export-v1.json dict (no DB connection to IR).
+Creates Tag rows (skipping artist/post kinds, resolving fandom_name to
+FK). Writes the per-image-sha256 artist assignments + tag associations
++ series page assignments to /images/_migration_state/ir_tag_manifest.json
+so tag_apply.py can join them to ImageRecord rows AFTER the operator
+runs FC's filesystem scan.
+"""
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from ...models import Tag, TagKind
+
+_SKIP_KINDS = frozenset({"artist", "post"})
+_MIGRATION_STATE_DIRNAME = "_migration_state"
+_IR_MANIFEST_FILENAME = "ir_tag_manifest.json"
+
+
+def _zero_counts() -> dict:
+    return {
+        "rows_processed": 0, "rows_inserted": 0, "rows_skipped": 0,
+        "files_copied": 0, "bytes_copied": 0, "conflicts": 0,
+    }
+
+
+def manifest_path(images_root: Path | None = None) -> Path:
+    root = images_root if images_root is not None else Path("/images")
+    p = root / _MIGRATION_STATE_DIRNAME
+    p.mkdir(parents=True, exist_ok=True)
+    return p / _IR_MANIFEST_FILENAME
+
+
+async def _resolve_fandom_id(
+    db: AsyncSession, fandom_name: str | None, dry_run: bool,
+) -> int | None:
+    """Find-or-create a fandom-kind Tag by name."""
+    if not fandom_name:
+        return None
+    existing = (await db.execute(
+        select(Tag).where(Tag.name == fandom_name, Tag.kind == "fandom")
+    )).scalar_one_or_none()
+    if existing is not None:
+        return existing.id
+    if dry_run:
+        return None
+    t = Tag(name=fandom_name, kind=TagKind.fandom)
+    db.add(t)
+    await db.flush()
+    return t.id
+
+
+async def migrate_async(
+    db: AsyncSession,
+    *,
+    data: dict,
+    images_root: Path | None = None,
+    dry_run: bool = False,
+) -> dict:
+    """Ingest a parsed imagerepo-export-v1.json dict.
+
+    Creates Tag rows + writes the IR tag manifest file. Tag-to-image
+    binding happens later in tag_apply.py (after FC's filesystem scan
+    populates image_record.sha256 → id).
+    """
+    if data.get("source_app") != "imagerepo":
+        raise ValueError("export source_app must be 'imagerepo'")
+    if data.get("schema_version") != 1:
+        raise ValueError(f"unsupported schema_version: {data.get('schema_version')}")
+
+    counts = _zero_counts()
+
+    # Phase 1: tags (skip artist + post kinds; resolve fandom_name → fandom_id).
+    # First pass: create all fandom-kind tags so they're available for FK resolution.
+    for tag in data.get("tags", []):
+        kind = tag.get("kind") or "general"
+        if kind != "fandom":
+            continue
+        counts["rows_processed"] += 1
+        existing = (await db.execute(
+            select(Tag).where(Tag.name == tag["name"], Tag.kind == "fandom")
+        )).scalar_one_or_none()
+        if existing is not None:
+            counts["rows_skipped"] += 1
+            continue
+        if dry_run:
+            counts["rows_inserted"] += 1
+            continue
+        db.add(Tag(name=tag["name"], kind=TagKind.fandom))
+        counts["rows_inserted"] += 1
+    if not dry_run:
+        await db.flush()
+
+    # Second pass: every other kind.
+    for tag in data.get("tags", []):
+        kind_str = tag.get("kind") or "general"
+        if kind_str in _SKIP_KINDS:
+            counts["rows_skipped"] += 1
+            continue
+        if kind_str == "fandom":
+            continue  # handled above
+        counts["rows_processed"] += 1
+        try:
+            kind = TagKind(kind_str)
+        except ValueError:
+            kind = TagKind.general
+        fandom_id = await _resolve_fandom_id(db, tag.get("fandom_name"), dry_run)
+        existing = (await db.execute(
+            select(Tag).where(Tag.name == tag["name"], Tag.kind == kind)
+        )).scalar_one_or_none()
+        if existing is not None:
+            counts["rows_skipped"] += 1
+            continue
+        if dry_run:
+            counts["rows_inserted"] += 1
+            continue
+        db.add(Tag(name=tag["name"], kind=kind, fandom_id=fandom_id))
+        counts["rows_inserted"] += 1
+
+    if not dry_run:
+        await db.commit()
+
+    # Phase 2: write the per-image manifest for tag_apply.py to consume later.
+    manifest = {
+        "schema_version": 1,
+        "image_artist_assignments": data.get("image_artist_assignments", []),
+        "image_tag_associations": data.get("image_tag_associations", []),
+        "series_pages": data.get("series_pages", []),
+    }
+    counts["rows_processed"] += len(manifest["image_artist_assignments"])
+    counts["rows_processed"] += len(manifest["image_tag_associations"])
+    counts["rows_processed"] += len(manifest["series_pages"])
+    if not dry_run:
+        manifest_path(images_root).write_text(json.dumps(manifest, indent=2))
+
+    return counts

