Merge pull request 'Sidecar synthetic anchor cleanup + tier-gated classifier fix' (#39) from dev into main

Three coupled operator-reported pains from the 2026-05-31 download
event audit:

1. `[patreon][warning] Not allowed to view post N` was bubbling up as
   an error event, bumping consecutive_failures and parking the source
   in "needs attention." The classifier's tier-gated branch was gated
   on `return_code in (1, 4)`. Gallery-dl returns a different exit
   code for mixed-failure runs (e.g. paywall warnings + a missing
   yt-dlp dep flipping the exit bits), so the branch never fired and
   the path fell through to UNKNOWN_ERROR. Widen the gate: when no
   source-level error fired AND tier-gated warnings are present,
   classify as TIER_LIMITED regardless of return code.

2. Knuxy event #38275 (2026-05-31) ran 30 min and finalized with
   "stranded by recovery sweep (no terminal status after time_limit)"
   + empty stdout/stderr. Root cause: subprocess.run timeout (900s)
   and Celery soft_time_limit (900s) raced; when Celery won, SIGKILL
   wiped the in-memory captured output and the DownloadEvent ended up
   empty-logged 18 minutes later when the sweep finalized it. Drop
   gallery-dl's default subprocess timeout to 870s — a 30s margin
   shy of Celery's soft limit — so subprocess.TimeoutExpired always
   wins the race and captures the partial stdout/stderr via the
   existing handler.

3. `[downloader.ytdl][error] Cannot import yt-dlp or youtube-dl` was
   firing on every video attachment, causing per-item download
   failures that masked legitimate tier-gated classification.
   Add yt-dlp>=2025.1 to requirements.txt. Once it's in the image,
   video posts download normally and the per-item failure noise
   disappears.

Tests added:
- pure tier-gated stderr with exit code 128 → TIER_LIMITED + success
- mixed tier-gated + yt-dlp + per-item failures → still TIER_LIMITED

.forgejo/workflows/build.yml

@@ -173,24 +173,51 @@ jobs:
         # same source code as the preceding main-push build but with an
         # immutable version tag — they need the XPI too, otherwise the
         # versioned image ships without the signed extension.
+        #
+        # Tag-push vs main-push race (operator-flagged 2026-05-27 after
+        # v26.05.27.0 hit it): a release cut fires BOTH workflows almost
+        # simultaneously. Main-push runs sign-extension (1-5min AMO round
+        # trip) before publishing the ext-<version> release; tag-push
+        # skips sign-extension (gated to main) and races straight to
+        # this download step. Tag-push lost every time. Fix: poll the
+        # ext-<version> release endpoint with a sleep+retry loop (30s
+        # for up to 10min total) before giving up. Main-push's signing
+        # eventually wins and tag-push picks the release up on a later
+        # iteration.
         if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')
         env:
           TOKEN: ${{ secrets.RELEASE_TOKEN }}
         run: |
           set -eux
           VERSION=$(grep -E '"version"' extension/package.json | head -1 | sed -E 's/.*"version"[[:space:]]*:[[:space:]]*"([^"]+)".*/\1/')
-          # Look up the ext-<version> release; extract the .xpi asset's
-          # browser_download_url (Forgejo's /releases/assets/<id> endpoint
-          # returns ASSET METADATA, not the binary blob — operator-flagged
-          # 2026-05-26: my prior code curl'd the metadata endpoint without
-          # -f and wrote the resulting 404-page-not-found text into
-          # fabledcurator-*.xpi, which Firefox then rejected as "corrupt").
-          # browser_download_url is the canonical binary endpoint and is
-          # also publicly accessible (no token needed) but we pass the
-          # token anyway for symmetry with private-repo support.
-          curl -sf -H "Authorization: token $TOKEN" \
-            "https://git.fabledsword.com/api/v1/repos/bvandeusen/FabledCurator/releases/tags/ext-$VERSION" \
-            -o release.json
+          # Poll for the ext-<version> release. main-push's sign-extension
+          # step (AMO round-trip, 1-5min) needs to finish + upload before
+          # tag-push can fetch. 30s * 20 = up to 10min wait, then hard-fail.
+          for attempt in $(seq 1 20); do
+            STATUS=$(curl -s -o release.json -w "%{http_code}" \
+              -H "Authorization: token $TOKEN" \
+              "https://git.fabledsword.com/api/v1/repos/bvandeusen/FabledCurator/releases/tags/ext-$VERSION" || echo 000)
+            if [ "$STATUS" = "200" ]; then
+              echo "Found ext-$VERSION release on attempt $attempt"
+              break
+            fi
+            if [ "$attempt" = "20" ]; then
+              echo "ERROR: ext-$VERSION release not available after 10min of polling"
+              echo "Last HTTP status: $STATUS"
+              exit 1
+            fi
+            echo "Attempt $attempt: ext-$VERSION not yet published (HTTP $STATUS); sleeping 30s"
+            sleep 30
+          done
+          # Extract the .xpi asset's browser_download_url (Forgejo's
+          # /releases/assets/<id> endpoint returns ASSET METADATA, not
+          # the binary blob — operator-flagged 2026-05-26: my prior
+          # code curl'd the metadata endpoint without -f and wrote the
+          # resulting 404-page-not-found text into fabledcurator-*.xpi,
+          # which Firefox then rejected as "corrupt").
+          # browser_download_url is the canonical binary endpoint and
+          # is also publicly accessible (no token needed) but we pass
+          # the token anyway for symmetry with private-repo support.
           DOWNLOAD_URL=$(python3 -c "import json; r=json.load(open('release.json')); xpis=[a for a in r.get('assets', []) if a.get('name','').endswith('.xpi')]; print(xpis[0]['browser_download_url'])")
           test -n "$DOWNLOAD_URL"
           echo "Downloading XPI from: $DOWNLOAD_URL"

.forgejo/workflows/ci.yml

@@ -1,7 +1,8 @@
 name: CI
 
 # CI lanes per FabledRulebook/forgejo.md "CI philosophy":
-#   - backend-lint-and-test: ruff + `pytest -m "not integration"`, no service containers.
+#   - lint: ruff only, no dep install — fast-fail for the common lint bounce.
+#   - backend-lint-and-test: `pytest -m "not integration"`, no service containers.
 #   - frontend-build: vitest unit + vite build.
 #   - integration: pgvector + redis service containers; alembic + `pytest -m integration`.
 
@@ -14,6 +15,20 @@ on:
   # (single-operator Forgejo repo) so push coverage is complete.
 
 jobs:
+  # Fast-fail lint lane. ruff is pre-installed in the ci-python image, so
+  # this runs with NO dependency install and surfaces the most common bounce
+  # class (lint: I001 / UP037 / ASYNC109 / W293 …) in seconds — instead of
+  # after the backend job's ~30-60s wheel install. ruff is static analysis,
+  # so no DB/secret env is needed.
+  lint:
+    runs-on: python-ci
+    container:
+      image: git.fabledsword.com/bvandeusen/ci-python:3.14
+    steps:
+      - uses: actions/checkout@v4
+      - name: Ruff lint
+        run: ruff check backend/ tests/ alembic/
+
   backend-lint-and-test:
     runs-on: python-ci
     container:
@@ -51,9 +66,8 @@ jobs:
             pip install -r requirements.txt pytest pytest-asyncio
           fi
 
-      - name: Ruff lint
-        run: ruff check backend/ tests/ alembic/
-
+      # Ruff moved to the dedicated fast `lint` job above (fails in seconds,
+      # no dep install). This job is now unit tests only.
       - name: Pytest (unit only — integration runs in the integration job)
         run: pytest tests/ -v -m "not integration"
 

alembic/versions/0024_backfill_post_title_from_description.py

@@ -0,0 +1,80 @@
+"""backfill post.post_title from description first-line — 2026-05-27
+
+Revision ID: 0024
+Revises: 0023
+Create Date: 2026-05-27
+
+SubscribeStar gallery-dl always writes `title: ""` and embeds the leading
+sentence inside `content` HTML. FC's sidecar parser was leaving
+post_title NULL for every SubscribeStar post since FC-3 shipped. The
+parser fix (sidecar._first_line_text fallback) now synthesizes a title
+at parse time; this migration applies the same logic retroactively to
+existing rows.
+
+Operator-flagged 2026-05-27 after inspecting
+/mnt/Data/Patreon/Cheunart/subscribestar/ sidecars.
+
+Idempotent: only touches rows where post_title IS NULL or empty AND
+description IS NOT NULL. Re-running the migration is a no-op.
+"""
+from __future__ import annotations
+
+import re
+from typing import Sequence, Union
+
+from alembic import op
+from sqlalchemy import text
+
+revision: str = "0024"
+down_revision: Union[str, None] = "0023"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+_TAG_RE = re.compile(r"<[^>]+>")
+_WS_RE = re.compile(r"\s+")
+
+
+def _first_line_text(body: str, limit: int = 120) -> str | None:
+    """Mirror of sidecar._first_line_text. Kept inline so the migration
+    doesn't carry a runtime import dependency from app code that may
+    have moved by the time the migration is replayed years from now."""
+    if not body:
+        return None
+    text_ = _TAG_RE.sub(" ", body)
+    text_ = text_.replace("\xa0", " ")
+    for line in text_.splitlines():
+        line = _WS_RE.sub(" ", line).strip()
+        if line:
+            if len(line) > limit:
+                return line[: limit - 1].rstrip() + "…"
+            return line
+    return None
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+    rows = bind.execute(
+        text(
+            "SELECT id, description FROM post "
+            "WHERE (post_title IS NULL OR post_title = '') "
+            "AND description IS NOT NULL AND description <> ''"
+        )
+    ).fetchall()
+    updated = 0
+    for row in rows:
+        derived = _first_line_text(row.description)
+        if not derived:
+            continue
+        bind.execute(
+            text("UPDATE post SET post_title = :t WHERE id = :id"),
+            {"t": derived, "id": row.id},
+        )
+        updated += 1
+    print(f"0024: backfilled post_title on {updated} row(s)")
+
+
+def downgrade() -> None:
+    # No safe restore — we can't tell which post_titles were derived vs
+    # genuinely present. Leave the column alone on rollback.
+    pass

alembic/versions/0025_fix_subscribestar_post_ids.py

@@ -0,0 +1,288 @@
+"""sidecar-audit followup: correct external_post_id + post_url across all platforms
+
+Revision ID: 0025
+Revises: 0024
+Create Date: 2026-05-27
+
+Closes the operator-flagged 2026-05-27 sidecar audit findings. Three
+data-correctness bugs across non-Patreon platforms had been silently
+corrupting Posts since FC-3 shipped; the parser fix (sidecar.py, same
+commit) addresses new imports. This migration cleans up existing rows.
+
+Per-platform actions:
+
+  subscribestar — gallery-dl wrote the per-attachment id in `id` and
+    the actual post id in `post_id`. FC's parser picked `id`, so every
+    multi-image SubscribeStar post was fragmented into N Post rows.
+    1. For each SubscribeStar Post, read its sidecar (via the related
+       ImageRecord's on-disk path), pull `post_id`, overwrite
+       external_post_id and post_url.
+    2. Merge groups of Posts under one source that now share an
+       external_post_id (fragments of the same actual post). Same
+       ImageProvenance pre-delete + repoint dance as alembic 0022.
+
+  hentaifoundry — sidecars have NO `url` field; `src` is the image
+    URL. FC's parser stored post_url=NULL. Read each HF Post's sidecar
+    for `user` + `index`, derive the canonical /pictures/user/<u>/<i>
+    permalink. external_post_id (= `index`) was already correct.
+
+  discord — gallery-dl wrote the CDN attachment URL in `url`. FC's
+    parser stored that as post_url. Read each Discord Post's sidecar
+    for the server/channel/message triple, derive the proper
+    discord.com/channels/.../<message> permalink. external_post_id (=
+    `message_id`) was already correct.
+
+  pixiv — pure-SQL backfill: replace any `i.pximg.net`-style URL on
+    Post.post_url with the derived `/artworks/<id>` permalink. Pixiv
+    external_post_id (= `id`) was already correct; no sidecar IO
+    needed.
+
+Idempotent: re-running on already-corrected data is a no-op (skips
+rows whose derived value matches what's already stored).
+
+Posts whose related ImageRecord paths don't resolve on disk (orphaned
+filesystem state) are skipped with a count in the migration output —
+those will be picked up by a future deep-scan.
+"""
+from __future__ import annotations
+
+import json
+import re
+from pathlib import Path
+from typing import Sequence, Union
+
+from alembic import op
+from sqlalchemy import text
+
+revision: str = "0025"
+down_revision: Union[str, None] = "0024"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+# Mirror of sidecar._NUMBERING_PREFIX. Kept inline so the migration is
+# self-contained (the operator's banked rule:
+# reference_postgres_enum_swap_drop_checks.md says migrations shouldn't
+# import from runtime app code).
+_NUMBERING_PREFIX = re.compile(r"^\d+_(.+)$")
+
+
+def _find_sidecar(media_path: Path) -> Path | None:
+    """gallery-dl writes the sidecar under the unprefixed stem
+    (`HOLLOW-ICHIGO.json`) while the media file gets a NN_ ordering
+    prefix (`01_HOLLOW-ICHIGO.png`). Try in order:
+      1. <stem>.json next to the media
+      2. <media>.json next to the media (full-name variant)
+      3. strip the NN_ prefix from the stem, then <stripped>.json
+    """
+    if not media_path:
+        return None
+    cand = media_path.with_suffix(".json")
+    if cand.is_file():
+        return cand
+    cand = media_path.parent / f"{media_path.name}.json"
+    if cand.is_file():
+        return cand
+    m = _NUMBERING_PREFIX.match(media_path.stem)
+    if m:
+        cand = media_path.parent / f"{m.group(1)}.json"
+        if cand.is_file():
+            return cand
+    return None
+
+
+def _str_id(v) -> str | None:
+    """str() a JSON scalar id; reject bool (JSON booleans are ints in
+    Python's eyes but they aren't valid sidecar ids)."""
+    if isinstance(v, bool):
+        return None
+    if isinstance(v, (str, int)) and str(v).strip():
+        return str(v).strip()
+    return None
+
+
+def _str_field(v) -> str | None:
+    if isinstance(v, str) and v.strip():
+        return v.strip()
+    return None
+
+
+def upgrade() -> None:
+    conn = op.get_bind()
+
+    # ── PART 1: Per-platform corrections requiring filesystem IO ─────
+    # SubscribeStar, HentaiFoundry, Discord all need fields from the
+    # sidecar to construct the right post_url. We walk each Post's
+    # related ImageRecord.path to find the sidecar, read it, derive,
+    # and update.
+    targets = conn.execute(text("""
+        SELECT p.id, p.external_post_id, p.post_url, s.platform
+        FROM post p
+        JOIN source s ON s.id = p.source_id
+        WHERE s.platform IN ('subscribestar', 'hentaifoundry', 'discord')
+    """)).fetchall()
+
+    stats: dict[str, dict[str, int]] = {
+        plat: {"read": 0, "updated": 0, "no_sidecar": 0}
+        for plat in ("subscribestar", "hentaifoundry", "discord")
+    }
+    for post_row in targets:
+        plat = post_row.platform
+        path = _first_attachment_path(conn, post_row.id)
+        if not path:
+            stats[plat]["no_sidecar"] += 1
+            continue
+        sidecar = _find_sidecar(Path(path))
+        if sidecar is None:
+            stats[plat]["no_sidecar"] += 1
+            continue
+        try:
+            data = json.loads(sidecar.read_text(encoding="utf-8"))
+        except (OSError, json.JSONDecodeError):
+            stats[plat]["no_sidecar"] += 1
+            continue
+        stats[plat]["read"] += 1
+
+        new_epid = post_row.external_post_id
+        new_url = None
+        if plat == "subscribestar":
+            pid = _str_id(data.get("post_id"))
+            if pid:
+                new_epid = pid
+                new_url = f"https://www.subscribestar.com/posts/{pid}"
+        elif plat == "hentaifoundry":
+            user = _str_field(data.get("user")) or _str_field(data.get("artist"))
+            idx = _str_id(data.get("index"))
+            if user and idx:
+                new_url = f"https://www.hentai-foundry.com/pictures/user/{user}/{idx}"
+        elif plat == "discord":
+            sid = _str_id(data.get("server_id"))
+            cid = _str_id(data.get("channel_id"))
+            mid = _str_id(data.get("message_id"))
+            if sid and cid and mid:
+                new_url = f"https://discord.com/channels/{sid}/{cid}/{mid}"
+
+        # Idempotent: skip if nothing changed.
+        if new_epid == post_row.external_post_id and new_url == post_row.post_url:
+            continue
+        conn.execute(
+            text("""
+                UPDATE post
+                SET external_post_id = :epid, post_url = :url
+                WHERE id = :id
+            """),
+            {"epid": new_epid, "url": new_url, "id": post_row.id},
+        )
+        stats[plat]["updated"] += 1
+
+    for plat, s in stats.items():
+        print(
+            f"0025: {plat} — read {s['read']} sidecars, "
+            f"updated {s['updated']} Posts, "
+            f"{s['no_sidecar']} Posts had no resolvable sidecar"
+        )
+
+    # ── PART 2: Merge SubscribeStar fragments now sharing epid ───────
+    # After Part 1, each group of Posts under one source with the SAME
+    # new external_post_id is a fragment-set of the same actual post.
+    # Merge to one canonical row. Pre-handle the same ImageProvenance
+    # collision pattern as alembic 0022 (uq_image_provenance_image_post).
+    fragment_groups = conn.execute(text("""
+        SELECT p.source_id, p.external_post_id,
+               ARRAY_AGG(p.id ORDER BY p.id ASC) AS post_ids
+        FROM post p
+        JOIN source s ON s.id = p.source_id
+        WHERE s.platform = 'subscribestar'
+          AND p.external_post_id IS NOT NULL
+        GROUP BY p.source_id, p.external_post_id
+        HAVING COUNT(*) > 1
+    """)).fetchall()
+
+    merged = 0
+    for grp in fragment_groups:
+        post_ids = list(grp.post_ids)
+        keep_id, *drop_ids = post_ids
+        for drop_id in drop_ids:
+            # Pre-DELETE colliding ImageProvenance under drop_ that
+            # already exist under keep (alembic 0022 banked the pattern).
+            conn.execute(
+                text("""
+                    DELETE FROM image_provenance
+                    WHERE post_id = :drop_
+                      AND image_record_id IN (
+                          SELECT image_record_id FROM image_provenance
+                          WHERE post_id = :keep
+                      )
+                """),
+                {"keep": keep_id, "drop_": drop_id},
+            )
+            conn.execute(
+                text("""
+                    UPDATE image_provenance SET post_id = :keep
+                    WHERE post_id = :drop_
+                """),
+                {"keep": keep_id, "drop_": drop_id},
+            )
+            conn.execute(
+                text("""
+                    UPDATE image_record SET primary_post_id = :keep
+                    WHERE primary_post_id = :drop_
+                """),
+                {"keep": keep_id, "drop_": drop_id},
+            )
+            conn.execute(
+                text("""
+                    UPDATE post_attachment SET post_id = :keep
+                    WHERE post_id = :drop_
+                """),
+                {"keep": keep_id, "drop_": drop_id},
+            )
+            conn.execute(
+                text("DELETE FROM post WHERE id = :drop_"),
+                {"drop_": drop_id},
+            )
+            merged += 1
+    print(f"0025: subscribestar — merged {merged} duplicate Post fragments")
+
+    # ── PART 3: Pixiv post_url backfill (pure SQL) ───────────────────
+    # Pixiv's external_post_id is already correct (gallery-dl's `id` is
+    # the post id). Only post_url needs derivation: replace anything
+    # under i.pximg.net (the file URL) with the /artworks/<id> permalink.
+    pixiv_updated = conn.execute(text("""
+        UPDATE post p
+        SET post_url = 'https://www.pixiv.net/artworks/' || p.external_post_id
+        FROM source s
+        WHERE p.source_id = s.id
+          AND s.platform = 'pixiv'
+          AND p.external_post_id IS NOT NULL
+          AND (p.post_url IS NULL
+               OR p.post_url LIKE 'https://i.pximg.net/%'
+               OR p.post_url LIKE 'http://i.pximg.net/%')
+    """)).rowcount
+    print(f"0025: pixiv — backfilled post_url on {pixiv_updated} Posts")
+
+
+def _first_attachment_path(conn, post_id: int) -> str | None:
+    """Return any ImageRecord.path attached to this post (via
+    ImageProvenance). Lowest-id row keeps the migration deterministic
+    so re-running on the same DB picks the same sidecar."""
+    row = conn.execute(
+        text("""
+            SELECT ir.path
+            FROM image_provenance ip
+            JOIN image_record ir ON ir.id = ip.image_record_id
+            WHERE ip.post_id = :pid
+            ORDER BY ip.id ASC
+            LIMIT 1
+        """),
+        {"pid": post_id},
+    ).first()
+    return row[0] if row else None
+
+
+def downgrade() -> None:
+    # Lossy: external_post_id values were overwritten with the correct
+    # post_id; original per-attachment ids weren't preserved. Post-merge
+    # also deleted drop rows. No safe restore. To roll back the schema
+    # invariant, fork from 0024 and re-run sidecar imports.
+    pass

alembic/versions/0026_import_task_recovery_count_refetched.py

@@ -0,0 +1,53 @@
+"""import_task.recovery_count + refetched — poison-pill circuit breaker
+
+Revision ID: 0026
+Revises: 0025
+Create Date: 2026-05-28
+
+Backs the import-task resilience work (operator-flagged 2026-05-28):
+
+- recovery_count: how many times recover_interrupted_tasks has
+  re-queued this row from a stuck 'processing' state. A row that
+  hard-crashes the worker (OOM / segfault on a corrupt or oversized
+  input) leaves no terminal flip, so the sweep re-queues it — and
+  without a cap it would loop forever, re-crashing the worker each
+  time. After MAX_RECOVERY_ATTEMPTS the sweep marks it 'failed' with a
+  diagnostic instead.
+
+- refetched: whether a one-shot re-download has already been attempted
+  for this task's file. Bounds the Layer-2 re-fetch remediation to a
+  single attempt so source-side corruption doesn't loop.
+
+Both default to 0 / false; additive, no backfill needed.
+"""
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+
+revision: str = "0026"
+down_revision: Union[str, None] = "0025"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        "import_task",
+        sa.Column(
+            "recovery_count", sa.Integer(), nullable=False,
+            server_default="0",
+        ),
+    )
+    op.add_column(
+        "import_task",
+        sa.Column(
+            "refetched", sa.Boolean(), nullable=False,
+            server_default=sa.false(),
+        ),
+    )
+
+
+def downgrade() -> None:
+    op.drop_column("import_task", "refetched")
+    op.drop_column("import_task", "recovery_count")

alembic/versions/0027_drop_migration_run.py

@@ -0,0 +1,50 @@
+"""drop migration_run — one-and-done GS/IR migration tooling removed
+
+Revision ID: 0027
+Revises: 0026
+Create Date: 2026-05-29
+
+The GS/IR migration tooling (services/migrators, /api/migrate, the
+run_migration task, LegacyMigrationCard, and the MigrationRun model) was
+removed after the migration cutover completed. This drops its now-orphaned
+run-log table. Downgrade recreates the table (mirrors the old model) so the
+migration is reversible.
+"""
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.dialects.postgresql import JSONB
+
+revision: str = "0027"
+down_revision: Union[str, None] = "0026"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.drop_table("migration_run")
+
+
+def downgrade() -> None:
+    op.create_table(
+        "migration_run",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column("kind", sa.String(length=32), nullable=False),
+        sa.Column("status", sa.String(length=32), nullable=False),
+        sa.Column("dry_run", sa.Boolean(), nullable=False, server_default=sa.false()),
+        sa.Column(
+            "started_at", sa.DateTime(timezone=True), nullable=False,
+            server_default=sa.func.now(),
+        ),
+        sa.Column("finished_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column(
+            "counts", JSONB(), nullable=False, server_default=sa.text("'{}'::jsonb"),
+        ),
+        sa.Column("error", sa.Text(), nullable=True),
+        sa.Column(
+            "metadata", JSONB(), nullable=False, server_default=sa.text("'{}'::jsonb"),
+        ),
+    )
+    op.create_index("ix_migration_run_kind", "migration_run", ["kind"])
+    op.create_index("ix_migration_run_status", "migration_run", ["status"])

alembic/versions/0028_collapse_sidecar_synthetics_into_real_sources.py

@@ -0,0 +1,190 @@
+"""collapse-sidecar-synthetic: repoint Posts/ImageProvenance/DownloadEvents
+from `sidecar:<platform>:<slug>` synthetic Source anchors onto the real
+Source for the same (artist, platform) when one exists, then delete the
+synthetic.
+
+Revision ID: 0028
+Revises: 0027
+Create Date: 2026-05-31
+
+Background: alembic 0022 (2026-05-26) consolidated the old per-post-URL
+Source rows into one canonical Source per (artist, platform). When NO
+real campaign URL was salvageable among the candidates, it rewrote the
+canonical row to url='sidecar:<platform>:<slug>' enabled=false as a
+disabled anchor for any Posts already attached.
+
+That was fine while it was the only Source for that artist+platform.
+But: the unique constraint on Source is (artist_id, platform, url), not
+(artist_id, platform). When the operator later added the real
+subscription via the UI / extension / etc., a SECOND row landed —
+the real one — with id > the synthetic. Both coexisted.
+
+Two follow-on problems surfaced 2026-05-31:
+
+  1. The Subscriptions UI listed both rows. The synthetic was disabled
+     so the scheduler never polled it, but it looked like a phantom
+     subscription. (Fixed in same commit by SourceService.list filter.)
+  2. importer._source_for_sidecar picked Source by `ORDER BY id ASC
+     LIMIT 1`, so EVERY gallery-dl download since the real Source was
+     added attached its Post to the SYNTHETIC anchor, not the real
+     Source. (Fixed in same commit by preferring non-sidecar URLs.)
+
+This migration is the data half of the cleanup: for every (artist,
+platform) with both a synthetic AND a real Source, repoint the
+synthetic's children (Posts, ImageProvenance, DownloadEvents) onto the
+real Source and delete the synthetic. Reuses the same epid/provenance
+collision dance from alembic 0022 because the same uniqueness
+constraints fire row-by-row during bulk UPDATEs.
+
+Lone synthetic anchors — those where no real Source for the same
+(artist, platform) exists (e.g., filesystem-imported artist with no
+subscription added) — are LEFT INTACT. They anchor real imported
+content; deleting them would CASCADE-delete the Posts the operator
+imported. The SourceService.list filter hides them from the UI; the
+operator can delete them by hand if they want the underlying imports
+gone.
+"""
+from typing import Sequence, Union
+
+from alembic import op
+from sqlalchemy import text
+
+revision: str = "0028"
+down_revision: Union[str, None] = "0027"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    conn = op.get_bind()
+
+    # Find (artist_id, platform) groups where BOTH a sidecar synthetic
+    # and at least one real Source exist.
+    groups = conn.execute(text("""
+        SELECT artist_id, platform
+        FROM source
+        GROUP BY artist_id, platform
+        HAVING bool_or(url LIKE 'sidecar:%')
+           AND bool_or(url NOT LIKE 'sidecar:%')
+    """)).fetchall()
+
+    for artist_id, platform in groups:
+        rows = conn.execute(
+            text("""
+                SELECT id, url FROM source
+                WHERE artist_id = :a AND platform = :p
+                ORDER BY id ASC
+            """),
+            {"a": artist_id, "p": platform},
+        ).fetchall()
+
+        synthetic_ids = [sid for sid, url in rows if url.startswith("sidecar:")]
+        real_rows = [(sid, url) for sid, url in rows if not url.startswith("sidecar:")]
+        if not synthetic_ids or not real_rows:
+            continue  # belt+suspenders; the GROUP BY already filtered
+
+        # Canonical real: lowest-id non-sidecar Source.
+        canonical_id = real_rows[0][0]
+
+        # STEP A: PRE-merge Post collisions on (canonical, external_post_id).
+        # Mirror alembic 0022's pre-merge logic — when synth has Post X
+        # epid=N and real has Post Y epid=N, the bulk UPDATE below would
+        # trip uq_post_source_external_id row-by-row. Group all Posts
+        # under (canonical + synthetics) by epid; for any group >1,
+        # pick a keep (prefer one already under canonical, else lowest
+        # id) and merge the rest into it.
+        all_posts = conn.execute(
+            text("""
+                SELECT external_post_id, id, source_id
+                FROM post
+                WHERE source_id = :canonical OR source_id = ANY(:synths)
+                ORDER BY external_post_id, id
+            """),
+            {"canonical": canonical_id, "synths": synthetic_ids},
+        ).fetchall()
+        by_epid: dict = {}
+        for epid, post_id, src_id in all_posts:
+            by_epid.setdefault(epid, []).append((post_id, src_id))
+        for _epid, posts in by_epid.items():
+            if len(posts) <= 1:
+                continue
+            canonical_side = [p for p in posts if p[1] == canonical_id]
+            keep_id = canonical_side[0][0] if canonical_side else posts[0][0]
+            drop_ids = [p[0] for p in posts if p[0] != keep_id]
+            for drop_id in drop_ids:
+                # Pre-delete image_provenance rows under drop_ whose
+                # image_record_id already has provenance under keep —
+                # avoids tripping uq_image_provenance_image_post (0021)
+                # row-by-row during the repoint UPDATE.
+                conn.execute(
+                    text("""
+                        DELETE FROM image_provenance
+                        WHERE post_id = :drop_
+                          AND image_record_id IN (
+                              SELECT image_record_id FROM image_provenance
+                              WHERE post_id = :keep
+                          )
+                    """),
+                    {"keep": keep_id, "drop_": drop_id},
+                )
+                conn.execute(
+                    text("""
+                        UPDATE image_provenance SET post_id = :keep
+                        WHERE post_id = :drop_
+                    """),
+                    {"keep": keep_id, "drop_": drop_id},
+                )
+                conn.execute(
+                    text("""
+                        UPDATE image_record SET primary_post_id = :keep
+                        WHERE primary_post_id = :drop_
+                    """),
+                    {"keep": keep_id, "drop_": drop_id},
+                )
+                conn.execute(
+                    text("DELETE FROM post WHERE id = :drop_"),
+                    {"drop_": drop_id},
+                )
+
+        # STEP B: Bulk reparent the remaining Posts off the synthetics.
+        conn.execute(
+            text("""
+                UPDATE post SET source_id = :canonical
+                WHERE source_id = ANY(:synths)
+            """),
+            {"canonical": canonical_id, "synths": synthetic_ids},
+        )
+
+        # STEP C: Reparent ImageProvenance.source_id (denormalized FK;
+        # no UNIQUE on source_id, safe bulk).
+        conn.execute(
+            text("""
+                UPDATE image_provenance SET source_id = :canonical
+                WHERE source_id = ANY(:synths)
+            """),
+            {"canonical": canonical_id, "synths": synthetic_ids},
+        )
+
+        # STEP D: Reparent any DownloadEvent.source_id. Synthetics are
+        # enabled=false so the scheduler never created events for them;
+        # this is belt+suspenders for any rows planted by manual force
+        # or older code paths.
+        conn.execute(
+            text("""
+                UPDATE download_event SET source_id = :canonical
+                WHERE source_id = ANY(:synths)
+            """),
+            {"canonical": canonical_id, "synths": synthetic_ids},
+        )
+
+        # STEP E: Drop the now-empty synthetics.
+        conn.execute(
+            text("DELETE FROM source WHERE id = ANY(:synths)"),
+            {"synths": synthetic_ids},
+        )
+
+
+def downgrade() -> None:
+    # Lossy migration — synthetic Sources deleted, Posts repointed and
+    # potentially merged. No safe downgrade.
+    pass

backend/app/__init__.py

@@ -33,12 +33,6 @@ def create_app() -> Quart:
 
     app = Quart(__name__)
     app.secret_key = cfg.secret_key
-    # FC-5: legacy IR ingest JSON can run to tens of MB (hundreds of
-    # thousands of image_tag_associations). Werkzeug's default form
-    # memory cap is 500KB; raise both ceilings so the multipart upload
-    # for /api/migrate/ir_ingest doesn't 413.
-    app.config["MAX_CONTENT_LENGTH"] = 1024 * 1024 * 1024   # 1 GB
-    app.config["MAX_FORM_MEMORY_SIZE"] = 1024 * 1024 * 1024  # 1 GB
 
     for bp in all_blueprints():
         app.register_blueprint(bp)

backend/app/api/__init__.py

@@ -26,7 +26,6 @@ def all_blueprints() -> list[Blueprint]:
     from .extension import extension_bp
     from .gallery import gallery_bp
     from .import_admin import import_admin_bp
-    from .migrate import migrate_bp
     from .ml_admin import ml_admin_bp
     from .platforms import platforms_bp
     from .posts import posts_bp
@@ -54,7 +53,6 @@ def all_blueprints() -> list[Blueprint]:
         admin_bp,
         cleanup_bp,
         import_admin_bp,
-        migrate_bp,
         suggestions_bp,
         allowlist_bp,
         aliases_bp,

backend/app/api/_responses.py

@@ -0,0 +1,16 @@
+"""Shared API response helpers."""
+
+from quart import jsonify
+
+
+def error_response(
+    error: str, *, status: int = 400, detail: str | None = None, **extra,
+):
+    """JSON error body + HTTP status. `detail` is included only when given;
+    `extra` keys are merged into the body. Returns the (response, status)
+    tuple Quart expects. Imported as `_bad` by the blueprints."""
+    body = {"error": error}
+    if detail is not None:
+        body["detail"] = detail
+    body.update(extra)
+    return jsonify(body), status

backend/app/api/admin.py

@@ -6,6 +6,7 @@ Five action surfaces:
   DELETE /api/admin/tags/<int:tag_id>              (Tier B)
   POST   /api/admin/tags/<int:dest_id>/merge       (Tier B)
   POST   /api/admin/tags/prune-unused              (Tier A)
+  POST   /api/admin/tags/purge-legacy              (Tier A)
   GET    /api/admin/tags/<int:tag_id>/usage-count  (helper)
 
 Tier-C ops take a dry_run body flag (returns projection inline,
@@ -23,16 +24,11 @@ from sqlalchemy import select
 from ..extensions import get_session
 from ..models import Artist
 from ..services.cleanup_service import project_artist_cascade, project_bulk_image_delete
+from ._responses import error_response as _bad
 
 admin_bp = Blueprint("admin", __name__, url_prefix="/api/admin")
 
 
-def _bad(error: str, *, status: int = 400, **extra):
-    body = {"error": error}
-    body.update(extra)
-    return jsonify(body), status
-
-
 def _bulk_image_confirm_token(image_ids: list[int]) -> str:
     """Stable 8-hex token derived from the sorted id list. Mutates
     when the selection changes; stays the same across modal opens of
@@ -97,11 +93,19 @@ async def images_bulk_delete():
             )
         )
 
-    if dry_run:
-        return jsonify(projected)
-
     sha8 = _bulk_image_confirm_token(image_ids)
     expected = f"delete-images-{sha8}"
+
+    if dry_run:
+        # Hand the canonical Tier-C confirm token back with the
+        # projection so the frontend doesn't have to recompute SHA-256
+        # client-side via crypto.subtle (Secure-Context-gated,
+        # undefined on plain-HTTP origins per the homelab posture).
+        # Operator-flagged 2026-05-27.
+        projected["confirm_token"] = expected
+        return jsonify(projected)
+
+
     if supplied_confirm != expected:
         return _bad(
             "confirm_mismatch",
@@ -198,3 +202,23 @@ async def tags_prune_unused():
             )
         )
     return jsonify(result)
+
+
+@admin_bp.route("/tags/purge-legacy", methods=["POST"])
+async def tags_purge_legacy():
+    """Tier-A: delete legacy IR-migration tags — archive/post/artist
+    kinds (e.g. `BlenderKnight:Hannah_BJ_Loops`) PLUS general tags with
+    a legacy name prefix (`source:*`, from IR's source kind that fell
+    back to general). dry-run preview returns per-kind + per-prefix
+    counts + a sample so the UI shows exactly what'll go before the
+    operator confirms with dry_run=false."""
+    from ..services.cleanup_service import purge_legacy_tags
+
+    body = await request.get_json(silent=True) or {}
+    dry_run = bool(body.get("dry_run", False))
+
+    async with get_session() as session:
+        result = await session.run_sync(
+            lambda sync_sess: purge_legacy_tags(sync_sess, dry_run=dry_run)
+        )
+    return jsonify(result)

backend/app/api/cleanup.py

@@ -31,18 +31,13 @@ from sqlalchemy import select
 from ..extensions import get_session
 from ..models import LibraryAuditRun
 from ..services import cleanup_service
+from ._responses import error_response as _bad
 
 cleanup_bp = Blueprint("cleanup", __name__, url_prefix="/api/cleanup")
 
 IMAGES_ROOT = Path("/images")
 
 
-def _bad(error: str, *, status: int = 400, **extra):
-    body = {"error": error}
-    body.update(extra)
-    return jsonify(body), status
-
-
 def _min_dim_token(min_w: int, min_h: int) -> str:
     # SHA-256 (not MD5) — Web Crypto's subtle.digest rejects MD5; both
     # sides use SHA-256 truncated to 8 hex chars.
@@ -81,6 +76,13 @@ async def min_dim_preview():
                 s, min_width=min_w, min_height=min_h,
             )
         )
+    # Hand the canonical Tier-C delete token back with the preview so
+    # the frontend doesn't have to recompute SHA-256 client-side.
+    # window.crypto.subtle is Secure-Context-gated and undefined on
+    # plain-HTTP origins (homelab posture); without this the Delete
+    # button silently swallowed the TypeError and never opened the
+    # confirm modal. Operator-flagged 2026-05-27.
+    projection["confirm_token"] = _min_dim_token(min_w, min_h)
     return jsonify(projection)
 
 

backend/app/api/credentials.py

@@ -20,6 +20,7 @@ from ..services.credential_service import (
     UnknownPlatformError,
     WrongAuthTypeError,
 )
+from ._responses import error_response as _bad
 
 credentials_bp = Blueprint("credentials", __name__, url_prefix="/api/credentials")
 
