Merge pull request 'UX fixes: suggestion-accept chip refresh, showcase endless feed, non-media downloads' (#48) from dev into main

attach_in_place mirrored only the media flow, so gallery-dl-downloaded
zips/PDFs/audio bounced back as `skipped+invalid_image`, which
download_service counted as an ingest error and flipped runs to
status="error" despite N successful image attaches. Lustria patreon
event #38998 (21 images + 1 OST zip) went red for exactly this reason.

Now attach_in_place dispatches the same way as import_one: archives →
_import_archive (extracts media members, captures archive as
PostAttachment), non-media → _capture_attachment. Download_service
accepts the new `attached` result and treats non-duplicate skips as
soft skips, not ingest errors.

Also: ShowcaseView always loadInitial() on mount, not just when the
store is empty — Pinia persists across navigations and operator wants
a fresh shuffle every time the showcase loads.

.forgejo/workflows/build.yml

@@ -242,20 +242,32 @@ jobs:
         id: tag
         run: |
           # Three trigger shapes:
-          #   refs/tags/v…   → tag-push: publish ONLY the immutable version
-          #                    tag (e.g. :v26.05.26.5). Don't touch :latest;
-          #                    that already got published by the main-push
-          #                    build for the merge commit.
-          #   refs/heads/main → push to main (incl. PR merge commits):
-          #                    publish :main + :latest (floating).
+          #   refs/tags/v…   → tag-push: opt-in milestone label (vYY.MM.DD,
+          #                    no `.N` per family release-posture rule).
+          #                    Publish ONLY the immutable version tag;
+          #                    don't touch :latest (the main-push build
+          #                    for the merge commit already did that).
+          #   refs/heads/main → push to main: publish :main + :latest
+          #                    (floating) AND :c-<short_sha> (immutable
+          #                    per-commit rollback substrate, per family
+          #                    release-posture rule "Tags are milestones,
+          #                    not gates — commit-SHA images are the
+          #                    rollback unit"). Rollback to any commit
+          #                    becomes `docker pull …:c-<sha>` without a
+          #                    release ceremony.
           #   anything else  → safety net; shouldn't fire given the `on:`
-          #                    config above (dev was dropped). Tag :dev to
-          #                    surface the unexpected run in the registry.
+          #                    config above. Tag :dev to surface the
+          #                    unexpected run in the registry.
+          # POSIX-safe substring (the runner shell is dash/BusyBox sh, not
+          # bash — `${var:0:7}` errors with "Bad substitution"; cut works
+          # everywhere). Operator-flagged 2026-06-01 after first :c-<sha>
+          # main-push build failed at this step.
+          SHORT_SHA=$(printf '%s' "$GITHUB_SHA" | cut -c1-7)
           if [ "${GITHUB_REF#refs/tags/}" != "${GITHUB_REF}" ]; then
             TAG_NAME="${GITHUB_REF#refs/tags/}"
             echo "tags=git.fabledsword.com/bvandeusen/fabledcurator:${TAG_NAME}" >> "$GITHUB_OUTPUT"
           elif [ "${GITHUB_REF##*/}" = "main" ]; then
-            echo "tags=git.fabledsword.com/bvandeusen/fabledcurator:main,git.fabledsword.com/bvandeusen/fabledcurator:latest" >> "$GITHUB_OUTPUT"
+            echo "tags=git.fabledsword.com/bvandeusen/fabledcurator:main,git.fabledsword.com/bvandeusen/fabledcurator:latest,git.fabledsword.com/bvandeusen/fabledcurator:c-${SHORT_SHA}" >> "$GITHUB_OUTPUT"
           else
             echo "tags=git.fabledsword.com/bvandeusen/fabledcurator:dev" >> "$GITHUB_OUTPUT"
           fi
@@ -286,13 +298,19 @@ jobs:
         id: tag
         run: |
           # Mirrors build-web's three-shape logic (tag-push / main-push /
-          # safety-net dev). The -ml image follows the same release cadence
-          # as the web image.
+          # safety-net dev) including the per-commit :c-<short_sha> tag
+          # on main-push per the family release-posture rule. The -ml
+          # image follows the same release cadence as the web image.
+          # POSIX-safe substring (the runner shell is dash/BusyBox sh, not
+          # bash — `${var:0:7}` errors with "Bad substitution"; cut works
+          # everywhere). Operator-flagged 2026-06-01 after first :c-<sha>
+          # main-push build failed at this step.
+          SHORT_SHA=$(printf '%s' "$GITHUB_SHA" | cut -c1-7)
           if [ "${GITHUB_REF#refs/tags/}" != "${GITHUB_REF}" ]; then
             TAG_NAME="${GITHUB_REF#refs/tags/}"
             echo "tags=git.fabledsword.com/bvandeusen/fabledcurator-ml:${TAG_NAME}" >> "$GITHUB_OUTPUT"
           elif [ "${GITHUB_REF##*/}" = "main" ]; then
-            echo "tags=git.fabledsword.com/bvandeusen/fabledcurator-ml:main,git.fabledsword.com/bvandeusen/fabledcurator-ml:latest" >> "$GITHUB_OUTPUT"
+            echo "tags=git.fabledsword.com/bvandeusen/fabledcurator-ml:main,git.fabledsword.com/bvandeusen/fabledcurator-ml:latest,git.fabledsword.com/bvandeusen/fabledcurator-ml:c-${SHORT_SHA}" >> "$GITHUB_OUTPUT"
           else
             echo "tags=git.fabledsword.com/bvandeusen/fabledcurator-ml:dev" >> "$GITHUB_OUTPUT"
           fi

.forgejo/workflows/ci.yml

@@ -1,7 +1,8 @@
 name: CI
 
 # CI lanes per FabledRulebook/forgejo.md "CI philosophy":
-#   - backend-lint-and-test: ruff + `pytest -m "not integration"`, no service containers.
+#   - lint: ruff only, no dep install — fast-fail for the common lint bounce.
+#   - backend-lint-and-test: `pytest -m "not integration"`, no service containers.
 #   - frontend-build: vitest unit + vite build.
 #   - integration: pgvector + redis service containers; alembic + `pytest -m integration`.
 
@@ -14,6 +15,20 @@ on:
   # (single-operator Forgejo repo) so push coverage is complete.
 
 jobs:
+  # Fast-fail lint lane. ruff is pre-installed in the ci-python image, so
+  # this runs with NO dependency install and surfaces the most common bounce
+  # class (lint: I001 / UP037 / ASYNC109 / W293 …) in seconds — instead of
+  # after the backend job's ~30-60s wheel install. ruff is static analysis,
+  # so no DB/secret env is needed.
+  lint:
+    runs-on: python-ci
+    container:
+      image: git.fabledsword.com/bvandeusen/ci-python:3.14
+    steps:
+      - uses: actions/checkout@v4
+      - name: Ruff lint
+        run: ruff check backend/ tests/ alembic/
+
   backend-lint-and-test:
     runs-on: python-ci
     container:
@@ -51,9 +66,8 @@ jobs:
             pip install -r requirements.txt pytest pytest-asyncio
           fi
 
-      - name: Ruff lint
-        run: ruff check backend/ tests/ alembic/
-
+      # Ruff moved to the dedicated fast `lint` job above (fails in seconds,
+      # no dep install). This job is now unit tests only.
       - name: Pytest (unit only — integration runs in the integration job)
         run: pytest tests/ -v -m "not integration"
 

alembic/versions/0027_drop_migration_run.py

@@ -0,0 +1,50 @@
+"""drop migration_run — one-and-done GS/IR migration tooling removed
+
+Revision ID: 0027
+Revises: 0026
+Create Date: 2026-05-29
+
+The GS/IR migration tooling (services/migrators, /api/migrate, the
+run_migration task, LegacyMigrationCard, and the MigrationRun model) was
+removed after the migration cutover completed. This drops its now-orphaned
+run-log table. Downgrade recreates the table (mirrors the old model) so the
+migration is reversible.
+"""
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.dialects.postgresql import JSONB
+
+revision: str = "0027"
+down_revision: Union[str, None] = "0026"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.drop_table("migration_run")
+
+
+def downgrade() -> None:
+    op.create_table(
+        "migration_run",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column("kind", sa.String(length=32), nullable=False),
+        sa.Column("status", sa.String(length=32), nullable=False),
+        sa.Column("dry_run", sa.Boolean(), nullable=False, server_default=sa.false()),
+        sa.Column(
+            "started_at", sa.DateTime(timezone=True), nullable=False,
+            server_default=sa.func.now(),
+        ),
+        sa.Column("finished_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column(
+            "counts", JSONB(), nullable=False, server_default=sa.text("'{}'::jsonb"),
+        ),
+        sa.Column("error", sa.Text(), nullable=True),
+        sa.Column(
+            "metadata", JSONB(), nullable=False, server_default=sa.text("'{}'::jsonb"),
+        ),
+    )
+    op.create_index("ix_migration_run_kind", "migration_run", ["kind"])
+    op.create_index("ix_migration_run_status", "migration_run", ["status"])

alembic/versions/0028_collapse_sidecar_synthetics_into_real_sources.py

@@ -0,0 +1,190 @@
+"""collapse-sidecar-synthetic: repoint Posts/ImageProvenance/DownloadEvents
+from `sidecar:<platform>:<slug>` synthetic Source anchors onto the real
+Source for the same (artist, platform) when one exists, then delete the
+synthetic.
+
+Revision ID: 0028
+Revises: 0027
+Create Date: 2026-05-31
+
+Background: alembic 0022 (2026-05-26) consolidated the old per-post-URL
+Source rows into one canonical Source per (artist, platform). When NO
+real campaign URL was salvageable among the candidates, it rewrote the
+canonical row to url='sidecar:<platform>:<slug>' enabled=false as a
+disabled anchor for any Posts already attached.
+
+That was fine while it was the only Source for that artist+platform.
+But: the unique constraint on Source is (artist_id, platform, url), not
+(artist_id, platform). When the operator later added the real
+subscription via the UI / extension / etc., a SECOND row landed —
+the real one — with id > the synthetic. Both coexisted.
+
+Two follow-on problems surfaced 2026-05-31:
+
+  1. The Subscriptions UI listed both rows. The synthetic was disabled
+     so the scheduler never polled it, but it looked like a phantom
+     subscription. (Fixed in same commit by SourceService.list filter.)
+  2. importer._source_for_sidecar picked Source by `ORDER BY id ASC
+     LIMIT 1`, so EVERY gallery-dl download since the real Source was
+     added attached its Post to the SYNTHETIC anchor, not the real
+     Source. (Fixed in same commit by preferring non-sidecar URLs.)
+
+This migration is the data half of the cleanup: for every (artist,
+platform) with both a synthetic AND a real Source, repoint the
+synthetic's children (Posts, ImageProvenance, DownloadEvents) onto the
+real Source and delete the synthetic. Reuses the same epid/provenance
+collision dance from alembic 0022 because the same uniqueness
+constraints fire row-by-row during bulk UPDATEs.
+
+Lone synthetic anchors — those where no real Source for the same
+(artist, platform) exists (e.g., filesystem-imported artist with no
+subscription added) — are LEFT INTACT. They anchor real imported
+content; deleting them would CASCADE-delete the Posts the operator
+imported. The SourceService.list filter hides them from the UI; the
+operator can delete them by hand if they want the underlying imports
+gone.
+"""
+from typing import Sequence, Union
+
+from alembic import op
+from sqlalchemy import text
+
+revision: str = "0028"
+down_revision: Union[str, None] = "0027"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    conn = op.get_bind()
+
+    # Find (artist_id, platform) groups where BOTH a sidecar synthetic
+    # and at least one real Source exist.
+    groups = conn.execute(text("""
+        SELECT artist_id, platform
+        FROM source
+        GROUP BY artist_id, platform
+        HAVING bool_or(url LIKE 'sidecar:%')
+           AND bool_or(url NOT LIKE 'sidecar:%')
+    """)).fetchall()
+
+    for artist_id, platform in groups:
+        rows = conn.execute(
+            text("""
+                SELECT id, url FROM source
+                WHERE artist_id = :a AND platform = :p
+                ORDER BY id ASC
+            """),
+            {"a": artist_id, "p": platform},
+        ).fetchall()
+
+        synthetic_ids = [sid for sid, url in rows if url.startswith("sidecar:")]
+        real_rows = [(sid, url) for sid, url in rows if not url.startswith("sidecar:")]
+        if not synthetic_ids or not real_rows:
+            continue  # belt+suspenders; the GROUP BY already filtered
+
+        # Canonical real: lowest-id non-sidecar Source.
+        canonical_id = real_rows[0][0]
+
+        # STEP A: PRE-merge Post collisions on (canonical, external_post_id).
+        # Mirror alembic 0022's pre-merge logic — when synth has Post X
+        # epid=N and real has Post Y epid=N, the bulk UPDATE below would
+        # trip uq_post_source_external_id row-by-row. Group all Posts
+        # under (canonical + synthetics) by epid; for any group >1,
+        # pick a keep (prefer one already under canonical, else lowest
+        # id) and merge the rest into it.
+        all_posts = conn.execute(
+            text("""
+                SELECT external_post_id, id, source_id
+                FROM post
+                WHERE source_id = :canonical OR source_id = ANY(:synths)
+                ORDER BY external_post_id, id
+            """),
+            {"canonical": canonical_id, "synths": synthetic_ids},
+        ).fetchall()
+        by_epid: dict = {}
+        for epid, post_id, src_id in all_posts:
+            by_epid.setdefault(epid, []).append((post_id, src_id))
+        for _epid, posts in by_epid.items():
+            if len(posts) <= 1:
+                continue
+            canonical_side = [p for p in posts if p[1] == canonical_id]
+            keep_id = canonical_side[0][0] if canonical_side else posts[0][0]
+            drop_ids = [p[0] for p in posts if p[0] != keep_id]
+            for drop_id in drop_ids:
+                # Pre-delete image_provenance rows under drop_ whose
+                # image_record_id already has provenance under keep —
+                # avoids tripping uq_image_provenance_image_post (0021)
+                # row-by-row during the repoint UPDATE.
+                conn.execute(
+                    text("""
+                        DELETE FROM image_provenance
+                        WHERE post_id = :drop_
+                          AND image_record_id IN (
+                              SELECT image_record_id FROM image_provenance
+                              WHERE post_id = :keep
+                          )
+                    """),
+                    {"keep": keep_id, "drop_": drop_id},
+                )
+                conn.execute(
+                    text("""
+                        UPDATE image_provenance SET post_id = :keep
+                        WHERE post_id = :drop_
+                    """),
+                    {"keep": keep_id, "drop_": drop_id},
+                )
+                conn.execute(
+                    text("""
+                        UPDATE image_record SET primary_post_id = :keep
+                        WHERE primary_post_id = :drop_
+                    """),
+                    {"keep": keep_id, "drop_": drop_id},
+                )
+                conn.execute(
+                    text("DELETE FROM post WHERE id = :drop_"),
+                    {"drop_": drop_id},
+                )
+
+        # STEP B: Bulk reparent the remaining Posts off the synthetics.
+        conn.execute(
+            text("""
+                UPDATE post SET source_id = :canonical
+                WHERE source_id = ANY(:synths)
+            """),
+            {"canonical": canonical_id, "synths": synthetic_ids},
+        )
+
+        # STEP C: Reparent ImageProvenance.source_id (denormalized FK;
+        # no UNIQUE on source_id, safe bulk).
+        conn.execute(
+            text("""
+                UPDATE image_provenance SET source_id = :canonical
+                WHERE source_id = ANY(:synths)
+            """),
+            {"canonical": canonical_id, "synths": synthetic_ids},
+        )
+
+        # STEP D: Reparent any DownloadEvent.source_id. Synthetics are
+        # enabled=false so the scheduler never created events for them;
+        # this is belt+suspenders for any rows planted by manual force
+        # or older code paths.
+        conn.execute(
+            text("""
+                UPDATE download_event SET source_id = :canonical
+                WHERE source_id = ANY(:synths)
+            """),
+            {"canonical": canonical_id, "synths": synthetic_ids},
+        )
+
+        # STEP E: Drop the now-empty synthetics.
+        conn.execute(
+            text("DELETE FROM source WHERE id = ANY(:synths)"),
+            {"synths": synthetic_ids},
+        )
+
+
+def downgrade() -> None:
+    # Lossy migration — synthetic Sources deleted, Posts repointed and
+    # potentially merged. No safe downgrade.
+    pass

