Merge pull request 'fix(extension): Add-to-FC button on subscribed Patreon creators + v1.0.8 (#1485)' (#230) from dev into main

pg_dump + zstd in runtime image, lift Quart body cap to 1 GiB. See PR #2.

.forgejo/workflows/ci.yml

@@ -2,7 +2,6 @@ name: CI
 
 # CI lanes per FabledRulebook/forgejo.md "CI philosophy":
 #   - lint: ruff only, no dep install — fast-fail for the common lint bounce.
-#   - extension-version: the derived version resolves and is a shape AMO takes.
 #   - backend-lint-and-test: `pytest -m "not integration"`, no service containers.
 #   - frontend-build: vitest unit + vite build.
 #   - integration: pgvector + redis service containers; alembic + `pytest -m integration`.
@@ -35,92 +34,13 @@ jobs:
       - name: Ruff lint
         # agent/ included so the GPU-agent is linted before its image is built
         # (build.yml only `docker build`s it — this is where it gets checked).
-        # scripts/ likewise: release_notes.py runs only on a tag push, so a
-        # syntax or import error there would otherwise surface at the one
-        # moment nobody wants to debug a workflow.
-        run: ruff check backend/ tests/ alembic/ agent/ scripts/
+        run: ruff check backend/ tests/ alembic/ agent/
       - name: Agent syntax check
         # The agent's runtime deps (torch/transformers/ultralytics) aren't in the
         # CI image, so we can't import it — but compileall parses every module,
         # catching syntax errors before the image build.
         run: python -m compileall -q agent/fc_agent
 
-  # The extension version is DERIVED, not hand-maintained (milestone 271 step
-  # 4): build.yml computes it from the commit TIME of the newest packaged
-  # extension change and stamps it into manifest.json / package.json at build
-  # time. The guard that used to live here — "packaged files changed but nobody
-  # bumped the version" — was therefore checking a fact that had stopped
-  # existing. Worse than useless: it would have failed this lane on every real
-  # extension change, demanding a bump that decides nothing. Retired 2026-08-27
-  # rather than left running beside the new mechanism (rule 22).
-  #
-  # Two things are still worth asserting, and this is the only lane that can:
-  # the extension.yml suite runs on node:24-slim, which is exactly why
-  # version.spec.js sticks to packaging.sh's git-free subcommands.
-  #   1. the derivation actually resolves on this commit
-  #   2. the derived string is one AMO will accept, checked against Mozilla's
-  #      own published grammar rather than a loose "digits and dots"
-  #
-  # The MAJOR.MINOR-agreement check that used to be (2) is gone with milestone
-  # 318 step 8: the committed version no longer seeds anything, so there is no
-  # hand-set part left for the two files to disagree about.
-  #
-  # Deliberately NOT checked here: that the derived value beats what has already
-  # been signed. That guard belongs in build.yml, where it compares against the
-  # real ext-* releases. Comparing against origin/main here would be wrong —
-  # dev legitimately derives a LOWER value whenever main is ahead on the
-  # extension, and a lane that fails for being behind is a lane people learn to
-  # ignore.
-  extension-version:
-    runs-on: python-ci
-    container:
-      image: git.fabledsword.com/bvandeusen/ci-python:3.14
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          # The derivation needs real history: a depth-1 clone sees one commit
-          # and produces a wrong, too-low value RATHER THAN FAILING. Checking
-          # that here is half the point of the lane.
-          fetch-depth: 0
-      - name: Extension version derives cleanly
-        run: |
-          set -eu
-          # busybox sh on the act_runner — no bashisms (family rule).
-          VERSION=$(sh extension/scripts/packaging.sh version)
-          echo "derived: $VERSION"
-
-          # Mozilla's published grammar for AMO, transcribed verbatim from
-          # MDN's manifest.json/version page:
-          #
-          #     ^(0|[1-9][0-9]{0,8})([.](0|[1-9][0-9]{0,8})){0,3}$
-          #
-          # Not the looser `^[0-9]+(\.[0-9]+)*$` this lane used to carry. That
-          # one passes `2026.08.29.0201`, which AMO REJECTS — a segment must be
-          # the single digit 0 or start 1-9 — and it also passes five segments,
-          # where AMO allows four. Both would surface as a failed sign with the
-          # version already burned: AMO 409s on re-signing, so a rejected value
-          # cannot be reclaimed and cannot be reused. This lane is the cheap
-          # place to find out. (#3138, milestone 318 step 8.)
-          if ! echo "$VERSION" | grep -qE '^(0|[1-9][0-9]{0,8})(\.(0|[1-9][0-9]{0,8})){0,3}$'; then
-            echo "ERROR: derived version '$VERSION' is not a version AMO accepts."
-            echo "AMO's grammar: ^(0|[1-9][0-9]{0,8})([.](0|[1-9][0-9]{0,8})){0,3}$"
-            echo "Most likely cause: a zero-padded segment (08, 0201). The rest"
-            echo "of the family pads; the extension must not — see packaging.sh."
-            exit 1
-          fi
-
-          # ...and the shape this project actually derives. AMO would happily
-          # take `1.0.3500147` too, so the grammar check alone would not notice
-          # a regression to the pre-318 shape — which orders BELOW everything
-          # signed since, and is unrecoverable once Firefox has the higher one.
-          if ! echo "$VERSION" | grep -qE '^20[0-9][0-9]\.[0-9]{1,2}\.[0-9]{1,2}\.[0-9]{1,4}$'; then
-            echo "ERROR: derived version '$VERSION' is not YYYY.M.D.HHMM."
-            echo "Rule 148's CalVer is what build.yml signs; the old"
-            echo "1.0.<minutes> shape would order below every ext-2026.* release."
-            exit 1
-          fi
-          echo "OK: derived version $VERSION"
-
   backend-lint-and-test:
     runs-on: python-ci
     container:
@@ -132,13 +52,6 @@ jobs:
       SECRET_KEY: ci_unit_test_placeholder
     steps:
       - uses: actions/checkout@v4
-        with:
-          # Full history for tests/test_artifact_identity.py, which derives
-          # each artifact's revision to check the identity scheme. On a
-          # depth-1 clone that derivation either fails or returns the tip sha
-          # — so the lane would go green while asserting nothing, which is
-          # the one outcome worse than a red one.
-          fetch-depth: 0
 
       # Cache step removed 2026-05-26: act_runner's cache backend has been
       # broken on this homelab runner since 2026-05-15 (first as request-

.forgejo/workflows/extension.yml

@@ -1,5 +1,5 @@
 name: extension
-# Lint + unit tests. The sign-and-publish dance moved into build.yml's
+# Lint-only workflow. The sign-and-publish dance moved into build.yml's
 # `sign-extension` job (2026-05-25) — `:latest` now always bundles the XPI
 # because sign-extension runs as a build-web dependency in the SAME workflow,
 # eliminating the prior race between build.yml and a separate extension.yml.
@@ -10,20 +10,10 @@ on:
     paths:
       - 'extension/**'
       - '.forgejo/workflows/extension.yml'
-      # test/version.spec.js asserts things ABOUT the other two workflows —
-      # that neither inlines the packaged-file set, and that build.yml derives
-      # the shipped version rather than reading it out of the repo. A
-      # workflow-only edit can therefore break this suite, so it has to trigger
-      # it. build.yml joined the list at milestone 271 step 5, when the spec
-      # started asserting against it.
-      - '.forgejo/workflows/ci.yml'
-      - '.forgejo/workflows/build.yml'
   pull_request:
     branches: [main]
     paths:
       - 'extension/**'
-      - '.forgejo/workflows/ci.yml'
-      - '.forgejo/workflows/build.yml'
   workflow_dispatch:
 
 jobs:
@@ -33,55 +23,7 @@ jobs:
       image: node:24-bookworm-slim
     steps:
       - uses: actions/checkout@v4
-      # Not --no-save: vitest and web-ext are both real devDependencies now,
-      # and the suite needs vitest resolvable from node_modules.
-      - name: Install dev dependencies
-        run: cd extension && npm install --no-audit --no-fund
+      - name: Install web-ext
+        run: cd extension && npm install --no-save --no-audit --no-fund
       - name: Lint
         run: cd extension && npm run lint
-      # Pure-logic specs over lib/url.js and lib/platforms.js plus manifest /
-      # package version-consistency checks. No browser, no network.
-      - name: Unit tests
-        run: cd extension && npm run test:unit
-
-      # Everything else about packaging is asserted against our own declaration
-      # of what ships. This is the only check that asks web-ext what it ACTUALLY
-      # put in the archive. Until now that was an unverified assumption about
-      # glob semantics — and a fragile one: `test/**` reaches web-ext intact
-      # only because callers `set -f` first, so losing that quoting would
-      # silently start shipping dev files with no other signal.
-      - name: Verify XPI contents
-        run: |
-          set -eu
-          command -v unzip >/dev/null 2>&1 || { apt-get update -qq && apt-get install -y -qq unzip; }
-          cd extension
-          npm run build
-          ZIP=$(ls web-ext-artifacts/*.zip | head -1)
-          echo "=== packaged entries in $ZIP ==="
-          unzip -Z1 "$ZIP" | sort
-          echo "=== end ==="
-          ENTRIES=$(unzip -Z1 "$ZIP")
-          fail=0
-          # Must NOT ship: repo infrastructure with no business in a user's browser.
-          for pat in 'test/' 'scripts/' 'vitest.config.js' 'package.json' 'package-lock.json' 'README.md' 'node_modules/' 'web-ext-artifacts/'; do
-            if echo "$ENTRIES" | grep -q "^$pat"; then
-              echo "ERROR: '$pat' was packaged into the XPI but must not be"
-              fail=1
-            fi
-          done
-          # Must ship: if an exclusion pattern ever over-matches, the extension
-          # breaks at runtime rather than at build time, so assert presence too.
-          for req in 'manifest.json' 'lib/url.js' 'lib/api.js' 'lib/platforms.js' 'lib/cookies.js'; do
-            if ! echo "$ENTRIES" | grep -q "^$req$"; then
-              echo "ERROR: '$req' is missing from the XPI"
-              fail=1
-            fi
-          done
-          for dir in 'background/' 'popup/' 'options/' 'content/' 'icons/'; do
-            if ! echo "$ENTRIES" | grep -q "^$dir"; then
-              echo "ERROR: nothing from '$dir' was packaged"
-              fail=1
-            fi
-          done
-          [ "$fail" -eq 0 ] || exit 1
-          echo "XPI contents verified."

.forgejo/workflows/release.yml

@@ -1,80 +0,0 @@
-name: Release
-
-# A `v*` tag publishes a changelog. It does NOT build anything.
-#
-# Milestone 318 step 2 removed the tag trigger from build.yml: by the time
-# anyone tags a commit, `main` has already built and published it, and a
-# rebuild would re-push `:c-<sha>` — which rule 145 forbids even when the
-# source matches, since image configs carry timestamps and "same source" does
-# not mean "same manifest". That left the tag with no consequence at all.
-#
-# This is the consequence it has instead. Step 6 put the derived version in the
-# Settings footer, so an operator can say WHICH build they are running; this
-# says what is IN it that was not in the one they ran last month. Both halves
-# of one question (note #3127 §5).
-#
-# Nothing here runs on a schedule and nothing auto-tags on merge. Release tags
-# are bookmarks — cut one when you will want to point at that day by name,
-# otherwise don't (note #3127 §0). FC went twelve weeks between v26.06.04.0 and
-# the next one and nothing was wrong. A schedule would turn an optional
-# bookmark back into ceremony, which is the thing this milestone is removing.
-#
-# Cutting the tag is an explicit operator action under rule 2 ("`main` — never
-# without explicit request", which since 2026-08-28 covers PR, merge and tag
-# alike). This lane only decides what happens once they do.
-#
-# Requires repo secret RELEASE_TOKEN with the `write:release` scope — the same
-# PAT build.yml uses for the ext-<version> XPI asset cache.
-
-on:
-  push:
-    tags: ['v*']
-  # So a release body can be regenerated after the fact — the publisher PATCHes
-  # an existing release rather than falling through on a conflict, so re-running
-  # this on a tag rewrites the body instead of silently keeping the first one
-  # (note #3127 §6.7).
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: 'Tag to (re)publish notes for'
-        required: true
-
-jobs:
-  changelog:
-    runs-on: python-ci
-    container:
-      image: git.fabledsword.com/bvandeusen/ci-python:3.14
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          # Load-bearing twice over: the previous release is found by walking
-          # ancestry back through the tag graph, and the cross-check against
-          # the derived web version calls artifacts.sh, which reads commit
-          # times. A shallow clone would find no previous tag and emit the
-          # entire history as the changelog — plausible-looking and wrong.
-          fetch-depth: 0
-          ref: ${{ github.event.inputs.tag || github.ref }}
-
-      # The `:c-<sha>` rollback refs are only real if `main` built this commit.
-      # The script checks that against origin/main and downgrades the claim to
-      # "unverified" when it cannot resolve one; fetching it here means that
-      # downgrade stays an actual signal instead of firing on every release.
-      - name: Make main's history resolvable
-        run: git fetch --no-tags --quiet origin +main:refs/remotes/origin/main || true
-
-      # TAG goes through the environment, not through `${{ }}` inside the
-      # run block. The value is operator-supplied, and an expression expanded
-      # into a shell line is expanded BEFORE the shell sees it — there is no
-      # quoting that makes that safe. On a tag push it is empty and the script
-      # falls back to GITHUB_REF.
-      - name: Publish the derived changelog
-        env:
-          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
-          TAG: ${{ github.event.inputs.tag }}
-        run: |
-          set -eu
-          if [ -n "${TAG:-}" ]; then
-            python3 scripts/release_notes.py "$TAG"
-          else
-            python3 scripts/release_notes.py
-          fi

Dockerfile

@@ -47,29 +47,6 @@ RUN chmod +x entrypoint.sh
 
 COPY --from=frontend-builder /build/dist ./frontend/dist
 
-# Which channel this image belongs to — `dev` or `main` (milestone 271 step 7).
-# build.yml passes it; /api/extension/manifest reports it beside the version so
-# an operator can tell which channel an install came from without the channel
-# ever touching the version string.
-#
-# Empty by default, deliberately: a locally-built image then reports NO channel
-# rather than claiming to be one, and the manifest omits the field entirely —
-# indistinguishable from an image built before the field existed, which is
-# exactly the shape every reader already has to handle.
-#
-# Declared LAST on purpose. An ARG/ENV invalidates every layer below it, and
-# these are the values that differ between builds of otherwise identical
-# source — put them any earlier and the two channels could never share a
-# cached pip install.
-#
-# FC_VERSION is what the instance reports about itself in the UI. Since
-# milestone 318 stopped publishing version image tags, that self-report is
-# the only answer to "which build is this?" — nothing else names it.
-ARG FC_CHANNEL=""
-ENV FC_CHANNEL=${FC_CHANNEL}
-ARG FC_VERSION=""
-ENV FC_VERSION=${FC_VERSION}
-
 EXPOSE 8080
 
 ENTRYPOINT ["./entrypoint.sh"]

README.md

@@ -6,50 +6,7 @@ Combines what was [ImageRepo](https://git.fabledsword.com/bvandeusen/ImageRepo)
 
 ## Status
 
-In production. `main` is continuously deployed — every merge to `main` builds
-and publishes `:latest` images, so whatever is on `main` is what is running.
-Day-to-day work happens on `dev`, which publishes `:dev` images.
-
-## Versions and tags
-
-Three image tags exist, and no others:
-
-| Tag | Branch | Meaning |
-| --- | --- | --- |
-| `:latest` | `main` | Production. Moves on every merge. |
-| `:c-<sha>` | `main` | Immutable — the rollback unit, all three images together. |
-| `:dev` | `dev` | The rolling test channel. Moves on every push. |
-
-There are deliberately **no version tags**. Nothing pins one, and a per-build
-name nobody reads is upkeep for a model FC does not run (family rule 145; the
-reasoning is note #3127 §5). Rolling back is `docker pull …:c-<sha>`.
-
-Each artifact still has a version, derived rather than chosen: the commit time
-of the newest change to that artifact's *own* shipped files, as
-`YYYY.MM.DD.HHMM` UTC (rule 148). Four artifacts, four independent versions —
-a push touching only `agent/` re-versions the agent and leaves web and ml
-alone, and CI skips the builds whose content did not move.
-
-Because no registry name carries it, the running instance's own report is the
-only answer to "which build is this?". The foot of Settings shows
-`FabledCurator 2026.08.29.0201 · dev`, and `/api/health` returns the same two
-fields.
-
-Release tags are optional bookmarks — FC went twelve weeks without one and
-nothing was wrong. Pushing `v<version>` publishes a Forgejo release listing the
-commits since the previous tag; it builds no image.
-
-## What's in here
-
-Five deployable pieces, built by `.forgejo/workflows/build.yml`:
-
-| Piece | Built from | Image | Role |
-| --- | --- | --- | --- |
-| **Web / workers** | `Dockerfile` | `fabledcurator` | Quart API + the built Vue SPA in one image. `entrypoint.sh` picks the role: `web`, `worker`, `scheduler`. The `maintenance-long` service is a second `worker` pinned to the long-running maintenance queue. |
-| **ML worker** | `Dockerfile.ml` | `fabledcurator-ml` | Same app, plus `requirements-ml.txt` — tagging and embedding models that run in-container. |
-| **GPU agent** | `agent/Dockerfile` | `fabledcurator-agent` | Optional desktop-GPU worker (`agent/`). Leases jobs over **HTTP only** — never touches the database or Redis. Run it for a burst, stop it to reclaim the card. See `agent/README.md`. |
-| **Firefox extension** | `extension/` | signed XPI | MV3 extension: pushes platform session cookies into FC and adds a creator as a Source in one click. AMO-signed on both `dev` and `main` (one signature per extension change, shared by the two channels), bundled into that channel's web image and served from Settings → Maintenance. See `extension/README.md`. |
-| **Data** | — | `pgvector/pgvector:pg16`, `redis:7-alpine` | Postgres with pgvector for embeddings; Redis as the Celery broker. |
+Pre-v1. Not yet functional.
 