@@ -38,14 +39,6 @@ def _get_crypto() -> CredentialCrypto:
     return _crypto
 
 
-def _bad(error: str, *, status: int = 400, detail: str | None = None, **extra):
-    body = {"error": error}
-    if detail is not None:
-        body["detail"] = detail
-    body.update(extra)
-    return jsonify(body), status
-
-
 async def _ext_key_ok(session) -> bool:
     """If X-Extension-Key is supplied, it must match the stored value.
     Missing header → True (browser path; accepted per homelab posture).
@@ -124,3 +117,56 @@ async def delete_credential(platform: str):
         except LookupError:
             return _bad("not_found", status=404)
     return "", 204
+
+
+@credentials_bp.route("/<platform>/verify", methods=["POST"])
+async def verify_credential(platform: str):
+    """Test the stored credential by running gallery-dl --simulate
+    against one of the platform's enabled sources. On success stamps
+    last_verified. Returns {valid: bool|null, reason, last_verified?}.
+    valid=null means "couldn't test" (no credential, or no enabled
+    source to point at)."""
+    from ..models import Artist, Source
+    from ..services.gallery_dl import GalleryDLService, SourceConfig
+
+    async with get_session() as session:
+        if not await _ext_key_ok(session):
+            return _bad("unauthorized", status=401)
+        svc = CredentialService(session, _get_crypto())
+        record = await svc.get(platform)
+        if record is None:
+            return jsonify({"valid": None, "reason": "No credential stored for this platform."})
+
+        # Pick an enabled source for this platform to point the probe at.
+        row = (await session.execute(
+            select(Source, Artist)
+            .join(Artist, Artist.id == Source.artist_id)
+            .where(Source.platform == platform, Source.enabled.is_(True))
+            .order_by(Source.id.asc())
+        )).first()
+        if row is None:
+            return jsonify({
+                "valid": None,
+                "reason": "No enabled source for this platform to verify against — add a subscription first.",
+            })
+        source, artist = row
+
+        cookies_path = await svc.get_cookies_path(platform)
+        auth_token = await svc.get_token(platform)
+
+    gdl = GalleryDLService(images_root=Path("/images"))
+    ok, message = await gdl.verify(
+        url=source.url,
+        artist_slug=artist.slug,
+        platform=platform,
+        source_config=SourceConfig.from_dict(source.config_overrides or {}),
+        cookies_path=str(cookies_path) if cookies_path else None,
+        auth_token=auth_token,
+    )
+
+    last_verified = None
+    if ok:
+        async with get_session() as session:
+            ts = await CredentialService(session, _get_crypto()).mark_verified(platform)
+            last_verified = ts.isoformat() if ts else None
+    return jsonify({"valid": ok, "reason": message, "last_verified": last_verified})

backend/app/api/downloads.py

@@ -5,8 +5,10 @@ status/source/artist. Returns slim records.
 Detail view: full DownloadEvent including the metadata JSONB.
 """
 
+from datetime import UTC, datetime, timedelta
+
 from quart import Blueprint, jsonify, request
-from sqlalchemy import select
+from sqlalchemy import func, select
 
 from ..extensions import get_session
 from ..models import Artist, DownloadEvent, Source
@@ -95,6 +97,83 @@ async def list_downloads():
     return jsonify([_list_record(e, s, a) for e, s, a in rows])
 
 
+@downloads_bp.route("/stats", methods=["GET"])
+async def downloads_stats():
+    """Status-grouped count over download_event for the dashboard stat chips.
+
+    `?window_hours=` (default 24) bounds by `started_at`. The full set of
+    statuses is always present in the response (zero for missing) so the
+    UI doesn't have to fill in defaults.
+    """
+    try:
+        window_hours = int(request.args.get("window_hours", "24"))
+    except ValueError:
+        return jsonify({"error": "invalid_window_hours"}), 400
+    if window_hours < 1 or window_hours > 24 * 365:
+        return jsonify({"error": "invalid_window_hours"}), 400
+
+    since = datetime.now(UTC) - timedelta(hours=window_hours)
+    out = {"pending": 0, "running": 0, "ok": 0, "error": 0, "skipped": 0}
+    async with get_session() as session:
+        stmt = (
+            select(DownloadEvent.status, func.count())
+            .where(DownloadEvent.started_at >= since)
+            .group_by(DownloadEvent.status)
+        )
+        for status, n in (await session.execute(stmt)).all():
+            if status in out:
+                out[status] = int(n)
+    return jsonify(out)
+
+
+@downloads_bp.route("/activity", methods=["GET"])
+async def downloads_activity():
+    """Hourly download-event counts over the last `?hours=` (default 24).
+
+    Returns a fixed-length, oldest-first bucket array so the UI can render
+    a sparkline directly. Bucketing is done in Python against UTC to dodge
+    session-timezone ambiguity in SQL date_trunc.
+    """
+    try:
+        hours = int(request.args.get("hours", "24"))
+    except ValueError:
+        return jsonify({"error": "invalid_hours"}), 400
+    hours = max(1, min(168, hours))
+
+    now = datetime.now(UTC)
+    end = now.replace(minute=0, second=0, microsecond=0)
+    start = end - timedelta(hours=hours - 1)
+    buckets = [
+        {"hour": (start + timedelta(hours=i)).isoformat(),
+         "ok": 0, "error": 0, "other": 0, "total": 0}
+        for i in range(hours)
+    ]
+
+    async with get_session() as session:
+        rows = (await session.execute(
+            select(DownloadEvent.started_at, DownloadEvent.status)
+            .where(DownloadEvent.started_at >= start)
+        )).all()
+
+    for started_at, status in rows:
+        if started_at is None:
+            continue
+        sa = started_at if started_at.tzinfo else started_at.replace(tzinfo=UTC)
+        idx = int((sa - start).total_seconds() // 3600)
+        if not (0 <= idx < hours):
+            continue
+        b = buckets[idx]
+        if status == "ok":
+            b["ok"] += 1
+        elif status == "error":
+            b["error"] += 1
+        else:
+            b["other"] += 1
+        b["total"] += 1
+
+    return jsonify({"hours": hours, "buckets": buckets})
+
+
 @downloads_bp.route("/<int:event_id>", methods=["GET"])
 async def get_download(event_id: int):
     async with get_session() as session:
@@ -108,3 +187,20 @@ async def get_download(event_id: int):
             return jsonify({"error": "not_found"}), 404
         event, source, artist = row
     return jsonify(_detail_record(event, source, artist))
+
+
+@downloads_bp.route("/recover-stalled", methods=["POST"])
+async def recover_stalled():
+    """Trigger the recover_stalled_download_events sweep on demand.
+
+    The same sweep runs every 5 min via Beat (see celery_app.beat_schedule);
+    this endpoint exists so the operator can force-clear stuck pending/
+    running download_events from the Subscriptions → Downloads maintenance
+    menu without waiting for the next scheduled tick.
+    """
+    # Local import: avoids registering maintenance tasks during blueprint
+    # import (Celery task discovery races with the API import otherwise).
+    from ..tasks.maintenance import recover_stalled_download_events
+
+    recover_stalled_download_events.delay()
+    return jsonify({"queued": True}), 202

backend/app/api/extension.py

@@ -20,6 +20,7 @@ from ..services.extension_service import (
     UnknownPlatformError,
 )
 from ..services.source_service import KNOWN_PLATFORMS
+from ._responses import error_response as _bad
 
 extension_bp = Blueprint("extension", __name__, url_prefix="/api/extension")
 
@@ -30,12 +31,6 @@ XPI_DIR = Path("/app/frontend/dist/extension")
 _XPI_VERSION_RE = re.compile(r"fabledcurator-(?P<version>[\w.-]+)\.xpi$")
 
 
-def _bad(error: str, *, status: int = 400, **extra):
-    body = {"error": error}
-    body.update(extra)
-    return jsonify(body), status
-
-
 async def _ext_key_required(session) -> bool:
     """Unlike /api/credentials (which accepts the browser path with no
     header), quick-add-source writes server state and must be explicitly

backend/app/api/import_admin.py

@@ -114,18 +114,53 @@ async def retry_failed():
                 status="queued", error=None,
                 started_at=None, finished_at=None,
             )
-            .returning(ImportTask.id)
+            .returning(ImportTask.id, ImportTask.task_type)
         )
-        failed_ids = [row[0] for row in result.all()]
-        if not failed_ids:
+        failed = result.all()
+        if not failed:
             return jsonify({"retried": 0})
         await session.commit()
 
-    from ..tasks.import_file import import_media_file
-    for tid in failed_ids:
-        import_media_file.delay(tid)
+    from ..tasks.import_file import enqueue_import
+    for tid, task_type in failed:
+        enqueue_import(tid, task_type)
 
-    return jsonify({"retried": len(failed_ids)})
+    return jsonify({"retried": len(failed)})
+
+
+@import_admin_bp.route("/tasks/<int:task_id>/refetch", methods=["POST"])
+async def refetch_task(task_id: int):
+    """Layer-2 one-shot re-download: delete the (corrupt) file behind a
+    failed import task and re-run its source's downloader to fetch a
+    fresh copy. Only works for files that resolve to an enabled,
+    real-URL subscription Source; filesystem-only imports return
+    no_source.
+
+    Returns one of: refetch_queued (+source_id) / no_source /
+    already_refetched / not_found / not_failed.
+    """
+    async with get_session() as session:
+        result = await session.run_sync(_refetch_task_sync, task_id)
+    if result["status"] == "not_found":
+        return jsonify(result), 404
+    if result["status"] == "not_failed":
+        return jsonify(result), 400
+    return jsonify(result)
+
+
+def _refetch_task_sync(session, task_id: int) -> dict:
+    from pathlib import Path
+
+    from ..models import ImportSettings
+    from ..services.refetch_service import attempt_refetch
+
+    task = session.get(ImportTask, task_id)
+    if task is None:
+        return {"status": "not_found"}
+    if task.status != "failed":
+        return {"status": "not_failed"}
+    settings = ImportSettings.load_sync(session)
+    return attempt_refetch(session, task, Path(settings.import_scan_path))
 
 
 @import_admin_bp.route("/clear-stuck", methods=["POST"])

backend/app/api/migrate.py

@@ -1,112 +0,0 @@
-"""FC-5: /api/migrate — trigger and poll migration runs.
-
-Ingest kinds (gs_ingest, ir_ingest) accept multipart/form-data with an
-`export_file` field. All other kinds accept JSON. Backup + rollback
-were retired in FC-3h (2026-05-24); use /api/system/backup/* instead.
-"""
-
-import json
-
-from quart import Blueprint, jsonify, request
-from sqlalchemy import select
-
-from ..extensions import get_session
-from ..models import MigrationRun
-from ..tasks.migration import run_migration
-
-migrate_bp = Blueprint("migrate", __name__, url_prefix="/api/migrate")
-
-# 'backup' + 'rollback' retired 2026-05-24 (FC-3h); see /api/system/backup/*.
-_VALID_KINDS = frozenset({
-    "gs_ingest", "ir_ingest", "tag_apply",
-    "ml_queue", "verify", "cleanup",
-})
-_INGEST_KINDS = frozenset({"gs_ingest", "ir_ingest"})
-
-
-def _bad(error: str, *, status: int = 400, **extra):
-    body = {"error": error}
-    body.update(extra)
-    return jsonify(body), status
-
-
-def _run_to_dict(run: MigrationRun) -> dict:
-    return {
-        "id": run.id,
-        "kind": run.kind,
-        "status": run.status,
-        "dry_run": run.dry_run,
-        "started_at": run.started_at.isoformat(),
-        "finished_at": run.finished_at.isoformat() if run.finished_at else None,
-        "counts": run.counts or {},
-        "error": run.error,
-        "metadata": run.metadata_ or {},
-    }
-
-
-@migrate_bp.route("/<kind>", methods=["POST"])
-async def create_run(kind: str):
-    if kind not in _VALID_KINDS:
-        return _bad("unknown_kind", detail=f"kind must be one of {sorted(_VALID_KINDS)}")
-
-    # Ingest kinds accept multipart/form-data; everything else takes JSON.
-    if kind in _INGEST_KINDS:
-        form = await request.form
-        files = await request.files
-        if "export_file" not in files:
-            return _bad("missing_export_file", detail="multipart export_file required")
-        export_file = files["export_file"]
-        try:
-            raw = export_file.read()
-            data = json.loads(raw.decode("utf-8"))
-        except (UnicodeDecodeError, json.JSONDecodeError) as exc:
-            return _bad("invalid_export_file", detail=str(exc))
-        dry_run = str(form.get("dry_run", "false")).lower() in ("true", "1", "yes")
-        params: dict = {"data": data, "dry_run": dry_run}
-    else:
-        body = await request.get_json()
-        if body is None:
-            body = {}
-        if not isinstance(body, dict):
-            return _bad("invalid_body")
-        dry_run = bool(body.get("dry_run", False))
-        params = dict(body)
-
-    async with get_session() as session:
-        run = MigrationRun(kind=kind, status="pending", dry_run=dry_run)
-        session.add(run)
-        await session.commit()
-        await session.refresh(run)
-        run_id = run.id
-
-    run_migration.delay(run_id, kind, params)
-    return jsonify({"run_id": run_id, "status": "pending"}), 202
-
-
-@migrate_bp.route("/runs/<int:run_id>", methods=["GET"])
-async def get_run(run_id: int):
-    async with get_session() as session:
-        run = (await session.execute(
-            select(MigrationRun).where(MigrationRun.id == run_id)
-        )).scalar_one_or_none()
-    if run is None:
-        return _bad("not_found", status=404)
-    return jsonify(_run_to_dict(run))
-
-
-@migrate_bp.route("/runs", methods=["GET"])
-async def list_runs():
-    try:
-        limit = int(request.args.get("limit", "10"))
-    except ValueError:
-        return _bad("invalid_limit")
-    if limit < 1 or limit > 100:
-        return _bad("invalid_limit")
-
-    async with get_session() as session:
-        rows = (await session.execute(
-            select(MigrationRun)
-            .order_by(MigrationRun.id.desc())
-            .limit(limit)
-        )).scalars().all()
-    return jsonify([_run_to_dict(r) for r in rows])

backend/app/api/posts.py

@@ -5,18 +5,11 @@ from quart import Blueprint, jsonify, request
 from ..extensions import get_session
 from ..services.post_feed_service import PostFeedService
 from ..services.source_service import KNOWN_PLATFORMS
+from ._responses import error_response as _bad
 
 posts_bp = Blueprint("posts", __name__, url_prefix="/api/posts")
 
 
-def _bad(error: str, *, status: int = 400, detail: str | None = None, **extra):
-    body = {"error": error}
-    if detail is not None:
-        body["detail"] = detail
-    body.update(extra)
-    return jsonify(body), status
-
-
 @posts_bp.route("", methods=["GET"])
 async def list_posts():
     args = request.args
@@ -25,6 +18,8 @@ async def list_posts():
     artist_id_raw = args.get("artist_id")
     platform = args.get("platform") or None
     limit_raw = args.get("limit", "24")
+    direction = args.get("direction", "older")
+    around_raw = args.get("around")
 
     try:
         limit = int(limit_raw)
@@ -33,6 +28,16 @@ async def list_posts():
     if limit < 1 or limit > 100:
         return _bad("invalid_limit", detail="limit must be between 1 and 100")
 
+    if direction not in ("older", "newer"):
+        return _bad("invalid_direction", detail="direction must be 'older' or 'newer'")
+
+    around_id = None
+    if around_raw is not None:
+        try:
+            around_id = int(around_raw)
+        except ValueError:
+            return _bad("invalid_around", detail="around must be an integer post id")
+
     artist_id = None
     if artist_id_raw is not None:
         try:
@@ -47,11 +52,20 @@ async def list_posts():
         )
 
     async with get_session() as session:
-        try:
-            page = await PostFeedService(session).scroll(
-                cursor=cursor, artist_id=artist_id,
+        svc = PostFeedService(session)
+        if around_id is not None:
+            result = await svc.around(
+                post_id=around_id, artist_id=artist_id,
                 platform=platform, limit=limit,
             )
+            if result is None:
+                return _bad("not_found", status=404, detail=f"post id={around_id}")
+            return jsonify(result)
+        try:
+            page = await svc.scroll(
+                cursor=cursor, artist_id=artist_id,
+                platform=platform, limit=limit, direction=direction,
+            )
         except ValueError as exc:
             # Service raises ValueError for malformed cursors only;
             # limit bounds are validated above.

backend/app/api/settings.py

@@ -31,9 +31,7 @@ _EDITABLE_FIELDS = (
 @settings_bp.route("/settings/import", methods=["GET"])
 async def get_import_settings():
     async with get_session() as session:
-        row = (
-            await session.execute(select(ImportSettings).where(ImportSettings.id == 1))
-        ).scalar_one()
+        row = await ImportSettings.load(session)
     return jsonify({
         "min_width": row.min_width,
         "min_height": row.min_height,
@@ -99,9 +97,7 @@ async def update_import_settings():
             return _bad_int("download_failure_warning_threshold", 1, 100)
 
     async with get_session() as session:
-        row = (
-            await session.execute(select(ImportSettings).where(ImportSettings.id == 1))
-        ).scalar_one()
+        row = await ImportSettings.load(session)
         for field in _EDITABLE_FIELDS:
             if field in body:
                 setattr(row, field, body[field])

backend/app/api/sources.py

@@ -5,6 +5,7 @@ from sqlalchemy import select
 
 from ..extensions import get_session
 from ..models import DownloadEvent, Source
+from ..services.scheduler_service import active_platform_cooldowns, scheduler_status
 from ..services.source_service import (
     KNOWN_PLATFORMS,
     ArtistNotFoundError,
@@ -14,18 +15,11 @@ from ..services.source_service import (
     SourceService,
     UnknownPlatformError,
 )
+from ._responses import error_response as _bad
 
 sources_bp = Blueprint("sources", __name__, url_prefix="/api/sources")
 
 
-def _bad(error: str, *, status: int = 400, detail: str | None = None, **extra):
-    body = {"error": error}
-    if detail is not None:
-        body["detail"] = detail
-    body.update(extra)
-    return jsonify(body), status
-
-
 @sources_bp.route("", methods=["GET"])
 async def list_sources():
     artist_id_raw = request.args.get("artist_id")
@@ -35,11 +29,19 @@ async def list_sources():
             artist_id = int(artist_id_raw)
         except ValueError:
             return _bad("invalid_artist_id", detail="artist_id must be an integer")
+    failing = request.args.get("failing", "").lower() in ("1", "true", "yes")
     async with get_session() as session:
-        records = await SourceService(session).list(artist_id=artist_id)
+        records = await SourceService(session).list(artist_id=artist_id, failing=failing)
     return jsonify([r.to_dict() for r in records])
 
 
+@sources_bp.route("/schedule-status", methods=["GET"])
+async def schedule_status():
+    """FC-dashboards: scheduler health for the Subscriptions hub."""
+    async with get_session() as session:
+        return jsonify(await scheduler_status(session))
+
+
 @sources_bp.route("/<int:source_id>", methods=["GET"])
 async def get_source(source_id: int):
     async with get_session() as session:
@@ -123,7 +125,16 @@ async def check_source(source_id: int):
     """FC-3c: enqueue a download for this source.
 
     Returns 202 with the new DownloadEvent id. If a pending/running
-    event already exists for this source, returns 409 with that id."""
+    event already exists for this source, returns 409 with that id. If
+    the source's platform is currently in a rate-limit cooldown, returns
+    **202 with `{status: "deferred", cooldown_until, platform}`** and
+    does NOT create an event or dispatch — the bulk retry path uses this
+    to avoid bowling N sources right back into the rate limit the
+    cooldown is preventing. Single-click "retry this one source" passes
+    `?force=true` to override the cooldown (operator-explicit, useful
+    for rapid auth-fix testing). The in-flight guard always applies.
+    """
+    force = (request.args.get("force") or "").lower() in ("1", "true", "yes")
     async with get_session() as session:
         source = (await session.execute(
             select(Source).where(Source.id == source_id)
@@ -133,6 +144,19 @@ async def check_source(source_id: int):
         if not source.enabled:
             return _bad("source_disabled", detail="enable the source first")
 
+        # Cooldown gate (unless explicitly overridden). Checked before the
+        # in-flight guard because a deferred retry doesn't need to create
+        # or check for an event at all.
+        if not force:
+            cooldowns = await active_platform_cooldowns(session)
+            expires_at = cooldowns.get(source.platform)
+            if expires_at is not None:
+                return jsonify({
+                    "status": "deferred",
+                    "platform": source.platform,
+                    "cooldown_until": expires_at.isoformat(),
+                }), 202
+
         in_flight = (await session.execute(
             select(DownloadEvent.id).where(
                 DownloadEvent.source_id == source_id,

backend/app/api/system_activity.py

@@ -20,6 +20,7 @@ from sqlalchemy import desc, func, select
 from ..config import get_config
 from ..extensions import get_session
 from ..models import TaskRun
+from ..services.scheduler_service import scheduler_status
 
 system_activity_bp = Blueprint(
     "system_activity", __name__, url_prefix="/api/system/activity",
@@ -81,17 +82,22 @@ def _read_workers_sync() -> dict:
     }
 
 
+async def _queues_cached() -> dict:
+    """Per-queue Redis LLEN, cached 2s. Shared by /queues and /summary."""
+    now = time.time()
+    if _QUEUE_CACHE["data"] is None or (now - _QUEUE_CACHE["ts"]) > _QUEUE_CACHE_TTL:
+        _QUEUE_CACHE["data"] = await asyncio.to_thread(_read_queues_sync)
+        _QUEUE_CACHE["ts"] = now
+    return _QUEUE_CACHE["data"]
+
+
 @system_activity_bp.route("/queues", methods=["GET"])
 async def get_queues():
     """Per-queue Redis LLEN. Cached 2s.
 
     Response: {queues: {name: depth_or_null}, fetched_at: iso8601}
     """
-    now = time.time()
-    if _QUEUE_CACHE["data"] is None or (now - _QUEUE_CACHE["ts"]) > _QUEUE_CACHE_TTL:
-        _QUEUE_CACHE["data"] = await asyncio.to_thread(_read_queues_sync)
-        _QUEUE_CACHE["ts"] = now
-    return jsonify(_QUEUE_CACHE["data"])
+    return jsonify(await _queues_cached())
 
 
 @system_activity_bp.route("/workers", methods=["GET"])
@@ -107,6 +113,35 @@ async def get_workers():
     return jsonify(_WORKER_CACHE["data"])
 
 
+@system_activity_bp.route("/summary", methods=["GET"])
+async def get_summary():
+    """One-call rollup for the always-on TopNav pipeline indicator:
+    scheduler health, per-queue pending depths, currently-running count, and
+    recent (24h) failure count. Cheap — cached queue LLENs + two TaskRun
+    counts — so it's safe to poll app-wide."""
+    queues_data = await _queues_cached()
+    depths = queues_data.get("queues", {})
+    queued_total = sum(v for v in depths.values() if isinstance(v, int))
+    since = datetime.now(UTC) - timedelta(hours=24)
+    async with get_session() as session:
+        scheduler = await scheduler_status(session)
+        running = (await session.execute(
+            select(func.count(TaskRun.id)).where(TaskRun.status == "running")
+        )).scalar_one()
+        failing = (await session.execute(
+            select(func.count(TaskRun.id))
+            .where(TaskRun.status.in_(["error", "timeout"]))
+            .where(TaskRun.finished_at >= since)
+        )).scalar_one()
+    return jsonify({
+        "scheduler": scheduler,
+        "queues": depths,
+        "queued_total": queued_total,
+        "running": int(running),
+        "failing": int(failing),
+    })
+
+
 @system_activity_bp.route("/runs", methods=["GET"])
 async def list_runs():
     """Paginated task_run history. Query params:

backend/app/api/system_backup.py

@@ -14,6 +14,7 @@ from sqlalchemy import desc, select
 
 from ..extensions import get_session
 from ..models import BackupRun, ImportSettings
+from ._responses import error_response as _bad
 
 system_backup_bp = Blueprint(
     "system_backup", __name__, url_prefix="/api/system/backup",
@@ -29,12 +30,6 @@ _BACKUP_SETTINGS_FIELDS = (
 )
 
 
-def _bad(error: str, *, status: int = 400, **extra):
-    body = {"error": error}
-    body.update(extra)
-    return jsonify(body), status
-
-
 def _row_to_dict(r: BackupRun) -> dict:
     return {
         "id": r.id,
@@ -232,9 +227,7 @@ async def delete_run(run_id: int):
 @system_backup_bp.route("/settings", methods=["GET"])
 async def get_settings():
     async with get_session() as session:
-        row = (await session.execute(
-            select(ImportSettings).where(ImportSettings.id == 1)
-        )).scalar_one()
+        row = await ImportSettings.load(session)
     return jsonify({
         "backup_db_nightly_enabled": row.backup_db_nightly_enabled,
         "backup_db_nightly_hour_utc": row.backup_db_nightly_hour_utc,
@@ -254,9 +247,7 @@ async def patch_settings():
         return err
 
     async with get_session() as session:
-        row = (await session.execute(
-            select(ImportSettings).where(ImportSettings.id == 1)
-        )).scalar_one()
+        row = await ImportSettings.load(session)
         for field in _BACKUP_SETTINGS_FIELDS:
             if field in body:
                 setattr(row, field, body[field])

backend/app/celery_app.py

@@ -28,7 +28,6 @@ def make_celery() -> Celery:
             "backend.app.tasks.import_file",
             "backend.app.tasks.thumbnail",
             "backend.app.tasks.maintenance",
-            "backend.app.tasks.migration",
             "backend.app.tasks.ml",
             "backend.app.tasks.download",
             "backend.app.tasks.backup",
@@ -45,7 +44,6 @@ def make_celery() -> Celery:
             "backend.app.tasks.download.*": {"queue": "download"},
             "backend.app.tasks.scan.*": {"queue": "scan"},
             "backend.app.tasks.maintenance.*": {"queue": "maintenance"},
-            "backend.app.tasks.migration.*": {"queue": "maintenance"},
             "backend.app.tasks.backup.*": {"queue": "maintenance"},
             "backend.app.tasks.admin.*": {"queue": "maintenance"},
             "backend.app.tasks.library_audit.*": {"queue": "maintenance"},
@@ -87,6 +85,10 @@ def make_celery() -> Celery:
                 "task": "backend.app.tasks.maintenance.cleanup_old_download_events",
                 "schedule": 86400.0,  # daily
             },
+            "recover-stalled-download-events": {
+                "task": "backend.app.tasks.maintenance.recover_stalled_download_events",
+                "schedule": 300.0,  # every 5 min, matches recover-interrupted-tasks
+            },
             "recover-stalled-task-runs": {
                 "task": "backend.app.tasks.maintenance.recover_stalled_task_runs",
                 "schedule": 300.0,  # every 5 min, matches recover-interrupted-tasks

backend/app/celery_signals.py

@@ -66,10 +66,7 @@ def _queue_for(task) -> str:
         return "download"
     if name.startswith("backend.app.tasks.scan."):
         return "scan"
-    if name.startswith((
-        "backend.app.tasks.maintenance.",
-        "backend.app.tasks.migration.",
-    )):
+    if name.startswith("backend.app.tasks.maintenance."):
         return "maintenance"
     return "default"
 

backend/app/models/__init__.py

@@ -12,7 +12,6 @@ from .import_batch import ImportBatch
 from .import_settings import ImportSettings
 from .import_task import ImportTask
 from .library_audit_run import LibraryAuditRun
-from .migration_run import MigrationRun
 from .ml_settings import MLSettings
 from .post import Post
 from .post_attachment import PostAttachment
@@ -46,7 +45,6 @@ __all__ = [
     "ImportSettings",
     "LibraryAuditRun",
     "MLSettings",
-    "MigrationRun",
     "TagAlias",
     "TagAllowlist",
     "TagReferenceEmbedding",

backend/app/models/import_settings.py

@@ -4,7 +4,7 @@ Enforced as a single row via a CHECK (id = 1) constraint. The application
 always SELECTs id=1 and never inserts/deletes after the initial migration.
 """
 
-from sqlalchemy import Boolean, CheckConstraint, Float, Integer, Text
+from sqlalchemy import Boolean, CheckConstraint, Float, Integer, Text, select
 from sqlalchemy.orm import Mapped, mapped_column
 
 from .base import Base
@@ -63,3 +63,13 @@ class ImportSettings(Base):
     backup_images_keep_last_n: Mapped[int] = mapped_column(
         Integer, nullable=False, default=3,
     )
+
+    @classmethod
+    async def load(cls, session) -> ImportSettings:
+        """The singleton settings row (id=1), via an async session."""
+        return (await session.execute(select(cls).where(cls.id == 1))).scalar_one()
+
+    @classmethod
+    def load_sync(cls, session) -> ImportSettings:
+        """The singleton settings row (id=1), via a sync session."""
+        return session.execute(select(cls).where(cls.id == 1)).scalar_one()

backend/app/models/import_task.py

@@ -8,7 +8,16 @@ been processing longer than the stuck-task threshold.
 
 from datetime import datetime
 
-from sqlalchemy import BigInteger, DateTime, ForeignKey, Integer, String, Text, func
+from sqlalchemy import (
+    BigInteger,
+    Boolean,
+    DateTime,
+    ForeignKey,
+    Integer,
+    String,
+    Text,
+    func,
+)
 from sqlalchemy.orm import Mapped, mapped_column, relationship
 
 from .base import Base
@@ -26,6 +35,13 @@ class ImportTask(Base):
     task_type: Mapped[str] = mapped_column(String(16), nullable=False)  # media|archive
     status: Mapped[str] = mapped_column(String(16), nullable=False, default="pending", index=True)
 
+    # Poison-pill circuit breaker (alembic 0026). recovery_count tracks
+    # how many times the stuck-task sweep has re-queued this row; after
+    # the cap it's failed with a diagnostic instead of looping. refetched
+    # bounds the one-shot re-download remediation to a single attempt.
+    recovery_count: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
+    refetched: Mapped[bool] = mapped_column(Boolean, nullable=False, default=False)
+
     result_image_id: Mapped[int | None] = mapped_column(
         ForeignKey("image_record.id", ondelete="SET NULL"), nullable=True
     )

backend/app/models/migration_run.py

@@ -1,37 +0,0 @@
-"""MigrationRun — tracks each FC-5 migration invocation (backup/gs/ir/etc).
-
-kind/status are String(32) not Postgres ENUM so adding kinds later
-doesn't need a schema migration. The API layer validates values.
-"""
-
-from datetime import datetime
-
-import sqlalchemy as sa
-from sqlalchemy import Boolean, DateTime, Integer, String, Text, func
-from sqlalchemy.dialects.postgresql import JSONB
-from sqlalchemy.orm import Mapped, mapped_column
-
-from .base import Base
-
-
-class MigrationRun(Base):
-    __tablename__ = "migration_run"
-
-    id: Mapped[int] = mapped_column(Integer, primary_key=True)
-    kind: Mapped[str] = mapped_column(String(32), nullable=False, index=True)
-    status: Mapped[str] = mapped_column(String(32), nullable=False, index=True)
-    dry_run: Mapped[bool] = mapped_column(Boolean, nullable=False, default=False)
-    started_at: Mapped[datetime] = mapped_column(
-        DateTime(timezone=True), nullable=False, server_default=func.now(),
-    )
-    finished_at: Mapped[datetime | None] = mapped_column(
-        DateTime(timezone=True), nullable=True,
-    )
-    counts: Mapped[dict] = mapped_column(
-        JSONB, nullable=False, default=dict, server_default=sa.text("'{}'::jsonb"),
-    )
-    error: Mapped[str | None] = mapped_column(Text, nullable=True)
-    metadata_: Mapped[dict] = mapped_column(
-        "metadata", JSONB, nullable=False, default=dict,
-        server_default=sa.text("'{}'::jsonb"),
-    )

backend/app/services/artist_directory_service.py

@@ -127,17 +127,20 @@ class ArtistDirectoryService:
                 ImageRecord.artist_id.label("artist_id"),
                 ImageRecord.sha256.label("sha256"),
                 ImageRecord.mime.label("mime"),
+                ImageRecord.thumbnail_path.label("thumbnail_path"),
                 rn,
             )
             .where(ImageRecord.artist_id.in_(artist_ids))
             .subquery()
         )
         stmt = (
-            select(sub.c.artist_id, sub.c.sha256, sub.c.mime)
+            select(
+                sub.c.artist_id, sub.c.sha256, sub.c.mime, sub.c.thumbnail_path,
+            )
             .where(sub.c.rn <= _PREVIEW_COUNT)
             .order_by(sub.c.artist_id, sub.c.rn)
         )
         out: dict[int, list[str]] = {}
-        for aid, sha, mime in (await self.session.execute(stmt)).all():
-            out.setdefault(aid, []).append(thumbnail_url(sha, mime))
+        for aid, sha, mime, tp in (await self.session.execute(stmt)).all():
+            out.setdefault(aid, []).append(thumbnail_url(tp, sha, mime))
         return out

backend/app/services/artist_service.py

@@ -198,7 +198,7 @@ class ArtistService:
                     "mime": r.mime,
                     "width": r.width,
                     "height": r.height,
-                    "thumbnail_url": thumbnail_url(r.sha256, r.mime),
+                    "thumbnail_url": thumbnail_url(r.thumbnail_path, r.sha256, r.mime),
                 }
                 for r in rows
             ],

backend/app/services/cleanup_service.py

@@ -6,9 +6,8 @@ HTTP handlers (small ops) and from Celery tasks in
 backend.app.tasks.admin (long ops).
 
 This module is the PERMANENT home of artist-cascade + image-unlink
-logic. The legacy copy at backend/app/services/migrators/cleanup.py
-stays in place until FC-3j; FC-3j will replace its body with thin
-re-exports from this module and then delete the wrapper.
+logic. (The legacy migrators/cleanup.py copy was removed with the rest of
+the one-and-done GS/IR migration tooling.)
 """
 from __future__ import annotations
 
@@ -16,7 +15,7 @@ from datetime import UTC, datetime
 from pathlib import Path
 from typing import Any
 
-from sqlalchemy import func, select, update
+from sqlalchemy import func, or_, select, update
 from sqlalchemy.orm import Session
 
 from ..models import Artist, ImageRecord, LibraryAuditRun, Tag
@@ -369,6 +368,72 @@ def prune_unused_tags(session: Session, *, dry_run: bool = False) -> dict:
     return {"deleted": len(ids), "sample_names": sample}
 
 
+# Legacy tags FC no longer uses, in two shapes:
+#   (1) kinds the tag input never produces — archive/post/artist.
+#       provenance (post grouping) + archive membership are their own
+#       systems now, and artists are first-class Artist/Source rows.
+#       meta/rating were already hard-deleted by alembic 0023.
+#   (2) name prefixes from IR kinds FC never adopted — `source:*`.
+#       ImageRepo had a `source` kind; FC's enum doesn't, so ir_ingest
+#       fell those back to `general` (kind=general, name="source:patreon"
+#       etc.). They can't be caught by kind, so we match the name prefix.
+PURGEABLE_TAG_KINDS = ("archive", "post", "artist")
+LEGACY_NAME_PREFIXES = ("source:",)
+
+
+def _legacy_tag_predicate():
+    name_clauses = [Tag.name.like(f"{p}%") for p in LEGACY_NAME_PREFIXES]
+    return or_(Tag.kind.in_(PURGEABLE_TAG_KINDS), *name_clauses)
+
+
+def purge_legacy_tags(session: Session, *, dry_run: bool = False) -> dict:
+    """Count (dry_run) or delete legacy IR-migration tags: archive/post/
+    artist-kind tags PLUS general tags whose name matches a legacy
+    prefix (source:*).
+
+    CASCADE on image_tag / tag_alias / tag_allowlist /
+    tag_reference_embedding / tag_suggestion_rejection / series_page
+    clears the related rows on the parent DELETE.
+
+    Returns:
+      {"by_kind": {kind: count, ...},        # kind-matched rows
+       "by_prefix": {"source:*": count},     # name-prefix-matched rows
+       "count": total, "sample_names": [first 50],
+       and on live runs "deleted": total}
+    """
+    predicate = _legacy_tag_predicate()
+    rows = session.execute(
+        select(Tag.id, Tag.name, Tag.kind).where(predicate)
+    ).all()
+    by_kind: dict[str, int] = {}
+    by_prefix: dict[str, int] = {}
+    for _id, name, kind in rows:
+        # Classify by name-prefix first so a source:* row counts once,
+        # under the prefix bucket, regardless of its (general) kind.
+        matched_prefix = next(
+            (p for p in LEGACY_NAME_PREFIXES if name.startswith(p)), None,
+        )
+        if matched_prefix is not None:
+            label = f"{matched_prefix}*"
+            by_prefix[label] = by_prefix.get(label, 0) + 1
+        else:
+            key = kind.value if hasattr(kind, "value") else str(kind)
+            by_kind[key] = by_kind.get(key, 0) + 1
+    sample = [name for _id, name, _kind in rows[:50]]
+    total = len(rows)
+    result = {
+        "by_kind": by_kind, "by_prefix": by_prefix,
+        "count": total, "sample_names": sample,
+    }
+    if dry_run:
+        return result
+    if total:
+        session.execute(Tag.__table__.delete().where(predicate))
+        session.commit()
+    result["deleted"] = total
+    return result
+
+
 # ---------------------------------------------------------------------------
 # FC-Cleanup additions (2026-05-26): retroactive audit of import-filter rules.
 # ---------------------------------------------------------------------------

backend/app/services/credential_service.py

@@ -7,7 +7,7 @@ from __future__ import annotations
 import json
 import os
 from dataclasses import dataclass
-from datetime import datetime
+from datetime import UTC, datetime
 from pathlib import Path
 
 from sqlalchemy import select
@@ -148,6 +148,7 @@ class CredentialService:
             return None
         plaintext = self.crypto.decrypt(row.encrypted_blob)
         netscape = _to_netscape(plaintext)
+        netscape = _augment_cookies(platform, netscape)
         self.cookies_dir.mkdir(parents=True, exist_ok=True)
         out = self.cookies_dir / f"{platform}_cookies.txt"
         out.write_text(netscape)
@@ -162,6 +163,32 @@ class CredentialService:
             return None
         return self.crypto.decrypt(row.encrypted_blob)
 
+    async def mark_verified(self, platform: str) -> datetime | None:
+        """Stamp last_verified=now after a successful verify. Returns the
+        timestamp, or None if the credential is gone."""
+        row = (await self.session.execute(
+            select(Credential).where(Credential.platform == platform)
+        )).scalar_one_or_none()
+        if row is None:
+            return None
+        ts = datetime.now(UTC)
+        row.last_verified = ts
+        await self.session.commit()
+        return ts
+
+
+def _augment_cookies(platform: str, netscape: str) -> str:
+    """Delegate to the platform's `augment_cookies` hook if one is
+    registered (subscribestar, hentaifoundry, etc. — see
+    `services/platforms/<name>.py`). No-op when the platform doesn't
+    register a hook (Patreon, DeviantArt). Centralizing the
+    quirks-per-platform in the platforms package means adding a new
+    platform's cookie quirks doesn't require touching this file."""
+    info = PLATFORMS.get(platform)
+    if info is None or info.augment_cookies is None:
+        return netscape
+    return info.augment_cookies(netscape)
+
 
 def _to_netscape(plaintext: str) -> str:
     """Accept either Netscape-format text (the extension's output) or a

backend/app/services/download_service.py

@@ -28,6 +28,7 @@ from .credential_service import CredentialService
 from .gallery_dl import GalleryDLService, SourceConfig
 from .importer import Importer
 from .patreon_resolver import resolve_campaign_id
+from .scheduler_service import set_platform_cooldown
 
 log = logging.getLogger(__name__)
 
@@ -276,18 +277,27 @@ class DownloadService:
         }
         await self._update_source_health(
             source_id=ctx["source_id"], status=status, error_message=ev.error,
+            error_type=dl_result.error_type.value if dl_result.error_type else None,
         )
         await self.async_session.commit()
         return event_id
 
     async def _update_source_health(
         self, *, source_id: int, status: str, error_message: str | None,
+        error_type: str | None = None,
     ) -> None:
         """FC-3d: update Source.{consecutive_failures, last_error, last_checked_at}.
 
         ok      -> failures = 0, error = None, checked_at = now
         error   -> failures += 1, error = error_message, checked_at = now
         skipped -> failures unchanged, error = None, checked_at = now
+
+        When error_type == 'rate_limited', also stamps a platform-wide
+        cooldown via scheduler_service.set_platform_cooldown so the next
+        scan tick skips every source on this platform until the cooldown
+        expires. Preventive half of the burst-prevention pair —
+        consecutive_failures still backs the offending source off across
+        ticks.
         """
         source = (await self.async_session.execute(
             select(Source).where(Source.id == source_id)
@@ -299,6 +309,8 @@ class DownloadService:
         elif status == "error":
             source.consecutive_failures = (source.consecutive_failures or 0) + 1
             source.last_error = error_message
+            if error_type == "rate_limited":
+                await set_platform_cooldown(self.async_session, source.platform)
         elif status == "skipped":
             source.last_error = None
         source.last_checked_at = now

backend/app/services/gallery_dl.py

@@ -42,6 +42,18 @@ class ErrorType(StrEnum):
     UNKNOWN_ERROR = "unknown_error"
 