alembic/versions/0029_drop_artist_copyright_ml_thresholds.py

@@ -0,0 +1,71 @@
+"""drop artist + copyright ml thresholds; lower general default to 0.50
+
+Revision ID: 0029
+Revises: 0028
+Create Date: 2026-06-01
+
+Operator-flagged 2026-06-01: the view modal's Suggestions panel hides
+most general-category predictions because the default threshold is
+0.95. Lowering the default to 0.50 (matches character) so general
+suggestions surface more aggressively; the value remains tunable in
+Settings → ML.
+
+Same change retires two ML suggestion categories whose Tag.kind
+surfaces are unused:
+
+- `artist`: retired in FC-2d-vii-c — artist identity is acquisition-
+  derived (image_record.artist_id), never ML-inferred. The threshold
+  column was a leftover from before that retirement.
+- `copyright`: retired 2026-06-01 — the app uses `fandom` for the
+  franchise/copyright concept (per TagsView.vue's doc comment); no
+  Tag rows of kind=copyright exist, and the threshold column never
+  fed anything user-visible.
+
+Both columns are dropped from ml_settings; the existing row's
+suggestion_threshold_general value is bumped from 0.95 to 0.50 iff
+it's still at the old default, so deployed installs pick up the new
+UX without overriding any operator tuning.
+"""
+from typing import Sequence, Union
+
+from alembic import op
+from sqlalchemy import text
+
+revision: str = "0029"
+down_revision: Union[str, None] = "0028"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # Bump the general threshold for installs still at the old default.
+    op.execute(text(
+        "UPDATE ml_settings "
+        "SET suggestion_threshold_general = 0.50 "
+        "WHERE id = 1 AND suggestion_threshold_general = 0.95"
+    ))
+    op.drop_column("ml_settings", "suggestion_threshold_artist")
+    op.drop_column("ml_settings", "suggestion_threshold_copyright")
+
+
+def downgrade() -> None:
+    # Restore the columns with their prior defaults. The bump from
+    # 0.95 → 0.50 isn't reversible without remembering whether the
+    # operator had explicitly set 0.95 (unlikely — that was just the
+    # default) so we leave the current general value as-is.
+    from sqlalchemy import Column, Float
+
+    op.add_column(
+        "ml_settings",
+        Column(
+            "suggestion_threshold_artist",
+            Float, nullable=False, server_default="0.30",
+        ),
+    )
+    op.add_column(
+        "ml_settings",
+        Column(
+            "suggestion_threshold_copyright",
+            Float, nullable=False, server_default="0.50",
+        ),
+    )

alembic/versions/0030_nullable_post_source_id_denorm_artist_id.py

@@ -0,0 +1,145 @@
+"""nullable post.source_id + denormalized post.artist_id; retire sidecar synthetics
+
+Revision ID: 0030
+Revises: 0029
+Create Date: 2026-06-01
+
+Operator-asked 2026-06-01 after the Dymkens orphan investigation: the
+sidecar synthetic Source pattern (`sidecar:<platform>:<slug>` rows
+with enabled=false) was technically correct but misled the operator
+into thinking they had phantom subscriptions. The synthetics existed
+solely to satisfy `Post.source_id NOT NULL` for filesystem-imported
+content with no real subscription.
+
+This migration makes the data model honest:
+
+1. **Post gets a denormalized `artist_id` column** so artist filters
+   work without traversing `Post → Source.artist_id`. Backfilled from
+   the existing Source linkage, then NOT NULL'd.
+2. **`Post.source_id` becomes nullable**, FK ondelete `CASCADE` → `SET
+   NULL`. Deleting a Source detaches its Posts instead of destroying
+   imported content (semantically: subscription ends, archive stays).
+3. **`ImageProvenance.source_id` becomes nullable** with the same FK
+   semantic change.
+4. **Sidecar synthetic Sources are deleted** — first NULL out the
+   FKs from Post + ImageProvenance pointing at them (so the implicit
+   CASCADE doesn't fire), then delete. DownloadEvent FK is unchanged
+   (still CASCADE'd, NOT NULL'd) — synthetics have `enabled=false`
+   so no events exist for them.
+
+Uniqueness handling: the existing `uq_post_source_external_id`
+(source_id, external_post_id) keeps working for source-bound Posts
+(Postgres treats NULL != NULL so NULL-source rows aren't deduped by
+it). A second partial unique index covers the NULL-source case on
+(artist_id, external_post_id) so filesystem-imported posts still
+dedupe within an artist.
+"""
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy import text
+
+revision: str = "0030"
+down_revision: Union[str, None] = "0029"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    conn = op.get_bind()
+
+    # Step 1: add Post.artist_id, initially nullable for backfill.
+    # FK naming follows the Base.metadata naming_convention
+    # (fk_<table>_<column>_<referred_table>) — alembic 0001 set this up.
+    op.add_column(
+        "post",
+        sa.Column("artist_id", sa.Integer, nullable=True),
+    )
+    op.create_foreign_key(
+        "fk_post_artist_id_artist", "post", "artist",
+        ["artist_id"], ["id"], ondelete="CASCADE",
+    )
+
+    # Step 2: backfill from Source.artist_id (every existing Post has a
+    # Source today, so every row gets populated).
+    conn.execute(text("""
+        UPDATE post p
+        SET artist_id = s.artist_id
+        FROM source s
+        WHERE p.source_id = s.id AND p.artist_id IS NULL
+    """))
+
+    # Sanity: count any remaining NULLs. Should be zero pre-this-migration.
+    remaining = conn.execute(text(
+        "SELECT COUNT(*) FROM post WHERE artist_id IS NULL"
+    )).scalar_one()
+    if remaining:
+        raise RuntimeError(
+            f"alembic 0030: {remaining} post rows have no resolvable "
+            f"artist_id after backfill. Investigate before continuing."
+        )
+
+    # Step 3: enforce NOT NULL + add index for artist-filter queries.
+    op.alter_column("post", "artist_id", nullable=False)
+    op.create_index("ix_post_artist_id", "post", ["artist_id"])
+
+    # Step 4: relax post.source_id + flip FK to SET NULL. The original FK
+    # name from alembic 0001 is `fk_post_source_id_source` per the
+    # NAMING_CONVENTION in models/base.py.
+    op.alter_column("post", "source_id", nullable=True)
+    op.drop_constraint("fk_post_source_id_source", "post", type_="foreignkey")
+    op.create_foreign_key(
+        "fk_post_source_id_source", "post", "source",
+        ["source_id"], ["id"], ondelete="SET NULL",
+    )
+
+    # Step 5: relax image_provenance.source_id + flip FK to SET NULL.
+    op.alter_column("image_provenance", "source_id", nullable=True)
+    op.drop_constraint(
+        "fk_image_provenance_source_id_source", "image_provenance",
+        type_="foreignkey",
+    )
+    op.create_foreign_key(
+        "fk_image_provenance_source_id_source", "image_provenance", "source",
+        ["source_id"], ["id"], ondelete="SET NULL",
+    )
+
+    # Step 6: partial unique index on (artist_id, external_post_id) for
+    # NULL-source Posts. The existing uq_post_source_external_id keeps
+    # guarding source-bound rows; NULL-source rows now dedupe within
+    # an artist.
+    op.execute(
+        "CREATE UNIQUE INDEX uq_post_artist_external_id_null_source "
+        "ON post (artist_id, external_post_id) "
+        "WHERE source_id IS NULL"
+    )
+
+    # Step 7: retire sidecar synthetic Sources. NULL out the references
+    # FIRST (the new FK is SET NULL so CASCADE wouldn't fire anyway, but
+    # being explicit makes the intent clear). Then delete the synthetic
+    # source rows. Any DownloadEvent rows under synthetics CASCADE-die
+    # with the source — synthetics have enabled=false so there shouldn't
+    # be any in practice.
+    conn.execute(text("""
+        UPDATE post
+        SET source_id = NULL
+        WHERE source_id IN (SELECT id FROM source WHERE url LIKE 'sidecar:%')
+    """))
+    conn.execute(text("""
+        UPDATE image_provenance
+        SET source_id = NULL
+        WHERE source_id IN (SELECT id FROM source WHERE url LIKE 'sidecar:%')
+    """))
+    deleted = conn.execute(text(
+        "DELETE FROM source WHERE url LIKE 'sidecar:%' RETURNING id"
+    )).rowcount
+    print(f"alembic 0030: deleted {deleted} sidecar synthetic source rows")
+
+
+def downgrade() -> None:
+    # Lossy migration — the deleted sidecar synthetics can't be
+    # restored from the orphan post.source_id / image_provenance.source_id
+    # values, and the partial unique index encodes a constraint that
+    # NULL-source Posts may now exist. No safe downgrade.
+    pass

alembic/versions/0031_source_backfill_runs_remaining.py

@@ -0,0 +1,45 @@
+"""source.backfill_runs_remaining: sticky deep-scan mode
+
+Revision ID: 0031
+Revises: 0030
+Create Date: 2026-06-01
+
+Tick vs backfill mode for subscription downloads. When
+`backfill_runs_remaining > 0`, the next N download runs use
+`skip: True` + 30-min timeout (walk full history). When 0, runs use
+`skip: "exit:20"` + 14.5-min timeout (catch-up mode, exits early once
+20 contiguous archived items are seen).
+
+Operator-flagged 2026-06-01 (Knuxy run #38887): a creator with ~550
+archived posts saturates the 870s catch-up timeout even when there is
+no new content, because gallery-dl's default `skip: True` keeps walking.
+Tick mode short-circuits that; backfill mode is the explicit opt-in for
+deep history scans.
+
+Default 0 (all existing subscriptions start in tick mode).
+"""
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+
+revision: str = "0031"
+down_revision: Union[str, None] = "0030"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        "source",
+        sa.Column(
+            "backfill_runs_remaining",
+            sa.Integer,
+            nullable=False,
+            server_default="0",
+        ),
+    )
+
+
+def downgrade() -> None:
+    op.drop_column("source", "backfill_runs_remaining")

backend/app/__init__.py

@@ -33,12 +33,6 @@ def create_app() -> Quart:
 
     app = Quart(__name__)
     app.secret_key = cfg.secret_key
-    # FC-5: legacy IR ingest JSON can run to tens of MB (hundreds of
-    # thousands of image_tag_associations). Werkzeug's default form
-    # memory cap is 500KB; raise both ceilings so the multipart upload
-    # for /api/migrate/ir_ingest doesn't 413.
-    app.config["MAX_CONTENT_LENGTH"] = 1024 * 1024 * 1024   # 1 GB
-    app.config["MAX_FORM_MEMORY_SIZE"] = 1024 * 1024 * 1024  # 1 GB
 
     for bp in all_blueprints():
         app.register_blueprint(bp)

backend/app/api/__init__.py

@@ -26,7 +26,6 @@ def all_blueprints() -> list[Blueprint]:
     from .extension import extension_bp
     from .gallery import gallery_bp
     from .import_admin import import_admin_bp
-    from .migrate import migrate_bp
     from .ml_admin import ml_admin_bp
     from .platforms import platforms_bp
     from .posts import posts_bp
@@ -54,7 +53,6 @@ def all_blueprints() -> list[Blueprint]:
         admin_bp,
         cleanup_bp,
         import_admin_bp,
-        migrate_bp,
         suggestions_bp,
         allowlist_bp,
         aliases_bp,

backend/app/api/_responses.py

@@ -0,0 +1,16 @@
+"""Shared API response helpers."""
+
+from quart import jsonify
+
+
+def error_response(
+    error: str, *, status: int = 400, detail: str | None = None, **extra,
+):
+    """JSON error body + HTTP status. `detail` is included only when given;
+    `extra` keys are merged into the body. Returns the (response, status)
+    tuple Quart expects. Imported as `_bad` by the blueprints."""
+    body = {"error": error}
+    if detail is not None:
+        body["detail"] = detail
+    body.update(extra)
+    return jsonify(body), status

backend/app/api/admin.py

@@ -6,6 +6,7 @@ Five action surfaces:
   DELETE /api/admin/tags/<int:tag_id>              (Tier B)
   POST   /api/admin/tags/<int:dest_id>/merge       (Tier B)
   POST   /api/admin/tags/prune-unused              (Tier A)
+  POST   /api/admin/tags/purge-legacy              (Tier A)
   GET    /api/admin/tags/<int:tag_id>/usage-count  (helper)
 
 Tier-C ops take a dry_run body flag (returns projection inline,
@@ -23,16 +24,11 @@ from sqlalchemy import select
 from ..extensions import get_session
 from ..models import Artist
 from ..services.cleanup_service import project_artist_cascade, project_bulk_image_delete
+from ._responses import error_response as _bad
 
 admin_bp = Blueprint("admin", __name__, url_prefix="/api/admin")
 
 
-def _bad(error: str, *, status: int = 400, **extra):
-    body = {"error": error}
-    body.update(extra)
-    return jsonify(body), status
-
-
 def _bulk_image_confirm_token(image_ids: list[int]) -> str:
     """Stable 8-hex token derived from the sorted id list. Mutates
     when the selection changes; stays the same across modal opens of
@@ -206,3 +202,23 @@ async def tags_prune_unused():
             )
         )
     return jsonify(result)
+
+
+@admin_bp.route("/tags/purge-legacy", methods=["POST"])
+async def tags_purge_legacy():
+    """Tier-A: delete legacy IR-migration tags — archive/post/artist
+    kinds (e.g. `BlenderKnight:Hannah_BJ_Loops`) PLUS general tags with
+    a legacy name prefix (`source:*`, from IR's source kind that fell
+    back to general). dry-run preview returns per-kind + per-prefix
+    counts + a sample so the UI shows exactly what'll go before the
+    operator confirms with dry_run=false."""
+    from ..services.cleanup_service import purge_legacy_tags
+
+    body = await request.get_json(silent=True) or {}
+    dry_run = bool(body.get("dry_run", False))
+
+    async with get_session() as session:
+        result = await session.run_sync(
+            lambda sync_sess: purge_legacy_tags(sync_sess, dry_run=dry_run)
+        )
+    return jsonify(result)

backend/app/api/cleanup.py

@@ -31,18 +31,13 @@ from sqlalchemy import select
 from ..extensions import get_session
 from ..models import LibraryAuditRun
 from ..services import cleanup_service
+from ._responses import error_response as _bad
 
 cleanup_bp = Blueprint("cleanup", __name__, url_prefix="/api/cleanup")
 
 IMAGES_ROOT = Path("/images")
 
 
-def _bad(error: str, *, status: int = 400, **extra):
-    body = {"error": error}
-    body.update(extra)
-    return jsonify(body), status
-
-
 def _min_dim_token(min_w: int, min_h: int) -> str:
     # SHA-256 (not MD5) — Web Crypto's subtle.digest rejects MD5; both
     # sides use SHA-256 truncated to 8 hex chars.

backend/app/api/credentials.py

@@ -20,6 +20,7 @@ from ..services.credential_service import (
     UnknownPlatformError,
     WrongAuthTypeError,
 )
+from ._responses import error_response as _bad
 
 credentials_bp = Blueprint("credentials", __name__, url_prefix="/api/credentials")
 
@@ -38,14 +39,6 @@ def _get_crypto() -> CredentialCrypto:
     return _crypto
 
 
-def _bad(error: str, *, status: int = 400, detail: str | None = None, **extra):
-    body = {"error": error}
-    if detail is not None:
-        body["detail"] = detail
-    body.update(extra)
-    return jsonify(body), status
-
-
 async def _ext_key_ok(session) -> bool:
     """If X-Extension-Key is supplied, it must match the stored value.
     Missing header → True (browser path; accepted per homelab posture).
@@ -124,3 +117,56 @@ async def delete_credential(platform: str):
         except LookupError:
             return _bad("not_found", status=404)
     return "", 204
+
+
+@credentials_bp.route("/<platform>/verify", methods=["POST"])
+async def verify_credential(platform: str):
+    """Test the stored credential by running gallery-dl --simulate
+    against one of the platform's enabled sources. On success stamps
+    last_verified. Returns {valid: bool|null, reason, last_verified?}.
+    valid=null means "couldn't test" (no credential, or no enabled
+    source to point at)."""
+    from ..models import Artist, Source
+    from ..services.gallery_dl import GalleryDLService, SourceConfig
+
+    async with get_session() as session:
+        if not await _ext_key_ok(session):
+            return _bad("unauthorized", status=401)
+        svc = CredentialService(session, _get_crypto())
+        record = await svc.get(platform)
+        if record is None:
+            return jsonify({"valid": None, "reason": "No credential stored for this platform."})
+
+        # Pick an enabled source for this platform to point the probe at.
+        row = (await session.execute(
+            select(Source, Artist)
+            .join(Artist, Artist.id == Source.artist_id)
+            .where(Source.platform == platform, Source.enabled.is_(True))
+            .order_by(Source.id.asc())
+        )).first()
+        if row is None:
+            return jsonify({
+                "valid": None,
+                "reason": "No enabled source for this platform to verify against — add a subscription first.",
+            })
+        source, artist = row
+
+        cookies_path = await svc.get_cookies_path(platform)
+        auth_token = await svc.get_token(platform)
+
+    gdl = GalleryDLService(images_root=Path("/images"))
+    ok, message = await gdl.verify(
+        url=source.url,
+        artist_slug=artist.slug,
+        platform=platform,
+        source_config=SourceConfig.from_dict(source.config_overrides or {}),
+        cookies_path=str(cookies_path) if cookies_path else None,
+        auth_token=auth_token,
+    )
+
+    last_verified = None
+    if ok:
+        async with get_session() as session:
+            ts = await CredentialService(session, _get_crypto()).mark_verified(platform)
+            last_verified = ts.isoformat() if ts else None
+    return jsonify({"valid": ok, "reason": message, "last_verified": last_verified})

backend/app/api/downloads.py

@@ -126,6 +126,54 @@ async def downloads_stats():
     return jsonify(out)
 