 ## Quick start
 
@@ -72,42 +29,22 @@ docker compose -f docker-compose.yml up -d
 # (skips the override so containers pull registry images)
 ```
 
-The GPU agent is deployed separately, on the machine with the card —
-`agent/docker-compose.yml`, not this stack.
-
 ## Deployment posture
 
 FabledCurator is designed to run inside a self-hosted homelab environment over plain HTTP. If you want TLS, terminate it at your reverse proxy. The app does not generate certificates, redirect to HTTPS, or set HSTS.
 
 ## CI / Forgejo setup
 
-Four workflows: `ci.yml` (lint, extension-version check, backend unit tests,
-frontend build, integration), `extension.yml` (extension lint, vitest, XPI
-content verification), `build.yml` (sign + publish), and `release.yml`, which
-runs only on a `v*` tag and publishes a changelog without building anything.
+The repo's workflows expect:
 
-**The toolchain each job runs in is its `container.image`, not its `runs-on`
-label.** `runs-on: python-ci` only schedules the job onto a runner; every job
-then names the image it actually wants. `ci-requirements.md` is the current,
-authoritative list of images and per-job installs — read that rather than a
-copy here, so the two can't drift.
-
-The repo expects one secret:
-
-- **`RELEASE_TOKEN`** — a Forgejo PAT with:
+- **Runner label `python-ci`** — a Forgejo runner with Python 3.14, ruff, and Node 22 pre-installed. Both `ci.yml` and `build.yml` use this label. The runner image (`runner-base:python-ci`) is built from `CI-Runner/CI-python/` in the operator's workspace; `make push` from that directory builds and pushes a new image when toolchain pins change.
+- **Repo secret `RELEASE_TOKEN`** — a Forgejo PAT with the following scopes:
   - `write:package` + `read:package` — for `docker push` to `git.fabledsword.com`
-  - `write:release` — for the `ext-<version>` releases that cache the signed XPI
-  - `write:issue` — for issue-management automation
+  - `write:release` — for future release-cutting workflows
+  - `write:issue` — for future issue-management automation
 
   Generate at https://git.fabledsword.com/user/settings/applications. The injected `GITHUB_TOKEN` cannot be used because it lacks `write:package`.
 
-AMO signing additionally needs `MOZILLA_AMO_JWT_KEY` / `MOZILLA_AMO_JWT_SECRET`.
-It runs on **both** channels and is cached per version: because the version is
-derived from commit time, `dev` and `main` derive the same number for the same
-source, so `main` finds `dev`'s signature already cached and makes no second AMO
-call. That cache is why signing must be one-shot — AMO rejects a re-signed
-version.
-
 ## License
 
 Personal project; use at your own discretion.

agent/fc_agent/app.py

@@ -21,7 +21,7 @@ log = logging.getLogger("fc_agent.app")
 # Bump on every agent change. The page embeds this and /status reports it; the UI
 # warns to reload when they differ — so a stale browser-cached page can't be
 # mistaken for "the new image didn't deploy". (Belt-and-braces with no-store.)
-VERSION = "2026-07-17.1 · idle model-unload: after ~5 min idle the GPU models release their VRAM and reload on the next job (env IDLE_UNLOAD_SECONDS, 0=off) · sleep mode sheds to one downloader"
+VERSION = "2026-07-02.6 · sleep mode: an empty queue sheds to one downloader and backs the lease poll off to 15 min"
 
 logbuf.install()
 cfg = Config.from_env()
@@ -334,12 +334,9 @@ _PAGE = """<!doctype html><html><head><meta charset=utf-8>
   waited.textContent=s.transient||0
   // Instantaneous pool state → demoted to the sub-line, where its jumpiness reads
   // as live churn rather than a "broken" headline metric.
-  // '=== false' (not falsy) so a stale page that doesn't send models_loaded shows
-  // nothing; when the idle monitor unloads, the VRAM meter drops alongside this.
   pipe.textContent='downloaders '+(s.downloaders!=null?s.downloaders:'—')+' · consumers '+(s.consumers!=null?s.consumers:'—')+' · on GPU '+(s.active||0)
    +' · net '+(s.net_mb_s!=null?s.net_mb_s.toFixed(1):'—')+' MB/s'
    +(s.bandwidth_limit_mb_s>0?(' / cap '+s.bandwidth_limit_mb_s):'')
-   +(s.models_loaded===false?' · GPU models unloaded (idle — reload on next job)':'')
   if(document.activeElement!==bw && s.bandwidth_limit_mb_s!=null) bw.value=s.bandwidth_limit_mb_s
   // Buffer occupancy bar (also driven here so it tracks the /status cadence).
   if(s.buffer!=null && s.buffer_max){ const p=Math.round(100*s.buffer/s.buffer_max)

agent/fc_agent/config.py

@@ -51,12 +51,6 @@ class Config:
     bandwidth_limit_mb_s: float  # aggregate download cap in MEGABYTES/s across
     #                              all downloaders + video streams (0 = unlimited);
     #                              tunable live from the agent UI
-    idle_unload_seconds: float   # after this long with the GPU idle (nothing in
-    #                              flight, queue empty or Stopped), unload the
-    #                              SigLIP embedder + YOLO proposers to free their
-    #                              VRAM; they reload lazily on the next job. A
-    #                              24/7 agent otherwise squats on ~5GB doing
-    #                              nothing. 0 disables (keep models warm forever).
 
     @classmethod
     def from_env(cls) -> Config:
@@ -93,8 +87,4 @@ class Config:
             # link to ~1-1.5 MB/s per stream, browser included). Raise it (or 0)
             # from the agent UI on wired/faster networks.
             bandwidth_limit_mb_s=float(os.environ.get("BANDWIDTH_LIMIT_MB_S", "8")),
-            # 5 min: long enough that a lull between job bursts doesn't thrash the
-            # (few-second) reload, short enough that an agent left running with an
-            # empty queue hands its VRAM back promptly.
-            idle_unload_seconds=float(os.environ.get("IDLE_UNLOAD_SECONDS", "300")),
         )

agent/fc_agent/detectors.py

@@ -170,13 +170,6 @@ class YoloProposer:
             ))
         return out
 
-    def unload(self) -> None:
-        """Drop the loaded YOLO so its VRAM can be reclaimed; detect() reloads it
-        lazily on the next job. Leaves _ok untouched — a healthy proposer comes
-        back, but one that self-disabled on a fault stays off."""
-        with self._lock:
-            self._model = None
-
 
 class Proposers:
     """The agent's proposer set, built from config. Each detector is optional —
@@ -223,11 +216,3 @@ class Proposers:
 
     def panels(self, image):
         return self._top(self._panel, image, self.cfg.max_panels)
-
-    def unload(self) -> None:
-        """Release every loaded proposer's YOLO (idle VRAM reclaim). The worker
-        also drops its reference to this Proposers and rebuilds a fresh one via
-        _proposers_for on the next job, so this is belt-and-braces."""
-        for p in (self._person, self._anatomy, self._panel):
-            if p is not None:
-                p.unload()

agent/fc_agent/embedder.py

@@ -75,18 +75,3 @@ class CropEmbedder:
         pooled = out.pooler_output if hasattr(out, "pooler_output") else out
         arr = pooled.float().cpu().numpy().astype(np.float32)
         return [row.reshape(-1).tolist() for row in arr]
-
-    def unload(self) -> bool:
-        """Drop the loaded model so its VRAM can be reclaimed — the idle monitor
-        calls this after a spell with no work so an idle agent doesn't squat on
-        the card; the next embed() reloads it lazily (a few seconds). Held under
-        BOTH the load and inference locks so it can never race a concurrent load
-        or an in-flight forward pass. Returns True if a model was actually
-        released (the caller then runs one empty_cache() to hand the freed blocks
-        back to the driver)."""
-        with self._load_lock, self._infer_lock:
-            if self._model is None:
-                return False
-            self._model = None
-            self._processor = None
-            return True

agent/fc_agent/worker.py

@@ -57,15 +57,6 @@ MAX_BACKOFF_SECONDS = 60.0
 # up on their own.
 IDLE_POLL_MAX_SECONDS = 900.0
 
-# Idle VRAM reclaim (operator 2026-07-17): the SigLIP embedder + YOLO proposers
-# load lazily and then stay warm for fast job bursts — but a 24/7 agent with an
-# empty queue would otherwise squat on that VRAM (~5GB on the operator's card)
-# indefinitely while doing nothing. So a monitor unloads them after
-# cfg.idle_unload_seconds with the GPU genuinely idle (nothing in flight, buffer
-# drained); they reload lazily on the next job. This is just how often the
-# monitor wakes to check — it bounds how soon past the threshold the unload fires.
-IDLE_UNLOAD_CHECK_INTERVAL = 30.0
-
 # A job whose fetch dies transiently this many times IN ONE SESSION stops being
 # handed back and is failed instead. Transient handbacks (release) burn no
 # attempts on the server, so a poisoned transfer — an original that stalls the
@@ -277,11 +268,6 @@ class Worker:
         self._proposers_sig = None    # detector-config signature the current
         #                               proposers were built for (#134)
         self._proposers_lock = threading.Lock()
-        # Monotonic time of the last GPU activity (a consumer finishing a job).
-        # The idle monitor unloads the warm models once this goes stale by
-        # cfg.idle_unload_seconds — see _idle_unload_loop.
-        self._last_gpu_activity = time.monotonic()
-        threading.Thread(target=self._idle_unload_loop, daemon=True).start()
 
     # --- held-lease bookkeeping --------------------------------------------
     def _hold(self, job_ids) -> None:
@@ -622,9 +608,6 @@ class Worker:
             "net_mb_s": round(self._net_mb_s, 1),       # observed aggregate rate
             "bw_capped": self._bw_capped,   # autoscaler holding at the cap (UI hint)
             "idle": self._idle,             # queue empty → poll backed off (UI hint)
-            # Whether the GPU models are currently resident (False after an idle
-            # unload freed their VRAM) — a plain bool read, UI hint only.
-            "models_loaded": self._embedder is not None or self._proposers is not None,
         }
 
     def _bump(self, *, processed=0, downloaded=0, errors=0, active=0, transient=0):
@@ -805,9 +788,6 @@ class Worker:
                     self._bump(processed=1)
             finally:
                 self._bump(active=-1)
-                # Mark the GPU busy-until-now so the idle monitor starts its
-                # unload countdown from when work actually stopped, not before.
-                self._last_gpu_activity = time.monotonic()
 
     def _ensure_embedder(self, model_name: str):
         if self._embedder is not None:
@@ -865,61 +845,6 @@ class Worker:
                 self._proposers_sig = sig
             return self._proposers
 
-    def _unload_models(self) -> bool:
-        """Release the GPU-resident models (SigLIP embedder + YOLO proposers) so an
-        idle agent hands their VRAM back instead of squatting on the card. They
-        reload lazily on the next job (_ensure_embedder / _proposers_for) — a
-        few seconds' cost paid only when work actually resumes. Dropping the
-        shared instances under their build locks means a concurrent job either
-        sees the old instance (before) or rebuilds a fresh one (after); the idle
-        monitor only calls this with nothing in flight, so no inference is using
-        them. Returns True if anything was released."""
-        released = False
-        with self._embedder_lock:
-            if self._embedder is not None:
-                self._embedder.unload()
-                self._embedder = None
-                released = True
-        with self._proposers_lock:
-            if self._proposers is not None:
-                self._proposers.unload()
-                self._proposers = None
-                self._proposers_sig = None
-                released = True
-        if released:
-            try:
-                import torch
-                if torch.cuda.is_available():
-                    # torch's caching allocator holds freed blocks; hand them back
-                    # to the driver so nvidia-smi actually reflects the drop.
-                    torch.cuda.empty_cache()
-            except Exception:   # noqa: BLE001 — torch absent / CPU-only → nothing to free
-                pass
-        return released
-
-    def _idle_unload_loop(self) -> None:
-        """Unload the warm GPU models after a stretch of inactivity so a 24/7
-        agent with an empty queue doesn't hold ~5GB of VRAM doing nothing. Fires
-        only when nothing is in flight (active == 0 AND the buffer is drained) and
-        no job has completed for cfg.idle_unload_seconds — a window long enough
-        that a brief lull between bursts doesn't thrash reload/unload. Covers BOTH
-        sleep mode (queue empty, pipeline still running) and a full Stop; the
-        models reload lazily on the next job. idle_unload_seconds <= 0 disables it."""
-        idle_after = self.cfg.idle_unload_seconds
-        if idle_after <= 0:
-            return
-        while True:
-            time.sleep(IDLE_UNLOAD_CHECK_INTERVAL)
-            if self._embedder is None and self._proposers is None:
-                continue                       # nothing loaded → nothing to free
-            if self._active != 0 or not self._buffer.empty():
-                continue                       # work in flight → keep them warm
-            if time.monotonic() - self._last_gpu_activity < idle_after:
-                continue                       # not idle long enough yet
-            if self._unload_models():
-                log.info("idle %.0fs — unloaded GPU models, freed VRAM "
-                         "(reload on next job)", idle_after)
-
     def _consume(self, job: dict, frames: list, stop_evt: threading.Event) -> bool:
         """Detect + embed the decoded frames and submit the result. Returns True
         when the job was completed (→ count it processed), False otherwise: a

backend/app/api/admin.py

@@ -459,22 +459,6 @@ async def trigger_prune_missing_files():
     return _queued(async_result)
 
 
-@admin_bp.route("/maintenance/reclaim-attachments", methods=["POST"])
-async def trigger_reclaim_attachments():
-    """Reclaim orphaned attachments (#3068). Body {"dry_run": bool}: dry_run
-    (the DEFAULT here) projects the orphan rows and unreferenced store blobs
-    without touching either; dry_run=false deletes the rows then unlinks every
-    blob no surviving row references. Maintenance queue; operator-triggered
-    only — never an unattended sweep, since the apply unlinks files. Returns the
-    Celery task id — poll /maintenance/task-result/<id> for the summary."""
-    from ..tasks.admin import reclaim_orphaned_attachments_task
-
-    body = await request.get_json(silent=True) or {}
-    dry_run = bool(body.get("dry_run", True))  # default to the SAFE preview
-    async_result = reclaim_orphaned_attachments_task.delay(dry_run=dry_run)
-    return _queued(async_result)
-
-
 @admin_bp.route("/maintenance/dedup-videos", methods=["POST"])
 async def trigger_dedup_videos():
     """Tier-1 video dedup (#871). Body {"dry_run": bool}: dry_run=true previews

backend/app/api/extension.py

@@ -6,14 +6,12 @@ from __future__ import annotations
 
 import asyncio
 import hashlib
-import hmac
 import re
 from pathlib import Path
 
 from quart import Blueprint, jsonify, request
 from sqlalchemy import select
 
-from ..build_info import FC_CHANNEL as _FC_CHANNEL
 from ..extensions import get_session
 from ..models import AppSetting
 from ..services.extension_service import (
@@ -32,15 +30,6 @@ XPI_DIR = Path("/app/frontend/dist/extension")
 
 _XPI_VERSION_RE = re.compile(r"fabledcurator-(?P<version>[\w.-]+)\.xpi$")
 
-# Which channel this image belongs to — "dev" or "main" — baked in at build
-# time (milestone 271 step 7). Read from build_info rather than the environment
-# a second time: /api/health reports the same value, and two independent
-# `os.environ.get` calls are two things that can drift.
-#
-# Still bound as a module-level name here, so tests monkeypatch
-# `extension.FC_CHANNEL` exactly as they did before, same as XPI_DIR above.
-FC_CHANNEL = _FC_CHANNEL
-
 
 async def _ext_key_required(session) -> bool:
     """Unlike /api/credentials (which accepts the browser path with no
@@ -52,15 +41,7 @@ async def _ext_key_required(session) -> bool:
     stored = (await session.execute(
         select(AppSetting.value).where(AppSetting.key == "extension_api_key")
     )).scalar_one_or_none()
-    if stored is None:
-        return False
-    # compare_digest, not `==`: the stored key is a shared secret, and a
-    # short-circuiting compare leaks its prefix through timing. Costs nothing
-    # here — it is not that this route is exposed (#3072). Compared as BYTES:
-    # compare_digest's str form rejects non-ASCII with TypeError, and this
-    # header is attacker-supplied, so a str compare would turn a junk key into
-    # a 500 instead of a 403.
-    return hmac.compare_digest(supplied.encode("utf-8"), stored.encode("utf-8"))
+    return stored is not None and supplied == stored
 
 
 def _extract_version(xpi_name: str) -> str:
@@ -143,30 +124,13 @@ def _read_manifest_sync() -> dict | None:
         return None
     versioned.sort(key=lambda p: p.stat().st_mtime)
     latest = versioned[-1]
-    info = {
+    return {
         "installed": True,
         "version": _extract_version(latest.name),
         "xpi_url": f"/extension/{latest.name}",
         "latest_url": "/extension/fabledcurator-latest.xpi",
         "sha256": _sha256(latest),
     }
-    # The channel goes BESIDE the version, never inside it. A `-dev` suffix is
-    # what silently disabled the dev channel in the sibling project this design
-    # comes from: the comparator returned nothing for a non-integer segment, so
-    # every dev version compared equal and "no update available" became
-    # indistinguishable from "I cannot read this version".
-    #
-    # Omitted rather than defaulted when unset. Absence already has a meaning
-    # every reader must handle — an image built before this field existed says
-    # exactly the same thing by not having the key — so a blank channel reuses
-    # that path instead of inventing a second "unknown" spelling.
-    #
-    # Reported verbatim, not validated against {"dev", "main"}: if an image
-    # declares something else, showing what it actually claims is more useful
-    # to whoever is debugging it than dropping the value on the floor.
-    if FC_CHANNEL:
-        info["channel"] = FC_CHANNEL
-    return info
 
 
 @extension_bp.route("/manifest", methods=["GET"])

backend/app/api/gpu.py

@@ -256,7 +256,9 @@ async def lease():
         if not await _agent_authed(session):
             return jsonify({"error": "unauthorized"}), 401
         jobs = await GpuJobService(session).lease(agent_id, batch_size=batch)
-        ml = await MLSettings.load(session)
+        ml = (
+            await session.execute(select(MLSettings).where(MLSettings.id == 1))
+        ).scalar_one()
         # image rows for url/mime in one shot
         ids = [j.image_record_id for j in jobs]
         imgs = {

backend/app/api/health.py

@@ -1,20 +1,5 @@
-"""Health endpoint — no DB or Redis touch; liveness, plus the build's identity.
-
-The identity rides here rather than on a route of its own because it answers
-at the same cost: two module constants, no I/O, nothing that can be slow or
-fail. It is also already fetched app-wide — TopNav calls `refreshHealth` on
-mount — so a separate endpoint would mean a second request for two strings.
-
-Both fields are OMITTED when unset rather than sent empty. See build_info.
-"""
-
-from ..build_info import FC_CHANNEL, FC_VERSION
+"""Health endpoint — no DB or Redis touch; just liveness."""
 
 
 async def get_health():
-    body = {"status": "ok"}
-    if FC_VERSION:
-        body["version"] = FC_VERSION
-    if FC_CHANNEL:
-        body["channel"] = FC_CHANNEL
-    return body, 200
+    return {"status": "ok"}, 200

backend/app/api/ml_admin.py

@@ -4,7 +4,6 @@ from quart import Blueprint, jsonify, request
 
 from ..extensions import get_session
 from ..models import MLSettings
-from ..services.ml.heads import AUTO_APPLY_THRESHOLD_MAX, AUTO_APPLY_THRESHOLD_MIN
 
 ml_admin_bp = Blueprint("ml_admin", __name__, url_prefix="/api/ml")
 
@@ -84,21 +83,48 @@ async def embedder_models():
 
 @ml_admin_bp.route("/settings", methods=["GET"])
 async def get_settings():
+    from sqlalchemy import select
+
     async with get_session() as session:
-        s = await MLSettings.load(session)
-    # Table-driven off _EDITABLE (which PATCH also writes) so a new settings field
-    # can never be silently absent from GET — the split that historically dropped
-    # fields. _EDITABLE already includes *_DETECTOR_FIELDS.
-    return jsonify({f: getattr(s, f) for f in _EDITABLE})
+        s = (
+            await session.execute(select(MLSettings).where(MLSettings.id == 1))
+        ).scalar_one()
+    return jsonify(
+        {
+            "cpu_embed_enabled": s.cpu_embed_enabled,
+            "video_frame_interval_seconds": s.video_frame_interval_seconds,
+            "video_max_frames": s.video_max_frames,
+            "embedder_model_version": s.embedder_model_version,
+            "head_min_positives": s.head_min_positives,
+            "head_auto_apply_precision": s.head_auto_apply_precision,
+            "head_auto_apply_enabled": s.head_auto_apply_enabled,
+            "head_auto_apply_min_positives": s.head_auto_apply_min_positives,
+            "ccip_match_threshold": s.ccip_match_threshold,
+            "ccip_auto_apply_enabled": s.ccip_auto_apply_enabled,
+            "ccip_auto_apply_threshold": s.ccip_auto_apply_threshold,
+            "presentation_auto_apply_enabled": s.presentation_auto_apply_enabled,
+            "presentation_auto_apply_threshold": s.presentation_auto_apply_threshold,
+            "presentation_conflict_threshold": s.presentation_conflict_threshold,
+            "process_auto_apply_enabled": s.process_auto_apply_enabled,
+            "process_auto_apply_threshold": s.process_auto_apply_threshold,
+            "process_conflict_threshold": s.process_conflict_threshold,
+            "embedder_model_name": s.embedder_model_name,
+            **{f: getattr(s, f) for f in _DETECTOR_FIELDS},
+        }
+    )
 
 
 @ml_admin_bp.route("/settings", methods=["PATCH"])
 async def patch_settings():
+    from sqlalchemy import select
+
     body = await request.get_json()
     if not isinstance(body, dict):
         return jsonify({"error": "body must be an object"}), 400
     async with get_session() as session:
-        s = await MLSettings.load(session)
+        s = (
+            await session.execute(select(MLSettings).where(MLSettings.id == 1))
+        ).scalar_one()
 
         # Merge the patch over current values, then validate the result as a
         # whole — the store-floor invariant couples three fields, so they
@@ -128,24 +154,24 @@ def _validate(p: dict) -> str | None:
     # Head training (#114).
     if int(p["head_min_positives"]) < 1:
         return "head_min_positives must be >= 1"
-    if not (AUTO_APPLY_THRESHOLD_MIN <= float(p["head_auto_apply_precision"]) <= AUTO_APPLY_THRESHOLD_MAX):
-        return f"head_auto_apply_precision must be between {AUTO_APPLY_THRESHOLD_MIN} and {AUTO_APPLY_THRESHOLD_MAX}"
+    if not (0.5 <= float(p["head_auto_apply_precision"]) <= 0.999):
+        return "head_auto_apply_precision must be between 0.5 and 0.999"
     if int(p["head_auto_apply_min_positives"]) < 1:
         return "head_auto_apply_min_positives must be >= 1"
-    if not (AUTO_APPLY_THRESHOLD_MIN <= float(p["ccip_match_threshold"]) <= AUTO_APPLY_THRESHOLD_MAX):
-        return f"ccip_match_threshold must be between {AUTO_APPLY_THRESHOLD_MIN} and {AUTO_APPLY_THRESHOLD_MAX}"
-    if not (AUTO_APPLY_THRESHOLD_MIN <= float(p["ccip_auto_apply_threshold"]) <= AUTO_APPLY_THRESHOLD_MAX):
-        return f"ccip_auto_apply_threshold must be between {AUTO_APPLY_THRESHOLD_MIN} and {AUTO_APPLY_THRESHOLD_MAX}"
+    if not (0.5 <= float(p["ccip_match_threshold"]) <= 0.999):
+        return "ccip_match_threshold must be between 0.5 and 0.999"
+    if not (0.5 <= float(p["ccip_auto_apply_threshold"]) <= 0.999):
+        return "ccip_auto_apply_threshold must be between 0.5 and 0.999"
     # Presentation chrome auto-hide (#141). Auto-apply runs high (hiding is
     # consequential); the conflict cut is a plain probability [0,1].
-    if not (AUTO_APPLY_THRESHOLD_MIN <= float(p["presentation_auto_apply_threshold"]) <= AUTO_APPLY_THRESHOLD_MAX):
-        return f"presentation_auto_apply_threshold must be between {AUTO_APPLY_THRESHOLD_MIN} and {AUTO_APPLY_THRESHOLD_MAX}"
+    if not (0.5 <= float(p["presentation_auto_apply_threshold"]) <= 0.999):
+        return "presentation_auto_apply_threshold must be between 0.5 and 0.999"
     if not (0.0 <= float(p["presentation_conflict_threshold"]) <= 1.0):
         return "presentation_conflict_threshold must be between 0 and 1"
     # Process auto-apply (#1464). wip/editor stay VISIBLE so a false apply is
     # low-harm (excludes-from-training + a review flag), but keep the same bar.
-    if not (AUTO_APPLY_THRESHOLD_MIN <= float(p["process_auto_apply_threshold"]) <= AUTO_APPLY_THRESHOLD_MAX):
-        return f"process_auto_apply_threshold must be between {AUTO_APPLY_THRESHOLD_MIN} and {AUTO_APPLY_THRESHOLD_MAX}"
+    if not (0.5 <= float(p["process_auto_apply_threshold"]) <= 0.999):
+        return "process_auto_apply_threshold must be between 0.5 and 0.999"
     if not (0.0 <= float(p["process_conflict_threshold"]) <= 1.0):
         return "process_conflict_threshold must be between 0 and 1"
     # Embedder model swap (#1190): both must be non-empty. Changing them means a

backend/app/api/settings.py

@@ -66,9 +66,34 @@ _EXTDL_TOGGLE_FIELDS = (
 async def get_import_settings():
     async with get_session() as session:
         row = await ImportSettings.load(session)
-    # Table-driven off _EDITABLE_FIELDS (which PATCH also writes) so a new field
-    # can't be silently absent from GET.
-    return jsonify({f: getattr(row, f) for f in _EDITABLE_FIELDS})
+    return jsonify({
+        "min_width": row.min_width,
+        "min_height": row.min_height,
+        "skip_transparent": row.skip_transparent,
+        "transparency_threshold": row.transparency_threshold,
+        "skip_single_color": row.skip_single_color,
+        "single_color_threshold": row.single_color_threshold,
+        "single_color_tolerance": row.single_color_tolerance,
+        "phash_threshold": row.phash_threshold,
+        "download_rate_limit_seconds": row.download_rate_limit_seconds,
+        "download_validate_files": row.download_validate_files,
+        "download_schedule_default_seconds": row.download_schedule_default_seconds,
+        "download_event_retention_days": row.download_event_retention_days,
+        "download_failure_warning_threshold": row.download_failure_warning_threshold,
+        "series_suggest_enabled": row.series_suggest_enabled,
+        "series_suggest_threshold": row.series_suggest_threshold,
+        "extdl_mega_enabled": row.extdl_mega_enabled,
+        "extdl_gdrive_enabled": row.extdl_gdrive_enabled,
+        "extdl_mediafire_enabled": row.extdl_mediafire_enabled,
+        "extdl_dropbox_enabled": row.extdl_dropbox_enabled,
+        "extdl_pixeldrain_enabled": row.extdl_pixeldrain_enabled,
+        "translation_enabled": row.translation_enabled,
+        "interpreter_base_url": row.interpreter_base_url,
+        "translation_target_lang": row.translation_target_lang,
+        "translation_min_confidence": row.translation_min_confidence,
+        "wip_title_tagging_enabled": row.wip_title_tagging_enabled,
+        "wip_soft_title_tagging_enabled": row.wip_soft_title_tagging_enabled,
+    })
 
 
 @settings_bp.route("/settings/import", methods=["PATCH"])

backend/app/build_info.py

@@ -1,30 +0,0 @@
-"""What this build IS — stamped at image build time, not configurable.
-
-Deliberately separate from `config.py`. Those are operator settings, read from
-the environment and meant to be changed. These describe the artifact itself and
-are baked in by CI (the `FC_VERSION` / `FC_CHANNEL` build args); an operator
-setting them by hand is not a supported thing to do, it is just how a value
-gets from the build into the running process.
-
-**Absent rather than empty when unknown.** A locally-built image has no version,
-and neither did any image predating the field — one spelling of "cannot say",
-which every reader already has to handle, instead of a second one to
-special-case (note #3127 §7).
-
-**Why this matters more than it used to.** Milestone 318 stopped publishing
-version image tags, so a running instance's self-report is now the *only*
-answer to "which build is this?" — there is no registry name left to check it
-against. A wrong value here has nothing to contradict it. That is why the UI
-renders `unknown` rather than a blank or a plausible default: an empty footer
-reads as "no version", which is a different and false claim.
-
-The channel lives BESIDE the version and is never folded into it (rule 149).
-A `-dev` suffix would be parsed by the extension's comparator as a segment
-worth 0, making every dev build compare equal to every other — issue #2993's
-exact failure.
-"""
-
-import os
-
-FC_VERSION = os.environ.get("FC_VERSION", "").strip()
-FC_CHANNEL = os.environ.get("FC_CHANNEL", "").strip()

backend/app/models/__init__.py

@@ -27,7 +27,7 @@ from .patreon_seen_media import PatreonSeenMedia
 from .pixiv_failed_media import PixivFailedMedia
 from .pixiv_seen_media import PixivSeenMedia
 from .post import Post
-from .post_attachment import PostAttachment, attachment_download_url
+from .post_attachment import PostAttachment
 from .presentation_review import PresentationReview
 from .series_chapter import SeriesChapter
 from .series_page import SeriesPage
@@ -58,7 +58,6 @@ __all__ = [
     "SubscribeStarSeenMedia",
     "Post",
     "PostAttachment",
-    "attachment_download_url",
     "PresentationReview",
     "SeriesChapter",
     "SeriesPage",

backend/app/models/ml_settings.py

@@ -10,7 +10,6 @@ from sqlalchemy import (
     Integer,
     String,
     func,
-    select,
 )
 from sqlalchemy.orm import Mapped, mapped_column
 
@@ -213,14 +212,3 @@ class MLSettings(Base):
     updated_at: Mapped[datetime] = mapped_column(
         DateTime(timezone=True), nullable=False, server_default=func.now()
     )
-
-    @classmethod
-    async def load(cls, session) -> MLSettings:
-        """The singleton settings row (id=1), via an async session. Mirrors
-        ImportSettings.load — the shared singleton-loader pattern."""
-        return (await session.execute(select(cls).where(cls.id == 1))).scalar_one()
-
-    @classmethod
-    def load_sync(cls, session) -> MLSettings:
-        """The singleton settings row (id=1), via a sync session."""
-        return session.execute(select(cls).where(cls.id == 1)).scalar_one()

backend/app/models/post_attachment.py

@@ -65,15 +65,3 @@ class PostAttachment(Base):
     captured_at: Mapped[datetime] = mapped_column(
         DateTime(timezone=True), nullable=False, server_default=func.now()
     )
-
-
-def attachment_download_url(attachment_id: int) -> str:
-    """The path that streams this attachment's bytes.
-
-    Both serializers that expose an attachment to the frontend
-    (`provenance_service`, `post_feed_service`) built this literal themselves,
-    so changing the route in `api/attachments.py` meant two edits and only one
-    would be remembered (#3072). `test_attachment_download_url` pins it against
-    the app's registered rule, so the drift is caught rather than trusted to.
-    """
-    return f"/api/attachments/{attachment_id}/download"

backend/app/services/cleanup_service.py

@@ -48,47 +48,6 @@ log = logging.getLogger(__name__)
 _VIDEO_DURATION_UNKNOWN = -1.0
 
 
-# -- artist-cascade predicates (rule 93: ONE definition, preview + apply) ---
-# project_artist_cascade (preview) and delete_artist_cascade (apply) both build
-# their queries from these. The preview used to re-derive its own — which is how
-# it came to count images and stay silent about posts and attachments while the
-# apply destroyed both. Same failure shape as the 2026-06-08 fandom-tag
-# deletion, where a re-implemented delete predicate diverged from the preview's.
-# Returned as condition LISTS spread into `.where(*conds)`, matching
-# _unused_tag_conditions / _bare_post_conditions below.
-
-
-def _artist_images_conditions(artist_id: int) -> list:
-    """Images the cascade deletes (rows AND their on-disk files)."""
-    return [ImageRecord.artist_id == artist_id]
-
-
-def _artist_posts_conditions(artist_id: int) -> list:
-    """Posts the cascade destroys. The apply never names these — post.artist_id
-    is ondelete=CASCADE, so Postgres takes them when the artist row goes — which
-    is exactly why the preview has to name them: an artist whose posts are
-    body-only (no images) otherwise previews as `images: 0` and reads as an
-    empty artist, while every captured body/description/external-link set is
-    destroyed."""
-    return [Post.artist_id == artist_id]
-
-
-def _artist_attachments_conditions(artist_id: int) -> list:
-    """Attachments the cascade deletes. Matched by artist_id OR by the owning
-    post's artist: artist_id is nullable (_capture_attachment leaves it NULL
-    when no artist resolved), so neither arm alone covers every row. The
-    sha-addressed blobs are NOT unlinked (one blob backs many rows) — these are
-    row counts, and the bytes are not part of this operation's footprint."""
-    return [
-        or_(
-            PostAttachment.artist_id == artist_id,
-            PostAttachment.post_id.in_(
-                select(Post.id).where(*_artist_posts_conditions(artist_id))
-            ),
-        )
-    ]
-
-
 def project_artist_cascade(session: Session, *, slug: str) -> dict:
     """Read-only projection of what delete_artist_cascade would touch.
 
@@ -97,17 +56,12 @@ def project_artist_cascade(session: Session, *, slug: str) -> dict:
           "artist": {"id": int, "name": str, "slug": str},
           "projected": {
             "images": int,
-            "posts": int,         # hard-deleted by the post.artist_id CASCADE
-            "attachments": int,   # rows deleted; the sha-addressed blobs stay
             "sources": int,
             "thumbs": int,        # images with a thumbnail_path set
             "import_tasks": int,  # ImportTask rows referencing the artist's images
             "bytes_on_disk": int, # SUM(image_record.size_bytes) — column is NOT NULL
           },
         }
-    Every count is built from the shared `_artist_*_conditions` predicates the
-    apply uses, so the two halves cannot drift (rule 93).
-
     Raises LookupError if slug not found. No mutations.
     """
     from ..models.import_task import ImportTask
@@ -119,49 +73,36 @@ def project_artist_cascade(session: Session, *, slug: str) -> dict:
     if artist is None:
         raise LookupError(f"artist slug not found: {slug!r}")
 
-    images_conds = _artist_images_conditions(artist.id)
-
     images_count = session.execute(
-        select(func.count(ImageRecord.id)).where(*images_conds)
+        select(func.count(ImageRecord.id))
+        .where(ImageRecord.artist_id == artist.id)
     ).scalar_one()
-    posts_count = session.execute(
-        select(func.count(Post.id))
-        .where(*_artist_posts_conditions(artist.id))
-    ).scalar_one()
-    attachments_count = session.execute(
-        select(func.count(PostAttachment.id))
-        .where(*_artist_attachments_conditions(artist.id))
-    ).scalar_one()
-    # Sources have no shared predicate: the apply never queries them either, it
-    # gets them from the Artist.sources ORM cascade. Counted directly here.
     sources_count = session.execute(
         select(func.count(Source.id))
         .where(Source.artist_id == artist.id)
     ).scalar_one()
     thumbs_count = session.execute(
         select(func.count(ImageRecord.id))
-        .where(*images_conds)
+        .where(ImageRecord.artist_id == artist.id)
         .where(ImageRecord.thumbnail_path.is_not(None))
     ).scalar_one()
     import_tasks_count = session.execute(
         select(func.count(ImportTask.id))
         .where(
             ImportTask.result_image_id.in_(
-                select(ImageRecord.id).where(*images_conds)
+                select(ImageRecord.id).where(ImageRecord.artist_id == artist.id)
             )
         )
     ).scalar_one()
     bytes_on_disk = session.execute(
         select(func.coalesce(func.sum(ImageRecord.size_bytes), 0))
-        .where(*images_conds)
+        .where(ImageRecord.artist_id == artist.id)
     ).scalar_one()
 
     return {
         "artist": {"id": artist.id, "name": artist.name, "slug": artist.slug},
         "projected": {
             "images": images_count,
-            "posts": posts_count,
-            "attachments": attachments_count,
             "sources": sources_count,
             "thumbs": thumbs_count,
             "import_tasks": import_tasks_count,
@@ -336,10 +277,6 @@ def delete_artist_cascade(
     series_page / tag_suggestion_rejection from ImageRecord delete,
     and source / post / download_event / etc. from Artist delete
     (via Artist.sources cascade="all, delete-orphan").
-
-    The artist's post_attachment rows are cleared EXPLICITLY before the
-    artist row goes — see the comment at that step; leaving them to the
-    cascade aborts the whole delete on a unique violation.
     """
     artist = session.get(Artist, artist_id)
     if artist is None:
@@ -350,22 +287,11 @@ def delete_artist_cascade(
                 "files_deleted": 0,
                 "thumbs_deleted": 0,
                 "import_tasks_nulled": 0,
-                "posts_deleted": 0,
-                "attachments_deleted": 0,
                 "files_failed": 0,
             },
         }
     artist_info = {"id": artist.id, "name": artist.name, "slug": artist.slug}
 
-    # Counted BEFORE the delete: Postgres takes these via the post.artist_id
-    # CASCADE when the artist row goes, so afterwards there is nothing left to
-    # count. Reported so the summary can be checked against the preview's
-    # `posts` — the parity rule 93 asks for is only testable if both halves
-    # actually state the number.
-    posts_deleted = session.execute(
-        select(func.count(Post.id)).where(*_artist_posts_conditions(artist.id))
-    ).scalar_one()
-
     images_deleted = 0
     files_deleted = 0
     thumbs_deleted = 0
@@ -374,7 +300,7 @@ def delete_artist_cascade(
     while True:
         rows = session.execute(
             select(ImageRecord)
-            .where(*_artist_images_conditions(artist.id))
+            .where(ImageRecord.artist_id == artist.id)
             .limit(500)
         ).scalars().all()
         if not rows:
@@ -397,28 +323,6 @@ def delete_artist_cascade(
     # source_path_prefix matching that's out of scope here.
     import_tasks_nulled = 0
 
-    # Clear the artist's attachments BEFORE the artist row, or the delete below
-    # aborts. Deleting an artist CASCADEs to Post (post.artist_id is
-    # ondelete=CASCADE), which SET NULLs post_attachment.post_id — and
-    # `uq_post_attachment_null_post_sha` is a partial UNIQUE on sha256 ALONE
-    # WHERE post_id IS NULL, so any two of this artist's attachments sharing a
-    # sha collapse onto one another and raise. That is an ORDINARY shape, not a
-    # corrupt one: _capture_attachment deliberately writes one row per post over
-    # a single sha-addressed blob (a creator who attaches the same pdf to two
-    # posts has two rows), and a pre-existing filesystem-import row with the same
-    # sha and a NULL post_id collides on its own. Migration 0043 reasoned only
-    # about upgrade-time safety and never about this later SET NULL.
-    # _repoint_post_links guards the identical collision class in the reconcile
-    # path; this is its artist-cascade counterpart.
-    #
-    # Which rows count as the artist's — and why the blobs are left on disk —
-    # is _artist_attachments_conditions, shared with the preview.
-    attachments_deleted = session.execute(
-        delete(PostAttachment)
-        .where(*_artist_attachments_conditions(artist.id))
-    ).rowcount or 0
-    session.commit()
-
     session.delete(artist)
     session.commit()
 
@@ -429,8 +333,6 @@ def delete_artist_cascade(
             "files_deleted": files_deleted,
             "thumbs_deleted": thumbs_deleted,
             "import_tasks_nulled": import_tasks_nulled,
-            "posts_deleted": posts_deleted,
-            "attachments_deleted": attachments_deleted,
             "files_failed": files_failed,
         },
     }
@@ -1592,155 +1494,3 @@ def purge_gated_previews(
         "ledger_cleared": ledger_cleared,
         "posts_deleted": posts_deleted,
     }
-
-
-# -- orphaned attachment reclamation ---------------------------------------
-# PostAttachment's two FKs are both ON DELETE SET NULL, so a deleted post or
-# artist leaves the row behind rather than taking it. Nothing ever pruned those
-# rows, and nothing has ever unlinked a file under the attachment store — so
-# both rows and bytes accumulated permanently and were invisible to every
-# existing diagnostic.
-#
-# Why this is a DISK->DB reconciliation rather than a row sweep: the store is
-# sha-addressed and idempotent (attachment_store.store), so ONE blob backs MANY
-# rows. Deleting a row therefore does not free its blob, and — since the artist
-# cascade now deletes its attachment rows outright — a freed blob has no DB
-# pointer left to find it by. Walking the store and asking "does any row still
-# reference this sha?" catches orphans from every cause, including ones no
-# future delete path will think to report.
-
-# A blob is written by attachment_store.store BEFORE its row is inserted and
-# committed, so a just-stored file legitimately has no referencing row for a
-# moment. Same guard, same reasoning as ORPHAN_TEMP_MIN_AGE_HOURS in
-# tasks/maintenance.py: never judge a file younger than this.
-_ATTACHMENT_ORPHAN_MIN_AGE_HOURS = 6
-
-# Wall-clock budget for the store walk (rule 89). A library with a large
-# attachment store shouldn't be able to run this past its soft time limit; on
-# exhaustion it reports partial=True and the operator re-runs to finish.
-_ATTACHMENT_RECLAIM_BUDGET_SECONDS = 900
-
-# The store names files `<sha256><ext>`. Parse the sha as the first 64 chars
-# rather than via Path.stem: store() takes the extension straight from the
-# source filename, and a URL-encoded basename yields a multi-dot "suffix"
-# (see [[reference_url_encoded_basename_suffix]]) that would make stem eat part
-# of the sha. Validating the 64 chars as hex also skips anything else in the
-# tree that isn't a stored blob.
-_SHA256_HEX_LEN = 64
-
-
-def _orphan_attachment_conditions() -> list:
-    """PostAttachment rows belonging to nothing: both FKs nulled by a deleted
-    post AND a deleted artist. A row with post_id NULL but an artist_id is the
-    deliberate filesystem-import case (importer._capture_attachment writes it
-    that way) and is NOT an orphan — it is still attributed."""
-    return [
-        PostAttachment.post_id.is_(None),
-        PostAttachment.artist_id.is_(None),
-    ]
-
-
-def _is_sha_named(name: str) -> bool:
-    """True when `name` starts with a 64-char lowercase-hex sha256."""
-    if len(name) < _SHA256_HEX_LEN:
-        return False
-    head = name[:_SHA256_HEX_LEN]
-    return all(c in "0123456789abcdef" for c in head)
-
-
-def reclaim_orphaned_attachments(
-    session: Session, *, images_root: Path, dry_run: bool = False,
-) -> dict:
-    """Prune unattributed PostAttachment rows, then unlink store blobs that no
-    surviving row references.
-
-    Returns (same discovery keys either way, so the UI renders one shape):
-        {"rows": int,            # orphan rows found / deleted
-         "files": int,           # unreferenced blobs found / unlinked
-         "bytes": int,           # their total size
-         "scanned": int,         # blobs examined
-         "skipped_recent": int,  # blobs under the min-age guard
-         "files_failed": int,    # unlink raised (apply only)
-         "partial": bool}        # walk hit the time budget
-
-    dry_run computes exactly what the apply would do and mutates nothing — the
-    surviving-sha set is derived by NEGATING the same orphan predicate the
-    delete uses, so the preview cannot disagree with the apply (rule 93).
-    """
-    started = time.monotonic()
-    orphan_conds = _orphan_attachment_conditions()
-
-    if dry_run:
-        rows = session.execute(
-            select(func.count(PostAttachment.id)).where(*orphan_conds)
-        ).scalar_one()
-    else:
-        rows = session.execute(
-            delete(PostAttachment).where(*orphan_conds)
-        ).rowcount or 0
-        session.commit()
-
-    # Shas that still have a home. In the apply path the orphan rows are already
-    # gone, so `NOT orphan` is redundant but harmless; in the dry-run path it is
-    # what makes the projection honest about blobs the delete would free. One
-    # predicate, one query, both modes.
-    surviving_shas = set(session.execute(
-        select(PostAttachment.sha256).where(~and_(*orphan_conds)).distinct()
-    ).scalars())
-
-    root = Path(images_root) / "attachments"
-    cutoff = (
-        datetime.now(UTC).timestamp()
-        - _ATTACHMENT_ORPHAN_MIN_AGE_HOURS * 3600
-    )
-    files = 0
-    freed_bytes = 0
-    scanned = 0
-    skipped_recent = 0
-    files_failed = 0
-    partial = False
-
-    if root.is_dir():
-        for path in root.rglob("*"):
-            if time.monotonic() - started >= _ATTACHMENT_RECLAIM_BUDGET_SECONDS:
-                partial = True
-                break
-            # .partial staging files belong to cleanup_orphaned_temp_files —
-            # leave them alone rather than racing an in-flight store().
-            if path.suffix in (".part", ".partial") or not path.is_file():
-                continue
-            if not _is_sha_named(path.name):
-                continue
-            scanned += 1
-            sha = path.name[:_SHA256_HEX_LEN]
-            if sha in surviving_shas:
-                continue
-            try:
-                st = path.stat()
-                if st.st_mtime >= cutoff:
-                    skipped_recent += 1
-                    continue
-                size = st.st_size
-                if not dry_run:
-                    path.unlink()
-                files += 1
-                freed_bytes += size
-            except OSError as exc:
-                files_failed += 1
-                log.warning("reclaim_orphaned_attachments: %s: %s", path, exc)
-
-    if not dry_run and (rows or files):
-        log.info(
-            "attachment reclaim: %d orphan row(s) deleted, %d blob(s) unlinked "
-            "(%d bytes), %d failed, partial=%s",
-            rows, files, freed_bytes, files_failed, partial,
-        )
-    return {
-        "rows": rows,
-        "files": files,
-        "bytes": freed_bytes,
-        "scanned": scanned,
-        "skipped_recent": skipped_recent,
-        "files_failed": files_failed,
-        "partial": partial,
-    }

backend/app/services/credential_service.py

@@ -181,7 +181,7 @@ def _augment_cookies(platform: str, netscape: str) -> str:
     """Delegate to the platform's `augment_cookies` hook if one is
     registered (subscribestar, hentaifoundry, etc. — see
     `services/platforms/<name>.py`). No-op when the platform doesn't
-    register a hook (Patreon, Discord). Centralizing the
+    register a hook (Patreon, DeviantArt). Centralizing the
     quirks-per-platform in the platforms package means adding a new
     platform's cookie quirks doesn't require touching this file."""
     info = PLATFORMS.get(platform)

backend/app/services/download_backends.py

@@ -31,8 +31,9 @@ from .pixiv_ingester import PixivIngester
 from .subscribestar_ingester import SubscribeStarIngester
 
 # Platforms whose download + verify go through the native ingester rather than
-# gallery-dl. gallery-dl still serves the rest (hentaifoundry, discord) until
-# they migrate too.
+# gallery-dl. gallery-dl still serves the rest (hentaifoundry, discord,
+# deviantart — the latter slated for retirement, not migration) until they
+# migrate too.
 NATIVE_INGESTER_PLATFORMS = frozenset({"patreon", "subscribestar", "pixiv"})
 
 # Mirrors patreon_resolver._CAMPAIGNS_URL — surfaced in resolution-failure

backend/app/services/extension_service.py

@@ -55,6 +55,12 @@ _PLATFORM_PATTERNS: list[tuple[str, re.Pattern[str]]] = [
         r"^https?://(?:www\.)?hentai-foundry\.com/user/(?P<slug>[^/?#]+)",
         re.IGNORECASE,
     )),
+    ("deviantart", re.compile(
+        r"^https?://(?:www\.)?deviantart\.com/"
+        r"(?!home$|watch\b|tag\b|browse\b)"
+        r"(?P<slug>[^/?#]+)/?$",
+        re.IGNORECASE,
+    )),
     ("pixiv", re.compile(
         r"^https?://(?:www\.)?pixiv\.net/(?:en/)?users/(?P<slug>\d+)",
         re.IGNORECASE,

backend/app/services/gallery_dl.py

@@ -299,9 +299,8 @@ class GalleryDLService:
     # (services/patreon_ingester.py), not gallery-dl.
     PLATFORM_DEFAULTS = {
         # subscribestar removed — native-ingester platform now (#71); pixiv
-        # removed likewise (#129); deviantart removed at #3069 as a dropped
-        # platform, not a migrated one. The remaining entries are the
-        # gallery-dl platforms not yet migrated.
+        # removed likewise (#129). The remaining entries are the gallery-dl
+        # platforms not yet migrated.
         "hentaifoundry": {
             "content_types": ["all"],
             "directory": [],
@@ -317,6 +316,15 @@ class GalleryDLService:
             "reactions": False,
             "threads": True,
         },
+        "deviantart": {
+            "content_types": ["all"],
+            "directory": [],
+            "filename": "{index:>03}_{title[:50]}.{extension}",
+            "flat": True,
+            "original": True,
+            "mature": True,
+            "metadata": True,
+        },
     }
 
     def __init__(

backend/app/services/image_tag_apply.py

@@ -1,51 +0,0 @@
-"""Bulk, idempotent writes to the ``image_tag`` association table.
-
-Three writers attach tags to images in bulk: the WIP-title backfill
-(`wip_title.apply_wip_image_tags`), the concept-head auto-apply sweep and the
-system-tag auto-apply sweep (both in `ml/heads.py`). The two sweeps used to
-issue ONE INSERT PER ROW from inside their per-image loop — fine in steady
-state, but a first pass over a back-catalogue is tens of thousands of
-individual round-trips (#3072). All three share this one chunked multi-row
-insert now.
-
-Sync only: every caller runs on a sync ``Session`` (the Celery task path). No
-async service writes image_tag in bulk, so there is no async sibling to keep in
-step — unlike `db_helpers.get_or_create`, which does have one.
-"""
-
-from __future__ import annotations
-
-from sqlalchemy.dialects.postgresql import insert as pg_insert
-from sqlalchemy.orm import Session
-
-from ..models.tag import image_tag
-
-# 5000 rows x 3 bound params = 15000, comfortably inside Postgres' 65535-param
-# ceiling for a single statement. Raising this past ~21000 rows would exceed it.
-INSERT_CHUNK = 5000
-
-
-def insert_image_tags(
-    session: Session, rows: list[dict], *, chunk: int = INSERT_CHUNK
-) -> None:
-    """Attach ``rows`` to their images, skipping any tag already on one.
-
-    Each row is ``{"image_record_id": int, "tag_id": int, "source": str}``.
-    Does NOT commit — the caller owns the transaction.
-
-    ON CONFLICT DO NOTHING against the (image_record_id, tag_id) primary key,
-    so an existing tag keeps its ORIGINAL ``source``: re-running a sweep can
-    never re-stamp a tag the operator applied by hand as machine-applied.
-
-    Returns nothing on purpose. psycopg reports ``rowcount`` -1 for a multi-row
-    ON CONFLICT DO NOTHING insert (it runs via an executemany path), so a count
-    taken from the statement would be a lie rather than an approximation.
-    Callers that need an accurate count derive it themselves — see
-    `wip_title.apply_wip_image_tags`' pre-SELECT, and the sweeps' `skip` sets.
-    """
-    for start in range(0, len(rows), chunk):
-        session.execute(
-            pg_insert(image_tag)
-            .values(rows[start:start + chunk])
-            .on_conflict_do_nothing(index_elements=["image_record_id", "tag_id"])
-        )

backend/app/services/ml/character_prototypes.py

@@ -150,7 +150,9 @@ def refresh_character_prototypes(
     """Incrementally refresh the prototype store. `full=True` rebuilds every
     character regardless of the gate/fingerprints (nightly reconcile). Returns
     {skipped, rebuilt, removed}; commits."""
-    settings = MLSettings.load_sync(session)
+    settings = session.execute(
+        select(MLSettings).where(MLSettings.id == 1)
+    ).scalar_one()
     sig = _global_signature(session)
     if not full and settings.ccip_ref_signature == sig:
         return {"skipped": True, "rebuilt": 0, "removed": 0}
@@ -202,7 +204,9 @@ def retract_auto_applied_ccip(session: Session) -> int:
     n_retracted."""
     import numpy as np
 
-    settings = MLSettings.load_sync(session)
+    settings = session.execute(
+        select(MLSettings).where(MLSettings.id == 1)
+    ).scalar_one()
     if not settings.ccip_auto_apply_enabled:
         return 0
     thr = float(settings.ccip_auto_apply_threshold)

backend/app/services/ml/heads.py

@@ -23,7 +23,6 @@ from datetime import UTC, datetime
 from typing import Any
 
 from sqlalchemy import delete, exists, func, select
-from sqlalchemy.dialects.postgresql import insert as pg_insert
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy.orm import Session
 
@@ -41,10 +40,8 @@ from ...models import (
     TagSuggestionRejection,
 )
 from ...models.tag import CHROME_SYSTEM_TAGS, PROCESS_SYSTEM_TAGS, image_tag
-from ..image_tag_apply import insert_image_tags
 from .training_data import (
     _AUTO_SOURCES,
-    _applied_or_rejected,
     _auto_apply_point,
     _hygiene_excluded_ids,
     _ids_with_tag,
@@ -64,14 +61,6 @@ MIN_POSITIVES_FLOOR = 8     # hard floor; settings.head_min_positives can raise
 _UNLABELED_POOL = 4000
 _EXAMPLES_MIN = 8           # need at least this many embedded +/- to fit a head
 
-# Auto-apply / match confidence operating range. Every graduated auto-apply or
-# CCIP-match threshold the operator can set lives in this band, and the head
-# precision target is clamped to it: below 0.5 "auto-apply" is meaningless, and
-# 1.0 is unachievable so 0.999 is the ceiling. One source shared by the service
-# clamp (_normalize_params) and the API validator (ml_admin._validate).
-AUTO_APPLY_THRESHOLD_MIN = 0.5
-AUTO_APPLY_THRESHOLD_MAX = 0.999
-
 # Only these tag kinds get heads (the surfaced suggestion categories).
 _HEAD_KINDS = (TagKind.general, TagKind.character)
 # tag.kind -> the suggestion category the rail groups under.
@@ -89,38 +78,6 @@ _CATEGORY = {TagKind.general: "general", TagKind.character: "character"}
 _SYSTEM_TAG_SUGGEST_FLOOR = 0.65
 
 
-def _sigmoid(z, np):
-    """Logistic sigmoid 1/(1+e^-z): the head score→probability transform. One home
-    for what was inlined at every scoring site (suggest, both sweeps, retract)."""
-    return 1.0 / (1.0 + np.exp(-z))
-
-
-def _conflict_scores(Xn, Wc, bc, np):
-    """The presentation conflict signal (#141): per row, the MAX content-head
-    probability and WHICH head produced it. Shared by the system-tag sweep's guard-2
-    and the soft-wip audit — both ask "does this ALSO look like real content?"."""
-    cprobs = _sigmoid(Xn @ Wc.T + bc, np)
-    return cprobs.max(axis=1), cprobs.argmax(axis=1)
-
-
-def _insert_presentation_review(
-    session, *, image_record_id, tag_id, conflict_tag_id, conflict_score, mode,
-):
-    """Single-source the ring-loud PresentationReview row shape so the two writers
-    (system-tag sweep guard-2 + soft-wip audit) can't drift on columns or `mode` —
-    they share the (image_record_id, tag_id) composite PK, so a divergent `mode`
-    would be a silent first-writer-wins bug."""
-    session.execute(
-        pg_insert(PresentationReview)
-        .values(
-            image_record_id=image_record_id, tag_id=tag_id,
-            conflict_tag_id=conflict_tag_id, conflict_score=conflict_score,
-            mode=mode,
-        )
-        .on_conflict_do_nothing()
-    )
-
-
 class HeadTrainingAlreadyRunning(Exception):
     """Raised by start_head_training_run when a run is already in flight."""
 
@@ -146,7 +103,9 @@ def start_head_training_run(session: Session, params: dict[str, Any]) -> int:
 
 
 def _settings(session: Session) -> MLSettings:
-    return MLSettings.load_sync(session)
+    return session.execute(
+        select(MLSettings).where(MLSettings.id == 1)
+    ).scalar_one()
 
 
 def _normalize_params(session: Session, params: dict[str, Any] | None) -> dict[str, Any]:
@@ -165,7 +124,7 @@ def _normalize_params(session: Session, params: dict[str, Any] | None) -> dict[s
     except (TypeError, ValueError):
         cv_folds = DEFAULT_CV_FOLDS
     try:
-        precision_target = min(max(float(params.get("precision_target", s.head_auto_apply_precision)), AUTO_APPLY_THRESHOLD_MIN), AUTO_APPLY_THRESHOLD_MAX)
+        precision_target = min(max(float(params.get("precision_target", s.head_auto_apply_precision)), 0.5), 0.999)
     except (TypeError, ValueError):
         precision_target = s.head_auto_apply_precision
     return {
@@ -577,7 +536,7 @@ async def score_image(
     norms[norms == 0] = 1.0
     Xn = X / norms
     Z = Xn @ heads["W"].T + heads["b"]                  # (B, H)
-    probs_bag = _sigmoid(Z, np)                         # (B, H)
+    probs_bag = 1.0 / (1.0 + np.exp(-Z))                # (B, H)
     probs = probs_bag.max(axis=0)                       # (H,) best over the bag
     # ARGMAX beside the max: WHICH bag row won each head → the region that grounds
     # the tag (bag_meta[win]); None when the whole-image vector won (#1206).
@@ -655,7 +614,9 @@ async def ground_applied_tag(
 
 
 async def _settings_async(session: AsyncSession) -> MLSettings:
-    return await MLSettings.load(session)
+    return (
+        await session.execute(select(MLSettings).where(MLSettings.id == 1))
+    ).scalar_one()
 
 
 # --- Earned auto-apply (sync, ml worker) ---------------------------------
@@ -726,6 +687,7 @@ def auto_apply_sweep(
     embeddings in chunks; commits per chunk on a real run. Returns
     {n_applied, concepts:[{tag_id,name,applied,scanned,threshold}]}."""
     import numpy as np
+    from sqlalchemy.dialects.postgresql import insert as pg_insert
 
     settings = _settings(session)
     rows = _auto_apply_heads(
@@ -742,7 +704,18 @@ def auto_apply_sweep(
     names = [r.name for r in rows]
 
     # Skip images that already carry, or have rejected, each tag.
-    skip = _applied_or_rejected(session, tag_ids)
+    skip = {tid: set() for tid in tag_ids}
+    for tid in tag_ids:
+        for (iid,) in session.execute(
+            select(image_tag.c.image_record_id).where(image_tag.c.tag_id == tid)
+        ):
+            skip[tid].add(iid)
+        for (iid,) in session.execute(
+            select(TagSuggestionRejection.image_record_id).where(
+                TagSuggestionRejection.tag_id == tid
+            )
+        ):
+            skip[tid].add(iid)
 
     applied = [0] * len(rows)
     scanned = 0
@@ -756,12 +729,8 @@ def auto_apply_sweep(
         if not cids:
             continue
         Xn = _l2norm(np.vstack([emb[i] for i in cids]).astype(np.float32), np)
-        probs = _sigmoid(Xn @ W.T + b, np)              # (N, H)
+        probs = 1.0 / (1.0 + np.exp(-(Xn @ W.T + b)))   # (N, H)
         scanned += len(cids)
-        # Collected across every head, then written as ONE insert below. Was an
-        # insert per applied tag from inside this loop, which on a first sweep
-        # over a back-catalogue is tens of thousands of round-trips (#3072).
-        pending: list[dict] = []
         for h in range(len(rows)):
             tid = tag_ids[h]
             for idx in np.where(probs[:, h] >= thr[h])[0]:
@@ -771,12 +740,12 @@ def auto_apply_sweep(
                 skip[tid].add(iid)
                 applied[h] += 1
                 if not dry_run:
-                    pending.append({
-                        "image_record_id": iid, "tag_id": tid,
-                        "source": "head_auto",
-                    })
+                    session.execute(
+                        pg_insert(image_tag)
+                        .values(image_record_id=iid, tag_id=tid, source="head_auto")
+                        .on_conflict_do_nothing()
+                    )
         if not dry_run:
-            insert_image_tags(session, pending)
             session.commit()
         run.last_progress_at = datetime.now(UTC)
         session.commit()
@@ -871,6 +840,7 @@ def system_tag_auto_apply_sweep(
     enabled flag is set. numpy-only (no sklearn). Returns {n_applied, n_flagged,
     concepts}."""
     import numpy as np
+    from sqlalchemy.dialects.postgresql import insert as pg_insert
 
     cfg = _SWEEP_MODES[mode]
     settings = _settings(session)
@@ -899,7 +869,18 @@ def system_tag_auto_apply_sweep(
     valued = _valued_image_ids(session)
 
     # Skip images that already carry, or have rejected, each presentation tag.
-    skip = _applied_or_rejected(session, pres_tag_ids)
+    skip = {tid: set() for tid in pres_tag_ids}
+    for tid in pres_tag_ids:
+        for (iid,) in session.execute(
+            select(image_tag.c.image_record_id).where(image_tag.c.tag_id == tid)
+        ):
+            skip[tid].add(iid)
+        for (iid,) in session.execute(
+            select(TagSuggestionRejection.image_record_id).where(
+                TagSuggestionRejection.tag_id == tid
+            )
+        ):
+            skip[tid].add(iid)
 
     applied = [0] * len(pres)
     n_flagged = 0
@@ -914,15 +895,12 @@ def system_tag_auto_apply_sweep(
         if not cids:
             continue
         Xn = _l2norm(np.vstack([emb[i] for i in cids]).astype(np.float32), np)
-        probs = _sigmoid(Xn @ Wp.T + bp, np)                  # (N, P)
+        probs = 1.0 / (1.0 + np.exp(-(Xn @ Wp.T + bp)))       # (N, P)
         if Wc is not None:
-            max_c, arg_c = _conflict_scores(Xn, Wc, bc, np)   # (N,), (N,)
+            cprobs = 1.0 / (1.0 + np.exp(-(Xn @ Wc.T + bc)))  # (N, C)
+            max_c = cprobs.max(axis=1)
+            arg_c = cprobs.argmax(axis=1)
         scanned += len(cids)
-        # Same batching as auto_apply_sweep (#3072): collect the chunk's rows
-        # and write them once, below. The PresentationReview rows stay per-row —
-        # they FK to image_record/tag, not to image_tag, so writing the tags
-        # after them is safe, and a flagged conflict is rare by construction.
-        pending: list[dict] = []
         for p in range(len(pres)):
             tid = pres_tag_ids[p]
             for idx in np.where(probs[:, p] >= thr)[0]:
@@ -932,25 +910,31 @@ def system_tag_auto_apply_sweep(
                 skip[tid].add(iid)
                 applied[p] += 1
                 if not dry_run:
-                    pending.append({
-                        "image_record_id": iid, "tag_id": tid,
-                        "source": source,
-                    })
+                    session.execute(
+                        pg_insert(image_tag)
+                        .values(
+                            image_record_id=iid, tag_id=tid,
+                            source=source,
+                        )
+                        .on_conflict_do_nothing()
+                    )
                 # Guard 2: also looks like real content → still apply, but flag it
                 # for the review strip instead of silently marking (chrome hides,
                 # process stays visible — either way the operator gets a heads-up).
                 if Wc is not None and float(max_c[idx]) >= conflict_thr:
                     n_flagged += 1
                     if not dry_run:
-                        _insert_presentation_review(
-                            session,
-                            image_record_id=iid, tag_id=tid,
-                            conflict_tag_id=conf_tag_ids[int(arg_c[idx])],
-                            conflict_score=float(max_c[idx]),
-                            mode=mode,
+                        session.execute(
+                            pg_insert(PresentationReview)
+                            .values(
+                                image_record_id=iid, tag_id=tid,
+                                conflict_tag_id=conf_tag_ids[int(arg_c[idx])],
+                                conflict_score=float(max_c[idx]),
+                                mode=mode,
+                            )
+                            .on_conflict_do_nothing()
                         )
         if not dry_run:
-            insert_image_tags(session, pending)
             session.commit()
 
     concepts = [
@@ -972,6 +956,7 @@ def soft_wip_conflict_audit(session: Session, dry_run: bool = False) -> dict:
     NOT remove the tag; the operator decides. No-op when there are no content heads.
     numpy-only. Returns {n_scanned, n_flagged}."""
     import numpy as np
+    from sqlalchemy.dialects.postgresql import insert as pg_insert
 
     from ..wip_title import WIP_TITLE_SOFT_SOURCE, resolve_wip_tag_id
 
@@ -1008,17 +993,22 @@ def soft_wip_conflict_audit(session: Session, dry_run: bool = False) -> dict:
             continue
         scanned += len(cids)
         Xn = _l2norm(np.vstack([emb[i] for i in cids]).astype(np.float32), np)
-        max_c, arg_c = _conflict_scores(Xn, Wc, bc, np)
+        cprobs = 1.0 / (1.0 + np.exp(-(Xn @ Wc.T + bc)))
+        max_c = cprobs.max(axis=1)
+        arg_c = cprobs.argmax(axis=1)
         for k in range(len(cids)):
             if float(max_c[k]) >= conflict_thr:
                 n_flagged += 1
                 if not dry_run:
-                    _insert_presentation_review(
-                        session,
-                        image_record_id=cids[k], tag_id=wip_id,
-                        conflict_tag_id=conf_tag_ids[int(arg_c[k])],
-                        conflict_score=float(max_c[k]),
-                        mode="process",
+                    session.execute(
+                        pg_insert(PresentationReview)
+                        .values(
+                            image_record_id=cids[k], tag_id=wip_id,
+                            conflict_tag_id=conf_tag_ids[int(arg_c[k])],
+                            conflict_score=float(max_c[k]),
+                            mode="process",
+                        )
+                        .on_conflict_do_nothing()
                     )
         if not dry_run:
             session.commit()
@@ -1072,7 +1062,7 @@ def retract_auto_applied_heads(session: Session) -> int:
             continue
         Xn = _l2norm(np.vstack([emb[i] for i in cids]).astype(np.float32), np)
         w = np.asarray(weights, dtype=np.float32)
-        probs = _sigmoid(Xn @ w + float(bias), np)
+        probs = 1.0 / (1.0 + np.exp(-(Xn @ w + float(bias))))
         below = [cids[k] for k in np.where(probs < float(thr))[0]]
         for iid in below:
             session.execute(

backend/app/services/ml/training_data.py

@@ -94,24 +94,6 @@ def _rejected_ids(session: Session, tag_id: int) -> list[int]:
     ]
 
 
-def _applied_or_rejected(session: Session, tag_ids) -> dict[int, set[int]]:
-    """Per-tag skip set for the auto-apply sweeps: every image that ALREADY carries
-    the tag (ANY source — not just training positives) OR has rejected it. A sweep
-    never re-applies to these. Shared by auto_apply_sweep + system_tag_auto_apply_sweep
-    (heads.py) and scheduled_ccip_auto_apply (tasks/ml.py). Callers mutate the returned
-    sets in-place to also dedupe within a single run."""
-    skip: dict[int, set[int]] = {}
-    for tid in tag_ids:
-        ids = {
-            r[0] for r in session.execute(
-                select(image_tag.c.image_record_id).where(image_tag.c.tag_id == tid)
-            ).all()
-        }
-        ids.update(_rejected_ids(session, tid))
-        skip[tid] = ids
-    return skip
-
-
 def _sample_unlabeled(session: Session, exclude: set[int], limit: int) -> list[int]:
     """Random image ids (with an embedding) NOT carrying the tag. Concepts are
     sparse, so an untagged image is almost always a true negative."""

backend/app/services/patreon_resolver.py

@@ -91,46 +91,48 @@ def _sync_lookup(vanity: str, cookies_path: str | None) -> str | None:
     )
 
 
-def _campaigns_api_first(vanity: str, cookies_path: str | None) -> dict | None:
-    """The first `data` object from Patreon's campaigns API filtered by vanity
-    (`?filter[vanity]=<vanity>&fields[campaign]=name`), or None on any failure
-    (network / non-200 / non-JSON / empty). The single request shape shared by
-    _lookup_via_api (plucks the campaign id) and resolve_display_name (plucks the
-    display name)."""
+def _lookup_via_api(vanity: str, cookies_path: str | None) -> str | None:
     jar = _load_cookie_jar(cookies_path)
+    headers = {
+        "User-Agent": _USER_AGENT,
+        "Accept": "application/vnd.api+json",
+    }
+    params = {
+        "filter[vanity]": vanity,
+        "fields[campaign]": "name",
+    }
     try:
         resp = requests.get(
             _CAMPAIGNS_URL,
-            params={"filter[vanity]": vanity, "fields[campaign]": "name"},
-            headers={"User-Agent": _USER_AGENT, "Accept": "application/vnd.api+json"},
+            params=params,
+            headers=headers,
             cookies=jar,
             timeout=_TIMEOUT_SECONDS,
         )
     except requests.RequestException as exc:
         log.warning("Patreon campaigns API request failed for vanity=%s: %s", vanity, exc)
         return None
+
     if resp.status_code != 200:
         log.warning(
             "Patreon campaigns API returned HTTP %d for vanity=%s",
             resp.status_code, vanity,
         )
         return None
+
     try:
         payload = resp.json()
     except ValueError as exc:
         log.warning("Patreon campaigns API returned non-JSON for vanity=%s: %s", vanity, exc)
         return None
-    data = payload.get("data") if isinstance(payload, dict) else None
-    if not isinstance(data, list) or not data or not isinstance(data[0], dict):
-        return None
-    return data[0]
 
-
-def _lookup_via_api(vanity: str, cookies_path: str | None) -> str | None:
-    first = _campaigns_api_first(vanity, cookies_path)
-    if first is None:
+    if not isinstance(payload, dict):
         return None
-    campaign_id = first.get("id")
+    data = payload.get("data")
+    if not isinstance(data, list) or not data:
+        return None
+    first = data[0] if isinstance(data[0], dict) else None
+    campaign_id = first.get("id") if first else None
     if not isinstance(campaign_id, str) or not campaign_id:
         return None
     log.info("Resolved Patreon vanity=%s → campaign_id=%s", vanity, campaign_id)
@@ -142,10 +144,24 @@ def resolve_display_name(vanity: str, cookies_path: str | None) -> str | None:
     (`fields[campaign]=name`), used to name the Artist at add-time (#130). None
     on any failure — the caller falls back to the vanity handle. Sync: call from
     an executor."""
-    first = _campaigns_api_first(vanity, cookies_path)
-    if first is None:
+    jar = _load_cookie_jar(cookies_path)
+    try:
+        resp = requests.get(
+            _CAMPAIGNS_URL,
+            params={"filter[vanity]": vanity, "fields[campaign]": "name"},
+            headers={"User-Agent": _USER_AGENT, "Accept": "application/vnd.api+json"},
+            cookies=jar,
+            timeout=_TIMEOUT_SECONDS,
+        )
+        if resp.status_code != 200:
+            return None
+        data = resp.json().get("data")
+    except (requests.RequestException, ValueError) as exc:
+        log.warning("Patreon name lookup failed for vanity=%s: %s", vanity, exc)
         return None
-    name = (first.get("attributes") or {}).get("name")
+    if not isinstance(data, list) or not data or not isinstance(data[0], dict):
+        return None
+    name = (data[0].get("attributes") or {}).get("name")
     return name.strip() if isinstance(name, str) and name.strip() else None
 
 

backend/app/services/platforms/__init__.py

@@ -8,10 +8,9 @@ PLATFORMS below. Sidecar parsing, cookie materialization, and
 
 Lifted from GallerySubscriber's
 ~/Nextcloud/Projects/GallerySubscriber/backend/app/api/platforms.py
-and ~/.../extension/lib/platforms.js. Five platforms; auth_type and
+and ~/.../extension/lib/platforms.js. Six platforms; auth_type and
 URL patterns match GS exactly so the existing browser extension
-hits FC unmodified. deviantart was dropped at #3069 (2026-08-27) —
-FC downloaders are art-dedicated services only.
+hits FC unmodified.
 """
 
 from .base import (
@@ -19,6 +18,7 @@ from .base import (
     DEFAULT_EXTERNAL_POST_ID_KEYS,
     PlatformInfo,
 )
+from .deviantart import INFO as _DEVIANTART
 from .discord import INFO as _DISCORD
 from .hentaifoundry import INFO as _HENTAIFOUNDRY
 from .patreon import INFO as _PATREON
@@ -33,6 +33,7 @@ PLATFORMS: dict[str, PlatformInfo] = {
         _HENTAIFOUNDRY,
         _DISCORD,
         _PIXIV,
+        _DEVIANTART,
     )
 }
 

backend/app/services/platforms/base.py

@@ -63,7 +63,7 @@ class PlatformInfo:
     # Synthesize a post permalink from sidecar data. Required when
     # gallery-dl's `url` field is the file/CDN URL rather than the post
     # permalink (subscribestar/pixiv/hf/discord). None = trust the bare
-    # `url` field (patreon).
+    # `url` field (patreon, deviantart).
     derive_post_url: Callable[[dict], str | None] | None = None
 
     # Post-process the materialized cookies.txt for gallery-dl. Used by

backend/app/services/platforms/deviantart.py

@@ -0,0 +1,23 @@
+"""DeviantArt — no exercised quirks yet.
+
+No operator-owned DeviantArt archive existed at the 2026-05-27 sidecar
+audit, so we don't know yet whether DA's gallery-dl sidecars are
+well-behaved or have their own quirks. When DA gets exercised for the
+first time, add `derive_post_url` / `augment_cookies` here as needed.
+"""
+
+from .base import GD_DEFAULTS, PlatformInfo
+
+INFO = PlatformInfo(
+    key="deviantart",
+    name="DeviantArt",
+    description="Download artwork from DeviantArt artists",
+    auth_type="cookies",
+    requires_auth=False,
+    url_pattern=r"^https?://(www\.)?deviantart\.com/",
+    url_examples=[
+        "https://www.deviantart.com/example-artist",
+        "https://www.deviantart.com/example-artist/gallery",
+    ],
+    default_config={**GD_DEFAULTS, "content_types": ["gallery"]},
+)

backend/app/services/post_feed_service.py

@@ -24,7 +24,6 @@ from ..models import (
     Post,
     PostAttachment,
     Source,
-    attachment_download_url,
 )
 from ..utils.html_sanitize import (
     extract_img_srcs,
@@ -361,7 +360,7 @@ class PostFeedService:
                 "ext": att.ext,
                 "mime": att.mime,
                 "size_bytes": att.size_bytes,
-                "download_url": attachment_download_url(att.id),
+                "download_url": f"/api/attachments/{att.id}/download",
             })
         return out
 

backend/app/services/provenance_service.py

@@ -16,7 +16,6 @@ from ..models import (
     Post,
     PostAttachment,
     Source,
-    attachment_download_url,
 )
 from ..utils.html_sanitize import sanitize_post_html
 
@@ -54,7 +53,7 @@ def _attachment_dict(a: PostAttachment) -> dict:
         "original_filename": a.original_filename,
         "size_bytes": a.size_bytes,
         "ext": a.ext,
-        "download_url": attachment_download_url(a.id),
+        "download_url": f"/api/attachments/{a.id}/download",
     }
 
 

backend/app/services/wip_title.py

@@ -20,10 +20,10 @@ family gains one member.
 import re
 
 from sqlalchemy import select
+from sqlalchemy.dialects.postgresql import insert as pg_insert
 from sqlalchemy.orm import Session
 
 from ..models.tag import WIP_SYSTEM_TAG, Tag, image_tag
-from .image_tag_apply import insert_image_tags
 
 # image_tag.source stamped on title-heuristic WIP tags — distinct from the other
 # apply sources so provenance stays legible and a future undo can target only these.
@@ -113,9 +113,13 @@ def apply_wip_image_tags(
         to_insert = [iid for iid in chunk if iid not in already]
         if not to_insert:
             continue
-        insert_image_tags(session, [
-            {"image_record_id": iid, "tag_id": tag_id, "source": source}
-            for iid in to_insert
-        ])
+        session.execute(
+            pg_insert(image_tag)
+            .values([
+                {"image_record_id": iid, "tag_id": tag_id, "source": source}
+                for iid in to_insert
+            ])
+            .on_conflict_do_nothing(index_elements=["image_record_id", "tag_id"])
+        )
         inserted += len(to_insert)
     return inserted

backend/app/tasks/admin.py

@@ -409,31 +409,3 @@ def rescan_series_suggestions_task(self, after_post_id: int = 0) -> dict:
         )
         rescan_series_suggestions_task.delay(summary["resume_after_id"])
     return summary
-
-
-@celery.task(
-    name="backend.app.tasks.admin.reclaim_orphaned_attachments_task",
-    bind=True,
-    autoretry_for=(OperationalError, DBAPIError),
-    retry_backoff=15, retry_backoff_max=180, max_retries=1,
-    # The service stops walking at its own 900s budget and reports partial, so
-    # these limits are the backstop for a wedged filesystem (NFS stall), not the
-    # expected exit. Comfortably above the budget so a normal run always returns
-    # its summary rather than being killed mid-walk.
-    soft_time_limit=1200, time_limit=1500,  # 20 min / 25 min
-)
-def reclaim_orphaned_attachments_task(self, dry_run: bool = True) -> dict:
-    """Reclaim unattributed PostAttachment rows and the store blobs nothing
-    references any more (#3068). dry_run (the default) returns the projection
-    without touching rows or files; apply deletes the orphan rows, then unlinks
-    every blob no surviving row references.
-
-    Defaults to the SAFE preview — unlike the other tasks here, whose apply is
-    reversible-ish or scoped; this one deletes files. Operator-triggered only,
-    never on a beat: an unattended sweep that unlinks blobs is not something to
-    run without someone reading the projection first."""
-    SessionLocal = _sync_session_factory()
-    with SessionLocal() as session:
-        return cleanup_service.reclaim_orphaned_attachments(
-            session, images_root=IMAGES_ROOT, dry_run=dry_run,
-        )

backend/app/tasks/maintenance.py

@@ -173,12 +173,6 @@ TASK_STUCK_THRESHOLD_MINUTES: dict[str, int] = {
     # task-name override beats the queue threshold whatever queue the row records
     # (it recorded 'default' before the celery_signals fix → download). 65 = 60+5.
     "backend.app.tasks.external.fetch_external_link": 65,
-    # Attachment reclaim walks the whole sha-addressed store; the service caps
-    # itself at a 900s budget and reports partial, but the task's hard limit is
-    # 25 min for a wedged filesystem (NFS stall). Same phantom-flag class as the
-    # external-fetch entry above — without an override a healthy in-flight walk
-    # is swept 'RecoverySweep' at the bare 5-min default. 30 = 25 + 5.
-    "backend.app.tasks.admin.reclaim_orphaned_attachments_task": 30,
 }
 
 
@@ -782,62 +776,89 @@ def recover_stalled_library_audit_runs() -> int:
         return recovered
 
 
-def _recover_stalled_runs(model, *, stall_minutes: int, keep_runs: int, label: str) -> int:
-    """Shared recovery + retention sweep for the head run-tracking tables
-    (HeadTrainingRun / HeadAutoApplyRun, which share the
-    status/last_progress_at/started_at/finished_at/error/id columns): flip 'running'
-    rows with no progress past `stall_minutes` to 'error', then prune to the last
-    `keep_runs` (rule 89). Returns the number recovered. NOTE the two other recover
-    tasks are deliberately NOT folded in — library-audit has no prune tail and
-    backup uses a single started_at cutoff."""
-    SessionLocal = _sync_session_factory()
-    now = datetime.now(UTC)
-    cutoff = now - timedelta(minutes=stall_minutes)
-    with SessionLocal() as session:
-        result = session.execute(
-            update(model)
-            .where(model.status == "running")
-            .where(func.coalesce(model.last_progress_at, model.started_at) < cutoff)
-            .values(
-                status="error", finished_at=now,
-                error=f"stranded by recovery sweep (no progress for {stall_minutes} min)",
-            )
-        )
-        keep = session.execute(
-            select(model.id).order_by(model.id.desc()).limit(keep_runs)
-        ).scalars().all()
-        if keep:
-            session.execute(delete(model).where(model.id.not_in(keep)))
-        session.commit()
-        recovered = result.rowcount or 0
-        if recovered:
-            log.info("%s: recovered %d rows", label, recovered)
-        return recovered
-
-
 @celery.task(name="backend.app.tasks.maintenance.recover_stalled_head_training_runs")
 def recover_stalled_head_training_runs() -> int:
     """Flip HeadTrainingRun rows stuck in 'running' past the stall threshold to
     'error', and prune old runs to the last HEAD_TRAINING_KEEP_RUNS (retention,
     rule 89). Runs every 5 min on the maintenance lane; no-op when idle."""
-    return _recover_stalled_runs(
-        HeadTrainingRun,
-        stall_minutes=HEAD_TRAINING_STALL_THRESHOLD_MINUTES,
-        keep_runs=HEAD_TRAINING_KEEP_RUNS,
-        label="recover_stalled_head_training_runs",
-    )
+    SessionLocal = _sync_session_factory()
+    now = datetime.now(UTC)
+    cutoff = now - timedelta(minutes=HEAD_TRAINING_STALL_THRESHOLD_MINUTES)
+    with SessionLocal() as session:
+        result = session.execute(
+            update(HeadTrainingRun)
+            .where(HeadTrainingRun.status == "running")
+            .where(
+                func.coalesce(
+                    HeadTrainingRun.last_progress_at, HeadTrainingRun.started_at
+                )
+                < cutoff
+            )
+            .values(
+                status="error", finished_at=now,
+                error=(
+                    f"stranded by recovery sweep (no progress for "
+                    f"{HEAD_TRAINING_STALL_THRESHOLD_MINUTES} min)"
+                ),
+            )
+        )
+        keep = session.execute(
+            select(HeadTrainingRun.id).order_by(HeadTrainingRun.id.desc())
+            .limit(HEAD_TRAINING_KEEP_RUNS)
+        ).scalars().all()
+        if keep:
+            session.execute(
+                delete(HeadTrainingRun).where(HeadTrainingRun.id.not_in(keep))
+            )
+        session.commit()
+        recovered = result.rowcount or 0
+        if recovered:
+            log.info(
+                "recover_stalled_head_training_runs: recovered %d rows", recovered
+            )
+        return recovered
 
 
 @celery.task(name="backend.app.tasks.maintenance.recover_stalled_head_auto_apply_runs")
 def recover_stalled_head_auto_apply_runs() -> int:
     """Flip stalled HeadAutoApplyRun 'running' rows to 'error' + prune to the
     last HEAD_AUTO_APPLY_KEEP_RUNS (retention, rule 89). 5-min maintenance lane."""
-    return _recover_stalled_runs(
-        HeadAutoApplyRun,
-        stall_minutes=HEAD_AUTO_APPLY_STALL_THRESHOLD_MINUTES,
-        keep_runs=HEAD_AUTO_APPLY_KEEP_RUNS,
-        label="recover_stalled_head_auto_apply_runs",
-    )
+    SessionLocal = _sync_session_factory()
+    now = datetime.now(UTC)
+    cutoff = now - timedelta(minutes=HEAD_AUTO_APPLY_STALL_THRESHOLD_MINUTES)
+    with SessionLocal() as session:
+        result = session.execute(
+            update(HeadAutoApplyRun)
+            .where(HeadAutoApplyRun.status == "running")
+            .where(
+                func.coalesce(
+                    HeadAutoApplyRun.last_progress_at, HeadAutoApplyRun.started_at
+                )
+                < cutoff
+            )
+            .values(
+                status="error", finished_at=now,
+                error=(
+                    f"stranded by recovery sweep (no progress for "
+                    f"{HEAD_AUTO_APPLY_STALL_THRESHOLD_MINUTES} min)"
+                ),
+            )
+        )
+        keep = session.execute(
+            select(HeadAutoApplyRun.id).order_by(HeadAutoApplyRun.id.desc())
+            .limit(HEAD_AUTO_APPLY_KEEP_RUNS)
+        ).scalars().all()
+        if keep:
+            session.execute(
+                delete(HeadAutoApplyRun).where(HeadAutoApplyRun.id.not_in(keep))
+            )
+        session.commit()
+        recovered = result.rowcount or 0
+        if recovered:
+            log.info(
+                "recover_stalled_head_auto_apply_runs: recovered %d rows", recovered
+            )
+        return recovered
 
 
 # Keep ~6 months of daily head-metric snapshots (enough to see tuning trends).

backend/app/tasks/ml.py

@@ -105,7 +105,9 @@ def embed_image(self, image_id: int) -> dict:
             record = session.get(ImageRecord, image_id)
             if record is None:
                 return {"status": "missing", "image_id": image_id}
-            settings = MLSettings.load_sync(session)
+            settings = session.execute(
+                select(MLSettings).where(MLSettings.id == 1)
+            ).scalar_one()
 
             src = Path(record.path)
             is_vid = _is_video(src)
@@ -486,10 +488,15 @@ def scheduled_ccip_auto_apply() -> str:
     from sqlalchemy import select as sa_select
     from sqlalchemy.dialects.postgresql import insert as pg_insert
 
-    from ..models import ImageRegion, MLSettings, Tag, TagKind
+    from ..models import ImageRegion, MLSettings, Tag, TagKind, TagSuggestionRejection
     from ..models.tag import image_tag
-    from ..services.ml.ccip import _FIGURE_KINDS
-    from ..services.ml.training_data import _applied_or_rejected, _l2norm
+
+    fig = ("face", "figure")
+
+    def _l2(m):
+        n = np.linalg.norm(m, axis=1, keepdims=True)
+        n[n == 0] = 1.0
+        return m / n
 
     SessionLocal = _sync_session_factory()
     with SessionLocal() as session:
@@ -514,7 +521,7 @@ def scheduled_ccip_auto_apply() -> str:
             )
             .join(Tag, Tag.id == image_tag.c.tag_id)
             .where(Tag.kind == TagKind.character)
-            .where(ImageRegion.kind.in_(_FIGURE_KINDS))
+            .where(ImageRegion.kind.in_(fig))
             .where(ImageRegion.ccip_embedding.is_not(None))
             .where(ImageRegion.image_record_id.in_(single))
         ).all()
@@ -525,16 +532,29 @@ def scheduled_ccip_auto_apply() -> str:
         for tid, vec in ref_rows:
             by_char.setdefault(tid, []).append(vec)
         ref_tags = list(by_char)
-        mats = [_l2norm(np.asarray(by_char[t], dtype=np.float32), np) for t in ref_tags]
+        mats = [_l2(np.asarray(by_char[t], dtype=np.float32)) for t in ref_tags]
         allref = np.vstack(mats)                                  # (total, 768)
         seg = np.cumsum([0] + [len(m) for m in mats])[:-1]        # per-char start
 
         # Per character: images that already carry OR rejected the tag — skip.
-        skip = _applied_or_rejected(session, ref_tags)
+        skip = {t: set() for t in ref_tags}
+        for t in ref_tags:
+            for (iid,) in session.execute(
+                sa_select(image_tag.c.image_record_id).where(
+                    image_tag.c.tag_id == t
+                )
+            ):
+                skip[t].add(iid)
+            for (iid,) in session.execute(
+                sa_select(TagSuggestionRejection.image_record_id).where(
+                    TagSuggestionRejection.tag_id == t
+                )
+            ):
+                skip[t].add(iid)
 
         img_ids = list(session.execute(
             sa_select(ImageRegion.image_record_id)
-            .where(ImageRegion.kind.in_(_FIGURE_KINDS), ImageRegion.ccip_embedding.is_not(None))
+            .where(ImageRegion.kind.in_(fig), ImageRegion.ccip_embedding.is_not(None))
             .distinct()
         ).scalars())
 
@@ -546,7 +566,7 @@ def scheduled_ccip_auto_apply() -> str:
                 sa_select(ImageRegion.image_record_id, ImageRegion.ccip_embedding)
                 .where(
                     ImageRegion.image_record_id.in_(chunk),
-                    ImageRegion.kind.in_(_FIGURE_KINDS),
+                    ImageRegion.kind.in_(fig),
                     ImageRegion.ccip_embedding.is_not(None),
                 )
             ).all()
@@ -554,7 +574,7 @@ def scheduled_ccip_auto_apply() -> str:
             for iid, vec in rows:
                 by_img.setdefault(iid, []).append(vec)
             for iid, vecs in by_img.items():
-                q = _l2norm(np.asarray(vecs, dtype=np.float32), np)  # (nq, 768)
+                q = _l2(np.asarray(vecs, dtype=np.float32))      # (nq, 768)
                 colmax = (q @ allref.T).max(axis=0)              # (total,)
                 charmax = np.maximum.reduceat(colmax, seg)       # (n_chars,)
                 for ci in np.where(charmax >= thr)[0]:

ci-requirements.md

@@ -9,31 +9,14 @@ git.fabledsword.com/bvandeusen/ci-python:3.14
 ## Image deps used
 
 - python 3.14
-- ruff (analyzer for `backend/`, `tests/`, `alembic/`, `agent/`, `scripts/`)
+- ruff (analyzer for `backend/`, `tests/`, `alembic/`)
 - node (frontend job: `npm install` + vitest + vite build)
-- docker CLI + buildx (`.forgejo/workflows/build.yml`: build-web, build-ml, build-agent — Fabled-Git registry push, and `imagetools inspect`/`create` for the reuse path)
-
-## Secondary runtime image
-
-node:24-bookworm-slim — `.forgejo/workflows/extension.yml` only.
-
-`.forgejo/workflows/release.yml` runs on `ci-python:3.14` like everything else
-and installs nothing: it needs git and stdlib python, and builds no image.
-
-The extension lane is the one job that does NOT run on `ci-python:3.14`: it
-needs a current Node for `web-ext` and vitest and nothing Python at all. Kept
-on the upstream slim image rather than adding a Node toolchain to `ci-python`,
-per `docs/process.md`'s "add deps to the image when used by >1 project".
+- docker CLI + buildx (`.forgejo/workflows/build.yml`: build-web, build-ml — Forgejo registry push)
 
 ## Per-job tool installs
 
 - `pip install -r requirements.txt pytest pytest-asyncio` — in `backend-lint-and-test` and `integration` jobs
 - `npm install --no-audit --no-fund` — in `frontend-build` job
-- `npm install --no-audit --no-fund` — in `extension.yml`'s `lint` job (web-ext + vitest)
-- `unzip` — in `extension.yml`'s "Verify XPI contents" step, installed via apt
-  only when absent (`node:24-bookworm-slim` may or may not carry it). Debian
-  package, ~2s. Not worth baking into a shared image for a single consumer, per
-  `docs/process.md`'s ">1 project" rule.
 
 ## Notes
 
@@ -43,117 +26,12 @@ per `docs/process.md`'s "add deps to the image when used by >1 project".
   "add deps to image when used by >1 project" rule: FC alone is one Python
   project, so the deps live in `requirements.txt` and install per-job.
   Reconsider when a second Fabled-family Python backend lands.
-- Integration uses Fabled-Git Actions `services:` + socket-discovered bridge IPs
+- Integration uses Forgejo Actions `services:` + socket-discovered bridge IPs
   because `act_runner` (swarm-runner v0.6+) puts services on the default
   bridge with no embedded DNS. The pattern is documented in the rulebook's
-  `fabled-git.md` "CI philosophy" section and FC's `ci.yml` is the canonical
+  `forgejo.md` "CI philosophy" section and FC's `ci.yml` is the canonical
   example.
 - No `package-lock.json` is tracked yet (FC's `feedback_no_local_runs`
   memory bans `npm install` locally). Using `npm install` rather than
   `npm ci` until a lockfile lands.
 - No `imagemagick` / `pandoc` per-job installs needed.
-- `extension/`'s vitest specs load `lib/*.js` by evaluating the real file as a
-  classic script (`test/helpers/loadLib.js`) rather than adding `module.exports`
-  shims to production code — the libs ship as `background.scripts`, not ES
-  modules, so the specs exercise exactly the bytes packaged into the XPI.
-- **`extension/scripts/packaging.sh` is the single definition of what ships
-  inside the XPI.** Three consumers read from it rather than keeping their own
-  copy: web-ext's `--ignore-files` (`extension/package.json`), the `git log`
-  pathspec inside the script's own version derivation, and `scripts/artifacts.sh`,
-  which appends the extension's set to web's because the web image bundles the
-  signed XPI. Hand-kept copies of that one fact is what allowed issue #2397, so
-  `extension/test/version.spec.js` asserts no workflow has reintroduced a
-  literal `:(exclude)extension/…`.
-- **Packaged and version-relevant are two different sets** (#3156). `scripts/`
-  is excluded from the XPI and is NOT excluded from the version derivation,
-  because `packaging.sh` decides the version string stamped into the packaged
-  `manifest.json`. The membership test is *"can changing this file change the
-  published bytes?"*, not *"is this file copied in?"* — which is why the script
-  keeps two lists rather than one.
-- **The shipped extension version is derived, not committed.** It is the commit
-  TIME of the newest packaged-extension change, rendered `YYYY.M.D.HHMM` UTC
-  (family rules 148/149 — never a commit count, which orders by branch rather
-  than by recency). `build.yml`'s `sign-extension` computes it and stamps it
-  into `extension/manifest.json` + `package.json` in the working tree before
-  signing; the stamp is never committed. The version in the repo is **wholly
-  inert** — since milestone 318 step 8 there is no hand-set MAJOR.MINOR either.
-- **The extension is the one artifact that does not zero-pad, and that is not a
-  drift** (#3138). Mozilla's grammar for AMO is
-  `^(0|[1-9][0-9]{0,8})([.](0|[1-9][0-9]{0,8})){0,3}$` — a segment is the single
-  digit `0` or starts 1-9, and there are at most four. `2026.08.29.0201` is
-  rejected; `2026.8.29.201` is the same value one character narrower per
-  segment, and rule 148 defines comparison as numeric per segment, so nothing is
-  reordered. `ci.yml`'s `extension-version` lane asserts the derived string
-  against that exact regex, plus a `YYYY.M.D.HHMM` shape check that would catch
-  a regression to the pre-318 `1.0.<minutes>` — which AMO would accept and which
-  orders below everything already signed. Checking here is the whole point: AMO
-  409s on re-signing, so a version it rejects is burned and cannot be reused.
-  `scripts/artifacts.sh version extension` **delegates** to `packaging.sh` so
-  the two cannot answer differently.
-- Every job that derives anything checks out with `fetch-depth: 0` — all four
-  `build.yml` jobs, `ci.yml`'s `extension-version` and `backend-lint-and-test`
-  (for `tests/test_artifact_paths.py` and `test_artifact_identity.py`), and
-  `release.yml`, which additionally walks the tag graph. A depth-1 clone sees
-  one commit and derives a wrong, too-low value **rather than failing**, so the
-  full-history checkout is load-bearing rather than incidental.
-- **`scripts/artifacts.sh` is the same shape one level up: one definition per
-  artifact of what it is built from, and the two values derived from it.**
-  `revision` (12 hex of the newest commit touching that set) and `version`
-  (`YYYY.MM.DD.HHMM` UTC, rule 148). Four artifacts, four independent answers,
-  so a push touching only `agent/` leaves web and ml alone.
-  `tests/test_artifact_paths.py` reads each Dockerfile and asserts every COPY
-  source is covered, so adding a COPY without updating the script fails CI.
-- **A file that DECIDES an artifact's identity belongs in its set even though it
-  is copied into nothing** — `packaging.sh` for the extension and web (#3156),
-  and `artifacts.sh` itself for web (#3202), which decides the `FC_VERSION`
-  baked into that image. Only web needs the second entry: every artifact stamps
-  a revision, but a revision has a backstop (a changed derivation stops matching
-  the published label and forces a rebuild) and a version has none, because
-  nothing compares it to anything. `tests/test_artifact_paths.py`'s `DERIVERS`
-  table is the guard.
-- **Builds are skipped when the content is already published.** Each image
-  carries its revision as an `fc.revision` LABEL, and `build.yml` reads that
-  label back off the moving channel tag (`imagetools inspect --format`). Equal
-  to the derived revision means the bytes are already published, so the job
-  repoints the remaining tags at the existing manifest instead of rebuilding.
-  Two things this depends on: an inspect that errors for ANY reason reads as a
-  MISS so no needed build is ever skipped, and the repoint must EXCLUDE the
-  source tag — `imagetools create` wraps its source in a manifest index, and
-  config labels do not resolve through an index, so writing the channel tag
-  from itself destroys the label the next run reads (#3183).
-- **The build pushes exactly ONE tag — the channel's — and every other tag is
-  written registry-side afterwards** (#3190). buildx on this runner pushes the
-  first tag to the registry and then re-pushes the rest through the docker
-  driver, out of a local image store that a registry-direct build never fills;
-  it fails intermittently with `tag does not exist`. On `dev` that only reddens
-  a job, but on `main` it silently skips `:c-<sha>` while `:latest` publishes
-  fine — a missing rollback tag has no consumer that fails, so nothing but the
-  red job would notice until somebody needs to roll back. `imagetools create`
-  has no local store to be absent from, and it is the code the reuse path
-  already ran, so both paths now share one proven route. The cost: `:c-<sha>`
-  is an index rather than a plain image, so `fc.revision` does not resolve
-  through it — nothing reads it there, and the index names the same manifest.
-- **`FC_CHANNEL` and `FC_VERSION` are build args, not runtime settings.**
-  `build.yml` passes them to the web image only — the ml and agent images have
-  nothing to report them to. `/api/health` returns both, the foot of Settings
-  renders them, and `/api/extension/manifest` reports the channel beside the
-  extension version so an install can be traced to a channel. With no version image tags, that
-  self-report is the ONLY answer to "which build is this?" — which is why a
-  missing version renders `unknown` rather than a blank: an empty footer reads
-  as "no version", a different and false claim.
-  Both are declared LAST in the Dockerfile on purpose: an ARG invalidates every
-  layer below it, and these are the values that differ between the dev and main
-  builds of identical source, so placing them earlier would stop the two
-  channels ever sharing a cached `pip install`. Empty by default — a local build
-  then reports nothing rather than claiming a channel it is not on.
-- **The channel is never folded into the version.** A `-dev` suffix makes the
-  extension's per-segment `parseInt` comparator read that segment as 0, so every
-  dev build compares equal to every other — issue #2993 exactly (rule 149).
-  `frontend/test/systemBuild.spec.js` pins the rendered version to the bare
-  number.
-- Callers MUST `set -f` before substituting the script's output. Without it the
-  shell expands `test/**` against the working tree and silently narrows the
-  pattern to whatever files exist at that moment — a failure that looks like
-  nothing until dev files start appearing in the XPI. `test/version.spec.js`
-  asserts every `--ignore-files` consumer sets it, and that no consumer has
-  quietly reinstated a hardcoded list.

extension/README.md

@@ -1,14 +1,13 @@
 # FabledCurator Firefox Extension
 
 Self-hosted Firefox extension that pushes session cookies from supported
-platforms (Patreon, SubscribeStar, Hentai-Foundry, Discord, Pixiv)
-into FabledCurator, and lets you add a creator as a Source from their
-page in one click.
+platforms (Patreon, SubscribeStar, Hentai-Foundry, Discord, Pixiv,
+DeviantArt) into FabledCurator, and lets you add a creator as a Source
+from their page in one click.
 
 ## Install (operator)
 
-The signed XPI is bundled into the FC Docker image — `:dev` and
-`:latest` each carry their own channel's build. Open FC →
+The signed XPI is bundled into the FC Docker image. Open FC →
 Settings → Maintenance → Browser extension → click "Install Firefox
 extension". Firefox shows its native install prompt. After installing,
 open the extension's options page (about:addons → FabledCurator →
@@ -21,7 +20,6 @@ same card.
 cd extension/
 npm install --no-save        # web-ext only
 npm run lint                 # web-ext lint
-npm run test:unit            # vitest — lib/ logic + packaging/version checks
 npm run start                # launches Firefox with extension loaded
 npm run build                # unsigned XPI in web-ext-artifacts/
 ```
@@ -38,76 +36,10 @@ npm run build                # unsigned XPI in web-ext-artifacts/
 - [ ] Subscriptions list: popup → "Sources" tab → list renders
 - [ ] Check now: click play icon on source row → no error toast
 