 
+# 30 seconds shy of download_source's Celery soft_time_limit (900s, see
+# tasks/download.py:32). subprocess.run MUST raise TimeoutExpired before
+# Celery raises SoftTimeLimitExceeded — otherwise Celery wins the race,
+# SIGKILLs the worker, in-memory stdout/stderr is lost, and the
+# DownloadEvent ends up empty-logged with "stranded by recovery sweep"
+# 18 minutes later (operator-flagged 2026-05-31, Knuxy event #38275).
+# The 30s buffer absorbs scheduler jitter / GC pauses without making
+# legitimately-long-running syncs timeout-friendlier. Per-source bumps
+# still live in source.config_overrides for legitimately long syncs.
+_DEFAULT_GDL_TIMEOUT_SECONDS = 870
+
+
 @dataclass
 class SourceConfig:
     content_types: list[str] = field(default_factory=lambda: ["all"])
@@ -51,7 +63,7 @@ class SourceConfig:
     filename_pattern: str | None = None
     skip_existing: bool = True
     save_metadata: bool = True
-    timeout: int = 3600
+    timeout: int = _DEFAULT_GDL_TIMEOUT_SECONDS
 
     @classmethod
     def from_dict(cls, data: dict) -> SourceConfig:
@@ -63,7 +75,7 @@ class SourceConfig:
             filename_pattern=data.get("filename_pattern"),
             skip_existing=data.get("skip_existing", True),
             save_metadata=data.get("save_metadata", True),
-            timeout=data.get("timeout", 3600),
+            timeout=data.get("timeout", _DEFAULT_GDL_TIMEOUT_SECONDS),
         )
 
 
@@ -360,7 +372,17 @@ class GalleryDLService:
         if return_code in (1, 4) and (skip_line_count > 0 or has_skip_text) and not has_actual_error:
             return ErrorType.NO_NEW_CONTENT, "No new content to download"
 
-        if return_code in (1, 4) and not has_actual_error:
+        # Tier-gated classification used to require `return_code in (1, 4)`,
+        # which silently fell through to UNKNOWN_ERROR when gallery-dl
+        # returned a different exit code for mixed-failure runs (e.g.
+        # paywall warnings + a missing yt-dlp dep flipping the exit bits).
+        # The artist then surfaced as "needs attention" purely because a
+        # paywall blocked posts the operator wasn't paying to see —
+        # operator-flagged 2026-05-31. Now: if no source-level error
+        # category fired AND tier-gated warnings are present, classify
+        # as TIER_LIMITED regardless of return code. Same priority order
+        # as before (auth/rate/access/not_found/network/http still win).
+        if not has_actual_error:
             tier_gated_lines = [
                 line for line in combined.split("\n")
                 if "][warning]" in line and "not allowed to view post" in line
@@ -632,13 +654,57 @@ class GalleryDLService:
                 started_at=started_at, completed_at=completed_at,
             )
 
-        except subprocess.TimeoutExpired:
+        except subprocess.TimeoutExpired as e:
             duration = time.time() - start_time
-            log.error("Download timeout for %s/%s after %.1fs", artist_slug, platform, duration)
+            # subprocess.run(text=True) makes these str if non-None, but the
+            # caller may have raised TimeoutExpired manually with None or
+            # bytes (tests do); coerce both cases to str.
+            partial_stdout = e.stdout or ""
+            partial_stderr = e.stderr or ""
+            if isinstance(partial_stdout, bytes):
+                partial_stdout = partial_stdout.decode("utf-8", "replace")
+            if isinstance(partial_stderr, bytes):
+                partial_stderr = partial_stderr.decode("utf-8", "replace")
+
+            files_so_far = self._count_downloaded_files(partial_stdout)
+            written_so_far = [str(p) for p in self._written_paths(partial_stdout)]
+            stderr_lines = partial_stderr.strip().splitlines()
+            tail_hint = stderr_lines[-1] if stderr_lines else "no stderr output"
+
+            # If the partial output already shows a rate-limit pattern, the
+            # timeout was almost certainly gallery-dl spinning on retries —
+            # promote to RATE_LIMITED so _update_source_health stamps the
+            # platform cooldown (same code path as a clean-exit rate limit).
+            # Otherwise stay TIMEOUT and let the captured stdout/stderr +
+            # files_so_far tell the operator whether it was "lots of
+            # content" vs "stuck retrying" vs "hung silent".
+            combined = (partial_stdout + "\n" + partial_stderr).lower()
+            if any(p in combined for p in self.RATE_LIMIT_PATTERNS):
+                error_type = ErrorType.RATE_LIMITED
+                error_message = (
+                    f"Rate-limited and never completed within "
+                    f"{source_config.timeout}s ({files_so_far} files written)"
+                )
+            else:
+                error_type = ErrorType.TIMEOUT
+                error_message = (
+                    f"Download timed out after {source_config.timeout}s — "
+                    f"{files_so_far} file(s) written; last stderr: {tail_hint}"
+                )
+
+            log.error(
+                "Download timeout for %s/%s after %.1fs (%d files written, "
+                "last stderr: %s)",
+                artist_slug, platform, duration, files_so_far, tail_hint,
+            )
+
             return DownloadResult(
                 success=False, url=url, artist_slug=artist_slug, platform=platform,
-                error_type=ErrorType.TIMEOUT,
-                error_message=f"Download timed out after {source_config.timeout} seconds",
+                files_downloaded=files_so_far,
+                written_paths=written_so_far,
+                stdout=partial_stdout, stderr=partial_stderr,
+                return_code=-1,  # killed by timeout, no real exit code
+                error_type=error_type, error_message=error_message,
                 duration_seconds=duration,
                 started_at=started_at,
                 completed_at=datetime.now(UTC).isoformat(),
@@ -658,3 +724,64 @@ class GalleryDLService:
                 Path(temp_config_path).unlink()  # noqa: ASYNC240
             except Exception:
                 pass
+
+    async def verify(
+        self,
+        url: str,
+        artist_slug: str,
+        platform: str,
+        source_config: SourceConfig | None = None,
+        cookies_path: str | None = None,
+        auth_token: str | None = None,
+        timeout: float = 45.0,  # noqa: ASYNC109 — subprocess.run timeout, not a coroutine deadline
+    ) -> tuple[bool, str]:
+        """Test that credentials authenticate against `url` WITHOUT
+        downloading anything. Runs gallery-dl in --simulate mode limited
+        to the first item; if auth is bad the extractor errors before it
+        can list, which _categorize_error flags as AUTH_ERROR. Returns
+        (ok, message). Used by the credential Verify button."""
+        if source_config is None:
+            source_config = SourceConfig()
+        config = self._build_config_for_source(platform, source_config, artist_slug)
+        if cookies_path:
+            config["extractor"]["cookies"] = cookies_path
+        if auth_token and platform == "discord":
+            config["extractor"].setdefault("discord", {})["token"] = auth_token
+        if auth_token and platform == "pixiv":
+            config["extractor"].setdefault("pixiv", {})["refresh-token"] = auth_token
+
+        with tempfile.NamedTemporaryFile(
+            mode="w", suffix=".json", delete=False, dir=str(self._config_dir),
+        ) as fh:
+            json.dump(config, fh, indent=2)
+            temp_config_path = fh.name
+        try:
+            cmd = [
+                sys.executable, "-m", "gallery_dl",
+                "--config", temp_config_path,
+                "--simulate", "--range", "1-1", "--verbose", url,
+            ]
+            loop = asyncio.get_running_loop()
+            proc = await loop.run_in_executor(
+                None,
+                lambda: subprocess.run(
+                    cmd, capture_output=True, text=True, timeout=timeout,
+                ),
+            )
+            etype, msg = self._categorize_error(proc.returncode, proc.stdout, proc.stderr)
+            if proc.returncode == 0 or etype == ErrorType.NO_NEW_CONTENT:
+                return True, "Credentials valid — the feed authenticated."
+            if etype == ErrorType.AUTH_ERROR:
+                return False, msg
+            # Network / not-found / rate-limit / unknown: inconclusive,
+            # not a definitive credential failure. Surface the reason.
+            return False, f"Could not confirm ({etype.value}): {msg}"
+        except subprocess.TimeoutExpired:
+            return False, f"Verification timed out after {timeout:.0f}s"
+        except Exception as exc:  # noqa: BLE001
+            return False, f"Verification error: {exc}"
+        finally:
+            try:
+                Path(temp_config_path).unlink()  # noqa: ASYNC240
+            except Exception:
+                pass

backend/app/services/gallery_service.py

@@ -90,9 +90,27 @@ class TimelineBucket:
     count: int
 
 
-def thumbnail_url(sha256_hex: str, mime: str) -> str:
-    # Quart serves /images/* via the frontend blueprint (FC-1); thumbnails go
-    # under /images/thumbs/. The MIME determines the extension.
+def thumbnail_url(thumbnail_path: str | None, sha256_hex: str, mime: str) -> str:
+    """Return the URL to fetch a thumbnail.
+
+    Prefers the stored thumbnail_path verbatim — Quart serves /images/*
+    1:1 from the volume (frontend.py:20-36), so the URL IS the disk
+    path. Falls back to deriving from (sha256, mime) only when the
+    record's thumbnail_path is NULL (thumbnailer hasn't run yet); that
+    URL will 404 until backfill catches it, same as before the path
+    was tracked.
+
+    Pre-2026-05-30 this was derived only from (sha256, mime), which
+    disagreed with the actual on-disk extension when the thumbnailer
+    chose its format from transparency rather than MIME — every PNG
+    source without alpha (extension was .jpg on disk) and every WebP
+    source with alpha (extension was .png on disk) silently 404'd
+    despite the thumbnail file existing.
+    """
+    if thumbnail_path:
+        return thumbnail_path
+    # Fallback for records with no thumbnail recorded yet — preserves
+    # prior behavior (URL exists but 404s until backfill regenerates).
     ext = ".png" if mime in ("image/png", "image/gif") else ".jpg"
     bucket = sha256_hex[:3]
     return f"/images/thumbs/{bucket}/{sha256_hex}{ext}"
@@ -198,7 +216,7 @@ class GalleryService:
                 created_at=record.created_at,
                 effective_date=eff_date,
                 posted_at=posted_at,
-                thumbnail_url=thumbnail_url(record.sha256, record.mime),
+                thumbnail_url=thumbnail_url(record.thumbnail_path, record.sha256, record.mime),
                 artist=artists.get(record.id),
             )
             for record, posted_at, eff_date in rows
@@ -306,7 +324,7 @@ class GalleryService:
             "integrity_status": record.integrity_status,
             "created_at": record.created_at.isoformat(),
             "posted_at": posted_at.isoformat() if posted_at else None,
-            "thumbnail_url": thumbnail_url(record.sha256, record.mime),
+            "thumbnail_url": thumbnail_url(record.thumbnail_path, record.sha256, record.mime),
             "image_url": f"/images/{record.path.split('/images/', 1)[-1]}",
             "artist": (
                 {"id": artist.id, "name": artist.name, "slug": artist.slug}

backend/app/services/importer.py

@@ -30,6 +30,7 @@ from ..models import (
     PostAttachment,
     Source,
 )
+from ..utils import safe_probe
 from ..utils.paths import derive_subdir, derive_top_level_artist, hash_suffixed_name
 from ..utils.phash import compute_phash, find_similar
 from ..utils.sidecar import find_sidecar, parse_sidecar
@@ -203,6 +204,32 @@ class Importer:
                 (phash, width or 0, height or 0, image_id)
             )
 
+    def _get_or_create(self, stmt, factory):
+        """Race-safe find-or-create. Run `stmt` (scalar_one_or_none); if a
+        row exists, return it. Otherwise open a savepoint and INSERT
+        ``factory()``; on IntegrityError (a concurrent worker inserted the
+        same row first) roll the savepoint back — NOT the outer transaction,
+        which would lose the surrounding scan's progress — and re-run `stmt`
+        (scalar_one) to return the row the other worker created.
+
+        Centralizes the pattern shared by _find_or_create_source,
+        _source_for_sidecar, and _find_or_create_post. The plain
+        SELECT-then-INSERT version lost races under the 5-min recovery sweep
+        (operator-flagged 2026-05-26)."""
+        existing = self.session.execute(stmt).scalar_one_or_none()
+        if existing is not None:
+            return existing
+        sp = self.session.begin_nested()
+        try:
+            row = factory()
+            self.session.add(row)
+            self.session.flush()
+            sp.commit()
+            return row
+        except IntegrityError:
+            sp.rollback()
+            return self.session.execute(stmt).scalar_one()
+
     def _find_or_create_source(
         self, *, artist_id: int, platform: str, url: str,
     ) -> Source:
@@ -221,53 +248,57 @@ class Importer:
         and re-select — the concurrent op just created the row we
         wanted, so the second select will find it.
         """
-        existing = self.session.execute(
-            select(Source).where(
-                Source.artist_id == artist_id,
-                Source.platform == platform,
-                Source.url == url,
-            )
-        ).scalar_one_or_none()
-        if existing is not None:
-            return existing
-        sp = self.session.begin_nested()
-        try:
-            row = Source(artist_id=artist_id, platform=platform, url=url)
-            self.session.add(row)
-            self.session.flush()
-            sp.commit()
-            return row
-        except IntegrityError:
-            sp.rollback()
-            return self.session.execute(
-                select(Source).where(
-                    Source.artist_id == artist_id,
-                    Source.platform == platform,
-                    Source.url == url,
-                )
-            ).scalar_one()
+        stmt = select(Source).where(
+            Source.artist_id == artist_id,
+            Source.platform == platform,
+            Source.url == url,
+        )
+        return self._get_or_create(
+            stmt,
+            lambda: Source(artist_id=artist_id, platform=platform, url=url),
+        )
 
     def _source_for_sidecar(
         self, *, artist_id: int, platform: str, artist_slug: str,
     ) -> Source:
-        """Filesystem-import sidecar Source resolver.
+        """Sidecar-import Source resolver. Used by both filesystem imports
+        and gallery-dl downloads (both write sidecar JSON, both flow through
+        _apply_sidecar / _capture_attachment).
 
         Source represents a subscription feed (one per artist+platform — the
-        gallery-dl URL polled by the FC-3 downloader). The filesystem importer
-        used to call _find_or_create_source(url=sd.post_url), which created
-        one Source row per post URL — 100s of junk Sources per artist, all
-        with enabled=True, polluting the artist detail page and tricking the
+        URL polled by the FC-3 downloader). The filesystem importer used to
+        call _find_or_create_source(url=sd.post_url), creating one Source
+        row per post URL — 100s of junk Sources per artist, all with
+        enabled=True, polluting the artist detail page and tricking the
         subscription checker into trying to poll patreon post URLs as feeds.
-        Operator-flagged 2026-05-26.
+        Operator-flagged 2026-05-26; consolidated via alembic 0022.
 
-        New behaviour: if any Source row exists for (artist_id, platform),
-        reuse it regardless of its URL — the artist's real subscription Source
-        (created by the downloader / extension / UI) is the canonical
-        attachment point for filesystem-imported posts. If none exists, create
-        ONE synthetic anchor with url='sidecar:<platform>:<artist_slug>' and
-        enabled=False (so the subscription checker doesn't poll it).
+        Resolution order: prefer a real (non-sidecar) Source over a
+        synthetic anchor. When alembic 0022 ran, it may have rewritten
+        per-post Sources into `sidecar:<platform>:<slug>` synthetic
+        anchors. If the operator later added the real subscription, both
+        rows now coexist. A naive `ORDER BY id ASC LIMIT 1` lookup would
+        pick the older synthetic and silently attach every gallery-dl
+        download to the wrong Source — operator-flagged 2026-05-31 after
+        the Subscriptions UI surfaced the phantom anchors. Pick the real
+        one when one exists; fall back to the synthetic; only create a
+        new synthetic when nothing exists for (artist, platform).
         """
-        existing = self.session.execute(
+        real_stmt = (
+            select(Source)
+            .where(
+                Source.artist_id == artist_id,
+                Source.platform == platform,
+                ~Source.url.like("sidecar:%"),
+            )
+            .order_by(Source.id.asc())
+            .limit(1)
+        )
+        real = self.session.execute(real_stmt).scalar_one_or_none()
+        if real is not None:
+            return real
+
+        any_stmt = (
             select(Source)
             .where(
                 Source.artist_id == artist_id,
@@ -275,33 +306,16 @@ class Importer:
             )
             .order_by(Source.id.asc())
             .limit(1)
-        ).scalar_one_or_none()
-        if existing is not None:
-            return existing
-        synthetic_url = f"sidecar:{platform}:{artist_slug}"
-        sp = self.session.begin_nested()
-        try:
-            row = Source(
+        )
+        return self._get_or_create(
+            any_stmt,
+            lambda: Source(
                 artist_id=artist_id,
                 platform=platform,
-                url=synthetic_url,
+                url=f"sidecar:{platform}:{artist_slug}",
                 enabled=False,
-            )
-            self.session.add(row)
-            self.session.flush()
-            sp.commit()
-            return row
-        except IntegrityError:
-            sp.rollback()
-            return self.session.execute(
-                select(Source)
-                .where(
-                    Source.artist_id == artist_id,
-                    Source.platform == platform,
-                )
-                .order_by(Source.id.asc())
-                .limit(1)
-            ).scalar_one()
+            ),
+        )
 
     def _find_or_create_post(
         self, *, source_id: int, external_post_id: str,
@@ -309,29 +323,14 @@ class Importer:
         """Race-safe find-or-create on `post` keyed by
         (source_id, external_post_id). Mirrors `_find_or_create_source`
         — same savepoint + IntegrityError-recovery pattern."""
-        existing = self.session.execute(
-            select(Post).where(
-                Post.source_id == source_id,
-                Post.external_post_id == external_post_id,
-            )
-        ).scalar_one_or_none()
-        if existing is not None:
-            return existing
-        sp = self.session.begin_nested()
-        try:
-            row = Post(source_id=source_id, external_post_id=external_post_id)
-            self.session.add(row)
-            self.session.flush()
-            sp.commit()
-            return row
-        except IntegrityError:
-            sp.rollback()
-            return self.session.execute(
-                select(Post).where(
-                    Post.source_id == source_id,
-                    Post.external_post_id == external_post_id,
-                )
-            ).scalar_one()
+        stmt = select(Post).where(
+            Post.source_id == source_id,
+            Post.external_post_id == external_post_id,
+        )
+        return self._get_or_create(
+            stmt,
+            lambda: Post(source_id=source_id, external_post_id=external_post_id),
+        )
 
     def import_one(self, source: Path) -> ImportResult:
         """Dispatch by kind. Media → normal pipeline. Archive → extract
@@ -407,6 +406,29 @@ class Importer:
         return ImportResult(status="attached")
 
     def _import_archive(self, source: Path) -> ImportResult:
+        # Layer-3 isolation: bomb-size guard + integrity test in a
+        # spawned child BEFORE extracting in this process. A
+        # decompression bomb or a native-lib crash on a malformed
+        # archive is contained to the child; we reject the file cleanly
+        # instead of OOMing/segfaulting the import worker. extract_archive
+        # is already fail-soft for plain exceptions, so this only adds
+        # the hard-crash protection.
+        probe = safe_probe.probe_archive(source)
+        if not probe.ok:
+            if probe.crashed:
+                return ImportResult(
+                    status="failed",
+                    error=f"archive probe crashed/timed out: {probe.reason}",
+                )
+            # Clean rejection (bomb cap exceeded, integrity mismatch):
+            # still preserve the archive file itself as an attachment so
+            # nothing silently vanishes, matching extract_archive's
+            # fail-soft contract.
+            artist = self._resolve_artist(source)
+            post = self._post_for_sidecar(source, artist)
+            self._capture_attachment(source, post=post, artist=artist, resolved=True)
+            return ImportResult(status="attached")
+
         artist = self._resolve_artist(source)
         post = self._post_for_sidecar(source, artist)
         member_ids: list[int] = []
@@ -446,7 +468,25 @@ class Importer:
         # Compute file dimensions (images only) and apply filters.
         width = height = None
         has_alpha = False
-        if not is_video(source):
+        if is_video(source):
+            # Layer-3 isolation: validate the container via ffprobe (a
+            # separate process) before the rest of the pipeline touches
+            # it. A corrupt video that would crash a decoder is rejected
+            # cleanly here, and we capture width/height for free (the
+            # importer didn't previously record video dimensions).
+            probe = safe_probe.probe_video(source)
+            if not probe.ok:
+                if probe.crashed:
+                    return ImportResult(
+                        status="failed",
+                        error=f"video probe crashed/timed out: {probe.reason}",
+                    )
+                return ImportResult(
+                    status="skipped", skip_reason=SkipReason.invalid_image,
+                    error=probe.reason,
+                )
+            width, height = probe.width, probe.height
+        else:
             try:
                 with Image.open(source) as im:
                     im.verify()

backend/app/services/migrators/__init__.py

@@ -1,10 +0,0 @@
-"""FC-5 migration tooling.
-
-One module per concern (gs/ir/overlap/ml_queue/verify/cleanup).
-Each migrator returns a counts dict; the run_migration task wires
-that dict into MigrationRun.counts so the UI polling shows progress.
-
-backup + rollback were retired in FC-3h (2026-05-24); first-class
-backup lives at backend/app/services/backup_service.py and exposes
-its own /api/system/backup/* surface.
-"""

backend/app/services/migrators/cleanup.py

@@ -1,182 +0,0 @@
-"""Targeted cleanup migrator: delete every image attributed to one Artist.
-
-Built for the IR-migration rescue case where the filesystem scan derived
-a bogus 'imagerepo' artist from a mismatched bind-mount layout. Every
-image attributed to that artist (40k+ rows) needs to be removed — DB
-rows, original files under `/images/<bucket>/...`, and thumbnails under
-`/images/thumbs/...` — before the operator remounts and re-scans.
-
-CASCADE handles image_tag, image_provenance, series_page, and
-tag_suggestion_rejection child rows; import_task.result_image_id is
-SET NULL by FK. We also delete ImportTask rows whose source_path starts
-with the (still-existing) IR scan prefix so the next scan isn't fooled
-by them.
-"""
-from __future__ import annotations
-
-import logging
-from pathlib import Path
-
-from sqlalchemy import delete, func, select
-from sqlalchemy.ext.asyncio import AsyncSession
-
-from ...models import Artist, ImageRecord, ImportBatch, ImportTask
-
-log = logging.getLogger(__name__)
-
-_BATCH_SIZE = 500
-
-
-def _zero_counts() -> dict:
-    return {
-        "rows_processed": 0, "rows_inserted": 0, "rows_skipped": 0,
-        "files_copied": 0, "bytes_copied": 0, "conflicts": 0,
-    }
-
-
-def _thumb_path(images_root: Path, sha256_hex: str) -> tuple[Path, Path]:
-    """Return both possible thumbnail paths (.jpg and .png). We try both
-    because the extension is chosen at generate-time based on the source
-    image's mode (alpha → .png, otherwise → .jpg)."""
-    bucket = sha256_hex[:3]
-    base = images_root / "thumbs" / bucket / sha256_hex
-    return base.with_suffix(".jpg"), base.with_suffix(".png")
-
-
-def _delete_file(path: Path) -> bool:
-    """Best-effort unlink; True if the file was actually removed."""
-    try:
-        path.unlink(missing_ok=True)
-        return True
-    except OSError as exc:
-        log.warning("cleanup: failed to unlink %s: %s", path, exc)
-        return False
-
-
-async def cleanup_artist_async(
-    db: AsyncSession,
-    *,
-    slug: str,
-    images_root: Path | None = None,
-    dry_run: bool = False,
-    source_path_prefix: str | None = None,
-) -> dict:
-    """Delete every image attributed to the Artist with this slug,
-    along with the artist row itself and any associated import tasks.
-
-    Args:
-        slug: artist.slug to target (e.g. 'imagerepo').
-        images_root: defaults to /images.
-        dry_run: skip filesystem + DB writes; still walk rows for counts.
-        source_path_prefix: if set, ImportTask rows whose source_path
-            starts with this string are deleted too (use the IR scan
-            mount prefix, e.g. '/import/imagerepo').
-    """
-    root = images_root if images_root is not None else Path("/images")
-
-    artist = (await db.execute(
-        select(Artist).where(Artist.slug == slug)
-    )).scalar_one_or_none()
-    if artist is None:
-        raise ValueError(f"no Artist with slug={slug!r}")
-
-    artist_id = artist.id
-    artist_name = artist.name
-
-    total_images = (await db.execute(
-        select(func.count(ImageRecord.id)).where(ImageRecord.artist_id == artist_id)
-    )).scalar_one()
-
-    counts = _zero_counts()
-    files_deleted = 0
-    thumbs_deleted = 0
-    images_deleted = 0
-
-    # Batched delete loop. CASCADE handles image_tag, image_provenance,
-    # series_page, tag_suggestion_rejection. import_task.result_image_id
-    # is SET NULL by FK.
-    while True:
-        rows = (await db.execute(
-            select(ImageRecord.id, ImageRecord.path, ImageRecord.sha256)
-            .where(ImageRecord.artist_id == artist_id)
-            .limit(_BATCH_SIZE)
-        )).all()
-        if not rows:
-            break
-
-        ids = [r.id for r in rows]
-        counts["rows_processed"] += len(ids)
-
-        if not dry_run:
-            for r in rows:
-                if r.path:
-                    if _delete_file(Path(r.path)):
-                        files_deleted += 1
-                if r.sha256:
-                    jpg, png = _thumb_path(root, r.sha256)
-                    if _delete_file(jpg):
-                        thumbs_deleted += 1
-                    if _delete_file(png):
-                        thumbs_deleted += 1
-
-            await db.execute(
-                delete(ImageRecord).where(ImageRecord.id.in_(ids))
-            )
-            await db.commit()
-
-        images_deleted += len(ids)
-
-        if dry_run:
-            # Nothing was actually deleted from the DB; bail after one
-            # pass so we don't loop forever.
-            break
-
-    import_tasks_deleted = 0
-    if source_path_prefix and not dry_run:
-        # Delete ImportTask rows whose source_path is under the bad mount
-        # prefix. These are mostly orphaned now (result_image_id was set
-        # NULL by CASCADE) but their presence still blocks the
-        # idempotency check in scan_directory if the operator remounts
-        # the same prefix.
-        like_pattern = source_path_prefix.rstrip("/") + "/%"
-        result = await db.execute(
-            delete(ImportTask).where(ImportTask.source_path.like(like_pattern))
-        )
-        import_tasks_deleted = result.rowcount or 0
-        await db.commit()
-
-    # Sweep ImportBatch rows that are now empty.
-    empty_batches_deleted = 0
-    if not dry_run:
-        empty_batch_ids = (await db.execute(
-            select(ImportBatch.id).where(
-                ~select(ImportTask.id)
-                .where(ImportTask.batch_id == ImportBatch.id)
-                .exists()
-            )
-        )).scalars().all()
-        if empty_batch_ids:
-            result = await db.execute(
-                delete(ImportBatch).where(ImportBatch.id.in_(empty_batch_ids))
-            )
-            empty_batches_deleted = result.rowcount or 0
-            await db.commit()
-
-    # Finally, the artist row.
-    if not dry_run:
-        await db.execute(delete(Artist).where(Artist.id == artist_id))
-        await db.commit()
-
-    return {
-        "counts": counts,
-        "artist": {"id": artist_id, "name": artist_name, "slug": slug},
-        "summary": {
-            "images_targeted": total_images,
-            "images_deleted": images_deleted,
-            "files_deleted": files_deleted,
-            "thumbs_deleted": thumbs_deleted,
-            "import_tasks_deleted": import_tasks_deleted,
-            "empty_batches_deleted": empty_batches_deleted,
-            "dry_run": dry_run,
-        },
-    }

backend/app/services/migrators/gs_ingest.py

@@ -1,126 +0,0 @@
-"""GallerySubscriber export → FabledCurator ingest.
-
-Reads a parsed gallerysubscriber-export-v1.json dict (no DB connection
-to GS). Creates Artist (from subscriptions) + Source (nested under each
-subscription) + Credential (re-encrypted with FC's key). Idempotent on
-natural keys: Artist.slug, (artist_id, platform, url), Credential.platform.
-
-Credentials arrive plaintext in the export — GS's export script
-decrypts using GS's Fernet key in GS's own process. FC re-encrypts
-with FC's CredentialCrypto.
-"""
-from __future__ import annotations
-
-import json
-
-from sqlalchemy import select
-from sqlalchemy.ext.asyncio import AsyncSession
-
-from ...models import Artist, Credential, Source
-from ...utils.slug import slugify
-from ..credential_crypto import CredentialCrypto
-
-
-def _zero_counts() -> dict:
-    return {
-        "rows_processed": 0, "rows_inserted": 0, "rows_skipped": 0,
-        "files_copied": 0, "bytes_copied": 0, "conflicts": 0,
-    }
-
-
-async def migrate_async(
-    db: AsyncSession,
-    *,
-    data: dict,
-    fc_crypto: CredentialCrypto | None = None,
-    dry_run: bool = False,
-) -> dict:
-    """Ingest a parsed gallerysubscriber-export-v1.json dict."""
-    if data.get("source_app") != "gallerysubscriber":
-        raise ValueError("export source_app must be 'gallerysubscriber'")
-    if data.get("schema_version") != 1:
-        raise ValueError(f"unsupported schema_version: {data.get('schema_version')}")
-
-    counts = _zero_counts()
-
-    # Phase 1: subscriptions → Artist; nested sources within each.
-    for sub in data.get("subscriptions", []):
-        counts["rows_processed"] += 1
-        slug = slugify(sub["name"])
-        artist = (await db.execute(
-            select(Artist).where(Artist.slug == slug)
-        )).scalar_one_or_none()
-        if artist is None:
-            if dry_run:
-                counts["rows_inserted"] += 1
-                # Continue to nested sources, but they can't link without an artist row.
-                continue
-            notes = json.dumps(sub.get("metadata"), indent=2) if sub.get("metadata") else None
-            artist = Artist(
-                name=sub["name"], slug=slug,
-                is_subscription=True,
-                auto_check=bool(sub.get("enabled", True)),
-                notes=notes,
-            )
-            db.add(artist)
-            await db.flush()
-            counts["rows_inserted"] += 1
-        else:
-            counts["rows_skipped"] += 1
-
-        # Nested sources under this subscription.
-        for src in sub.get("sources", []):
-            counts["rows_processed"] += 1
-            existing = (await db.execute(
-                select(Source).where(
-                    Source.artist_id == artist.id,
-                    Source.platform == src["platform"],
-                    Source.url == src["url"],
-                )
-            )).scalar_one_or_none()
-            if existing is not None:
-                counts["rows_skipped"] += 1
-                continue
-            if dry_run:
-                counts["rows_inserted"] += 1
-                continue
-            db.add(Source(
-                artist_id=artist.id,
-                platform=src["platform"],
-                url=src["url"],
-                enabled=bool(src.get("enabled", True)),
-                check_interval_override=src.get("check_interval"),
-                config_overrides=src.get("metadata") or {},
-            ))
-            counts["rows_inserted"] += 1
-
-    # Phase 2: credentials.
-    for cred in data.get("credentials", []):
-        counts["rows_processed"] += 1
-        existing = (await db.execute(
-            select(Credential).where(Credential.platform == cred["platform"])
-        )).scalar_one_or_none()
-        if existing is not None:
-            counts["rows_skipped"] += 1
-            continue
-        if dry_run:
-            counts["rows_inserted"] += 1
-            continue
-        if fc_crypto is None:
-            # Without a crypto helper we can't encrypt — skip rather than
-            # store plaintext.
-            counts["rows_skipped"] += 1
-            counts["conflicts"] += 1
-            continue
-        encrypted = fc_crypto.encrypt(cred["plaintext"])
-        db.add(Credential(
-            platform=cred["platform"],
-            credential_type=cred.get("credential_type") or "cookies",
-            encrypted_blob=encrypted,
-            expires_at=cred.get("expires_at"),
-        ))
-        counts["rows_inserted"] += 1
-
-    if not dry_run:
-        await db.commit()
-    return counts

backend/app/services/migrators/ir_ingest.py

@@ -1,146 +0,0 @@
-"""ImageRepo export → FabledCurator ingest.
-
-Reads a parsed imagerepo-export-v1.json dict (no DB connection to IR).
-Creates Tag rows (skipping artist/post kinds, resolving fandom_name to
-FK). Writes the per-image-sha256 artist assignments + tag associations
-+ series page assignments to /images/_migration_state/ir_tag_manifest.json
-so tag_apply.py can join them to ImageRecord rows AFTER the operator
-runs FC's filesystem scan.
-"""
-from __future__ import annotations
-
-import json
-from pathlib import Path
-
-from sqlalchemy import select
-from sqlalchemy.ext.asyncio import AsyncSession
-
-from ...models import Tag, TagKind
-
-_SKIP_KINDS = frozenset({"artist", "post"})
-_MIGRATION_STATE_DIRNAME = "_migration_state"
-_IR_MANIFEST_FILENAME = "ir_tag_manifest.json"
-
-
-def _zero_counts() -> dict:
-    return {
-        "rows_processed": 0, "rows_inserted": 0, "rows_skipped": 0,
-        "files_copied": 0, "bytes_copied": 0, "conflicts": 0,
-    }
-
-
-def manifest_path(images_root: Path | None = None) -> Path:
-    root = images_root if images_root is not None else Path("/images")
-    p = root / _MIGRATION_STATE_DIRNAME
-    p.mkdir(parents=True, exist_ok=True)
-    return p / _IR_MANIFEST_FILENAME
-
-
-async def _resolve_fandom_id(
-    db: AsyncSession, fandom_name: str | None, dry_run: bool,
-) -> int | None:
-    """Find-or-create a fandom-kind Tag by name."""
-    if not fandom_name:
-        return None
-    existing = (await db.execute(
-        select(Tag).where(Tag.name == fandom_name, Tag.kind == "fandom")
-    )).scalar_one_or_none()
-    if existing is not None:
-        return existing.id
-    if dry_run:
-        return None
-    t = Tag(name=fandom_name, kind=TagKind.fandom)
-    db.add(t)
-    await db.flush()
-    return t.id
-
-
-async def migrate_async(
-    db: AsyncSession,
-    *,
-    data: dict,
-    images_root: Path | None = None,
-    dry_run: bool = False,
-) -> dict:
-    """Ingest a parsed imagerepo-export-v1.json dict.
-
-    Creates Tag rows + writes the IR tag manifest file. Tag-to-image
-    binding happens later in tag_apply.py (after FC's filesystem scan
-    populates image_record.sha256 → id).
-    """
-    if data.get("source_app") != "imagerepo":
-        raise ValueError("export source_app must be 'imagerepo'")
-    if data.get("schema_version") not in (1, 2):
-        raise ValueError(f"unsupported schema_version: {data.get('schema_version')}")
-
-    counts = _zero_counts()
-
-    # Phase 1: tags (skip artist + post kinds; resolve fandom_name → fandom_id).
-    # First pass: create all fandom-kind tags so they're available for FK resolution.
-    for tag in data.get("tags", []):
-        kind = tag.get("kind") or "general"
-        if kind != "fandom":
-            continue
-        counts["rows_processed"] += 1
-        existing = (await db.execute(
-            select(Tag).where(Tag.name == tag["name"], Tag.kind == "fandom")
-        )).scalar_one_or_none()
-        if existing is not None:
-            counts["rows_skipped"] += 1
-            continue
-        if dry_run:
-            counts["rows_inserted"] += 1
-            continue
-        db.add(Tag(name=tag["name"], kind=TagKind.fandom))
-        counts["rows_inserted"] += 1
-    if not dry_run:
-        await db.flush()
-
-    # Second pass: every other kind.
-    for tag in data.get("tags", []):
-        kind_str = tag.get("kind") or "general"
-        if kind_str in _SKIP_KINDS:
-            counts["rows_skipped"] += 1
-            continue
-        if kind_str == "fandom":
-            continue  # handled above
-        counts["rows_processed"] += 1
-        try:
-            kind = TagKind(kind_str)
-        except ValueError:
-            kind = TagKind.general
-        fandom_id = await _resolve_fandom_id(db, tag.get("fandom_name"), dry_run)
-        existing = (await db.execute(
-            select(Tag).where(Tag.name == tag["name"], Tag.kind == kind)
-        )).scalar_one_or_none()
-        if existing is not None:
-            counts["rows_skipped"] += 1
-            continue
-        if dry_run:
-            counts["rows_inserted"] += 1
-            continue
-        db.add(Tag(name=tag["name"], kind=kind, fandom_id=fandom_id))
-        counts["rows_inserted"] += 1
-
-    if not dry_run:
-        await db.commit()
-
-    # Phase 2: write the per-image manifest for tag_apply.py to consume later.
-    # schema_version 2 (added 2026-05-24) carries `image_posts` for
-    # Post + Source + ImageProvenance restore; schema 1 manifests
-    # without it stay valid (tag_apply treats the missing field as []).
-    manifest = {
-        "schema_version": data.get("schema_version", 1),
-        "image_artist_assignments": data.get("image_artist_assignments", []),
-        "image_tag_associations": data.get("image_tag_associations", []),
-        "series_pages": data.get("series_pages", []),
-        "image_posts": data.get("image_posts", []),
-    }
-    counts["rows_processed"] += len(manifest["image_artist_assignments"])
-    counts["rows_processed"] += len(manifest["image_tag_associations"])
-    counts["rows_processed"] += len(manifest["series_pages"])
-    counts["rows_processed"] += len(manifest["image_posts"])
-    if not dry_run:
-        manifest_path(images_root).write_text(json.dumps(manifest, indent=2))
-
-    return counts

backend/app/services/migrators/ml_queue.py

@@ -1,21 +0,0 @@
-"""Queue every migrated image_record with no embedding for ML re-processing."""
-from __future__ import annotations
-
-from sqlalchemy import select
-from sqlalchemy.ext.asyncio import AsyncSession
-
-from ...models import ImageRecord
-
-
-async def queue_all_unprocessed_async(db: AsyncSession) -> int:
-    """Find every ImageRecord with siglip_embedding IS NULL, fire
-    tag_and_embed.delay(id) for each. Returns count queued.
-    """
-    from ...tasks.ml import tag_and_embed
-
-    rows = (await db.execute(
-        select(ImageRecord.id).where(ImageRecord.siglip_embedding.is_(None))
-    )).scalars().all()
-    for image_id in rows:
-        tag_and_embed.delay(image_id)
-    return len(rows)