backend/app/services/migrators/ml_queue.py

@@ -0,0 +1,21 @@
+"""Queue every migrated image_record with no embedding for ML re-processing."""
+from __future__ import annotations
+
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from ...models import ImageRecord
+
+
+async def queue_all_unprocessed_async(db: AsyncSession) -> int:
+    """Find every ImageRecord with siglip_embedding IS NULL, fire
+    tag_and_embed.delay(id) for each. Returns count queued.
+    """
+    from ...tasks.ml import tag_and_embed
+
+    rows = (await db.execute(
+        select(ImageRecord.id).where(ImageRecord.siglip_embedding.is_(None))
+    )).scalars().all()
+    for image_id in rows:
+        tag_and_embed.delay(image_id)
+    return len(rows)

backend/app/services/migrators/rollback.py

@@ -0,0 +1,21 @@
+"""Restore from the most recent 'pre_migration'-tagged backup."""
+from __future__ import annotations
+
+from pathlib import Path
+
+from . import backup as backup_mod
+
+
+class NoBackupFoundError(Exception):
+    """Raised when rollback() is called with no pre_migration backup on disk."""
+
+
+def rollback_to_pre_migration(*, db_url: str, images_root: Path) -> dict:
+    manifest = backup_mod.find_latest_backup(images_root, tag="pre_migration")
+    if manifest is None:
+        raise NoBackupFoundError(
+            "no pre_migration-tagged backup found under <images_root>/_backups/"
+        )
+    return backup_mod.restore_backup(
+        manifest=manifest, db_url=db_url, images_root=images_root,
+    )