-## Versioning — the committed number decides nothing
-
-The shipped version is **derived**, not committed. `scripts/packaging.sh
-version` returns `YYYY.M.D.HHMM` in UTC: the commit *time* of the newest change
-to a packaged extension file. `build.yml` computes it and stamps it into both
-`manifest.json` and `package.json` at build time. The stamp is never
-committed — the commit carrying it would itself be a change to the extension,
-which would move the version again.
-
-So:
-
-- **Editing the version does nothing.** All of it is overwritten before web-ext
-  ever reads it. There is no bump to make, and none to forget. There is no
-  hand-set part left either: MAJOR.MINOR went away with milestone 318 step 8.
-- `npm run build` locally produces an XPI labelled with the *committed*
-  version, since nothing stamped it. Fine for loading into a test profile; not
-  what ships.
-
-**Why the extension is the one artifact that does not zero-pad.** Every other
-FC artifact emits rule 148's `YYYY.MM.DD.HHMM`. AMO will not take it: Mozilla's
-grammar for addons.mozilla.org is
-
-```
-^(0|[1-9][0-9]{0,8})([.](0|[1-9][0-9]{0,8})){0,3}$
-```
-
-— each segment is the single digit `0` or starts 1-9, so `08` and `0201` are
-rejected, and at most four segments are allowed. The extension therefore emits
-**the same numbers unpadded**: `2026.8.29.201` where the rest of the family
-says `2026.08.29.0201`. Rule 148 already defines comparison as numeric per
-segment, under which the two are equal, so nothing is reordered by the choice
-and left-padding each segment recovers the family string exactly. `ci.yml`'s
-`extension-version` lane checks the derived string against that regex on every
-push — the cheap place to find out, because AMO 409s on re-signing and a
-rejected version is burned for good.
-
-Why commit time and not a commit count: a count is per-branch, so `dev` and
-`main` count different histories of the same code and their versions end up
-ordered by which branch accumulated more commits rather than by which is newer.
-Commit time gives both branches the same number for the same source — which is
-exactly what lets one AMO signature serve both channels (family rule 149, FC
-issue #3092).
-
-## Channels
-
-`dev` and `main` each build and sign their own extension, and an install is
-tied to whichever FC instance it points at — Firefox's static `update_url`
-cannot apply here, since every FC install is a different host, so the extension
-asks its configured backend. **The channel therefore IS the instance.**
-Switching channel means repointing the FC URL in options and reinstalling from
-that host; there is no separate channel setting, and adding one would
-contradict each server build shipping its own extension.
-
-The channel is reported *beside* the version, never inside it:
-`/api/extension/manifest` answers `{"version": "...", "channel": "dev"}`. It is
-optional — an instance that declares none simply omits the key, and the popup,
-the toolbar tooltip and the Settings card all read exactly as they did before
-the field existed. Do not be tempted to make it a `-dev` version suffix: the
-comparator parses each dotted segment with `parseInt`, so a suffixed segment
-reads as 0 and every dev build compares equal to every other, collapsing "no
-update available" and "I cannot read this version" into one answer.
-
 ## Release
 