 
+@downloads_bp.route("/activity", methods=["GET"])
+async def downloads_activity():
+    """Hourly download-event counts over the last `?hours=` (default 24).
+
+    Returns a fixed-length, oldest-first bucket array so the UI can render
+    a sparkline directly. Bucketing is done in Python against UTC to dodge
+    session-timezone ambiguity in SQL date_trunc.
+    """
+    try:
+        hours = int(request.args.get("hours", "24"))
+    except ValueError:
+        return jsonify({"error": "invalid_hours"}), 400
+    hours = max(1, min(168, hours))
+
+    now = datetime.now(UTC)
+    end = now.replace(minute=0, second=0, microsecond=0)
+    start = end - timedelta(hours=hours - 1)
+    buckets = [
+        {"hour": (start + timedelta(hours=i)).isoformat(),
+         "ok": 0, "error": 0, "other": 0, "total": 0}
+        for i in range(hours)
+    ]
+
+    async with get_session() as session:
+        rows = (await session.execute(
+            select(DownloadEvent.started_at, DownloadEvent.status)
+            .where(DownloadEvent.started_at >= start)
+        )).all()
+
+    for started_at, status in rows:
+        if started_at is None:
+            continue
+        sa = started_at if started_at.tzinfo else started_at.replace(tzinfo=UTC)
+        idx = int((sa - start).total_seconds() // 3600)
+        if not (0 <= idx < hours):
+            continue
+        b = buckets[idx]
+        if status == "ok":
+            b["ok"] += 1
+        elif status == "error":
+            b["error"] += 1
+        else:
+            b["other"] += 1
+        b["total"] += 1
+
+    return jsonify({"hours": hours, "buckets": buckets})
+
+
 @downloads_bp.route("/<int:event_id>", methods=["GET"])
 async def get_download(event_id: int):
     async with get_session() as session:
@@ -139,3 +187,20 @@ async def get_download(event_id: int):
             return jsonify({"error": "not_found"}), 404
         event, source, artist = row
     return jsonify(_detail_record(event, source, artist))
+
+
+@downloads_bp.route("/recover-stalled", methods=["POST"])
+async def recover_stalled():
+    """Trigger the recover_stalled_download_events sweep on demand.
+
+    The same sweep runs every 5 min via Beat (see celery_app.beat_schedule);
+    this endpoint exists so the operator can force-clear stuck pending/
+    running download_events from the Subscriptions → Downloads maintenance
+    menu without waiting for the next scheduled tick.
+    """
+    # Local import: avoids registering maintenance tasks during blueprint
+    # import (Celery task discovery races with the API import otherwise).
+    from ..tasks.maintenance import recover_stalled_download_events
+
+    recover_stalled_download_events.delay()
+    return jsonify({"queued": True}), 202

backend/app/api/extension.py

@@ -20,6 +20,7 @@ from ..services.extension_service import (
     UnknownPlatformError,
 )
 from ..services.source_service import KNOWN_PLATFORMS
+from ._responses import error_response as _bad
 
 extension_bp = Blueprint("extension", __name__, url_prefix="/api/extension")
 
@@ -30,12 +31,6 @@ XPI_DIR = Path("/app/frontend/dist/extension")
 _XPI_VERSION_RE = re.compile(r"fabledcurator-(?P<version>[\w.-]+)\.xpi$")
 
 
-def _bad(error: str, *, status: int = 400, **extra):
-    body = {"error": error}
-    body.update(extra)
-    return jsonify(body), status
-
-
 async def _ext_key_required(session) -> bool:
     """Unlike /api/credentials (which accepts the browser path with no
     header), quick-add-source writes server state and must be explicitly
@@ -62,6 +57,24 @@ def _sha256(path: Path) -> str:
     return h.hexdigest()
 
 
+@extension_bp.route("/probe", methods=["GET"])
+async def probe_source():
+    """Read-only resolution of a creator-page URL: tells the extension
+    whether this URL is already a Source, is for an Artist that exists
+    but with a different URL, is brand new, or doesn't match any known
+    platform pattern. Drives the content-script chip's color/copy
+    BEFORE the operator clicks, so the button can show 'already added'
+    without requiring an add-attempt."""
+    url = (request.args.get("url") or "").strip()
+    if not url:
+        return _bad("invalid_body", detail="url query parameter is required")
+    async with get_session() as session:
+        if not await _ext_key_required(session):
+            return _bad("unauthorized", status=401)
+        result = await ExtensionService(session).probe(url)
+    return jsonify(result)
+
+
 @extension_bp.route("/quick-add-source", methods=["POST"])
 async def quick_add_source():
     body = await request.get_json(silent=True)

backend/app/api/import_admin.py

@@ -159,9 +159,7 @@ def _refetch_task_sync(session, task_id: int) -> dict:
         return {"status": "not_found"}
     if task.status != "failed":
         return {"status": "not_failed"}
-    settings = session.execute(
-        select(ImportSettings).where(ImportSettings.id == 1)
-    ).scalar_one()
+    settings = ImportSettings.load_sync(session)
     return attempt_refetch(session, task, Path(settings.import_scan_path))
 
 

backend/app/api/migrate.py

@@ -1,112 +0,0 @@
-"""FC-5: /api/migrate — trigger and poll migration runs.
-
-Ingest kinds (gs_ingest, ir_ingest) accept multipart/form-data with an
-`export_file` field. All other kinds accept JSON. Backup + rollback
-were retired in FC-3h (2026-05-24); use /api/system/backup/* instead.
-"""
-
-import json
-
-from quart import Blueprint, jsonify, request
-from sqlalchemy import select
-
-from ..extensions import get_session
-from ..models import MigrationRun
-from ..tasks.migration import run_migration
-
-migrate_bp = Blueprint("migrate", __name__, url_prefix="/api/migrate")
-
-# 'backup' + 'rollback' retired 2026-05-24 (FC-3h); see /api/system/backup/*.
-_VALID_KINDS = frozenset({
-    "gs_ingest", "ir_ingest", "tag_apply",
-    "ml_queue", "verify", "cleanup",
-})
-_INGEST_KINDS = frozenset({"gs_ingest", "ir_ingest"})
-
-
-def _bad(error: str, *, status: int = 400, **extra):
-    body = {"error": error}
-    body.update(extra)
-    return jsonify(body), status
-
-
-def _run_to_dict(run: MigrationRun) -> dict:
-    return {
-        "id": run.id,
-        "kind": run.kind,
-        "status": run.status,
-        "dry_run": run.dry_run,
-        "started_at": run.started_at.isoformat(),
-        "finished_at": run.finished_at.isoformat() if run.finished_at else None,
-        "counts": run.counts or {},
-        "error": run.error,
-        "metadata": run.metadata_ or {},
-    }
-
-
-@migrate_bp.route("/<kind>", methods=["POST"])
-async def create_run(kind: str):
-    if kind not in _VALID_KINDS:
-        return _bad("unknown_kind", detail=f"kind must be one of {sorted(_VALID_KINDS)}")
-
-    # Ingest kinds accept multipart/form-data; everything else takes JSON.
-    if kind in _INGEST_KINDS:
-        form = await request.form
-        files = await request.files
-        if "export_file" not in files:
-            return _bad("missing_export_file", detail="multipart export_file required")
-        export_file = files["export_file"]
-        try:
-            raw = export_file.read()
-            data = json.loads(raw.decode("utf-8"))
-        except (UnicodeDecodeError, json.JSONDecodeError) as exc:
-            return _bad("invalid_export_file", detail=str(exc))
-        dry_run = str(form.get("dry_run", "false")).lower() in ("true", "1", "yes")
-        params: dict = {"data": data, "dry_run": dry_run}
-    else:
-        body = await request.get_json()
-        if body is None:
-            body = {}
-        if not isinstance(body, dict):
-            return _bad("invalid_body")
-        dry_run = bool(body.get("dry_run", False))
-        params = dict(body)
-
-    async with get_session() as session:
-        run = MigrationRun(kind=kind, status="pending", dry_run=dry_run)
-        session.add(run)
-        await session.commit()
-        await session.refresh(run)
-        run_id = run.id
-
-    run_migration.delay(run_id, kind, params)
-    return jsonify({"run_id": run_id, "status": "pending"}), 202
-
-
-@migrate_bp.route("/runs/<int:run_id>", methods=["GET"])
-async def get_run(run_id: int):
-    async with get_session() as session:
-        run = (await session.execute(
-            select(MigrationRun).where(MigrationRun.id == run_id)
-        )).scalar_one_or_none()
-    if run is None:
-        return _bad("not_found", status=404)
-    return jsonify(_run_to_dict(run))
-
-
-@migrate_bp.route("/runs", methods=["GET"])
-async def list_runs():
-    try:
-        limit = int(request.args.get("limit", "10"))
-    except ValueError:
-        return _bad("invalid_limit")
-    if limit < 1 or limit > 100:
-        return _bad("invalid_limit")
-
-    async with get_session() as session:
-        rows = (await session.execute(
-            select(MigrationRun)
-            .order_by(MigrationRun.id.desc())
-            .limit(limit)
-        )).scalars().all()
-    return jsonify([_run_to_dict(r) for r in rows])

backend/app/api/ml_admin.py

@@ -9,9 +9,7 @@ ml_admin_bp = Blueprint("ml_admin", __name__, url_prefix="/api/ml")
 
 
 _EDITABLE = (
-    "suggestion_threshold_artist",
     "suggestion_threshold_character",
-    "suggestion_threshold_copyright",
     "suggestion_threshold_general",
     "centroid_similarity_threshold",
     "min_reference_images",
@@ -28,9 +26,7 @@ async def get_settings():
         ).scalar_one()
     return jsonify(
         {
-            "suggestion_threshold_artist": s.suggestion_threshold_artist,
             "suggestion_threshold_character": s.suggestion_threshold_character,
-            "suggestion_threshold_copyright": s.suggestion_threshold_copyright,
             "suggestion_threshold_general": s.suggestion_threshold_general,
             "centroid_similarity_threshold": s.centroid_similarity_threshold,
             "min_reference_images": s.min_reference_images,

backend/app/api/posts.py

@@ -5,18 +5,11 @@ from quart import Blueprint, jsonify, request
 from ..extensions import get_session
 from ..services.post_feed_service import PostFeedService
 from ..services.source_service import KNOWN_PLATFORMS
+from ._responses import error_response as _bad
 
 posts_bp = Blueprint("posts", __name__, url_prefix="/api/posts")
 
 
-def _bad(error: str, *, status: int = 400, detail: str | None = None, **extra):
-    body = {"error": error}
-    if detail is not None:
-        body["detail"] = detail
-    body.update(extra)
-    return jsonify(body), status
-
-
 @posts_bp.route("", methods=["GET"])
 async def list_posts():
     args = request.args
@@ -25,6 +18,8 @@ async def list_posts():
     artist_id_raw = args.get("artist_id")
     platform = args.get("platform") or None
     limit_raw = args.get("limit", "24")
+    direction = args.get("direction", "older")
+    around_raw = args.get("around")
 
     try:
         limit = int(limit_raw)
@@ -33,6 +28,16 @@ async def list_posts():
     if limit < 1 or limit > 100:
         return _bad("invalid_limit", detail="limit must be between 1 and 100")
 
+    if direction not in ("older", "newer"):
+        return _bad("invalid_direction", detail="direction must be 'older' or 'newer'")
+
+    around_id = None
+    if around_raw is not None:
+        try:
+            around_id = int(around_raw)
+        except ValueError:
+            return _bad("invalid_around", detail="around must be an integer post id")
+
     artist_id = None
     if artist_id_raw is not None:
         try:
@@ -47,11 +52,20 @@ async def list_posts():
         )
 
     async with get_session() as session:
-        try:
-            page = await PostFeedService(session).scroll(
-                cursor=cursor, artist_id=artist_id,
+        svc = PostFeedService(session)
+        if around_id is not None:
+            result = await svc.around(
+                post_id=around_id, artist_id=artist_id,
                 platform=platform, limit=limit,
             )
+            if result is None:
+                return _bad("not_found", status=404, detail=f"post id={around_id}")
+            return jsonify(result)
+        try:
+            page = await svc.scroll(
+                cursor=cursor, artist_id=artist_id,
+                platform=platform, limit=limit, direction=direction,
+            )
         except ValueError as exc:
             # Service raises ValueError for malformed cursors only;
             # limit bounds are validated above.

backend/app/api/settings.py

@@ -31,9 +31,7 @@ _EDITABLE_FIELDS = (
 @settings_bp.route("/settings/import", methods=["GET"])
 async def get_import_settings():
     async with get_session() as session:
-        row = (
-            await session.execute(select(ImportSettings).where(ImportSettings.id == 1))
-        ).scalar_one()
+        row = await ImportSettings.load(session)
     return jsonify({
         "min_width": row.min_width,
         "min_height": row.min_height,
@@ -99,9 +97,7 @@ async def update_import_settings():
             return _bad_int("download_failure_warning_threshold", 1, 100)
 
     async with get_session() as session:
-        row = (
-            await session.execute(select(ImportSettings).where(ImportSettings.id == 1))
-        ).scalar_one()
+        row = await ImportSettings.load(session)
         for field in _EDITABLE_FIELDS:
             if field in body:
                 setattr(row, field, body[field])

backend/app/api/sources.py

@@ -5,6 +5,7 @@ from sqlalchemy import select
 
 from ..extensions import get_session
 from ..models import DownloadEvent, Source
+from ..services.scheduler_service import active_platform_cooldowns, scheduler_status
 from ..services.source_service import (
     KNOWN_PLATFORMS,
     ArtistNotFoundError,
@@ -14,18 +15,11 @@ from ..services.source_service import (
     SourceService,
     UnknownPlatformError,
 )
+from ._responses import error_response as _bad
 
 sources_bp = Blueprint("sources", __name__, url_prefix="/api/sources")
 
 
-def _bad(error: str, *, status: int = 400, detail: str | None = None, **extra):
-    body = {"error": error}
-    if detail is not None:
-        body["detail"] = detail
-    body.update(extra)
-    return jsonify(body), status
-
-
 @sources_bp.route("", methods=["GET"])
 async def list_sources():
     artist_id_raw = request.args.get("artist_id")
@@ -35,11 +29,19 @@ async def list_sources():
             artist_id = int(artist_id_raw)
         except ValueError:
             return _bad("invalid_artist_id", detail="artist_id must be an integer")
+    failing = request.args.get("failing", "").lower() in ("1", "true", "yes")
     async with get_session() as session:
-        records = await SourceService(session).list(artist_id=artist_id)
+        records = await SourceService(session).list(artist_id=artist_id, failing=failing)
     return jsonify([r.to_dict() for r in records])
 
 
+@sources_bp.route("/schedule-status", methods=["GET"])
+async def schedule_status():
+    """FC-dashboards: scheduler health for the Subscriptions hub."""
+    async with get_session() as session:
+        return jsonify(await scheduler_status(session))
+
+
 @sources_bp.route("/<int:source_id>", methods=["GET"])
 async def get_source(source_id: int):
     async with get_session() as session:
@@ -118,12 +120,46 @@ async def delete_source(source_id: int):
     return "", 204
 
 
+@sources_bp.route("/<int:source_id>/backfill", methods=["POST"])
+async def set_backfill(source_id: int):
+    """Plan #544: arm a source for backfill mode for the next N download
+    runs. Body: `{"runs": int}` (1..10, default 3). Returns the updated
+    source dict. While backfill_runs_remaining > 0, downloads use
+    gallery-dl's full-walk config (skip: True + 30-min timeout) instead
+    of the catch-up default (skip: "exit:20" + 14.5-min timeout)."""
+    payload = await request.get_json(silent=True) or {}
+    runs = payload.get("runs", 3)
+    try:
+        runs = int(runs)
+    except (TypeError, ValueError):
+        return _bad("invalid_runs", detail="runs must be an integer")
+    async with get_session() as session:
+        try:
+            record = await SourceService(session).set_backfill_runs(
+                source_id, runs,
+            )
+        except LookupError:
+            return _bad("not_found", status=404)
+        except ValueError as exc:
+            return _bad("invalid_runs", detail=str(exc))
+    return jsonify(record.to_dict())
+
+
 @sources_bp.route("/<int:source_id>/check", methods=["POST"])
 async def check_source(source_id: int):
     """FC-3c: enqueue a download for this source.
 