backend/app/services/migrators/tag_apply.py

@@ -1,368 +0,0 @@
-"""Apply the IR tag manifest after FC's filesystem scan.
-
-Reads /images/_migration_state/ir_tag_manifest.json and joins each entry
-to an ImageRecord row by sha256 (which exists after the operator runs
-FC's filesystem scan over the mounted IR images dir).
-
-- image_artist_assignments → ImageRecord.artist_id (find_or_create Artist by slug).
-- image_tag_associations  → image_tag insert (idempotent).
-- series_pages            → series_page insert (idempotent on image_id unique).
-- image_posts (schema v2) → Source + Post + ImageProvenance restore.
-
-Unmatched sha256s are logged into the result's `unmatched` list so the
-Celery task can drop them into MigrationRun.metadata for the operator
-to inspect.
-"""
-from __future__ import annotations
-
-import json
-from datetime import datetime
-from pathlib import Path
-
-from sqlalchemy import select
-from sqlalchemy.ext.asyncio import AsyncSession
-
-from ...models import (
-    Artist,
-    ImageProvenance,
-    ImageRecord,
-    Post,
-    SeriesPage,
-    Source,
-    Tag,
-    TagKind,
-    image_tag,
-)
-from ...utils.slug import slugify
-from .ir_ingest import manifest_path
-
-# Per-platform artist-profile URL — used as Source.url when restoring
-# IR PostMetadata into FC. Must cover every platform that
-# backend/app/services/extension_service.py:_PLATFORM_PATTERNS
-# recognizes; an entry missing here silently drops ALL PostMetadata for
-# that platform during phase 4 (operator hit this 2026-05-25:
-# DeviantArt + Pixiv posts in the IR migration produced empty
-# ImageProvenance because they fell through this table).
-#
-# Pixiv caveat: the real profile URL takes a numeric user_id
-# (https://www.pixiv.net/users/12345), but IR's PostMetadata.artist
-# stores the display name not the id. We use the slugified name here
-# so we preserve the artist→post→image linkage; the resulting Source.url
-# won't resolve in a browser and the operator may want to manually fix
-# it via Settings → Subscriptions once the migration lands.
-_PLATFORM_PROFILE_URL = {
-    "patreon":       "https://www.patreon.com/{slug}",
-    "subscribestar": "https://www.subscribestar.com/{slug}",
-    "hentaifoundry": "https://www.hentai-foundry.com/user/{slug}",
-    "deviantart":    "https://www.deviantart.com/{slug}",
-    "pixiv":         "https://www.pixiv.net/users/{slug}",
-}
-
-
-def _profile_url(platform: str, artist_slug: str) -> str | None:
-    fmt = _PLATFORM_PROFILE_URL.get(platform)
-    return fmt.format(slug=artist_slug) if fmt else None
-
-
-async def _find_or_create_source(
-    db: AsyncSession, *, artist_id: int, platform: str, url: str, dry_run: bool,
-) -> int | None:
-    existing = (await db.execute(
-        select(Source.id).where(
-            Source.artist_id == artist_id,
-            Source.platform == platform,
-            Source.url == url,
-        )
-    )).scalar_one_or_none()
-    if existing is not None:
-        return existing
-    if dry_run:
-        return None
-    s = Source(artist_id=artist_id, platform=platform, url=url, enabled=False)
-    db.add(s)
-    await db.flush()
-    return s.id
-
-
-async def _find_or_create_post(
-    db: AsyncSession, *,
-    source_id: int, external_post_id: str,
-    title: str | None, description: str | None, post_url: str | None,
-    post_date_iso: str | None, attachment_count: int, dry_run: bool,
-) -> int | None:
-    existing = (await db.execute(
-        select(Post.id).where(
-            Post.source_id == source_id,
-            Post.external_post_id == external_post_id,
-        )
-    )).scalar_one_or_none()
-    if existing is not None:
-        return existing
-    if dry_run:
-        return None
-    post_date = None
-    if post_date_iso:
-        post_date = datetime.fromisoformat(post_date_iso)
-    p = Post(
-        source_id=source_id,
-        external_post_id=external_post_id,
-        post_title=title,
-        description=description,
-        post_url=post_url,
-        post_date=post_date,
-        attachment_count=attachment_count,
-        raw_metadata={"migrated_from": "imagerepo"},
-    )
-    db.add(p)
-    await db.flush()
-    return p.id
-
-
-async def _ensure_provenance(
-    db: AsyncSession, *,
-    image_id: int, post_id: int, source_id: int, dry_run: bool,
-) -> bool:
-    """Returns True if a new ImageProvenance row was inserted.
-
-    Also sets ImageRecord.primary_post_id to this post if the image
-    doesn't already have one — preserves any primary_post_id already
-    assigned at download time by the importer (don't clobber). This is
-    the linkage gallery_service.py uses to surface Post.post_date as
-    the image's effective date for sort/group/jump/neighbor nav.
-    """
-    existing = (await db.execute(
-        select(ImageProvenance.id).where(
-            ImageProvenance.image_record_id == image_id,
-            ImageProvenance.post_id == post_id,
-            ImageProvenance.source_id == source_id,
-        )
-    )).scalar_one_or_none()
-
-    # Whether-or-not the provenance row already exists, ensure the
-    # image's primary_post_id is set so the gallery date-coalesce works.
-    # Idempotent: only writes when currently NULL.
-    if not dry_run:
-        await db.execute(
-            ImageRecord.__table__.update()
-            .where(ImageRecord.id == image_id)
-            .where(ImageRecord.primary_post_id.is_(None))
-            .values(primary_post_id=post_id)
-        )
-
-    if existing is not None:
-        return False
-    if dry_run:
-        return True
-    db.add(ImageProvenance(
-        image_record_id=image_id, post_id=post_id, source_id=source_id,
-    ))
-    await db.flush()
-    return True
-
-
-def _zero_counts() -> dict:
-    return {
-        "rows_processed": 0, "rows_inserted": 0, "rows_skipped": 0,
-        "files_copied": 0, "bytes_copied": 0, "conflicts": 0,
-    }
-
-
-async def _ensure_artist_id(
-    db: AsyncSession, artist_name: str, dry_run: bool,
-) -> int | None:
-    if not artist_name or not artist_name.strip():
-        return None
-    slug = slugify(artist_name)
-    existing = (await db.execute(
-        select(Artist).where(Artist.slug == slug)
-    )).scalar_one_or_none()
-    if existing is not None:
-        return existing.id
-    if dry_run:
-        return None
-    a = Artist(name=artist_name, slug=slug, is_subscription=False)
-    db.add(a)
-    await db.flush()
-    return a.id
-
-
-async def _resolve_tag_id(
-    db: AsyncSession, tag_name: str, tag_kind: str,
-) -> int | None:
-    try:
-        kind = TagKind(tag_kind)
-    except ValueError:
-        kind = TagKind.general
-    row = (await db.execute(
-        select(Tag.id).where(Tag.name == tag_name, Tag.kind == kind)
-    )).scalar_one_or_none()
-    return row
-
-
-async def _sha_to_image_id(db: AsyncSession, sha: str) -> int | None:
-    return (await db.execute(
-        select(ImageRecord.id).where(ImageRecord.sha256 == sha)
-    )).scalar_one_or_none()
-
-
-async def apply_async(
-    db: AsyncSession,
-    *,
-    images_root: Path | None = None,
-    dry_run: bool = False,
-) -> dict:
-    """Apply the manifest. Returns counts + an `unmatched` list of sha256s."""
-    mf_path = manifest_path(images_root)
-    if not mf_path.exists():
-        raise FileNotFoundError(f"no IR tag manifest at {mf_path}")
-
-    manifest = json.loads(mf_path.read_text())
-    counts = _zero_counts()
-    unmatched: list[dict] = []
-
-    # 1. Artist assignments.
-    for entry in manifest.get("image_artist_assignments", []):
-        counts["rows_processed"] += 1
-        img_id = await _sha_to_image_id(db, entry["sha256"])
-        if img_id is None:
-            unmatched.append({"kind": "artist", **entry})
-            counts["rows_skipped"] += 1
-            continue
-        aid = await _ensure_artist_id(db, entry["artist_name"], dry_run)
-        if aid is None:
-            counts["rows_skipped"] += 1
-            continue
-        if dry_run:
-            counts["rows_inserted"] += 1
-            continue
-        img = await db.get(ImageRecord, img_id)
-        if img is not None and img.artist_id != aid:
-            img.artist_id = aid
-            counts["rows_inserted"] += 1
-        else:
-            counts["rows_skipped"] += 1
-
-    # 2. Tag associations.
-    for entry in manifest.get("image_tag_associations", []):
-        counts["rows_processed"] += 1
-        img_id = await _sha_to_image_id(db, entry["sha256"])
-        if img_id is None:
-            unmatched.append({"kind": "tag", **entry})
-            counts["rows_skipped"] += 1
-            continue
-        tag_id = await _resolve_tag_id(
-            db, entry["tag_name"], entry.get("tag_kind") or "general",
-        )
-        if tag_id is None:
-            counts["rows_skipped"] += 1
-            continue
-        # Skip if association already exists.
-        already = (await db.execute(
-            select(image_tag.c.image_record_id).where(
-                image_tag.c.image_record_id == img_id,
-                image_tag.c.tag_id == tag_id,
-            )
-        )).first()
-        if already is not None:
-            counts["rows_skipped"] += 1
-            continue
-        if dry_run:
-            counts["rows_inserted"] += 1
-            continue
-        await db.execute(image_tag.insert().values(
-            image_record_id=img_id, tag_id=tag_id, source="manual",
-        ))
-        counts["rows_inserted"] += 1
-
-    # 3. Series pages.
-    for entry in manifest.get("series_pages", []):
-        counts["rows_processed"] += 1
-        img_id = await _sha_to_image_id(db, entry["sha256"])
-        if img_id is None:
-            unmatched.append({"kind": "series", **entry})
-            counts["rows_skipped"] += 1
-            continue
-        series_tag_id = await _resolve_tag_id(db, entry["series_tag_name"], "series")
-        if series_tag_id is None:
-            counts["rows_skipped"] += 1
-            continue
-        existing = (await db.execute(
-            select(SeriesPage).where(SeriesPage.image_id == img_id)
-        )).scalar_one_or_none()
-        if existing is not None:
-            counts["rows_skipped"] += 1
-            continue
-        if dry_run:
-            counts["rows_inserted"] += 1
-            continue
-        db.add(SeriesPage(
-            series_tag_id=series_tag_id,
-            image_id=img_id,
-            page_number=entry["page_number"],
-        ))
-        counts["rows_inserted"] += 1
-
-    # 4. Image posts (schema v2) → Source + Post + ImageProvenance.
-    # Restores IR PostMetadata as FC's downloader-track provenance,
-    # so the modal's ProvenancePanel surfaces title/description/
-    # source URL/publish date the same way it does for live
-    # gallery-dl downloads.
-    for entry in manifest.get("image_posts", []):
-        counts["rows_processed"] += 1
-        platform = entry.get("platform")
-        artist_name = entry.get("artist")
-        if not platform or not artist_name:
-            counts["rows_skipped"] += 1
-            continue
-
-        aid = await _ensure_artist_id(db, artist_name, dry_run)
-        if aid is None:
-            counts["rows_skipped"] += 1
-            continue
-
-        url = _profile_url(platform, slugify(artist_name))
-        if url is None:
-            counts["rows_skipped"] += 1
-            continue
-
-        source_id = await _find_or_create_source(
-            db, artist_id=aid, platform=platform, url=url, dry_run=dry_run,
-        )
-        if source_id is None:
-            counts["rows_skipped"] += 1
-            continue
-
-        post_id = await _find_or_create_post(
-            db, source_id=source_id,
-            external_post_id=entry.get("post_id") or "",
-            title=entry.get("title"),
-            description=entry.get("description"),
-            post_url=entry.get("source_url"),
-            post_date_iso=entry.get("published_at"),
-            attachment_count=entry.get("attachment_count") or 0,
-            dry_run=dry_run,
-        )
-        if post_id is None:
-            counts["rows_skipped"] += 1
-            continue
-
-        for sha in entry.get("image_sha256s", []):
-            img_id = await _sha_to_image_id(db, sha)
-            if img_id is None:
-                unmatched.append({
-                    "kind": "post", "sha256": sha,
-                    "post_id": entry.get("post_id"),
-                })
-                continue
-            inserted = await _ensure_provenance(
-                db, image_id=img_id, post_id=post_id,
-                source_id=source_id, dry_run=dry_run,
-            )
-            if inserted:
-                counts["rows_inserted"] += 1
-            else:
-                counts["rows_skipped"] += 1
-
-    if not dry_run:
-        await db.commit()
-    return {"counts": counts, "unmatched": unmatched}

backend/app/services/migrators/verify.py

@@ -1,80 +0,0 @@
-"""Post-migration verification: row counts + sha256 sampling."""
-from __future__ import annotations
-
-import hashlib
-from pathlib import Path
-
-from sqlalchemy import func, select
-from sqlalchemy.ext.asyncio import AsyncSession
-
-from ...models import Artist, Credential, ImageRecord, Source, Tag
-
-
-async def verify_async(db: AsyncSession, *, expected: dict | None = None) -> dict:
-    """Return per-check status dicts. `expected` is optional row-count
-    assertions; checks default to status='ok' when no expected provided."""
-    expected = expected or {}
-    results: dict[str, dict] = {}
-
-    checks = {
-        "artist_subscriptions": (
-            select(func.count(Artist.id)).where(Artist.is_subscription.is_(True))
-        ),
-        "source_count": select(func.count(Source.id)),
-        "credential_count": select(func.count(Credential.id)),
-        "tag_count": select(func.count(Tag.id)),
-        "image_record_imported_or_downloaded": (
-            select(func.count(ImageRecord.id))
-            .where(ImageRecord.origin.in_(["imported_filesystem", "downloaded"]))
-        ),
-    }
-    for name, stmt in checks.items():
-        actual = (await db.execute(stmt)).scalar_one()
-        exp = expected.get(name)
-        status = "ok" if exp is None or exp == actual else "mismatch"
-        results[name] = {"status": status, "actual": int(actual), "expected": exp}
-    return results
-
-
-async def verify_sha256_sample(
-    db: AsyncSession, *, sample_size: int = 20,
-) -> dict:
-    """Sample N image_records; verify file exists + sha256 matches."""
-    rows = (await db.execute(
-        select(ImageRecord.id, ImageRecord.path, ImageRecord.sha256)
-        .order_by(func.random()).limit(sample_size)
-    )).all()
-
-    matched = 0
-    mismatched = 0
-    missing = 0
-    samples: list[dict] = []
-    for img_id, path, expected_sha in rows:
-        p = Path(path)
-        # Sync stdlib filesystem ops are intentional: this verify pass runs
-        # inside a Celery task under asyncio.run; no other awaitables compete
-        # for the loop. Same pattern as download_service.py.
-        if not p.exists():  # noqa: ASYNC240
-            missing += 1
-            samples.append({"id": img_id, "path": path, "result": "missing"})
-            continue
-        h = hashlib.sha256()
-        with p.open("rb") as f:  # noqa: ASYNC230
-            for chunk in iter(lambda: f.read(65536), b""):
-                h.update(chunk)
-        if h.hexdigest() == expected_sha:
-            matched += 1
-            samples.append({"id": img_id, "result": "ok"})
-        else:
-            mismatched += 1
-            samples.append({
-                "id": img_id, "path": path, "result": "mismatch",
-                "expected_sha": expected_sha, "actual_sha": h.hexdigest(),
-            })
-    return {
-        "sample_size": len(rows),
-        "matched": matched,
-        "mismatched": mismatched,
-        "missing": missing,
-        "samples": samples,
-    }

backend/app/services/platforms.py

@@ -1,140 +0,0 @@
-"""FC-3b platforms registry — the single source of truth for what
-FabledCurator supports.
-
-Lifted from GallerySubscriber's
-~/Nextcloud/Projects/GallerySubscriber/backend/app/api/platforms.py
-and ~/.../extension/lib/platforms.js. Six platforms; auth_type and
-URL patterns match GS exactly so the existing browser extension
-hits FC unmodified.
-"""
-
-from dataclasses import dataclass
-from typing import Literal
-
-
-@dataclass(frozen=True)
-class PlatformInfo:
-    key: str
-    name: str
-    description: str
-    auth_type: Literal["cookies", "token"]
-    requires_auth: bool
-    url_pattern: str
-    url_examples: list[str]
-    default_config: dict
-    notes: str | None = None
-
-
-# Common defaults used across most platforms; embedded per-platform
-# below so per-platform overrides remain explicit.
-_DEFAULTS = {
-    "sleep": 3.0,
-    "sleep_request": 1.5,
-    "skip_existing": True,
-    "save_metadata": True,
-    "timeout": 3600,
-}
-
-
-PLATFORMS: dict[str, PlatformInfo] = {
-    "patreon": PlatformInfo(
-        key="patreon",
-        name="Patreon",
-        description="Download posts from Patreon creators",
-        auth_type="cookies",
-        requires_auth=True,
-        url_pattern=r"^https?://(www\.)?patreon\.com/",
-        url_examples=[
-            "https://www.patreon.com/example_artist",
-            "https://www.patreon.com/user?u=12345678",
-        ],
-        default_config={**_DEFAULTS, "content_types": ["images", "attachments"]},
-    ),
-    "subscribestar": PlatformInfo(
-        key="subscribestar",
-        name="SubscribeStar",
-        description="Download posts from SubscribeStar creators",
-        auth_type="cookies",
-        requires_auth=True,
-        url_pattern=r"^https?://(www\.)?subscribestar\.(com|adult)/",
-        url_examples=[
-            "https://subscribestar.adult/example_artist",
-            "https://www.subscribestar.com/example_artist",
-        ],
-        default_config={**_DEFAULTS, "content_types": ["all"]},
-    ),
-    "hentaifoundry": PlatformInfo(
-        key="hentaifoundry",
-        name="Hentai Foundry",
-        description="Download artwork from Hentai Foundry artists",
-        auth_type="cookies",
-        requires_auth=False,
-        url_pattern=r"^https?://(www\.)?hentai-foundry\.com/",
-        url_examples=[
-            "https://www.hentai-foundry.com/user/example_artist",
-            "https://www.hentai-foundry.com/pictures/user/example_artist",
-        ],
-        default_config={**_DEFAULTS, "content_types": ["pictures"]},
-    ),
-    "discord": PlatformInfo(
-        key="discord",
-        name="Discord",
-        description="Download attachments from Discord channels",
-        auth_type="token",
-        requires_auth=True,
-        url_pattern=r"^https?://(www\.)?discord\.com/channels/",
-        url_examples=["https://discord.com/channels/123456789/987654321"],
-        default_config={**_DEFAULTS, "content_types": ["all"]},
-        notes="Requires Discord user token (not bot token).",
-    ),
-    "pixiv": PlatformInfo(
-        key="pixiv",
-        name="Pixiv",
-        description="Download artwork from Pixiv artists",
-        auth_type="token",
-        requires_auth=True,
-        url_pattern=r"^https?://(www\.)?pixiv\.net/",
-        url_examples=[
-            "https://www.pixiv.net/users/12345678",
-            "https://www.pixiv.net/en/users/12345678",
-        ],
-        default_config={**_DEFAULTS, "content_types": ["all"]},
-        notes="Requires OAuth refresh token. Run `gallery-dl oauth:pixiv` to obtain one.",
-    ),
-    "deviantart": PlatformInfo(
-        key="deviantart",
-        name="DeviantArt",
-        description="Download artwork from DeviantArt artists",
-        auth_type="cookies",
-        requires_auth=False,
-        url_pattern=r"^https?://(www\.)?deviantart\.com/",
-        url_examples=[
-            "https://www.deviantart.com/example-artist",
-            "https://www.deviantart.com/example-artist/gallery",
-        ],
-        default_config={**_DEFAULTS, "content_types": ["gallery"]},
-    ),
-}
-
-
-def known_platform_keys() -> frozenset[str]:
-    return frozenset(PLATFORMS.keys())
-
-
-def auth_type_for(platform: str) -> str | None:
-    info = PLATFORMS.get(platform)
-    return info.auth_type if info else None
-
-
-def to_dict(info: PlatformInfo) -> dict:
-    return {
-        "key": info.key,
-        "name": info.name,
-        "description": info.description,
-        "auth_type": info.auth_type,
-        "requires_auth": info.requires_auth,
-        "url_pattern": info.url_pattern,
-        "url_examples": info.url_examples,
-        "default_config": info.default_config,
-        "notes": info.notes,
-    }

backend/app/services/platforms/__init__.py

@@ -0,0 +1,95 @@
+"""FC-3b platforms registry — single source of truth for what
+FabledCurator supports + where each platform's quirks live.
+
+Adding a new platform: drop a new module `<platform>.py` next to this
+one, declare an `INFO = PlatformInfo(...)`, add the import + entry in
+PLATFORMS below. Sidecar parsing, cookie materialization, and
+`/api/platforms` pick it up automatically.
+
+Lifted from GallerySubscriber's
+~/Nextcloud/Projects/GallerySubscriber/backend/app/api/platforms.py
+and ~/.../extension/lib/platforms.js. Six platforms; auth_type and
+URL patterns match GS exactly so the existing browser extension
+hits FC unmodified.
+"""
+
+from .base import (
+    DEFAULT_DESCRIPTION_KEYS,
+    DEFAULT_EXTERNAL_POST_ID_KEYS,
+    PlatformInfo,
+)
+from .deviantart import INFO as _DEVIANTART
+from .discord import INFO as _DISCORD
+from .hentaifoundry import INFO as _HENTAIFOUNDRY
+from .patreon import INFO as _PATREON
+from .pixiv import INFO as _PIXIV
+from .subscribestar import INFO as _SUBSCRIBESTAR
+
+PLATFORMS: dict[str, PlatformInfo] = {
+    info.key: info
+    for info in (
+        _PATREON,
+        _SUBSCRIBESTAR,
+        _HENTAIFOUNDRY,
+        _DISCORD,
+        _PIXIV,
+        _DEVIANTART,
+    )
+}
+
+
+def known_platform_keys() -> frozenset[str]:
+    return frozenset(PLATFORMS.keys())
+
+
+def auth_type_for(platform: str) -> str | None:
+    info = PLATFORMS.get(platform)
+    return info.auth_type if info else None
+
+
+def to_dict(info: PlatformInfo) -> dict:
+    """Serialize a PlatformInfo to a JSON-safe dict for /api/platforms.
+
+    Behavioral fields (callables, sidecar-chain overrides) are
+    intentionally omitted — they aren't useful to API consumers.
+    """
+    return {
+        "key": info.key,
+        "name": info.name,
+        "description": info.description,
+        "auth_type": info.auth_type,
+        "requires_auth": info.requires_auth,
+        "url_pattern": info.url_pattern,
+        "url_examples": info.url_examples,
+        "default_config": info.default_config,
+        "notes": info.notes,
+    }
+
+
+def external_post_id_keys_for(platform: str | None) -> tuple[str, ...]:
+    """Resolve the external_post_id lookup chain for a given platform,
+    falling back to the module default when the platform isn't
+    registered or hasn't overridden the chain."""
+    info = PLATFORMS.get(platform) if platform else None
+    if info is not None and info.external_post_id_keys is not None:
+        return info.external_post_id_keys
+    return DEFAULT_EXTERNAL_POST_ID_KEYS
+
+
+def description_keys_for(platform: str | None) -> tuple[str, ...]:
+    """Resolve the description body lookup chain for a given platform."""
+    info = PLATFORMS.get(platform) if platform else None
+    if info is not None and info.description_keys is not None:
+        return info.description_keys
+    return DEFAULT_DESCRIPTION_KEYS
+
+
+__all__ = [
+    "PLATFORMS",
+    "PlatformInfo",
+    "auth_type_for",
+    "description_keys_for",
+    "external_post_id_keys_for",
+    "known_platform_keys",
+    "to_dict",
+]

backend/app/services/platforms/base.py

@@ -0,0 +1,105 @@
+"""PlatformInfo dataclass + shared defaults + small helpers.
+
+Per-platform modules import from here, register their PlatformInfo via
+INFO, optionally attaching `derive_post_url` and/or `augment_cookies`
+callables for behavior that diverges from gallery-dl's mainline shape
+(Patreon).
+
+Adding a new platform: drop a new module under `services/platforms/`,
+declare an INFO, and add it to the import list in
+`services/platforms/__init__.py`. Sidecar parsing, cookie
+materialization, and the /api/platforms response pick it up
+automatically.
+"""
+
+from collections.abc import Callable
+from dataclasses import dataclass
+from typing import Literal
+
+# Sidecar parsing defaults. Per-platform PlatformInfo entries can
+# override these by setting `external_post_id_keys=` /
+# `description_keys=`. Most don't need to — the defaults already cover
+# every platform FC supports.
+#
+# external_post_id chain: `post_id` MUST come before `id` because
+# SubscribeStar gallery-dl puts the per-attachment id in `id` and the
+# actual post id in `post_id`; picking `id` first fragments
+# multi-image SubscribeStar posts into N Post rows. Patreon/Pixiv have
+# no `post_id` so `id` still wins for them; HF uses `index`, Discord
+# uses `message_id` — all reached via the remaining chain entries.
+# (Banked 2026-05-27 during the sidecar audit.)
+DEFAULT_EXTERNAL_POST_ID_KEYS: tuple[str, ...] = (
+    "post_id", "id", "index", "message_id",
+)
+
+# Description body chain: Discord's gallery-dl extractor uses `message`
+# (no `content`); appended to the chain so Discord posts surface body
+# text.
+DEFAULT_DESCRIPTION_KEYS: tuple[str, ...] = (
+    "content", "description", "caption", "message",
+)
+
+
+@dataclass(frozen=True)
+class PlatformInfo:
+    # --- Identity / metadata ---
+    key: str
+    name: str
+    description: str
+    auth_type: Literal["cookies", "token"]
+    requires_auth: bool
+    url_pattern: str
+    url_examples: list[str]
+    default_config: dict
+    notes: str | None = None
+
+    # --- Sidecar parsing overrides ---
+    # Each is None to mean "use the module default above"; a platform
+    # only sets one of these when its sidecar shape genuinely differs.
+    external_post_id_keys: tuple[str, ...] | None = None
+    description_keys: tuple[str, ...] | None = None
+
+    # --- Behavioral hooks ---
+    # Synthesize a post permalink from sidecar data. Required when
+    # gallery-dl's `url` field is the file/CDN URL rather than the post
+    # permalink (subscribestar/pixiv/hf/discord). None = trust the bare
+    # `url` field (patreon, deviantart).
+    derive_post_url: Callable[[dict], str | None] | None = None
+
+    # Post-process the materialized cookies.txt for gallery-dl. Used by
+    # platforms whose server gates or extractor quirks need synthetic
+    # cookies the extension can't capture (subscribestar age cookie, HF
+    # host-only PHPSESSID duplicate). None = no-op.
+    augment_cookies: Callable[[str], str] | None = None
+
+
+def str_id_value(v) -> str | None:
+    """Coerce a JSON scalar id into a non-empty string, rejecting bool
+    (Python's bool is an int subclass so `isinstance(True, int)` is
+    True; without this guard a sidecar with `"id": true` would produce
+    external_post_id="True")."""
+    if isinstance(v, bool):
+        return None
+    if isinstance(v, (str, int)) and str(v).strip():
+        return str(v).strip()
+    return None
+
+
+def str_field(v) -> str | None:
+    """Same idea as str_id_value but for plain string fields (no int
+    coercion)."""
+    if isinstance(v, str) and v.strip():
+        return v.strip()
+    return None
+
+
+# Shared gallery-dl invocation defaults. Embedded in each platform's
+# default_config (with platform-specific overrides) so per-platform
+# choices stay explicit.
+GD_DEFAULTS = {
+    "sleep": 3.0,
+    "sleep_request": 1.5,
+    "skip_existing": True,
+    "save_metadata": True,
+    "timeout": 3600,
+}

backend/app/services/platforms/deviantart.py

@@ -0,0 +1,23 @@
+"""DeviantArt — no exercised quirks yet.
+
+No operator-owned DeviantArt archive existed at the 2026-05-27 sidecar
+audit, so we don't know yet whether DA's gallery-dl sidecars are
+well-behaved or have their own quirks. When DA gets exercised for the
+first time, add `derive_post_url` / `augment_cookies` here as needed.
+"""
+
+from .base import GD_DEFAULTS, PlatformInfo
+
+INFO = PlatformInfo(
+    key="deviantart",
+    name="DeviantArt",
+    description="Download artwork from DeviantArt artists",
+    auth_type="cookies",
+    requires_auth=False,
+    url_pattern=r"^https?://(www\.)?deviantart\.com/",
+    url_examples=[
+        "https://www.deviantart.com/example-artist",
+        "https://www.deviantart.com/example-artist/gallery",
+    ],
+    default_config={**GD_DEFAULTS, "content_types": ["gallery"]},
+)

backend/app/services/platforms/discord.py

@@ -0,0 +1,38 @@
+"""Discord — one quirk + one already-default.
+
+post_url: gallery-dl's `url` is the CDN attachment URL. The "permalink"
+for a Discord message uses the (server, channel, message) triple via
+`discord.com/channels/<server>/<channel>/<message>`. Note that
+permalinks are only resolvable for users in the same server — public
+access doesn't work — but the URL is still useful to the operator
+in-app.
+
+Description body is in `message` not `content`. That's already covered
+by the default description chain in base.py (DEFAULT_DESCRIPTION_KEYS
+ends with `message`). No description_keys override needed.
+"""
+
+from .base import GD_DEFAULTS, PlatformInfo, str_id_value
+
+
+def derive_post_url(data: dict) -> str | None:
+    sid = str_id_value(data.get("server_id"))
+    cid = str_id_value(data.get("channel_id"))
+    mid = str_id_value(data.get("message_id"))
+    if sid and cid and mid:
+        return f"https://discord.com/channels/{sid}/{cid}/{mid}"
+    return None
+
+
+INFO = PlatformInfo(
+    key="discord",
+    name="Discord",
+    description="Download attachments from Discord channels",
+    auth_type="token",
+    requires_auth=True,
+    url_pattern=r"^https?://(www\.)?discord\.com/channels/",
+    url_examples=["https://discord.com/channels/123456789/987654321"],
+    default_config={**GD_DEFAULTS, "content_types": ["all"]},
+    notes="Requires Discord user token (not bot token).",
+    derive_post_url=derive_post_url,
+)

backend/app/services/platforms/hentaifoundry.py

@@ -0,0 +1,83 @@
+"""HentaiFoundry — two quirks colocated.
+
+1. post_url: HF sidecars omit `url` entirely; `src` is the image URL.
+   Synthesize the permalink from `user` + `index`
+   (/pictures/user/<user>/<index>).
+
+2. augment_cookies: gallery-dl's HF extractor checks
+   `self.cookies.get("PHPSESSID", domain="www.hentai-foundry.com")` with
+   `requests`' EXACT domain matching. The extension's pre-v1.0.5
+   `cookies.js` aggressively rewrote every captured cookie to the
+   leading-dot subdomain-wide form (`.hentai-foundry.com`), which fails
+   the exact lookup even though the cookie IS sent on actual HTTP
+   requests (RFC 6265 subdomain matching). The extractor falls into
+   an unauthenticated `?enterAgree=1` HEAD that 401s. Inject host-only
+   duplicates of PHPSESSID + YII_CSRF_TOKEN so the lookup succeeds.
+"""
+
+from .base import GD_DEFAULTS, PlatformInfo, str_field, str_id_value
+
+_HOST_ONLY_NAMES = ("PHPSESSID", "YII_CSRF_TOKEN")
+
+
+def derive_post_url(data: dict) -> str | None:
+    user = str_field(data.get("user")) or str_field(data.get("artist"))
+    idx = str_id_value(data.get("index"))
+    if user and idx:
+        return f"https://www.hentai-foundry.com/pictures/user/{user}/{idx}"
+    return None
+
+
+def augment_cookies(netscape: str) -> str:
+    body = netscape.rstrip("\n")
+    if not body:
+        return netscape
+    lines = body.split("\n")
+    existing_host_only: set[str] = set()
+    by_name: dict[str, list[str]] = {}
+    for raw in lines:
+        if not raw or raw.startswith("#"):
+            continue
+        parts = raw.split("\t")
+        if len(parts) < 7:
+            continue
+        domain, _flag, _path, _secure, _exp, name, _value = parts[:7]
+        if name not in _HOST_ONLY_NAMES:
+            continue
+        if domain == "www.hentai-foundry.com":
+            existing_host_only.add(name)
+        elif domain in (".hentai-foundry.com", "hentai-foundry.com"):
+            by_name.setdefault(name, []).append(raw)
+
+    appended: list[str] = []
+    for name in _HOST_ONLY_NAMES:
+        if name in existing_host_only or name not in by_name:
+            continue
+        # Duplicate the first subdomain-wide line as host-only on
+        # www.hentai-foundry.com. Same value + expiry; flag=FALSE marks
+        # the entry host-only in netscape format.
+        parts = by_name[name][0].split("\t")
+        parts[0] = "www.hentai-foundry.com"
+        parts[1] = "FALSE"
+        appended.append("\t".join(parts[:7]))
+
+    if not appended:
+        return netscape
+    return body + "\n" + "\n".join(appended) + "\n"
+
+
+INFO = PlatformInfo(
+    key="hentaifoundry",
+    name="Hentai Foundry",
+    description="Download artwork from Hentai Foundry artists",
+    auth_type="cookies",
+    requires_auth=False,
+    url_pattern=r"^https?://(www\.)?hentai-foundry\.com/",
+    url_examples=[
+        "https://www.hentai-foundry.com/user/example_artist",
+        "https://www.hentai-foundry.com/pictures/user/example_artist",
+    ],
+    default_config={**GD_DEFAULTS, "content_types": ["pictures"]},
+    derive_post_url=derive_post_url,
+    augment_cookies=augment_cookies,
+)

backend/app/services/platforms/patreon.py

@@ -0,0 +1,23 @@
+"""Patreon — no quirks. The reference platform.
+
+Patreon's gallery-dl sidecars are the well-behaved baseline: `url` is a
+real permalink, `id` is the post id, `title` and `content` are
+populated. No cookie quirks (session cookies are domain-wide). No
+derivation overrides.
+"""
+
+from .base import GD_DEFAULTS, PlatformInfo
+
+INFO = PlatformInfo(
+    key="patreon",
+    name="Patreon",
+    description="Download posts from Patreon creators",
+    auth_type="cookies",
+    requires_auth=True,
+    url_pattern=r"^https?://(www\.)?patreon\.com/",
+    url_examples=[
+        "https://www.patreon.com/example_artist",
+        "https://www.patreon.com/user?u=12345678",
+    ],
+    default_config={**GD_DEFAULTS, "content_types": ["images", "attachments"]},
+)

backend/app/services/platforms/pixiv.py

@@ -0,0 +1,32 @@
+"""Pixiv — one quirk.
+
+post_url: gallery-dl's `url` is the image URL on `i.pximg.net`. The
+post permalink follows /artworks/<id>. external_post_id (= `id`) was
+already correct, so no override there.
+"""
+
+from .base import GD_DEFAULTS, PlatformInfo, str_id_value
+
+
+def derive_post_url(data: dict) -> str | None:
+    pid = str_id_value(data.get("id"))
+    if pid:
+        return f"https://www.pixiv.net/artworks/{pid}"
+    return None
+
+
+INFO = PlatformInfo(
+    key="pixiv",
+    name="Pixiv",
+    description="Download artwork from Pixiv artists",
+    auth_type="token",
+    requires_auth=True,
+    url_pattern=r"^https?://(www\.)?pixiv\.net/",
+    url_examples=[
+        "https://www.pixiv.net/users/12345678",
+        "https://www.pixiv.net/en/users/12345678",
+    ],
+    default_config={**GD_DEFAULTS, "content_types": ["all"]},
+    notes="Requires OAuth refresh token. Run `gallery-dl oauth:pixiv` to obtain one.",
+    derive_post_url=derive_post_url,
+)

backend/app/services/platforms/subscribestar.py

@@ -0,0 +1,62 @@
+"""SubscribeStar — three quirks colocated.
+
+1. external_post_id: gallery-dl puts the per-attachment id in `id`
+   (e.g. 711509) and the actual post id in `post_id` (e.g. 360360).
+   The default chain in base.py already prefers `post_id`; this module
+   doesn't need to override it but the comment lives here too so a
+   future reader knows the chain's order was driven by this platform.
+
+2. post_url: gallery-dl's `url` is the file CDN URL
+   (`/post_uploads?payload=...`). Synthesize the post permalink from
+   `post_id`.
+
+3. augment_cookies: the server gates artist pages behind a
+   `_personalization_id` age-confirmation cookie that the user can't
+   easily refresh — SubscribeStar's frontend JS uses localStorage to
+   suppress the age popup once dismissed. gallery-dl's own login flow
+   sidesteps this by setting `18_plus_agreement_generic=true` on
+   `.subscribestar.adult`; we mirror that for cookies captured via the
+   extension.
+"""
+
+from .base import GD_DEFAULTS, PlatformInfo, str_id_value
+
+
+def derive_post_url(data: dict) -> str | None:
+    pid = str_id_value(data.get("post_id"))
+    if pid:
+        return f"https://www.subscribestar.com/posts/{pid}"
+    return None
+
+
+def augment_cookies(netscape: str) -> str:
+    if "18_plus_agreement_generic" in netscape:
+        return netscape
+    # Far-future expiry — gallery-dl's own login flow sets this with no
+    # explicit expiry; the server only checks presence/value.
+    expiry = 4102444800  # 2100-01-01 UTC
+    line = "\t".join([
+        ".subscribestar.adult", "TRUE", "/", "TRUE",
+        str(expiry), "18_plus_agreement_generic", "true",
+    ])
+    body = netscape.rstrip("\n")
+    if not body:
+        body = "# Netscape HTTP Cookie File"
+    return body + "\n" + line + "\n"
+
+
+INFO = PlatformInfo(
+    key="subscribestar",
+    name="SubscribeStar",
+    description="Download posts from SubscribeStar creators",
+    auth_type="cookies",
+    requires_auth=True,
+    url_pattern=r"^https?://(www\.)?subscribestar\.(com|adult)/",
+    url_examples=[
+        "https://subscribestar.adult/example_artist",
+        "https://www.subscribestar.com/example_artist",
+    ],
+    default_config={**GD_DEFAULTS, "content_types": ["all"]},
+    derive_post_url=derive_post_url,
+    augment_cookies=augment_cookies,
+)

backend/app/services/post_feed_service.py

@@ -56,9 +56,17 @@ class PostFeedService:
         artist_id: int | None = None,
         platform: str | None = None,
         limit: int = 24,
+        direction: str = "older",
     ) -> dict:
+        """Paginate the feed from `cursor`. direction='older' walks back in
+        time (default, infinite-scroll down); direction='newer' walks forward
+        (scroll up in an anchored view). Items are always returned in feed
+        (descending) order; `next_cursor` points to the far edge in the
+        requested direction (null when exhausted)."""
         if limit < 1 or limit > 100:
             raise ValueError("limit must be between 1 and 100")
+        if direction not in ("older", "newer"):
+            raise ValueError("direction must be 'older' or 'newer'")
 
         sort_key = _sort_key()
         stmt = (
@@ -72,22 +80,37 @@ class PostFeedService:
             stmt = stmt.where(Source.platform == platform)
         if cursor:
             cur_ts, cur_id = decode_cursor(cursor)
-            stmt = stmt.where(
-                or_(
+            if direction == "older":
+                stmt = stmt.where(or_(
                     sort_key < cur_ts,
                     and_(sort_key == cur_ts, Post.id < cur_id),
-                )
-            )
+                ))
+            else:
+                stmt = stmt.where(or_(
+                    sort_key > cur_ts,
+                    and_(sort_key == cur_ts, Post.id > cur_id),
+                ))
 
-        stmt = stmt.order_by(sort_key.desc(), Post.id.desc()).limit(limit + 1)
+        if direction == "older":
+            stmt = stmt.order_by(sort_key.desc(), Post.id.desc())
+        else:
+            stmt = stmt.order_by(sort_key.asc(), Post.id.asc())
+        stmt = stmt.limit(limit + 1)
         rows = (await self.session.execute(stmt)).all()
 