-Nothing to do by hand. Push to `dev`: `build.yml` signs the extension if this
-change moved the version, caches the signed XPI as a Forgejo `ext-<version>`
-release, and bundles it into `fabledcurator:dev`. Merging to `main` derives the
-same version, hits that cache, and bundles the byte-identical XPI into
-`:latest` with no second AMO call.
-
-AMO refuses to re-sign a version it has already issued, so signing is one-shot
-per version — which is why the cache exists and why the version must never move
-backwards.
+Bump `manifest.json` + `package.json` SemVer (both files) and commit
+under `extension/**`. The `.forgejo/workflows/extension.yml` workflow
+runs `web-ext sign` on main, commits the signed XPI to
+`frontend/public/extension/`, and the next FC server build bundles it
+into the Docker image.

extension/background/background.js

@@ -31,91 +31,6 @@ browser.runtime.onInstalled.addListener(() => ensureInitialized());
 browser.runtime.onStartup.addListener(() => ensureInitialized());
 ensureInitialized().catch(e => console.error('init failed:', e));
 
-// ---- Extension self-update check (#1489) ----
-// Installed per-instance from the operator's FC host, so Firefox's static
-// update_url can't apply (each instance has a different host). Instead ask the
-// configured backend for the latest published version and nudge the operator to
-// reinstall the freshly-signed XPI — surfaced as a popup banner (on demand) and
-// a toolbar badge (daily). /api/extension/manifest is public and returns
-// {version, latest_url, sha256} plus an OPTIONAL {channel} naming which channel
-// that instance serves ("dev"/"main", #3113); the XPI is served from the web
-// root (not /api).
-//
-// The channel IS the instance: Firefox's static update_url cannot apply here
-// because every FC install is a different host, so the extension asks its
-// configured backend — which means switching channel is repointing apiUrl in
-// options and reinstalling from that host. There is no separate channel
-// setting to build, and building one would contradict each server build
-// shipping its own extension.
-
-function versionIsNewer(candidate, current) {
-  // Dotted numeric compare so 1.0.10 > 1.0.9 (a plain string compare wouldn't).
-  const a = String(candidate).split('.').map(n => parseInt(n, 10) || 0);
-  const b = String(current).split('.').map(n => parseInt(n, 10) || 0);
-  for (let i = 0; i < Math.max(a.length, b.length); i++) {
-    if ((a[i] || 0) !== (b[i] || 0)) return (a[i] || 0) > (b[i] || 0);
-  }
-  return false;
-}
-
-async function checkForUpdateInfo() {
-  await ensureInitialized();
-  if (!api.isConfigured()) return { updateAvailable: false, configured: false };
-  let info;
-  try {
-    info = await api.getExtensionManifest();
-  } catch (e) {
-    return { updateAvailable: false, error: e.message };
-  }
-  const currentVersion = browser.runtime.getManifest().version;
-  const latestVersion = info && info.version ? info.version : null;
-  // Which channel the configured instance serves — reported ALONGSIDE the
-  // version, never folded into it. A `-dev` suffix would have to survive
-  // versionIsNewer's parseInt above, and it wouldn't: the segment would read
-  // as 0 and every dev build would compare equal to every other.
-  //
-  // null is a normal answer, not a failure — an instance built before the
-  // field existed, or one built locally with no channel declared. Nothing
-  // below branches on it except the label.
-  const channel = info && info.channel ? info.channel : null;
-  // latest_url is served from the web root, not the JSON API.
-  const base = api.webRoot();
-  return {
-    updateAvailable: !!latestVersion && versionIsNewer(latestVersion, currentVersion),
-    currentVersion,
-    latestVersion,
-    channel,
-    xpiUrl: info && info.latest_url ? `${base}${info.latest_url}` : null,
-  };
-}
-
-async function refreshUpdateBadge() {
-  let r;
-  try { r = await checkForUpdateInfo(); } catch { return; }
-  try {
-    await browser.action.setBadgeText({ text: r.updateAvailable ? '↑' : '' });
-    if (r.updateAvailable) {
-      await browser.action.setBadgeBackgroundColor({ color: '#F4BA7A' });
-      // Channel first, version second, and the channel dropped entirely when
-      // the instance doesn't report one — so the tooltip reads exactly as it
-      // did before the field existed rather than saying "(unknown ...)".
-      const label = r.channel ? `${r.channel} v${r.latestVersion}` : `v${r.latestVersion}`;
-      await browser.action.setTitle({ title: `FabledCurator — update available (${label})` });
-    } else {
-      await browser.action.setTitle({ title: 'FabledCurator' });
-    }
-  } catch { /* action API unavailable — non-fatal */ }
-}
-
-// Daily proactive check (needs the "alarms" permission). create() is idempotent
-// by name, so re-running it on each event-page load is safe.
-browser.alarms.create('fc-update-check', { periodInMinutes: 24 * 60, delayInMinutes: 1 });
-browser.alarms.onAlarm.addListener((alarm) => {
-  if (alarm.name === 'fc-update-check') refreshUpdateBadge();
-});
-browser.runtime.onStartup.addListener(() => refreshUpdateBadge());
-browser.runtime.onInstalled.addListener(() => refreshUpdateBadge());
-
 // ---- Discord token capture via webRequest ----
 
 browser.webRequest.onBeforeSendHeaders.addListener(
@@ -233,21 +148,6 @@ browser.webRequest.onBeforeRedirect.addListener(
   { urls: ['https://app-api.pixiv.net/web/v1/users/auth/pixiv/callback*'] },
 );
 
-// Extract → verify → upload one cookie-auth platform. Returns a structured
-// outcome so the two callers (EXPORT_COOKIES single, EXPORT_ALL_COOKIES) shape
-// their own response + skip semantics. Verifies the captured cookies are
-// actually live BEFORE uploading, so a confirmed-stale session doesn't overwrite
-// good FC-side credentials; platforms with no verify config (v.ok === null) fall
-// through to upload.
-async function exportPlatformCookies(key) {
-  const cookies = await extractCookiesForPlatform(key);
-  if (cookies.length === 0) return { status: 'empty' };
-  const v = await verifyCookiesForPlatform(key);
-  if (v.ok === false) return { status: 'stale', reason: v.reason, cookieCount: cookies.length };
-  await api.uploadCredentials(key, 'cookies', toNetscapeFormat(cookies));
-  return { status: 'ok', cookieCount: cookies.length, verified: v.ok === true };
-}
-
 // ---- Message router ----
 
 browser.runtime.onMessage.addListener(async (msg) => {
@@ -292,14 +192,22 @@ browser.runtime.onMessage.addListener(async (msg) => {
       if (!platform) return { error: `Unknown platform: ${key}` };
       try {
         if (platform.authType === 'cookies') {
-          const r = await exportPlatformCookies(key);
-          if (r.status === 'empty') return { error: 'No cookies found — log in first.' };
-          if (r.status === 'stale') {
+          const cookies = await extractCookiesForPlatform(key);
+          if (cookies.length === 0) return { error: 'No cookies found — log in first.' };
+          // Verify the captured cookies are actually live BEFORE
+          // uploading. Skips upload on confirmed-stale sessions so we
+          // don't overwrite FC-side credentials with garbage. Platforms
+          // without a verify config (verify.ok === null) fall through
+          // to upload as before.
+          const v = await verifyCookiesForPlatform(key);
+          if (v.ok === false) {
             return {
-              error: `Captured ${r.cookieCount} ${platform.name} cookies but they don't appear authenticated (${r.reason}). Log in again in this browser, then retry.`,
+              error: `Captured ${cookies.length} ${platform.name} cookies but they don't appear authenticated (${v.reason}). Log in again in this browser, then retry.`,
             };
           }
-          return { success: true, cookieCount: r.cookieCount, verified: r.verified };
+          const data = toNetscapeFormat(cookies);
+          await api.uploadCredentials(key, 'cookies', data);
+          return { success: true, cookieCount: cookies.length, verified: v.ok === true };
         }
         if (key === 'discord') {
           if (!discordToken) return { error: 'Open discord.com to capture a token first.' };
@@ -327,10 +235,18 @@ browser.runtime.onMessage.addListener(async (msg) => {
           continue;
         }
         try {
-          const r = await exportPlatformCookies(key);
-          if (r.status === 'empty') results[key] = { skipped: true, reason: 'no cookies' };
-          else if (r.status === 'stale') results[key] = { error: `verify failed: ${r.reason}` };
-          else results[key] = { success: true, cookieCount: r.cookieCount, verified: r.verified };
+          const cookies = await extractCookiesForPlatform(key);
+          if (cookies.length === 0) {
+            results[key] = { skipped: true, reason: 'no cookies' };
+            continue;
+          }
+          const v = await verifyCookiesForPlatform(key);
+          if (v.ok === false) {
+            results[key] = { error: `verify failed: ${v.reason}` };
+            continue;
+          }
+          await api.uploadCredentials(key, 'cookies', toNetscapeFormat(cookies));
+          results[key] = { success: true, cookieCount: cookies.length, verified: v.ok === true };
         } catch (e) {
           results[key] = { error: e.message };
         }
@@ -367,9 +283,11 @@ browser.runtime.onMessage.addListener(async (msg) => {
       }
 
     case 'OPEN_ARTIST_PAGE': {
-      // The SPA artist route (/artist/:slug) is served from the web root, not
-      // the JSON API — see api.webRoot().
-      const base = api.webRoot();
+      // apiUrl is configured with the /api suffix (see
+      // options/options.html placeholder); the SPA artist route is
+      // /artist/:slug, served from the same origin. Strip /api so the
+      // browser-level URL hits the Vue router, not the JSON API.
+      const base = (api.baseUrl || '').replace(/\/+$/, '').replace(/\/api$/, '');
       const slug = encodeURIComponent(msg.slug || '');
       if (!base || !slug) return { error: 'apiUrl or slug missing' };
       try {
@@ -380,9 +298,6 @@ browser.runtime.onMessage.addListener(async (msg) => {
       }
     }
 
-    case 'CHECK_UPDATE':
-      return await checkForUpdateInfo();
-
     default:
       return { error: `Unknown message type: ${msg.type}` };
   }

extension/lib/api.js

@@ -11,10 +11,7 @@ class FabledCuratorAPI {
 
   async init() {
     const cfg = await browser.storage.local.get(['apiUrl', 'apiKey']);
-    // Normalize on READ, not just on save: configs stored before the options
-    // page started normalizing are missing the `/api` suffix, and this heals
-    // them without the operator having to reopen Settings.
-    this.baseUrl = normalizeApiUrl(cfg.apiUrl) || null;
+    this.baseUrl = cfg.apiUrl || null;
     this.apiKey = cfg.apiKey || null;
     return this.isConfigured();
   }
@@ -53,13 +50,6 @@ class FabledCuratorAPI {
       } catch {
         message = `HTTP ${response.status}: ${response.statusText}`;
       }
-      // 404/405 from FC almost always means the request never reached the JSON
-      // API — it fell through to the SPA catch-all, which serves HTML on GET
-      // and rejects everything else. Say so, rather than making the operator
-      // decode "Method Not Allowed" on an endpoint that plainly allows POST.
-      if (response.status === 404 || response.status === 405) {
-        message += ` — ${url} isn't the FC API. Check the FC URL in settings.`;
-      }
       const err = new Error(message);
       err.status = response.status;
       throw err;
@@ -99,18 +89,6 @@ class FabledCuratorAPI {
     const qs = new URLSearchParams({ url }).toString();
     return this.request('GET', `/extension/probe?${qs}`);
   }
-  // Latest published extension version on this instance — drives the in-app
-  // update prompt. Public endpoint (no key needed, but request() sends it
-  // harmlessly). Returns {version, xpi_url, latest_url, sha256}.
-  getExtensionManifest() {
-    return this.request('GET', '/extension/manifest');
-  }
-
-  // The web/SPA root: where the Vue router (artist pages) and the served XPI
-  // live, NOT the JSON API. Used by OPEN_ARTIST_PAGE + the self-update check.
-  webRoot() {
-    return webRootFromApiUrl(this.baseUrl);
-  }
 
   // Connection test = the cheapest read with auth.
   testConnection() {

extension/lib/platforms.js

@@ -68,6 +68,16 @@ const PLATFORMS = {
     urlPattern: /^https?:\/\/(www\.)?pixiv\.net/,
     note: 'Click to authenticate via OAuth',
   },
+  deviantart: {
+    name: 'DeviantArt',
+    domains: ['.deviantart.com', 'www.deviantart.com', 'deviantart.com'],
+    authType: 'cookies',
+    color: '#05CC47',
+    urlPattern: /^https?:\/\/(www\.)?deviantart\.com/,
+    // DA's logged-in-only endpoints sit behind their internal _napi
+    // namespace which shifts; skipping verify until a stable check
+    // surfaces. Same posture as SubscribeStar.
+  },
 };
 
 /**
@@ -88,6 +98,7 @@ const PLATFORM_ARTIST_PATTERNS = {
   patreon:       /^https?:\/\/(www\.)?patreon\.com\/(?:cw\/|c\/)?(?!(?:home|search|messages|notifications|library|settings|posts)(?:[\/?#]|$))[^/?#]+/i,
   subscribestar: /^https?:\/\/(www\.)?subscribestar\.(com|adult)\/(?!feed$|messages$|library$)[^/?#]+\/?$/i,
   hentaifoundry: /^https?:\/\/(www\.)?hentai-foundry\.com\/user\/[^/?#]+/i,
+  deviantart:    /^https?:\/\/(www\.)?deviantart\.com\/(?!home$|watch\b|tag\b|browse\b)[^/?#]+\/?$/i,
   pixiv:         /^https?:\/\/(www\.)?pixiv\.net\/(en\/)?users\/\d+/i,
 };
 

extension/lib/url.js

@@ -1,32 +0,0 @@
-/**
- * Canonical FC endpoint derivation, shared by the background client and the
- * options page so a URL entered either way behaves identically.
- *
- * FC serves two things on one origin: the JSON API under `/api`, and the Vue
- * SPA from the root. `api.js` builds requests as `${baseUrl}/credentials`, so
- * the stored base URL has to carry the `/api` suffix.
- */
-
-/**
- * Accept what an operator would naturally type — the instance root
- * (`http://curator.example.com`) or the API root (`.../api`) — and return the
- * API root either way.
- *
- * Worth normalizing rather than validating: a root-form URL doesn't fail
- * loudly, it lands on the SPA catch-all, which answers `GET /credentials` with
- * 200 HTML and rejects `POST /credentials` with 405. The operator sees a
- * working Test Connection and a broken export.
- */
-function normalizeApiUrl(raw) {
-  const trimmed = (raw || '').trim().replace(/\/+$/, '');
-  if (!trimmed) return '';
-  return /\/api$/i.test(trimmed) ? trimmed : `${trimmed}/api`;
-}
-
-/**
- * The SPA root — where the Vue router (artist pages) and the served XPI live,
- * NOT the JSON API. Accepts either input form, same as normalizeApiUrl.
- */
-function webRootFromApiUrl(raw) {
-  return normalizeApiUrl(raw).replace(/\/api$/i, '');
-}

extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "FabledCurator",
-  "version": "1.0.11",
+  "version": "1.0.8",
   "description": "Export cookies from supported platforms to FabledCurator and add creators as sources in one click.",
 
   "browser_specific_settings": {
@@ -22,8 +22,7 @@
     "tabs",
     "activeTab",
     "webRequest",
-    "webRequestBlocking",
-    "alarms"
+    "webRequestBlocking"
   ],
 
   "host_permissions": [
@@ -33,6 +32,7 @@
     "*://*.hentai-foundry.com/*",
     "*://*.discord.com/*",
     "*://*.pixiv.net/*",
+    "*://*.deviantart.com/*",
     "*://app-api.pixiv.net/*",
     "*://oauth.secure.pixiv.net/*",
     "*://*/*"
@@ -45,7 +45,7 @@
   },
 
   "background": {
-    "scripts": ["lib/platforms.js", "lib/cookies.js", "lib/url.js", "lib/api.js", "background/background.js"]
+    "scripts": ["lib/platforms.js", "lib/cookies.js", "lib/api.js", "background/background.js"]
   },
 
   "options_ui": {
@@ -60,6 +60,7 @@
         "*://*.subscribestar.com/*",
         "*://*.subscribestar.adult/*",
         "*://*.hentai-foundry.com/*",
+        "*://*.deviantart.com/*",
         "*://*.pixiv.net/*"
       ],
       "js": ["lib/platforms.js", "content/content-script.js"],

extension/options/options.html

@@ -21,12 +21,9 @@
 <body>
   <h1>FabledCurator extension</h1>
 
-  <label for="api-url">FC instance URL</label>
-  <input id="api-url" type="url" placeholder="http://curator.example.com" />
-  <div class="hint">
-    Your FabledCurator address — with or without the trailing <code>/api</code>; both work.
-    Find it on FC → Settings → Maintenance → Browser extension.
-  </div>
+  <label for="api-url">FC base URL</label>
+  <input id="api-url" type="url" placeholder="http://curator.example.com/api" />
+  <div class="hint">Find this on FC → Settings → Maintenance → Browser extension.</div>
 
   <label for="api-key">Extension API key</label>
   <input id="api-key" type="password" placeholder="paste from FC Settings card" />
@@ -39,7 +36,6 @@
 
   <div id="status" class="status" style="display:none;"></div>
 
-  <script src="../lib/url.js"></script>
   <script src="options.js"></script>
 </body>
 </html>

extension/options/options.js

@@ -8,7 +8,7 @@ document.addEventListener('DOMContentLoaded', async () => {
 });
 
 async function save() {
-  const apiUrl = normalizeApiUrl(document.getElementById('api-url').value);
+  const apiUrl = document.getElementById('api-url').value.trim().replace(/\/+$/, '');
   const apiKey = document.getElementById('api-key').value.trim();
   if (!apiUrl || !apiKey) {
     showStatus('Both fields are required.', 'err');
@@ -16,14 +16,11 @@ async function save() {
   }
   await browser.storage.local.set({ apiUrl, apiKey });
   await browser.storage.local.remove(['lastConnectionTest', 'lastConnectionStatus']);
-  // Show what was actually stored — the operator may have typed the instance
-  // root and it was normalized to the API root.
-  document.getElementById('api-url').value = apiUrl;
-  showStatus(`Saved — using ${apiUrl}`, 'ok');
+  showStatus('Saved.', 'ok');
 }
 
 async function test() {
-  const apiUrl = normalizeApiUrl(document.getElementById('api-url').value);
+  const apiUrl = document.getElementById('api-url').value.trim().replace(/\/+$/, '');
   const apiKey = document.getElementById('api-key').value.trim();
   if (!apiUrl || !apiKey) {
     showStatus('Fill both fields first.', 'err');
@@ -34,23 +31,8 @@ async function test() {
       method: 'GET',
       headers: { 'X-Extension-Key': apiKey },
     });
-    if (!r.ok) {
-      showStatus(`HTTP ${r.status}: ${r.statusText}`, 'err');
-      return;
-    }
-    // A 200 is NOT sufficient. If the URL resolves to the Vue SPA instead of
-    // the JSON API, the catch-all route returns 200 with an HTML document —
-    // which used to report "Connected" on a config that could not POST at all.
-    const contentType = r.headers.get('content-type') || '';
-    if (!contentType.includes('json')) {
-      showStatus(
-        `${apiUrl} answered with ${contentType || 'no content-type'}, not JSON `
-          + '— that looks like the FC web UI rather than its API.',
-        'err',
-      );
-      return;
-    }
-    showStatus(`Connected to ${apiUrl} — HTTP ${r.status}.`, 'ok');
+    if (r.ok) showStatus(`Connected — HTTP ${r.status}.`, 'ok');
+    else showStatus(`HTTP ${r.status}: ${r.statusText}`, 'err');
   } catch (e) {
     showStatus(`Cannot reach ${apiUrl}: ${e.message}`, 'err');
   }

extension/package.json

@@ -1,18 +1,15 @@
 {
   "name": "fabledcurator-extension",
-  "version": "1.0.11",
+  "version": "1.0.8",
   "private": true,
   "description": "Firefox extension for FabledCurator",
-  "comment_ignore_files": "The --ignore-files list comes from scripts/packaging.sh, the single source of truth shared with ci.yml's guard and the derived-version patch count. `set -f` is REQUIRED before the substitution: without it the shell globs `test/**` against the working tree and silently narrows the pattern to whatever files happen to exist.",
   "scripts": {
-    "lint":  "set -f; web-ext lint --source-dir=. --no-config-discovery --ignore-files $(sh scripts/packaging.sh ignore)",
-    "start": "set -f; web-ext run --source-dir=. --no-config-discovery --ignore-files $(sh scripts/packaging.sh ignore) --firefox=firefox",
-    "build": "set -f; web-ext build --source-dir=. --no-config-discovery --ignore-files $(sh scripts/packaging.sh ignore) --overwrite-dest",
-    "sign":  "set -f; web-ext sign --source-dir=. --no-config-discovery --ignore-files $(sh scripts/packaging.sh ignore) --channel=unlisted --api-key=$WEB_EXT_API_KEY --api-secret=$WEB_EXT_API_SECRET",
-    "test:unit": "vitest run"
+    "lint":  "web-ext lint --source-dir=. --no-config-discovery --ignore-files package.json package-lock.json web-ext-artifacts node_modules README.md .gitignore",
+    "start": "web-ext run --source-dir=. --no-config-discovery --ignore-files package.json package-lock.json web-ext-artifacts node_modules README.md .gitignore --firefox=firefox",
+    "build": "web-ext build --source-dir=. --no-config-discovery --ignore-files package.json package-lock.json web-ext-artifacts node_modules README.md .gitignore --overwrite-dest",
+    "sign":  "web-ext sign --source-dir=. --no-config-discovery --ignore-files package.json package-lock.json web-ext-artifacts node_modules README.md .gitignore --channel=unlisted --api-key=$WEB_EXT_API_KEY --api-secret=$WEB_EXT_API_SECRET"
   },
   "devDependencies": {
-    "vitest": "^4.0.0",
     "web-ext": "^10.0.0"
   }
 }

extension/popup/popup.css

@@ -72,17 +72,6 @@ body {
 .btn.block { display: block; width: 100%; margin-top: 8px; }
 .btn.link { background: none; color: var(--on-surface-variant); padding: 4px; }
 .btn.link:hover { color: var(--accent); }
-.btn.small { padding: 6px 12px; font-size: 13px; }
-
-/* In-app update prompt (accent-tinted so it reads as an actionable notice). */
-.update-banner {
-  display: flex; align-items: center; gap: 10px;
-  margin: 10px 10px 0; padding: 10px 12px;
-  background: rgba(244, 186, 122, 0.12);
-  border: 1px solid rgba(244, 186, 122, 0.4);
-  border-radius: 6px;
-}
-#update-text { flex: 1; font-size: 13px; }
 
 .source-row .play {
   background: none; border: none; color: var(--on-surface-variant);

extension/popup/popup.html

@@ -20,11 +20,6 @@
   </section>
 
   <section id="main-content" class="main hidden">
-    <div id="update-banner" class="update-banner hidden">
-      <span id="update-text"></span>
-      <button id="update-btn" class="btn primary small">Update</button>
-    </div>
-
     <nav class="tabs">
       <button class="tab active" data-tab="platforms">Platforms</button>
       <button class="tab" data-tab="sources">Sources</button>

extension/popup/popup.js

@@ -2,15 +2,6 @@ document.addEventListener('DOMContentLoaded', init);
 
 const CONNECTION_TEST_INTERVAL = 2 * 60 * 1000;
 
-// A centered muted note div — the loading / empty state shared by the platform
-// and sources lists.
-function mutedNote(text) {
-  const d = document.createElement('div');
-  d.style.cssText = 'text-align:center;padding:18px;color:var(--on-surface-variant);';
-  d.textContent = text;
-  return d;
-}
-
 async function init() {
   try {
     const cfg = await browser.runtime.sendMessage({ type: 'GET_CONFIG' });
@@ -23,7 +14,6 @@ async function init() {
     setupEventListeners();
     showPlatformsLoading();
     testConnectionIfNeeded();
-    checkForUpdate();
     loadPlatformStatus().catch(e => showError(`Failed to load platforms: ${e.message}`));
   } catch (e) {
     showSetupRequired();
@@ -47,7 +37,10 @@ function showSetupRequired() {
 function showPlatformsLoading() {
   const c = document.getElementById('platforms-list');
   c.textContent = '';
-  c.appendChild(mutedNote('Loading platforms…'));
+  const d = document.createElement('div');
+  d.style.cssText = 'text-align:center;padding:18px;color:var(--on-surface-variant);';
+  d.textContent = 'Loading platforms…';
+  c.appendChild(d);
 }
 
 async function testConnectionIfNeeded() {
@@ -70,30 +63,6 @@ function updateConnectionDot(connected) {
   d.title = connected ? 'Connected to FabledCurator' : 'Disconnected';
 }
 
-// Nudge to reinstall when the configured instance publishes a newer signed XPI
-// (the extension is self-hosted, so there's no Firefox auto-update). Never
-// blocks the popup — a failed check just leaves the banner hidden.
-async function checkForUpdate() {
-  try {
-    const r = await browser.runtime.sendMessage({ type: 'CHECK_UPDATE' });
-    if (r && r.updateAvailable && r.xpiUrl) showUpdateBanner(r);
-  } catch { /* non-fatal */ }
-}
-
-function showUpdateBanner(r) {
-  // The channel names itself beside the version, never inside it (#3113).
-  // Absent when the instance doesn't report one, and the banner then reads
-  // exactly as it did before the field existed.
-  const channel = r.channel ? ` (${r.channel})` : '';
-  document.getElementById('update-text').textContent =
-    `Update available${channel} — v${r.latestVersion} (installed v${r.currentVersion})`;
-  // Opening the signed XPI triggers Firefox's native install prompt.
-  document.getElementById('update-btn').addEventListener('click', () => {
-    browser.tabs.create({ url: r.xpiUrl });
-  });
-  document.getElementById('update-banner').classList.remove('hidden');
-}
-
 async function loadPlatformStatus() {
   const status = await browser.runtime.sendMessage({ type: 'GET_PLATFORM_STATUS' });
   const c = document.getElementById('platforms-list');
@@ -193,7 +162,10 @@ async function exportAllCookies() {
 async function loadSources() {
   const c = document.getElementById('sources-list');
   c.textContent = '';
-  c.appendChild(mutedNote('Loading sources…'));
+  const d = document.createElement('div');
+  d.style.cssText = 'text-align:center;padding:18px;color:var(--on-surface-variant);';
+  d.textContent = 'Loading sources…';
+  c.appendChild(d);
   const r = await browser.runtime.sendMessage({ type: 'LIST_SOURCES' });
   c.textContent = '';
   if (r.error) {
@@ -204,7 +176,10 @@ async function loadSources() {
     return;
   }
   if (!r.sources || r.sources.length === 0) {
-    c.appendChild(mutedNote('No sources yet.'));
+    const empty = document.createElement('div');
+    empty.style.cssText = 'text-align:center;padding:18px;color:var(--on-surface-variant);';
+    empty.textContent = 'No sources yet.';
+    c.appendChild(empty);
     return;
   }
   for (const src of r.sources) c.appendChild(createSourceRow(src));