backend/app/services/migrators/tag_apply.py

@@ -0,0 +1,172 @@
+"""Apply the IR tag manifest after FC's filesystem scan.
+
+Reads /images/_migration_state/ir_tag_manifest.json and joins each entry
+to an ImageRecord row by sha256 (which exists after the operator runs
+FC's filesystem scan over the mounted IR images dir).
+
+- image_artist_assignments → ImageRecord.artist_id (find_or_create Artist by slug).
+- image_tag_associations  → image_tag insert (idempotent).
+- series_pages            → series_page insert (idempotent on image_id unique).
+
+Unmatched sha256s are logged into the result's `unmatched` list so the
+Celery task can drop them into MigrationRun.metadata for the operator
+to inspect.
+"""
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from ...models import Artist, ImageRecord, SeriesPage, Tag, TagKind, image_tag
+from ...utils.slug import slugify
+from .ir_ingest import manifest_path
+
+
+def _zero_counts() -> dict:
+    return {
+        "rows_processed": 0, "rows_inserted": 0, "rows_skipped": 0,
+        "files_copied": 0, "bytes_copied": 0, "conflicts": 0,
+    }
+
+
+async def _ensure_artist_id(
+    db: AsyncSession, artist_name: str, dry_run: bool,
+) -> int | None:
+    if not artist_name or not artist_name.strip():
+        return None
+    slug = slugify(artist_name)
+    existing = (await db.execute(
+        select(Artist).where(Artist.slug == slug)
+    )).scalar_one_or_none()
+    if existing is not None:
+        return existing.id
+    if dry_run:
+        return None
+    a = Artist(name=artist_name, slug=slug, is_subscription=False)
+    db.add(a)
+    await db.flush()
+    return a.id
+
+
+async def _resolve_tag_id(
+    db: AsyncSession, tag_name: str, tag_kind: str,
+) -> int | None:
+    try:
+        kind = TagKind(tag_kind)
+    except ValueError:
+        kind = TagKind.general
+    row = (await db.execute(
+        select(Tag.id).where(Tag.name == tag_name, Tag.kind == kind)
+    )).scalar_one_or_none()
+    return row
+
+
+async def _sha_to_image_id(db: AsyncSession, sha: str) -> int | None:
+    return (await db.execute(
+        select(ImageRecord.id).where(ImageRecord.sha256 == sha)
+    )).scalar_one_or_none()
+
+
+async def apply_async(
+    db: AsyncSession,
+    *,
+    images_root: Path | None = None,
+    dry_run: bool = False,
+) -> dict:
+    """Apply the manifest. Returns counts + an `unmatched` list of sha256s."""
+    mf_path = manifest_path(images_root)
+    if not mf_path.exists():
+        raise FileNotFoundError(f"no IR tag manifest at {mf_path}")
+
+    manifest = json.loads(mf_path.read_text())
+    counts = _zero_counts()
+    unmatched: list[dict] = []
+
+    # 1. Artist assignments.
+    for entry in manifest.get("image_artist_assignments", []):
+        counts["rows_processed"] += 1
+        img_id = await _sha_to_image_id(db, entry["sha256"])
+        if img_id is None:
+            unmatched.append({"kind": "artist", **entry})
+            counts["rows_skipped"] += 1
+            continue
+        aid = await _ensure_artist_id(db, entry["artist_name"], dry_run)
+        if aid is None:
+            counts["rows_skipped"] += 1
+            continue
+        if dry_run:
+            counts["rows_inserted"] += 1
+            continue
+        img = await db.get(ImageRecord, img_id)
+        if img is not None and img.artist_id != aid:
+            img.artist_id = aid
+            counts["rows_inserted"] += 1
+        else:
+            counts["rows_skipped"] += 1
+
+    # 2. Tag associations.
+    for entry in manifest.get("image_tag_associations", []):
+        counts["rows_processed"] += 1
+        img_id = await _sha_to_image_id(db, entry["sha256"])
+        if img_id is None:
+            unmatched.append({"kind": "tag", **entry})
+            counts["rows_skipped"] += 1
+            continue
+        tag_id = await _resolve_tag_id(
+            db, entry["tag_name"], entry.get("tag_kind") or "general",
+        )
+        if tag_id is None:
+            counts["rows_skipped"] += 1
+            continue
+        # Skip if association already exists.
+        already = (await db.execute(
+            select(image_tag.c.image_record_id).where(
+                image_tag.c.image_record_id == img_id,
+                image_tag.c.tag_id == tag_id,
+            )
+        )).first()
+        if already is not None:
+            counts["rows_skipped"] += 1
+            continue
+        if dry_run:
+            counts["rows_inserted"] += 1
+            continue
+        await db.execute(image_tag.insert().values(
+            image_record_id=img_id, tag_id=tag_id, source="manual",
+        ))
+        counts["rows_inserted"] += 1
+
+    # 3. Series pages.
+    for entry in manifest.get("series_pages", []):
+        counts["rows_processed"] += 1
+        img_id = await _sha_to_image_id(db, entry["sha256"])
+        if img_id is None:
+            unmatched.append({"kind": "series", **entry})
+            counts["rows_skipped"] += 1
+            continue
+        series_tag_id = await _resolve_tag_id(db, entry["series_tag_name"], "series")
+        if series_tag_id is None:
+            counts["rows_skipped"] += 1
+            continue
+        existing = (await db.execute(
+            select(SeriesPage).where(SeriesPage.image_id == img_id)
+        )).scalar_one_or_none()
+        if existing is not None:
+            counts["rows_skipped"] += 1
+            continue
+        if dry_run:
+            counts["rows_inserted"] += 1
+            continue
+        db.add(SeriesPage(
+            series_tag_id=series_tag_id,
+            image_id=img_id,
+            page_number=entry["page_number"],
+        ))
+        counts["rows_inserted"] += 1
+
+    if not dry_run:
+        await db.commit()
+    return {"counts": counts, "unmatched": unmatched}