+        has_more = len(rows) > limit
+        rows = rows[:limit]
+        if direction == "newer":
+            # Fetched ascending (closest-newer first); flip to feed order.
+            rows = list(reversed(rows))
+
         next_cursor: str | None = None
-        if len(rows) > limit:
-            last_post, _, _ = rows[limit - 1]
-            last_key = last_post.post_date or last_post.downloaded_at
-            next_cursor = encode_cursor(last_key, last_post.id)
-            rows = rows[:limit]
+        if has_more and rows:
+            # Far edge in the travel direction: oldest row going older,
+            # newest row going newer (rows is descending for display).
+            edge_post = rows[-1][0] if direction == "older" else rows[0][0]
+            edge_key = edge_post.post_date or edge_post.downloaded_at
+            next_cursor = encode_cursor(edge_key, edge_post.id)
 
         post_ids = [p.id for p, _, _ in rows]
         thumbs_map = await self._thumbnails_for(post_ids)
@@ -99,6 +122,49 @@ class PostFeedService:
         ]
         return {"items": items, "next_cursor": next_cursor}
 
+    async def around(
+        self,
+        *,
+        post_id: int,
+        artist_id: int | None = None,
+        platform: str | None = None,
+        limit: int = 12,
+    ) -> dict | None:
+        """A window centered on `post_id`: up to `limit` newer posts + the
+        post + up to `limit` older posts, in feed (descending) order, with a
+        cursor for each end. Returns None if the post doesn't exist."""
+        anchor = (await self.session.execute(
+            select(Post, Artist, Source)
+            .join(Source, Post.source_id == Source.id)
+            .join(Artist, Source.artist_id == Artist.id)
+            .where(Post.id == post_id)
+        )).one_or_none()
+        if anchor is None:
+            return None
+        anchor_post, anchor_artist, anchor_source = anchor
+        anchor_key = anchor_post.post_date or anchor_post.downloaded_at
+        anchor_cursor = encode_cursor(anchor_key, anchor_post.id)
+
+        older = await self.scroll(
+            cursor=anchor_cursor, artist_id=artist_id, platform=platform,
+            limit=limit, direction="older",
+        )
+        newer = await self.scroll(
+            cursor=anchor_cursor, artist_id=artist_id, platform=platform,
+            limit=limit, direction="newer",
+        )
+        thumbs_map = await self._thumbnails_for([anchor_post.id])
+        atts_map = await self._attachments_for([anchor_post.id])
+        anchor_item = self._to_dict(
+            anchor_post, anchor_artist, anchor_source, thumbs_map, atts_map,
+        )
+        return {
+            "items": newer["items"] + [anchor_item] + older["items"],
+            "cursor_older": older["next_cursor"],
+            "cursor_newer": newer["next_cursor"],
+            "anchor_id": anchor_post.id,
+        }
+
     async def get_post(self, post_id: int) -> dict | None:
         row = (await self.session.execute(
             select(Post, Artist, Source)
@@ -141,6 +207,7 @@ class PostFeedService:
                 ImageRecord.primary_post_id,
                 ImageRecord.sha256,
                 ImageRecord.mime,
+                ImageRecord.thumbnail_path,
                 func.row_number().over(
                     partition_by=ImageRecord.primary_post_id,
                     order_by=ImageRecord.id.asc(),
@@ -154,18 +221,18 @@ class PostFeedService:
         )
         stmt = select(
             ranked.c.id, ranked.c.primary_post_id,
-            ranked.c.sha256, ranked.c.mime, ranked.c.total,
+            ranked.c.sha256, ranked.c.mime, ranked.c.thumbnail_path, ranked.c.total,
         )
         if limit is not None:
             stmt = stmt.where(ranked.c.rn <= limit)
         rows = (await self.session.execute(stmt)).all()
 
         out: dict[int, dict] = {pid: {"thumbs": [], "more": 0} for pid in post_ids}
-        for img_id, pid, sha, mime, total in rows:
+        for img_id, pid, sha, mime, tp, total in rows:
             entry = out.setdefault(pid, {"thumbs": [], "more": 0})
             entry["thumbs"].append({
                 "image_id": img_id,
-                "thumbnail_url": thumbnail_url(sha, mime),
+                "thumbnail_url": thumbnail_url(tp, sha, mime),
                 "mime": mime,
             })
             # `total` is constant per partition; overflow = total - THUMBNAIL_LIMIT.

backend/app/services/refetch_service.py

@@ -0,0 +1,106 @@
+"""Layer-2 one-shot re-download remediation for corrupt imported files.
+
+When an import fails on a file that came from a known, pollable
+subscription Source, deleting the bad copy and re-running the source's
+downloader can fetch a fresh, unblemished copy. This only helps when:
+
+  - the corruption is in transit / on disk (not at the source), AND
+  - the file resolves to an ENABLED Source with a real feed URL
+    (a `sidecar:<platform>:<slug>` synthetic anchor is not pollable),
+    AND
+  - we haven't already re-fetched this task once (bounded by
+    ImportTask.refetched so source-side corruption can't loop).
+
+Filesystem-only imports with no resolvable Source return 'no_source' —
+the operator's only remediation there is to replace the file on disk.
+
+Operator-requested 2026-05-28 (Layer 2).
+"""
+
+import json
+import logging
+from pathlib import Path
+
+from sqlalchemy import select
+from sqlalchemy.orm import Session
+
+from ..models import Artist, ImportTask, Source
+from ..utils.paths import derive_top_level_artist
+from ..utils.sidecar import find_sidecar, parse_sidecar
+from ..utils.slug import slugify
+
+log = logging.getLogger(__name__)
+
+
+def resolve_refetch_source(
+    session: Session, source_path: str, import_root: Path,
+) -> Source | None:
+    """Find an enabled, real-URL Source for the file's (artist, platform),
+    or None when nothing re-pollable resolves."""
+    path = Path(source_path)
+    sc = find_sidecar(path)
+    if sc is None:
+        return None
+    try:
+        data = json.loads(sc.read_text("utf-8"))
+    except (OSError, json.JSONDecodeError):
+        return None
+    if not isinstance(data, dict):
+        return None
+    sd = parse_sidecar(data)
+    if not sd.platform:
+        return None
+    artist_name = derive_top_level_artist(path, import_root)
+    if not artist_name:
+        return None
+    artist = session.execute(
+        select(Artist).where(Artist.slug == slugify(artist_name))
+    ).scalar_one_or_none()
+    if artist is None:
+        return None
+    src = session.execute(
+        select(Source)
+        .where(
+            Source.artist_id == artist.id,
+            Source.platform == sd.platform,
+            Source.enabled.is_(True),
+        )
+        .order_by(Source.id.asc())
+    ).scalars().first()
+    if src is None:
+        return None
+    if (src.url or "").startswith("sidecar:"):
+        return None  # synthetic anchor — not a pollable feed
+    return src
+
+
+def attempt_refetch(
+    session: Session, task: ImportTask, import_root: Path,
+) -> dict:
+    """Delete the corrupt file, mark the task refetched, and trigger ONE
+    source re-check. Idempotent/bounded: a task already refetched (or
+    with no resolvable Source) is a no-op. Commits."""
+    if task.refetched:
+        return {"status": "already_refetched"}
+    src = resolve_refetch_source(session, task.source_path, import_root)
+    if src is None:
+        return {"status": "no_source"}
+
+    # Remove the bad copy so gallery-dl (skip_existing) re-fetches it on
+    # the source re-check instead of skipping the still-present corrupt
+    # file.
+    try:
+        Path(task.source_path).unlink(missing_ok=True)
+    except OSError as exc:
+        log.warning("refetch unlink failed for %s: %s", task.source_path, exc)
+
+    task.refetched = True
+    session.add(task)
+    session.commit()
+
+    # Lazy import to avoid a tasks→services→tasks import cycle at module
+    # load. download_source.delay() is sync-safe in any context.
+    from ..tasks.download import download_source
+
+    download_source.delay(src.id)
+    return {"status": "refetch_queued", "source_id": src.id}

backend/app/services/scheduler_service.py

@@ -9,15 +9,33 @@ from __future__ import annotations
 from datetime import UTC, datetime, timedelta
 
 from sqlalchemy import select
+from sqlalchemy.dialects.postgresql import insert as pg_insert
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy.orm import selectinload
 
-from ..models import Artist, ImportSettings, Source
+from ..models import AppSetting, Artist, ImportSettings, Source
 
 MIN_INTERVAL_SECONDS = 60
 MAX_INTERVAL_SECONDS = 86400
 MAX_BACKOFF_EXPONENT = 6
 
+# AppSetting key stamped every time the Beat tick fires (see scan.py). The
+# tick runs every 60s; the UI flags the scheduler as stalled if the last
+# stamp is older than a few minutes.
+SCHEDULER_LAST_TICK_KEY = "scheduler_last_tick_at"
+
+# AppSetting key prefix for per-platform rate-limit cooldowns. When a
+# download surfaces ErrorType.RATE_LIMITED, every other source on the same
+# platform is deferred for PLATFORM_RATE_LIMIT_COOLDOWN_SECONDS so the next
+# scan tick doesn't fire a burst of due same-platform sources back into the
+# same limit. Per-source consecutive_failures backoff still applies on top
+# of this — but this is PREVENTIVE (kills the same-tick burst from N due
+# sources hammering the platform at once), while consecutive_failures is
+# REACTIVE (slows the offender down over many cycles). Operator-confirmed
+# 2026-05-30.
+PLATFORM_COOLDOWN_KEY_PREFIX = "platform_cooldown:"
+PLATFORM_RATE_LIMIT_COOLDOWN_SECONDS = 900  # 15 min
+
 
 def compute_effective_interval(
     source: Source, artist: Artist, settings: ImportSettings,
@@ -40,10 +58,76 @@ def compute_effective_interval(
     return max(MIN_INTERVAL_SECONDS, min(MAX_INTERVAL_SECONDS, raw))
 
 
+async def set_platform_cooldown(
+    session: AsyncSession, platform: str,
+    seconds: int = PLATFORM_RATE_LIMIT_COOLDOWN_SECONDS,
+) -> None:
+    """Stamp a cooldown expiry on the given platform so select_due_sources
+    skips every source on that platform until it expires.
+
+    Called when a download surfaces ErrorType.RATE_LIMITED so the other
+    sources on the same platform don't all retry into the same rate limit.
+    Caller is responsible for committing the session.
+
+    Uses INSERT...ON CONFLICT DO UPDATE so two concurrent workers hitting
+    the same platform's rate limit don't race: a SELECT-then-INSERT pattern
+    would let the loser's whole transaction (including the source-health
+    update + event finalize) roll back on a unique-violation, stranding
+    that event. Atomic upsert avoids that.
+    """
+    now = datetime.now(UTC)
+    expires_at = (now + timedelta(seconds=seconds)).isoformat()
+    key = f"{PLATFORM_COOLDOWN_KEY_PREFIX}{platform}"
+    stmt = pg_insert(AppSetting.__table__).values(
+        key=key, value=expires_at, updated_at=now,
+    ).on_conflict_do_update(
+        index_elements=["key"],
+        set_={"value": expires_at, "updated_at": now},
+    )
+    await session.execute(stmt)
+
+
+async def active_platform_cooldowns(session: AsyncSession) -> dict[str, datetime]:
+    """Return {platform: expires_at} for platforms whose cooldown is still
+    in the future. Expired rows are ignored (a future maintenance sweep can
+    delete them; they don't affect routing decisions on their own).
+
+    Exposed beyond scheduler_service so the manual check endpoint
+    (`/api/sources/<id>/check`) can defer bulk retries that would bowl
+    into the same rate limit the cooldown is preventing.
+    """
+    rows = (await session.execute(
+        select(AppSetting.key, AppSetting.value)
+        .where(AppSetting.key.startswith(PLATFORM_COOLDOWN_KEY_PREFIX))
+    )).all()
+    if not rows:
+        return {}
+    now = datetime.now(UTC)
+    active: dict[str, datetime] = {}
+    for key, value in rows:
+        try:
+            expires_at = datetime.fromisoformat(value)
+        except (ValueError, TypeError):
+            continue
+        if expires_at > now:
+            active[key[len(PLATFORM_COOLDOWN_KEY_PREFIX):]] = expires_at
+    return active
+
+
 async def select_due_sources(session: AsyncSession) -> list[Source]:
     """Sources where (enabled, artist.auto_check) and now >= last_checked_at + effective_interval.
 
-    Never-checked sources (last_checked_at IS NULL) are always due.
+    Never-checked sources (last_checked_at IS NULL) are always due. Sources
+    whose platform is currently in a rate-limit cooldown are excluded — the
+    cooldown is the preventive half of the burst-prevention pair (per-source
+    consecutive_failures backoff handles the offending source itself).
+
+    Ordering: last_checked_at ASC NULLS FIRST, then id. Never-checked
+    sources go first, then the longest-since-checked, so the most overdue
+    sources hit Celery's FIFO download queue first. Anti-starvation: if
+    queue throughput ever falls below the tick rate, a freshly-rerun source
+    can't keep cutting in line ahead of one that hasn't been checked at all.
+    Operator-confirmed 2026-05-30.
     """
     rows = (await session.execute(
         select(Source)
@@ -51,15 +135,17 @@ async def select_due_sources(session: AsyncSession) -> list[Source]:
         .join(Artist, Source.artist_id == Artist.id)
         .where(Source.enabled.is_(True))
         .where(Artist.auto_check.is_(True))
+        .order_by(Source.last_checked_at.asc().nulls_first(), Source.id)
     )).scalars().all()
 
-    settings = (await session.execute(
-        select(ImportSettings).where(ImportSettings.id == 1)
-    )).scalar_one()
+    cooldowns = await active_platform_cooldowns(session)
+    settings = await ImportSettings.load(session)
 
     now = datetime.now(UTC)
     due: list[Source] = []
     for s in rows:
+        if s.platform in cooldowns:
+            continue
         interval = compute_effective_interval(s, s.artist, settings)
         if s.last_checked_at is None:
             due.append(s)
@@ -78,3 +164,65 @@ def compute_next_check_at(
         return None
     interval = compute_effective_interval(source, artist, settings)
     return source.last_checked_at + timedelta(seconds=interval)
+
+
+async def record_tick(session: AsyncSession) -> None:
+    """Stamp the current time on the SCHEDULER_LAST_TICK_KEY AppSetting.
+
+    Called once per Beat tick so the UI can prove the scheduler is alive.
+    Commits its own write so the stamp survives even if the rest of the
+    tick errors out.
+    """
+    now_iso = datetime.now(UTC).isoformat()
+    row = (await session.execute(
+        select(AppSetting).where(AppSetting.key == SCHEDULER_LAST_TICK_KEY)
+    )).scalar_one_or_none()
+    if row is None:
+        session.add(AppSetting(key=SCHEDULER_LAST_TICK_KEY, value=now_iso))
+    else:
+        row.value = now_iso
+    await session.commit()
+
+
+async def scheduler_status(session: AsyncSession) -> dict:
+    """Summarise scheduler health for the dashboard.
+
+    Returns last_tick_at (when Beat last fired), next_due_at (earliest
+    upcoming scheduled check across enabled auto-check sources), due_now
+    (how many are due right now), and auto_sources (total under schedule).
+    """
+    last_tick_at = (await session.execute(
+        select(AppSetting.value).where(AppSetting.key == SCHEDULER_LAST_TICK_KEY)
+    )).scalar_one_or_none()
+
+    rows = (await session.execute(
+        select(Source)
+        .options(selectinload(Source.artist))
+        .join(Artist, Source.artist_id == Artist.id)
+        .where(Source.enabled.is_(True))
+        .where(Artist.auto_check.is_(True))
+    )).scalars().all()
+    settings = await ImportSettings.load(session)
+
+    now = datetime.now(UTC)
+    due_now = 0
+    next_due_at: datetime | None = None
+    for s in rows:
+        if s.last_checked_at is None:
+            due_now += 1
+            continue
+        nca = compute_next_check_at(s, s.artist, settings)
+        if nca is None or nca <= now:
+            due_now += 1
+        elif next_due_at is None or nca < next_due_at:
+            next_due_at = nca
+
+    cooldowns = await active_platform_cooldowns(session)
+
+    return {
+        "last_tick_at": last_tick_at,
+        "next_due_at": next_due_at.isoformat() if next_due_at else None,
+        "due_now": due_now,
+        "auto_sources": len(rows),
+        "platform_cooldowns": {p: dt.isoformat() for p, dt in cooldowns.items()},
+    }

backend/app/services/series_service.py

@@ -63,6 +63,7 @@ class SeriesService:
                     ImageRecord.sha256,
                     ImageRecord.mime,
                     ImageRecord.path,
+                    ImageRecord.thumbnail_path,
                 )
                 .join(ImageRecord, ImageRecord.id == SeriesPage.image_id)
                 .where(SeriesPage.series_tag_id == series_tag_id)
@@ -75,7 +76,7 @@ class SeriesService:
                 {
                     "image_id": r.image_id,
                     "page_number": r.page_number,
-                    "thumbnail_url": thumbnail_url(r.sha256, r.mime),
+                    "thumbnail_url": thumbnail_url(r.thumbnail_path, r.sha256, r.mime),
                     "image_url": f"/images/{r.path.split('/images/', 1)[-1]}",
                 }
                 for r in rows

backend/app/services/showcase_service.py

@@ -34,7 +34,7 @@ class ShowcaseService:
                 "mime": r.mime,
                 "width": r.width,
                 "height": r.height,
-                "thumbnail_url": thumbnail_url(r.sha256, r.mime),
+                "thumbnail_url": thumbnail_url(r.thumbnail_path, r.sha256, r.mime),
             }
             for r in rows
         ]

backend/app/services/source_service.py

@@ -120,9 +120,7 @@ class SourceService:
         return config
 
     async def _load_settings(self) -> ImportSettings:
-        return (await self.session.execute(
-            select(ImportSettings).where(ImportSettings.id == 1)
-        )).scalar_one()
+        return await ImportSettings.load(self.session)
 
     def _build_record(
         self, source: Source, artist: Artist, settings: ImportSettings,
@@ -151,14 +149,27 @@ class SourceService:
         settings = await self._load_settings()
         return self._build_record(source, artist, settings)
 
-    async def list(self, artist_id: int | None = None) -> list[SourceRecord]:
-        stmt = (
-            select(Source, Artist)
-            .join(Artist, Artist.id == Source.artist_id)
-            .order_by(Artist.name.asc(), Source.id.asc())
-        )
+    async def list(
+        self, artist_id: int | None = None, failing: bool = False,
+        include_synthetic: bool = False,
+    ) -> list[SourceRecord]:
+        stmt = select(Source, Artist).join(Artist, Artist.id == Source.artist_id)
         if artist_id is not None:
             stmt = stmt.where(Source.artist_id == artist_id)
+        if not include_synthetic:
+            # Filesystem-import sidecar anchors (importer._source_for_sidecar)
+            # have url='sidecar:<platform>:<slug>' and exist only to give
+            # imported Posts a NOT-NULL Source FK. They aren't pollable
+            # feeds; the Subscriptions UI used to render them as phantom
+            # subscriptions. Hide by default.
+            stmt = stmt.where(~Source.url.like("sidecar:%"))
+        if failing:
+            # Worst-first so the rollup card surfaces the loudest failures.
+            stmt = stmt.where(Source.consecutive_failures > 0).order_by(
+                Source.consecutive_failures.desc(), Artist.name.asc(),
+            )
+        else:
+            stmt = stmt.order_by(Artist.name.asc(), Source.id.asc())
         rows = (await self.session.execute(stmt)).all()
         settings = await self._load_settings()
         return [self._build_record(s, a, settings) for s, a in rows]

backend/app/services/tag_directory_service.py

@@ -115,12 +115,17 @@ class TagDirectoryService:
             .subquery()
         )
         stmt = (
-            select(sub.c.tag_id, ImageRecord.sha256, ImageRecord.mime)
+            select(
+                sub.c.tag_id,
+                ImageRecord.sha256,
+                ImageRecord.mime,
+                ImageRecord.thumbnail_path,
+            )
             .join(ImageRecord, ImageRecord.id == sub.c.image_record_id)
             .where(sub.c.rn <= 3)
             .order_by(sub.c.tag_id, sub.c.rn)
         )
         out: dict[int, list[str]] = {}
-        for tag_id, sha, mime in (await self.session.execute(stmt)).all():
-            out.setdefault(tag_id, []).append(thumbnail_url(sha, mime))
+        for tag_id, sha, mime, tp in (await self.session.execute(stmt)).all():
+            out.setdefault(tag_id, []).append(thumbnail_url(tp, sha, mime))
         return out

backend/app/tasks/_async_session.py

@@ -0,0 +1,21 @@
+"""Per-invocation async session factory for Celery task modules.
+
+Async engine connections are bound to the event loop. Each Celery task
+runs its async body under a fresh ``asyncio.run()`` loop, so it needs its
+own engine created (and disposed) within that loop — a process-wide async
+engine would reuse loop-bound connections across tasks and raise "attached
+to a different loop". So unlike the process-wide sync engine in
+``_sync_engine.py``, this returns a fresh engine per call; the caller
+disposes it (``await engine.dispose()``) when its loop ends.
+"""
+
+from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
+
+from ..config import get_config
+
+
+def async_session_factory():
+    """Return ``(sessionmaker, engine)`` bound to a fresh async engine."""
+    cfg = get_config()
+    engine = create_async_engine(cfg.database_url, future=True, pool_pre_ping=True)
+    return async_sessionmaker(engine, class_=AsyncSession, expire_on_commit=False), engine

backend/app/tasks/backup.py

@@ -246,9 +246,7 @@ def prune_backups() -> dict:
     SessionLocal = _sync_session_factory()
     counts = {"db_deleted": 0, "images_deleted": 0, "files_unlinked": 0}
     with SessionLocal() as session:
-        s = session.execute(
-            select(ImportSettings).where(ImportSettings.id == 1)
-        ).scalar_one()
+        s = ImportSettings.load_sync(session)
         for kind, keep in (
             ("db", s.backup_db_keep_last_n),
             ("images", s.backup_images_keep_last_n),
@@ -286,9 +284,7 @@ def backup_db_nightly() -> dict:
     either {'skipped': '<reason>'} or {'dispatched': '<task_id>'}."""
     SessionLocal = _sync_session_factory()
     with SessionLocal() as session:
-        s = session.execute(
-            select(ImportSettings).where(ImportSettings.id == 1)
-        ).scalar_one()
+        s = ImportSettings.load_sync(session)
         nightly_enabled = s.backup_db_nightly_enabled
         configured_hour = s.backup_db_nightly_hour_utc
     if not nightly_enabled:

backend/app/tasks/download.py

@@ -3,12 +3,9 @@
 import asyncio
 from pathlib import Path
 
-from sqlalchemy import select
 from sqlalchemy.exc import DBAPIError, OperationalError
-from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
 
 from ..celery_app import celery
-from ..config import get_config
 from ..models import ImportSettings
 from ..services.credential_crypto import CredentialCrypto
 from ..services.credential_service import CredentialService
@@ -16,18 +13,13 @@ from ..services.download_service import DownloadService
 from ..services.gallery_dl import GalleryDLService
 from ..services.importer import Importer
 from ..services.thumbnailer import Thumbnailer
+from ._async_session import async_session_factory
 from .import_file import _sync_session_factory
 
 IMAGES_ROOT = Path("/images")
 _KEY_PATH = IMAGES_ROOT / "secrets" / "credential_key.b64"
 
 
-def _async_session_factory():
-    cfg = get_config()
-    engine = create_async_engine(cfg.database_url, future=True, pool_pre_ping=True)
-    return async_sessionmaker(engine, class_=AsyncSession, expire_on_commit=False), engine
-
-
 @celery.task(
     name="backend.app.tasks.download.download_source",
     bind=True,
@@ -44,13 +36,11 @@ def download_source(self, source_id: int) -> int:
     """Returns the DownloadEvent.id."""
 
     async def _run():
-        async_factory, async_engine = _async_session_factory()
+        async_factory, async_engine = async_session_factory()
         SyncFactory = _sync_session_factory()
         try:
             with SyncFactory() as sync_session:
-                settings = sync_session.execute(
-                    select(ImportSettings).where(ImportSettings.id == 1)
-                ).scalar_one()
+                settings = ImportSettings.load_sync(sync_session)
                 rate_limit = settings.download_rate_limit_seconds
                 validate_files = settings.download_validate_files
 
@@ -64,9 +54,7 @@ def download_source(self, source_id: int) -> int:
             async with async_factory() as async_session:
                 cred_service = CredentialService(async_session, crypto)
                 with SyncFactory() as sync_session:
-                    sync_settings = sync_session.execute(
-                        select(ImportSettings).where(ImportSettings.id == 1)
-                    ).scalar_one()
+                    sync_settings = ImportSettings.load_sync(sync_session)
                     importer = Importer(
                         session=sync_session,
                         images_root=IMAGES_ROOT,

backend/app/tasks/import_file.py

@@ -64,30 +64,13 @@ def _mark_failed(session, task, error_msg: str) -> None:
             pass
 
 
-@celery.task(
-    name="backend.app.tasks.import_file.import_media_file",
-    bind=True,
-    autoretry_for=(OperationalError, DBAPIError, OSError),
-    retry_backoff=5,
-    retry_backoff_max=60,
-    retry_jitter=True,
-    max_retries=3,
-    soft_time_limit=300,
-    time_limit=360,
-)
-def import_media_file(self, import_task_id: int) -> dict:
-    """Returns a dict so the eager-mode tests can assert without DB.
-
-    Decorator notes:
-      - autoretry_for: transient DB / filesystem errors retry with
-        exponential backoff (5s base, jitter, max 3 attempts). On final
-        give-up the task raises and acks_late=True (set globally on the
-        Celery app) does NOT redeliver — the recovery sweep catches the
-        row instead.
-      - soft_time_limit (300s) raises SoftTimeLimitExceeded in this
-        process so the task can mark its row failed before being killed.
-      - time_limit (360s) is the hard cap; SIGKILL if the soft signal
-        was swallowed.
+def _run_import_task(import_task_id: int) -> dict:
+    """Shared body for import_media_file + import_archive_file. The two
+    tasks differ ONLY in their Celery time limits (a single media file
+    is sub-second; an archive runs the full per-member pipeline inline
+    for every member and can take many minutes). Both flip the row to
+    'processing', dispatch to `_do_import`, and honor the
+    flip-to-terminal resilience contract.
     """
     SessionLocal = _sync_session_factory()
     with SessionLocal() as session:
@@ -103,24 +86,88 @@ def import_media_file(self, import_task_id: int) -> dict:
         try:
             return _do_import(session, task, import_task_id)
         except SoftTimeLimitExceeded:
-            _mark_failed(session, task, "soft_time_limit exceeded (>300s)")
+            _mark_failed(session, task, "soft_time_limit exceeded")
             raise
         except (OperationalError, DBAPIError, OSError):
             # Retryable per the decorator; do NOT mark failed (let
             # autoretry have a clean go at it). If autoretry exhausts,
             # the row stays 'processing' and the maintenance sweep
-            # flips it within 5 min.
+            # flips it.
             raise
         except Exception as exc:  # noqa: BLE001 — pipeline crash, mark + re-raise
             _mark_failed(session, task, f"{type(exc).__name__}: {exc}")
             raise
 
 
+@celery.task(
+    name="backend.app.tasks.import_file.import_media_file",
+    bind=True,
+    autoretry_for=(OperationalError, DBAPIError, OSError),
+    retry_backoff=5,
+    retry_backoff_max=60,
+    retry_jitter=True,
+    max_retries=3,
+    soft_time_limit=300,
+    time_limit=360,
+)
+def import_media_file(self, import_task_id: int) -> dict:
+    """Import ONE media file (or non-media → PostAttachment). Sub-second
+    for the common case; the tight 5-min soft limit keeps a genuinely
+    stuck single-file import detectable fast.
+
+    Decorator notes:
+      - autoretry_for: transient DB / filesystem errors retry with
+        exponential backoff (5s base, jitter, max 3 attempts). On final
+        give-up the task raises and acks_late=True (set globally on the
+        Celery app) does NOT redeliver — the recovery sweep catches the
+        row instead.
+      - soft_time_limit (300s) raises SoftTimeLimitExceeded in-process
+        so the task can mark its row failed before being killed.
+      - time_limit (360s) is the hard SIGKILL cap.
+    """
+    return _run_import_task(import_task_id)
+
+
+@celery.task(
+    name="backend.app.tasks.import_file.import_archive_file",
+    bind=True,
+    autoretry_for=(OperationalError, DBAPIError, OSError),
+    retry_backoff=5,
+    retry_backoff_max=60,
+    retry_jitter=True,
+    max_retries=3,
+    # Archives run the full per-member pipeline (sha256 + pHash + dedup
+    # query + copy + provenance) for EVERY media member inline, under a
+    # single task budget. A multi-hundred-member archive blows the
+    # 5-min media limit. soft=30min / hard=35min sizes for a large
+    # archive. Operator-flagged 2026-05-28 (target 1645019 hit the old
+    # shared 300s soft limit). The recovery sweep gives this task its
+    # own 40-min threshold via maintenance.TASK_STUCK_THRESHOLD_MINUTES
+    # so it isn't preempted while legitimately grinding through members.
+    soft_time_limit=1800,
+    time_limit=2100,
+)
+def import_archive_file(self, import_task_id: int) -> dict:
+    """Import an archive: extract + run the per-member media pipeline for
+    every member inline, then preserve the archive as a PostAttachment.
+    Same body as import_media_file (dispatch is by file kind inside
+    Importer.import_one); split out purely for the larger time budget."""
+    return _run_import_task(import_task_id)
+
+
+def enqueue_import(task_id: int, task_type: str) -> None:
+    """Route an ImportTask to the right Celery task by its task_type.
+    Single source of truth for the media-vs-archive dispatch so the
+    scan, retry, and recovery-requeue paths stay in sync."""
+    if task_type == "archive":
+        import_archive_file.delay(task_id)
+    else:
+        import_media_file.delay(task_id)
+
+
 def _do_import(session, task, import_task_id: int) -> dict:
     """Actual work, called from inside the resilience wrapper."""
-    settings = session.execute(
-        select(ImportSettings).where(ImportSettings.id == 1)
-    ).scalar_one()
+    settings = ImportSettings.load_sync(session)
     import_root = Path(settings.import_scan_path)
     batch = session.get(ImportBatch, task.batch_id)
     deep = bool(batch and batch.scan_mode == "deep")

backend/app/tasks/maintenance.py

@@ -1,22 +1,53 @@
 """Periodic maintenance: recover stuck import tasks, garbage-collect old finished tasks."""
 
 import logging
+import os
 import subprocess
 from datetime import UTC, datetime, timedelta
 from pathlib import Path
 
 from PIL import Image
-from sqlalchemy import delete, select, update
+from sqlalchemy import and_, delete, or_, select, update
 
 from ..celery_app import celery
-from ..models import DownloadEvent, ImageRecord, ImportSettings, ImportTask, TaskRun
+from ..models import (
+    DownloadEvent,
+    ImageRecord,
+    ImportSettings,
+    ImportTask,
+    Source,
+    TaskRun,
+)
 from ..utils.phash import compute_phash
 from ._sync_engine import sync_session_factory as _sync_session_factory
 
 log = logging.getLogger(__name__)
 
 STUCK_THRESHOLD_MINUTES = 5
+# Archive ImportTasks run the per-member pipeline inline for every
+# member (import_archive_file: soft=30min/hard=35min). The ImportTask
+# 'processing' recovery sweep must give them a longer threshold or it
+# re-queues a legitimately-running archive mid-import (double-process).
+# 40 min = 5-min buffer past the archive task's hard kill.
+# Operator-flagged 2026-05-28 (target 1645019, a big archive).
+ARCHIVE_STUCK_THRESHOLD_MINUTES = 40
+
+# Poison-pill cap. After being recovered (re-queued from a stuck
+# 'processing' state) MAX_RECOVERY_ATTEMPTS-1 times, the next sweep
+# marks the row 'failed' instead of looping. 3 = two recoveries then
+# give up. A row reaches this only if it leaves NO terminal flip each
+# run — i.e. it hard-crashes the worker (OOM/segfault/SIGKILL), the
+# signature of a corrupt or oversized input. Caught exceptions already
+# flip to terminal 'failed' and never enter this loop.
+MAX_RECOVERY_ATTEMPTS = 3
 ORPHAN_PENDING_THRESHOLD_MINUTES = 30
+
+# DownloadEvent (pending|running) recovery threshold. download_source has
+# time_limit=1200s (20 min); 30 min is 10 min past that, so a legitimately-
+# running task is never killed by the sweep. Operator-confirmed 2026-05-29
+# after 43 sources stranded at "last check never" by the in-flight guard.
+DOWNLOAD_STALL_THRESHOLD_MINUTES = 30
+
 OLD_TASK_DAYS = 7
 PHASH_PAGE = 500
 VERIFY_PAGE = 200
@@ -24,17 +55,40 @@ FFPROBE_TIMEOUT_SECONDS = 10
 TASK_RUN_KEEP_OK_SECONDS = 24 * 3600       # 24 h
 TASK_RUN_KEEP_FAILURE_SECONDS = 7 * 24 * 3600  # 7 days
 
+# Overrides for recover_stalled_task_runs (the TaskRun 'running' sweep).
+# Tasks/queues that legitimately run longer than the default 5-min
+# threshold need their own larger value, else the sweep marks in-flight
+# work 'error' before it finishes. Each value MUST be ≥ the relevant
+# task.time_limit + a small buffer. task_name overrides take precedence
+# over queue overrides.
+#
+# ml queue: tag_and_embed video branch (≈20 GPU ops); time_limit=1200.
+# import_archive_file: shares the 'import' queue with the fast
+#   single-file import_media_file, so it needs a task-name override
+#   (the import queue itself stays at the 5-min default for single
+#   files); time_limit=2100.
+QUEUE_STUCK_THRESHOLD_MINUTES: dict[str, int] = {
+    "ml": 25,
+}
+TASK_STUCK_THRESHOLD_MINUTES: dict[str, int] = {
+    "backend.app.tasks.import_file.import_archive_file": 40,
+}
+
 
 @celery.task(name="backend.app.tasks.maintenance.recover_interrupted_tasks")
 def recover_interrupted_tasks() -> int:
     """Recover stuck ImportTask rows. Two distinct stuck states:
 
-    1. 'processing' > 5 min — worker crash mid-import. Re-queue via
-       .delay() and let the import retry. Was 30 min historically;
-       tightened 2026-05-24 after operator hit a 2224-row zombie pile.
-       import_media_file is sub-second for the vast majority of files and
-       capped at the per-task soft_time_limit (5 min), so anything still
-       'processing' after that window is a confirmed crash.
+    1. 'processing' too long — worker crash mid-import. Re-queue via
+       enqueue_import (routing media vs archive) and let the import
+       retry. Threshold is task-type-aware: media files are sub-second
+       and capped at the 5-min soft limit, so STUCK_THRESHOLD_MINUTES
+       (5) means a confirmed crash; archives run the per-member
+       pipeline inline (import_archive_file, 35-min hard limit) so they
+       get ARCHIVE_STUCK_THRESHOLD_MINUTES (40) to avoid re-queueing a
+       still-running archive. (Media was tightened from 30 min to 5
+       2026-05-24 after a 2224-row zombie pile; archive split out
+       2026-05-28.)
 
     2. 'pending' or 'queued' > 30 min — enqueue-phase crash. scan_directory
        creates rows with status='pending' (commit), then in a second pass
@@ -51,7 +105,8 @@ def recover_interrupted_tasks() -> int:
     """
     SessionLocal = _sync_session_factory()
     now = datetime.now(UTC)
-    processing_cutoff = now - timedelta(minutes=STUCK_THRESHOLD_MINUTES)
+    media_cutoff = now - timedelta(minutes=STUCK_THRESHOLD_MINUTES)
+    archive_cutoff = now - timedelta(minutes=ARCHIVE_STUCK_THRESHOLD_MINUTES)
     orphan_cutoff = now - timedelta(minutes=ORPHAN_PENDING_THRESHOLD_MINUTES)
     with SessionLocal() as session:
         # Both sweeps used to be SELECT ids → UPDATE WHERE id IN (...) which
@@ -59,20 +114,67 @@ def recover_interrupted_tasks() -> int:
         # tens of thousands of rows (operator hit it 2026-05-26 after the
         # /import deep scan piled up orphans). Folding the SELECT into the
         # UPDATE eliminates the IN-list entirely. RETURNING gives us back
-        # exactly the ids that flipped so the stuck sweep can still
-        # .delay() each one.
-        stuck_result = session.execute(
+        # exactly the (id, task_type) pairs that flipped so the requeue
+        # can route media vs archive correctly.
+        #
+        # Media + archive get separate cutoffs: a single media file is
+        # sub-second so 5 min means crash; an archive runs the per-member
+        # pipeline inline and can legitimately take up to its 35-min hard
+        # limit, so it gets ARCHIVE_STUCK_THRESHOLD_MINUTES (40) to avoid
+        # re-queueing a still-running archive.
+        stuck_predicate = and_(
+            ImportTask.status == "processing",
+            or_(
+                and_(ImportTask.task_type != "archive",
+                     ImportTask.started_at < media_cutoff),
+                and_(ImportTask.task_type == "archive",
+                     ImportTask.started_at < archive_cutoff),
+            ),
+        )
+
+        # POISON-PILL CIRCUIT BREAKER (Layer 1, 2026-05-28). A row that
+        # leaves no terminal flip (hard worker crash: OOM/segfault/SIGKILL
+        # on a corrupt or oversized input) gets re-queued by this sweep —
+        # and would loop forever, re-crashing the worker each pass,
+        # without a cap. Once a row has already been recovered
+        # MAX_RECOVERY_ATTEMPTS-1 times, stop re-queueing it and mark it
+        # 'failed' with a diagnostic so the operator can find + replace
+        # the offending file. This UPDATE runs FIRST so the rows it
+        # claims drop out of 'processing' before the re-queue pass.
+        poison_result = session.execute(
             update(ImportTask)
-            .where(ImportTask.status == "processing")
-            .where(ImportTask.started_at < processing_cutoff)
+            .where(stuck_predicate)
+            .where(ImportTask.recovery_count >= MAX_RECOVERY_ATTEMPTS - 1)
             .values(
-                status="queued",
-                started_at=None,
-                error="recovered from stuck state",
+                status="failed",
+                finished_at=now,
+                error=(
+                    f"crashed or stalled the worker {MAX_RECOVERY_ATTEMPTS} "
+                    f"times without completing — likely a corrupt or "
+                    f"oversized input. Not re-queued. Inspect/replace the "
+                    f"file, then retry via /api/import/retry-failed."
+                ),
             )
             .returning(ImportTask.id)
         )
-        stuck_ids = [row[0] for row in stuck_result.all()]
+        poison_ids = [r[0] for r in poison_result.all()]
+
+        # Re-queue the remaining stuck rows (under the cap) and bump
+        # their recovery_count. RETURNING (id, task_type) so the requeue
+        # routes media vs archive correctly.
+        stuck_result = session.execute(
+            update(ImportTask)
+            .where(stuck_predicate)
+            .where(ImportTask.recovery_count < MAX_RECOVERY_ATTEMPTS - 1)
+            .values(
+                status="queued",
+                started_at=None,
+                recovery_count=ImportTask.recovery_count + 1,
+                error="recovered from stuck state",
+            )
+            .returning(ImportTask.id, ImportTask.task_type)
+        )
+        stuck = stuck_result.all()
 
         orphan_result = session.execute(
             update(ImportTask)
@@ -91,12 +193,34 @@ def recover_interrupted_tasks() -> int:
 
         session.commit()
 
-        if stuck_ids:
-            from .import_file import import_media_file
-            for tid in stuck_ids:
-                import_media_file.delay(tid)
+        if stuck:
+            from .import_file import enqueue_import
+            for tid, task_type in stuck:
+                enqueue_import(tid, task_type)
 
-        return len(stuck_ids) + orphan_count
+        # Layer-2 auto re-download (env-gated, default OFF). For each
+        # poison-pill row that resolves to a pollable Source, delete the
+        # bad file and trigger ONE source re-check to fetch a fresh
+        # copy. Bounded by ImportTask.refetched so source-side
+        # corruption can't loop. The 'failed' row stays as history; the
+        # re-downloaded file re-imports as a fresh task on the next scan.
+        if poison_ids and os.environ.get("FC_AUTO_REFETCH_CORRUPT", "0") == "1":
+            from ..models import ImportSettings
+            from ..services.refetch_service import attempt_refetch
+            import_root = Path(session.execute(
+                select(ImportSettings.import_scan_path)
+                .where(ImportSettings.id == 1)
+            ).scalar_one())
+            for pid in poison_ids:
+                ptask = session.get(ImportTask, pid)
+                if ptask is None:
+                    continue
+                try:
+                    attempt_refetch(session, ptask, import_root)
+                except Exception as exc:  # noqa: BLE001 — best-effort
+                    log.warning("auto-refetch failed for task %s: %s", pid, exc)
+
+        return len(stuck) + len(poison_ids) + orphan_count
 
 
 @celery.task(name="backend.app.tasks.maintenance.cleanup_old_tasks")
@@ -121,18 +245,29 @@ def cleanup_old_tasks() -> int:
 
 @celery.task(name="backend.app.tasks.maintenance.recover_stalled_task_runs")
 def recover_stalled_task_runs() -> int:
-    """Flip task_run rows stuck in 'running' for >STUCK_THRESHOLD_MINUTES
-    to 'error'. FC-3i.
+    """Flip task_run rows stuck in 'running' past their queue-specific
+    threshold to 'error'. FC-3i.
 