extension/scripts/packaging.sh

@@ -1,177 +0,0 @@
-#!/bin/sh
-# Single source of truth for "what ships inside the XPI", plus the version
-# derived from it.
-#
-# Three consumers used to hand-maintain their own copy of this list, and
-# keeping three copies of one fact in sync by hand is how issue #2397 happened:
-#
-#   1. web-ext's --ignore-files      (extension/package.json's four scripts)
-#   2. the :(exclude) pathspec       (what moves the version — a WIDER
-#                                     set than the ignore list; see
-#                                     NOT_VERSION_RELEVANT)
-#   3. the git-log pathspec          (the derived version, below)
-#
-# They now all read from here. POSIX sh only — CI's run shell is busybox.
-#
-# -f (no pathname expansion) is set for the whole script and is load-bearing:
-# the lists below are iterated with deliberate word-splitting, and without -f
-# the shell would also GLOB them, expanding `test/**` into whatever files
-# happen to exist and corrupting the output. A caller's own `set -f` does not
-# help here — this runs as a separate sh process and does not inherit it.
-# Callers still need their own `set -f` for the substituted result; the two
-# guards protect different expansions.
-set -euf
-
-# Paths under extension/ that are NOT packaged into the XPI.
-#
-# Split by whether git tracks them: node_modules and web-ext-artifacts are
-# build/dependency output that never appears in a commit, so they belong in
-# web-ext's ignore list but would be meaningless in a git pathspec.
-#
-# Directories need BOTH forms. `test/**` matches the files inside, but not the
-# directory entry itself — web-ext writes an entry for the directory too, so
-# with only the glob the XPI ends up carrying empty `test/` and `scripts/`
-# entries (caught by the XPI-content check on 2026-08-03). The bare name alone
-# is not enough either: minimatch's `test` does not match `test/url.spec.js`,
-# so dropping the glob would ship the contents. Keep both.
-NOT_PACKAGED_TRACKED='package.json package-lock.json README.md .gitignore vitest.config.js scripts scripts/** test test/**'
-NOT_PACKAGED_BUILD='web-ext-artifacts node_modules'
-
-# Paths under extension/ that cannot change the SHIPPED BYTES, and so must not
-# move the derived version.
-#
-# Deliberately NOT the same list as NOT_PACKAGED_TRACKED, and the whole
-# difference is `scripts/`. packaging.sh is not packaged into the XPI — but it
-# DECIDES the version string, and build.yml stamps that string into the
-# manifest.json that is packaged. A change to how the version is computed is
-# therefore a change to the shipped bytes.
-#
-# Excluding it was harmless only while every push rebuilt the web image.
-# Milestone 313 step 4 made the rebuild conditional on the derived revision
-# moving, which turned it into a silent failure: a packaging.sh change gives a
-# NEW version, so sign-extension misses its ext-<version> cache and signs —
-# while build-web sees an unmoved revision, reuses the published image, and
-# ships the OLD XPI. An orphaned AMO signature, and an instance quietly serving
-# code the registry says is current.
-#
-# The two directions are not symmetric, which is why this list is the narrower
-# one. Too wide costs a re-sign and a rebuild for a change that ships nothing
-# new. Too narrow serves stale bytes and says nothing.
-NOT_VERSION_RELEVANT='package.json package-lock.json README.md .gitignore vitest.config.js test test/**'
-
-usage() {
-  echo "usage: packaging.sh {ignore|pathspec|version}" >&2
-  exit 2
-}
-
-# web-ext --ignore-files values, space-separated.
-#
-# Callers MUST disable pathname expansion first (`set -f`), or the shell will
-# glob `test/**` against the working tree before web-ext ever sees the pattern
-# and silently narrow it to whatever happens to exist right now.
-cmd_ignore() {
-  echo "$NOT_PACKAGED_TRACKED $NOT_PACKAGED_BUILD"
-}
-
-# git pathspec excluding the tracked files that cannot change the shipped
-# bytes, e.g. :(exclude)extension/package.json :(exclude)extension/test/**
-#
-# This answers "what moves the version?", NOT "what goes in the XPI?" — see
-# NOT_VERSION_RELEVANT for why those differ. cmd_ignore answers the other one.
-# Same `set -f` requirement as above.
-cmd_pathspec() {
-  for entry in $NOT_VERSION_RELEVANT; do
-    printf ':(exclude)extension/%s ' "$entry"
-  done
-  echo
-}
-
-# Strip leading zeros from one segment, leaving at least one digit.
-#
-# This exists for AMO and nothing else. Mozilla's version grammar for
-# addons.mozilla.org is documented as
-#
-#     ^(0|[1-9][0-9]{0,8})([.](0|[1-9][0-9]{0,8})){0,3}$
-#
-# — each segment is either the single digit `0` or starts 1-9, so `08` and
-# `0201` are rejected outright, while `0` itself is fine. MDN states it in
-# prose too: "Non-zero numbers must not include a leading zero."
-#
-# POSIX sh has no trim-loop, hence the while.
-unpad() {
-  s=$1
-  while [ "${#s}" -gt 1 ]; do
-    case "$s" in
-      0*) s=${s#0} ;;
-      *)  break ;;
-    esac
-  done
-  printf '%s' "$s"
-}
-
-# The extension's version: `YYYY.M.D.HHMM`, UTC, derived from the commit TIME
-# of the newest change to a PACKAGED extension file.
-#
-# THE ONE DELIBERATE DEPARTURE FROM THE FAMILY SHAPE, and it is a rendering
-# difference only. Rule 148 says `YYYY.MM.DD.HHMM` zero-padded, and every other
-# FC artifact emits exactly that. AMO's grammar (see unpad) forbids the padding,
-# and AMO is not negotiable: a rejected version is burned, since AMO 409s on
-# re-signing a version it has already seen. So the extension emits THE SAME
-# NUMBERS unpadded — 2026.08.29.0201 and 2026.8.29.201 are one value in two
-# renderings, and rule 148 already specifies comparison as numeric per segment,
-# under which they are equal. Nothing published is reordered by the choice, and
-# left-padding each segment recovers the family string exactly.
-#
-# HHMM is one segment, not two, because AMO allows at most FOUR. Unpadded that
-# reads oddly (00:14 -> `14`, midnight -> `0`) but stays strictly increasing
-# within a day, which is all the ordering needs.
-#
-# Why the commit's time and not the build's:
-#   * MONOTONIC — max() over a set that only ever gains members.
-#   * STABLE while the extension is unchanged, so an unchanged extension keeps
-#     its version, the ext-<version> signature cache still hits, and AMO is
-#     called once per extension CHANGE rather than once per push. Build-time
-#     minutes would re-sign on every push and never let two channels share a
-#     signature.
-#   * SHARED ACROSS CHANNELS — after a merge, `main` sees the same commit and
-#     derives the same number, so `:latest` reuses the signature `:dev` already
-#     produced for byte-identical code. Same code, same version, one signing.
-#   * REPRODUCIBLE — any checkout of a commit yields that commit's version.
-#
-# Never a commit count (family rule 149): a count is per-branch, so `dev` and
-# `main` count different histories of the same code and order by which branch
-# accumulated more commits rather than by which is newer. A squash-merge makes
-# that permanent. Roundtable's 2026-08-24 incident, in a different repo.
-#
-# Requires real history: a depth-1 clone sees one commit and will derive a wrong
-# (too low) value. Every consumer must check out with fetch-depth: 0.
-#
-# Formatted through git rather than date(1): busybox date does not reliably
-# accept `-d @<epoch>`, and git's --date=format-local is available wherever git
-# is. TZ=UTC so the value does not depend on the runner's timezone.
-cmd_version() {
-  root=$(git rev-parse --show-toplevel)
-  # Unquoted on purpose: the pathspec must word-split into separate args.
-  # Globbing is already off script-wide (set -euf above).
-  # shellcheck disable=SC2046
-  sha=$(cd "$root" && git log --format='%ct %H' HEAD -- extension/ $(cmd_pathspec) \
-        | sort -n | tail -1 | cut -d' ' -f2)
-  if [ -z "$sha" ]; then
-    echo "packaging.sh: no commit touches a packaged extension file" >&2
-    exit 1
-  fi
-  padded=$(cd "$root" && TZ=UTC git show -s --format=%cd \
-           --date='format-local:%Y.%m.%d.%H%M' "$sha")
-  # Rebinding the function's own positional params, which are unused here.
-  # shellcheck disable=SC2046
-  set -- $(echo "$padded" | tr '.' ' ')
-  echo "$(unpad "$1").$(unpad "$2").$(unpad "$3").$(unpad "$4")"
-}
-
-[ $# -ge 1 ] || usage
-case "$1" in
-  ignore)   cmd_ignore ;;
-  pathspec) cmd_pathspec ;;
-  version)  cmd_version ;;
-  *)        usage ;;
-esac

extension/test/helpers/loadLib.js

@@ -1,29 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { fileURLToPath } from 'node:url'
-import path from 'node:path'
-
-const LIB_DIR = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', '..', 'lib')
-
-/**
- * Load an extension lib and hand back the globals it declares.
- *
- * The files under lib/ are CLASSIC scripts, not ES modules: manifest.json
- * lists them in `background.scripts` and options.html pulls them in with a
- * plain <script> tag, so they declare bare functions into a shared scope and
- * export nothing. Rather than bolt a `module.exports` shim onto production
- * code that would never run in the browser, evaluate the real file the same
- * way the browser does — as a script body — and pick the declarations back out.
- *
- * This means the specs exercise the exact bytes that get packaged into the
- * XPI. Only usable for libs that touch no browser APIs at load time
- * (url.js, platforms.js); cookies.js and api.js reference `browser.*` and
- * would need stubbing, which is why they aren't loaded this way.
- *
- * @param {string} filename e.g. 'url.js'
- * @param {string[]} names  declarations to return, e.g. ['normalizeApiUrl']
- */
-export function loadLib(filename, names) {
-  const source = readFileSync(path.join(LIB_DIR, filename), 'utf8')
-  const factory = new Function(`${source}\nreturn { ${names.join(', ')} }`)
-  return factory()
-}

extension/test/platforms.spec.js

@@ -1,190 +0,0 @@
-import { describe, it, expect } from 'vitest'
-import { readFileSync } from 'node:fs'
-import { fileURLToPath } from 'node:url'
-import path from 'node:path'
-import { loadLib } from './helpers/loadLib.js'
-
-const EXT_DIR = path.join(path.dirname(fileURLToPath(import.meta.url)), '..')
-const manifest = JSON.parse(readFileSync(path.join(EXT_DIR, 'manifest.json'), 'utf8'))
-
-const { getPlatformFromUrl, isArtistPage, PLATFORMS, PLATFORM_ARTIST_PATTERNS } = loadLib(
-  'platforms.js',
-  ['getPlatformFromUrl', 'isArtistPage', 'PLATFORMS', 'PLATFORM_ARTIST_PATTERNS']
-)
-
-describe('getPlatformFromUrl', () => {
-  it('identifies each platform from a domain URL', () => {
-    expect(getPlatformFromUrl('https://www.patreon.com/Atole')).toBe('patreon')
-    expect(getPlatformFromUrl('https://subscribestar.adult/someone')).toBe('subscribestar')
-    expect(getPlatformFromUrl('https://www.hentai-foundry.com/user/someone')).toBe('hentaifoundry')
-    expect(getPlatformFromUrl('https://discord.com/channels/@me')).toBe('discord')
-    expect(getPlatformFromUrl('https://www.pixiv.net/en/users/123')).toBe('pixiv')
-  })
-
-  it('accepts http as well as https, with or without www', () => {
-    expect(getPlatformFromUrl('http://patreon.com/Atole')).toBe('patreon')
-    expect(getPlatformFromUrl('https://www.patreon.com/Atole')).toBe('patreon')
-  })
-
-  it('returns null for unrelated hosts', () => {
-    expect(getPlatformFromUrl('https://example.com/patreon.com')).toBe(null)
-    expect(getPlatformFromUrl('https://not-patreon.com/Atole')).toBe(null)
-    expect(getPlatformFromUrl('')).toBe(null)
-  })
-
-  it('returns null for deviantart, retired at #3069', () => {
-    // The 2026-07-05 product decision (FC downloaders = art-dedicated services
-    // only) left deviantart wired for seven weeks. Asserting the negative is
-    // what keeps a partial retirement from being re-completed by accident.
-    expect(getPlatformFromUrl('https://www.deviantart.com/someone')).toBe(null)
-    expect(PLATFORMS.deviantart).toBeUndefined()
-    expect(PLATFORM_ARTIST_PATTERNS.deviantart).toBeUndefined()
-  })
-})
-
-describe('isArtistPage', () => {
-  // Regression cases from issue #1485: the Add-to-FC button vanished once the
-  // operator SUBSCRIBED to a creator, because Patreon serves subscribed users
-  // the /cw/ ("creator workspace") URL and the pattern only matched the bare
-  // root. All three creator URL shapes must match, plus inner pages — the
-  // button matters most exactly when you're subscribed.
-  it('matches all three Patreon creator URL shapes', () => {
-    expect(isArtistPage('https://www.patreon.com/Atole', 'patreon')).toBe(true)
-    expect(isArtistPage('https://www.patreon.com/c/Atole', 'patreon')).toBe(true)
-    expect(isArtistPage('https://www.patreon.com/cw/Atole', 'patreon')).toBe(true)
-  })
-
-  it('matches Patreon creator inner pages', () => {
-    expect(isArtistPage('https://www.patreon.com/cw/Atole/posts', 'patreon')).toBe(true)
-    expect(isArtistPage('https://www.patreon.com/Atole/membership', 'patreon')).toBe(true)
-  })
-
-  it('excludes Patreon navigation pages that are not creators', () => {
-    for (const nav of ['home', 'search', 'messages', 'notifications', 'library', 'settings']) {
-      expect(isArtistPage(`https://www.patreon.com/${nav}`, 'patreon')).toBe(false)
-      expect(isArtistPage(`https://www.patreon.com/${nav}/anything`, 'patreon')).toBe(false)
-    }
-  })
-
-  it('matches SubscribeStar creator roots on both TLDs but not feed pages', () => {
-    expect(isArtistPage('https://subscribestar.adult/someone', 'subscribestar')).toBe(true)
-    expect(isArtistPage('https://subscribestar.com/someone', 'subscribestar')).toBe(true)
-    expect(isArtistPage('https://subscribestar.adult/feed', 'subscribestar')).toBe(false)
-    expect(isArtistPage('https://subscribestar.adult/messages', 'subscribestar')).toBe(false)
-  })
-
-  it('matches Hentai Foundry user pages only', () => {
-    expect(isArtistPage('https://www.hentai-foundry.com/user/someone', 'hentaifoundry')).toBe(true)
-    expect(isArtistPage('https://www.hentai-foundry.com/pictures/popular', 'hentaifoundry')).toBe(
-      false
-    )
-  })
-
-  it('matches Pixiv numeric user pages, with or without the /en/ prefix', () => {
-    expect(isArtistPage('https://www.pixiv.net/users/12345', 'pixiv')).toBe(true)
-    expect(isArtistPage('https://www.pixiv.net/en/users/12345', 'pixiv')).toBe(true)
-    expect(isArtistPage('https://www.pixiv.net/en/artworks/999', 'pixiv')).toBe(false)
-  })
-
-  it('returns false for a platform with no artist pattern (discord)', () => {
-    expect(isArtistPage('https://discord.com/channels/@me', 'discord')).toBe(false)
-  })
-
-  it('returns false for an unknown platform key', () => {
-    expect(isArtistPage('https://www.patreon.com/Atole', 'nope')).toBe(false)
-  })
-})
-
-describe('platform table integrity', () => {
-  it('gives every artist pattern a corresponding platform entry', () => {
-    // A pattern keyed to a platform that no longer exists is dead code that
-    // silently never fires; the reverse (a platform with no pattern) is the
-    // legitimate discord case, so only this direction is an error.
-    for (const key of Object.keys(PLATFORM_ARTIST_PATTERNS)) {
-      expect(Object.keys(PLATFORMS)).toContain(key)
-    }
-  })
-
-  it('gives every platform the fields the popup renders', () => {
-    for (const [key, platform] of Object.entries(PLATFORMS)) {
-      expect(platform.name, `${key}.name`).toBeTruthy()
-      expect(platform.color, `${key}.color`).toMatch(/^#[0-9A-Fa-f]{6}$/)
-      expect(['cookies', 'token'], `${key}.authType`).toContain(platform.authType)
-      expect(platform.urlPattern, `${key}.urlPattern`).toBeInstanceOf(RegExp)
-      expect(Array.isArray(platform.domains), `${key}.domains`).toBe(true)
-      expect(platform.domains.length, `${key}.domains`).toBeGreaterThan(0)
-    }
-  })
-
-  it('keeps every artist URL matched by its own platform pattern too', () => {
-    // isArtistPage is only ever consulted after getPlatformFromUrl resolves a
-    // key, so an artist pattern matching a URL its platform's urlPattern
-    // rejects would be unreachable.
-    const samples = {
-      patreon: 'https://www.patreon.com/cw/Atole',
-      subscribestar: 'https://subscribestar.adult/someone',
-      hentaifoundry: 'https://www.hentai-foundry.com/user/someone',
-      pixiv: 'https://www.pixiv.net/en/users/12345'
-    }
-    for (const [key, url] of Object.entries(samples)) {
-      expect(isArtistPage(url, key), `${key} artist pattern`).toBe(true)
-      expect(getPlatformFromUrl(url), `${key} urlPattern`).toBe(key)
-    }
-  })
-})
-
-describe('manifest.json agrees with the platform table', () => {
-  // #3069: deviantart was dropped from the product in July but survived in
-  // manifest.json until late August, because NOTHING tied the manifest's
-  // domain lists back to PLATFORMS. These two specs are that tie. Both
-  // directions matter: a stale match ships host access the product decided
-  // not to use, and a missing one silently kills the Add-to-FC button.
-  const matches = manifest.content_scripts[0].matches
-  // '*://*.patreon.com/*' -> '.patreon.com', the form PLATFORMS.domains uses.
-  const hostOf = (m) => m.replace(/^\*:\/\/\*/, '').replace(/\/\*$/, '')
-
-  it('injects the content script only on domains a platform claims', () => {
-    for (const m of matches) {
-      const host = hostOf(m)
-      const owner = Object.entries(PLATFORMS).find(
-        ([, p]) => p.domains.includes(host)
-      )
-      expect(owner, `no platform claims content-script match "${m}"`).toBeTruthy()
-      // The content script exists to draw the Add-as-source button, so a
-      // platform with no artist pattern (discord) has no business here.
-      expect(
-        PLATFORM_ARTIST_PATTERNS[owner[0]],
-        `"${m}" injects for ${owner[0]}, which has no artist pattern`
-      ).toBeTruthy()
-    }
-  })
-
-  it('injects on every platform that has an artist pattern', () => {
-    const covered = new Set(
-      matches
-        .map(hostOf)
-        .map((h) => Object.entries(PLATFORMS).find(([, p]) => p.domains.includes(h)))
-        .filter(Boolean)
-        .map(([key]) => key)
-    )
-    for (const key of Object.keys(PLATFORM_ARTIST_PATTERNS)) {
-      expect(covered, `${key} has an artist pattern but no content-script match`).toContain(key)
-    }
-  })
-
-  it('requests no host permission for a domain no platform claims', () => {
-    // '*://*/*' is the deliberate exception: FC is self-hosted at an arbitrary
-    // operator-chosen URL, so the extension cannot enumerate its own backend.
-    // Every OTHER entry is a platform domain and must still have an owner.
-    for (const h of manifest.host_permissions) {
-      if (h === '*://*/*') continue
-      const host = hostOf(h)
-      // pixiv's OAuth/API hosts are pixiv infrastructure, not creator pages,
-      // so they are matched by suffix rather than by the domains list.
-      const claimed = Object.values(PLATFORMS).some(
-        (p) => p.domains.includes(host) || p.domains.some((d) => host.endsWith(d))
-      )
-      expect(claimed, `host permission "${h}" belongs to no platform`).toBe(true)
-    }
-  })
-})

extension/test/url.spec.js

@@ -1,93 +0,0 @@
-import { describe, it, expect } from 'vitest'
-import { loadLib } from './helpers/loadLib.js'
-
-const { normalizeApiUrl, webRootFromApiUrl } = loadLib('url.js', [
-  'normalizeApiUrl',
-  'webRootFromApiUrl'
-])
-
-describe('normalizeApiUrl', () => {
-  // The bug this exists for (issue #2393): the instance root was accepted and
-  // stored verbatim, so every request went to /credentials instead of
-  // /api/credentials. That path is a Vue router route, so the SPA catch-all
-  // answered GET with 200 HTML and rejected POST with 405 — which read as a
-  // backend bug rather than a URL one.
-  it('appends /api to an instance root', () => {
-    expect(normalizeApiUrl('http://curator.traefik.internal')).toBe(
-      'http://curator.traefik.internal/api'
-    )
-  })
-
-  it('leaves an API root alone rather than doubling the suffix', () => {
-    expect(normalizeApiUrl('http://curator.traefik.internal/api')).toBe(
-      'http://curator.traefik.internal/api'
-    )
-  })
-
-  it('is idempotent', () => {
-    const once = normalizeApiUrl('http://curator.example.com')
-    expect(normalizeApiUrl(once)).toBe(once)
-  })
-
-  it('strips trailing slashes before deciding', () => {
-    expect(normalizeApiUrl('http://curator.example.com/')).toBe('http://curator.example.com/api')
-    expect(normalizeApiUrl('http://curator.example.com///')).toBe('http://curator.example.com/api')
-    expect(normalizeApiUrl('http://curator.example.com/api/')).toBe('http://curator.example.com/api')
-  })
-
-  it('trims surrounding whitespace (paste artifacts)', () => {
-    expect(normalizeApiUrl('  http://curator.example.com  ')).toBe(
-      'http://curator.example.com/api'
-    )
-  })
-
-  it('matches the /api suffix case-insensitively', () => {
-    expect(normalizeApiUrl('http://curator.example.com/API')).toBe('http://curator.example.com/API')
-  })
-
-  it('returns empty string for empty/nullish input, never a bare "/api"', () => {
-    // isConfigured() gates on truthiness, so a bogus '/api' here would read as
-    // "configured" and produce a request against the options page's own origin.
-    expect(normalizeApiUrl('')).toBe('')
-    expect(normalizeApiUrl('   ')).toBe('')
-    expect(normalizeApiUrl(null)).toBe('')
-    expect(normalizeApiUrl(undefined)).toBe('')
-  })
-
-  it('does not treat a path merely containing "api" as the suffix', () => {
-    expect(normalizeApiUrl('http://curator.example.com/apiary')).toBe(
-      'http://curator.example.com/apiary/api'
-    )
-  })
-
-  it('preserves a subpath deployment', () => {
-    expect(normalizeApiUrl('http://host.internal/curator')).toBe('http://host.internal/curator/api')
-  })
-})
-
-describe('webRootFromApiUrl', () => {
-  // The SPA root, where the Vue router and the served XPI live. Used by
-  // OPEN_ARTIST_PAGE and the self-update check — NOT the JSON API.
-  it('strips the /api suffix', () => {
-    expect(webRootFromApiUrl('http://curator.example.com/api')).toBe('http://curator.example.com')
-  })
-
-  it('accepts an instance root unchanged', () => {
-    expect(webRootFromApiUrl('http://curator.example.com')).toBe('http://curator.example.com')
-  })
-
-  it('agrees with normalizeApiUrl in both directions', () => {
-    for (const input of ['http://curator.example.com', 'http://curator.example.com/api']) {
-      expect(normalizeApiUrl(webRootFromApiUrl(input))).toBe(normalizeApiUrl(input))
-    }
-  })
-
-  it('preserves a subpath deployment', () => {
-    expect(webRootFromApiUrl('http://host.internal/curator/api')).toBe('http://host.internal/curator')
-  })
-
-  it('returns empty string for empty/nullish input', () => {
-    expect(webRootFromApiUrl('')).toBe('')
-    expect(webRootFromApiUrl(null)).toBe('')
-  })
-})

extension/test/version.spec.js

@@ -1,191 +0,0 @@
-import { describe, it, expect } from 'vitest'
-import { readdirSync, readFileSync } from 'node:fs'
-import { execFileSync } from 'node:child_process'
-import { fileURLToPath } from 'node:url'
-import path from 'node:path'
-
-const EXT_DIR = path.join(path.dirname(fileURLToPath(import.meta.url)), '..')
-const read = (name) => JSON.parse(readFileSync(path.join(EXT_DIR, name), 'utf8'))
-const readText = (...seg) => readFileSync(path.join(EXT_DIR, ...seg), 'utf8')
-
-// Only the git-free subcommands are exercised here: `version` shells out to
-// git, and the extension lane runs on node:24-bookworm-slim which may not ship
-// it. That one is covered where git is guaranteed — ci.yml's extension-version
-// lane and build.yml both run on ci-python.
-const packaging = (cmd) =>
-  execFileSync('sh', [path.join(EXT_DIR, 'scripts', 'packaging.sh'), cmd], {
-    cwd: EXT_DIR,
-    encoding: 'utf8'
-  })
-    .trim()
-    .split(/\s+/)
-    .filter(Boolean)
-
-describe('packaging.sh — the single definition of what ships', () => {
-  it('emits an ignore list and a pathspec that agree on the tracked files', () => {
-    const ignore = packaging('ignore')
-    const pathspec = packaging('pathspec').map((e) => e.replace(':(exclude)extension/', ''))
-
-    // Every git-excluded path must also be hidden from web-ext. The reverse is
-    // not required: node_modules and web-ext-artifacts are build output git
-    // never tracks, so they appear only in the ignore list.
-    for (const entry of pathspec) {
-      expect(ignore, `pathspec has "${entry}" but --ignore-files does not`).toContain(entry)
-    }
-    expect(pathspec.length).toBeGreaterThan(0)
-    expect(ignore).toContain('node_modules')
-  })
-
-  it('emits glob patterns literally, never expanded against the working tree', () => {
-    // The script iterates its lists with deliberate word-splitting, so it must
-    // run with pathname expansion off. Without that, invoking it from a cwd
-    // where test/ exists (exactly how ci.yml and vitest call it) expands
-    // `test/**` into the individual spec files, and the pathspec silently stops
-    // covering anything added later.
-    const pathspec = packaging('pathspec')
-    expect(pathspec).toContain(':(exclude)extension/test/**')
-    expect(pathspec.some((e) => e.includes('.spec.js'))).toBe(false)
-    expect(pathspec.some((e) => e.includes('helpers'))).toBe(false)
-
-    const ignore = packaging('ignore')
-    expect(ignore).toContain('test/**')
-    expect(ignore).toContain('scripts/**')
-    expect(ignore.some((e) => e.includes('.spec.js'))).toBe(false)
-  })
-
-  it('lets packaging.sh move the version, though it never ships in the XPI', () => {
-    // The two lists answer different questions and this is the one place they
-    // disagree. scripts/ is ignored by web-ext — it is repo tooling, not addon
-    // code — but packaging.sh DECIDES the version string, and build.yml stamps
-    // that string into the manifest.json that does ship. So changing how the
-    // version is computed changes the shipped bytes.
-    //
-    // Excluding it from the pathspec was invisible while every push rebuilt the
-    // web image. Milestone 313 step 4 made that rebuild conditional on the
-    // derived revision moving, and the omission turned into a silent failure:
-    // a new version means sign-extension misses its ext-<version> cache and
-    // signs, while build-web sees an unmoved revision, reuses the published
-    // image and ships the OLD XPI. An orphaned signature, and an instance
-    // serving code the registry calls current.
-    const pathspec = packaging('pathspec')
-    expect(
-      pathspec.some((e) => e.startsWith(':(exclude)extension/scripts')),
-      'the pathspec excludes scripts/, so a change to how the version is '
-        + 'derived would not move the version it derives',
-    ).toBe(false)
-
-    // ...and it is still kept out of the package itself. Both must hold: the
-    // tempting "fix" for either half is to make the two lists one again.
-    expect(packaging('ignore')).toContain('scripts')
-  })
-
-  it('keeps its own scripts and specs out of the XPI', () => {
-    // Both are repo infrastructure. web-ext packages everything not ignored, so
-    // omitting either would ship dev tooling to users -- and `test/**` in
-    // particular only survives because callers `set -f` before substituting it.
-    const ignore = packaging('ignore')
-    expect(ignore).toContain('vitest.config.js')
-    // Both forms per directory. The glob covers the contents; the bare name
-    // covers the directory ENTRY, which web-ext writes separately — with only
-    // the glob, the XPI carries an empty `test/` and `scripts/`.
-    for (const dir of ['test', 'scripts']) {
-      expect(ignore, `${dir} contents`).toContain(`${dir}/**`)
-      expect(ignore, `${dir} directory entry`).toContain(dir)
-    }
-  })
-})
-
-describe('consumers delegate rather than keeping their own copy', () => {
-  // These assertions are the actual anti-regression value: it is easy for a
-  // future edit to "simplify" by inlining a literal list again, which silently
-  // reintroduces the drift that issue #2397 was about.
-  it('package.json derives --ignore-files from the script', () => {
-    for (const [name, script] of Object.entries(read('package.json').scripts)) {
-      if (!script.includes('--ignore-files')) continue
-      expect(script, `${name} should call packaging.sh`).toContain('scripts/packaging.sh ignore')
-      expect(script, `${name} must set -f before the substitution`).toMatch(/set -f;/)
-    }
-  })
-
-  // Read from disk rather than listed by hand. The point of this assertion is
-  // that it survives consumers coming and going, and a hardcoded list is the
-  // one part of it that cannot — release.yml (milestone 318 step 7) would have
-  // joined the directory without joining the check.
-  const WORKFLOWS = readdirSync(path.join(EXT_DIR, '..', '.forgejo', 'workflows')).filter((f) =>
-    f.endsWith('.yml')
-  )
-
-  it('no workflow hardcodes the packaged-file set', () => {
-    // ci.yml used to substitute `packaging.sh pathspec` directly, for the
-    // manual-bump guard that milestone 271 step 5 retired. Nothing inlines the
-    // set today, and nothing should start to: a literal :(exclude)extension/...
-    // in a workflow means someone bypassed the shared definition, which is
-    // exactly the drift #2397 was about.
-    expect(
-      WORKFLOWS.length,
-      'no workflows found — the glob is not looking where it thinks'
-    ).toBeGreaterThan(2)
-    for (const wf of WORKFLOWS) {
-      const text = readText('..', '.forgejo', 'workflows', wf)
-      expect(text, `${wf} inlines an :(exclude) literal`).not.toMatch(/:\(exclude\)extension\//)
-    }
-  })
-
-  it('build.yml takes the shipped version from the script, not from the repo', () => {
-    // The version is DERIVED from commit time (#3092, milestone 271 step 4).
-    // Going back to reading the committed value is not a style regression, it
-    // is the bug: a hand-set version makes dev and main sign the same number
-    // for different code, and the ext-<version> cache then serves one channel
-    // the other's XPI.
-    const build = readText('..', '.forgejo', 'workflows', 'build.yml')
-    expect(build).toContain('packaging.sh version')
-    expect(build, 'build.yml re-reads the committed version instead of deriving it')
-      .not.toMatch(/grep[^\n]*'"version"'[^\n]*package\.json/)
-  })
-})
-
-describe('extension version', () => {
-  // Mozilla's published grammar for addons.mozilla.org, transcribed from MDN's
-  // manifest.json/version page. Each segment is the single digit 0 or starts
-  // 1-9 — so no leading zeros — and there are at most four of them.
-  const AMO = /^(0|[1-9][0-9]{0,8})(\.(0|[1-9][0-9]{0,8})){0,3}$/
-
-  it('keeps a committed version AMO would accept, though it ships nothing', () => {
-    // The committed value is wholly inert since milestone 318 step 8: there is
-    // no hand-set MAJOR.MINOR left for packaging.sh to read, and build.yml
-    // stamps the derived string over both files before web-ext sees them.
-    //
-    // It is still asserted, for one reason: `npm run build` locally packages
-    // whatever is committed, so a value AMO would reject turns a local build
-    // into a confusing failure with no CI signal ahead of it. ci.yml checks
-    // the same grammar against the DERIVED value, which is the one AMO sees.
-    for (const file of ['manifest.json', 'package.json']) {
-      expect(read(file).version, `${file} version is not AMO-shaped`).toMatch(AMO)
-    }
-  })
-
-  it('rejects the zero-padded family shape, which is why the extension unpads', () => {
-    // Guards the reason for the exception, not just its result. If this ever
-    // starts passing, someone has loosened the pattern and the next sign burns
-    // an AMO version to find out. (#3138.)
-    expect('2026.08.29.0201').not.toMatch(AMO)
-    expect('2026.8.29.201').toMatch(AMO)
-    // Five segments: AMO allows four.
-    expect('2026.8.29.2.1').not.toMatch(AMO)
-  })
-
-  it('declares manifest v3', () => {
-    expect(read('manifest.json').manifest_version).toBe(3)
-  })
-
-  it('lists every background script that exists, in dependency order', () => {
-    // url.js must load BEFORE api.js: api.js calls normalizeApiUrl at
-    // init()-time, and these are classic scripts sharing one scope, so a
-    // reordering here is a runtime ReferenceError with no build-time signal.
-    const scripts = read('manifest.json').background.scripts
-    for (const rel of scripts) {
-      expect(() => readFileSync(path.join(EXT_DIR, rel)), `missing ${rel}`).not.toThrow()
-    }
-    expect(scripts.indexOf('lib/url.js')).toBeLessThan(scripts.indexOf('lib/api.js'))
-  })
-})

extension/vitest.config.js

@@ -1,13 +0,0 @@
-import { defineConfig } from 'vitest/config'
-
-// Mirrors frontend/vitest.config.js, minus the Vue plugin — the extension has
-// no SFCs and mounts nothing. Pure-logic specs only, so `node` is enough; the
-// libs under test are deliberately the ones with no browser-API surface (see
-// test/helpers/loadLib.js).
-export default defineConfig({
-  test: {
-    environment: 'node',
-    include: ['test/**/*.spec.js'],
-    passWithNoTests: true
-  }
-})

frontend/src/components/artist/ArtistDangerZone.vue

@@ -50,19 +50,14 @@ const projected = ref(null)
 
 const projectedCounts = computed(() => projected.value?.projected || null)
 
-// `posts` is named here, not left to the counts grid below it: an artist whose
-// posts are body-only previews as `images: 0`, and a summary line that says
-// only "0 images" reads as "this artist is empty" while the apply destroys
-// every captured post body (#3067). Attachments stay in the grid — the grid
-// renders every key, so this line carries only what changes the read.
-const modalDescription = computed(() => {
-  const p = projectedCounts.value
-  return p
-    ? `Artist “${props.artistName}” — ${p.images} images, `
-      + `${p.posts} posts, ${p.sources} sources, `
-      + `${Math.round(p.bytes_on_disk / 1_048_576)} MiB on disk`
-    : ''
-})
+const modalDescription = computed(
+  () => projected.value
+    ? `Artist “${props.artistName}” — `
+        + `${projected.value.projected.images} images, `
+        + `${projected.value.projected.sources} sources, `
+        + `${Math.round(projected.value.projected.bytes_on_disk / 1_048_576)} MiB on disk`
+    : '',
+)
 
 async function onClick() {
   loading.value = true

frontend/src/components/common/SettingNumberField.vue

@@ -1,56 +0,0 @@
-<!--
-  Canonical settings number field (DRY pass #161): a compact numeric v-text-field
-  with a built-in clamp to [min,max] on commit. Hand-rolled identically across the
-  ML settings cards (HeadsCard x6, CropProposersCard, VideoEmbeddingCard).
-
-  The clamp is the point: the cards previously sent Number(raw) straight to the
-  API, so an out-of-range value bounced off the API's 400 validator (only
-  TranslationCard clamped). This is now the single home for that clamp.
-
-  Binds `modelValue` (v-model) and emits `change` on blur/enter AFTER clamping, so
-  the parent's save reads the already-clamped value — same as the prior
-  `v-model.number` + `@change=save` pattern.
--->
-<template>
-  <v-text-field
-    :model-value="modelValue"
-    :label="label"
-    type="number"
-    :min="min"
-    :max="max"
-    :step="step"
-    :disabled="disabled"
-    :density="density" hide-details
-    :style="{ maxWidth }"
-    @update:model-value="v => emit('update:modelValue', v)"
-    @change="onCommit"
-  />
-</template>
-
-<script setup>
-const props = defineProps({
-  modelValue: { type: [Number, String], default: null },
-  label: { type: String, default: '' },
-  min: { type: [Number, String], default: null },
-  max: { type: [Number, String], default: null },
-  step: { type: [Number, String], default: 1 },
-  maxWidth: { type: String, default: '200px' },
-  density: { type: String, default: 'compact' },
-  disabled: { type: Boolean, default: false },
-})
-const emit = defineEmits(['update:modelValue', 'change'])
-
-function onCommit() {
-  // On blur/enter: coerce to a number and clamp to [min,max] so an out-of-range
-  // value never reaches the API. props.modelValue reflects the latest keystroke
-  // (kept in sync by the passthrough above); re-emit the clamped number, then let
-  // the parent persist.
-  let n = Number(props.modelValue)
-  if (!Number.isNaN(n)) {
-    if (props.min !== null && props.min !== '') n = Math.max(Number(props.min), n)
-    if (props.max !== null && props.max !== '') n = Math.min(Number(props.max), n)
-    if (n !== Number(props.modelValue)) emit('update:modelValue', n)
-  }
-  emit('change')
-}
-</script>

frontend/src/components/common/SettingToggleRow.vue

@@ -1,42 +0,0 @@
-<!--
-  Canonical settings toggle row (DRY pass #161): an accent icon + an uppercase
-  .fc-section-h label + a right-aligned switch. Hand-rolled identically in the
-  ML settings cards (HeadsCard x3, CropProposersCard, MLBackfillCard).
-
-  Two-way binds `modelValue` (so the parent switch state stays optimistic) AND
-  emits `change` with the new boolean, so the parent can persist + revert on
-  failure — matching the prior `v-model` + `@update:model-value=handler` pattern.
--->
-<template>
-  <div class="d-flex align-center mb-1" style="gap: 10px;">
-    <v-icon v-if="icon" size="18" :color="iconColor">{{ icon }}</v-icon>
-    <span class="fc-section-h">{{ label }}</span>
-    <v-switch
-      :model-value="modelValue"
-      :loading="loading"
-      :disabled="disabled"
-      hide-details density="compact" color="success" class="ml-auto"
-      @update:model-value="onSwitch"
-    />
-  </div>
-</template>
-
-<script setup>
-defineProps({
-  modelValue: { type: Boolean, default: false },
-  label: { type: String, default: '' },
-  icon: { type: String, default: '' },
-  // Icon tint. Default accent; pass null for the theme default (e.g. when a row
-  // is off). null (not undefined) so the default doesn't override it.
-  iconColor: { type: String, default: 'accent' },
-  loading: { type: Boolean, default: false },
-  disabled: { type: Boolean, default: false },
-})
-const emit = defineEmits(['update:modelValue', 'change'])
-
-function onSwitch(v) {
-  const b = !!v
-  emit('update:modelValue', b)
-  emit('change', b)
-}
-</script>

frontend/src/components/gallery/GalleryItem.vue

@@ -139,9 +139,9 @@ function onThumbError() { thumbError.value = true }
   position: absolute; top: 8px; left: 8px;
   width: 22px; height: 22px; border-radius: 4px;
   border: 2px solid rgba(232, 228, 216, 0.8);
-  background: rgba(var(--v-theme-background), 0.45);
+  background: rgba(20, 23, 26, 0.45);
   display: grid; place-items: center;
-  color: rgb(var(--v-theme-background)); z-index: 11;
+  color: #14171A; z-index: 11;
 }
 .fc-gallery-item__checkbox.on {
   background: rgb(var(--v-theme-accent));
@@ -152,7 +152,7 @@ function onThumbError() { thumbError.value = true }
   min-width: 22px; height: 22px; padding: 0 5px;
   border-radius: 11px;
   background: rgb(var(--v-theme-accent));
-  color: rgb(var(--v-theme-background)); font-size: 12px; font-weight: 700;
+  color: #14171A; font-size: 12px; font-weight: 700;
   display: grid; place-items: center; z-index: 11;
   pointer-events: none;
 }
@@ -160,8 +160,7 @@ function onThumbError() { thumbError.value = true }
   position: absolute; left: 0; right: 0; bottom: 0;
   padding: 14px 8px 6px;
   background: linear-gradient(
-    to top, rgba(var(--v-theme-background), 0.78),
-    rgba(var(--v-theme-background), 0)
+    to top, rgba(20, 23, 26, 0.78), rgba(20, 23, 26, 0)
   );
   font-size: 12px; line-height: 1.2;
   white-space: nowrap; overflow: hidden; text-overflow: ellipsis;

frontend/src/components/settings/AttachmentReclaimCard.vue

@@ -1,127 +0,0 @@
-<template>
-  <!-- #3068: attachment reclamation. PostAttachment's FKs are both SET NULL, so
-       a deleted post or artist leaves the row behind; and the store is
-       sha-addressed, so one blob backs many rows and deleting a row never freed
-       its file. Nothing swept either. Preview first, then apply (destructive:
-       unlinks files). -->
-  <MaintenanceTile
-    icon="mdi-paperclip-off"
-    title="Reclaim orphaned attachments"
-    blurb="Remove attachment records belonging to nothing, and the files nothing references."
-    destructive
-    :open="applying || previewing"
-  >
-    <p class="text-body-2 mb-3">
-      Attachment records survive the post and artist they belonged to, and the
-      files behind them are shared between records — so a deleted record never
-      freed its file on its own. This finds records attributed to
-      <strong>neither</strong> a post nor an artist, and files in the attachment
-      store that <strong>no remaining record</strong> points at.
-      <strong>Preview</strong> first; <strong>Apply</strong> deletes those
-      records and unlinks those files. Files written in the last few hours are
-      always left alone, so an in-progress download is never caught mid-write.
-    </p>
-
-    <div class="d-flex align-center flex-wrap" style="gap: 12px;">
-      <v-btn
-        color="primary" variant="tonal" rounded="pill"
-        :loading="previewing" :disabled="applying" @click="preview"
-      >
-        <v-icon start>mdi-magnify</v-icon> Preview
-      </v-btn>
-      <v-btn
-        color="error" rounded="pill"
-        :loading="applying"
-        :disabled="previewing || !canApply"
-        @click="confirmOpen = true"
-      >
-        <v-icon start>mdi-paperclip-off</v-icon> Apply
-      </v-btn>
-    </div>
-
-    <v-alert
-      v-if="summary" :type="summaryType" variant="tonal" class="mt-4"
-      density="comfortable"
-    >
-      <span v-if="applied">
-        Deleted {{ summary.rows }} orphaned record(s) and unlinked
-        {{ summary.files }} file(s), reclaiming {{ humanBytes(summary.bytes) }}.
-      </span>
-      <span v-else-if="hasWork">
-        {{ summary.rows }} orphaned record(s) and {{ summary.files }}
-        unreferenced file(s) — {{ humanBytes(summary.bytes) }} reclaimable.
-        Click <strong>Apply</strong> to remove them.
-      </span>
-      <span v-else>Nothing to reclaim — every attachment is accounted for.</span>
-
-      <!-- Both of these change what the numbers MEAN, so they are stated
-           whenever they are non-zero rather than hidden in a tooltip. -->
-      <div v-if="summary.files_failed" class="mt-1 text-caption">
-        {{ summary.files_failed }} file(s) could not be read or removed — see
-        the worker log.
-      </div>
-      <div v-if="summary.partial" class="mt-1 text-caption">
-        Stopped early at the time limit; some of the store was not examined.
-        Run it again to continue.
-      </div>
-    </v-alert>
-
-    <QueueStatusBar queue="maintenance_long" queue-label="Maintenance" />
-
-    <v-dialog v-model="confirmOpen" max-width="440">
-      <v-card>
-        <v-card-title>Reclaim orphaned attachments?</v-card-title>
-        <v-card-text class="text-body-2">
-          This permanently deletes
-          <strong>{{ summary?.rows ?? 0 }}</strong> attachment record(s) and
-          unlinks <strong>{{ summary?.files ?? 0 }}</strong> file(s)
-          ({{ humanBytes(summary?.bytes) }}). Only files that no remaining
-          record points at are removed, so nothing still attached to a post
-          is affected.
-        </v-card-text>
-        <v-card-actions>
-          <v-spacer />
-          <v-btn variant="text" @click="confirmOpen = false">Cancel</v-btn>
-          <v-btn color="error" @click="apply">Reclaim</v-btn>
-        </v-card-actions>
-      </v-card>
-    </v-dialog>
-  </MaintenanceTile>
-</template>
-
-<script setup>
-import { computed, ref } from 'vue'
-
-import { useMaintenanceTask } from '../../composables/useMaintenanceTask.js'
-import { humanBytes } from '../../utils/bytes.js'
-import MaintenanceTile from '../common/MaintenanceTile.vue'
-import QueueStatusBar from './QueueStatusBar.vue'
-
-const confirmOpen = ref(false)
-
-// Walks the whole attachment store, so it can run for minutes on a large
-// library — the service caps itself at 900s and reports `partial`. 150 polls
-// × 2s ≈ 5m of foreground waiting; past that the composable hands off to the
-// task dashboard rather than spinning forever.
-const { previewing, applying, summary, applied, preview, apply: applyTask } = useMaintenanceTask({
-  endpoint: '/api/admin/maintenance/reclaim-attachments',
-  storageKey: 'fc.maint.reclaimAttachments',
-  appliedToast: 'Orphaned attachments reclaimed',
-  maxPolls: 150,
-})
-
-const hasWork = computed(
-  () => !!summary.value && (summary.value.rows > 0 || summary.value.files > 0),
-)
-const canApply = computed(() => hasWork.value && !applied.value)
-const summaryType = computed(() => {
-  if (applied.value) return 'success'
-  return hasWork.value ? 'info' : 'success'
-})
-
-// The confirm dialog gates the destructive apply; close it, then run.
-function apply () {
-  confirmOpen.value = false
-  applyTask()
-}
-</script>

frontend/src/components/settings/BrowserExtensionCard.vue

@@ -4,22 +4,12 @@
       <span v-if="manifest?.installed" class="text-caption fc-muted">
         · Firefox · v{{ manifest.version }}
       </span>
-      <!-- Which channel this instance serves, so it is visible without
-           installing anything. Rendered only when the image declares one: a
-           locally-built image, or one predating the field, says nothing rather
-           than guessing. Never merged into the version string beside it — see
-           the endpoint's note on why a `-dev` suffix breaks the comparator. -->
-      <v-chip
-        v-if="manifest?.channel"
-        size="x-small" variant="tonal" class="ml-2"
-        :color="manifest.channel === 'dev' ? 'warning' : 'info'"
-      >{{ manifest.channel }}</v-chip>
     </CardHeading>
 