     Returns 202 with the new DownloadEvent id. If a pending/running
-    event already exists for this source, returns 409 with that id."""
+    event already exists for this source, returns 409 with that id. If
+    the source's platform is currently in a rate-limit cooldown, returns
+    **202 with `{status: "deferred", cooldown_until, platform}`** and
+    does NOT create an event or dispatch — the bulk retry path uses this
+    to avoid bowling N sources right back into the rate limit the
+    cooldown is preventing. Single-click "retry this one source" passes
+    `?force=true` to override the cooldown (operator-explicit, useful
+    for rapid auth-fix testing). The in-flight guard always applies.
+    """
+    force = (request.args.get("force") or "").lower() in ("1", "true", "yes")
     async with get_session() as session:
         source = (await session.execute(
             select(Source).where(Source.id == source_id)
@@ -133,6 +169,19 @@ async def check_source(source_id: int):
         if not source.enabled:
             return _bad("source_disabled", detail="enable the source first")
 
+        # Cooldown gate (unless explicitly overridden). Checked before the
+        # in-flight guard because a deferred retry doesn't need to create
+        # or check for an event at all.
+        if not force:
+            cooldowns = await active_platform_cooldowns(session)
+            expires_at = cooldowns.get(source.platform)
+            if expires_at is not None:
+                return jsonify({
+                    "status": "deferred",
+                    "platform": source.platform,
+                    "cooldown_until": expires_at.isoformat(),
+                }), 202
+
         in_flight = (await session.execute(
             select(DownloadEvent.id).where(
                 DownloadEvent.source_id == source_id,

backend/app/api/system_activity.py

@@ -20,6 +20,7 @@ from sqlalchemy import desc, func, select
 from ..config import get_config
 from ..extensions import get_session
 from ..models import TaskRun
+from ..services.scheduler_service import scheduler_status
 
 system_activity_bp = Blueprint(
     "system_activity", __name__, url_prefix="/api/system/activity",
@@ -81,17 +82,22 @@ def _read_workers_sync() -> dict:
     }
 
 
+async def _queues_cached() -> dict:
+    """Per-queue Redis LLEN, cached 2s. Shared by /queues and /summary."""
+    now = time.time()
+    if _QUEUE_CACHE["data"] is None or (now - _QUEUE_CACHE["ts"]) > _QUEUE_CACHE_TTL:
+        _QUEUE_CACHE["data"] = await asyncio.to_thread(_read_queues_sync)
+        _QUEUE_CACHE["ts"] = now
+    return _QUEUE_CACHE["data"]
+
+
 @system_activity_bp.route("/queues", methods=["GET"])
 async def get_queues():
     """Per-queue Redis LLEN. Cached 2s.
 
     Response: {queues: {name: depth_or_null}, fetched_at: iso8601}
     """
-    now = time.time()
-    if _QUEUE_CACHE["data"] is None or (now - _QUEUE_CACHE["ts"]) > _QUEUE_CACHE_TTL:
-        _QUEUE_CACHE["data"] = await asyncio.to_thread(_read_queues_sync)
-        _QUEUE_CACHE["ts"] = now
-    return jsonify(_QUEUE_CACHE["data"])
+    return jsonify(await _queues_cached())
 
 
 @system_activity_bp.route("/workers", methods=["GET"])
@@ -107,6 +113,35 @@ async def get_workers():
     return jsonify(_WORKER_CACHE["data"])
 
 
+@system_activity_bp.route("/summary", methods=["GET"])
+async def get_summary():
+    """One-call rollup for the always-on TopNav pipeline indicator:
+    scheduler health, per-queue pending depths, currently-running count, and
+    recent (24h) failure count. Cheap — cached queue LLENs + two TaskRun
+    counts — so it's safe to poll app-wide."""
+    queues_data = await _queues_cached()
+    depths = queues_data.get("queues", {})
+    queued_total = sum(v for v in depths.values() if isinstance(v, int))
+    since = datetime.now(UTC) - timedelta(hours=24)
+    async with get_session() as session:
+        scheduler = await scheduler_status(session)
+        running = (await session.execute(
+            select(func.count(TaskRun.id)).where(TaskRun.status == "running")
+        )).scalar_one()
+        failing = (await session.execute(
+            select(func.count(TaskRun.id))
+            .where(TaskRun.status.in_(["error", "timeout"]))
+            .where(TaskRun.finished_at >= since)
+        )).scalar_one()
+    return jsonify({
+        "scheduler": scheduler,
+        "queues": depths,
+        "queued_total": queued_total,
+        "running": int(running),
+        "failing": int(failing),
+    })
+
+
 @system_activity_bp.route("/runs", methods=["GET"])
 async def list_runs():
     """Paginated task_run history. Query params:

backend/app/api/system_backup.py

@@ -14,6 +14,7 @@ from sqlalchemy import desc, select
 
 from ..extensions import get_session
 from ..models import BackupRun, ImportSettings
+from ._responses import error_response as _bad
 
 system_backup_bp = Blueprint(
     "system_backup", __name__, url_prefix="/api/system/backup",
@@ -29,12 +30,6 @@ _BACKUP_SETTINGS_FIELDS = (
 )
 
 
-def _bad(error: str, *, status: int = 400, **extra):
-    body = {"error": error}
-    body.update(extra)
-    return jsonify(body), status
-
-
 def _row_to_dict(r: BackupRun) -> dict:
     return {
         "id": r.id,
@@ -232,9 +227,7 @@ async def delete_run(run_id: int):
 @system_backup_bp.route("/settings", methods=["GET"])
 async def get_settings():
     async with get_session() as session:
-        row = (await session.execute(
-            select(ImportSettings).where(ImportSettings.id == 1)
-        )).scalar_one()
+        row = await ImportSettings.load(session)
     return jsonify({
         "backup_db_nightly_enabled": row.backup_db_nightly_enabled,
         "backup_db_nightly_hour_utc": row.backup_db_nightly_hour_utc,
@@ -254,9 +247,7 @@ async def patch_settings():
         return err
 
     async with get_session() as session:
-        row = (await session.execute(
-            select(ImportSettings).where(ImportSettings.id == 1)
-        )).scalar_one()
+        row = await ImportSettings.load(session)
         for field in _BACKUP_SETTINGS_FIELDS:
             if field in body:
                 setattr(row, field, body[field])

backend/app/api/thumbnails.py

@@ -1,5 +1,7 @@
 """Thumbnail admin API: backfill trigger."""
 
+import asyncio
+
 from quart import Blueprint, jsonify
 
 thumbnails_bp = Blueprint("thumbnails", __name__, url_prefix="/api/thumbnails")
@@ -7,7 +9,20 @@ thumbnails_bp = Blueprint("thumbnails", __name__, url_prefix="/api/thumbnails")
 
 @thumbnails_bp.route("/backfill", methods=["POST"])
 async def trigger_backfill():
-    from ..tasks.thumbnail import backfill_thumbnails
+    """Run the backfill scan synchronously, return the counts. The actual
+    thumbnail generation work is still off-loaded to the thumbnail Celery
+    queue via `generate_thumbnail.delay()` per missing row — so this
+    handler is fast even on a 100k-image library (a scan is just SELECT
+    id, thumbnail_path + a file.stat() per row, no heavy work).
 
-    r = backfill_thumbnails.delay()
-    return jsonify({"celery_task_id": r.id}), 202
+    Operator-flagged 2026-06-01: the previous fire-and-forget shape
+    returned `{celery_task_id}` only, so the admin UI had no idea whether
+    backfill found 0 or 5000 candidates — \"found nothing\" was
+    indistinguishable from \"the worker isn't picking up the task.\""""
+    from ..tasks.thumbnail import _run_backfill_scan
+
+    # Sync scan inside an executor so we don't block the event loop.
+    counts = await asyncio.get_running_loop().run_in_executor(
+        None, _run_backfill_scan,
+    )
+    return jsonify(counts), 200

backend/app/celery_app.py

@@ -28,7 +28,6 @@ def make_celery() -> Celery:
             "backend.app.tasks.import_file",
             "backend.app.tasks.thumbnail",
             "backend.app.tasks.maintenance",
-            "backend.app.tasks.migration",
             "backend.app.tasks.ml",
             "backend.app.tasks.download",
             "backend.app.tasks.backup",
@@ -45,7 +44,6 @@ def make_celery() -> Celery:
             "backend.app.tasks.download.*": {"queue": "download"},
             "backend.app.tasks.scan.*": {"queue": "scan"},
             "backend.app.tasks.maintenance.*": {"queue": "maintenance"},
-            "backend.app.tasks.migration.*": {"queue": "maintenance"},
             "backend.app.tasks.backup.*": {"queue": "maintenance"},
             "backend.app.tasks.admin.*": {"queue": "maintenance"},
             "backend.app.tasks.library_audit.*": {"queue": "maintenance"},
@@ -87,6 +85,10 @@ def make_celery() -> Celery:
                 "task": "backend.app.tasks.maintenance.cleanup_old_download_events",
                 "schedule": 86400.0,  # daily
             },
+            "recover-stalled-download-events": {
+                "task": "backend.app.tasks.maintenance.recover_stalled_download_events",
+                "schedule": 300.0,  # every 5 min, matches recover-interrupted-tasks
+            },
             "recover-stalled-task-runs": {
                 "task": "backend.app.tasks.maintenance.recover_stalled_task_runs",
                 "schedule": 300.0,  # every 5 min, matches recover-interrupted-tasks

backend/app/celery_signals.py

@@ -66,10 +66,7 @@ def _queue_for(task) -> str:
         return "download"
     if name.startswith("backend.app.tasks.scan."):
         return "scan"
-    if name.startswith((
-        "backend.app.tasks.maintenance.",
-        "backend.app.tasks.migration.",
-    )):
+    if name.startswith("backend.app.tasks.maintenance."):
         return "maintenance"
     return "default"
 

backend/app/models/__init__.py

@@ -12,7 +12,6 @@ from .import_batch import ImportBatch
 from .import_settings import ImportSettings
 from .import_task import ImportTask
 from .library_audit_run import LibraryAuditRun
-from .migration_run import MigrationRun
 from .ml_settings import MLSettings
 from .post import Post
 from .post_attachment import PostAttachment
@@ -46,7 +45,6 @@ __all__ = [
     "ImportSettings",
     "LibraryAuditRun",
     "MLSettings",
-    "MigrationRun",
     "TagAlias",
     "TagAllowlist",
     "TagReferenceEmbedding",

backend/app/models/image_provenance.py

@@ -34,8 +34,12 @@ class ImageProvenance(Base):
     post_id: Mapped[int] = mapped_column(
         ForeignKey("post.id", ondelete="CASCADE"), nullable=False, index=True
     )
-    source_id: Mapped[int] = mapped_column(
-        ForeignKey("source.id", ondelete="CASCADE"), nullable=False, index=True
+    # Nullable since alembic 0030 — provenance rows for filesystem-imported
+    # content with no subscription have NULL source_id. FK ondelete SET
+    # NULL so deleting a Source detaches its provenance rows instead of
+    # destroying the linkage between image and post.
+    source_id: Mapped[int | None] = mapped_column(
+        ForeignKey("source.id", ondelete="SET NULL"), nullable=True, index=True
     )
     captured_metadata: Mapped[dict | None] = mapped_column(JSON, nullable=True)
     captured_at: Mapped[datetime] = mapped_column(

backend/app/models/import_settings.py

@@ -4,7 +4,7 @@ Enforced as a single row via a CHECK (id = 1) constraint. The application
 always SELECTs id=1 and never inserts/deletes after the initial migration.
 """
 
-from sqlalchemy import Boolean, CheckConstraint, Float, Integer, Text
+from sqlalchemy import Boolean, CheckConstraint, Float, Integer, Text, select
 from sqlalchemy.orm import Mapped, mapped_column
 
 from .base import Base
@@ -63,3 +63,13 @@ class ImportSettings(Base):
     backup_images_keep_last_n: Mapped[int] = mapped_column(
         Integer, nullable=False, default=3,
     )
+
+    @classmethod
+    async def load(cls, session) -> ImportSettings:
+        """The singleton settings row (id=1), via an async session."""
+        return (await session.execute(select(cls).where(cls.id == 1))).scalar_one()
+
+    @classmethod
+    def load_sync(cls, session) -> ImportSettings:
+        """The singleton settings row (id=1), via a sync session."""
+        return session.execute(select(cls).where(cls.id == 1)).scalar_one()

backend/app/models/migration_run.py

@@ -1,37 +0,0 @@
-"""MigrationRun — tracks each FC-5 migration invocation (backup/gs/ir/etc).
-
-kind/status are String(32) not Postgres ENUM so adding kinds later
-doesn't need a schema migration. The API layer validates values.
-"""
-
-from datetime import datetime
-
-import sqlalchemy as sa
-from sqlalchemy import Boolean, DateTime, Integer, String, Text, func
-from sqlalchemy.dialects.postgresql import JSONB
-from sqlalchemy.orm import Mapped, mapped_column
-
-from .base import Base
-
-
-class MigrationRun(Base):
-    __tablename__ = "migration_run"
-
-    id: Mapped[int] = mapped_column(Integer, primary_key=True)
-    kind: Mapped[str] = mapped_column(String(32), nullable=False, index=True)
-    status: Mapped[str] = mapped_column(String(32), nullable=False, index=True)
-    dry_run: Mapped[bool] = mapped_column(Boolean, nullable=False, default=False)
-    started_at: Mapped[datetime] = mapped_column(
-        DateTime(timezone=True), nullable=False, server_default=func.now(),
-    )
-    finished_at: Mapped[datetime | None] = mapped_column(
-        DateTime(timezone=True), nullable=True,
-    )
-    counts: Mapped[dict] = mapped_column(
-        JSONB, nullable=False, default=dict, server_default=sa.text("'{}'::jsonb"),
-    )
-    error: Mapped[str | None] = mapped_column(Text, nullable=True)
-    metadata_: Mapped[dict] = mapped_column(
-        "metadata", JSONB, nullable=False, default=dict,
-        server_default=sa.text("'{}'::jsonb"),
-    )

backend/app/models/ml_settings.py

@@ -15,17 +15,14 @@ class MLSettings(Base):
     __table_args__ = (CheckConstraint("id = 1", name="singleton"),)
 
     id: Mapped[int] = mapped_column(Integer, primary_key=True)
-    suggestion_threshold_artist: Mapped[float] = mapped_column(
-        Float, nullable=False, default=0.30
-    )
     suggestion_threshold_character: Mapped[float] = mapped_column(
         Float, nullable=False, default=0.50
     )
-    suggestion_threshold_copyright: Mapped[float] = mapped_column(
-        Float, nullable=False, default=0.50
-    )
+    # Default lowered 0.95 → 0.50 on 2026-06-01 — operator-flagged that
+    # 0.95 hid most general suggestions. Operator-tunable via Settings →
+    # ML if too noisy.
     suggestion_threshold_general: Mapped[float] = mapped_column(
-        Float, nullable=False, default=0.95
+        Float, nullable=False, default=0.50
     )
     centroid_similarity_threshold: Mapped[float] = mapped_column(
         Float, nullable=False, default=0.55

backend/app/models/post.py

@@ -1,6 +1,9 @@
-"""Post — provenance anchor for content downloaded from a Source.
+"""Post — provenance anchor for one creator post (may contain many images).
 