     A row gets stuck when the worker dies without emitting
     task_postrun / task_failure (e.g. OOM, container restart between
-    signals, signal handler raised+logged). Shares the 5-min threshold
-    with recover_interrupted_tasks for consistency.
+    signals, signal handler raised+logged). The default 5-min threshold
+    fits short-lived queues (import/thumbnail/download); queues that
+    legitimately run longer tasks (ml-video, deep scans) get their
+    own larger threshold via QUEUE_STUCK_THRESHOLD_MINUTES so the
+    sweep doesn't preempt them.
+
+    Runs once per distinct threshold value: each pass updates rows
+    whose queue maps to that threshold.
     """
     SessionLocal = _sync_session_factory()
-    cutoff = datetime.now(UTC) - timedelta(minutes=STUCK_THRESHOLD_MINUTES)
-    with SessionLocal() as session:
-        result = session.execute(
+    now = datetime.now(UTC)
+    override_tasks = set(TASK_STUCK_THRESHOLD_MINUTES.keys())
+    override_queues = set(QUEUE_STUCK_THRESHOLD_MINUTES.keys())
+    total = 0
+
+    def _flag(minutes, *extra_where):
+        cutoff = now - timedelta(minutes=minutes)
+        stmt = (
             update(TaskRun)
             .where(TaskRun.status == "running")
             .where(TaskRun.started_at < cutoff)
@@ -140,14 +275,42 @@ def recover_stalled_task_runs() -> int:
                 status="error",
                 error_type="RecoverySweep",
                 error_message=(
-                    f"no completion signal received within "
-                    f"{STUCK_THRESHOLD_MINUTES} min"
+                    f"no completion signal received within {minutes} min"
                 ),
-                finished_at=datetime.now(UTC),
+                finished_at=now,
             )
         )
+        for w in extra_where:
+            stmt = stmt.where(w)
+        return session.execute(stmt).rowcount or 0
+
+    with SessionLocal() as session:
+        # Precedence: task_name override → queue override → default.
+        # Each pass excludes rows claimed by a higher-precedence pass so
+        # every row is touched at most once.
+
+        # 1. Per-task-name overrides (e.g. import_archive_file, which
+        #    shares the 'import' queue with fast single-file imports).
+        for task_name, minutes in TASK_STUCK_THRESHOLD_MINUTES.items():
+            total += _flag(minutes, TaskRun.task_name == task_name)
+
+        # 2. Per-queue overrides, excluding the override task-names.
+        for queue, minutes in QUEUE_STUCK_THRESHOLD_MINUTES.items():
+            wheres = [TaskRun.queue == queue]
+            if override_tasks:
+                wheres.append(TaskRun.task_name.notin_(override_tasks))
+            total += _flag(minutes, *wheres)
+
+        # 3. Default — everything not claimed above.
+        default_wheres = []
+        if override_queues:
+            default_wheres.append(TaskRun.queue.notin_(override_queues))
+        if override_tasks:
+            default_wheres.append(TaskRun.task_name.notin_(override_tasks))
+        total += _flag(STUCK_THRESHOLD_MINUTES, *default_wheres)
+
         session.commit()
-        return result.rowcount or 0
+        return total
 
 
 @celery.task(name="backend.app.tasks.maintenance.prune_task_runs")
@@ -299,6 +462,65 @@ def verify_integrity() -> int:
     return total
 
 
+@celery.task(name="backend.app.tasks.maintenance.recover_stalled_download_events")
+def recover_stalled_download_events() -> int:
+    """Recover DownloadEvent rows stuck pending/running past the worker hard kill.
+
+    The scan tick (scheduler_service.select_due_sources →
+    tasks.scan._tick_due_sources_async) inserts DownloadEvent(status='pending')
+    and fires download_source.delay(). If that task dies before finalizing the
+    event — worker OOM/SIGKILL, lost task, or a gallery-dl that didn't unwind
+    on the 1200s hard time_limit — the event stays in-flight forever. The next
+    tick then skips that source because of the in-flight guard (scan.py:168)
+    and Source.last_checked_at never updates; the operator sees "last check
+    never" in the Subscriptions health column, permanently.
+
+    This sweep flips matching events to 'error', stamps each affected Source's
+    last_checked_at + last_error and bumps consecutive_failures (once per
+    source, not per event — backoff is exponential on that count so an N-event
+    bump would inflate the next interval by 2^N for no reason). The source
+    becomes re-queueable on the next tick and the health dot goes amber.
+
+    Operator-confirmed 2026-05-29 (43-row strand pile in production).
+    """
+    SessionLocal = _sync_session_factory()
+    now = datetime.now(UTC)
+    cutoff = now - timedelta(minutes=DOWNLOAD_STALL_THRESHOLD_MINUTES)
+    msg = "stranded by recovery sweep (no terminal status after time_limit)"
+    with SessionLocal() as session:
+        # UPDATE...RETURNING the source_ids in one round trip — keeps us off
+        # the psycopg 65535-param ceiling that SELECT-then-UPDATE-WHERE-IN
+        # would hit on a large strand pile.
+        result = session.execute(
+            update(DownloadEvent)
+            .where(DownloadEvent.status.in_(["pending", "running"]))
+            .where(DownloadEvent.started_at < cutoff)
+            .values(status="error", finished_at=now, error=msg)
+            .returning(DownloadEvent.source_id)
+        )
+        returned = result.all()
+        if not returned:
+            session.commit()
+            return 0
+        events_recovered = len(returned)
+        source_ids = list({row.source_id for row in returned})
+        session.execute(
+            update(Source)
+            .where(Source.id.in_(source_ids))
+            .values(
+                consecutive_failures=Source.consecutive_failures + 1,
+                last_error=msg,
+                last_checked_at=now,
+            )
+        )
+        session.commit()
+        log.info(
+            "recover_stalled_download_events: recovered %d events across %d sources",
+            events_recovered, len(source_ids),
+        )
+        return events_recovered
+
+
 @celery.task(name="backend.app.tasks.maintenance.cleanup_old_download_events")
 def cleanup_old_download_events() -> int:
     """FC-3d: delete terminal DownloadEvent rows older than the configured
@@ -311,9 +533,7 @@ def cleanup_old_download_events() -> int:
     """
     SessionLocal = _sync_session_factory()
     with SessionLocal() as session:
-        settings = session.execute(
-            select(ImportSettings).where(ImportSettings.id == 1)
-        ).scalar_one()
+        settings = ImportSettings.load_sync(session)
         retention_days = settings.download_event_retention_days
         cutoff = datetime.now(UTC) - timedelta(days=retention_days)
         result = session.execute(

backend/app/tasks/migration.py

@@ -1,175 +0,0 @@
-"""FC-5 run_migration Celery task.
-
-Dispatches to the right migrator based on `kind`. Updates MigrationRun
-row's status/counts/finished_at as it runs. Failures set status='error'
-with the error message preserved.
-
-kinds: gs_ingest, ir_ingest, tag_apply, ml_queue, verify, cleanup
-(backup + rollback retired 2026-05-24 → see /api/system/backup/*)
-"""
-from __future__ import annotations
-
-import asyncio
-import logging
-from datetime import UTC, datetime
-from pathlib import Path
-
-from sqlalchemy import select
-from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
-
-from ..celery_app import celery
-from ..config import get_config
-from ..models import MigrationRun
-from ..services.credential_crypto import CredentialCrypto
-from ..services.migrators import cleanup as cleanup_mod
-from ..services.migrators import gs_ingest, ir_ingest, ml_queue, tag_apply, verify
-
-log = logging.getLogger(__name__)
-
-IMAGES_ROOT = Path("/images")
-_KEY_PATH = IMAGES_ROOT / "secrets" / "credential_key.b64"
-
-
-def _async_session_factory():
-    cfg = get_config()
-    engine = create_async_engine(cfg.database_url, future=True, pool_pre_ping=True)
-    return async_sessionmaker(engine, class_=AsyncSession, expire_on_commit=False), engine
-
-
-async def _update_run(
-    db: AsyncSession, run_id: int, *,
-    status: str | None = None, counts: dict | None = None,
-    error: str | None = None, finished_at: datetime | None = None,
-    metadata_patch: dict | None = None,
-) -> None:
-    run = (await db.execute(
-        select(MigrationRun).where(MigrationRun.id == run_id)
-    )).scalar_one()
-    if status is not None:
-        run.status = status
-    if counts is not None:
-        run.counts = counts
-    if error is not None:
-        run.error = error
-    if finished_at is not None:
-        run.finished_at = finished_at
-    if metadata_patch:
-        run.metadata_ = {**(run.metadata_ or {}), **metadata_patch}
-    await db.commit()
-
-
-async def _run_async(run_id: int, kind: str, params: dict) -> dict:
-    factory, engine = _async_session_factory()
-    try:
-        async with factory() as db:
-            await _update_run(db, run_id, status="running")
-            try:
-                if kind in ("backup", "rollback"):
-                    raise ValueError(
-                        f"kind {kind!r} retired in FC-3h; "
-                        "use /api/system/backup/* instead"
-                    )
-
-                elif kind == "gs_ingest":
-                    fc_crypto = CredentialCrypto(_KEY_PATH)
-                    counts = await gs_ingest.migrate_async(
-                        db, data=params["data"],
-                        fc_crypto=fc_crypto,
-                        dry_run=params.get("dry_run", False),
-                    )
-                    await _update_run(
-                        db, run_id, status="ok", counts=counts,
-                        finished_at=datetime.now(UTC),
-                    )
-                    return counts
-
-                elif kind == "ir_ingest":
-                    counts = await ir_ingest.migrate_async(
-                        db, data=params["data"],
-                        images_root=IMAGES_ROOT,
-                        dry_run=params.get("dry_run", False),
-                    )
-                    await _update_run(
-                        db, run_id, status="ok", counts=counts,
-                        finished_at=datetime.now(UTC),
-                    )
-                    return counts
-
-                elif kind == "tag_apply":
-                    result = await tag_apply.apply_async(
-                        db, images_root=IMAGES_ROOT,
-                        dry_run=params.get("dry_run", False),
-                    )
-                    await _update_run(
-                        db, run_id, status="ok",
-                        counts=result["counts"],
-                        finished_at=datetime.now(UTC),
-                        metadata_patch={"unmatched": result["unmatched"]},
-                    )
-                    return result
-
-                elif kind == "ml_queue":
-                    count = await ml_queue.queue_all_unprocessed_async(db)
-                    await _update_run(
-                        db, run_id, status="ok",
-                        counts={"rows_processed": count, "rows_inserted": 0,
-                                "rows_skipped": 0, "files_copied": 0,
-                                "bytes_copied": 0, "conflicts": 0},
-                        finished_at=datetime.now(UTC),
-                    )
-                    return {"queued": count}
-
-                elif kind == "verify":
-                    checks = await verify.verify_async(db, expected=params.get("expected"))
-                    sample = await verify.verify_sha256_sample(
-                        db, sample_size=params.get("sample_size", 20),
-                    )
-                    await _update_run(
-                        db, run_id, status="ok",
-                        counts={"rows_processed": sample["sample_size"],
-                                "rows_inserted": 0, "rows_skipped": 0,
-                                "files_copied": 0, "bytes_copied": 0,
-                                "conflicts": sample["mismatched"] + sample["missing"]},
-                        finished_at=datetime.now(UTC),
-                        metadata_patch={"checks": checks, "sample": sample},
-                    )
-                    return {"checks": checks, "sample": sample}
-
-                elif kind == "cleanup":
-                    slug = params.get("slug")
-                    if not slug:
-                        raise ValueError("cleanup requires params.slug")
-                    result = await cleanup_mod.cleanup_artist_async(
-                        db, slug=slug, images_root=IMAGES_ROOT,
-                        dry_run=params.get("dry_run", False),
-                        source_path_prefix=params.get("source_path_prefix"),
-                    )
-                    await _update_run(
-                        db, run_id, status="ok",
-                        counts=result["counts"],
-                        finished_at=datetime.now(UTC),
-                        metadata_patch={
-                            "artist": result["artist"],
-                            "summary": result["summary"],
-                        },
-                    )
-                    return result
-
-                else:
-                    raise ValueError(f"unknown kind: {kind}")
-
-            except Exception as exc:
-                log.exception("migration kind=%s failed", kind)
-                await _update_run(
-                    db, run_id, status="error", error=str(exc),
-                    finished_at=datetime.now(UTC),
-                )
-                raise
-    finally:
-        await engine.dispose()
-
-
-@celery.task(name="backend.app.tasks.migration.run_migration", bind=True, acks_late=True)
-def run_migration(self, run_id: int, kind: str, params: dict) -> dict:
-    """FC-5: dispatch a migration kind. Updates MigrationRun row as it goes."""
-    return asyncio.run(_run_async(run_id, kind, params))

backend/app/tasks/ml.py

@@ -31,8 +31,15 @@ def _is_video(path: Path) -> bool:
     retry_backoff_max=60,
     retry_jitter=True,
     max_retries=3,
-    soft_time_limit=300,
-    time_limit=420,
+    # Sized for the video branch: sample 10 frames, run tagger +
+    # embedder on each (≈20 GPU ops vs 2 for an image). A loaded
+    # ml-worker can take 5-10 min on a long video; bumped from
+    # 5min/7min on 2026-05-28 after operator-flagged image 6288 (a
+    # .mp4) hit the recovery sweep at 5 min while still legitimately
+    # processing. Image runs return in seconds; the bump doesn't
+    # affect their UX.
+    soft_time_limit=900,   # 15 min
+    time_limit=1200,       # 20 min hard
 )
 def tag_and_embed(self, image_id: int) -> dict:
     """Run Camie + SigLIP on one image; store predictions + embedding;
@@ -64,6 +71,18 @@ def tag_and_embed(self, image_id: int) -> dict:
         embedder = get_embedder()
 
         if _is_video(src):
+            # Layer-3 isolation: ffprobe (a separate process) validates
+            # the container before we burn ~20 GPU ops sampling frames
+            # from it. A corrupt video that would crash the frame
+            # decoder is rejected cleanly here instead of taking down
+            # the ml-worker. Operator-flagged 2026-05-28.
+            from ..utils import safe_probe
+            vprobe = safe_probe.probe_video(src)
+            if not vprobe.ok:
+                return {
+                    "status": "bad_video", "image_id": image_id,
+                    "reason": vprobe.reason,
+                }
             frames = _sample_video_frames(
                 src, int(os.environ.get("VIDEO_ML_FRAMES", "10"))
             )

backend/app/tasks/scan.py

@@ -12,12 +12,12 @@ from datetime import UTC, datetime
 from pathlib import Path
 
 from sqlalchemy import select
-from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
 
 from ..celery_app import celery
-from ..config import get_config
 from ..models import DownloadEvent, ImportBatch, ImportSettings, ImportTask
-from ..services.scheduler_service import select_due_sources
+from ..services.archive_extractor import is_archive
+from ..services.scheduler_service import record_tick, select_due_sources
+from ._async_session import async_session_factory
 from ._sync_engine import sync_session_factory as _sync_session_factory
 
 
@@ -44,9 +44,7 @@ def scan_directory(self, triggered_by: str = "manual",
     batch id."""
     SessionLocal = _sync_session_factory()
     with SessionLocal() as session:
-        settings = session.execute(
-            select(ImportSettings).where(ImportSettings.id == 1)
-        ).scalar_one()
+        settings = ImportSettings.load_sync(session)
         import_root = Path(settings.import_scan_path)
 
         batch = ImportBatch(
@@ -96,7 +94,9 @@ def scan_directory(self, triggered_by: str = "manual",
             task = ImportTask(
                 batch_id=batch_id,
                 source_path=entry_str,
-                task_type="media",
+                # Archives route to import_archive_file (larger time
+                # budget) — they run the per-member pipeline inline.
+                task_type="archive" if is_archive(entry) else "media",
                 status="pending",
                 size_bytes=size,
             )
@@ -115,15 +115,16 @@ def scan_directory(self, triggered_by: str = "manual",
             batch.finished_at = datetime.now(UTC)
         session.commit()
 
-        # Now enqueue import_media_file for each pending task.
+        # Now enqueue each pending task on the right Celery task
+        # (media vs archive) via the shared router.
+        from .import_file import enqueue_import
+
         for task in session.execute(
             select(ImportTask).where(ImportTask.batch_id == batch_id)
         ).scalars():
             task.status = "queued"
             session.add(task)
-            from .import_file import import_media_file
-
-            import_media_file.delay(task.id)
+            enqueue_import(task.id, task.task_type)
         session.commit()
 
         if mode == "deep":
@@ -137,16 +138,12 @@ def scan_directory(self, triggered_by: str = "manual",
 # --- FC-3d: periodic source-check tick ------------------------------------
 
 
-def _async_session_factory():
-    cfg = get_config()
-    engine = create_async_engine(cfg.database_url, future=True, pool_pre_ping=True)
-    return async_sessionmaker(engine, class_=AsyncSession, expire_on_commit=False), engine
-
-
 async def _tick_due_sources_async() -> dict:
-    factory, engine = _async_session_factory()
+    factory, engine = async_session_factory()
     try:
         async with factory() as session:
+            # Prove the scheduler is alive even on empty ticks (UI reads this).
+            await record_tick(session)
             due = await select_due_sources(session)
             if not due:
                 return {

backend/app/utils/_archive_probe_runner.py

@@ -0,0 +1,33 @@
+"""Subprocess entrypoint for safe_probe.probe_archive — see safe_probe.py.
+
+probe_archive spawns this via subprocess (not multiprocessing.Process)
+because Celery's prefork worker pool runs tasks in DAEMON processes and
+Python's multiprocessing forbids daemon processes from spawning children
+("AssertionError: daemonic processes are not allowed to have children",
+operator-flagged 2026-05-30 — every archive import failed at task
+startup). subprocess has no such restriction; we still get crash-
+isolation because a probe segfault/OOM exits non-zero rather than
+killing the worker.
+
+Prints a single JSON line on stdout: {"status": "ok"|"error",
+"detail": "..."?}. Exit code 0 for clean outcomes; non-zero exit
+(signal / OOM-kill / unhandled exception) is the poison-pill signature
+the parent maps to ProbeResult(crashed=True).
+"""
+import json
+import sys
+
+from .safe_probe import _run_probe
+
+
+def main() -> int:
+    if len(sys.argv) != 2:
+        print(json.dumps({"status": "error", "detail": "usage: <path>"}))
+        return 2
+    status, detail = _run_probe(sys.argv[1])
+    print(json.dumps({"status": status, "detail": detail}))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

backend/app/utils/safe_probe.py

@@ -0,0 +1,191 @@
+"""Subprocess-isolated media probes (Layer 3 of import resilience).
+
+A malformed video or archive can hard-crash the worker process — a
+decoder OOM, a native-lib segfault, or a decompression bomb. A hard
+crash leaves no terminal flip, so the recovery sweep re-queues the row
+and it crashes again: a poison-pill loop (the Layer-1 cap is the
+backstop, but isolating the crash is better — the file gets a clean
+terminal failure and the worker never dies).
+
+These probes run the risky read in a way that contains the blast:
+
+- Video: `ffprobe` is a separate binary, so a crash decoding the
+  container kills only ffprobe (non-zero exit), never the worker. Also
+  returns width/height, which the importer didn't previously capture
+  for videos.
+- Archive: an uncompressed-size guard (catches decompression bombs
+  before they OOM anything) plus an integrity test in a spawned child
+  (catches native-lib crashes on a malformed archive). A child segfault
+  / OOM shows up as a non-zero exit code, not a dead worker.
+
+Images are intentionally NOT probed here: Pillow raises (it doesn't
+segfault) on the realistic corrupt-image cases, the importer already
+catches that as an invalid_image skip, and a subprocess per image would
+wreck deep-scan throughput on a large library. Add an image branch only
+if a real image-induced worker crash is ever observed.
+
+Operator-requested 2026-05-28 (Layer 3).
+"""
+
+import json
+import subprocess
+import sys
+from dataclasses import dataclass
+from pathlib import Path
+
+VIDEO_PROBE_TIMEOUT_SECONDS = 60
+ARCHIVE_PROBE_TIMEOUT_SECONDS = 120
+# Refuse archives whose total UNCOMPRESSED size exceeds this — the
+# classic decompression-bomb guard (a 4 GB cap comfortably clears real
+# art-pack archives while stopping a few-KB zip that expands to TB).
+MAX_ARCHIVE_UNCOMPRESSED_BYTES = 4 * 1024 * 1024 * 1024
+
+# Repo root for the subprocess cwd so `python -m backend.app.utils.*`
+# resolves regardless of where Celery / pytest started. backend/app/utils
+# = parents[0]; backend/app = parents[1]; backend = parents[2]; repo root
+# = parents[3].
+_REPO_ROOT = Path(__file__).resolve().parents[3]
+_PROBE_RUNNER_MODULE = "backend.app.utils._archive_probe_runner"
+
+
+@dataclass(frozen=True)
+class ProbeResult:
+    ok: bool
+    # crashed=True means the probe HARD-FAILED (subprocess killed by a
+    # signal, OOM, or timeout) — the poison-pill signature. crashed=False
+    # with ok=False means a clean rejection (corrupt-but-handled,
+    # bomb-size-exceeded, integrity mismatch). Callers map crashed → a
+    # terminal 'failed', clean → a 'skipped'/'failed' of their choosing.
+    crashed: bool = False
+    reason: str | None = None
+    width: int | None = None
+    height: int | None = None
+
+
+def probe_video(path: Path, *, timeout: float = VIDEO_PROBE_TIMEOUT_SECONDS) -> ProbeResult:
+    """Validate a video container + first video stream via ffprobe."""
+    try:
+        out = subprocess.run(
+            [
+                "ffprobe", "-v", "error",
+                "-select_streams", "v:0",
+                "-show_entries", "stream=width,height",
+                "-of", "json", str(path),
+            ],
+            capture_output=True, text=True, timeout=timeout,
+        )
+    except subprocess.TimeoutExpired:
+        return ProbeResult(ok=False, crashed=True, reason="ffprobe timed out")
+    except OSError as exc:
+        # ffprobe missing / not executable — environmental, not the
+        # file's fault. Treat as a clean non-crash failure so the import
+        # path can decide (it currently proceeds without dims).
+        return ProbeResult(ok=False, crashed=False, reason=f"ffprobe unavailable: {exc}")
+    if out.returncode != 0:
+        return ProbeResult(
+            ok=False, crashed=False,
+            reason=f"ffprobe rejected the file: {out.stderr.strip()[:200]}",
+        )
+    try:
+        streams = (json.loads(out.stdout) or {}).get("streams") or []
+    except json.JSONDecodeError as exc:
+        return ProbeResult(ok=False, crashed=False, reason=f"ffprobe output parse failed: {exc}")
+    if not streams:
+        return ProbeResult(ok=False, crashed=False, reason="no decodable video stream")
+    return ProbeResult(
+        ok=True, width=streams[0].get("width"), height=streams[0].get("height"),
+    )
+
+
+def probe_archive(path: Path, *, timeout: float = ARCHIVE_PROBE_TIMEOUT_SECONDS) -> ProbeResult:
+    """Bomb-size guard + isolated integrity test for an archive.
+
+    Runs via subprocess (not multiprocessing.Process) because Celery's
+    prefork worker pool is daemon-mode and Python's multiprocessing
+    forbids daemon processes from spawning children ("AssertionError:
+    daemonic processes are not allowed to have children"). subprocess
+    has no such restriction and still gives the crash isolation: a probe
+    segfault/OOM exits non-zero rather than killing the worker.
+    """
+    try:
+        result = subprocess.run(
+            [sys.executable, "-m", _PROBE_RUNNER_MODULE, str(path)],
+            capture_output=True, text=True, timeout=timeout,
+            cwd=str(_REPO_ROOT),
+        )
+    except subprocess.TimeoutExpired:
+        return ProbeResult(ok=False, crashed=True, reason="archive probe timed out")
+    if result.returncode != 0:
+        # Negative = killed by signal (segfault); positive = unhandled
+        # exception or OOM-kill. Either way: poison-pill signature.
+        return ProbeResult(
+            ok=False, crashed=True,
+            reason=f"archive probe crashed (exit {result.returncode})",
+        )
+    last_line = result.stdout.strip().splitlines()[-1:] or [""]
+    try:
+        outcome = json.loads(last_line[0])
+    except json.JSONDecodeError as exc:
+        return ProbeResult(
+            ok=False, crashed=True,
+            reason=f"archive probe produced no parseable result: {exc}",
+        )
+    if outcome.get("status") == "ok":
+        return ProbeResult(ok=True)
+    return ProbeResult(
+        ok=False, crashed=False,
+        reason=outcome.get("detail") or "archive probe rejected",
+    )
+
+
+def _run_probe(path_str: str) -> tuple[str, str | None]:
+    """Pure-Python body of the archive probe — bomb-guard + integrity test.
+
+    Returns ('ok', None) or ('error', reason). Caught exceptions become
+    clean 'error' rejections; uncaught crashes in the subprocess become
+    non-zero exit codes (poison-pill signature) handled by probe_archive.
+
+    Exposed at the module level so the subprocess runner and tests both
+    call the same code path.
+    """
+    path = Path(path_str)
+    ext = path.suffix.lower()
+    try:
+        total, test_bad = _inspect_archive(path, ext)
+    except Exception as exc:  # noqa: BLE001 — clean rejection
+        return ("error", f"{type(exc).__name__}: {exc}")
+    if total is not None and total > MAX_ARCHIVE_UNCOMPRESSED_BYTES:
+        gib = total / (1024 ** 3)
+        return ("error", f"uncompressed size {gib:.1f} GiB exceeds the bomb-guard cap")
+    if test_bad is not None:
+        return ("error", f"integrity test failed at member {test_bad!r}")
+    return ("ok", None)
+
+
+def _inspect_archive(path: Path, ext: str):
+    """Return (total_uncompressed_bytes | None, first_bad_member | None)
+    for the archive. Format-specific; raises on a structurally-broken
+    container (caught by the child as a clean rejection)."""
+    if ext in (".zip", ".cbz"):
+        import zipfile
+
+        with zipfile.ZipFile(path) as zf:
+            total = sum(zi.file_size for zi in zf.infolist())
+            return total, zf.testzip()
+    if ext == ".rar":
+        import rarfile
+
+        with rarfile.RarFile(path) as rf:
+            total = sum(getattr(ri, "file_size", 0) for ri in rf.infolist())
+            rf.testrar()
+            return total, None
+    if ext == ".7z":
+        import py7zr
+
+        with py7zr.SevenZipFile(path, "r") as zf:
+            info = zf.archiveinfo()
+            total = getattr(info, "uncompressed", None)
+            ok = zf.test()  # True / None when all members pass
+            return total, (None if ok in (True, None) else "7z test reported corruption")
+    # Unknown extension — nothing to test; treat as clean.
+    return None, None

backend/app/utils/sidecar.py

@@ -1,7 +1,9 @@
 """Minimal gallery-dl sidecar parsing (one-time filesystem-import aid).
 
-No per-platform branching: a small common key set with fallbacks; the
-full JSON is kept in raw so anything unmapped is recoverable later.
+Per-platform quirks (post_url synthesis, key-chain overrides) live in
+the platforms registry — `backend/app/services/platforms/`. This module
+is platform-agnostic: it looks up `category` in the sidecar and asks
+the registry for the right behavior.
 """
 
 import re
@@ -9,6 +11,12 @@ from dataclasses import dataclass
 from datetime import UTC, datetime
 from pathlib import Path
 
+from ..services.platforms import (
+    PLATFORMS,
+    description_keys_for,
+    external_post_id_keys_for,
+)
+
 
 @dataclass(frozen=True)
 class SidecarData:
@@ -55,6 +63,46 @@ def _first_str(data: dict, keys: tuple[str, ...]) -> str | None:
     return None
 
 
+def _first_id(data: dict, keys: tuple[str, ...]) -> str | None:
+    """Like `_first_str` but accepts ints and rejects bool (Python's
+    bool subclasses int, so a literal `"id": true` would otherwise
+    yield external_post_id="True")."""
+    for k in keys:
+        v = data.get(k)
+        if isinstance(v, bool):
+            continue
+        if isinstance(v, (str, int)) and str(v).strip():
+            return str(v).strip()
+    return None
+
+
+# Strip HTML tags + collapse whitespace + take the first non-empty line.
+# Used to derive a display title from a body when the platform doesn't
+# expose a separate title field (subscribestar posts always write
+# `title: ""` and put the leading sentence inside `content` as HTML).
+# Truncated to 120 chars with an ellipsis if longer — long enough to be
+# meaningful in a feed, short enough to fit a row.
+_TAG_RE = re.compile(r"<[^>]+>")
+_WS_RE = re.compile(r"\s+")
+
+
+def _first_line_text(body: str, limit: int = 120) -> str | None:
+    if not body:
+        return None
+    text = _TAG_RE.sub(" ", body)
+    text = text.replace("\xa0", " ")
+    # Split on hard line breaks first; the body-stripped HTML often
+    # collapses to one logical line, in which case the first sentence
+    # split is the next-best heuristic.
+    for line in text.splitlines():
+        line = _WS_RE.sub(" ", line).strip()
+        if line:
+            if len(line) > limit:
+                return line[: limit - 1].rstrip() + "…"
+            return line
+    return None
+
+
 def _parse_date(v) -> datetime | None:
     if isinstance(v, bool):
         return None
@@ -84,14 +132,7 @@ def parse_sidecar(data: dict) -> SidecarData:
     cat = data.get("category")
     platform = cat if isinstance(cat, str) and cat.strip() else None
 
-    external_post_id = None
-    for k in ("id", "post_id", "index", "message_id"):
-        v = data.get(k)
-        if isinstance(v, bool):
-            continue
-        if isinstance(v, (str, int)) and str(v).strip():
-            external_post_id = str(v)
-            break
+    external_post_id = _first_id(data, external_post_id_keys_for(platform))
 
     pc = data.get("page_count")
     if isinstance(pc, bool):
@@ -111,12 +152,32 @@ def parse_sidecar(data: dict) -> SidecarData:
             if post_date is not None:
                 break
 
+    description = _first_str(data, description_keys_for(platform))
+
+    # When `title` is empty (subscribestar always; sometimes elsewhere),
+    # synthesize from the description body's first non-empty text line.
+    # Patreon's explicit titles short-circuit the fallback.
+    post_title = _first_str(data, ("title",))
+    if post_title is None and description:
+        post_title = _first_line_text(description)
+
+    # post_url: ask the platform module to synthesize a permalink.
+    # When the platform registers a `derive_post_url`, it owns the
+    # field (the bare `url`/`post_url` value is a file CDN URL and
+    # must NEVER be persisted). When it doesn't register one, trust
+    # the sidecar's `url` (Patreon's case — real permalink).
+    info = PLATFORMS.get(platform) if platform else None
+    if info is not None and info.derive_post_url is not None:
+        post_url = info.derive_post_url(data)
+    else:
+        post_url = _first_str(data, ("url", "post_url"))
+
     return SidecarData(
         platform=platform,
         external_post_id=external_post_id,
-        post_url=_first_str(data, ("url", "post_url")),
-        post_title=_first_str(data, ("title",)),
-        description=_first_str(data, ("content", "description", "caption")),
+        post_url=post_url,
+        post_title=post_title,
+        description=description,
         attachment_count=attachment_count,
         post_date=post_date,
         raw=data,

extension/lib/cookies.js

@@ -38,11 +38,33 @@ function deduplicateCookies(cookies) {
 function toNetscapeFormat(cookies) {
   const lines = ['# Netscape HTTP Cookie File'];
   for (const c of cookies) {
-    let domain = c.domain.replace(/^\.?www\./, '.');
-    if (!domain.startsWith('.')) domain = '.' + domain;
+    // Preserve the browser's actual scope. Earlier versions rewrote
+    // every cookie to a leading-dot subdomain-wide form, which broke
+    // gallery-dl's HF extractor: its `cookies.get(name,
+    // domain="www.hentai-foundry.com")` does EXACT domain matching and
+    // missed host-only PHPSESSID rewritten to `.hentai-foundry.com`.
+    // Operator-flagged 2026-05-27. Backend `_augment_cookies` covers
+    // the already-stored cookies; this fix is forward-compat for fresh
+    // captures.
+    //
+    // Cookie storage semantics (Firefox):
+    //   c.hostOnly === true   → cookie set without a Domain= attribute;
+    //                           applies to the exact host only.
+    //   c.hostOnly === false  → cookie set with Domain=X; applies to
+    //                           that domain and its subdomains.
+    //
+    // Netscape format:
+    //   leading-dot domain + TRUE flag → subdomain-wide
+    //   bare-host  domain + FALSE flag → host-only
+    const hostOnly = c.hostOnly === true;
+    let domain = c.domain;
+    if (!hostOnly && !domain.startsWith('.')) {
+      domain = '.' + domain;
+    }
+    const subdomainFlag = hostOnly ? 'FALSE' : 'TRUE';
     const secure = c.secure ? 'TRUE' : 'FALSE';
     const expiration = c.expirationDate ? Math.floor(c.expirationDate) : 0;
-    lines.push([domain, 'TRUE', c.path || '/', secure, String(expiration), c.name, c.value].join('\t'));
+    lines.push([domain, subdomainFlag, c.path || '/', secure, String(expiration), c.name, c.value].join('\t'));
   }
   return lines.join('\n');
 }

extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "FabledCurator",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "description": "Export cookies from supported platforms to FabledCurator and add creators as sources in one click.",
 