     <v-card-text>
       <p class="fc-muted text-body-2">
         Pushes session cookies from supported platforms
-        (patreon, subscribestar, hentaifoundry, discord, pixiv)
+        (patreon, subscribestar, hentaifoundry, discord, pixiv, deviantart)
         into FabledCurator, and lets you add a creator as a source from
         their page in one click.
       </p>

frontend/src/components/settings/CropProposersCard.vue

@@ -15,23 +15,28 @@
     </p>
 
     <div v-for="p in proposers" :key="p.key" class="fc-proposer">
-      <SettingToggleRow
-        v-model="p.on" :loading="busy" :icon="p.icon"
-        :icon-color="p.on ? 'accent' : null" :label="p.label"
-        @change="v => saveToggle(p, v)"
-      />
+      <div class="d-flex align-center mb-1" style="gap: 10px;">
+        <v-icon size="18" :color="p.on ? 'accent' : undefined">{{ p.icon }}</v-icon>
+        <span class="fc-section-h">{{ p.label }}</span>
+        <v-switch
+          v-model="p.on" :loading="busy" hide-details density="compact"
+          color="success" class="ml-auto"
+          @update:model-value="v => saveToggle(p, v)"
+        />
+      </div>
       <p class="fc-muted text-body-2 mb-2">{{ p.help }}</p>
       <div class="d-flex flex-wrap mb-4" style="gap: 12px;">
         <v-text-field
           v-model="p.weights" label="Weights" density="compact" hide-details
           style="min-width: 300px; flex: 1;" :disabled="busy || !p.on"
           placeholder="name | URL | hf_repo::file"
-          @change="saveField({ [`detector_${p.key}_weights`]: p.weights })"
+          @change="save({ [`detector_${p.key}_weights`]: p.weights })"
         />
-        <SettingNumberField
-          v-model="p.conf" label="Confidence" :min="0" :max="1" :step="0.05"
-          max-width="140px" :disabled="busy || !p.on"
-          @change="saveField({ [`detector_${p.key}_conf`]: Number(p.conf) })"
+        <v-text-field
+          v-model.number="p.conf" label="Confidence" type="number"
+          min="0" max="1" step="0.05" density="compact" hide-details
+          style="max-width: 140px;" :disabled="busy || !p.on"
+          @change="save({ [`detector_${p.key}_conf`]: Number(p.conf) })"
         />
       </div>
     </div>
@@ -43,12 +48,12 @@
         storage. Dedupe IoU drops near-duplicate crops before embedding.
       </p>
       <div class="d-flex flex-wrap" style="gap: 12px;">
-        <SettingNumberField
+        <v-text-field
           v-for="c in caps" :key="c.key"
-          v-model="c.val" :label="c.label"
-          :min="c.min" :max="c.max" :step="c.step || 1"
-          max-width="165px" :disabled="busy"
-          @change="saveField({ [c.key]: Number(c.val) })"
+          v-model.number="c.val" :label="c.label" type="number"
+          :min="c.min" :max="c.max" :step="c.step || 1" density="compact"
+          hide-details style="max-width: 165px;" :disabled="busy"
+          @change="save({ [c.key]: Number(c.val) })"
         />
       </div>
     </div>
@@ -56,16 +61,14 @@
 </template>
 
 <script setup>
+import { toast } from '../../utils/toast.js'
 import { onMounted, ref } from 'vue'
 
 import MaintenanceTile from '../common/MaintenanceTile.vue'
-import SettingNumberField from '../common/SettingNumberField.vue'
-import SettingToggleRow from '../common/SettingToggleRow.vue'
-import { useSettingSave } from '../../composables/useSettingSave.js'
 import { useMLStore } from '../../stores/ml.js'
 
 const mlSettings = useMLStore()
-const { busy, save } = useSettingSave(mlSettings.patchSettings)
+const busy = ref(false)
 const proposers = ref([])
 const caps = ref([])
 
@@ -108,20 +111,31 @@ onMounted(async () => {
   caps.value = CAP_DEFS.map(c => ({ ...c, val: s[c.key] ?? 0 }))
 })
 
-// Field @change → persist with a "Saved" confirmation. SettingNumberField has
-// already clamped numeric values to their [min,max] before this fires.
-function saveField(patch) {
-  save(patch, { successMessage: 'Saved' })
+async function save(patch, revert) {
+  busy.value = true
+  try {
+    await mlSettings.patchSettings(patch)
+    toast({ text: 'Saved', type: 'success' })
+  } catch (e) {
+    if (revert) revert()
+    toast({ text: `Could not save: ${e.message}`, type: 'error' })
+  } finally {
+    busy.value = false
+  }
 }
 
-async function saveToggle(p, v) {
+function saveToggle (p, v) {
   // Revert the switch on failure so it never lies about the persisted state.
-  const ok = await save({ [`detector_${p.key}_enabled`]: !!v }, { successMessage: 'Saved' })
-  if (!ok) p.on = !v
+  save({ [`detector_${p.key}_enabled`]: !!v }, () => { p.on = !v })
 }
 </script>
 
 <style scoped>
+.fc-muted { color: rgb(var(--v-theme-on-surface-variant)); }
+.fc-section-h {
+  font-size: 13px; font-weight: 700; letter-spacing: 0.03em;
+  text-transform: uppercase; color: rgb(var(--v-theme-on-surface));
+}
 .fc-proposer {
   border-top: 1px solid rgb(var(--v-theme-surface-light)); padding-top: 14px;
 }

frontend/src/components/settings/DangerZoneCard.vue

@@ -112,6 +112,7 @@ async function onCommit() {
 </script>
 
 <style scoped>
+.fc-muted { color: rgb(var(--v-theme-on-surface-variant)); }
 .fc-code {
   background: rgb(var(--v-theme-surface-light));
   border-radius: 4px; padding: 2px 8px;

frontend/src/components/settings/DbMaintenanceCard.vue

@@ -42,7 +42,7 @@
           </tr>
         </tbody>
       </v-table>
-      <p v-else class="text-caption mt-3 fc-muted">
+      <p v-else class="text-caption mt-3" style="opacity: 0.6;">
         No table statistics yet.
       </p>
   </MaintenanceTile>

frontend/src/components/settings/DownloadsActivityPanel.vue

@@ -35,7 +35,7 @@
         All subscription sources healthy.
       </p>
       <p v-else class="text-body-2 mb-0">
-        <b class="fc-weak">{{ failing.length }}</b> failing source(s):
+        <b class="fc-bad">{{ failing.length }}</b> failing source(s):
         <span class="fc-muted">{{ failingNames }}</span>
       </p>
     </v-card-text>
@@ -72,4 +72,6 @@ onUnmounted(() => { if (pollId) clearInterval(pollId) })
 </script>
 
 <style scoped>
+.fc-muted { color: rgb(var(--v-theme-on-surface-variant)); }
+.fc-bad { color: rgb(var(--v-theme-error)); }
 </style>

frontend/src/components/settings/GatedPurgeCard.vue

@@ -102,7 +102,6 @@
 import { computed, ref } from 'vue'
 
 import { useMaintenanceTask } from '../../composables/useMaintenanceTask.js'
-import { humanBytes } from '../../utils/bytes.js'
 import MaintenanceTile from '../common/MaintenanceTile.vue'
 import QueueStatusBar from './QueueStatusBar.vue'
 
@@ -123,6 +122,14 @@ const summaryType = computed(() => {
   return summary.value && summary.value.matched > 0 ? 'info' : 'success'
 })
 
+function humanBytes (n) {
+  const b = Number(n || 0)
+  if (b >= 1 << 30) return (b / (1 << 30)).toFixed(1) + ' GB'
+  if (b >= 1 << 20) return (b / (1 << 20)).toFixed(1) + ' MB'
+  if (b >= 1 << 10) return (b / (1 << 10)).toFixed(1) + ' KB'
+  return b + ' B'
+}
+
 // The confirm dialog gates the destructive apply; close it, then run.
 function apply () {
   confirmOpen.value = false

frontend/src/components/settings/GpuActivityPanel.vue

@@ -25,7 +25,7 @@
           <div class="fc-cell__l">done</div>
         </div>
         <div class="fc-cell">
-          <div class="fc-cell__n" :class="q.error ? 'fc-weak' : ''">{{ q.error }}</div>
+          <div class="fc-cell__n" :class="q.error ? 'fc-bad' : ''">{{ q.error }}</div>
           <div class="fc-cell__l">errored</div>
         </div>
       </div>
@@ -95,6 +95,7 @@ onUnmounted(() => { if (pollId) clearInterval(pollId) })
 </script>
 
 <style scoped>
+.fc-muted { color: rgb(var(--v-theme-on-surface-variant)); }
 .fc-cells { display: flex; gap: 28px; }
 .fc-cell__n {
   font-size: 20px; font-weight: 700; line-height: 1.1;
@@ -104,4 +105,6 @@ onUnmounted(() => { if (pollId) clearInterval(pollId) })
   font-size: 11px; text-transform: uppercase; letter-spacing: 0.04em;
   color: rgb(var(--v-theme-on-surface-variant));
 }
+.fc-good { color: rgb(var(--v-theme-success)); }
+.fc-bad { color: rgb(var(--v-theme-error)); }
 </style>

frontend/src/components/settings/GpuAgentCard.vue

@@ -367,6 +367,11 @@ async function onReprocess() {
 </script>
 
 <style scoped>
+.fc-muted { color: rgb(var(--v-theme-on-surface-variant)); }
+.fc-section-h {
+  font-size: 13px; font-weight: 700; letter-spacing: 0.03em;
+  text-transform: uppercase; color: rgb(var(--v-theme-on-surface));
+}
 .fc-token {
   display: flex; align-items: center; gap: 4px;
   background: rgb(var(--v-theme-surface-light)); border-radius: 6px;
@@ -385,4 +390,6 @@ async function onReprocess() {
   font-size: 11px; text-transform: uppercase; letter-spacing: 0.04em;
   color: rgb(var(--v-theme-on-surface-variant));
 }
+.fc-good { color: rgb(var(--v-theme-success)); }
+.fc-weak { color: rgb(var(--v-theme-error)); }
 </style>

frontend/src/components/settings/GpuTriageCard.vue

@@ -155,6 +155,11 @@ async function onRecover(it) {
 </script>
 
 <style scoped>
+.fc-muted { color: rgb(var(--v-theme-on-surface-variant)); }
+.fc-section-h {
+  font-size: 13px; font-weight: 700; letter-spacing: 0.03em;
+  text-transform: uppercase; color: rgb(var(--v-theme-on-surface));
+}
 .fc-queue { display: flex; gap: 24px; }
 .fc-q__n {
   font-size: 20px; font-weight: 700; line-height: 1.1;
@@ -164,6 +169,8 @@ async function onRecover(it) {
   font-size: 11px; text-transform: uppercase; letter-spacing: 0.04em;
   color: rgb(var(--v-theme-on-surface-variant));
 }
+.fc-good { color: rgb(var(--v-theme-success)); }
+.fc-weak { color: rgb(var(--v-theme-error)); }
 .fc-defect {
   display: flex; align-items: center; gap: 12px;
   background: rgb(var(--v-theme-surface-light)); border-radius: 8px;

frontend/src/components/settings/HeadsCard.vue

@@ -95,10 +95,14 @@
 
     <!-- Earned auto-apply -->
     <div class="fc-auto mt-6">
-      <SettingToggleRow
-        v-model="autoEnabled" :loading="settingBusy"
-        icon="mdi-lightning-bolt" label="Auto-apply" @change="onToggleAuto"
-      />
+      <div class="d-flex align-center mb-1" style="gap: 10px;">
+        <v-icon size="18" color="accent">mdi-lightning-bolt</v-icon>
+        <span class="fc-section-h">Auto-apply</span>
+        <v-switch
+          v-model="autoEnabled" :loading="settingBusy" hide-details density="compact"
+          color="success" class="ml-auto" @update:model-value="onToggleAuto"
+        />
+      </div>
       <p class="fc-muted text-body-2 mb-3">
         Graduated heads (⚡, with ≥ {{ autoMinPosInput }} examples) apply their tag
         on their own where they clear {{ Math.round((autoPrecisionInput || 0) * 100) }}%
@@ -107,14 +111,17 @@
       </p>
 
       <div class="d-flex mb-3" style="gap: 12px;">
-        <SettingNumberField
-          v-model="autoPrecisionInput" label="Precision target"
-          :min="0.5" :max="0.999" :step="0.01" :disabled="settingBusy"
+        <v-text-field
+          v-model.number="autoPrecisionInput" label="Precision target"
+          type="number" min="0.5" max="0.999" step="0.01" density="compact"
+          hide-details style="max-width: 200px;" :disabled="settingBusy"
           @change="onSaveSettings"
         />
-        <SettingNumberField
-          v-model="autoMinPosInput" label="Min examples to fire"
-          :min="1" :disabled="settingBusy" @change="onSaveSettings"
+        <v-text-field
+          v-model.number="autoMinPosInput" label="Min examples to fire"
+          type="number" min="1" density="compact" hide-details
+          style="max-width: 200px;" :disabled="settingBusy"
+          @change="onSaveSettings"
         />
       </div>
 
@@ -154,11 +161,15 @@
 
     <!-- Presentation chrome auto-hide (#141) -->
     <div class="fc-auto mt-6">
-      <SettingToggleRow
-        v-model="presentationEnabled" :loading="settingBusy"
-        icon="mdi-image-off-outline" label="Hide presentation chrome"
-        @change="onTogglePresentation"
-      />
+      <div class="d-flex align-center mb-1" style="gap: 10px;">
+        <v-icon size="18" color="accent">mdi-image-off-outline</v-icon>
+        <span class="fc-section-h">Hide presentation chrome</span>
+        <v-switch
+          v-model="presentationEnabled" :loading="settingBusy" hide-details
+          density="compact" color="success" class="ml-auto"
+          @update:model-value="onTogglePresentation"
+        />
+      </div>
       <p class="fc-muted text-body-2 mb-3">
         Auto-hide <code>banner</code> chrome from the gallery once a head has
         learned it (≥ {{ minPositives }} examples) and clears
@@ -169,14 +180,16 @@
         tag), it's flagged for review instead of buried. Every auto-hide is reversible.
       </p>
       <div class="d-flex mb-3" style="gap: 12px;">
-        <SettingNumberField
-          v-model="presentationThresholdInput" label="Hide confidence"
-          :min="0.5" :max="0.999" :step="0.01" :disabled="settingBusy"
+        <v-text-field
+          v-model.number="presentationThresholdInput" label="Hide confidence"
+          type="number" min="0.5" max="0.999" step="0.01" density="compact"
+          hide-details style="max-width: 200px;" :disabled="settingBusy"
           @change="onSavePresentation"
         />
-        <SettingNumberField
-          v-model="presentationConflictInput" label="Flag if content ≥"
-          :min="0" :max="1" :step="0.05" :disabled="settingBusy"
+        <v-text-field
+          v-model.number="presentationConflictInput" label="Flag if content ≥"
+          type="number" min="0" max="1" step="0.05" density="compact"
+          hide-details style="max-width: 200px;" :disabled="settingBusy"
           @change="onSavePresentation"
         />
       </div>
@@ -184,11 +197,15 @@
 
     <!-- Process auto-tagging (#1464): wip / editor screenshot -->
     <div class="fc-auto mt-6">
-      <SettingToggleRow
-        v-model="processEnabled" :loading="settingBusy"
-        icon="mdi-progress-wrench" label="Auto-tag work-in-progress"
-        @change="onToggleProcess"
-      />
+      <div class="d-flex align-center mb-1" style="gap: 10px;">
+        <v-icon size="18" color="accent">mdi-progress-wrench</v-icon>
+        <span class="fc-section-h">Auto-tag work-in-progress</span>
+        <v-switch
+          v-model="processEnabled" :loading="settingBusy" hide-details
+          density="compact" color="success" class="ml-auto"
+          @update:model-value="onToggleProcess"
+        />
+      </div>
       <p class="fc-muted text-body-2 mb-3">
         Auto-tag <code>wip</code> and <code>editor screenshot</code> process art
         once a head has learned them (≥ {{ minPositives }} examples) and clears
@@ -200,14 +217,16 @@
         manual tags, never its own guesses — so it can't run away. Every tag reversible.
       </p>
       <div class="d-flex mb-3" style="gap: 12px;">
-        <SettingNumberField
-          v-model="processThresholdInput" label="Tag confidence"
-          :min="0.5" :max="0.999" :step="0.01" :disabled="settingBusy"
+        <v-text-field
+          v-model.number="processThresholdInput" label="Tag confidence"
+          type="number" min="0.5" max="0.999" step="0.01" density="compact"
+          hide-details style="max-width: 200px;" :disabled="settingBusy"
           @change="onSaveProcess"
         />
-        <SettingNumberField
-          v-model="processConflictInput" label="Flag if content ≥"
-          :min="0" :max="1" :step="0.05" :disabled="settingBusy"
+        <v-text-field
+          v-model.number="processConflictInput" label="Flag if content ≥"
+          type="number" min="0" max="1" step="0.05" density="compact"
+          hide-details style="max-width: 200px;" :disabled="settingBusy"
           @change="onSaveProcess"
         />
       </div>
@@ -237,7 +256,7 @@
               <td class="fc-r fc-mono">{{ c.n_auto_applied }}</td>
               <td class="fc-r fc-mono">{{ c.n_misfires }}</td>
               <td class="fc-r fc-mono" :class="rateClass(c.misfire_rate)">
-                {{ pct(c.misfire_rate) }}
+                {{ ratePct(c.misfire_rate) }}
               </td>
               <td class="fc-r fc-mono">{{ c.n_underfires }}</td>
             </tr>
@@ -253,9 +272,6 @@ import { toast } from '../../utils/toast.js'
 import { computed, onMounted, onUnmounted, ref } from 'vue'
 
 import MaintenanceTile from '../common/MaintenanceTile.vue'
-import SettingNumberField from '../common/SettingNumberField.vue'
-import SettingToggleRow from '../common/SettingToggleRow.vue'
-import { useSettingSave } from '../../composables/useSettingSave.js'
 import { useHeadsStore } from '../../stores/heads.js'
 import { useMLStore } from '../../stores/ml.js'
 
@@ -269,9 +285,7 @@ let pollTimer = null
 const autoEnabled = ref(false)
 const autoPrecisionInput = ref(0.97)
 const autoMinPosInput = ref(30)
-// Shared settings-save flow (busy + toast + revert); `settingBusy` gates the
-// toggles/fields, `save` returns ok/false for the optimistic-switch revert.
-const { busy: settingBusy, save } = useSettingSave(mlSettings.patchSettings)
+const settingBusy = ref(false)
 const autoBusy = ref(false)
 const autoStatus = ref(null)
 const metricsData = ref(null)
@@ -381,39 +395,81 @@ function startAutoPoll() {
 function stopAutoPoll() { if (autoTimer) { clearInterval(autoTimer); autoTimer = null } }
 
 async function onToggleAuto(val) {
-  const ok = await save({ head_auto_apply_enabled: !!val },
-    { successMessage: val ? 'Auto-apply on' : 'Auto-apply off', errorPrefix: 'Could not update' })
-  if (!ok) autoEnabled.value = !val   // revert the switch
+  settingBusy.value = true
+  try {
+    await mlSettings.patchSettings({ head_auto_apply_enabled: !!val })
+    toast({ text: val ? 'Auto-apply on' : 'Auto-apply off', type: 'success' })
+  } catch (e) {
+    autoEnabled.value = !val   // revert the switch
+    toast({ text: `Could not update: ${e.message}`, type: 'error' })
+  } finally {
+    settingBusy.value = false
+  }
 }
 async function onSaveSettings() {
-  await save({
-    head_auto_apply_precision: Number(autoPrecisionInput.value),
-    head_auto_apply_min_positives: Number(autoMinPosInput.value),
-  })
+  settingBusy.value = true
+  try {
+    await mlSettings.patchSettings({
+      head_auto_apply_precision: Number(autoPrecisionInput.value),
+      head_auto_apply_min_positives: Number(autoMinPosInput.value),
+    })
+  } catch (e) {
+    toast({ text: `Could not save: ${e.message}`, type: 'error' })
+  } finally {
+    settingBusy.value = false
+  }
 }
 
 async function onTogglePresentation(val) {
-  const ok = await save({ presentation_auto_apply_enabled: !!val },
-    { successMessage: val ? 'Chrome auto-hide on' : 'Chrome auto-hide off', errorPrefix: 'Could not update' })
-  if (!ok) presentationEnabled.value = !val   // revert the switch
+  settingBusy.value = true
+  try {
+    await mlSettings.patchSettings({ presentation_auto_apply_enabled: !!val })
+    toast({ text: val ? 'Chrome auto-hide on' : 'Chrome auto-hide off', type: 'success' })
+  } catch (e) {
+    presentationEnabled.value = !val   // revert the switch
+    toast({ text: `Could not update: ${e.message}`, type: 'error' })
+  } finally {
+    settingBusy.value = false
+  }
 }
 async function onSavePresentation() {
-  await save({
-    presentation_auto_apply_threshold: Number(presentationThresholdInput.value),
-    presentation_conflict_threshold: Number(presentationConflictInput.value),
-  })
+  settingBusy.value = true
+  try {
+    await mlSettings.patchSettings({
+      presentation_auto_apply_threshold: Number(presentationThresholdInput.value),
+      presentation_conflict_threshold: Number(presentationConflictInput.value),
+    })
+  } catch (e) {
+    toast({ text: `Could not save: ${e.message}`, type: 'error' })
+  } finally {
+    settingBusy.value = false
+  }
 }
 
 async function onToggleProcess(val) {
-  const ok = await save({ process_auto_apply_enabled: !!val },
-    { successMessage: val ? 'WIP auto-tag on' : 'WIP auto-tag off', errorPrefix: 'Could not update' })
-  if (!ok) processEnabled.value = !val   // revert the switch
+  settingBusy.value = true
+  try {
+    await mlSettings.patchSettings({ process_auto_apply_enabled: !!val })
+    toast({ text: val ? 'WIP auto-tag on' : 'WIP auto-tag off', type: 'success' })
+  } catch (e) {
+    processEnabled.value = !val   // revert the switch
+    toast({ text: `Could not update: ${e.message}`, type: 'error' })
+  } finally {
+    settingBusy.value = false
+  }
 }
 async function onSaveProcess() {
-  await save({
-    process_auto_apply_threshold: Number(processThresholdInput.value),
-    process_conflict_threshold: Number(processConflictInput.value),
-  })
+  settingBusy.value = true
+  try {
+    await mlSettings.patchSettings({
+      process_auto_apply_threshold: Number(processThresholdInput.value),
+      process_conflict_threshold: Number(processConflictInput.value),
+    })
+  } catch (e) {
+    toast({ text: `Could not save: ${e.message}`, type: 'error' })
+  } finally {
+    settingBusy.value = false
+  }
 }
 function onPreview() { startSweep(true) }
 function onApplyNow() { startSweep(false) }
@@ -439,6 +495,7 @@ function sweepConcepts(run) {
     .sort((a, b) => b.applied - a.applied)
 }
 function sweepTotal(run) { return run?.n_applied ?? 0 }
+function ratePct(x) { return x == null ? '—' : `${Math.round(x * 100)}%` }
 function rateClass(x) {
   if (x == null) return ''
   if (x <= 0.03) return 'fc-good'
@@ -469,6 +526,12 @@ function relTime(iso) {
 </script>
 
 <style scoped>
+.fc-muted { color: rgb(var(--v-theme-on-surface-variant)); }
+
+.fc-section-h {
+  font-size: 13px; font-weight: 700; letter-spacing: 0.03em;
+  text-transform: uppercase; color: rgb(var(--v-theme-on-surface));
+}
 .fc-auto {
   border-top: 1px solid rgb(var(--v-theme-surface-light)); padding-top: 16px;
 }
@@ -525,5 +588,7 @@ function relTime(iso) {
   background: rgb(var(--v-theme-surface-light));
   padding: 1px 6px; border-radius: 999px;
 }
+.fc-good { color: rgb(var(--v-theme-success)); }
 .fc-ok { color: rgb(var(--v-theme-on-surface)); }
+.fc-weak { color: rgb(var(--v-theme-error)); }
 </style>

frontend/src/components/settings/MLBackfillCard.vue

@@ -39,14 +39,13 @@
 import { toast } from '../../utils/toast.js'
 import { onMounted, ref } from 'vue'
 import { useMLStore } from '../../stores/ml.js'
-import { useSettingSave } from '../../composables/useSettingSave.js'
 import MaintenanceTile from '../common/MaintenanceTile.vue'
 import QueueStatusBar from './QueueStatusBar.vue'
 const store = useMLStore()
-const { busy: saving, save } = useSettingSave(store.patchSettings)
 const busy = ref(false)
 const done = ref(false)
 const enabled = ref(true)
+const saving = ref(false)
 onMounted(async () => {
   try {
     await store.loadSettings()
@@ -56,12 +55,21 @@ onMounted(async () => {
   } catch { /* non-fatal */ }
 })
 async function onToggle() {
-  const ok = await save({ cpu_embed_enabled: enabled.value }, {
-    successMessage: enabled.value
-      ? 'CPU embedding on — imports queue embeds for the ml-worker'
-      : 'CPU embedding off — the GPU embed backfill owns whole-image embeds',
-  })
-  if (!ok) enabled.value = !enabled.value
+  saving.value = true
+  try {
+    await store.patchSettings({ cpu_embed_enabled: enabled.value })
+    toast({
+      text: enabled.value
+        ? 'CPU embedding on — imports queue embeds for the ml-worker'
+        : 'CPU embedding off — the GPU embed backfill owns whole-image embeds',
+      type: 'success',
+    })
+  } catch (e) {
+    toast({ text: `Could not save: ${e.message}`, type: 'error' })
+    enabled.value = !enabled.value
+  } finally {
+    saving.value = false
+  }
 }
 async function run() {
   busy.value = true
@@ -72,4 +80,5 @@ async function run() {
 </script>
 
 <style scoped>
+.fc-muted { color: rgb(var(--v-theme-on-surface-variant)); }
 </style>

frontend/src/components/settings/MLThresholdSliders.vue

@@ -12,17 +12,17 @@
       </div>
       <v-row>
         <v-col cols="12" sm="6">
-          <SettingNumberField
-            v-model="local.video_frame_interval_seconds"
-            label="Frame interval (s)" :min="0.5" :step="0.5"
-            density="comfortable" max-width="none" @change="onSave"
+          <v-text-field
+            v-model.number="local.video_frame_interval_seconds"
+            label="Frame interval (s)" type="number" min="0.5" step="0.5"
+            density="comfortable" hide-details @change="save"
           />
         </v-col>
         <v-col cols="12" sm="6">
-          <SettingNumberField
-            v-model="local.video_max_frames"
-            label="Max frames" :min="1" :step="1"
-            density="comfortable" max-width="none" @change="onSave"
+          <v-text-field
+            v-model.number="local.video_max_frames"
+            label="Max frames" type="number" min="1" step="1"
+            density="comfortable" hide-details @change="save"
           />
         </v-col>
       </v-row>
@@ -32,23 +32,21 @@
 </template>
 
 <script setup>
+import { toast } from '../../utils/toast.js'
 import { reactive, watch } from 'vue'
 import { useMLStore } from '../../stores/ml.js'
 import MaintenanceTile from '../common/MaintenanceTile.vue'
-import SettingNumberField from '../common/SettingNumberField.vue'
-import { useSettingSave } from '../../composables/useSettingSave.js'
 
 const store = useMLStore()
-const { save } = useSettingSave(store.patchSettings)
 const local = reactive({})
 watch(() => store.settings, (s) => { if (s) Object.assign(local, s) }, { immediate: true })
 
-// SettingNumberField clamps interval to ≥0.5 and max-frames to ≥1 before this
-// fires, so an out-of-range value never reaches the API.
-function onSave() {
-  save({
-    video_frame_interval_seconds: Number(local.video_frame_interval_seconds),
-    video_max_frames: Number(local.video_max_frames),
-  })
+async function save() {
+  const patch = {
+    video_frame_interval_seconds: local.video_frame_interval_seconds,
+    video_max_frames: local.video_max_frames
+  }
+  try { await store.patchSettings(patch) }
+  catch (e) { toast({ text: e.message, type: 'error' }) }
 }
 </script>

frontend/src/components/settings/MaintenancePanel.vue

@@ -24,7 +24,6 @@
         the CPU fallback.
       </p>
       <div class="fc-tile-stack">
-        <VideoEmbeddingCard />
         <GpuAgentCard />
         <GpuTriageCard />
         <MLBackfillCard />
@@ -37,6 +36,7 @@
         Suggestion thresholds, trained heads and tag aliases.
       </p>
       <div class="fc-tile-stack">
+        <MLThresholdSliders />
         <CropProposersCard />
         <HeadsCard />
         <AliasTable />
@@ -77,7 +77,7 @@ import ArchiveReextractCard from './ArchiveReextractCard.vue'
 import MissingFileRepairCard from './MissingFileRepairCard.vue'
 import GpuTriageCard from './GpuTriageCard.vue'
 import DbMaintenanceCard from './DbMaintenanceCard.vue'
-import VideoEmbeddingCard from './VideoEmbeddingCard.vue'
+import MLThresholdSliders from './MLThresholdSliders.vue'
 import CropProposersCard from './CropProposersCard.vue'
 import HeadsCard from './HeadsCard.vue'
 import GpuAgentCard from './GpuAgentCard.vue'

frontend/src/components/settings/VideoDedupCard.vue

@@ -78,7 +78,6 @@
 import { computed, ref } from 'vue'
 
 import { useMaintenanceTask } from '../../composables/useMaintenanceTask.js'
-import { humanBytes } from '../../utils/bytes.js'
 import MaintenanceTile from '../common/MaintenanceTile.vue'
 import QueueStatusBar from './QueueStatusBar.vue'
 
@@ -99,6 +98,14 @@ const summaryType = computed(() => {
   return summary.value && summary.value.redundant > 0 ? 'info' : 'success'
 })
 
+function humanBytes (n) {
+  const b = Number(n || 0)
+  if (b >= 1 << 30) return (b / (1 << 30)).toFixed(1) + ' GB'
+  if (b >= 1 << 20) return (b / (1 << 20)).toFixed(1) + ' MB'
+  if (b >= 1 << 10) return (b / (1 << 10)).toFixed(1) + ' KB'
+  return b + ' B'
+}
+
 // The confirm dialog gates the destructive apply; close it, then run.
 function apply () {
   confirmOpen.value = false

frontend/src/composables/useSettingSave.js

@@ -1,33 +0,0 @@
-import { ref } from 'vue'
-import { toast } from '../utils/toast.js'
-
-// The shared "persist a settings patch" flow for the ML settings cards. Flips a
-// busy flag, calls the store's patch (which rethrows on failure), toasts
-// success/error, and returns true/false so a toggle handler can revert its
-// optimistic switch on failure. Centralises the try/catch/toast the cards each
-// hand-rolled (HeadsCard x6, CropProposersCard, MLBackfillCard) — and where the
-// threshold-clamp drifted; the clamp now lives in <SettingNumberField>.
-//
-// Pass the store's patch fn, e.g. useSettingSave(ml.patchSettings).
-export function useSettingSave(patchFn) {
-  const busy = ref(false)
-
-  // opts.successMessage — toast on success (toggles announce their new state;
-  // silent field-saves omit it). opts.errorPrefix — the failure toast prefix
-  // ("Could not save" default; toggles used "Could not update").
-  async function save(patch, { successMessage = '', errorPrefix = 'Could not save' } = {}) {
-    busy.value = true
-    try {
-      await patchFn(patch)
-      if (successMessage) toast({ text: successMessage, type: 'success' })
-      return true
-    } catch (e) {
-      toast({ text: `${errorPrefix}: ${e.message}`, type: 'error' })
-      return false
-    } finally {
-      busy.value = false
-    }
-  }
-
-  return { busy, save }
-}

frontend/src/stores/system.js

@@ -5,18 +5,6 @@ import { useApi } from '../composables/useApi.js'
 export const useSystemStore = defineStore('system', () => {
   const api = useApi()
   const healthy = ref(null)  // null=unknown, true=ok, false=down
-  // What the instance says it is. Since milestone 318 stopped publishing
-  // version image tags, this is the only answer to "which build is this?" —
-  // there is no registry name left to check it against.
-  //
-  // Three states, and collapsing any two of them would lie:
-  //   buildLoaded=false            we have not asked yet   -> render nothing
-  //   buildLoaded=true, version='' the build cannot say    -> render "unknown"
-  //   buildLoaded=true, version=x  this build is x
-  // A blank footer would read as "no version", which is a different claim.
-  const buildVersion = ref('')
-  const buildChannel = ref('')
-  const buildLoaded = ref(false)
   const stats = ref(null)
   const statsLoading = ref(false)
 
@@ -24,17 +12,8 @@ export const useSystemStore = defineStore('system', () => {
     try {
       const body = await api.get('/api/health')
       healthy.value = body.status === 'ok'
-      // Absent means "cannot say" — the server omits these rather than
-      // sending empty strings, so `?? ''` preserves that rather than
-      // inventing a value for it.
-      buildVersion.value = body.version ?? ''
-      buildChannel.value = body.channel ?? ''
-      buildLoaded.value = true
     } catch {
       healthy.value = false
-      // Deliberately NOT setting buildLoaded: a failed health call tells us
-      // nothing about the build, and claiming "unknown" would present a
-      // network blip as a defective image.
     }
   }
 
@@ -47,8 +26,5 @@ export const useSystemStore = defineStore('system', () => {
     }
   }
 