-A Post is one creator post; it may contain many images/videos.
+`source_id` is nullable since alembic 0030 — filesystem-imported posts
+with no live subscription have NULL source_id. `artist_id` is the
+denormalized always-present link to the creator (added in 0030 so
+artist-filter queries don't depend on the Source detour).
 """
 
 from datetime import datetime
@@ -14,12 +17,25 @@ from .base import Base
 class Post(Base):
     __tablename__ = "post"
     __table_args__ = (
+        # Source-bound dedup. Postgres treats NULL != NULL so rows
+        # with source_id IS NULL aren't deduped by this constraint;
+        # the partial unique index `uq_post_artist_external_id_null_source`
+        # (created in alembic 0030) covers that case via
+        # (artist_id, external_post_id).
         UniqueConstraint("source_id", "external_post_id", name="uq_post_source_external_id"),
     )
 
     id: Mapped[int] = mapped_column(Integer, primary_key=True)
-    source_id: Mapped[int] = mapped_column(
-        ForeignKey("source.id", ondelete="CASCADE"), nullable=False, index=True
+    source_id: Mapped[int | None] = mapped_column(
+        ForeignKey("source.id", ondelete="SET NULL"), nullable=True, index=True
+    )
+    # Denormalized; always equals source.artist_id when source_id is set
+    # (the importer is responsible for keeping them consistent on insert).
+    # Filter queries (artist detail, artist-scoped posts feed) use this
+    # directly instead of joining through Source.
+    artist_id: Mapped[int] = mapped_column(
+        ForeignKey("artist.id", ondelete="CASCADE"),
+        nullable=False, index=True,
     )
     external_post_id: Mapped[str] = mapped_column(String(128), nullable=False)
     post_url: Mapped[str | None] = mapped_column(Text, nullable=True)

backend/app/models/source.py

@@ -29,4 +29,13 @@ class Source(Base):
     check_interval_override: Mapped[int | None] = mapped_column(Integer, nullable=True)
     consecutive_failures: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
 
+    # alembic 0031: sticky deep-scan budget. When > 0, the next N download
+    # runs use gallery-dl's full-walk config (skip: True + 1800s timeout);
+    # when 0, runs use tick mode (skip: "exit:20" + 870s, exits early once
+    # 20 contiguous archived items are seen). Auto-decrements per run, with
+    # an auto-reset to 0 on clean exit + zero downloads (queue drained).
+    backfill_runs_remaining: Mapped[int] = mapped_column(
+        Integer, nullable=False, default=0, server_default="0",
+    )
+
     artist = relationship("Artist", back_populates="sources")

backend/app/services/artist_directory_service.py

@@ -127,17 +127,20 @@ class ArtistDirectoryService:
                 ImageRecord.artist_id.label("artist_id"),
                 ImageRecord.sha256.label("sha256"),
                 ImageRecord.mime.label("mime"),
+                ImageRecord.thumbnail_path.label("thumbnail_path"),
                 rn,
             )
             .where(ImageRecord.artist_id.in_(artist_ids))
             .subquery()
         )
         stmt = (
-            select(sub.c.artist_id, sub.c.sha256, sub.c.mime)
+            select(
+                sub.c.artist_id, sub.c.sha256, sub.c.mime, sub.c.thumbnail_path,
+            )
             .where(sub.c.rn <= _PREVIEW_COUNT)
             .order_by(sub.c.artist_id, sub.c.rn)
         )
         out: dict[int, list[str]] = {}
-        for aid, sha, mime in (await self.session.execute(stmt)).all():
-            out.setdefault(aid, []).append(thumbnail_url(sha, mime))
+        for aid, sha, mime, tp in (await self.session.execute(stmt)).all():
+            out.setdefault(aid, []).append(thumbnail_url(tp, sha, mime))
         return out

backend/app/services/artist_service.py

@@ -58,13 +58,17 @@ class ArtistService:
             )
         ).scalar_one()
 
+        # Posts under this artist that have at least one image attached.
+        # Use Post.artist_id (alembic 0030) for the artist filter; keep
+        # the ImageProvenance JOIN so date bounds reflect only image-
+        # bearing posts (matches the original semantic). NULL-source
+        # posts now surface too.
         date_row = (
             await self.session.execute(
                 select(func.min(Post.post_date), func.max(Post.post_date))
                 .select_from(Post)
                 .join(ImageProvenance, ImageProvenance.post_id == Post.id)
-                .join(Source, Source.id == ImageProvenance.source_id)
-                .where(Source.artist_id == aid)
+                .where(Post.artist_id == aid)
             )
         ).first()
         dmin, dmax = date_row if date_row else (None, None)
@@ -98,14 +102,14 @@ class ArtistService:
             )
         ).all()
 
+        # Same Post.artist_id direct filter — counts NULL-source posts too.
         month = func.date_trunc("month", Post.post_date).label("m")
         activity = (
             await self.session.execute(
                 select(month, func.count(func.distinct(ImageProvenance.image_record_id)))
                 .select_from(Post)
                 .join(ImageProvenance, ImageProvenance.post_id == Post.id)
-                .join(Source, Source.id == ImageProvenance.source_id)
-                .where(and_(Source.artist_id == aid, Post.post_date.isnot(None)))
+                .where(and_(Post.artist_id == aid, Post.post_date.isnot(None)))
                 .group_by(month)
                 .order_by(month)
             )
@@ -114,9 +118,7 @@ class ArtistService:
         post_count = (
             await self.session.execute(
                 select(func.count(func.distinct(Post.id)))
-                .select_from(Post)
-                .join(Source, Source.id == Post.source_id)
-                .where(Source.artist_id == aid)
+                .where(Post.artist_id == aid)
             )
         ).scalar_one()
 
@@ -198,7 +200,7 @@ class ArtistService:
                     "mime": r.mime,
                     "width": r.width,
                     "height": r.height,
-                    "thumbnail_url": thumbnail_url(r.sha256, r.mime),
+                    "thumbnail_url": thumbnail_url(r.thumbnail_path, r.sha256, r.mime),
                 }
                 for r in rows
             ],

backend/app/services/cleanup_service.py

@@ -6,9 +6,8 @@ HTTP handlers (small ops) and from Celery tasks in
 backend.app.tasks.admin (long ops).
 
 This module is the PERMANENT home of artist-cascade + image-unlink
-logic. The legacy copy at backend/app/services/migrators/cleanup.py
-stays in place until FC-3j; FC-3j will replace its body with thin
-re-exports from this module and then delete the wrapper.
+logic. (The legacy migrators/cleanup.py copy was removed with the rest of
+the one-and-done GS/IR migration tooling.)
 """
 from __future__ import annotations
 
@@ -16,7 +15,7 @@ from datetime import UTC, datetime
 from pathlib import Path
 from typing import Any
 
-from sqlalchemy import func, select, update
+from sqlalchemy import func, or_, select, update
 from sqlalchemy.orm import Session
 
 from ..models import Artist, ImageRecord, LibraryAuditRun, Tag
@@ -369,6 +368,72 @@ def prune_unused_tags(session: Session, *, dry_run: bool = False) -> dict:
     return {"deleted": len(ids), "sample_names": sample}
 
 
+# Legacy tags FC no longer uses, in two shapes:
+#   (1) kinds the tag input never produces — archive/post/artist.
+#       provenance (post grouping) + archive membership are their own
+#       systems now, and artists are first-class Artist/Source rows.
+#       meta/rating were already hard-deleted by alembic 0023.
+#   (2) name prefixes from IR kinds FC never adopted — `source:*`.
+#       ImageRepo had a `source` kind; FC's enum doesn't, so ir_ingest
+#       fell those back to `general` (kind=general, name="source:patreon"
+#       etc.). They can't be caught by kind, so we match the name prefix.
+PURGEABLE_TAG_KINDS = ("archive", "post", "artist")
+LEGACY_NAME_PREFIXES = ("source:",)
+
+
+def _legacy_tag_predicate():
+    name_clauses = [Tag.name.like(f"{p}%") for p in LEGACY_NAME_PREFIXES]
+    return or_(Tag.kind.in_(PURGEABLE_TAG_KINDS), *name_clauses)
+
+
+def purge_legacy_tags(session: Session, *, dry_run: bool = False) -> dict:
+    """Count (dry_run) or delete legacy IR-migration tags: archive/post/
+    artist-kind tags PLUS general tags whose name matches a legacy
+    prefix (source:*).
+
+    CASCADE on image_tag / tag_alias / tag_allowlist /
+    tag_reference_embedding / tag_suggestion_rejection / series_page
+    clears the related rows on the parent DELETE.
+
+    Returns:
+      {"by_kind": {kind: count, ...},        # kind-matched rows
+       "by_prefix": {"source:*": count},     # name-prefix-matched rows
+       "count": total, "sample_names": [first 50],
+       and on live runs "deleted": total}
+    """
+    predicate = _legacy_tag_predicate()
+    rows = session.execute(
+        select(Tag.id, Tag.name, Tag.kind).where(predicate)
+    ).all()
+    by_kind: dict[str, int] = {}
+    by_prefix: dict[str, int] = {}
+    for _id, name, kind in rows:
+        # Classify by name-prefix first so a source:* row counts once,
+        # under the prefix bucket, regardless of its (general) kind.
+        matched_prefix = next(
+            (p for p in LEGACY_NAME_PREFIXES if name.startswith(p)), None,
+        )
+        if matched_prefix is not None:
+            label = f"{matched_prefix}*"
+            by_prefix[label] = by_prefix.get(label, 0) + 1
+        else:
+            key = kind.value if hasattr(kind, "value") else str(kind)
+            by_kind[key] = by_kind.get(key, 0) + 1
+    sample = [name for _id, name, _kind in rows[:50]]
+    total = len(rows)
+    result = {
+        "by_kind": by_kind, "by_prefix": by_prefix,
+        "count": total, "sample_names": sample,
+    }
+    if dry_run:
+        return result
+    if total:
+        session.execute(Tag.__table__.delete().where(predicate))
+        session.commit()
+    result["deleted"] = total
+    return result
+
+
 # ---------------------------------------------------------------------------
 # FC-Cleanup additions (2026-05-26): retroactive audit of import-filter rules.
 # ---------------------------------------------------------------------------

backend/app/services/credential_service.py

@@ -7,7 +7,7 @@ from __future__ import annotations
 import json
 import os
 from dataclasses import dataclass
-from datetime import datetime
+from datetime import UTC, datetime
 from pathlib import Path
 
 from sqlalchemy import select
@@ -163,6 +163,19 @@ class CredentialService:
             return None
         return self.crypto.decrypt(row.encrypted_blob)
 
+    async def mark_verified(self, platform: str) -> datetime | None:
+        """Stamp last_verified=now after a successful verify. Returns the
+        timestamp, or None if the credential is gone."""
+        row = (await self.session.execute(
+            select(Credential).where(Credential.platform == platform)
+        )).scalar_one_or_none()
+        if row is None:
+            return None
+        ts = datetime.now(UTC)
+        row.last_verified = ts
+        await self.session.commit()
+        return ts
+
 
 def _augment_cookies(platform: str, netscape: str) -> str:
     """Delegate to the platform's `augment_cookies` hook if one is

backend/app/services/download_service.py

@@ -25,9 +25,17 @@ from sqlalchemy.orm import joinedload
 
 from ..models import Artist, DownloadEvent, Source
 from .credential_service import CredentialService
-from .gallery_dl import GalleryDLService, SourceConfig
+from .gallery_dl import (
+    BACKFILL_SKIP_VALUE,
+    BACKFILL_TIMEOUT_SECONDS,
+    TICK_SKIP_VALUE,
+    ErrorType,
+    GalleryDLService,
+    SourceConfig,
+)
 from .importer import Importer
 from .patreon_resolver import resolve_campaign_id
+from .scheduler_service import set_platform_cooldown
 
 log = logging.getLogger(__name__)
 
@@ -83,6 +91,18 @@ class DownloadService:
         ctx = setup
 
         source_config = SourceConfig.from_dict(ctx["config_overrides"] or {})
+        # alembic 0031 / plan #544: derive skip_value + timeout from the
+        # source's backfill_runs_remaining counter. When > 0, walk the full
+        # post history (skip: True + 1800s); when 0, exit gallery-dl after
+        # 20 contiguous archived items (skip: "exit:20" + the default
+        # 870s). Operator sets backfill via POST /api/sources/{id}/backfill.
+        backfill_remaining = ctx.get("backfill_runs_remaining", 0) or 0
+        if backfill_remaining > 0:
+            skip_value: bool | str = BACKFILL_SKIP_VALUE
+            source_config.timeout = BACKFILL_TIMEOUT_SECONDS
+        else:
+            skip_value = TICK_SKIP_VALUE
+
         effective_url = _effective_url(
             ctx["platform"], ctx["url"], ctx["config_overrides"] or {}
         )
@@ -94,6 +114,7 @@ class DownloadService:
             source_config=source_config,
             cookies_path=ctx["cookies_path"],
             auth_token=ctx["auth_token"],
+            skip_value=skip_value,
         )
 
         resolved_campaign_id: str | None = None
@@ -120,6 +141,7 @@ class DownloadService:
                         source_config=source_config,
                         cookies_path=ctx["cookies_path"],
                         auth_token=ctx["auth_token"],
+                        skip_value=skip_value,
                     )
 
         return await self._phase3_persist(
@@ -184,6 +206,7 @@ class DownloadService:
             "config_overrides": dict(source.config_overrides or {}),
             "cookies_path": cookies_path,
             "auth_token": auth_token,
+            "backfill_runs_remaining": source.backfill_runs_remaining or 0,
         }
 
     async def _phase3_persist(
@@ -237,6 +260,40 @@ class DownloadService:
                     bytes_downloaded += path.stat().st_size  # noqa: ASYNC240
                 except OSError:
                     pass
+                # Enqueue thumbnail + ML for newly-attached images, matching
+                # the filesystem-import path (tasks/import_file.py:228-239).
+                # Importer.attach_in_place deliberately skips inline thumb
+                # generation to keep the import queue moving; the calling
+                # task is responsible for the enqueue. Operator-flagged
+                # 2026-06-01: without this, every downloaded image stayed
+                # at thumbnail_path=NULL until a periodic backfill swept
+                # it up, surfacing as broken-thumbnail tiles in the gallery
+                # for hours after a download landed. Lazy import to avoid
+                # circular-import risk between this service and the
+                # tasks/* modules that import it.
+                from ..tasks.ml import tag_and_embed
+                from ..tasks.thumbnail import generate_thumbnail
+                ids = list(result.member_image_ids)
+                if result.image_id is not None and result.image_id not in ids:
+                    ids.append(result.image_id)
+                for img_id in ids:
+                    generate_thumbnail.delay(img_id)
+                    tag_and_embed.delay(img_id)
+            elif result.status == "attached":
+                # Non-media or extracted archive captured as PostAttachment
+                # (FC-2d-iii). The canonical copy lives in the attachments
+                # store; the original download path is now redundant —
+                # mirror duplicate_hash cleanup so we don't keep two copies.
+                # Operator-flagged 2026-06-02 (Lustria OST zip).
+                import_summary["attached"] += 1
+                try:
+                    bytes_downloaded += path.stat().st_size  # noqa: ASYNC240
+                except OSError:
+                    pass
+                try:
+                    path.unlink(missing_ok=True)  # noqa: ASYNC240
+                except OSError:
+                    pass
             elif result.status == "skipped" and result.skip_reason and result.skip_reason.value in (
                 "duplicate_hash", "duplicate_phash",
             ):
@@ -245,6 +302,12 @@ class DownloadService:
                     path.unlink(missing_ok=True)  # noqa: ASYNC240
                 except OSError:
                     pass
+            elif result.status == "skipped":
+                # Soft skip (too_small, too_transparent, invalid_image) —
+                # the file just didn't qualify, not a download/ingest
+                # failure. Don't flag the run as error; the file stays
+                # on disk for operator inspection.
+                import_summary["skipped"] += 1
             else:
                 import_summary["errors"] += 1
 
@@ -258,12 +321,21 @@ class DownloadService:
         run_stats["quarantined_count"] = dl_result.files_quarantined
         stderr_summary = self.gdl._extract_errors_warnings(dl_result.stderr)
 
-        status = "ok" if (dl_result.success and import_summary["errors"] == 0) else "error"
+        # Plan #544: PARTIAL means the run downloaded ≥1 file but the
+        # subprocess didn't finish in budget (typically wall-clock timeout
+        # mid-walk). Real work happened; the next tick continues via
+        # gallery-dl's archive. NOT a failure for status purposes.
+        if dl_result.success and import_summary["errors"] == 0:
+            status = "ok"
+        elif dl_result.error_type == ErrorType.PARTIAL and import_summary["errors"] == 0:
+            status = "ok"
+        else:
+            status = "error"
         ev.status = status
         ev.finished_at = datetime.now(UTC)
         ev.files_count = import_summary["attached"]
         ev.bytes_downloaded = bytes_downloaded
-        ev.error = dl_result.error_message if not dl_result.success else None
+        ev.error = dl_result.error_message if status == "error" else None
         ev.metadata_ = {
             "run_stats": run_stats,
             "error_type": dl_result.error_type.value if dl_result.error_type else None,
@@ -276,18 +348,40 @@ class DownloadService:
         }
         await self._update_source_health(
             source_id=ctx["source_id"], status=status, error_message=ev.error,
+            error_type=dl_result.error_type.value if dl_result.error_type else None,
         )
+        # Plan #544: backfill lifecycle — auto-complete when a clean
+        # backfill run drained the queue (gallery-dl exited 0 + zero files
+        # downloaded means there was nothing to fetch); otherwise decrement
+        # the counter. Next tick falls back to tick mode once it hits 0.
+        backfill_remaining = ctx.get("backfill_runs_remaining", 0) or 0
+        if backfill_remaining > 0:
+            src = (await self.async_session.execute(
+                select(Source).where(Source.id == ctx["source_id"])
+            )).scalar_one()
+            if dl_result.return_code == 0 and dl_result.files_downloaded == 0:
+                src.backfill_runs_remaining = 0
+            else:
+                src.backfill_runs_remaining = max(0, backfill_remaining - 1)
         await self.async_session.commit()
         return event_id
 
     async def _update_source_health(
         self, *, source_id: int, status: str, error_message: str | None,
+        error_type: str | None = None,
     ) -> None:
         """FC-3d: update Source.{consecutive_failures, last_error, last_checked_at}.
 