backend/app/services/migrators/verify.py

@@ -0,0 +1,80 @@
+"""Post-migration verification: row counts + sha256 sampling."""
+from __future__ import annotations
+
+import hashlib
+from pathlib import Path
+
+from sqlalchemy import func, select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from ...models import Artist, Credential, ImageRecord, Source, Tag
+
+
+async def verify_async(db: AsyncSession, *, expected: dict | None = None) -> dict:
+    """Return per-check status dicts. `expected` is optional row-count
+    assertions; checks default to status='ok' when no expected provided."""
+    expected = expected or {}
+    results: dict[str, dict] = {}
+
+    checks = {
+        "artist_subscriptions": (
+            select(func.count(Artist.id)).where(Artist.is_subscription.is_(True))
+        ),
+        "source_count": select(func.count(Source.id)),
+        "credential_count": select(func.count(Credential.id)),
+        "tag_count": select(func.count(Tag.id)),
+        "image_record_imported_or_downloaded": (
+            select(func.count(ImageRecord.id))
+            .where(ImageRecord.origin.in_(["imported_filesystem", "downloaded"]))
+        ),
+    }
+    for name, stmt in checks.items():
+        actual = (await db.execute(stmt)).scalar_one()
+        exp = expected.get(name)
+        status = "ok" if exp is None or exp == actual else "mismatch"
+        results[name] = {"status": status, "actual": int(actual), "expected": exp}
+    return results
+
+
+async def verify_sha256_sample(
+    db: AsyncSession, *, sample_size: int = 20,
+) -> dict:
+    """Sample N image_records; verify file exists + sha256 matches."""
+    rows = (await db.execute(
+        select(ImageRecord.id, ImageRecord.path, ImageRecord.sha256)
+        .order_by(func.random()).limit(sample_size)
+    )).all()
+
+    matched = 0
+    mismatched = 0
+    missing = 0
+    samples: list[dict] = []
+    for img_id, path, expected_sha in rows:
+        p = Path(path)
+        # Sync stdlib filesystem ops are intentional: this verify pass runs
+        # inside a Celery task under asyncio.run; no other awaitables compete
+        # for the loop. Same pattern as download_service.py.
+        if not p.exists():  # noqa: ASYNC240
+            missing += 1
+            samples.append({"id": img_id, "path": path, "result": "missing"})
+            continue
+        h = hashlib.sha256()
+        with p.open("rb") as f:  # noqa: ASYNC230
+            for chunk in iter(lambda: f.read(65536), b""):
+                h.update(chunk)
+        if h.hexdigest() == expected_sha:
+            matched += 1
+            samples.append({"id": img_id, "result": "ok"})
+        else:
+            mismatched += 1
+            samples.append({
+                "id": img_id, "path": path, "result": "mismatch",
+                "expected_sha": expected_sha, "actual_sha": h.hexdigest(),
+            })
+    return {
+        "sample_size": len(rows),
+        "matched": matched,
+        "mismatched": mismatched,
+        "missing": missing,
+        "samples": samples,
+    }