-  return {
-    healthy, stats, statsLoading, refreshHealth, refreshStats,
-    buildVersion, buildChannel, buildLoaded,
-  }
+  return { healthy, stats, statsLoading, refreshHealth, refreshStats }
 })

frontend/src/styles/app.css

@@ -40,25 +40,6 @@
    emits, so no specificity/reorder fight — no !important needed. */
 .fc-muted { color: rgb(var(--v-theme-on-surface-variant)); }
 
-/* Section sub-heading in settings cards (DRY pass #161): was redefined
-   identically in 4 cards, and TranslationCard used the class with NO local def
-   so its section headers rendered unstyled. Now one global utility. */
-.fc-section-h {
-  font-size: 13px; font-weight: 700; letter-spacing: 0.03em;
-  text-transform: uppercase; color: rgb(var(--v-theme-on-surface));
-}
-
-/* Status text colours (DRY pass #161): fc-good = success, fc-weak = error,
-   consolidated from the GPU / heads cards. fc-ok is intentionally NOT global —
-   it means on-surface in HeadsCard but success in QueuesTable.
-
-   No `.fc-bad` (#3072): it was defined locally and identically in the Downloads
-   and GPU activity panels, and it is fc-weak under a second name — GpuAgentCard
-   and GpuActivityPanel were colouring the same "errored" count with different
-   class names. Both now use fc-weak. Reach for fc-weak, not a new synonym. */
-.fc-good { color: rgb(var(--v-theme-success)); }
-.fc-weak { color: rgb(var(--v-theme-error)); }
-
 /* Vuetify 4 dropped its global CSS reset (normalisation moved into each
    component). FC's layouts assumed the reset zeroed margins on text elements, so
    restore just that — the "minimal reset" from the v4 upgrade guide — inside

frontend/src/utils/bytes.js

@@ -1,17 +0,0 @@
-// Human-readable byte sizes for maintenance summaries ("2.4 GB reclaimable").
-//
-// Promoted out of the cleanup cards, which had grown byte-identical private
-// copies (VideoDedupCard, GatedPurgeCard) and were about to grow a third for
-// the attachment reclaim. Binary units (1 KB = 1024 B) — these numbers come
-// from st_size / SUM(size_bytes), so they describe disk, not marketing.
-//
-// NOT the same shape as the `formatBytes` helpers in SystemStatsCards,
-// BackupRunsTable and PostCard — those differ in units, precision and
-// zero-handling. Left alone deliberately rather than force-fitted here.
-export function humanBytes (n) {
-  const b = Number(n || 0)
-  if (b >= 1 << 30) return (b / (1 << 30)).toFixed(1) + ' GB'
-  if (b >= 1 << 20) return (b / (1 << 20)).toFixed(1) + ' MB'
-  if (b >= 1 << 10) return (b / (1 << 10)).toFixed(1) + ' KB'
-  return b + ' B'
-}

frontend/src/utils/platformColor.js

@@ -1,10 +1,8 @@
 // Single source of truth for platform → color + icon mapping. Used by
-// PlatformChip and any other GS-style platform-tagged surface. The five
+// PlatformChip and any other GS-style platform-tagged surface. The six
 // platforms FC supports map 1:1 to the GS palette; unknown platforms fall
-// back to grey + mdi-web — which is deliberately what a retired platform
-// hits: a pre-#3069 deviantart source row still renders, as its raw key on
-// a grey chip. Operator-confirmed scope 2026-05-27. The ICONS key set is
-// pinned against backend known_platform_keys() by
+// back to grey + mdi-web. Operator-confirmed scope 2026-05-27. The ICONS key
+// set is pinned against backend known_platform_keys() by
 // tests/test_fe_be_contract.py.
 
 const ICONS = {
@@ -13,6 +11,7 @@ const ICONS = {
   hentaifoundry: 'mdi-palette',
   discord:       'mdi-discord',
   pixiv:         'mdi-alpha-p-box',
+  deviantart:    'mdi-deviantart',
 }
 
 const COLORS = {
@@ -21,6 +20,7 @@ const COLORS = {
   hentaifoundry: 'purple',
   discord:       'indigo',
   pixiv:         'blue',
+  deviantart:    'green',
 }
 
 const LABELS = {
@@ -29,6 +29,7 @@ const LABELS = {
   hentaifoundry: 'HentaiFoundry',
   discord:       'Discord',
   pixiv:         'Pixiv',
+  deviantart:    'DeviantArt',
 }
 
 export function platformIcon(platform) {

frontend/src/views/CleanupView.vue

@@ -19,16 +19,14 @@
     </section>
 
     <section class="fc-section">
-      <h3 class="fc-section__title">Duplicates &amp; leftovers</h3>
+      <h3 class="fc-section__title">Duplicates &amp; posts</h3>
       <p class="fc-section__hint">
-        Tidy post records, duplicates, locked-preview leftovers and attachments
-        that outlived what they belonged to.
+        Tidy post records, duplicates and locked-preview leftovers.
       </p>
       <div class="fc-tile-grid">
         <PostMaintenanceCard />
         <VideoDedupCard />
         <GatedPurgeCard />
-        <AttachmentReclaimCard />
       </div>
     </section>
 
@@ -62,7 +60,6 @@ import SingleColorAuditCard from '../components/cleanup/SingleColorAuditCard.vue
 import PostMaintenanceCard from '../components/settings/PostMaintenanceCard.vue'
 import VideoDedupCard from '../components/settings/VideoDedupCard.vue'
 import GatedPurgeCard from '../components/settings/GatedPurgeCard.vue'
-import AttachmentReclaimCard from '../components/settings/AttachmentReclaimCard.vue'
 import TagMaintenanceCard from '../components/settings/TagMaintenanceCard.vue'
 import DangerZoneCard from '../components/settings/DangerZoneCard.vue'
 </script>

frontend/src/views/ExploreView.vue

@@ -284,6 +284,7 @@ onUnmounted(() => {
 </script>
 
 <style scoped>
+.fc-muted { color: rgb(var(--v-theme-on-surface-variant)); }
 
 /* Full-height workspace under the sticky top nav. --fc-nav-h is the nav's REAL
    measured height (set by TopNav) — a hardcoded 64px here overflowed the

frontend/src/views/SettingsView.vue

@@ -54,21 +54,6 @@
         <MaintenancePanel />
       </v-window-item>
     </v-window>
-
-    <!-- Which build is this? With no version image tags (milestone 318) the
-         instance's own report is the only answer, so it is shown rather than
-         hidden. The instinct to treat it as information disclosure does not
-         survive contact: the JS bundle and asset hashes fingerprint the build
-         anyway, and "I'm on 2026.08.28.1249" is the single most useful line in
-         a bug report.
-
-         Channel sits BESIDE the version, never inside it (rule 149) — a
-         `-dev` suffix would read as a 0 segment to the extension's comparator
-         and make every dev build compare equal (#2993). -->
-    <div v-if="system.buildLoaded" class="text-caption text-medium-emphasis text-center mt-8">
-      FabledCurator {{ system.buildVersion || 'unknown' }}
-      <span v-if="system.buildChannel"> · {{ system.buildChannel }}</span>
-    </div>
   </v-container>
 </template>
 

frontend/src/views/TagsView.vue

@@ -349,6 +349,7 @@ async function onDeleteTagConfirm() {
 .fc-tags__sentinel {
   display: flex; justify-content: center; padding: 32px 0; min-height: 60px;
 }
+.fc-muted { color: rgb(var(--v-theme-on-surface-variant)); }
 .fc-merge-preview {
   padding: 10px 12px;
   border: 1px solid rgba(var(--v-theme-on-surface), 0.12);

frontend/test/components/browserExtensionCard.spec.js

@@ -1,72 +0,0 @@
-// @vitest-environment happy-dom
-import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest'
-import { nextTick } from 'vue'
-
-import BrowserExtensionCard from '../../src/components/settings/BrowserExtensionCard.vue'
-import { freshPinia, mountComponent } from '../support/mountComponent.js'
-
-// useApi is a thin fetch wrapper, so the seam is fetch itself (same shape as
-// showcase.spec.js) rather than a module mock.
-function stubApi(manifest) {
-  globalThis.fetch = vi.fn(async (url) => {
-    const payload = String(url).includes('/api/extension/manifest')
-      ? manifest
-      : { key: 'test-key' }
-    return {
-      ok: true, status: 200, statusText: '200',
-      text: async () => JSON.stringify(payload),
-    }
-  })
-}
-
-async function mountCard(manifest) {
-  stubApi(manifest)
-  const w = mountComponent(BrowserExtensionCard, { pinia: freshPinia() })
-  // onMounted fires two fetches (manifest + key) and each resolves through a
-  // chain of microtasks. Yielding to a macrotask drains the whole queue, which
-  // a fixed number of nextTicks would only do by luck.
-  await new Promise((resolve) => setTimeout(resolve, 0))
-  await nextTick()
-  return w
-}
-
-const INSTALLED = {
-  installed: true,
-  version: '1.0.3499884',
-  xpi_url: '/extension/fabledcurator-1.0.3499884.xpi',
-  latest_url: '/extension/fabledcurator-latest.xpi',
-  sha256: 'abc',
-}
-
-describe('BrowserExtensionCard — channel', () => {
-  beforeEach(() => { vi.restoreAllMocks() })
-  afterEach(() => { delete globalThis.fetch })
-
-  it('names the channel the instance reports', async () => {
-    // The point of the whole channel scheme: an operator can tell a dev
-    // instance from a main one without installing anything.
-    const w = await mountCard({ ...INSTALLED, channel: 'dev' })
-    expect(w.text()).toContain('dev')
-  })
-
-  it('shows the version and the channel as SEPARATE text, never merged', async () => {
-    // Regression guard with teeth: the tempting shortcut is a `-dev` version
-    // suffix, and that is precisely what breaks the extension's comparator —
-    // it parses each dotted segment with parseInt, so a suffixed segment reads
-    // as 0 and every dev build compares equal to every other. If someone ever
-    // "simplifies" by folding the channel into the version, the version text
-    // stops being the bare derived number and this fails.
-    const w = await mountCard({ ...INSTALLED, channel: 'dev' })
-    expect(w.text()).toContain('v1.0.3499884')
-    expect(w.text()).not.toContain('1.0.3499884-dev')
-  })
-
-  it('renders no channel when the instance declares none', async () => {
-    // A locally-built image, or one predating the field. The card must read
-    // exactly as it did before the channel existed rather than inventing an
-    // "unknown" badge — absence is a normal answer here, not a fault.
-    const w = await mountCard(INSTALLED)
-    expect(w.text()).toContain('v1.0.3499884')
-    expect(w.findAll('v-chip')).toHaveLength(0)
-  })
-})

frontend/test/systemBuild.spec.js

@@ -1,96 +0,0 @@
-import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest'
-import { setActivePinia, createPinia } from 'pinia'
-import { useSystemStore } from '../src/stores/system.js'
-
-// Which build am I running? Milestone 318 stopped publishing version image
-// tags, so the instance's own report is the ONLY answer — there is no registry
-// name left to check it against. That promotes this from a convenience to the
-// mechanism, and it means the three states below have to stay distinct: a
-// wrong answer here has nothing to contradict it.
-//
-//   not asked yet        -> render nothing
-//   asked, no version    -> render "unknown"
-//   asked, has a version -> render it
-//
-// Collapsing the first two would show "unknown" during every page load, and
-// collapsing either into a blank would read as "no version", which is a
-// different and false claim.
-
-function stubHealth(body, { fail = false } = {}) {
-  globalThis.fetch = vi.fn(async () => {
-    if (fail) throw new Error('network down')
-    return {
-      ok: true, status: 200, statusText: '200',
-      text: async () => JSON.stringify(body),
-    }
-  })
-}
-
-describe('system store — build identity', () => {
-  beforeEach(() => setActivePinia(createPinia()))
-  afterEach(() => { vi.restoreAllMocks(); delete globalThis.fetch })
-
-  it('starts having asked nothing, so the footer renders nothing', () => {
-    const s = useSystemStore()
-    expect(s.buildLoaded).toBe(false)
-  })
-
-  it('reports the version and channel the instance claims', async () => {
-    stubHealth({ status: 'ok', version: '2026.08.28.1249', channel: 'dev' })
-    const s = useSystemStore()
-    await s.refreshHealth()
-
-    expect(s.buildLoaded).toBe(true)
-    expect(s.buildVersion).toBe('2026.08.28.1249')
-    expect(s.buildChannel).toBe('dev')
-  })
-
-  it('keeps the channel OUT of the version string', async () => {
-    // The tempting shortcut is a `-dev` suffix. The extension's comparator
-    // parses each dotted segment with parseInt, so a suffixed segment reads as
-    // 0 and every dev build compares equal to every other — #2993 exactly
-    // (rule 149). If anyone ever "simplifies" by folding them together, the
-    // version stops being the bare derived number and this fails.
-    stubHealth({ status: 'ok', version: '2026.08.28.1249', channel: 'dev' })
-    const s = useSystemStore()
-    await s.refreshHealth()
-
-    expect(s.buildVersion).toBe('2026.08.28.1249')
-    expect(s.buildVersion).not.toContain('dev')
-  })
-
-  it('treats an absent version as "cannot say", not as a value', async () => {
-    // A locally-built image, or one predating the field. The server omits the
-    // key rather than sending an empty string; `?? ''` must preserve that
-    // rather than inventing something. The view renders "unknown" from it.
-    stubHealth({ status: 'ok' })
-    const s = useSystemStore()
-    await s.refreshHealth()
-
-    expect(s.buildLoaded).toBe(true)
-    expect(s.buildVersion).toBe('')
-    expect(s.buildChannel).toBe('')
-  })
-
-  it('reports a version with no channel without inventing one', async () => {
-    stubHealth({ status: 'ok', version: '2026.08.28.1249' })
-    const s = useSystemStore()
-    await s.refreshHealth()
-
-    expect(s.buildVersion).toBe('2026.08.28.1249')
-    expect(s.buildChannel).toBe('')
-  })
-
-  it('does not claim "unknown" when the health call itself failed', async () => {
-    // A network blip says nothing about the build. Marking it loaded here
-    // would present a transient failure as a defective image — and since
-    // nothing else names the build, there would be no second source to
-    // correct the impression.
-    stubHealth(null, { fail: true })
-    const s = useSystemStore()
-    await s.refreshHealth()
-
-    expect(s.healthy).toBe(false)
-    expect(s.buildLoaded).toBe(false)
-  })
-})

scripts/artifacts.sh

@@ -1,201 +0,0 @@
-#!/bin/sh
-# Single definition of WHAT EACH PUBLISHED ARTIFACT IS BUILT FROM, and the
-# version derived from it. Milestone 313; generalises the shape
-# extension/scripts/packaging.sh established for the extension alone.
-#
-# "Built from" is deliberately wider than "copied into". A file that DECIDES an
-# artifact's identity is part of what that artifact is built from even though it
-# never reaches the image — see DERIVER below, and #3156 for the same finding
-# about packaging.sh.
-#
-# Four artifacts, four independent versions. An artifact whose shipped files
-# did not change keeps its version and does not rebuild — that is the whole
-# point, and it is why each path set must match its Dockerfile rather than
-# being a plausible guess. Getting a set wrong is quiet in BOTH directions:
-#
-#   too narrow -> a pin serves stale bytes, because the version did not move
-#                 when the content did. This is the dangerous one.
-#   too wide   -> the artifact re-versions and rebuilds for a change it does
-#                 not ship. Merely wasteful.
-#
-# tests/test_artifact_paths.py asserts every COPY source in each Dockerfile is
-# covered here, so adding a COPY without updating this file fails CI.
-#
-# POSIX sh only — CI's run shell is busybox on some paths.
-#
-# -f (no pathname expansion) is load-bearing for the whole script: the lists
-# below are iterated with deliberate word-splitting, and without it the shell
-# would glob `frontend/test/**` against the working tree and silently narrow
-# the pattern. Callers substituting the output need their own `set -f` too;
-# the two guards protect different expansions.
-set -euf
-
-ROOT=$(git rev-parse --show-toplevel)
-
-# --- what each artifact ships ------------------------------------------------
-#
-# Each set includes its own Dockerfile and requirements: changing a base image
-# or a pin changes the artifact just as surely as changing a source file.
-#
-# web (Dockerfile, context `.`) — the runtime stage copies backend/, alembic/,
-# alembic.ini, entrypoint.sh and requirements.txt; the frontend-builder stage
-# copies frontend/ and the runtime takes its `dist` output.
-#
-# frontend/test is excluded: `npm run build` is vite, which builds from src/,
-# index.html and public/ and never reads test/. It lands in the builder layer
-# but not in `dist`, so it cannot reach the shipped image.
-#
-# The web image ALSO bundles the signed XPI (build.yml downloads it into
-# frontend/public/extension/ before the docker build), so an extension change
-# changes the web image. The extension's packaged set is appended in cmd_paths
-# rather than restated — one definition, per #2397.
-WEB_PATHS='Dockerfile requirements.txt backend alembic alembic.ini entrypoint.sh frontend :(exclude)frontend/test :(exclude)frontend/test/**'
-
-# ml (Dockerfile.ml, context `.`) — no frontend, no extension. Note it copies
-# BOTH requirements-ml.txt and requirements.txt.
-ML_PATHS='Dockerfile.ml requirements-ml.txt requirements.txt backend alembic alembic.ini entrypoint.sh'
-
-# agent (agent/Dockerfile, context `agent`) — copies requirements.txt and
-# fc_agent only. agent/README.md, agent/docker-compose.yml and agent/ruff.toml
-# live in the directory but never reach the image, so they must not re-version
-# it: this is deliberately NOT `agent/`.
-AGENT_PATHS='agent/Dockerfile agent/requirements.txt agent/fc_agent'
-
-# This file. It is copied into no image and it is still part of what the web
-# image is built from, because it DECIDES the FC_VERSION baked into that image
-# (#3202). Same finding as #3156 about packaging.sh, one level up.
-#
-# Why web and nothing else. Every artifact stamps `fc.revision`, but only web
-# also stamps a version (build.yml line ~488 feeds `version web` to the
-# FC_VERSION build arg; ml and agent ask for `revision` alone, and the
-# extension takes its version from packaging.sh). For a revision-only artifact
-# this file needs no entry: any change to how the revision is COMPUTED changes
-# the derived value, which then disagrees with the label on the published image
-# and forces a rebuild. That mechanism is self-correcting because it compares
-# against a string stamped into a real artifact.
-#
-# The version is compared against nothing, so it has no such backstop. Before
-# this entry, a change to cmd_version alone left every artifact's revision
-# untouched, the reuse check hit, the build was skipped, and the published
-# image went on reporting the OLD version format — silently, until some
-# unrelated commit happened to force a rebuild. Milestone 318 step 5 is the
-# worked instance: b3989d0 and 5771fd5 share revision fb2c4d5b80be while the
-# version moved 2026.8.28.1249 -> 2026.08.28.1249. It cost nothing only because
-# FC_VERSION did not exist until one commit later.
-#
-# Named as a file, not as `scripts`: release_notes.py lives beside it and only
-# READS derived values, so it decides nothing and must not re-version anything.
-# A future script that derives an identity belongs here explicitly.
-DERIVER='scripts/artifacts.sh'
-
-
-usage() {
-  echo "usage: artifacts.sh {paths|revision|version} {web|ml|agent|extension}" >&2
-  exit 2
-}
-
-# The extension's packaged set, read from its own definition rather than
-# copied. packaging.sh emits `:(exclude)extension/...` entries, so the bare
-# `extension` include has to come with them.
-ext_paths() {
-  echo "extension $(sh "$ROOT/extension/scripts/packaging.sh" pathspec)"
-}
-
-cmd_paths() {
-  case "$1" in
-    web)       echo "$WEB_PATHS $DERIVER $(ext_paths)" ;;
-    ml)        echo "$ML_PATHS" ;;
-    agent)     echo "$AGENT_PATHS" ;;
-    extension) ext_paths ;;
-    *)         usage ;;
-  esac
-}
-
-# "<unix ts> <sha>" of the newest commit touching this artifact's shipped set.
-# Unquoted on purpose: the pathspec must word-split into separate args.
-# Globbing is already off script-wide.
-newest() {
-  # shellcheck disable=SC2046
-  set -- "$(cd "$ROOT" && git log --format='%ct %H' HEAD -- $(cmd_paths "$1") \
-            | sort -n | tail -1)"
-  if [ -z "$1" ]; then
-    echo "artifacts.sh: no commit touches this artifact's shipped files" >&2
-    exit 1
-  fi
-  echo "$1"
-}
-
-# Formatted through git rather than date(1): busybox date does not reliably
-# accept `-d @<epoch>`, and git's own --date=format-local is available wherever
-# git is. TZ=UTC so the value does not depend on the runner's timezone.
-fmt() {
-  (cd "$ROOT" && TZ=UTC git show -s --format=%cd --date="format-local:$2" "$1")
-}
-
-# The IDENTITY of an artifact's content: the commit its shipped files last
-# changed in. This is what decides whether a build can be skipped.
-#
-# It is published as the `fc.revision` LABEL on the image itself, and read
-# back off the moving channel tag — not as a tag of its own (milestone 318
-# step 3). A tag would be a name minted per build that only one thing reads,
-# which is what rule 145 narrowed against; it would also be prunable under the
-# registry's keep_pattern (#3157), so the cache would silently expire.
-#
-# A published image with no such label reads as a MISS and rebuilds. That is
-# the migration path, not a fault: `imagetools create` copies a manifest and
-# config labels are not manifest annotations, so the reuse path cannot stamp
-# one and there is nothing to backfill. Each artifact pays one rebuild, once.
-cmd_revision() {
-  echo "$(newest "$1")" | cut -d' ' -f2 | cut -c1-12
-}
-
-# The VERSION: `YYYY.MM.DD.HHMM`, zero-padded, UTC. One shape across the whole
-# family (note #3127 §1, rule 148) — the number an instance reports about
-# itself, and, with a `v` in front, the release tag naming the same build.
-#
-# Zero-padded since 2026-08-28. This stripped leading zeros until then, on the
-# reasoning that every segment should read as a plain integer — which never
-# held, since comparison strips them on parse anyway. Padding costs nothing,
-# sorts lexically as well as numerically, and keeps this project emitting the
-# same string as its siblings: unpadded, a `2026.8.28.1432` here sits beside a
-# `2026.08.28.1432` there, two shapes one character apart. Two obviously
-# different formats are safer than two nearly identical ones.
-#
-# Comparison is numeric per dot-segment, so `08` and `8` are equal and nothing
-# already published is reordered by the change.
-#
-# HHMM is not decoration: it is what makes the value unique per build with no
-# lookup. A date alone collides on the second build of a day, and resolving
-# that needs a `.N` suffix, which needs asking the registry what already
-# exists — at which point two lanes derive different answers for one source
-# and the shared-signature property is lost.
-cmd_version() {
-  # The extension is the one artifact this script does not FORMAT, only route.
-  # AMO's version grammar forbids leading zeros, so the extension emits the
-  # same numbers unpadded (#3138) — a rendering exception, documented in
-  # packaging.sh beside the signing step that has to obey it. Delegating keeps
-  # one answer per artifact: `artifacts.sh version extension` and
-  # `packaging.sh version` cannot drift into two.
-  #
-  # The direction is deliberate. artifacts.sh already asks packaging.sh for the
-  # extension's PATH SET (ext_paths above), so the version has to flow the same
-  # way; reversing it would have packaging.sh call back into this script, which
-  # would call packaging.sh for the paths again.
-  if [ "$1" = extension ]; then
-    sh "$ROOT/extension/scripts/packaging.sh" version
-    return
-  fi
-  sha=$(echo "$(newest "$1")" | cut -d' ' -f2)
-  # One git call for the whole string rather than four and a sed. git's
-  # format-local takes the complete format, and doing it in pieces was only
-  # ever there to strip the padding between them.
-  fmt "$sha" '%Y.%m.%d.%H%M'
-}
-
-[ $# -ge 2 ] || usage
-case "$1" in
-  paths)    cmd_paths "$2" ;;
-  revision) cmd_revision "$2" ;;
-  version)  cmd_version "$2" ;;
-  *)        usage ;;
-esac

scripts/release_notes.py

@@ -1,312 +0,0 @@
-"""Publish a Forgejo release whose body is derived from git, not written by hand.
-
-Milestone 318 step 2 took the build consequence away from a `v*` tag: `main`
-has already built and published the commit by the time anyone tags it, and
-rebuilding would re-push `:c-<sha>`, which rule 145 forbids even when the bytes
-match. That left the tag with nothing to do. This gives it the job it has left.
-
-**The half of the question a version string cannot answer.** Step 6 puts
-`2026.08.28.2208` in the Settings footer, so an operator can say which build
-they are running. They still cannot say what is in it that was not in the one
-they ran last month. A dated release carrying the commits since the previous
-one is the object that interprets the identifier (note #3127 §5).
-
-**Derived, so it cannot drift.** The alternative is a hand-maintained
-`CHANGELOG.md`, which goes aspirational the first time someone forgets — and
-nothing ever catches it, because there is no second source to disagree with.
-Every line below comes out of `git log` at publish time.
-
-**Optional by construction.** Release tags are bookmarks: cut one when you will
-want to point at that day by name, otherwise don't. FC went twelve weeks
-without one and nothing was wrong (note #3127 §0). This runs on a tag push and
-on nothing else — deliberately no schedule and no auto-tag on merge, either of
-which would turn an optional bookmark back into ceremony.
-
-## Finding the previous release
-
-`git describe --exclude <this tag>`, which walks ANCESTRY, not a sorted list.
-That is not fussiness: this repo's existing tags are the old `v26.05.22.0`
-shape and the next one will be rule 148's `v2026.08.28.2208`. Lexicographically
-`v2026...` sorts BEFORE `v26...` — every release from here on would report its
-predecessor as itself-or-nothing and emit a changelog covering the entire
-history. Ancestry is immune to the shape change, and it is also the more honest
-question: "what is in this that was not in the last one" IS a reachability
-question.
-
-## Re-runs update, they do not fall through
-
-Note #3127 §6.7: a publisher that POSTs and recovers the id from a `409` never
-rewrites the body, so a re-run silently keeps the first version. Harmless for a
-`v*` tag created once — and wrong the moment anything re-points. This one GETs
-first and PATCHes when the release exists, so it is correct either way rather
-than correct by luck (ThoughtSync #2182 is the same bug).
-"""
-
-from __future__ import annotations
-
-import argparse
-import json
-import os
-import re
-import subprocess
-import sys
-import urllib.error
-import urllib.request
-
-API = "https://git.fabledsword.com/api/v1/repos/bvandeusen/FabledCurator"
-
-IMAGES = (
-    "git.fabledsword.com/bvandeusen/fabledcurator",
-    "git.fabledsword.com/bvandeusen/fabledcurator-ml",
-    "git.fabledsword.com/bvandeusen/fabledcurator-agent",
-)
-
-# Rule 148: `v` + the artifact's own version, zero-padded, no `.N`, no lookup.
-RULE_148 = re.compile(r"^v\d{4}\.\d{2}\.\d{2}\.\d{4}$")
-
-# Past this, the list has stopped being something anyone reads. It is reached
-# in exactly one situation — no previous tag is reachable, so the span is the
-# whole history — which happens on a genuine first release and on a tag cut
-# somewhere `main`'s tags cannot be seen from. Truncating says so; emitting
-# 1100 lines would bury the note explaining why there are 1100 of them.
-MAX_COMMITS = 200
-
-
-def git(*args: str) -> str:
-    return subprocess.run(
-        ["git", *args], capture_output=True, text=True, check=True
-    ).stdout.strip()
-
-
-def git_ok(*args: str) -> str | None:
-    """Run git, returning None instead of raising when it fails.
-
-    Used for the questions that legitimately have no answer — no previous tag,
-    no local `main` — where the absence is information rather than a fault.
-    """
-    try:
-        return git(*args)
-    except subprocess.CalledProcessError:
-        return None
-
-
-def previous_tag(ref: str, tag: str | None) -> str | None:
-    """The most recent `v*` tag reachable from `ref`, excluding `tag` itself.
-
-    `--exclude` rather than `<ref>^` so this is the same call whether or not
-    `ref` is the tag being released — and so it does not blow up on a root
-    commit that has no parent to walk to.
-    """
-    args = ["describe", "--tags", "--abbrev=0", "--match", "v*"]
-    if tag:
-        args += ["--exclude", tag]
-    return git_ok(*args, ref)
-
-
-def commits(previous: str | None, ref: str) -> list[str]:
-    """The subjects between the previous release and this one.
-
-    `--no-merges` because rule 153 merges `dev` into `main` with a plain merge
-    commit, so `main`'s first-parent view is a list of "Merge pull request #N"
-    and nothing else. The work is in the commits under those merges.
-    """
-    span = f"{previous}..{ref}" if previous else ref
-    out = git("log", "--no-merges", "--format=%s (%h)", span)
-    return [line for line in out.split("\n") if line.strip()]
-
-
-def truncate(log: list[str]) -> tuple[list[str], str | None]:
-    if len(log) <= MAX_COMMITS:
-        return log, None
-    return log[:MAX_COMMITS], (
-        f"{len(log)} commits in this span — more than a changelog is for. "
-        f"Listing the newest {MAX_COMMITS}. This usually means no previous "
-        f"`v*` tag was reachable from here."
-    )
-
-
-def render(tag: str, sha: str, previous: str | None, log: list[str], notes: list[str]) -> str:
-    short = sha[:7]
-    parts = []
-
-    if notes:
-        # Anything the derivation could not stand behind goes at the TOP, not
-        # in a footnote. A release that quietly names a build nobody can find
-        # is the failure this whole milestone is about.
-        parts.append("\n".join(f"> **Note:** {n}" for n in notes))
-
-    parts.append(
-        f"Built from `{short}`. The rollback unit is the immutable `:c-` tag "
-        f"(rule 145) — these three move together:\n\n```\n"
-        + "\n".join(f"{image}:c-{short}" for image in IMAGES)
-        + "\n```"
-    )
-
-    heading = f"## Changes since {previous}" if previous else "## Changes"
-    if log:
-        parts.append(heading + "\n\n" + "\n".join(f"- {line}" for line in log))
-    else:
-        parts.append(
-            heading
-            + "\n\n_No non-merge commits since the previous release. This tag "
-            "names the same source under a new name._"
-        )
-
-    span = f"{previous}..{tag}" if previous else tag
-    parts.append(
-        f"---\n\n_Derived at publish time from `git log --no-merges {span}`. "
-        f"Nothing here is hand-maintained._"
-    )
-    return "\n\n".join(parts)
-
-
-def cross_checks(tag: str, sha: str) -> list[str]:
-    """Everything the derivation knows that would make the release a lie.
-
-    Reported rather than enforced. The tag is already pushed by the time this
-    runs, so failing here would leave the operator with a tag and no release
-    and nothing but a red lane to explain it — while the release itself is
-    still the useful object. Say what is wrong, on the release, and publish.
-    """
-    notes = []
-
-    if not RULE_148.match(tag):
-        notes.append(
-            f"`{tag}` is not rule 148's `vYYYY.MM.DD.HHMM` shape. Published "
-            f"anyway — the old `v26.*` tags predate the rule."
-        )
-    else:
-        derived = artifact_version("web")
-        if derived and derived != tag[1:]:
-            notes.append(
-                f"This tag names `{tag[1:]}`, but the web image built from "
-                f"`{sha[:7]}` reports `{derived}`. The Settings footer will not "
-                f"match this release's name."
-            )
-
-    # `:c-<sha>` only exists if `main` built this commit. Checking costs one
-    # git call; claiming it without checking costs a rollback that 404s at the
-    # moment someone needs it.
-    main = git_ok("rev-parse", "--verify", "-q", "refs/remotes/origin/main")
-    if main is None:
-        notes.append(
-            "Could not resolve `origin/main` here, so the `:c-` tags above are "
-            "unverified — they exist only if `main` built this commit."
-        )
-    elif subprocess.run(
-        ["git", "merge-base", "--is-ancestor", sha, main], capture_output=True
-    ).returncode != 0:
-        notes.append(
-            f"`{sha[:7]}` is not on `main`, so no `:c-{sha[:7]}` images were "
-            f"ever published. The refs above will not pull."
-        )
-
-    return notes
-
-
-def artifact_version(artifact: str) -> str | None:
-    """What `artifacts.sh` derives for one artifact in the CURRENT checkout.
-
-    It takes no ref because `artifacts.sh` takes none — it walks history from
-    HEAD. That is right here only because a tag push checks out the tagged
-    commit; calling this after `--dry-run some-other-ref` would compare the
-    tag against the working tree, which is why the mismatch note below is
-    reported and not enforced.
-
-    Returns None rather than raising if the script is missing or unhappy: a
-    cross-check that cannot run should not take the release down with it.
-    """
-    root = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
-    try:
-        return subprocess.run(
-            ["sh", os.path.join(root, "scripts", "artifacts.sh"), "version", artifact],
-            capture_output=True, text=True, check=True, cwd=root,
-        ).stdout.strip()
-    except (subprocess.CalledProcessError, OSError):
-        return None
-
-
-def api(method: str, path: str, token: str, payload: dict | None = None) -> dict | None:
-    body = json.dumps(payload).encode() if payload is not None else None
-    req = urllib.request.Request(
-        API + path, data=body, method=method,
-        headers={
-            "Authorization": "token " + token,
-            "Content-Type": "application/json",
-        },
-    )
-    try:
-        with urllib.request.urlopen(req, timeout=30) as resp:
-            return json.load(resp)
-    except urllib.error.HTTPError as exc:
-        if exc.code == 404:
-            return None
-        sys.exit(f"release: {method} {path} failed with HTTP {exc.code}: {exc.read()!r}")
-
-
-def publish(tag: str, name: str, body: str, token: str) -> None:
-    existing = api("GET", f"/releases/tags/{tag}", token)
-    if existing:
-        api("PATCH", f"/releases/{existing['id']}", token, {"name": name, "body": body})
-        print(f"release: updated existing release {existing['id']} for {tag}")
-    else:
-        api("POST", "/releases", token, {"tag_name": tag, "name": name, "body": body})
-        print(f"release: created release for {tag}")
-
-
-def main() -> None:
-    ap = argparse.ArgumentParser(description=__doc__)
-    ap.add_argument(
-        "ref", nargs="?", default=None,
-        help="tag or commit to release. Defaults to GITHUB_REF's tag, else HEAD.",
-    )
-    ap.add_argument(
-        "--dry-run", action="store_true",
-        help="render the body to stdout and publish nothing. Needs no token, "
-             "so it also works as a preview before you decide to cut the tag.",
-    )
-    args = ap.parse_args()
-
-    github_ref = os.environ.get("GITHUB_REF", "")
-    if args.ref:
-        ref = args.ref
-    elif github_ref.startswith("refs/tags/"):
-        ref = github_ref[len("refs/tags/"):]
-    else:
-        ref = "HEAD"
-
-    # A tag only if git knows it as one — `HEAD` and a raw sha are refs to
-    # release FROM, never the name to exclude or to publish under.
-    tag = ref if git_ok("rev-parse", "--verify", "-q", f"refs/tags/{ref}") else None
-    sha = git("rev-parse", ref)
-    previous = previous_tag(ref, tag)
-
-    print(f"release: ref={ref} sha={sha[:12]} previous={previous or '<none>'}")
-
-    notes = cross_checks(tag, sha) if tag else [
-        f"Rendered for `{ref}`, which is not a tag. Nothing was published."
-    ]
-    for note in notes:
-        print(f"release: NOTE {note}")
-
-    log = commits(previous, ref)
-    print(f"release: {len(log)} non-merge commits in the span")
-    log, overflow = truncate(log)
-    if overflow:
-        print(f"release: NOTE {overflow}")
-        notes.append(overflow)
-    body = render(tag or ref, sha, previous, log, notes)
-
-    if args.dry_run or not tag:
-        print("--- body ---")
-        print(body)
-        return
-
-    token = os.environ.get("RELEASE_TOKEN") or os.environ.get("TOKEN")
-    if not token:
-        sys.exit("release: no RELEASE_TOKEN in the environment")
-    publish(tag, f"FabledCurator {tag[1:]}", body, token)
-
-
-if __name__ == "__main__":
-    main()

tests/test_api_admin.py

@@ -677,34 +677,3 @@ async def test_reset_content_tagging_apply_requires_confirm_token(client, db):
     )
     assert resp.status_code == 200
     assert (await resp.get_json())["deleted"] == 1
-
-
-@pytest.mark.asyncio
-async def test_trigger_reclaim_attachments_defaults_to_preview(client, monkeypatch):
-    """Unlike the other maintenance triggers, this one's apply unlinks FILES —
-    so an empty body must mean preview, not apply."""
-    from backend.app.tasks import admin as admin_tasks
-
-    calls = []
-    monkeypatch.setattr(
-        admin_tasks.reclaim_orphaned_attachments_task, "delay", _fake_delay(calls)
-    )
-    resp = await client.post("/api/admin/maintenance/reclaim-attachments", json={})
-    assert resp.status_code == 202
-    assert (await resp.get_json())["task_id"] == "task-xyz"
-    assert calls[0][1] == {"dry_run": True}
-
-
-@pytest.mark.asyncio
-async def test_trigger_reclaim_attachments_threads_apply(client, monkeypatch):
-    from backend.app.tasks import admin as admin_tasks
-
-    calls = []
-    monkeypatch.setattr(
-        admin_tasks.reclaim_orphaned_attachments_task, "delay", _fake_delay(calls)
-    )
-    resp = await client.post(
-        "/api/admin/maintenance/reclaim-attachments", json={"dry_run": False},
-    )
-    assert resp.status_code == 202
-    assert calls[0][1] == {"dry_run": False}

tests/test_api_attachments.py

@@ -1,6 +1,6 @@
 import pytest
 
-from backend.app.models import Artist, PostAttachment, attachment_download_url
+from backend.app.models import Artist, PostAttachment
 
 pytestmark = pytest.mark.integration
 
@@ -33,16 +33,3 @@ async def test_download_streams_with_disposition(client, db, tmp_path):
 async def test_download_404(client):
     resp = await client.get("/api/attachments/999999/download")
     assert resp.status_code == 404
-
-
-@pytest.mark.asyncio
-async def test_attachment_download_url_routes_to_the_download_endpoint(app):
-    """The two serializers no longer hand-format this path (#3072) — but a
-    single definition is only worth having if it still matches the route. Pin
-    it by MATCHING against the real URL map rather than comparing to a literal:
-    a string equality test would pass just as happily after someone renamed the
-    route, which is the exact drift the helper exists to prevent."""
-    built = attachment_download_url(4242)
-    endpoint, args = app.url_map.bind("localhost").match(built)
-    assert endpoint == "attachments.download"
-    assert args == {"attachment_id": 4242}

tests/test_api_extension.py

@@ -129,6 +129,7 @@ async def test_resolve_artist_name_dispatches_per_platform(db, monkeypatch):
     ("https://www.subscribestar.com/foobar",             "subscribestar", "foobar"),
     ("https://subscribestar.adult/foobar",               "subscribestar", "foobar"),
     ("https://www.hentai-foundry.com/user/Foo/profile",  "hentaifoundry", "Foo"),
+    ("https://www.deviantart.com/baz",                   "deviantart",    "baz"),
     ("https://www.pixiv.net/users/12345",                "pixiv",         "12345"),
     ("https://www.pixiv.net/en/users/12345",             "pixiv",         "12345"),
 ])
@@ -159,23 +160,6 @@ async def test_quick_add_source_unknown_url_400(client, ext_key):
     assert "known" in body
 