         ok      -> failures = 0, error = None, checked_at = now
         error   -> failures += 1, error = error_message, checked_at = now
         skipped -> failures unchanged, error = None, checked_at = now
+
+        When error_type == 'rate_limited', also stamps a platform-wide
+        cooldown via scheduler_service.set_platform_cooldown so the next
+        scan tick skips every source on this platform until the cooldown
+        expires. Preventive half of the burst-prevention pair —
+        consecutive_failures still backs the offending source off across
+        ticks.
         """
         source = (await self.async_session.execute(
             select(Source).where(Source.id == source_id)
@@ -299,6 +393,8 @@ class DownloadService:
         elif status == "error":
             source.consecutive_failures = (source.consecutive_failures or 0) + 1
             source.last_error = error_message
+            if error_type == "rate_limited":
+                await set_platform_cooldown(self.async_session, source.platform)
         elif status == "skipped":
             source.last_error = None
         source.last_checked_at = now

backend/app/services/extension_service.py

@@ -86,6 +86,67 @@ class ExtensionService:
             "created_artist": created_artist,
         }
 
+    async def probe(self, url: str) -> dict:
+        """Read-only resolution of a creator-page URL against the FC DB.
+        Returns one of:
+          - {state: 'unknown_platform'}            — URL didn't match any
+            platform's strict artist-page pattern
+          - {state: 'new',          platform, slug} — would create both
+            artist and source on quick-add
+          - {state: 'artist_match', platform, slug, artist}
+                                                   — artist exists, this
+            exact URL isn't a Source yet (collapses the sidecar-synthetic
+            case too — the synthetic anchor counts as an existing artist
+            row but not as a pollable Source for this URL)
+          - {state: 'source_match', platform, slug, artist, source}
+                                                   — exact (artist, platform,
+            url) Source already exists
+
+        Side-effect-free: two SELECTs at most.
+        """
+        try:
+            platform, raw_slug = self._derive(url)
+        except (UnknownPlatformError, InvalidUrlError):
+            return {"state": "unknown_platform"}
+
+        slug = slugify(raw_slug)
+        artist = (await self.session.execute(
+            select(Artist).where(Artist.slug == slug)
+        )).scalar_one_or_none()
+        if artist is None:
+            return {"state": "new", "platform": platform, "slug": slug}
+
+        artist_payload = {"id": artist.id, "name": artist.name, "slug": artist.slug}
+
+        source = (await self.session.execute(
+            select(Source).where(
+                Source.artist_id == artist.id,
+                Source.platform == platform,
+                Source.url == url,
+            )
+        )).scalar_one_or_none()
+        if source is None:
+            return {
+                "state": "artist_match",
+                "platform": platform,
+                "slug": slug,
+                "artist": artist_payload,
+            }
+
+        return {
+            "state": "source_match",
+            "platform": platform,
+            "slug": slug,
+            "artist": artist_payload,
+            "source": {
+                "id": source.id,
+                "artist_id": source.artist_id,
+                "platform": source.platform,
+                "url": source.url,
+                "enabled": source.enabled,
+            },
+        }
+
     def _derive(self, url: str) -> tuple[str, str]:
         if not isinstance(url, str) or not url.strip():
             raise InvalidUrlError("url is empty")

backend/app/services/gallery_dl.py

@@ -39,19 +39,58 @@ class ErrorType(StrEnum):
     HTTP_ERROR = "http_error"
     UNSUPPORTED_URL = "unsupported_url"
     VALIDATION_FAILED = "validation_failed"
+    # Run made real progress (downloaded ≥1 file) but did not finish in the
+    # subprocess budget. Distinct from UNKNOWN_ERROR — the downstream status
+    # mapping classifies this as "ok" because the next tick continues.
+    PARTIAL = "partial"
     UNKNOWN_ERROR = "unknown_error"
 
 
+# Tick mode (routine cron polls): skip ≤20 contiguous already-archived
+# items, then exit gallery-dl. Established subscription with zero new
+# content exits in ~30s of HEAD requests instead of walking to the bottom
+# of the post history (which can be hours for prolific creators). 20 (not
+# 5) is operator-set headroom against any edge case where paywalled or
+# otherwise-non-downloadable items might interleave with archived ones —
+# 20 contiguous HEADs is still negligible.
+TICK_SKIP_VALUE = "exit:20"
+
+# Backfill mode (operator-triggered deep scan): walk the full history.
+# Source.backfill_runs_remaining > 0 selects this mode; the longer
+# timeout below absorbs creators with thousands of posts.
+BACKFILL_SKIP_VALUE = True
+BACKFILL_TIMEOUT_SECONDS = 1800
+
+
+# 30 seconds shy of download_source's Celery soft_time_limit (900s, see
+# tasks/download.py:32). subprocess.run MUST raise TimeoutExpired before
+# Celery raises SoftTimeLimitExceeded — otherwise Celery wins the race,
+# SIGKILLs the worker, in-memory stdout/stderr is lost, and the
+# DownloadEvent ends up empty-logged with "stranded by recovery sweep"
+# 18 minutes later (operator-flagged 2026-05-31, Knuxy event #38275).
+# The 30s buffer absorbs scheduler jitter / GC pauses without making
+# legitimately-long-running syncs timeout-friendlier. Per-source bumps
+# still live in source.config_overrides for legitimately long syncs.
+_DEFAULT_GDL_TIMEOUT_SECONDS = 870
+
+
 @dataclass
 class SourceConfig:
+    """Per-source overrides loaded from Source.config_overrides JSON.
+
+    Note: the gallery-dl `skip` value (tick vs backfill, see TICK_SKIP_VALUE /
+    BACKFILL_SKIP_VALUE) is NOT carried here — it derives from the
+    Source.backfill_runs_remaining column at the download_service layer
+    and is passed to _build_config_for_source as `skip_value`. Same for
+    the per-run subprocess timeout.
+    """
     content_types: list[str] = field(default_factory=lambda: ["all"])
     sleep: float | None = None
     sleep_request: float | None = None
     directory_pattern: str | None = None
     filename_pattern: str | None = None
-    skip_existing: bool = True
     save_metadata: bool = True
-    timeout: int = 3600
+    timeout: int = _DEFAULT_GDL_TIMEOUT_SECONDS
 
     @classmethod
     def from_dict(cls, data: dict) -> SourceConfig:
@@ -61,9 +100,8 @@ class SourceConfig:
             sleep_request=data.get("sleep_request"),
             directory_pattern=data.get("directory_pattern"),
             filename_pattern=data.get("filename_pattern"),
-            skip_existing=data.get("skip_existing", True),
             save_metadata=data.get("save_metadata", True),
-            timeout=data.get("timeout", 3600),
+            timeout=data.get("timeout", _DEFAULT_GDL_TIMEOUT_SECONDS),
         )
 
 
@@ -219,6 +257,25 @@ class GalleryDLService:
                 "part-directory": str(self._config_dir / "temp"),
                 "retries": 3,
                 "timeout": 120.0,
+                # Forward Patreon as Referer/Origin to yt-dlp when it
+                # fetches video manifests. Operator-flagged 2026-06-01
+                # (DaferQ patreon): video posts hosted on Mux carry a JWT
+                # playback restriction that checks Referer/Origin on every
+                # request — not just the token signature. gallery-dl's
+                # HEAD probe to stream.mux.com returns 200 (the token is
+                # valid), but yt-dlp's actual GET-with-Range to fetch the
+                # m3u8 manifest 403s because yt-dlp sends its own default
+                # Referer, which Mux's policy rejects. Forcing the right
+                # headers fixes the headers-only case; Mux IP-range
+                # restrictions are unfixable from here.
+                "ytdl": {
+                    "raw-options": {
+                        "http_headers": {
+                            "Referer": "https://www.patreon.com/",
+                            "Origin": "https://www.patreon.com",
+                        },
+                    },
+                },
             },
             "output": {"progress": True},
         }
@@ -233,7 +290,18 @@ class GalleryDLService:
         platform: str,
         source_config: SourceConfig,
         artist_slug: str,
+        skip_value: bool | str = BACKFILL_SKIP_VALUE,
     ) -> dict:
+        """`skip_value` controls gallery-dl's archive-walk behavior:
+            - True (BACKFILL_SKIP_VALUE): walk full post history, skipping
+              archived items but continuing past them. Used in backfill mode.
+            - "exit:20" (TICK_SKIP_VALUE): exit gallery-dl after 20
+              contiguous archived items. Used in tick (routine catch-up)
+              mode for fast no-op syncs on creators with deep history.
+            - False: don't skip — redownload everything (not used in FC).
+        The caller (download_service) chooses based on
+        Source.backfill_runs_remaining.
+        """
         config = json.loads(json.dumps(self._get_default_config()))  # deep copy
 
         destination = str(self.images_root / artist_slug / platform)
@@ -243,7 +311,7 @@ class GalleryDLService:
             config["extractor"]["sleep"] = source_config.sleep
         if source_config.sleep_request is not None:
             config["extractor"]["sleep-request"] = source_config.sleep_request
-        config["extractor"]["skip"] = source_config.skip_existing
+        config["extractor"]["skip"] = skip_value
 
         if source_config.save_metadata:
             config["extractor"]["postprocessors"] = [
@@ -360,7 +428,17 @@ class GalleryDLService:
         if return_code in (1, 4) and (skip_line_count > 0 or has_skip_text) and not has_actual_error:
             return ErrorType.NO_NEW_CONTENT, "No new content to download"
 
-        if return_code in (1, 4) and not has_actual_error:
+        # Tier-gated classification used to require `return_code in (1, 4)`,
+        # which silently fell through to UNKNOWN_ERROR when gallery-dl
+        # returned a different exit code for mixed-failure runs (e.g.
+        # paywall warnings + a missing yt-dlp dep flipping the exit bits).
+        # The artist then surfaced as "needs attention" purely because a
+        # paywall blocked posts the operator wasn't paying to see —
+        # operator-flagged 2026-05-31. Now: if no source-level error
+        # category fired AND tier-gated warnings are present, classify
+        # as TIER_LIMITED regardless of return code. Same priority order
+        # as before (auth/rate/access/not_found/network/http still win).
+        if not has_actual_error:
             tier_gated_lines = [
                 line for line in combined.split("\n")
                 if "][warning]" in line and "not allowed to view post" in line
@@ -372,6 +450,22 @@ class GalleryDLService:
                     f"Subscription tier does not grant access to {count} post{'s' if count != 1 else ''}",
                 )
 
+        # Partial-success: the subprocess exited non-zero (typically because
+        # the wall-clock timeout fired mid-walk), but it had downloaded ≥1
+        # file by then and no source-level error category fired. The work
+        # the run DID do is real; gallery-dl's archive will pick up where
+        # it left off on the next tick. Mapped to status="ok" downstream
+        # (download_service.py) so this doesn't flag the source as
+        # "needs attention." Operator-flagged 2026-06-01 after a Knuxy
+        # patreon run downloaded hundreds of files then ran red on timeout.
+        files_downloaded = self._count_downloaded_files(stdout)
+        if not has_actual_error and files_downloaded > 0:
+            return (
+                ErrorType.PARTIAL,
+                f"Downloaded {files_downloaded} file{'s' if files_downloaded != 1 else ''}; "
+                "run did not complete in budget — next tick will continue",
+            )
+
         return ErrorType.UNKNOWN_ERROR, f"Unknown error (return code: {return_code})"
 
     def _count_downloaded_files(self, stdout: str) -> int:
@@ -523,6 +617,7 @@ class GalleryDLService:
         source_config: SourceConfig | None = None,
         cookies_path: str | None = None,
         auth_token: str | None = None,
+        skip_value: bool | str = BACKFILL_SKIP_VALUE,
     ) -> DownloadResult:
         start_time = time.time()
         started_at = datetime.now(UTC).isoformat()
@@ -530,7 +625,9 @@ class GalleryDLService:
         if source_config is None:
             source_config = SourceConfig()
 
-        config = self._build_config_for_source(platform, source_config, artist_slug)
+        config = self._build_config_for_source(
+            platform, source_config, artist_slug, skip_value=skip_value,
+        )
 
         if cookies_path:
             config["extractor"]["cookies"] = cookies_path
@@ -632,13 +729,57 @@ class GalleryDLService:
                 started_at=started_at, completed_at=completed_at,
             )
 
-        except subprocess.TimeoutExpired:
+        except subprocess.TimeoutExpired as e:
             duration = time.time() - start_time
-            log.error("Download timeout for %s/%s after %.1fs", artist_slug, platform, duration)
+            # subprocess.run(text=True) makes these str if non-None, but the
+            # caller may have raised TimeoutExpired manually with None or
+            # bytes (tests do); coerce both cases to str.
+            partial_stdout = e.stdout or ""
+            partial_stderr = e.stderr or ""
+            if isinstance(partial_stdout, bytes):
+                partial_stdout = partial_stdout.decode("utf-8", "replace")
+            if isinstance(partial_stderr, bytes):
+                partial_stderr = partial_stderr.decode("utf-8", "replace")
+
+            files_so_far = self._count_downloaded_files(partial_stdout)
+            written_so_far = [str(p) for p in self._written_paths(partial_stdout)]
+            stderr_lines = partial_stderr.strip().splitlines()
+            tail_hint = stderr_lines[-1] if stderr_lines else "no stderr output"
+
+            # If the partial output already shows a rate-limit pattern, the
+            # timeout was almost certainly gallery-dl spinning on retries —
+            # promote to RATE_LIMITED so _update_source_health stamps the
+            # platform cooldown (same code path as a clean-exit rate limit).
+            # Otherwise stay TIMEOUT and let the captured stdout/stderr +
+            # files_so_far tell the operator whether it was "lots of
+            # content" vs "stuck retrying" vs "hung silent".
+            combined = (partial_stdout + "\n" + partial_stderr).lower()
+            if any(p in combined for p in self.RATE_LIMIT_PATTERNS):
+                error_type = ErrorType.RATE_LIMITED
+                error_message = (
+                    f"Rate-limited and never completed within "
+                    f"{source_config.timeout}s ({files_so_far} files written)"
+                )
+            else:
+                error_type = ErrorType.TIMEOUT
+                error_message = (
+                    f"Download timed out after {source_config.timeout}s — "
+                    f"{files_so_far} file(s) written; last stderr: {tail_hint}"
+                )
+
+            log.error(
+                "Download timeout for %s/%s after %.1fs (%d files written, "
+                "last stderr: %s)",
+                artist_slug, platform, duration, files_so_far, tail_hint,
+            )
+
             return DownloadResult(
                 success=False, url=url, artist_slug=artist_slug, platform=platform,
-                error_type=ErrorType.TIMEOUT,
-                error_message=f"Download timed out after {source_config.timeout} seconds",
+                files_downloaded=files_so_far,
+                written_paths=written_so_far,
+                stdout=partial_stdout, stderr=partial_stderr,
+                return_code=-1,  # killed by timeout, no real exit code
+                error_type=error_type, error_message=error_message,
                 duration_seconds=duration,
                 started_at=started_at,
                 completed_at=datetime.now(UTC).isoformat(),
@@ -658,3 +799,64 @@ class GalleryDLService:
                 Path(temp_config_path).unlink()  # noqa: ASYNC240
             except Exception:
                 pass
+
+    async def verify(
+        self,
+        url: str,
+        artist_slug: str,
+        platform: str,
+        source_config: SourceConfig | None = None,
+        cookies_path: str | None = None,
+        auth_token: str | None = None,
+        timeout: float = 45.0,  # noqa: ASYNC109 — subprocess.run timeout, not a coroutine deadline
+    ) -> tuple[bool, str]:
+        """Test that credentials authenticate against `url` WITHOUT
+        downloading anything. Runs gallery-dl in --simulate mode limited
+        to the first item; if auth is bad the extractor errors before it
+        can list, which _categorize_error flags as AUTH_ERROR. Returns
+        (ok, message). Used by the credential Verify button."""
+        if source_config is None:
+            source_config = SourceConfig()
+        config = self._build_config_for_source(platform, source_config, artist_slug)
+        if cookies_path:
+            config["extractor"]["cookies"] = cookies_path
+        if auth_token and platform == "discord":
+            config["extractor"].setdefault("discord", {})["token"] = auth_token
+        if auth_token and platform == "pixiv":
+            config["extractor"].setdefault("pixiv", {})["refresh-token"] = auth_token
+
+        with tempfile.NamedTemporaryFile(
+            mode="w", suffix=".json", delete=False, dir=str(self._config_dir),
+        ) as fh:
+            json.dump(config, fh, indent=2)
+            temp_config_path = fh.name
+        try:
+            cmd = [
+                sys.executable, "-m", "gallery_dl",
+                "--config", temp_config_path,
+                "--simulate", "--range", "1-1", "--verbose", url,
+            ]
+            loop = asyncio.get_running_loop()
+            proc = await loop.run_in_executor(
+                None,
+                lambda: subprocess.run(
+                    cmd, capture_output=True, text=True, timeout=timeout,
+                ),
+            )
+            etype, msg = self._categorize_error(proc.returncode, proc.stdout, proc.stderr)
+            if proc.returncode == 0 or etype == ErrorType.NO_NEW_CONTENT:
+                return True, "Credentials valid — the feed authenticated."
+            if etype == ErrorType.AUTH_ERROR:
+                return False, msg
+            # Network / not-found / rate-limit / unknown: inconclusive,
+            # not a definitive credential failure. Surface the reason.
+            return False, f"Could not confirm ({etype.value}): {msg}"
+        except subprocess.TimeoutExpired:
+            return False, f"Verification timed out after {timeout:.0f}s"
+        except Exception as exc:  # noqa: BLE001
+            return False, f"Verification error: {exc}"
+        finally:
+            try:
+                Path(temp_config_path).unlink()  # noqa: ASYNC240
+            except Exception:
+                pass

backend/app/services/gallery_service.py

@@ -20,8 +20,9 @@ from datetime import datetime
 
 from sqlalchemy import Select, and_, exists, func, or_, select
 from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy.orm import aliased
 