   "browser_specific_settings": {

extension/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fabledcurator-extension",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "private": true,
   "description": "Firefox extension for FabledCurator",
   "scripts": {

frontend/package.json

@@ -26,6 +26,8 @@
     "vue-tsc": "^2.0.0",
     "vite-plugin-vuetify": "^2.0.0",
     "sass": "^1.71.0",
-    "vitest": "^2.1.0"
+    "vitest": "^2.1.0",
+    "@vue/test-utils": "^2.4.0",
+    "happy-dom": "^15.0.0"
   }
 }

frontend/src/App.vue

@@ -4,7 +4,6 @@
       <RouterView />
     </AppShell>
     <ImageViewer v-if="modal.isOpen" @close="modal.close()" />
-    <PostModal />
     <AppSnackbar ref="snackbar" />
   </v-app>
 </template>
@@ -14,7 +13,6 @@ import { onMounted, ref } from 'vue'
 import AppShell from './components/AppShell.vue'
 import AppSnackbar from './components/AppSnackbar.vue'
 import ImageViewer from './components/modal/ImageViewer.vue'
-import PostModal from './components/posts/PostModal.vue'
 import { useModalStore } from './stores/modal.js'
 
 const modal = useModalStore()

frontend/src/components/PipelineStatusChip.vue

@@ -0,0 +1,146 @@
+<template>
+  <v-menu location="bottom start" :close-on-content-click="false">
+    <template #activator="{ props }">
+      <button
+        v-bind="props" type="button"
+        class="fc-pulse" :class="`fc-pulse--${schedHealth}`"
+        :aria-label="`pipeline: ${running} running, ${queued} queued, ${failing} failing`"
+      >
+        <span class="fc-pulse__dot" />
+        <span v-if="running" class="fc-pulse__stat">
+          <v-icon size="13">mdi-progress-download</v-icon>{{ running }}
+        </span>
+        <span v-if="queued" class="fc-pulse__stat">
+          <v-icon size="13">mdi-tray-full</v-icon>{{ queued }}
+        </span>
+        <span v-if="failing" class="fc-pulse__stat fc-pulse__stat--err">
+          <v-icon size="13">mdi-alert-circle</v-icon>{{ failing }}
+        </span>
+        <span v-if="!running && !queued && !failing" class="fc-pulse__idle">idle</span>
+      </button>
+    </template>
+
+    <v-card min-width="300" class="fc-pulse__panel pa-3">
+      <div class="fc-pulse__row">
+        <span class="fc-pulse__rowdot" :class="`fc-pulse--${schedHealth}`" />
+        <strong>Scheduler</strong>
+        <v-spacer />
+        <span class="fc-pulse__muted">{{ schedLabel }}</span>
+      </div>
+
+      <div class="fc-pulse__sec">
+        <div class="fc-pulse__sechead">Queues</div>
+        <div v-if="busyQueues.length === 0" class="fc-pulse__muted">All idle</div>
+        <div v-for="q in busyQueues" :key="q.name" class="fc-pulse__qrow">
+          <span>{{ q.name }}</span><v-spacer /><strong>{{ q.depth }}</strong>
+        </div>
+      </div>
+
+      <div class="fc-pulse__sec fc-pulse__grid">
+        <div><span class="fc-pulse__muted">Running</span><div class="fc-pulse__big">{{ running }}</div></div>
+        <div><span class="fc-pulse__muted">Queued</span><div class="fc-pulse__big">{{ queued }}</div></div>
+        <div>
+          <span class="fc-pulse__muted">Failures 24h</span>
+          <div class="fc-pulse__big" :class="{ 'fc-pulse__big--err': failing }">{{ failing }}</div>
+        </div>
+      </div>
+
+      <RouterLink
+        class="fc-pulse__link"
+        :to="{ path: '/subscriptions', query: { tab: 'downloads' } }"
+      >Open downloads →</RouterLink>
+    </v-card>
+  </v-menu>
+</template>
+
+<script setup>
+import { computed, onMounted, onUnmounted } from 'vue'
+
+import { useSystemActivityStore } from '../stores/systemActivity.js'
+import { formatRelative } from '../utils/date.js'
+
+const store = useSystemActivityStore()
+
+// Beat ticks every 60s; flag the scheduler stale past ~3 min.
+const STALE_MS = 180_000
+const summary = computed(() => store.summary)
+const running = computed(() => summary.value?.running ?? 0)
+const queued = computed(() => summary.value?.queued_total ?? 0)
+const failing = computed(() => summary.value?.failing ?? 0)
+
+const schedHealth = computed(() => {
+  const t = summary.value?.scheduler?.last_tick_at
+  if (!t) return 'unknown'
+  return (Date.now() - new Date(t).getTime()) <= STALE_MS ? 'ok' : 'stale'
+})
+const schedLabel = computed(() => {
+  const s = summary.value?.scheduler
+  if (!s) return '—'
+  const ran = formatRelative(s.last_tick_at, { nullText: 'never' })
+  if (s.due_now > 0) return `ran ${ran} · ${s.due_now} due`
+  return `ran ${ran}`
+})
+const busyQueues = computed(() => {
+  const q = summary.value?.queues || {}
+  return Object.entries(q)
+    .filter(([, depth]) => typeof depth === 'number' && depth > 0)
+    .map(([name, depth]) => ({ name, depth }))
+})
+
+const POLL_MS = 8000
+let timer = null
+onMounted(() => {
+  store.loadSummary()
+  timer = setInterval(() => {
+    if (!document.hidden) store.loadSummary()
+  }, POLL_MS)
+})
+onUnmounted(() => { if (timer) clearInterval(timer) })
+</script>
+
+<style scoped>
+.fc-pulse {
+  display: inline-flex; align-items: center; gap: 6px;
+  padding: 3px 8px; border-radius: 999px;
+  background: rgb(var(--v-theme-on-surface) / 0.08);
+  color: rgb(var(--v-theme-on-surface));
+  font-size: 0.78rem; font-variant-numeric: tabular-nums;
+  cursor: pointer; border: 0;
+}
+.fc-pulse:hover { background: rgb(var(--v-theme-on-surface) / 0.16); }
+.fc-pulse__dot {
+  width: 8px; height: 8px; border-radius: 50%; flex: 0 0 auto;
+  background: rgb(var(--v-theme-on-surface-variant));
+}
+.fc-pulse--ok .fc-pulse__dot,
+.fc-pulse--ok.fc-pulse__rowdot { background: rgb(var(--v-theme-success)); }
+.fc-pulse--stale .fc-pulse__dot,
+.fc-pulse--stale.fc-pulse__rowdot { background: rgb(var(--v-theme-error)); }
+.fc-pulse__stat { display: inline-flex; align-items: center; gap: 2px; }
+.fc-pulse__stat--err { color: rgb(var(--v-theme-error)); }
+.fc-pulse__idle {
+  text-transform: uppercase; letter-spacing: 0.06em;
+  color: rgb(var(--v-theme-on-surface-variant)); font-size: 0.68rem;
+}
+
+.fc-pulse__panel { background: rgb(var(--v-theme-surface)); }
+.fc-pulse__row { display: flex; align-items: center; gap: 8px; }
+.fc-pulse__rowdot {
+  width: 9px; height: 9px; border-radius: 50%;
+  background: rgb(var(--v-theme-on-surface-variant));
+}
+.fc-pulse__muted { color: rgb(var(--v-theme-on-surface-variant)); font-size: 0.8rem; }
+.fc-pulse__sec { margin-top: 12px; }
+.fc-pulse__sechead {
+  font-size: 0.72rem; text-transform: uppercase; letter-spacing: 0.05em;
+  color: rgb(var(--v-theme-on-surface-variant)); margin-bottom: 4px;
+}
+.fc-pulse__qrow { display: flex; align-items: center; font-size: 0.85rem; padding: 2px 0; }
+.fc-pulse__grid { display: flex; gap: 16px; }
+.fc-pulse__big { font-size: 1.3rem; font-weight: 700; font-variant-numeric: tabular-nums; }
+.fc-pulse__big--err { color: rgb(var(--v-theme-error)); }
+.fc-pulse__link {
+  display: inline-block; margin-top: 14px;
+  color: rgb(var(--v-theme-accent)); text-decoration: none; font-size: 0.85rem;
+}
+</style>

frontend/src/components/TopNav.vue

@@ -8,6 +8,7 @@
       <span class="fc-health" :title="health.label">
         <v-icon size="x-small" :color="health.color">{{ health.icon }}</v-icon>
       </span>
+      <PipelineStatusChip />
     </div>
 
     <nav class="fc-links">
@@ -29,6 +30,7 @@
 import { computed, onMounted } from 'vue'
 import router, { FRONT_DOOR } from '../router.js'
 import { useSystemStore } from '../stores/system.js'
+import PipelineStatusChip from './PipelineStatusChip.vue'
 
 const system = useSystemStore()
 onMounted(() => system.refreshHealth())

frontend/src/components/artist/ArtistHeader.vue

@@ -35,6 +35,7 @@
 
 <script setup>
 import { computed } from 'vue'
+import { formatLocalDate } from '../../utils/date.js'
 
 const props = defineProps({
   name:        { type: String, required: true },
@@ -52,7 +53,7 @@ const stats = computed(() => {
     parts.push(`${props.imageCount} image${props.imageCount === 1 ? '' : 's'}`)
   }
   if (props.lastAdded) {
-    parts.push(`last added ${props.lastAdded.slice(0, 10)}`)
+    parts.push(`last added ${formatLocalDate(props.lastAdded)}`)
   }
   return parts.join(' · ')
 })

frontend/src/components/artist/ArtistPostsTab.vue

@@ -28,10 +28,11 @@
 </template>
 
 <script setup>
-import { onMounted, onUnmounted, ref, watch } from 'vue'
+import { onMounted, ref, watch } from 'vue'
 import { RouterLink } from 'vue-router'
 
 import { usePostsStore } from '../../stores/posts.js'
+import { useInfiniteScroll } from '../../composables/useInfiniteScroll.js'
 import PostCard from '../posts/PostCard.vue'
 
 const props = defineProps({
@@ -42,7 +43,6 @@ defineEmits(['switch-tab'])
 
 const store = usePostsStore()
 const sentinel = ref(null)
-let observer = null
 
 async function reload () {
   await store.loadInitial({ artist_id: props.artistId, platform: null })
@@ -50,19 +50,9 @@ async function reload () {
 
 watch(() => props.artistId, reload)
 
-onMounted(async () => {
-  await reload()
-  observer = new IntersectionObserver((entries) => {
-    if (entries.some(e => e.isIntersecting)) {
-      store.loadMore()
-    }
-  }, { rootMargin: '400px 0px' })
-  if (sentinel.value) observer.observe(sentinel.value)
-})
+useInfiniteScroll(sentinel, () => store.loadMore(), { rootMargin: '400px 0px' })
 
-onUnmounted(() => {
-  if (observer) observer.disconnect()
-})
+onMounted(reload)
 </script>
 
 <style scoped>

frontend/src/components/cleanup/MinDimensionCard.vue

@@ -52,8 +52,8 @@
       v-model="showModal"
       action="delete"
       kind="min-dim"
-      :run-id="tokenSha8"
       tier="C"
+      :expected-token-override="preview?.confirm_token || ''"
       :projected-counts="projectedCounts"
       :description="`Width < ${minW} OR height < ${minH}`"
       @confirm="onConfirmedDelete"
@@ -62,18 +62,26 @@
 </template>
 
 <script setup>
+import { toast } from '../../utils/toast.js'
 import { onMounted, ref } from 'vue'
 
 import DestructiveConfirmModal from '../modal/DestructiveConfirmModal.vue'
 import { useCleanupStore } from '../../stores/cleanup.js'
 
+// Backend's preview response hands the full Tier-C confirm token back
+// as `confirm_token` (e.g. `delete-min-dim-1a2b3c4d`); passed straight
+// to the modal via `expected-token-override`. We previously
+// reconstructed via Web Crypto's SHA-256, but `crypto.subtle` is
+// Secure-Context-gated and undefined on plain-HTTP origins, so the
+// Delete button silently swallowed the TypeError. Operator-flagged
+// 2026-05-27.
+
 const store = useCleanupStore()
 const minW = ref(0)
 const minH = ref(0)
 const preview = ref(null)
 const busy = ref(false)
 const showModal = ref(false)
-const tokenSha8 = ref('')
 const projectedCounts = ref({})
 
 onMounted(async () => {
@@ -82,28 +90,18 @@ onMounted(async () => {
   minH.value = store.defaults.min_height
 })
 
-// SHA-256 truncated to 8 hex chars — matches the backend's
-// _min_dim_token() exactly. Web Crypto rejects MD5 as insecure.
-async function sha8(canon) {
-  const enc = new TextEncoder()
-  const buf = await crypto.subtle.digest('SHA-256', enc.encode(canon))
-  const hex = Array.from(new Uint8Array(buf)).map(b => b.toString(16).padStart(2, '0')).join('')
-  return hex.slice(0, 8)
-}
-
 async function onPreview() {
   busy.value = true
   try {
     preview.value = await store.previewMinDim(minW.value, minH.value)
   } catch (e) {
-    window.__fcToast?.({ text: `Preview failed: ${e.message}`, type: 'error' })
+    toast({ text: `Preview failed: ${e.message}`, type: 'error' })
   } finally {
     busy.value = false
   }
 }
 
-async function onDeleteClick() {
-  tokenSha8.value = await sha8(`${minW.value}x${minH.value}`)
+function onDeleteClick() {
   projectedCounts.value = { 'Images to delete': preview.value.count }
   showModal.value = true
 }
@@ -111,12 +109,12 @@ async function onDeleteClick() {
 async function onConfirmedDelete(token) {
   try {
     const res = await store.deleteMinDim(minW.value, minH.value, token)
-    window.__fcToast?.({
+    toast({
       text: `Deleted ${res.deleted} image(s)`, type: 'success',
     })
     preview.value = null
   } catch (e) {
-    window.__fcToast?.({ text: `Delete failed: ${e.message}`, type: 'error' })
+    toast({ text: `Delete failed: ${e.message}`, type: 'error' })
   }
 }
 </script>

frontend/src/components/cleanup/SingleColorAuditCard.vue

@@ -93,6 +93,7 @@
 </template>
 
 <script setup>
+import { toast } from '../../utils/toast.js'
 import { onMounted, onUnmounted, ref } from 'vue'
 
 import DestructiveConfirmModal from '../modal/DestructiveConfirmModal.vue'
@@ -124,7 +125,7 @@ function startPoll(id) {
       if (fresh.status !== 'running') stopPoll()
     } catch (e) {
       stopPoll()
-      window.__fcToast?.({ text: `Audit poll failed: ${e.message}`, type: 'error' })
+      toast({ text: `Audit poll failed: ${e.message}`, type: 'error' })
     }
   }, 5000)
 }
@@ -142,7 +143,7 @@ async function onStart() {
     audit.value = await store.getAudit(res.audit_id)
     startPoll(res.audit_id)
   } catch (e) {
-    window.__fcToast?.({ text: `Scan start failed: ${e.message}`, type: 'error' })
+    toast({ text: `Scan start failed: ${e.message}`, type: 'error' })
   } finally {
     busy.value = false
   }
@@ -155,7 +156,7 @@ async function onCancel() {
     audit.value = await store.getAudit(audit.value.id)
     stopPoll()
   } catch (e) {
-    window.__fcToast?.({ text: `Cancel failed: ${e.message}`, type: 'error' })
+    toast({ text: `Cancel failed: ${e.message}`, type: 'error' })
   }
 }
 
@@ -167,12 +168,12 @@ function onApplyClick() {
 async function onConfirmedApply(token) {
   try {
     const res = await store.applyAudit(audit.value.id, token)
-    window.__fcToast?.({
+    toast({
       text: `Deleted ${res.deleted} image(s)`, type: 'success',
     })
     audit.value = await store.getAudit(audit.value.id)
   } catch (e) {
-    window.__fcToast?.({ text: `Apply failed: ${e.message}`, type: 'error' })
+    toast({ text: `Apply failed: ${e.message}`, type: 'error' })
   }
 }
 </script>

frontend/src/components/cleanup/TransparencyAuditCard.vue

@@ -80,6 +80,7 @@
 </template>
 
 <script setup>
+import { toast } from '../../utils/toast.js'
 import { onMounted, onUnmounted, ref } from 'vue'
 
 import DestructiveConfirmModal from '../modal/DestructiveConfirmModal.vue'
@@ -109,7 +110,7 @@ function startPoll(id) {
       if (fresh.status !== 'running') stopPoll()
     } catch (e) {
       stopPoll()
-      window.__fcToast?.({ text: `Audit poll failed: ${e.message}`, type: 'error' })
+      toast({ text: `Audit poll failed: ${e.message}`, type: 'error' })
     }
   }, 5000)
 }
@@ -125,7 +126,7 @@ async function onStart() {
     audit.value = await store.getAudit(res.audit_id)
     startPoll(res.audit_id)
   } catch (e) {
-    window.__fcToast?.({ text: `Scan start failed: ${e.message}`, type: 'error' })
+    toast({ text: `Scan start failed: ${e.message}`, type: 'error' })
   } finally {
     busy.value = false
   }
@@ -138,7 +139,7 @@ async function onCancel() {
     audit.value = await store.getAudit(audit.value.id)
     stopPoll()
   } catch (e) {
-    window.__fcToast?.({ text: `Cancel failed: ${e.message}`, type: 'error' })
+    toast({ text: `Cancel failed: ${e.message}`, type: 'error' })
   }
 }
 
@@ -150,12 +151,12 @@ function onApplyClick() {
 async function onConfirmedApply(token) {
   try {
     const res = await store.applyAudit(audit.value.id, token)
-    window.__fcToast?.({
+    toast({
       text: `Deleted ${res.deleted} image(s)`, type: 'success',
     })
     audit.value = await store.getAudit(audit.value.id)
   } catch (e) {
-    window.__fcToast?.({ text: `Apply failed: ${e.message}`, type: 'error' })
+    toast({ text: `Apply failed: ${e.message}`, type: 'error' })
   }
 }
 </script>

frontend/src/components/common/ErrorDetailModal.vue

@@ -33,6 +33,7 @@
 </template>
 
 <script setup>
+import { toast } from '../../utils/toast.js'
 import { computed, ref, watch } from 'vue'
 
 import { copyText } from '../../utils/clipboard.js'
@@ -119,7 +120,7 @@ async function onCopy () {
     if (copiedTimer) clearTimeout(copiedTimer)
     copiedTimer = setTimeout(() => { copied.value = false }, 1500)
   } catch (e) {
-    window.__fcToast?.({ text: `Copy failed: ${e.message}`, type: 'error' })
+    toast({ text: `Copy failed: ${e.message}`, type: 'error' })
   }
 }
 </script>

frontend/src/components/credentials/ExtensionKeyBar.vue

@@ -26,6 +26,7 @@
 </template>
 
 <script setup>
+import { toast } from '../../utils/toast.js'
 import { onMounted, ref } from 'vue'
 import { useCredentialsStore } from '../../stores/credentials.js'
 import { copyText } from '../../utils/clipboard.js'
@@ -39,9 +40,9 @@ async function copyKey() {
   if (!store.extensionKey) return
   try {
     await copyText(store.extensionKey)
-    globalThis.window?.__fcToast?.({ text: 'Copied', type: 'success' })
+    toast({ text: 'Copied', type: 'success' })
   } catch {
-    globalThis.window?.__fcToast?.({ text: 'Copy failed', type: 'error' })
+    toast({ text: 'Copy failed', type: 'error' })
   }
 }
 
@@ -50,7 +51,7 @@ function confirmRotate() { showRotateConfirm.value = true }
 async function doRotate() {
   showRotateConfirm.value = false
   await store.rotateKey()
-  globalThis.window?.__fcToast?.({ text: 'Key rotated', type: 'success' })
+  toast({ text: 'Key rotated', type: 'success' })
 }
 </script>
 

frontend/src/components/credentials/PlatformCredentialRow.vue

@@ -32,6 +32,8 @@
 </template>
 
 <script setup>
+import { formatLocalDate } from '../../utils/date.js'
+
 defineProps({
   platform: { type: Object, required: true },
   credential: { type: Object, default: null },
@@ -39,8 +41,7 @@ defineProps({
 defineEmits(['replace', 'remove'])
 
 function fmtDate(iso) {
-  if (!iso) return '—'
-  return iso.slice(0, 10)
+  return iso ? formatLocalDate(iso) : '—'
 }
 </script>
 

frontend/src/components/discovery/MasonryGrid.vue

@@ -4,7 +4,10 @@
       <div v-for="(col, ci) in columns" :key="ci" class="fc-masonry__col">
         <button
           v-for="item in col" :key="item.id"
-          class="fc-masonry__item" type="button"
+          class="fc-masonry__item"
+          :class="{ 'fc-masonry__item--anim': shouldAnimate(item) }"
+          :style="itemStyle(item)"
+          type="button"
           @click="$emit('open', item.id)"
         >
           <img
@@ -27,13 +30,20 @@
 </template>
 
 <script setup>
-import { ref, computed, onMounted, onUnmounted, watch } from 'vue'
+import { ref, computed } from 'vue'
 import { usePolyMasonry } from '../../composables/usePolyMasonry.js'
+import { useInfiniteScroll } from '../../composables/useInfiniteScroll.js'
 
 const props = defineProps({
   items: { type: Array, default: () => [] },
   loading: { type: Boolean, default: false },
-  hasMore: { type: Boolean, default: false }
+  hasMore: { type: Boolean, default: false },
+  // Items at indices >= animateFromIndex get the stagger fade-in. Opt-in
+  // — defaults to Infinity (no animation) so views that don't want it
+  // (ArtistView, etc.) don't pay the layout-shift cost. ShowcaseView
+  // uses 0 on initial load / shuffle and prevCount on infinite-scroll
+  // appends.
+  animateFromIndex: { type: Number, default: Number.POSITIVE_INFINITY },
 })
 const emit = defineEmits(['load-more', 'open'])
 
@@ -43,6 +53,25 @@ const { columnCount, distribute } = usePolyMasonry(containerEl)
 
 const columns = computed(() => distribute(props.items, columnCount.value))
 
+// id → index lookup so we can derive the stagger from natural reading
+// order even after the masonry distributes items across columns.
+const idxById = computed(() => {
+  const m = new Map()
+  props.items.forEach((it, i) => m.set(it.id, i))
+  return m
+})
+
+function shouldAnimate(item) {
+  const idx = idxById.value.get(item.id)
+  return idx !== undefined && idx >= props.animateFromIndex
+}
+
+function itemStyle(item) {
+  if (!shouldAnimate(item)) return {}
+  const idx = idxById.value.get(item.id) - props.animateFromIndex
+  return { '--stagger-index': idx }
+}
+
 function aspectStyle(item) {
   const w = Number(item.width)
   const h = Number(item.height)
@@ -50,20 +79,18 @@ function aspectStyle(item) {
   return { aspectRatio: `${w} / ${h}` }
 }
 
-let observer = null
-function attachObserver() {
-  if (observer) observer.disconnect()
-  if (!sentinelEl.value) return
-  observer = new IntersectionObserver(([entry]) => {
-    if (entry.isIntersecting && props.hasMore && !props.loading) {
-      emit('load-more')
-    }
-  }, { rootMargin: '600px' })
-  observer.observe(sentinelEl.value)
-}
-watch(sentinelEl, attachObserver)
-onMounted(attachObserver)
-onUnmounted(() => observer && observer.disconnect())
+// Larger rootMargin than the composable default (600px) because the
+// sentinel sits at the BOTTOM of the masonry container, whose height is
+// the MAX of the column heights. A single tall image (long manga page,
+// panorama) in one column pushes the sentinel way past the visible
+// bottom of the SHORTER columns — the user reads the short-column
+// bottoms long before the sentinel comes into view, and load-more
+// fires too late. 2400px ≈ 2-3 screen-heights of pre-emptive trigger,
+// comfortably covering typical tall-image heights. Operator-flagged
+// 2026-05-30.
+useInfiniteScroll(sentinelEl, () => {
+  if (props.hasMore && !props.loading) emit('load-more')
+}, { rootMargin: '2400px' })
 </script>
 
 <style scoped>
@@ -72,13 +99,54 @@ onUnmounted(() => observer && observer.disconnect())
 .fc-masonry__item {
   display: block; padding: 0; border: 0; background: none;
   cursor: pointer; width: 100%;
+  overflow: hidden; border-radius: 4px;
 }
 .fc-masonry__item img {
-  width: 100%; height: auto; display: block; border-radius: 4px;
+  width: 100%; height: auto; display: block;
   background: rgb(var(--v-theme-surface-light));
+  /* IR-parity hover: zoom + brighten the thumbnail (style.css ~1772). */
+  transition: transform 0.3s ease, filter 0.3s ease;
+}
+.fc-masonry__item:hover img {
+  transform: scale(1.03);
+  filter: brightness(1.1);
 }
 .fc-masonry__sentinel {
   display: flex; justify-content: center; padding: 32px 0; min-height: 60px;
 }
 .fc-masonry__end { text-align: center; padding: 32px 0; }
+
+/* Cascade entry: each tile flips up out of a backward tilt and settles
+   into place, one at a time — more pronounced than a plain fade so the
+   showcase reads as an "experience" (operator-flagged 2026-05-28). The
+   `both` fill holds the hidden/tilted 0% state until each tile's staggered
+   turn; the cubic-bezier overshoots slightly past flat then settles.
+   Honors prefers-reduced-motion. Tunables: tilt (-28deg), stagger (70ms),
+   duration (0.6s). */
+@keyframes fc-masonry-item-in {
+  0% {
+    opacity: 0;
+    transform: perspective(1000px) rotateX(-28deg) translateY(26px) scale(0.95);
+  }
+  55% { opacity: 1; }
+  100% {
+    opacity: 1;
+    transform: perspective(1000px) rotateX(0deg) translateY(0) scale(1);
+  }
+}
+.fc-masonry__item--anim {
+  transform-origin: center top;
+  backface-visibility: hidden;
+  animation: fc-masonry-item-in 0.6s cubic-bezier(0.34, 1.45, 0.64, 1) both;
+  animation-delay: calc(var(--stagger-index, 0) * 70ms);
+}
+@media (prefers-reduced-motion: reduce) {
+  .fc-masonry__item--anim {
+    animation: none;
+    opacity: 1;
+    transform: none;
+  }
+  .fc-masonry__item img { transition: none; }
+  .fc-masonry__item:hover img { transform: none; }
+}
 </style>

frontend/src/components/downloads/DownloadDetailModal.vue

@@ -7,7 +7,7 @@
       </v-card-title>
       <v-card-text>
         <p class="text-caption" style="opacity: 0.75">
-          {{ event.started_at }} → {{ event.finished_at || '(running)' }}
+          {{ formatDateTime(event.started_at) }} → {{ event.finished_at ? formatDateTime(event.finished_at) : '(running)' }}
           ({{ fmtDuration(event.summary?.duration_seconds) }})
         </p>
 
@@ -35,20 +35,53 @@
           </ul>
         </template>
 
+        <template v-if="event.error">
+          <div class="fc-dl-blockhead mt-4">
+            <h3 class="text-subtitle-2">Error</h3>
+            <v-btn
+              size="x-small" variant="text" prepend-icon="mdi-content-copy"
+              @click="onCopy('Error', event.error)"
+            >Copy</v-btn>
+          </div>
+          <pre class="fc-dl-pre">{{ event.error }}</pre>
+        </template>
+
         <template v-if="errorsWarnings">
-          <h3 class="text-subtitle-2 mt-4">Errors &amp; warnings</h3>
+          <div class="fc-dl-blockhead mt-4">
+            <h3 class="text-subtitle-2">Errors &amp; warnings</h3>
+            <v-btn
+              size="x-small" variant="text" prepend-icon="mdi-content-copy"
+              @click="onCopy('Errors & warnings', errorsWarnings)"
+            >Copy</v-btn>
+          </div>
           <pre class="fc-dl-pre">{{ errorsWarnings }}</pre>
         </template>
 
         <v-expansion-panels class="mt-4">
           <v-expansion-panel>
-            <v-expansion-panel-title>Raw stdout</v-expansion-panel-title>
+            <v-expansion-panel-title>
+              <span>Raw stdout</span>
+              <v-spacer />
+              <v-btn
+                size="x-small" variant="text" prepend-icon="mdi-content-copy"
+                class="me-2"
+                @click.stop="onCopy('stdout', event.metadata?.stdout || '')"
+              >Copy</v-btn>
+            </v-expansion-panel-title>
             <v-expansion-panel-text>
               <pre class="fc-dl-pre">{{ event.metadata?.stdout || '(empty)' }}</pre>
             </v-expansion-panel-text>
           </v-expansion-panel>
           <v-expansion-panel>
-            <v-expansion-panel-title>Raw stderr</v-expansion-panel-title>
+            <v-expansion-panel-title>
+              <span>Raw stderr</span>
+              <v-spacer />
+              <v-btn
+                size="x-small" variant="text" prepend-icon="mdi-content-copy"
+                class="me-2"
+                @click.stop="onCopy('stderr', event.metadata?.stderr || '')"
+              >Copy</v-btn>
+            </v-expansion-panel-title>
             <v-expansion-panel-text>
               <pre class="fc-dl-pre">{{ event.metadata?.stderr || '(empty)' }}</pre>
             </v-expansion-panel-text>
@@ -56,6 +89,10 @@
         </v-expansion-panels>
       </v-card-text>
       <v-card-actions>
+        <v-btn
+          variant="text" prepend-icon="mdi-content-copy"
+          @click="onCopy('All diagnostics', allDiagnostics)"
+        >Copy all diagnostics</v-btn>
         <v-spacer />
         <v-btn variant="text" @click="onClose(false)">Close</v-btn>
       </v-card-actions>
@@ -64,8 +101,12 @@
 </template>
 
 <script setup>
+import { toast } from '../../utils/toast.js'
 import { computed } from 'vue'
 
+import { copyText } from '../../utils/clipboard.js'
+import { formatDateTime } from '../../utils/date.js'
+
 const props = defineProps({ event: { type: Object, default: null } })
 const emit = defineEmits(['close'])
 
@@ -74,6 +115,32 @@ const summary = computed(() => props.event?.metadata?.import_summary || {})
 const quarantinedPaths = computed(() => props.event?.metadata?.quarantined_paths || [])
 const errorsWarnings = computed(() => props.event?.metadata?.stderr_errors_warnings || '')
 
+// One combined block for "research the issue elsewhere" — header line +
+// error + full stdout/stderr. Built lazily from the current event.
+const allDiagnostics = computed(() => {
+  const e = props.event
+  if (!e) return ''
+  const md = e.metadata || {}
+  return [
+    `event #${e.id} · ${e.platform || '—'} · ${e.artist_name || '—'}`,
+    `status: ${e.status}`,
+    `started: ${e.started_at}  finished: ${e.finished_at || '(running)'}`,
+    e.error ? `\n--- error ---\n${e.error}` : '',
+    errorsWarnings.value ? `\n--- errors & warnings ---\n${errorsWarnings.value}` : '',
+    `\n--- stdout ---\n${md.stdout || '(empty)'}`,
+    `\n--- stderr ---\n${md.stderr || '(empty)'}`,
+  ].filter(Boolean).join('\n')
+})
+
+async function onCopy(label, text) {
+  try {
+    await copyText(text || '')
+    toast({ text: `${label} copied`, type: 'success' })
+  } catch (e) {
+    toast({ text: `Copy failed: ${e.message}`, type: 'error' })
+  }
+}
+
 const statusColor = computed(() => ({
   ok: 'success', error: 'error', running: 'info',
   pending: 'secondary', skipped: 'warning',
@@ -114,4 +181,8 @@ function onClose() {
   word-break: break-all;
 }
 .fc-dl-quar { padding-left: 1.5rem; font-size: 0.85rem; }
+.fc-dl-blockhead {
+  display: flex; align-items: center; justify-content: space-between;
+  gap: 0.5rem;
+}
 </style>

frontend/src/components/downloads/DownloadEventRow.vue

@@ -1,47 +1,112 @@
 <template>
-  <div class="fc-dl-row" @click="$emit('open', event.id)">
-    <v-icon :icon="statusIcon" :color="statusColor" size="small" />
+  <div
+    class="fc-dl-row"
+    :class="[`fc-dl-row--${event.status || 'unknown'}`]"
+    @click="$emit('open', event.id)"
+  >
+    <!-- Colored left edge marks the run's status; matches the row's
+         status-chip color but reads at a glance without needing to
+         parse the chip text. -->
+    <div class="fc-dl-row__bar" />
+
+    <v-chip
+      :color="statusColor"
+      size="small"
+      variant="tonal"
+      :prepend-icon="statusIcon"
+      class="fc-dl-row__status"
+    >{{ statusLabel }}</v-chip>
+
     <RouterLink
       v-if="event.artist_slug"
       :to="`/artist/${event.artist_slug}`"
       class="fc-dl-row__artist"
       @click.stop
     >{{ event.artist_name }}</RouterLink>
-    <span v-else class="fc-dl-row__artist">—</span>
-    <v-chip size="x-small" variant="tonal">{{ event.platform || '—' }}</v-chip>
-    <span class="fc-dl-row__time">{{ fmtTime(event.started_at) }}</span>
-    <span class="fc-dl-row__files">{{ event.files_count }} files</span>
-    <span class="fc-dl-row__duration">{{ fmtDuration(event.summary?.duration_seconds) }}</span>
-    <span v-if="event.error" class="fc-dl-row__error">{{ event.error }}</span>
+    <span v-else class="fc-dl-row__artist fc-dl-row__artist--missing">—</span>
+
+    <PlatformChip
+      v-if="event.platform"
+      :platform="event.platform"
+      size="x-small"
+      class="fc-dl-row__platform"
+    />
+    <span v-else class="fc-dl-row__platform-missing">—</span>
+
+    <span class="fc-dl-row__time" :title="event.started_at">
+      {{ fmtTime(event.started_at) }}
+    </span>
+
+    <v-chip
+      v-if="event.files_count > 0"
+      size="x-small" variant="tonal" color="info"
+      prepend-icon="mdi-image-multiple"
+      class="fc-dl-row__files"
+    >{{ event.files_count }}</v-chip>
+    <span v-else class="fc-dl-row__no-files" aria-label="no new files">·</span>
+
+    <span class="fc-dl-row__duration">
+      {{ fmtDuration(event.summary?.duration_seconds) }}
+    </span>
+
+    <v-chip
+      v-if="event.error"
+      color="error" size="x-small" variant="tonal"
+      prepend-icon="mdi-alert-octagon"
+      class="fc-dl-row__error"
+      :title="event.error"
+    >{{ truncateError(event.error) }}</v-chip>
+    <span v-else class="fc-dl-row__error-spacer" />
+
+    <div class="fc-dl-row__actions" @click.stop>
+      <v-btn
+        v-if="event.status === 'error' && event.source_id"
+        icon size="x-small" variant="text" color="warning"
+        :loading="retrying"
+        @click.stop="onRetry"
+      >
+        <v-icon size="small">mdi-refresh</v-icon>
+        <v-tooltip activator="parent" location="top">Retry source check</v-tooltip>
+      </v-btn>
+      <v-btn icon size="x-small" variant="text" @click.stop="$emit('open', event.id)">
+        <v-icon size="small">mdi-information-outline</v-icon>
+        <v-tooltip activator="parent" location="top">Details</v-tooltip>
+      </v-btn>
+      <v-btn
+        v-if="event.artist_slug"
+        icon size="x-small" variant="text"
+        :to="`/artist/${event.artist_slug}`"
+        @click.stop
+      >
+        <v-icon size="small">mdi-account-circle</v-icon>
+        <v-tooltip activator="parent" location="top">Open artist</v-tooltip>
+      </v-btn>
+    </div>
   </div>
 </template>
 
 <script setup>
-import { computed } from 'vue'
+import { toast } from '../../utils/toast.js'
+import { computed, ref } from 'vue'
 import { RouterLink } from 'vue-router'
 
+import PlatformChip from '../subscriptions/PlatformChip.vue'
+import { useSourcesStore } from '../../stores/sources.js'
+import { downloadStatusColor, downloadStatusIcon, downloadStatusLabel } from '../../utils/downloadStatus.js'
+import { formatDateTime } from '../../utils/date.js'
+
 const props = defineProps({ event: { type: Object, required: true } })
 defineEmits(['open'])
 
-const statusIcon = computed(() => ({
-  ok: 'mdi-check-circle',
-  error: 'mdi-alert-circle',
-  running: 'mdi-progress-clock',
-  pending: 'mdi-clock-outline',
-  skipped: 'mdi-minus-circle',
-}[props.event.status] || 'mdi-help-circle'))
+const sourcesStore = useSourcesStore()
+const retrying = ref(false)
 
-const statusColor = computed(() => ({
-  ok: 'success',
-  error: 'error',
-  running: 'info',
-  pending: 'secondary',
-  skipped: 'warning',
-}[props.event.status] || undefined))
+const statusColor = computed(() => downloadStatusColor(props.event.status))
+const statusIcon = computed(() => downloadStatusIcon(props.event.status))
+const statusLabel = computed(() => downloadStatusLabel(props.event.status))
 
 function fmtTime(iso) {
-  if (!iso) return '—'
-  return iso.slice(0, 19).replace('T', ' ')
+  return iso ? formatDateTime(iso) : '—'
 }
 function fmtDuration(sec) {
   if (sec == null) return '—'
@@ -49,34 +114,107 @@ function fmtDuration(sec) {
   const m = Math.floor(sec / 60), s = Math.floor(sec % 60)
   return `${m}m ${s}s`
 }
+function truncateError(msg) {
+  const s = String(msg || '')
+  if (s.length <= 60) return s
+  return s.slice(0, 57) + '…'
+}
+
+async function onRetry() {
+  if (!props.event.source_id) return
+  retrying.value = true
+  try {
+    await sourcesStore.checkNow(props.event.source_id)
+    toast({
+      text: `Source check re-queued`, type: 'success',
+    })
+  } catch (e) {
+    const isInFlight = !!e?.body?.download_event_id
+    toast({
+      text: isInFlight ? 'Already running' : `Retry failed: ${e?.detail || e?.message || e}`,
+      type: isInFlight ? 'info' : 'error',
+    })
+  } finally {
+    retrying.value = false
+  }
+}
 </script>
 
 <style scoped>
 .fc-dl-row {
+  position: relative;
   display: grid;
-  grid-template-columns: 24px 1fr 96px 160px 80px 80px 1fr;
-  gap: 0.75rem;
+  grid-template-columns:
+    /* bar */    4px
+    /* status */ 120px
+    /* artist */ minmax(120px, 1.2fr)
+    /* plat   */ 140px
+    /* time   */ 140px
+    /* files  */ 60px
+    /* dur    */ 70px
+    /* error  */ minmax(0, 1.5fr)
+    /* actions*/ 120px;
+  gap: 0.6rem;
   align-items: center;
-  padding: 0.5rem 0.75rem;
-  border-bottom: 1px solid rgb(var(--v-theme-on-surface-variant) / 0.18);
+  padding: 0.55rem 0.75rem 0.55rem 0;
+  border-bottom: 1px solid rgb(var(--v-theme-on-surface-variant) / 0.15);
   cursor: pointer;
+  transition: background 0.12s ease;
 }
-.fc-dl-row:hover { background: rgb(var(--v-theme-surface) / 0.5); }
+.fc-dl-row:hover {
+  background: rgb(var(--v-theme-on-surface) / 0.04);
+}
+.fc-dl-row__bar {
+  width: 4px;
+  align-self: stretch;
+  border-radius: 0 2px 2px 0;
+}
+.fc-dl-row--ok      .fc-dl-row__bar { background: rgb(var(--v-theme-success)); }
+.fc-dl-row--error   .fc-dl-row__bar { background: rgb(var(--v-theme-error));   }
+.fc-dl-row--running .fc-dl-row__bar { background: rgb(var(--v-theme-info));    }
+.fc-dl-row--skipped .fc-dl-row__bar { background: rgb(var(--v-theme-warning)); }
+.fc-dl-row--pending .fc-dl-row__bar { background: rgb(var(--v-theme-on-surface-variant) / 0.4); }
+
+.fc-dl-row__status { justify-self: start; }
 .fc-dl-row__artist {
   color: rgb(var(--v-theme-on-surface));
   text-decoration: none;
+  font-weight: 500;
+  overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
+}
+.fc-dl-row__artist--missing,
+.fc-dl-row__platform-missing,
+.fc-dl-row__no-files {
+  color: rgb(var(--v-theme-on-surface-variant));
+  opacity: 0.5;
 }
 .fc-dl-row__artist:hover { color: rgb(var(--v-theme-accent)); }
-.fc-dl-row__time, .fc-dl-row__files, .fc-dl-row__duration {
+.fc-dl-row__platform { justify-self: start; }
+.fc-dl-row__time,
+.fc-dl-row__duration {
   color: rgb(var(--v-theme-on-surface-variant));
   font-size: 0.85rem;
   font-variant-numeric: tabular-nums;
-}
-.fc-dl-row__error {
-  color: rgb(var(--v-theme-error));
-  font-size: 0.85rem;
-  overflow: hidden;
-  text-overflow: ellipsis;
   white-space: nowrap;
 }
+.fc-dl-row__no-files {
+  text-align: center;
+  font-size: 1.1rem;
+}
+.fc-dl-row__error {
+  justify-self: start;
+  max-width: 100%;
+}
+.fc-dl-row__error :deep(.v-chip__content) {
+  overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
+}
+.fc-dl-row__error-spacer { /* keeps the grid column reserved */ }
+
+.fc-dl-row__actions {
+  display: flex; gap: 2px;
+  justify-self: end;
+  opacity: 0.5;
+  transition: opacity 0.12s ease;
+}
+.fc-dl-row:hover .fc-dl-row__actions { opacity: 1; }
 </style>

frontend/src/components/gallery/BulkEditorPanel.vue

@@ -74,7 +74,7 @@
       v-model="deleteModalOpen"
       action="delete"
       kind="images-selection"
-      :run-id="bulkToken"
+      :expected-token-override="bulkProjected?.confirm_token || ''"
       tier="C"
       :projected-counts="bulkProjectedCounts"
       :description="bulkDescription"
@@ -130,7 +130,6 @@ watch(() => sel.order.length, () => {
 const deleting = ref(false)
 const deleteModalOpen = ref(false)
 const bulkProjected = ref(null)
-const bulkToken = ref('')
 
 const bulkProjectedCounts = computed(() => bulkProjected.value
   ? {
@@ -147,24 +146,22 @@ const bulkDescription = computed(
     : '',
 )
 
-async function _computeSha8(ids) {
-  const canon = [...ids].sort((a, b) => a - b).join(',')
-  const buf = new TextEncoder().encode(canon)
-  const hashBuf = await crypto.subtle.digest('SHA-256', buf)
-  const bytes = new Uint8Array(hashBuf)
-  let hex = ''
-  for (let i = 0; i < 4; i++) {
-    hex += bytes[i].toString(16).padStart(2, '0')
-  }
-  return hex
-}
+// The dry-run response hands the canonical Tier-C confirm token back
+// as `confirm_token` (e.g. `delete-images-1a2b3c4d`), passed straight
+// to the modal via `expected-token-override`. We used to compute the
+// hash client-side via `crypto.subtle.digest`, but (1) that's
+// Secure-Context-gated and undefined on plain-HTTP origins
+// (homelab posture), so the click silently threw TypeError and the
+// modal never opened, and (2) the modal's `kind="images-selection"`
+// produced `delete-images-selection-<sha8>` while the backend
+// expected `delete-images-<sha8>` — so it never would have worked
+// even on HTTPS. Operator-flagged 2026-05-27.
 