 
-@pytest.mark.asyncio
-async def test_quick_add_source_rejects_retired_deviantart(client, ext_key):
-    """#3069: a DeviantArt creator URL used to derive cleanly. Now that the
-    platform is retired, the extension's own gate should never offer the
-    button — but a stale content script on an un-updated browser still can,
-    so the backend has to refuse it rather than create an unusable source."""
-    resp = await client.post(
-        "/api/extension/quick-add-source",
-        json={"url": "https://www.deviantart.com/baz"},
-        headers={"X-Extension-Key": ext_key},
-    )
-    assert resp.status_code == 400
-    body = await resp.get_json()
-    assert body["error"] == "unknown_platform"
-    assert "deviantart" not in body["known"]
-
-
 @pytest.mark.asyncio
 async def test_quick_add_source_invalid_url_400(client, ext_key):
     resp = await client.post(
@@ -383,53 +367,6 @@ async def test_extension_manifest_returns_metadata_when_xpi_present(client, monk
     assert body["sha256"] == hashlib.sha256(b"fake-xpi-content").hexdigest()
 
 
-@pytest.mark.asyncio
-async def test_extension_manifest_reports_the_channel_the_image_declares(
-    client, monkeypatch, tmp_path
-):
-    """The channel travels BESIDE the version, never inside it.
-
-    Folding it in as a `1.0.3499884-dev` suffix is the failure this design
-    exists to avoid: the extension's comparator parses each dotted segment as
-    an integer, so a suffixed segment collapses to 0 and every dev build
-    compares equal to every other — "no update available" and "I cannot read
-    this version" stop being distinguishable. Asserting the two are separate
-    keys is what keeps a future edit from merging them.
-    """
-    (tmp_path / "fabledcurator-1.2.3.xpi").write_bytes(b"x")
-    monkeypatch.setattr(extension_module, "XPI_DIR", tmp_path)
-    monkeypatch.setattr(extension_module, "FC_CHANNEL", "dev")
-    resp = await client.get("/api/extension/manifest")
-    assert resp.status_code == 200
-    body = await resp.get_json()
-    assert body["channel"] == "dev"
-    assert body["version"] == "1.2.3"
-
-
-@pytest.mark.asyncio
-async def test_extension_manifest_omits_the_channel_when_the_image_declares_none(
-    client, monkeypatch, tmp_path
-):
-    """A local build, or any image from before the field existed.
-
-    The key must be ABSENT rather than present-and-empty: absence is the state
-    every consumer already handles (an older image conveys it by not having the
-    key at all), so a blank channel reuses that path instead of introducing a
-    second spelling of "unknown" for each reader to special-case.
-    """
-    (tmp_path / "fabledcurator-1.2.3.xpi").write_bytes(b"x")
-    monkeypatch.setattr(extension_module, "XPI_DIR", tmp_path)
-    monkeypatch.setattr(extension_module, "FC_CHANNEL", "")
-    resp = await client.get("/api/extension/manifest")
-    assert resp.status_code == 200
-    body = await resp.get_json()
-    assert "channel" not in body
-    # Everything else still answers — an image with no channel is not a
-    # degraded one, it just cannot say which channel it came from.
-    assert body["installed"] is True
-    assert body["latest_url"] == "/extension/fabledcurator-latest.xpi"
-
-
 # --- /extension/<filename> -----------------------------------------
 
 

tests/test_api_platforms.py

@@ -6,17 +6,16 @@ pytestmark = pytest.mark.integration
 
 
 @pytest.mark.asyncio
-async def test_platforms_returns_gs_five(client):
+async def test_platforms_returns_gs_six(client):
     resp = await client.get("/api/platforms")
     assert resp.status_code == 200
     body = await resp.get_json()
     platforms = body["platforms"]
     assert set(platforms.keys()) == {
         "patreon", "subscribestar", "hentaifoundry",
-        "discord", "pixiv",
+        "discord", "pixiv", "deviantart",
     }
     assert "fanbox" not in platforms
-    assert "deviantart" not in platforms  # retired at #3069
 
 
 @pytest.mark.asyncio

tests/test_artifact_identity.py

@@ -1,166 +0,0 @@
-"""The two values `artifacts.sh` derives, and what each of them promises.
-
-`revision` decides whether a build gets skipped; `version` is what an instance
-reports about itself and what a release tag is named after. Neither has a
-consumer that would notice it going subtly wrong.
-
-## revision
-
-Milestone 318 step 3: each image carries its revision as an `fc.revision`
-label, and build.yml reads that label back off the moving channel tag. Equal
-to the derived revision means the bytes this push would produce are already
-published, so the build is skipped.
-
-That makes the revision load-bearing in a way a version string is not — it is
-compared for equality against a value stamped into a real published artifact.
-Both ways of getting it wrong are silent:
-
-* **it does not identify the content** — a revision that moves when the source
-  did not (a HEAD-derived value, say) never matches, nothing is ever skipped,
-  and the mechanism quietly buys nothing while every lane stays green.
-* **it identifies the wrong content** — a revision that holds still when the
-  source DID change matches a stale label, the build is skipped, and the
-  channel serves bytes that do not correspond to the commit. This is the
-  dangerous direction, and it is what `test_artifact_paths.py` guards from the
-  other side by pinning the path sets.
-
-This module owns the narrower claim: whatever the path sets say, the revision
-is genuinely the commit those paths last changed in.
-
-## version
-
-`YYYY.MM.DD.HHMM`, zero-padded, UTC — one shape across the family (note #3127
-§1, rule 148), so the string this project emits is the same string its siblings
-emit. Two nearly-identical formats are more dangerous than two obviously
-different ones, and the only thing keeping them identical is a test.
-
-The identity-TAG tests this file used to hold are gone with the tag. There is
-no longer a `CHANNELLED` list to drift (the channel is which tag you inspect),
-and no `identity` subcommand to refuse an unqualified call.
-"""
-from __future__ import annotations
-
-import os
-import re
-import subprocess
-from pathlib import Path
-
-import pytest
-
-ROOT = Path(__file__).resolve().parent.parent
-
-ARTIFACTS = ("web", "ml", "agent", "extension")
-
-# 12 hex chars — the prefix build.yml stamps and compares.
-_REVISION = re.compile(r"^[0-9a-f]{12}$")
-
-# YYYY.MM.DD.HHMM, every segment zero-padded to its full width.
-_VERSION = re.compile(r"^\d{4}\.\d{2}\.\d{2}\.\d{4}$")
-
-
-# Everything here goes through artifacts.sh rather than importing a sibling
-# test module. That is the interface build.yml actually calls, so the tests
-# exercise the contract instead of a Python re-implementation of it — and no
-# other test module in this repo imports another, so a cross-test import would
-# be a new convention introduced for no gain.
-def artifacts(*args: str) -> str:
-    return subprocess.run(
-        ["sh", str(ROOT / "scripts" / "artifacts.sh"), *args],
-        capture_output=True, text=True, check=True, cwd=ROOT,
-    ).stdout
-
-
-def revision(artifact: str) -> str:
-    return artifacts("revision", artifact).strip()
-
-
-def newest_by_commit_time(artifact: str) -> str:
-    """The full SHA of the newest commit touching this artifact's shipped set.
-
-    Ordered by committer TIME, matching what artifacts.sh means. Deliberately
-    not `git log -1`: git's default order is reverse-chronological only within
-    topological constraints, so on a merged history it can name a different
-    commit than the newest timestamp does. They agree on this repo today, and
-    a test that silently depends on them continuing to agree would be a flake
-    waiting for the branch shape that separates them.
-    """
-    paths = artifacts("paths", artifact).split()
-    log = subprocess.run(
-        ["git", "log", "--format=%ct %H", "HEAD", "--", *paths],
-        capture_output=True, text=True, check=True, cwd=ROOT,
-    ).stdout.split("\n")
-    commits = [line.split(" ", 1) for line in log if line.strip()]
-    assert commits, (
-        f"no commit in this history touches the {artifact} path set — the "
-        f"derivation has nothing to stand on"
-    )
-    return max(commits, key=lambda c: int(c[0]))[1]
-
-
-@pytest.mark.parametrize("artifact", ARTIFACTS)
-def test_revision_is_the_commit_its_own_shipped_files_last_changed_in(artifact):
-    """The claim the whole skip decision rests on.
-
-    Computed from git rather than asked of the script, so it fails if the
-    derivation ever stops meaning what it says — switching to HEAD, to a build
-    clock, or to a path set it did not actually use. Each of those still
-    produces a plausible 12-hex value, which is why this is worth asserting
-    rather than eyeballing.
-    """
-    expected = newest_by_commit_time(artifact)
-    got = revision(artifact)
-    assert expected.startswith(got), (
-        f"{artifact} derives {got!r}, but the newest commit touching its "
-        f"shipped files is {expected[:12]!r}. The label stamped into the image "
-        f"would not identify its own content."
-    )
-
-
-@pytest.mark.parametrize("artifact", ARTIFACTS)
-def test_revision_is_a_legal_label_value_and_is_stable(artifact):
-    """It is stamped as a docker label and compared for string equality, so a
-    stray newline or a varying value breaks the comparison rather than the
-    build — the mechanism would simply stop hitting, silently."""
-    first = revision(artifact)
-    assert _REVISION.match(first), f"{first!r} is not a 12-char hex revision"
-    assert first == revision(artifact), "revision is not stable across calls"
-
-
-@pytest.mark.parametrize("artifact", ARTIFACTS)
-def test_version_is_zero_padded_calver(artifact):
-    """The family shape, pinned.
-
-    Padding was stripped until 2026-08-28 on the reasoning that each segment
-    should read as a plain integer — which never held, since comparison strips
-    leading zeros on parse anyway. What it did do was make this project emit
-    `2026.8.28.1432` while a sibling emitted `2026.08.28.1432`: two shapes one
-    character apart, which is the hard kind of difference to notice.
-
-    Also catches the midnight case. A `%H%M` of `0322` must survive as `0322`;
-    the old strip-leading-zeros helper turned it into `322`, silently changing
-    a four-digit field into three.
-    """
-    value = artifacts("version", artifact).strip()
-    assert _VERSION.match(value), (
-        f"{artifact} derives {value!r}, which is not zero-padded "
-        f"YYYY.MM.DD.HHMM. Note #3127 §1 and rule 148 both specify the padded "
-        f"form, and a release tag is this string with a `v` in front."
-    )
-
-
-@pytest.mark.parametrize("artifact", ARTIFACTS)
-def test_version_and_revision_describe_the_same_commit(artifact):
-    """They are derived independently and must not be able to disagree.
-
-    A build reports the version and skips on the revision, so a divergence
-    would mean an instance naming one commit while carrying another's bytes —
-    unfalsifiable from outside, since both values look perfectly well-formed.
-    """
-    sha = newest_by_commit_time(artifact)
-    stamped = subprocess.run(
-        ["git", "show", "-s", "--format=%cd", "--date=format-local:%Y.%m.%d.%H%M", sha],
-        capture_output=True, text=True, check=True, cwd=ROOT,
-        env={"TZ": "UTC", "PATH": os.environ.get("PATH", "")},
-    ).stdout.strip()
-    assert artifacts("version", artifact).strip() == stamped
-    assert sha.startswith(revision(artifact))

tests/test_artifact_paths.py

@@ -1,199 +0,0 @@
-"""`scripts/artifacts.sh` path sets must match what the Dockerfiles copy.
-
-Each published artifact's version derives from the newest commit touching its
-own shipped file set (milestone 313). The whole scheme rests on those sets
-being right, and both ways of being wrong are silent:
-
-* **too narrow** — a file ships but is not in the set, so the version does not
-  move when the content does, and a pin serves stale bytes. This is the
-  dangerous direction and the one this module exists for.
-* **too wide** — a file is in the set but never reaches the image, so the
-  artifact re-versions and rebuilds for a change it does not ship.
-
-Nothing else notices either. The version still derives, CI still goes green,
-and the mismatch only surfaces as "I pinned that build and got the wrong
-bytes". So the Dockerfiles are read here and compared against the declaration.
-
-The COPY list is not the whole answer, though. A file that DECIDES what an
-artifact reports belongs in its set even though it is copied into nothing —
-see DERIVERS below, where the same finding is recorded twice (#3156, #3202).
-"""
-from __future__ import annotations
-
-import re
-import subprocess
-from pathlib import Path
-
-import pytest
-
-ROOT = Path(__file__).resolve().parent.parent
-
-# artifact -> (dockerfile, build context relative to the repo root)
-ARTIFACTS = {
-    "web": ("Dockerfile", ""),
-    "ml": ("Dockerfile.ml", ""),
-    "agent": ("agent/Dockerfile", "agent"),
-}
-
-# COPY --from=<stage> copies from an earlier build stage, not from the build
-# context, so its source is not a repo path and cannot be in a path set.
-_COPY = re.compile(r"^\s*COPY\s+(?!--from=)(?P<args>.+)$", re.MULTILINE)
-
-
-def declared_paths(artifact: str) -> list[str]:
-    out = subprocess.run(
-        ["sh", str(ROOT / "scripts" / "artifacts.sh"), "paths", artifact],
-        capture_output=True, text=True, check=True, cwd=ROOT,
-    ).stdout
-    return out.split()
-
-
-def includes(artifact: str) -> list[str]:
-    """The set minus its `:(exclude)…` entries."""
-    return [p for p in declared_paths(artifact) if not p.startswith(":(exclude)")]
-
-
-def copy_sources(dockerfile: str, context: str) -> list[str]:
-    """Repo-relative sources of every context COPY in a Dockerfile."""
-    text = (ROOT / dockerfile).read_text()
-    sources: list[str] = []
-    for m in _COPY.finditer(text):
-        args = m.group("args").split()
-        # Last arg is the destination; everything before it is a source.
-        for src in args[:-1]:
-            # `frontend/package-lock.json*` — the glob is an optional-file
-            # idiom; the directory it sits in is what matters for coverage.
-            src = src.rstrip("*")
-            sources.append(f"{context}/{src}" if context else src)
-    return sources
-
-
-def covered_by(path: str, include: str) -> bool:
-    """`path` ships if an include names it or one of its ancestors."""
-    path = path.rstrip("/").lstrip("./")
-    include = include.rstrip("/")
-    return path == include or path.startswith(include + "/")
-
-
-@pytest.mark.parametrize("artifact", sorted(ARTIFACTS))
-def test_every_copied_path_is_in_the_artifacts_path_set(artifact):
-    """The too-narrow direction — the one that serves stale bytes on a pin."""
-    dockerfile, context = ARTIFACTS[artifact]
-    inc = includes(artifact)
-    for src in copy_sources(dockerfile, context):
-        assert any(covered_by(src, i) for i in inc), (
-            f"{dockerfile} copies {src!r} into the {artifact} image, but no "
-            f"include in scripts/artifacts.sh covers it. The {artifact} "
-            f"version will not move when that file changes, so a pinned build "
-            f"will serve stale bytes. Add it to the path set.\n"
-            f"  declared includes: {inc}"
-        )
-
-
-@pytest.mark.parametrize("artifact", sorted(ARTIFACTS))
-def test_the_dockerfile_itself_is_in_the_path_set(artifact):
-    """Changing a base image or a RUN changes the artifact as surely as
-    changing a source file, so each set must include its own Dockerfile."""
-    dockerfile, _ = ARTIFACTS[artifact]
-    assert any(covered_by(dockerfile, i) for i in includes(artifact)), (
-        f"{dockerfile} is not in the {artifact} path set — a base-image bump "
-        f"would not move the version."
-    )
-
-
-def test_the_web_image_versions_on_an_extension_change():
-    """The web image bundles the signed XPI, so the extension's packaged files
-    are part of what it ships. Miss this and `:latest` serves a NEW extension
-    under an unchanged web version — a pin that quietly disagrees with itself.
-    """
-    inc = includes("web")
-    assert any(covered_by("extension/background/background.js", i) for i in inc), (
-        "the web path set does not cover the extension's packaged files, but "
-        "build.yml downloads the signed XPI into frontend/public/extension/ "
-        "before the docker build"
-    )
-
-
-# A file that DECIDES an artifact's identity is part of what that artifact is
-# built from, even though it is copied into no image. Both entries here are the
-# same finding twice — #3156 for packaging.sh, #3202 for artifacts.sh — and
-# both were latent for the same reason: the version has no backstop.
-#
-# The revision does. Change how a REVISION is computed and the derived value
-# stops matching the label on the published image, which forces a rebuild; the
-# mechanism self-corrects because it compares against a string stamped into a
-# real artifact. Nothing compares a version to anything, so a version-only
-# derivation change is invisible unless the deriver is in the set.
-DERIVERS = [
-    # packaging.sh decides the version build.yml stamps into the packaged
-    # manifest.json, so changing it changes the shipped bytes. Left out,
-    # milestone 313 step 4 turns silent: the new version misses the
-    # ext-<version> cache and gets signed, while web's revision has not moved,
-    # so the reuse path republishes the old image and the fresh signature is
-    # orphaned. Guarded for web too, since web bundles what the extension makes.
-    ("extension/scripts/packaging.sh", ("extension", "web")),
-    # artifacts.sh decides the FC_VERSION baked into the web image (#3202).
-    # Web only, and deliberately: ml and agent ask this script for `revision`
-    # alone, so they are covered by the self-correcting path above, and the
-    # extension takes its version from packaging.sh. Milestone 318 step 5 is
-    # the worked instance — b3989d0 and 5771fd5 share revision fb2c4d5b80be
-    # while the version moved 2026.8.28.1249 -> 2026.08.28.1249. It was
-    # harmless only because FC_VERSION did not exist until one commit later.
-    ("scripts/artifacts.sh", ("web",)),
-]
-
-
-@pytest.mark.parametrize("path, artifacts", DERIVERS, ids=lambda v: str(v))
-def test_a_version_deriver_is_in_the_set_of_what_it_decides(path, artifacts):
-    for artifact in artifacts:
-        inc = includes(artifact)
-        excluded = [
-            p[len(":(exclude)"):] for p in declared_paths(artifact)
-            if p.startswith(":(exclude)")
-        ]
-        assert any(covered_by(path, i) for i in inc), (
-            f"{path} decides the version {artifact} reports, but is not in the "
-            f"{artifact} path set. A change to the derivation would leave the "
-            f"revision untouched, the build skipped, and the published image "
-            f"reporting the old version — with nothing to disagree with it."
-        )
-        assert not any(
-            covered_by(path, e.rstrip("*").rstrip("/")) for e in excluded
-        ), (
-            f"{path} is excluded from the {artifact} path set, so a change to "
-            f"how the version is derived would not move the version — and "
-            f"step 4 would reuse the image that carries the old one"
-        )
-
-
-@pytest.mark.parametrize(
-    "artifact, path",
-    [
-        # Deliberate exclusions — the too-wide direction. Each of these lives
-        # beside shipped code but never reaches an image, and including it
-        # would re-version the artifact for a change it does not carry.
-        #
-        # "Never reaches an image" is the test, not "is not source": DERIVERS
-        # above are also copied into nothing and DO belong in their sets,
-        # because they decide what the image reports. The line between the two
-        # lists is whether the file has a say in the artifact's identity.
-        ("agent", "agent/README.md"),
-        ("agent", "agent/ruff.toml"),
-        ("agent", "agent/docker-compose.yml"),
-        # vite builds from src/, index.html and public/; it never reads test/,
-        # so a frontend test change cannot reach `dist`.
-        ("web", "frontend/test/gallery.spec.js"),
-    ],
-)
-def test_files_that_never_reach_an_image_do_not_version_it(artifact, path):
-    paths = declared_paths(artifact)
-    excluded = [p[len(":(exclude)"):] for p in paths if p.startswith(":(exclude)")]
-    inc = [p for p in paths if not p.startswith(":(exclude)")]
-
-    included = any(covered_by(path, i) for i in inc)
-    exempted = any(covered_by(path, e.rstrip("*").rstrip("/")) for e in excluded)
-    assert not included or exempted, (
-        f"{path} is in the {artifact} path set but is not copied into the "
-        f"image — it would re-version and rebuild {artifact} for a change it "
-        f"does not ship."
-    )

tests/test_artist_directory_service.py

@@ -154,7 +154,7 @@ async def test_list_platform_filter_excludes_no_source(db):
 @pytest.mark.asyncio
 async def test_list_platform_filter_excludes_wrong_platform(db):
     a = await _seed_artist(db, "alice-wplat")
-    await _seed_source(db, a.id, "discord", "https://d/alice-wp")
+    await _seed_source(db, a.id, "deviantart", "https://d/alice-wp")
     await db.commit()
 
     page = await ArtistDirectoryService(db).list_artists(

tests/test_cleanup_service.py

@@ -5,7 +5,6 @@ side effects use tmp_path. Assertions on mutated rows use COLUMN
 SELECTS per reference_async_coredml_test_assertions — never
 re-read ORM attributes after a service mutates and re-fetches.
 """
-import os
 from datetime import UTC, datetime
 
 import pytest
@@ -69,8 +68,6 @@ def test_project_artist_cascade_returns_zeroes_for_empty_artist(db_sync):
     assert result["artist"]["slug"] == "empty"
     assert result["projected"] == {
         "images": 0,
-        "posts": 0,
-        "attachments": 0,
         "sources": 0,
         "thumbs": 0,
         "import_tasks": 0,
@@ -95,87 +92,6 @@ def test_project_artist_cascade_counts_images_and_thumbs_and_bytes(db_sync, tmp_
     assert result["projected"]["bytes_on_disk"] == 3500
 
 
-def test_project_artist_cascade_counts_posts_and_attachments(db_sync, tmp_path):
-    """The body-only artist: zero images, but posts and attachments that the
-    apply destroys. Previewing this as `images: 0` alone is what made a
-    content-only artist read as an empty one (#3067)."""
-    a = _make_artist(db_sync, slug="bodyonly")
-    p1 = Post(artist_id=a.id, external_post_id="bo-1", description="a body")
-    p2 = Post(artist_id=a.id, external_post_id="bo-2", description="another")
-    db_sync.add_all([p1, p2])
-    db_sync.flush()
-    db_sync.add(PostAttachment(
-        post_id=p1.id, artist_id=a.id, sha256="b0d1".ljust(64, "0"),
-        path="/store/b0d1/a.pdf", original_filename="a.pdf",
-        ext=".pdf", size_bytes=5,
-    ))
-    # artist_id NULL, reachable only through its post — the second arm of
-    # _artist_attachments_conditions.
-    db_sync.add(PostAttachment(
-        post_id=p2.id, artist_id=None, sha256="b0d2".ljust(64, "0"),
-        path="/store/b0d2/b.pdf", original_filename="b.pdf",
-        ext=".pdf", size_bytes=5,
-    ))
-    db_sync.commit()
-
-    projected = cleanup_service.project_artist_cascade(
-        db_sync, slug="bodyonly",
-    )["projected"]
-    assert projected["images"] == 0
-    assert projected["posts"] == 2
-    assert projected["attachments"] == 2
-
-
-def test_artist_cascade_preview_matches_apply(db_sync, tmp_path):
-    """Rule 93: the preview's numbers must be what the apply actually does.
-
-    Guards the drift directly rather than trusting that both halves happen to
-    use the same predicate — the preview and apply are asserted against each
-    other on one artist carrying all three row kinds.
-    """
-    a = _make_artist(db_sync, slug="parity")
-    for i in range(3):
-        f = tmp_path / f"par{i}.jpg"
-        f.write_bytes(b"x")
-        _make_image(
-            db_sync, artist=a, path=str(f), sha256=f"{i:064x}", size=10,
-        )
-    posts = [
-        Post(artist_id=a.id, external_post_id=f"par-{i}") for i in range(4)
-    ]
-    db_sync.add_all(posts)
-    db_sync.flush()
-    for i, p in enumerate(posts[:2]):
-        db_sync.add(PostAttachment(
-            post_id=p.id, artist_id=a.id, sha256=f"par{i}".ljust(64, "0"),
-            path=f"/store/par{i}/f.zip", original_filename="f.zip",
-            ext=".zip", size_bytes=9,
-        ))
-    db_sync.commit()
-    artist_id = a.id
-
-    projected = cleanup_service.project_artist_cascade(
-        db_sync, slug="parity",
-    )["projected"]
-    summary = cleanup_service.delete_artist_cascade(
-        db_sync, artist_id=artist_id, images_root=tmp_path,
-    )["summary"]
-
-    assert projected["images"] == summary["images_deleted"] == 3
-    assert projected["posts"] == summary["posts_deleted"] == 4
-    assert projected["attachments"] == summary["attachments_deleted"] == 2
-
-    # And the apply really did remove them — a matching pair of numbers is
-    # worth nothing if neither half touched the DB.
-    assert db_sync.execute(
-        select(func.count(Post.id)).where(Post.artist_id == artist_id)
-    ).scalar_one() == 0
-    assert db_sync.execute(
-        select(func.count(PostAttachment.id))
-        .where(PostAttachment.artist_id == artist_id)
-    ).scalar_one() == 0
-
-
 def test_project_artist_cascade_raises_on_unknown_slug(db_sync):
     with pytest.raises(LookupError):
         cleanup_service.project_artist_cascade(db_sync, slug="nope")
@@ -378,88 +294,6 @@ def test_delete_artist_cascade_idempotent_on_missing(db_sync, tmp_path):
     assert result["summary"]["images_deleted"] == 0
 
 
-def test_delete_artist_cascade_survives_same_sha_on_two_posts(db_sync, tmp_path):
-    """Same file attached to two of the artist's posts must not abort the delete.
-
-    Left to the cascade this raises: artist delete CASCADEs to Post, which SET
-    NULLs post_attachment.post_id, and `uq_post_attachment_null_post_sha`
-    (sha256 alone, WHERE post_id IS NULL) then rejects the second row. That's an
-    ordinary shape — _capture_attachment writes one row per post over one
-    sha-addressed blob by design. Also covers the NULL-artist_id arm of the
-    delete predicate: the second row has no artist_id, only a post that does.
-    """
-    a = _make_artist(db_sync, slug="casatt")
-    p1 = Post(artist_id=a.id, external_post_id="att-p1")
-    p2 = Post(artist_id=a.id, external_post_id="att-p2")
-    db_sync.add_all([p1, p2])
-    db_sync.flush()
-
-    shared_sha = "ca5a".ljust(64, "0")
-    db_sync.add(PostAttachment(
-        post_id=p1.id, artist_id=a.id, sha256=shared_sha,
-        path="/store/ca5a/bundle.zip", original_filename="bundle.zip",
-        ext=".zip", size_bytes=7,
-    ))
-    db_sync.add(PostAttachment(
-        post_id=p2.id, artist_id=None, sha256=shared_sha,
-        path="/store/ca5a/bundle.zip", original_filename="bundle.zip",
-        ext=".zip", size_bytes=7,
-    ))
-    db_sync.commit()
-    artist_id = a.id
-
-    result = cleanup_service.delete_artist_cascade(
-        db_sync, artist_id=artist_id, images_root=tmp_path,
-    )
-
-    assert result["summary"]["attachments_deleted"] == 2
-    assert db_sync.execute(
-        select(func.count(Artist.id)).where(Artist.id == artist_id)
-    ).scalar_one() == 0
-    assert db_sync.execute(
-        select(func.count(PostAttachment.id))
-        .where(PostAttachment.sha256 == shared_sha)
-    ).scalar_one() == 0
-
-
-def test_delete_artist_cascade_keeps_unrelated_null_post_attachment(
-    db_sync, tmp_path,
-):
-    """A filesystem-import row (post_id NULL) sharing the sha is the other way
-    this collides — and it must SURVIVE: it belongs to no artist, so the
-    cascade has no claim on it."""
-    a = _make_artist(db_sync, slug="casorph")
-    p = Post(artist_id=a.id, external_post_id="orph-p1")
-    db_sync.add(p)
-    db_sync.flush()
-
-    sha = "0rfa".ljust(64, "0")
-    standalone = PostAttachment(
-        post_id=None, artist_id=None, sha256=sha,
-        path="/store/0rfa/manual.pdf", original_filename="manual.pdf",
-        ext=".pdf", size_bytes=3,
-    )
-    db_sync.add(standalone)
-    db_sync.add(PostAttachment(
-        post_id=p.id, artist_id=a.id, sha256=sha,
-        path="/store/0rfa/manual.pdf", original_filename="manual.pdf",
-        ext=".pdf", size_bytes=3,
-    ))
-    db_sync.commit()
-    artist_id, standalone_id = a.id, standalone.id
-
-    result = cleanup_service.delete_artist_cascade(
-        db_sync, artist_id=artist_id, images_root=tmp_path,
-    )
-
-    assert result["summary"]["attachments_deleted"] == 1
-    surviving = db_sync.execute(
-        select(PostAttachment.id, PostAttachment.post_id)
-        .where(PostAttachment.sha256 == sha)
-    ).all()
-    assert surviving == [(standalone_id, None)]
-
-
 # --- delete_images --------------------------------------------------
 
 
@@ -1082,176 +916,3 @@ def test_reconcile_preserves_from_attachment_on_provenance_collision(db_sync, tm
         .where(ImageProvenance.image_record_id == img_id)
     ).all()
     assert rows == [(native_id, att_id)]
-
-
-# --- reclaim_orphaned_attachments -----------------------------------
-
-
-def _store_blob(root, sha, *, ext=".pdf", age_hours=48, data=b"blob"):
-    """Write a file into the sha-addressed attachment store, aged past the
-    min-age guard by default."""
-    d = root / "attachments" / sha[:3]
-    d.mkdir(parents=True, exist_ok=True)
-    p = d / f"{sha}{ext}"
-    p.write_bytes(data)
-    old = datetime.now(UTC).timestamp() - age_hours * 3600
-    os.utime(p, (old, old))
-    return p
-
-
-def _attachment(db_sync, *, sha, post=None, artist=None):
-    att = PostAttachment(
-        post_id=post.id if post else None,
-        artist_id=artist.id if artist else None,
-        sha256=sha, path=f"/store/{sha[:3]}/f.pdf",
-        original_filename="f.pdf", ext=".pdf", size_bytes=4,
-    )
-    db_sync.add(att)
-    db_sync.flush()
-    return att
-
-
-def test_reclaim_attachments_dry_run_projects_without_mutating(db_sync, tmp_path):
-    a = _make_artist(db_sync, slug="recl-dry")
-    p = Post(artist_id=a.id, external_post_id="rd-1")
-    db_sync.add(p)
-    db_sync.flush()
-    kept_sha, orphan_sha = "aa11".ljust(64, "0"), "bb22".ljust(64, "0")
-    _attachment(db_sync, sha=kept_sha, post=p, artist=a)
-    _attachment(db_sync, sha=orphan_sha)            # both FKs NULL → orphan
-    db_sync.commit()
-    kept_blob = _store_blob(tmp_path, kept_sha)
-    orphan_blob = _store_blob(tmp_path, orphan_sha)
-
-    result = cleanup_service.reclaim_orphaned_attachments(
-        db_sync, images_root=tmp_path, dry_run=True,
-    )
-    assert result["rows"] == 1
-    assert result["files"] == 1
-    assert result["bytes"] == orphan_blob.stat().st_size
-
-    # Nothing actually happened.
-    assert kept_blob.exists() and orphan_blob.exists()
-    assert db_sync.execute(
-        select(func.count(PostAttachment.id))
-    ).scalar_one() == 2
-
-
-def test_reclaim_attachments_apply_deletes_rows_and_unlinks_blobs(db_sync, tmp_path):
-    a = _make_artist(db_sync, slug="recl-apply")
-    p = Post(artist_id=a.id, external_post_id="ra-1")
-    db_sync.add(p)
-    db_sync.flush()
-    kept_sha, orphan_sha = "cc33".ljust(64, "0"), "dd44".ljust(64, "0")
-    _attachment(db_sync, sha=kept_sha, post=p, artist=a)
-    _attachment(db_sync, sha=orphan_sha)
-    db_sync.commit()
-    kept_blob = _store_blob(tmp_path, kept_sha)
-    orphan_blob = _store_blob(tmp_path, orphan_sha)
-
-    result = cleanup_service.reclaim_orphaned_attachments(
-        db_sync, images_root=tmp_path, dry_run=False,
-    )
-    assert result["rows"] == 1
-    assert result["files"] == 1
-
-    assert kept_blob.exists()          # still referenced
-    assert not orphan_blob.exists()    # nothing points at it any more
-    surviving = db_sync.execute(select(PostAttachment.sha256)).scalars().all()
-    assert surviving == [kept_sha]
-
-
-def test_reclaim_attachments_preview_matches_apply(db_sync, tmp_path):
-    """Rule 93 — the dry-run's numbers are what the apply does. The projection
-    has to negate the orphan predicate to be honest about blobs the delete is
-    about to free, so this is the assertion that catches getting that backwards.
-    """
-    orphan_sha = "ee55".ljust(64, "0")
-    _attachment(db_sync, sha=orphan_sha)
-    db_sync.commit()
-    _store_blob(tmp_path, orphan_sha)
-
-    projected = cleanup_service.reclaim_orphaned_attachments(
-        db_sync, images_root=tmp_path, dry_run=True,
-    )
-    applied = cleanup_service.reclaim_orphaned_attachments(
-        db_sync, images_root=tmp_path, dry_run=False,
-    )
-    for key in ("rows", "files", "bytes"):
-        assert projected[key] == applied[key], key
-    assert applied["rows"] == 1 and applied["files"] == 1
-
-
-def test_reclaim_attachments_keeps_shared_blob_while_any_row_remains(db_sync, tmp_path):
-    """The refcount case this whole sweep exists for: one sha-addressed blob
-    backs several rows, so deleting SOME of them must not free the file."""
-    a = _make_artist(db_sync, slug="recl-shared")
-    p = Post(artist_id=a.id, external_post_id="rs-1")
-    db_sync.add(p)
-    db_sync.flush()
-    sha = "ff66".ljust(64, "0")
-    _attachment(db_sync, sha=sha, post=p, artist=a)   # attributed — survives
-    _attachment(db_sync, sha=sha)                     # orphan — deleted
-    db_sync.commit()
-    blob = _store_blob(tmp_path, sha)
-
-    result = cleanup_service.reclaim_orphaned_attachments(
-        db_sync, images_root=tmp_path, dry_run=False,
-    )
-    assert result["rows"] == 1     # the orphan row went
-    assert result["files"] == 0    # the blob did NOT
-    assert blob.exists()
-
-
-def test_reclaim_attachments_spares_filesystem_import_rows(db_sync, tmp_path):
-    """post_id NULL with an artist_id is the deliberate filesystem-import shape
-    (importer._capture_attachment), not an orphan — it is still attributed."""
-    a = _make_artist(db_sync, slug="recl-fsimport")
-    sha = "1177".ljust(64, "0")
-    _attachment(db_sync, sha=sha, artist=a)    # post NULL, artist set
-    db_sync.commit()
-    blob = _store_blob(tmp_path, sha)
-
-    result = cleanup_service.reclaim_orphaned_attachments(
-        db_sync, images_root=tmp_path, dry_run=False,
-    )
-    assert result["rows"] == 0
-    assert result["files"] == 0
-    assert blob.exists()
-    assert db_sync.execute(
-        select(func.count(PostAttachment.id))
-    ).scalar_one() == 1
-
-
-def test_reclaim_attachments_skips_recent_and_staging_files(db_sync, tmp_path):
-    """A blob is written BEFORE its row commits, so a just-stored file with no
-    row is in-flight, not orphaned. `.partial` staging files belong to
-    cleanup_orphaned_temp_files and must be left alone either way."""
-    fresh_sha, staged_sha = "2288".ljust(64, "0"), "3399".ljust(64, "0")
-    fresh = _store_blob(tmp_path, fresh_sha, age_hours=0)
-    staged = _store_blob(tmp_path, staged_sha, ext=".pdf.partial")
-    db_sync.commit()
-
-    result = cleanup_service.reclaim_orphaned_attachments(
-        db_sync, images_root=tmp_path, dry_run=False,
-    )
-    assert result["files"] == 0
-    assert result["skipped_recent"] == 1
-    assert fresh.exists() and staged.exists()
-
-
-def test_reclaim_attachments_ignores_non_sha_named_files(db_sync, tmp_path):
-    """The walk must only judge files it can identify as store blobs — anything
-    else under the root is none of its business."""
-    d = tmp_path / "attachments" / "zzz"
-    d.mkdir(parents=True)
-    stray = d / "notes.txt"
-    stray.write_text("not a blob")
-    old = datetime.now(UTC).timestamp() - 48 * 3600
-    os.utime(stray, (old, old))
-
-    result = cleanup_service.reclaim_orphaned_attachments(
-        db_sync, images_root=tmp_path, dry_run=False,
-    )
-    assert result["files"] == 0
-    assert stray.exists()

tests/test_download_backends.py

@@ -19,7 +19,7 @@ def test_native_platforms():
 def test_gallery_dl_platforms_are_not_native():
     # The platforms still served by gallery-dl must NOT route to the native
     # ingester — guards an accidental over-broad migration.
-    for platform in ("hentaifoundry", "discord"):
+    for platform in ("hentaifoundry", "discord", "deviantart"):
         assert uses_native_ingester(platform) is False