-from ..models import Artist, ImageProvenance, ImageRecord, Post, Source, Tag
+from ..models import Artist, ImageProvenance, ImageRecord, Post, Tag
 from ..models.tag import image_tag
 
 CURSOR_SEPARATOR = "|"
@@ -90,9 +91,27 @@ class TimelineBucket:
     count: int
 
 
-def thumbnail_url(sha256_hex: str, mime: str) -> str:
-    # Quart serves /images/* via the frontend blueprint (FC-1); thumbnails go
-    # under /images/thumbs/. The MIME determines the extension.
+def thumbnail_url(thumbnail_path: str | None, sha256_hex: str, mime: str) -> str:
+    """Return the URL to fetch a thumbnail.
+
+    Prefers the stored thumbnail_path verbatim — Quart serves /images/*
+    1:1 from the volume (frontend.py:20-36), so the URL IS the disk
+    path. Falls back to deriving from (sha256, mime) only when the
+    record's thumbnail_path is NULL (thumbnailer hasn't run yet); that
+    URL will 404 until backfill catches it, same as before the path
+    was tracked.
+
+    Pre-2026-05-30 this was derived only from (sha256, mime), which
+    disagreed with the actual on-disk extension when the thumbnailer
+    chose its format from transparency rather than MIME — every PNG
+    source without alpha (extension was .jpg on disk) and every WebP
+    source with alpha (extension was .png on disk) silently 404'd
+    despite the thumbnail file existing.
+    """
+    if thumbnail_path:
+        return thumbnail_path
+    # Fallback for records with no thumbnail recorded yet — preserves
+    # prior behavior (URL exists but 404s until backfill regenerates).
     ext = ".png" if mime in ("image/png", "image/gif") else ".jpg"
     bucket = sha256_hex[:3]
     return f"/images/thumbs/{bucket}/{sha256_hex}{ext}"
@@ -115,10 +134,23 @@ def _provenance_clause(post_id, artist_id):
             ImageProvenance.post_id == post_id,
         )
     if artist_id is not None:
+        # Use Post.artist_id (alembic 0030 denormalized column) instead
+        # of joining through ImageProvenance.source_id → Source.artist_id.
+        # The denormalization is the always-present linkage; the source
+        # path now drops NULL-source provenance rows (filesystem-imported
+        # content) which would otherwise vanish from artist-filtered
+        # gallery views.
+        # ALIAS Post: the gallery query outer-joins Post on
+        # ImageRecord.primary_post_id (`_outer_join_primary_post`).
+        # SQLAlchemy would otherwise correlate a bare `Post` reference
+        # in this EXISTS subquery to that outer Post (which is NULL for
+        # images with no primary post), and the filter would silently
+        # match nothing.
+        post_inner = aliased(Post)
         return exists().where(
             ImageProvenance.image_record_id == ImageRecord.id,
-            ImageProvenance.source_id == Source.id,
-            Source.artist_id == artist_id,
+            ImageProvenance.post_id == post_inner.id,
+            post_inner.artist_id == artist_id,
         )
     return None
 
@@ -198,7 +230,7 @@ class GalleryService:
                 created_at=record.created_at,
                 effective_date=eff_date,
                 posted_at=posted_at,
-                thumbnail_url=thumbnail_url(record.sha256, record.mime),
+                thumbnail_url=thumbnail_url(record.thumbnail_path, record.sha256, record.mime),
                 artist=artists.get(record.id),
             )
             for record, posted_at, eff_date in rows
@@ -306,7 +338,7 @@ class GalleryService:
             "integrity_status": record.integrity_status,
             "created_at": record.created_at.isoformat(),
             "posted_at": posted_at.isoformat() if posted_at else None,
-            "thumbnail_url": thumbnail_url(record.sha256, record.mime),
+            "thumbnail_url": thumbnail_url(record.thumbnail_path, record.sha256, record.mime),
             "image_url": f"/images/{record.path.split('/images/', 1)[-1]}",
             "artist": (
                 {"id": artist.id, "name": artist.name, "slug": artist.slug}

backend/app/services/importer.py

@@ -204,6 +204,32 @@ class Importer:
                 (phash, width or 0, height or 0, image_id)
             )
 
+    def _get_or_create(self, stmt, factory):
+        """Race-safe find-or-create. Run `stmt` (scalar_one_or_none); if a
+        row exists, return it. Otherwise open a savepoint and INSERT
+        ``factory()``; on IntegrityError (a concurrent worker inserted the
+        same row first) roll the savepoint back — NOT the outer transaction,
+        which would lose the surrounding scan's progress — and re-run `stmt`
+        (scalar_one) to return the row the other worker created.
+
+        Centralizes the pattern shared by _find_or_create_source and
+        _find_or_create_post. The plain SELECT-then-INSERT version lost
+        races under the 5-min recovery sweep (operator-flagged
+        2026-05-26)."""
+        existing = self.session.execute(stmt).scalar_one_or_none()
+        if existing is not None:
+            return existing
+        sp = self.session.begin_nested()
+        try:
+            row = factory()
+            self.session.add(row)
+            self.session.flush()
+            sp.commit()
+            return row
+        except IntegrityError:
+            sp.rollback()
+            return self.session.execute(stmt).scalar_one()
+
     def _find_or_create_source(
         self, *, artist_id: int, platform: str, url: str,
     ) -> Source:
@@ -222,53 +248,35 @@ class Importer:
         and re-select — the concurrent op just created the row we
         wanted, so the second select will find it.
         """
-        existing = self.session.execute(
-            select(Source).where(
-                Source.artist_id == artist_id,
-                Source.platform == platform,
-                Source.url == url,
-            )
-        ).scalar_one_or_none()
-        if existing is not None:
-            return existing
-        sp = self.session.begin_nested()
-        try:
-            row = Source(artist_id=artist_id, platform=platform, url=url)
-            self.session.add(row)
-            self.session.flush()
-            sp.commit()
-            return row
-        except IntegrityError:
-            sp.rollback()
-            return self.session.execute(
-                select(Source).where(
-                    Source.artist_id == artist_id,
-                    Source.platform == platform,
-                    Source.url == url,
-                )
-            ).scalar_one()
+        stmt = select(Source).where(
+            Source.artist_id == artist_id,
+            Source.platform == platform,
+            Source.url == url,
+        )
+        return self._get_or_create(
+            stmt,
+            lambda: Source(artist_id=artist_id, platform=platform, url=url),
+        )
 
-    def _source_for_sidecar(
-        self, *, artist_id: int, platform: str, artist_slug: str,
-    ) -> Source:
-        """Filesystem-import sidecar Source resolver.
+    def _lookup_source_for_sidecar(
+        self, *, artist_id: int, platform: str,
+    ) -> Source | None:
+        """Find the real subscription Source for (artist, platform), or
+        None if no subscription exists.
 
-        Source represents a subscription feed (one per artist+platform — the
-        gallery-dl URL polled by the FC-3 downloader). The filesystem importer
-        used to call _find_or_create_source(url=sd.post_url), which created
-        one Source row per post URL — 100s of junk Sources per artist, all
-        with enabled=True, polluting the artist detail page and tricking the
-        subscription checker into trying to poll patreon post URLs as feeds.
-        Operator-flagged 2026-05-26.
-
-        New behaviour: if any Source row exists for (artist_id, platform),
-        reuse it regardless of its URL — the artist's real subscription Source
-        (created by the downloader / extension / UI) is the canonical
-        attachment point for filesystem-imported posts. If none exists, create
-        ONE synthetic anchor with url='sidecar:<platform>:<artist_slug>' and
-        enabled=False (so the subscription checker doesn't poll it).
+        Pre-alembic-0030 this method would CREATE a synthetic
+        `sidecar:<platform>:<slug>` Source when no real one existed —
+        because `Post.source_id` was NOT NULL and the importer needed
+        something to attach Posts to. Alembic 0030 relaxed both
+        `Post.source_id` and `ImageProvenance.source_id` to nullable, so
+        synthetic anchors are obsolete; the importer now leaves
+        source_id as None when no subscription exists for the (artist,
+        platform). Operator-asked 2026-06-01: synthetic Sources had
+        leaked into the Subscriptions UI as phantom subscriptions and
+        the operator wanted the data model to truthfully say "this
+        content has no live subscription."
         """
-        existing = self.session.execute(
+        stmt = (
             select(Source)
             .where(
                 Source.artist_id == artist_id,
@@ -276,63 +284,39 @@ class Importer:
             )
             .order_by(Source.id.asc())
             .limit(1)
-        ).scalar_one_or_none()
-        if existing is not None:
-            return existing
-        synthetic_url = f"sidecar:{platform}:{artist_slug}"
-        sp = self.session.begin_nested()
-        try:
-            row = Source(
-                artist_id=artist_id,
-                platform=platform,
-                url=synthetic_url,
-                enabled=False,
-            )
-            self.session.add(row)
-            self.session.flush()
-            sp.commit()
-            return row
-        except IntegrityError:
-            sp.rollback()
-            return self.session.execute(
-                select(Source)
-                .where(
-                    Source.artist_id == artist_id,
-                    Source.platform == platform,
-                )
-                .order_by(Source.id.asc())
-                .limit(1)
-            ).scalar_one()
+        )
+        return self.session.execute(stmt).scalar_one_or_none()
 
     def _find_or_create_post(
-        self, *, source_id: int, external_post_id: str,
+        self, *, source_id: int | None, external_post_id: str,
+        artist_id: int,
     ) -> Post:
-        """Race-safe find-or-create on `post` keyed by
-        (source_id, external_post_id). Mirrors `_find_or_create_source`
-        — same savepoint + IntegrityError-recovery pattern."""
-        existing = self.session.execute(
-            select(Post).where(
+        """Race-safe find-or-create on `post`. Keyed by
+        (source_id, external_post_id) when source_id is set — the
+        `uq_post_source_external_id` constraint guards. For NULL-source
+        posts the existence check matches on (artist_id, external_post_id),
+        which the partial unique index `uq_post_artist_external_id_null_source`
+        (alembic 0030) guards. Same savepoint + IntegrityError-recovery
+        pattern as the rest of the helpers."""
+        if source_id is not None:
+            stmt = select(Post).where(
                 Post.source_id == source_id,
                 Post.external_post_id == external_post_id,
             )
-        ).scalar_one_or_none()
-        if existing is not None:
-            return existing
-        sp = self.session.begin_nested()
-        try:
-            row = Post(source_id=source_id, external_post_id=external_post_id)
-            self.session.add(row)
-            self.session.flush()
-            sp.commit()
-            return row
-        except IntegrityError:
-            sp.rollback()
-            return self.session.execute(
-                select(Post).where(
-                    Post.source_id == source_id,
-                    Post.external_post_id == external_post_id,
-                )
-            ).scalar_one()
+        else:
+            stmt = select(Post).where(
+                Post.source_id.is_(None),
+                Post.artist_id == artist_id,
+                Post.external_post_id == external_post_id,
+            )
+        return self._get_or_create(
+            stmt,
+            lambda: Post(
+                source_id=source_id,
+                artist_id=artist_id,
+                external_post_id=external_post_id,
+            ),
+        )
 
     def import_one(self, source: Path) -> ImportResult:
         """Dispatch by kind. Media → normal pipeline. Archive → extract
@@ -372,12 +356,14 @@ class Importer:
             return None
         sd = parse_sidecar(data)
         platform = sd.platform or "unknown"
-        src = self._source_for_sidecar(
-            artist_id=artist.id, platform=platform, artist_slug=artist.slug,
+        src = self._lookup_source_for_sidecar(
+            artist_id=artist.id, platform=platform,
         )
         epid = sd.external_post_id or sc.stem
         return self._find_or_create_post(
-            source_id=src.id, external_post_id=epid,
+            source_id=src.id if src else None,
+            external_post_id=epid,
+            artist_id=artist.id,
         )
 
     def _capture_attachment(
@@ -664,16 +650,34 @@ class Importer:
         them through. The sidecar JSON gallery-dl emits next to each
         downloaded file is read by `_apply_sidecar` via `find_sidecar`.
 