 async function onDeleteClick() {
   if (!sel.order.length) return
   deleting.value = true
   try {
     bulkProjected.value = await adminStore.projectBulkImageDelete(sel.order)
-    bulkToken.value = await _computeSha8(sel.order)
     deleteModalOpen.value = true
   } finally {
     deleting.value = false

frontend/src/components/gallery/GalleryGrid.vue

@@ -32,8 +32,9 @@
 </template>
 
 <script setup>
-import { onMounted, onUnmounted, ref, watch } from 'vue'
+import { ref } from 'vue'
 import { useGalleryStore } from '../../stores/gallery.js'
+import { useInfiniteScroll } from '../../composables/useInfiniteScroll.js'
 import GalleryItem from './GalleryItem.vue'
 
 defineEmits(['open'])
@@ -41,22 +42,9 @@ defineEmits(['open'])
 const store = useGalleryStore()
 const sentinelEl = ref(null)
 
-let observer = null
-
-function attachObserver() {
-  if (observer) observer.disconnect()
-  if (!sentinelEl.value) return
-  observer = new IntersectionObserver(([entry]) => {
-    if (entry.isIntersecting && store.hasMore && !store.loading) {
-      store.loadMore()
-    }
-  }, { rootMargin: '600px' })
-  observer.observe(sentinelEl.value)
-}
-
-watch(sentinelEl, attachObserver)
-onMounted(() => attachObserver())
-onUnmounted(() => observer && observer.disconnect())
+useInfiniteScroll(sentinelEl, () => {
+  if (store.hasMore && !store.loading) store.loadMore()
+})
 
 function dateHeaderId(group) { return `fc-month-${group.year}-${group.month}` }
 

frontend/src/components/modal/DestructiveConfirmModal.vue

@@ -58,17 +58,27 @@ import { computed, ref, watch } from 'vue'
 const props = defineProps({
   modelValue: { type: Boolean, required: true },
   action: { type: String, required: true },          // 'restore' | 'delete'
-  kind: { type: String, required: true },            // 'db' | 'images' | 'artist' | 'tag' | 'images-selection'
+  kind: { type: String, required: true },            // 'db' | 'images' | 'artist' | 'tag' | 'images-selection' | 'audit' | 'min-dim'
   runId: { type: [Number, String], default: '' },    // numeric id or sha8 string
   description: { type: String, default: '' },
   tier: { type: String, default: 'C' },              // 'B' | 'C'
   projectedCounts: { type: Object, default: null },
+  // Override the `${action}-${kind}-${runId}` token formula. Use when
+  // the backend computes the canonical confirm token (e.g. bulk-delete
+  // and min-dim cleanup both return `confirm_token` from their dry-run
+  // endpoints) and the UI's kind/runId would otherwise produce a
+  // mismatched string. Operator-flagged 2026-05-27 after the
+  // BulkEditor's kind="images-selection" produced
+  // `delete-images-selection-<sha8>` while the backend expected
+  // `delete-images-<sha8>`.
+  expectedTokenOverride: { type: String, default: '' },
 })
 const emit = defineEmits(['update:modelValue', 'confirm'])
 
 const typed = ref('')
 const expectedToken = computed(
-  () => `${props.action}-${props.kind}-${props.runId}`,
+  () => props.expectedTokenOverride
+    || `${props.action}-${props.kind}-${props.runId}`,
 )
 const titleVerb = computed(
   () => props.action === 'restore' ? 'Restore' : 'Delete',

frontend/src/components/modal/ProvenancePanel.vue

@@ -19,7 +19,7 @@
           <span v-if="postDate(e)" class="fc-prov__date">{{ postDate(e) }}</span>
         </div>
         <div class="fc-prov__post">
-          {{ e.post.title || `Post ${e.post.external_post_id}` }}
+          {{ postTitle(e) }}
         </div>
         <div class="fc-prov__meta">
           <RouterLink :to="`/artist/${e.artist.slug}`">
@@ -30,16 +30,16 @@
           </span>
         </div>
         <div class="fc-prov__actions">
-          <a
-            v-if="e.post.url" :href="e.post.url"
-            target="_blank" rel="noopener noreferrer"
-          >↗ View original post</a>
           <a href="#" @click.prevent="openPost(e.post.id)">
-            View images from this post
+            View post
           </a>
+          <a
+            v-if="e.post.description_html"
+            href="#" @click.prevent="toggleDesc(e.provenance_id)"
+          >{{ expanded[e.provenance_id] ? 'Hide description ▴' : 'Show description ▾' }}</a>
         </div>
         <div
-          v-if="e.post.description_html"
+          v-if="e.post.description_html && expanded[e.provenance_id]"
           class="fc-prov__desc" v-html="e.post.description_html"
         />
       </article>
@@ -74,16 +74,27 @@
 </template>
 
 <script setup>
-import { computed, watch } from 'vue'
+import { computed, reactive, watch } from 'vue'
 import { useRouter } from 'vue-router'
 import { useModalStore } from '../../stores/modal.js'
 import { useProvenanceStore } from '../../stores/provenance.js'
 import { formatPostDate } from '../../utils/date.js'
+import { toPlainText } from '../../utils/htmlSanitize.js'
 
 const modal = useModalStore()
 const prov = useProvenanceStore()
 const router = useRouter()
 
+// Per-post description collapse state (keyed by provenance_id). Default
+// collapsed so multiple posts don't each eat ~180px of the panel — the
+// operator flagged the descriptions consuming a lot of real estate
+// 2026-05-28. Reset when the viewed image changes.
+const expanded = reactive({})
+function toggleDesc(id) { expanded[id] = !expanded[id] }
+watch(() => modal.currentImageId, () => {
+  for (const k of Object.keys(expanded)) delete expanded[k]
+})
+
 watch(
   () => modal.currentImageId,
   (id) => { if (id != null) prov.loadForImage(id) },
@@ -120,9 +131,16 @@ const show = computed(() => {
 const attachments = computed(() => state.value?.attachments || [])
 
 function postDate(e) { return formatPostDate(e.post.date) }
+function postTitle(e) {
+  // Titles can arrive as stored HTML (e.g. "<strong>…</strong>"); render
+  // as plain text (the CSS makes it bold).
+  return toPlainText(e.post.title) || `Post ${e.post.external_post_id}`
+}
 
 function openPost(postId) {
-  router.push({ path: '/gallery', query: { post_id: postId } })
+  // Land on the post in the posts feed (in context), not the gallery
+  // image grid. Operator-flagged 2026-05-28.
+  router.push({ path: '/posts', query: { post_id: postId } })
   modal.close()
 }
 </script>
@@ -145,7 +163,7 @@ function openPost(postId) {
   text-transform: lowercase;
 }
 .fc-prov__post {
-  font-weight: 600; margin: 4px 0;
+  font-weight: 700; margin: 4px 0;
   color: rgb(var(--v-theme-on-surface));
 }
 .fc-prov__meta {

frontend/src/components/modal/SuggestionsPanel.vue

@@ -38,6 +38,7 @@
 </template>
 
 <script setup>
+import { toast } from '../../utils/toast.js'
 import { computed, ref, watch } from 'vue'
 import { useSuggestionsStore, CATEGORY_LABELS } from '../../stores/suggestions.js'
 import SuggestionsCategoryGroup from './SuggestionsCategoryGroup.vue'
@@ -57,7 +58,7 @@ watch(() => props.imageId, (id) => { if (id != null) store.load(id) }, { immedia
 
 async function onAccept(s) {
   try { await store.accept(s) }
-  catch (e) { window.__fcToast?.({ text: `Accept failed: ${e.message}`, type: 'error' }) }
+  catch (e) { toast({ text: `Accept failed: ${e.message}`, type: 'error' }) }
 }
 
 const aliasDialog = ref(false)
@@ -68,7 +69,7 @@ async function onAliasConfirm(canonicalTagId) {
     await store.aliasAccept(aliasTarget.value, canonicalTagId)
     aliasDialog.value = false
   } catch (e) {
-    window.__fcToast?.({ text: `Alias failed: ${e.message}`, type: 'error' })
+    toast({ text: `Alias failed: ${e.message}`, type: 'error' })
   }
 }
 </script>

frontend/src/components/posts/PostCard.vue

@@ -1,8 +1,8 @@
 <template>
   <v-card
-    class="fc-post-card"
+    :class="['fc-post-card', expanded && 'fc-post-card--expanded']"
     variant="outlined"
-    tabindex="0"
+    :tabindex="expanded ? -1 : 0"
     @click="onCardClick"
     @keydown.enter="onCardClick"
   >
@@ -14,6 +14,12 @@
         @click.stop
       >{{ post.artist.name }}</RouterLink>
       <span class="fc-post-card__date" :title="absoluteDate">{{ relativeDate }}</span>
+      <span v-if="expanded && images.length" class="fc-post-card__meta">
+        · {{ images.length }} image{{ images.length === 1 ? '' : 's' }}
+      </span>
+      <span v-if="expanded && attachments.length" class="fc-post-card__meta">
+        · {{ attachments.length }} attachment{{ attachments.length === 1 ? '' : 's' }}
+      </span>
       <v-spacer />
       <v-btn
         v-if="post.post_url"
@@ -22,11 +28,18 @@
         :aria-label="`open original post on ${post.source.platform}`"
         @click.stop
       />
+      <v-btn
+        :icon="expanded ? 'mdi-chevron-up' : 'mdi-chevron-down'"
+        size="x-small" variant="text"
+        :aria-label="expanded ? 'Collapse post' : 'Expand post'"
+        @click.stop="toggleExpanded"
+      />
     </div>
 
-    <div class="fc-post-card__body">
+    <!-- Compact body: collapsed card. Hero + thumb rail + truncated text. -->
+    <div v-if="!expanded" class="fc-post-card__body">
       <div class="fc-post-card__media">
-        <template v-if="post.thumbnails?.length">
+        <template v-if="images.length">
           <div class="fc-post-card__hero">
             <img :src="hero.thumbnail_url" :alt="`hero thumbnail`" loading="lazy" />
           </div>
@@ -43,8 +56,8 @@
       </div>
 
       <div class="fc-post-card__text">
-        <h3 v-if="post.post_title" class="fc-post-card__title">
-          {{ post.post_title }}
+        <h3 v-if="plainTitle" class="fc-post-card__title">
+          {{ plainTitle }}
         </h3>
         <h3 v-else class="fc-post-card__title fc-post-card__title--missing">
           Post {{ post.external_post_id }}
@@ -63,28 +76,89 @@
         </div>
       </div>
     </div>
+
+    <!-- Expanded body: title, full mosaic, full sanitized HTML description,
+         attachments. Lazy-loaded detail via getPostFull. -->
+    <div v-else class="fc-post-card__expanded">
+      <h2 v-if="plainTitle" class="fc-post-card__title-full">
+        {{ plainTitle }}
+      </h2>
+      <h2 v-else class="fc-post-card__title-full fc-post-card__title--missing">
+        Post {{ post.external_post_id }}
+      </h2>
+
+      <section v-if="images.length" class="fc-post-card__sec">
+        <PostImageGrid :thumbnails="images" />
+        <div v-if="!detailLoaded" class="fc-post-card__loading-hint">
+          Loading full image list…
+        </div>
+      </section>
+
+      <section v-if="descriptionHtml" class="fc-post-card__sec">
+        <div class="fc-post-card__desc-full" v-html="descriptionHtml" />
+      </section>
+      <section v-else-if="detailLoaded" class="fc-post-card__sec">
+        <p class="fc-post-card__desc fc-post-card__desc--missing">(no description)</p>
+      </section>
+
+      <section v-if="attachments.length" class="fc-post-card__sec">
+        <h3 class="fc-post-card__h3">Attachments</h3>
+        <div class="fc-post-card__atts-full">
+          <a
+            v-for="att in attachments" :key="att.id"
+            :href="att.download_url" download
+            class="fc-post-card__att"
+            @click.stop
+          >
+            <v-icon size="small" class="fc-post-card__att-icon">mdi-paperclip</v-icon>
+            <span>{{ att.original_filename }}</span>
+            <span class="fc-post-card__att-size">({{ formatBytes(att.size_bytes) }})</span>
+          </a>
+        </div>
+      </section>
+    </div>
   </v-card>
 </template>
 
 <script setup>
-import { computed } from 'vue'
+import { computed, ref } from 'vue'
 import { RouterLink } from 'vue-router'
 
-import { usePostModalStore } from '../../stores/postModal.js'
+import { usePostsStore } from '../../stores/posts.js'
+import { sanitizeHtml, toPlainText } from '../../utils/htmlSanitize.js'
 import PostEmptyThumbs from './PostEmptyThumbs.vue'
+import PostImageGrid from './PostImageGrid.vue'
 
 const props = defineProps({
   post: { type: Object, required: true },
 })
 
-const postModal = usePostModalStore()
+const postsStore = usePostsStore()
 
+// Per-card expand state. No global modal — each PostCard owns its own
+// view-mode and lazy-loaded detail.
+const expanded = ref(false)
+const detail = ref(null)
+const detailLoaded = ref(false)
+const detailError = ref(null)
+
+// When expanded + detail loaded, prefer the uncapped detail thumbnails +
+// full description. Falls back to feed shape if detail fetch is in flight
+// or failed.
+const merged = computed(() => detail.value || props.post)
+const images = computed(() => merged.value.thumbnails || [])
+const attachments = computed(() => merged.value.attachments || [])
+
+// Titles can arrive as stored HTML (e.g. "<strong>…</strong>"); render as
+// plain text — the CSS makes the title bold.
+const plainTitle = computed(() => toPlainText(props.post.post_title))
+
+// Compact-view hero+rail derived from the feed-shape (capped 6).
 const hero = computed(() => props.post.thumbnails?.[0])
 const rail = computed(() => (props.post.thumbnails || []).slice(1, 4))
 const moreCount = computed(() => {
   const more = props.post.thumbnails_more || 0
   const railLen = rail.value.length
-  // If feed returned more than (1 hero + 3 rail = 4), extra spills into "+N".
   const extraShown = Math.max(0, (props.post.thumbnails?.length || 0) - 1 - railLen)
   return more + extraShown
 })
@@ -101,8 +175,57 @@ const relativeDate = computed(() => {
   return new Date(sortDateIso.value).toLocaleDateString()
 })
 
-function onCardClick () {
-  postModal.open(props.post)
+const descriptionHtml = computed(() => {
+  // Detail endpoint returns description_full as plain text (the service
+  // uses html_to_plain on the stored description). Render plain text in
+  // <p> wrappers; sanitize defensively in case the backend ever returns
+  // raw HTML.
+  const raw = merged.value.description_full || merged.value.description_plain
+  if (!raw) return ''
+  if (/[<>]/.test(raw)) return sanitizeHtml(raw)
+  const esc = raw
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+  return esc
+    .split(/\n\s*\n/)
+    .map((p) => `<p>${p.replace(/\n/g, '<br>')}</p>`)
+    .join('')
+})
+
+async function loadDetailIfNeeded () {
+  if (detailLoaded.value || detail.value) return
+  try {
+    detail.value = await postsStore.getPostFull(props.post.id)
+    detailLoaded.value = true
+  } catch (e) {
+    detailError.value = e.message
+    // Leave merged on feed-shape; the card still renders the truncated
+    // body so the operator isn't staring at a blank panel.
+  }
+}
+
+function toggleExpanded () {
+  expanded.value = !expanded.value
+  if (expanded.value) loadDetailIfNeeded()
+}
+
+function onCardClick (e) {
+  // Inner interactive elements use @click.stop so they never reach here.
+  // Whole-card click expands a collapsed card; collapsing is chevron-only
+  // so a mosaic-image click on an expanded card can never accidentally
+  // collapse the surrounding card.
+  if (expanded.value) return
+  expanded.value = true
+  loadDetailIfNeeded()
+}
+
+function formatBytes (n) {
+  if (!n) return '0 B'
+  if (n < 1024) return `${n} B`
+  if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)} KB`
+  if (n < 1024 * 1024 * 1024) return `${(n / 1024 / 1024).toFixed(1)} MB`
+  return `${(n / 1024 / 1024 / 1024).toFixed(1)} GB`
 }
 </script>
 
@@ -110,17 +233,22 @@ function onCardClick () {
 .fc-post-card {
   padding: 1rem;
   margin-bottom: 1rem;
-  cursor: pointer;
   container-type: inline-size;
   transition: border-color 0.15s ease;
 }
-.fc-post-card:hover {
+.fc-post-card:not(.fc-post-card--expanded) {
+  cursor: pointer;
+}
+.fc-post-card:not(.fc-post-card--expanded):hover {
   border-color: rgb(var(--v-theme-accent));
 }
 .fc-post-card:focus-visible {
   outline: 2px solid rgb(var(--v-theme-accent));
   outline-offset: 2px;
 }
+.fc-post-card--expanded {
+  border-color: rgb(var(--v-theme-accent) / 0.6);
+}
 
 .fc-post-card__head {
   display: flex;
@@ -129,6 +257,7 @@ function onCardClick () {
   font-size: 0.8rem;
   color: rgb(var(--v-theme-on-surface-variant));
   margin-bottom: 12px;
+  flex-wrap: wrap;
 }
 .fc-post-card__artist {
   color: rgb(var(--v-theme-on-surface));
@@ -136,8 +265,10 @@ function onCardClick () {
   font-weight: 600;
 }
 .fc-post-card__artist:hover { color: rgb(var(--v-theme-accent)); }
-.fc-post-card__date { white-space: nowrap; }
+.fc-post-card__date,
+.fc-post-card__meta { white-space: nowrap; }
 
+/* ---- COMPACT BODY ---- */
 .fc-post-card__body {
   display: flex;
   flex-direction: column;
@@ -148,13 +279,8 @@ function onCardClick () {
     flex-direction: row;
     gap: 24px;
   }
-  .fc-post-card__media {
-    flex: 0 0 50%;
-  }
-  .fc-post-card__text {
-    flex: 1 1 0;
-    min-width: 0;
-  }
+  .fc-post-card__media { flex: 0 0 50%; }
+  .fc-post-card__text  { flex: 1 1 0; min-width: 0; }
 }
 
 .fc-post-card__hero {
@@ -164,35 +290,24 @@ function onCardClick () {
   border-radius: 6px;
 }
 .fc-post-card__hero img {
-  width: 100%;
-  height: 100%;
-  object-fit: cover;
-  display: block;
+  width: 100%; height: 100%;
+  object-fit: cover; display: block;
 }
 
 .fc-post-card__rail {
-  display: flex;
-  gap: 6px;
-  margin-top: 6px;
+  display: flex; gap: 6px; margin-top: 6px;
 }
 .fc-post-card__rail-cell {
-  width: 80px;
-  height: 80px;
-  overflow: hidden;
-  border-radius: 4px;
+  width: 80px; height: 80px;
+  overflow: hidden; border-radius: 4px;
 }
 .fc-post-card__rail-cell img {
-  width: 100%;
-  height: 100%;
-  object-fit: cover;
-  display: block;
+  width: 100%; height: 100%;
+  object-fit: cover; display: block;
 }
 .fc-post-card__rail-more {
-  width: 80px;
-  height: 80px;
-  display: flex;
-  align-items: center;
-  justify-content: center;
+  width: 80px; height: 80px;
+  display: flex; align-items: center; justify-content: center;
   border: 1px dashed rgb(var(--v-theme-on-surface-variant));
   border-radius: 4px;
   color: rgb(var(--v-theme-on-surface-variant));
@@ -201,8 +316,7 @@ function onCardClick () {
 
 .fc-post-card__title {
   font-family: 'Fraunces', Georgia, serif;
-  font-size: 18px;
-  font-weight: 500;
+  font-size: 18px; font-weight: 700;
   margin: 0 0 8px 0;
   color: rgb(var(--v-theme-on-surface));
   display: -webkit-box;
@@ -238,9 +352,7 @@ function onCardClick () {
   color: rgb(var(--v-theme-on-surface-variant));
 }
 @container (min-width: 800px) {
-  .fc-post-card__desc {
-    -webkit-line-clamp: 5;
-  }
+  .fc-post-card__desc { -webkit-line-clamp: 5; }
 }
 
 .fc-post-card__atts {
@@ -251,4 +363,60 @@ function onCardClick () {
   color: rgb(var(--v-theme-on-surface-variant));
 }
 .fc-post-card__att-icon { color: rgb(var(--v-theme-on-surface-variant)); }
+
+/* ---- EXPANDED BODY ---- */
+.fc-post-card__expanded {
+  display: flex;
+  flex-direction: column;
+  gap: 20px;
+}
+.fc-post-card__title-full {
+  font-family: 'Fraunces', Georgia, serif;
+  font-size: 22px;
+  font-weight: 700;
+  margin: 0;
+  color: rgb(var(--v-theme-on-surface));
+}
+@container (min-width: 800px) {
+  .fc-post-card__title-full { font-size: 26px; }
+}
+.fc-post-card__sec { margin: 0; }
+.fc-post-card__h3 {
+  font-family: 'Fraunces', Georgia, serif;
+  font-size: 16px;
+  font-weight: 500;
+  margin: 0 0 8px 0;
+  color: rgb(var(--v-theme-on-surface));
+}
+.fc-post-card__loading-hint {
+  margin-top: 8px;
+  font-size: 0.8rem;
+  color: rgb(var(--v-theme-on-surface-variant));
+}
+.fc-post-card__desc-full {
+  font-size: 0.95rem;
+  line-height: 1.55;
+  color: rgb(var(--v-theme-on-surface));
+}
+.fc-post-card__desc-full :deep(p) { margin: 0 0 12px 0; }
+.fc-post-card__desc-full :deep(a) { color: rgb(var(--v-theme-accent)); }
+.fc-post-card__atts-full {
+  display: flex; flex-wrap: wrap; gap: 8px;
+}
+.fc-post-card__att {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+  padding: 6px 12px;
+  border: 1px solid rgb(var(--v-theme-on-surface-variant));
+  border-radius: 999px;
+  color: rgb(var(--v-theme-on-surface));
+  text-decoration: none;
+  font-size: 0.85rem;
+}
+.fc-post-card__att:hover {
+  color: rgb(var(--v-theme-accent));
+  border-color: rgb(var(--v-theme-accent));
+}
+.fc-post-card__att-size { color: rgb(var(--v-theme-on-surface-variant)); }
 </style>

frontend/src/components/posts/PostModal.vue

@@ -1,211 +0,0 @@
-<template>
-  <v-dialog
-    :model-value="store.isOpen"
-    max-width="1100"
-    scrollable
-    @update:model-value="(v) => { if (!v) close() }"
-  >
-    <v-card v-if="store.currentPost" class="fc-post-modal">
-      <div class="fc-post-modal__head">
-        <v-chip size="x-small" variant="tonal">{{ post.source.platform }}</v-chip>
-        <RouterLink
-          :to="{ name: 'artist', params: { slug: post.artist.slug } }"
-          class="fc-post-modal__artist"
-          @click="close"
-        >{{ post.artist.name }}</RouterLink>
-        <span class="fc-post-modal__date" :title="absoluteDate">
-          {{ relativeDate }}
-        </span>
-        <span v-if="post.thumbnails?.length" class="fc-post-modal__meta">
-          · {{ post.thumbnails.length }} image{{ post.thumbnails.length === 1 ? '' : 's' }}
-        </span>
-        <span v-if="post.attachments?.length" class="fc-post-modal__meta">
-          · {{ post.attachments.length }} attachment{{ post.attachments.length === 1 ? '' : 's' }}
-        </span>
-        <v-spacer />
-        <v-btn
-          v-if="post.post_url"
-          :href="post.post_url" target="_blank" rel="noopener"
-          icon="mdi-open-in-new" size="small" variant="text"
-          :aria-label="`open original post on ${post.source.platform}`"
-        />
-        <v-btn
-          icon="mdi-close" size="small" variant="text"
-          aria-label="Close"
-          @click="close"
-        />
-      </div>
-
-      <v-card-text class="fc-post-modal__body">
-        <section v-if="post.thumbnails?.length" class="fc-post-modal__sec">
-          <PostImageGrid :thumbnails="post.thumbnails" />
-          <div v-if="!store.detailLoaded" class="fc-post-modal__loading-hint">
-            Loading full image list…
-          </div>
-        </section>
-
-        <section v-if="post.post_title" class="fc-post-modal__sec">
-          <h2 class="fc-post-modal__title">{{ post.post_title }}</h2>
-        </section>
-
-        <section v-if="descriptionHtml" class="fc-post-modal__sec">
-          <div class="fc-post-modal__desc" v-html="descriptionHtml" />
-        </section>
-
-        <section v-if="post.attachments?.length" class="fc-post-modal__sec">
-          <h3 class="fc-post-modal__h3">Attachments</h3>
-          <div class="fc-post-modal__atts">
-            <a
-              v-for="att in post.attachments" :key="att.id"
-              :href="att.download_url" download
-              class="fc-post-modal__att"
-            >
-              <v-icon size="small" class="fc-post-modal__att-icon">mdi-paperclip</v-icon>
-              <span class="fc-post-modal__att-name">{{ att.original_filename }}</span>
-              <span class="fc-post-modal__att-size">({{ formatBytes(att.size_bytes) }})</span>
-            </a>
-          </div>
-        </section>
-      </v-card-text>
-    </v-card>
-  </v-dialog>
-</template>
-
-<script setup>
-import { computed } from 'vue'
-import { RouterLink } from 'vue-router'
-
-import { usePostModalStore } from '../../stores/postModal.js'
-import { sanitizeHtml } from '../../utils/htmlSanitize.js'
-import PostImageGrid from './PostImageGrid.vue'
-
-const store = usePostModalStore()
-const post = computed(() => store.currentPost || {})
-
-const sortDateIso = computed(() => post.value.post_date || post.value.downloaded_at)
-const absoluteDate = computed(() => sortDateIso.value
-  ? new Date(sortDateIso.value).toLocaleString()
-  : '')
-const relativeDate = computed(() => {
-  if (!sortDateIso.value) return ''
-  const then = new Date(sortDateIso.value).getTime()
-  const diff = (Date.now() - then) / 1000
-  if (diff < 60) return `${Math.floor(diff)}s ago`
-  if (diff < 3600) return `${Math.floor(diff / 60)}m ago`
-  if (diff < 86400) return `${Math.floor(diff / 3600)}h ago`
-  if (diff < 86400 * 30) return `${Math.floor(diff / 86400)}d ago`
-  return new Date(sortDateIso.value).toLocaleDateString()
-})
-
-const descriptionHtml = computed(() => {
-  // Detail endpoint returns description_full as plain text (the
-  // existing service uses html_to_plain on the stored description).
-  // Render the plain text in <p> wrappers; the sanitizer below is
-  // defensive for the case where the backend ever switches to raw HTML.
-  const raw = post.value.description_full || post.value.description_plain
-  if (!raw) return ''
-  if (/[<>]/.test(raw)) return sanitizeHtml(raw)
-  const esc = raw
-    .replace(/&/g, '&amp;')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-  return esc
-    .split(/\n\s*\n/)
-    .map(p => `<p>${p.replace(/\n/g, '<br>')}</p>`)
-    .join('')
-})
-
-function close () {
-  store.close()
-}
-
-function formatBytes (n) {
-  if (!n) return '0 B'
-  if (n < 1024) return `${n} B`
-  if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)} KB`
-  if (n < 1024 * 1024 * 1024) return `${(n / 1024 / 1024).toFixed(1)} MB`
-  return `${(n / 1024 / 1024 / 1024).toFixed(1)} GB`
-}
-</script>
-
-<style scoped>
-.fc-post-modal {
-  background: rgb(var(--v-theme-surface));
-  max-height: 90vh;
-  display: flex;
-  flex-direction: column;
-}
-.fc-post-modal__head {
-  display: flex;
-  align-items: center;
-  gap: 10px;
-  padding: 12px 16px;
-  font-size: 0.85rem;
-  color: rgb(var(--v-theme-on-surface-variant));
-  border-bottom: 1px solid rgb(var(--v-theme-on-surface-variant) / 0.15);
-}
-.fc-post-modal__artist {
-  color: rgb(var(--v-theme-on-surface));
-  text-decoration: none;
-  font-weight: 600;
-}
-.fc-post-modal__artist:hover { color: rgb(var(--v-theme-accent)); }
-.fc-post-modal__date { white-space: nowrap; }
-.fc-post-modal__meta { white-space: nowrap; }
-.fc-post-modal__body {
-  padding: 16px;
-  overflow-y: auto;
-  flex: 1 1 auto;
-}
-.fc-post-modal__sec {
-  margin-bottom: 24px;
-}
-.fc-post-modal__sec:last-child { margin-bottom: 0; }
-.fc-post-modal__title {
-  font-family: 'Fraunces', Georgia, serif;
-  font-size: 24px;
-  font-weight: 500;
-  margin: 0;
-  color: rgb(var(--v-theme-on-surface));
-}
-.fc-post-modal__h3 {
-  font-family: 'Fraunces', Georgia, serif;
-  font-size: 16px;
-  font-weight: 500;
-  margin: 0 0 8px 0;
-  color: rgb(var(--v-theme-on-surface));
-}
-.fc-post-modal__desc {
-  font-size: 0.95rem;
-  line-height: 1.55;
-  color: rgb(var(--v-theme-on-surface));
-}
-.fc-post-modal__desc :deep(p) { margin: 0 0 12px 0; }
-.fc-post-modal__desc :deep(a) { color: rgb(var(--v-theme-accent)); }
-.fc-post-modal__loading-hint {
-  margin-top: 8px;
-  font-size: 0.8rem;
-  color: rgb(var(--v-theme-on-surface-variant));
-}
-.fc-post-modal__atts {
-  display: flex;
-  flex-wrap: wrap;
-  gap: 8px;
-}
-.fc-post-modal__att {
-  display: inline-flex;
-  align-items: center;
-  gap: 6px;
-  padding: 6px 12px;
-  border: 1px solid rgb(var(--v-theme-on-surface-variant));
-  border-radius: 999px;
-  color: rgb(var(--v-theme-on-surface));
-  text-decoration: none;
-  font-size: 0.85rem;
-}
-.fc-post-modal__att:hover {
-  color: rgb(var(--v-theme-accent));
-  border-color: rgb(var(--v-theme-accent));
-}
-.fc-post-modal__att-size { color: rgb(var(--v-theme-on-surface-variant)); }
-</style>

frontend/src/components/settings/BackupRunsTable.vue

@@ -59,6 +59,8 @@
 </template>
 
 <script setup>
+import { formatRelative as fmtRelative } from '../../utils/date.js'
+
 defineProps({ runs: { type: Array, default: () => [] } })
 defineEmits(['restore', 'delete', 'tag'])
 
@@ -92,13 +94,7 @@ function formatBytes(b) {
   return `${v.toFixed(i === 0 ? 0 : 1)} ${units[i]}`
 }
 function formatRelative(iso) {
-  if (!iso) return '—'
-  const then = new Date(iso).getTime()
-  const diff = Math.max(0, (Date.now() - then) / 1000)
-  if (diff < 60) return `${Math.floor(diff)}s ago`
-  if (diff < 3600) return `${Math.floor(diff / 60)}m ago`
-  if (diff < 86400) return `${Math.floor(diff / 3600)}h ago`
-  return `${Math.floor(diff / 86400)}d ago`
+  return fmtRelative(iso, { nullText: '—' })
 }
 </script>
 

frontend/src/components/settings/BrowserExtensionCard.vue

@@ -108,6 +108,7 @@
 </template>
 
 <script setup>
+import { toast } from '../../utils/toast.js'
 import { computed, onMounted, ref } from 'vue'
 import { useApi } from '../../composables/useApi.js'
 import { copyText } from '../../utils/clipboard.js'
@@ -147,7 +148,7 @@ async function loadKey() {
     apiKey.value = key
   } catch (e) {
     apiKey.value = ''
-    window.__fcToast?.({
+    toast({
       text: `Failed to load extension API key: ${e.message}`,
       type: 'error',
     })
@@ -160,9 +161,9 @@ async function rotateKey() {
     const { key } = await api.post('/api/settings/extension_api_key/rotate')
     apiKey.value = key
     keyShown.value = true
-    window.__fcToast?.({ text: 'Extension API key rotated.', type: 'success' })
+    toast({ text: 'Extension API key rotated.', type: 'success' })
   } catch (e) {
-    window.__fcToast?.({
+    toast({
       text: `Rotate failed: ${e.message}`,
       type: 'error',
     })
@@ -174,9 +175,9 @@ async function rotateKey() {
 async function copy(text, label) {
   try {
     await copyText(text)
-    window.__fcToast?.({ text: `${label} copied.`, type: 'success' })
+    toast({ text: `${label} copied.`, type: 'success' })
   } catch (e) {
-    window.__fcToast?.({ text: `Copy failed: ${e.message}`, type: 'error' })
+    toast({ text: `Copy failed: ${e.message}`, type: 'error' })
   }
 }
 </script>

frontend/src/components/settings/CentroidRecomputeCard.vue

@@ -11,20 +11,23 @@
         <v-icon start>mdi-vector-triangle</v-icon> Recompute centroids
       </v-btn>
       <span v-if="done" class="ml-3 text-caption">Enqueued.</span>
+      <QueueStatusBar queue="ml" queue-label="ML" />
     </v-card-text>
   </v-card>
 </template>
 
 <script setup>
+import { toast } from '../../utils/toast.js'
 import { ref } from 'vue'
 import { useMLStore } from '../../stores/ml.js'
+import QueueStatusBar from './QueueStatusBar.vue'
 const store = useMLStore()
 const busy = ref(false)
 const done = ref(false)
 async function run() {
   busy.value = true
   try { await store.triggerRecomputeCentroids(); done.value = true }
-  catch (e) { window.__fcToast?.({ text: e.message, type: 'error' }) }
+  catch (e) { toast({ text: e.message, type: 'error' }) }
   finally { busy.value = false }
 }
 </script>

frontend/src/components/settings/ImportFiltersForm.vue

@@ -51,68 +51,6 @@
         </v-col>
       </v-row>
 
-      <v-divider class="my-4" />
-      <div class="text-subtitle-2 mb-2">Downloader (FC-3c)</div>
-      <v-row>
-        <v-col cols="12" sm="6">
-          <v-text-field
-            v-model.number="local.download_rate_limit_seconds"
-            label="Rate limit (seconds between requests)"
-            type="number" step="0.5" min="0"
-            density="compact" hide-details @blur="save"
-          />
-          <div class="fc-help">gallery-dl extractor.sleep. Higher = slower but safer.</div>
-        </v-col>
-        <v-col cols="12" sm="6">
-          <v-switch
-            v-model="local.download_validate_files"
-            label="Validate downloaded files (magic-byte check)"
-            density="compact" hide-details color="accent" @change="save"
-          />
-        </v-col>
-      </v-row>
-
-      <v-divider class="my-4" />
-      <div class="text-subtitle-2 mb-2">Download scheduling (FC-3d)</div>
-      <v-row>
-        <v-col cols="12" sm="6">
-          <v-text-field
-            v-model.number="local.download_schedule_default_seconds"
-            label="Default check interval (seconds)"
-            type="number" :min="60" :max="86400"
-            density="compact" hide-details @blur="save"
-          />
-          <div class="fc-help">
-            Used when a source has no per-source or per-artist override.
-            Default 28800 (8 hours).
-          </div>
-        </v-col>
-        <v-col cols="12" sm="6">
-          <v-text-field
-            v-model.number="local.download_event_retention_days"
-            label="Event retention (days)"
-            type="number" :min="1" :max="3650"
-            density="compact" hide-details @blur="save"
-          />
-          <div class="fc-help">
-            Completed download events older than this are deleted nightly.
-            Default 90.
-          </div>
-        </v-col>
-        <v-col cols="12" sm="6">
-          <v-text-field
-            v-model.number="local.download_failure_warning_threshold"
-            label="Failure warning threshold"
-            type="number" :min="1" :max="100"
-            density="compact" hide-details @blur="save"
-          />
-          <div class="fc-help">
-            Source row badge turns red after this many consecutive
-            failures. Sources are never auto-disabled. Default 5.
-          </div>
-        </v-col>
-      </v-row>
-
       <v-alert v-if="store.settingsError" type="error" variant="tonal" class="mt-2" closable>
         {{ store.settingsError }}
       </v-alert>
@@ -128,16 +66,14 @@ import { reactive, watch } from 'vue'
 import { useImportStore } from '../../stores/import.js'
 
 const store = useImportStore()
+// Downloader + schedule-defaults fields moved to
+// /subscriptions?tab=settings (operator decision 2026-05-27). This form
+// now only owns image-import filters.
 const local = reactive({
   min_width: 0, min_height: 0,
   skip_transparent: false, transparency_threshold: 0.9,
   skip_single_color: false, single_color_threshold: 0.95,
   phash_threshold: 10,
-  download_rate_limit_seconds: 3.0,
-  download_validate_files: true,
-  download_schedule_default_seconds: 28800,
-  download_event_retention_days: 90,
-  download_failure_warning_threshold: 5,
 })
 
 watch(() => store.settings, (s) => { if (s) Object.assign(local, s) }, { immediate: true })

frontend/src/components/settings/ImportTaskList.vue

@@ -51,6 +51,19 @@
           title="Click for full error"
         >{{ shorten(item.error, 60) }}</button>
       </template>
+      <template #item.actions="{ item }">
+        <v-btn
+          v-if="item.status === 'failed'"
+          icon size="x-small" variant="text"
+          :loading="refetching === item.id"
+          @click="onRefetch(item)"
+        >
+          <v-icon size="small">mdi-cloud-refresh</v-icon>
+          <v-tooltip activator="parent" location="top">
+            Re-fetch original (re-download from source)
+          </v-tooltip>
+        </v-btn>
+      </template>
     </v-data-table-virtual>
     <div v-if="store.hasMore" class="d-flex justify-center py-3">
       <v-btn variant="text" size="small" @click="onLoadMore">Load more</v-btn>
@@ -112,6 +125,7 @@
 </template>
 
 <script setup>
+import { toast } from '../../utils/toast.js'
 import { computed, ref } from 'vue'
 import { useImportStore } from '../../stores/import.js'
 import ErrorDetailModal from '../common/ErrorDetailModal.vue'
@@ -149,9 +163,29 @@ const headers = [
   { title: 'Source', key: 'source_path', sortable: false },
   { title: 'Size', key: 'size_bytes', sortable: false, width: 90 },
   { title: 'Created', key: 'created_at', sortable: false, width: 150 },
-  { title: 'Note', key: 'error', sortable: false }
+  { title: 'Note', key: 'error', sortable: false },
+  { title: '', key: 'actions', sortable: false, width: 56 }
 ]
 
+const refetching = ref(null)
+const _REFETCH_MSG = {
+  refetch_queued: { text: 'Re-fetch queued — re-downloading from source', type: 'success' },
+  no_source: { text: 'No re-fetchable source (filesystem import — replace the file manually)', type: 'info' },
+  already_refetched: { text: 'Already re-fetched once', type: 'info' },
+}
+async function onRefetch(item) {
+  refetching.value = item.id
+  try {
+    const res = await store.refetchTask(item.id)
+    const msg = _REFETCH_MSG[res.status] || { text: `Re-fetch: ${res.status}`, type: 'info' }
+    toast(msg)
+  } catch (e) {
+    toast({ text: `Re-fetch failed: ${e.message}`, type: 'error' })
+  } finally {
+    refetching.value = null
+  }
+}
+
 const hasFailed = computed(() => store.tasks.some(t => t.status === 'failed'))
 const hasStuck = computed(() => store.tasks.some(
   t => t.status === 'pending' || t.status === 'queued' || t.status === 'processing'