+        File-type dispatch parity with `import_one` (FC-2d-iii): zips,
+        PDFs, audio etc. become PostAttachments; archives are extracted.
+        Without this dispatch, gallery-dl-downloaded non-media bounced
+        back as `skipped+invalid_image`, which DownloadService counted
+        as an ingest error and flipped otherwise-successful runs to
+        status="error". Operator-flagged 2026-06-02 after a Lustria
+        patreon run with a 94MB OST zip went red despite 21 successful
+        image attaches.
+
         Caller's responsibilities after this returns:
           - duplicate_hash / duplicate_phash skip → delete the on-disk file
           - superseded → file stays where it is (now canonical)
           - imported → file stays where it is
+          - attached → the file's been copied into the attachments store;
+            caller may delete the on-disk original (mirrors duplicate_hash)
           - failed → file untouched; caller decides
         """
-        if not is_supported(path):
+        if path.suffix.lower() == ".json":
             return ImportResult(
                 status="skipped", skip_reason=SkipReason.invalid_image,
-                error=f"unsupported extension {path.suffix}",
+                error="sidecar json is metadata, not content",
+            )
+        if is_archive(path):
+            return self._import_archive(path)
+        if not is_supported(path):
+            post = self._post_for_sidecar(path, artist) if artist else None
+            return self._capture_attachment(
+                path, post=post, artist=artist, resolved=True,
             )
 
         # Format / dimension / transparency filters (mirror _import_media).
@@ -860,14 +864,15 @@ class Importer:
             src = explicit_source
         else:
             platform = sd.platform or "unknown"
-            src = self._source_for_sidecar(
+            src = self._lookup_source_for_sidecar(
                 artist_id=artist.id, platform=platform,
-                artist_slug=artist.slug,
             )
 
         epid = sd.external_post_id or sc.stem
         post = self._find_or_create_post(
-            source_id=src.id, external_post_id=epid,
+            source_id=src.id if src else None,
+            external_post_id=epid,
+            artist_id=artist.id,
         )
         if sd.post_url is not None:
             post.post_url = sd.post_url
@@ -903,7 +908,7 @@ class Importer:
                     ImageProvenance(
                         image_record_id=record.id,
                         post_id=post.id,
-                        source_id=src.id,
+                        source_id=src.id if src else None,
                         captured_metadata=sd.raw,
                     )
                 )

backend/app/services/migrators/__init__.py

@@ -1,10 +0,0 @@
-"""FC-5 migration tooling.
-
-One module per concern (gs/ir/overlap/ml_queue/verify/cleanup).
-Each migrator returns a counts dict; the run_migration task wires
-that dict into MigrationRun.counts so the UI polling shows progress.
-
-backup + rollback were retired in FC-3h (2026-05-24); first-class
-backup lives at backend/app/services/backup_service.py and exposes
-its own /api/system/backup/* surface.
-"""

backend/app/services/migrators/cleanup.py

@@ -1,182 +0,0 @@
-"""Targeted cleanup migrator: delete every image attributed to one Artist.
-
-Built for the IR-migration rescue case where the filesystem scan derived
-a bogus 'imagerepo' artist from a mismatched bind-mount layout. Every
-image attributed to that artist (40k+ rows) needs to be removed — DB
-rows, original files under `/images/<bucket>/...`, and thumbnails under
-`/images/thumbs/...` — before the operator remounts and re-scans.
-
-CASCADE handles image_tag, image_provenance, series_page, and
-tag_suggestion_rejection child rows; import_task.result_image_id is
-SET NULL by FK. We also delete ImportTask rows whose source_path starts
-with the (still-existing) IR scan prefix so the next scan isn't fooled
-by them.
-"""
-from __future__ import annotations
-
-import logging
-from pathlib import Path
-
-from sqlalchemy import delete, func, select
-from sqlalchemy.ext.asyncio import AsyncSession
-
-from ...models import Artist, ImageRecord, ImportBatch, ImportTask
-
-log = logging.getLogger(__name__)
-
-_BATCH_SIZE = 500
-
-
-def _zero_counts() -> dict:
-    return {
-        "rows_processed": 0, "rows_inserted": 0, "rows_skipped": 0,
-        "files_copied": 0, "bytes_copied": 0, "conflicts": 0,
-    }
-
-
-def _thumb_path(images_root: Path, sha256_hex: str) -> tuple[Path, Path]:
-    """Return both possible thumbnail paths (.jpg and .png). We try both
-    because the extension is chosen at generate-time based on the source
-    image's mode (alpha → .png, otherwise → .jpg)."""
-    bucket = sha256_hex[:3]
-    base = images_root / "thumbs" / bucket / sha256_hex
-    return base.with_suffix(".jpg"), base.with_suffix(".png")
-
-
-def _delete_file(path: Path) -> bool:
-    """Best-effort unlink; True if the file was actually removed."""
-    try:
-        path.unlink(missing_ok=True)
-        return True
-    except OSError as exc:
-        log.warning("cleanup: failed to unlink %s: %s", path, exc)
-        return False
-
-
-async def cleanup_artist_async(
-    db: AsyncSession,
-    *,
-    slug: str,
-    images_root: Path | None = None,
-    dry_run: bool = False,
-    source_path_prefix: str | None = None,
-) -> dict:
-    """Delete every image attributed to the Artist with this slug,
-    along with the artist row itself and any associated import tasks.
-
-    Args:
-        slug: artist.slug to target (e.g. 'imagerepo').
-        images_root: defaults to /images.
-        dry_run: skip filesystem + DB writes; still walk rows for counts.
-        source_path_prefix: if set, ImportTask rows whose source_path
-            starts with this string are deleted too (use the IR scan
-            mount prefix, e.g. '/import/imagerepo').
-    """
-    root = images_root if images_root is not None else Path("/images")
-
-    artist = (await db.execute(
-        select(Artist).where(Artist.slug == slug)
-    )).scalar_one_or_none()
-    if artist is None:
-        raise ValueError(f"no Artist with slug={slug!r}")
-
-    artist_id = artist.id
-    artist_name = artist.name
-
-    total_images = (await db.execute(
-        select(func.count(ImageRecord.id)).where(ImageRecord.artist_id == artist_id)
-    )).scalar_one()
-
-    counts = _zero_counts()
-    files_deleted = 0
-    thumbs_deleted = 0
-    images_deleted = 0
-
-    # Batched delete loop. CASCADE handles image_tag, image_provenance,
-    # series_page, tag_suggestion_rejection. import_task.result_image_id
-    # is SET NULL by FK.
-    while True:
-        rows = (await db.execute(
-            select(ImageRecord.id, ImageRecord.path, ImageRecord.sha256)
-            .where(ImageRecord.artist_id == artist_id)
-            .limit(_BATCH_SIZE)
-        )).all()
-        if not rows:
-            break
-
-        ids = [r.id for r in rows]
-        counts["rows_processed"] += len(ids)
-
-        if not dry_run:
-            for r in rows:
-                if r.path:
-                    if _delete_file(Path(r.path)):
-                        files_deleted += 1
-                if r.sha256:
-                    jpg, png = _thumb_path(root, r.sha256)
-                    if _delete_file(jpg):
-                        thumbs_deleted += 1
-                    if _delete_file(png):
-                        thumbs_deleted += 1
-
-            await db.execute(
-                delete(ImageRecord).where(ImageRecord.id.in_(ids))
-            )
-            await db.commit()
-
-        images_deleted += len(ids)
-
-        if dry_run:
-            # Nothing was actually deleted from the DB; bail after one
-            # pass so we don't loop forever.
-            break
-
-    import_tasks_deleted = 0
-    if source_path_prefix and not dry_run:
-        # Delete ImportTask rows whose source_path is under the bad mount
-        # prefix. These are mostly orphaned now (result_image_id was set
-        # NULL by CASCADE) but their presence still blocks the
-        # idempotency check in scan_directory if the operator remounts
-        # the same prefix.
-        like_pattern = source_path_prefix.rstrip("/") + "/%"
-        result = await db.execute(
-            delete(ImportTask).where(ImportTask.source_path.like(like_pattern))
-        )
-        import_tasks_deleted = result.rowcount or 0
-        await db.commit()
-
-    # Sweep ImportBatch rows that are now empty.
-    empty_batches_deleted = 0
-    if not dry_run:
-        empty_batch_ids = (await db.execute(
-            select(ImportBatch.id).where(
-                ~select(ImportTask.id)
-                .where(ImportTask.batch_id == ImportBatch.id)
-                .exists()
-            )
-        )).scalars().all()
-        if empty_batch_ids:
-            result = await db.execute(
-                delete(ImportBatch).where(ImportBatch.id.in_(empty_batch_ids))
-            )
-            empty_batches_deleted = result.rowcount or 0
-            await db.commit()
-
-    # Finally, the artist row.
-    if not dry_run:
-        await db.execute(delete(Artist).where(Artist.id == artist_id))
-        await db.commit()
-
-    return {
-        "counts": counts,
-        "artist": {"id": artist_id, "name": artist_name, "slug": slug},
-        "summary": {
-            "images_targeted": total_images,
-            "images_deleted": images_deleted,
-            "files_deleted": files_deleted,
-            "thumbs_deleted": thumbs_deleted,
-            "import_tasks_deleted": import_tasks_deleted,
-            "empty_batches_deleted": empty_batches_deleted,
-            "dry_run": dry_run,
-        },
-    }

backend/app/services/migrators/gs_ingest.py

@@ -1,126 +0,0 @@
-"""GallerySubscriber export → FabledCurator ingest.
-
-Reads a parsed gallerysubscriber-export-v1.json dict (no DB connection
-to GS). Creates Artist (from subscriptions) + Source (nested under each
-subscription) + Credential (re-encrypted with FC's key). Idempotent on
-natural keys: Artist.slug, (artist_id, platform, url), Credential.platform.
-
-Credentials arrive plaintext in the export — GS's export script
-decrypts using GS's Fernet key in GS's own process. FC re-encrypts
-with FC's CredentialCrypto.
-"""
-from __future__ import annotations
-
-import json
-
-from sqlalchemy import select
-from sqlalchemy.ext.asyncio import AsyncSession
-
-from ...models import Artist, Credential, Source
-from ...utils.slug import slugify
-from ..credential_crypto import CredentialCrypto
-
-
-def _zero_counts() -> dict:
-    return {
-        "rows_processed": 0, "rows_inserted": 0, "rows_skipped": 0,
-        "files_copied": 0, "bytes_copied": 0, "conflicts": 0,
-    }
-
-
-async def migrate_async(
-    db: AsyncSession,
-    *,
-    data: dict,
-    fc_crypto: CredentialCrypto | None = None,
-    dry_run: bool = False,
-) -> dict:
-    """Ingest a parsed gallerysubscriber-export-v1.json dict."""
-    if data.get("source_app") != "gallerysubscriber":
-        raise ValueError("export source_app must be 'gallerysubscriber'")
-    if data.get("schema_version") != 1:
-        raise ValueError(f"unsupported schema_version: {data.get('schema_version')}")
-
-    counts = _zero_counts()
-
-    # Phase 1: subscriptions → Artist; nested sources within each.
-    for sub in data.get("subscriptions", []):
-        counts["rows_processed"] += 1
-        slug = slugify(sub["name"])
-        artist = (await db.execute(
-            select(Artist).where(Artist.slug == slug)
-        )).scalar_one_or_none()
-        if artist is None:
-            if dry_run:
-                counts["rows_inserted"] += 1
-                # Continue to nested sources, but they can't link without an artist row.
-                continue
-            notes = json.dumps(sub.get("metadata"), indent=2) if sub.get("metadata") else None
-            artist = Artist(
-                name=sub["name"], slug=slug,
-                is_subscription=True,
-                auto_check=bool(sub.get("enabled", True)),
-                notes=notes,
-            )
-            db.add(artist)
-            await db.flush()
-            counts["rows_inserted"] += 1
-        else:
-            counts["rows_skipped"] += 1
-
-        # Nested sources under this subscription.
-        for src in sub.get("sources", []):
-            counts["rows_processed"] += 1
-            existing = (await db.execute(
-                select(Source).where(
-                    Source.artist_id == artist.id,
-                    Source.platform == src["platform"],
-                    Source.url == src["url"],
-                )
-            )).scalar_one_or_none()
-            if existing is not None:
-                counts["rows_skipped"] += 1
-                continue
-            if dry_run:
-                counts["rows_inserted"] += 1
-                continue
-            db.add(Source(
-                artist_id=artist.id,
-                platform=src["platform"],
-                url=src["url"],
-                enabled=bool(src.get("enabled", True)),
-                check_interval_override=src.get("check_interval"),
-                config_overrides=src.get("metadata") or {},
-            ))
-            counts["rows_inserted"] += 1
-
-    # Phase 2: credentials.
-    for cred in data.get("credentials", []):
-        counts["rows_processed"] += 1
-        existing = (await db.execute(
-            select(Credential).where(Credential.platform == cred["platform"])
-        )).scalar_one_or_none()
-        if existing is not None:
-            counts["rows_skipped"] += 1
-            continue
-        if dry_run:
-            counts["rows_inserted"] += 1
-            continue
-        if fc_crypto is None:
-            # Without a crypto helper we can't encrypt — skip rather than
-            # store plaintext.
-            counts["rows_skipped"] += 1
-            counts["conflicts"] += 1
-            continue
-        encrypted = fc_crypto.encrypt(cred["plaintext"])
-        db.add(Credential(
-            platform=cred["platform"],
-            credential_type=cred.get("credential_type") or "cookies",
-            encrypted_blob=encrypted,
-            expires_at=cred.get("expires_at"),
-        ))
-        counts["rows_inserted"] += 1
-
-    if not dry_run:
-        await db.commit()
-    return counts

backend/app/services/migrators/ir_ingest.py

@@ -1,146 +0,0 @@
-"""ImageRepo export → FabledCurator ingest.
-
-Reads a parsed imagerepo-export-v1.json dict (no DB connection to IR).
-Creates Tag rows (skipping artist/post kinds, resolving fandom_name to
-FK). Writes the per-image-sha256 artist assignments + tag associations
-+ series page assignments to /images/_migration_state/ir_tag_manifest.json
-so tag_apply.py can join them to ImageRecord rows AFTER the operator
-runs FC's filesystem scan.
-"""
-from __future__ import annotations
-
-import json
-from pathlib import Path
-
-from sqlalchemy import select
-from sqlalchemy.ext.asyncio import AsyncSession
-
-from ...models import Tag, TagKind
-
-_SKIP_KINDS = frozenset({"artist", "post"})
-_MIGRATION_STATE_DIRNAME = "_migration_state"
-_IR_MANIFEST_FILENAME = "ir_tag_manifest.json"
-
-
-def _zero_counts() -> dict:
-    return {
-        "rows_processed": 0, "rows_inserted": 0, "rows_skipped": 0,
-        "files_copied": 0, "bytes_copied": 0, "conflicts": 0,
-    }
-
-
-def manifest_path(images_root: Path | None = None) -> Path:
-    root = images_root if images_root is not None else Path("/images")
-    p = root / _MIGRATION_STATE_DIRNAME
-    p.mkdir(parents=True, exist_ok=True)
-    return p / _IR_MANIFEST_FILENAME
-
-
-async def _resolve_fandom_id(
-    db: AsyncSession, fandom_name: str | None, dry_run: bool,
-) -> int | None:
-    """Find-or-create a fandom-kind Tag by name."""
-    if not fandom_name:
-        return None
-    existing = (await db.execute(
-        select(Tag).where(Tag.name == fandom_name, Tag.kind == "fandom")
-    )).scalar_one_or_none()
-    if existing is not None:
-        return existing.id
-    if dry_run:
-        return None
-    t = Tag(name=fandom_name, kind=TagKind.fandom)
-    db.add(t)
-    await db.flush()
-    return t.id
-
-
-async def migrate_async(
-    db: AsyncSession,
-    *,
-    data: dict,
-    images_root: Path | None = None,
-    dry_run: bool = False,
-) -> dict:
-    """Ingest a parsed imagerepo-export-v1.json dict.
-
-    Creates Tag rows + writes the IR tag manifest file. Tag-to-image
-    binding happens later in tag_apply.py (after FC's filesystem scan
-    populates image_record.sha256 → id).
-    """
-    if data.get("source_app") != "imagerepo":
-        raise ValueError("export source_app must be 'imagerepo'")
-    if data.get("schema_version") not in (1, 2):
-        raise ValueError(f"unsupported schema_version: {data.get('schema_version')}")
-
-    counts = _zero_counts()
-
-    # Phase 1: tags (skip artist + post kinds; resolve fandom_name → fandom_id).
-    # First pass: create all fandom-kind tags so they're available for FK resolution.
-    for tag in data.get("tags", []):
-        kind = tag.get("kind") or "general"
-        if kind != "fandom":
-            continue
-        counts["rows_processed"] += 1
-        existing = (await db.execute(
-            select(Tag).where(Tag.name == tag["name"], Tag.kind == "fandom")
-        )).scalar_one_or_none()
-        if existing is not None:
-            counts["rows_skipped"] += 1
-            continue
-        if dry_run:
-            counts["rows_inserted"] += 1
-            continue
-        db.add(Tag(name=tag["name"], kind=TagKind.fandom))
-        counts["rows_inserted"] += 1
-    if not dry_run:
-        await db.flush()
-
-    # Second pass: every other kind.
-    for tag in data.get("tags", []):
-        kind_str = tag.get("kind") or "general"
-        if kind_str in _SKIP_KINDS:
-            counts["rows_skipped"] += 1
-            continue
-        if kind_str == "fandom":
-            continue  # handled above
-        counts["rows_processed"] += 1
-        try:
-            kind = TagKind(kind_str)
-        except ValueError:
-            kind = TagKind.general
-        fandom_id = await _resolve_fandom_id(db, tag.get("fandom_name"), dry_run)
-        existing = (await db.execute(
-            select(Tag).where(Tag.name == tag["name"], Tag.kind == kind)
-        )).scalar_one_or_none()
-        if existing is not None:
-            counts["rows_skipped"] += 1
-            continue
-        if dry_run:
-            counts["rows_inserted"] += 1
-            continue
-        db.add(Tag(name=tag["name"], kind=kind, fandom_id=fandom_id))
-        counts["rows_inserted"] += 1
-
-    if not dry_run:
-        await db.commit()
-
-    # Phase 2: write the per-image manifest for tag_apply.py to consume later.
-    # schema_version 2 (added 2026-05-24) carries `image_posts` for
-    # Post + Source + ImageProvenance restore; schema 1 manifests
-    # without it stay valid (tag_apply treats the missing field as []).
-    manifest = {
-        "schema_version": data.get("schema_version", 1),
-        "image_artist_assignments": data.get("image_artist_assignments", []),
-        "image_tag_associations": data.get("image_tag_associations", []),
-        "series_pages": data.get("series_pages", []),
-        "image_posts": data.get("image_posts", []),
-    }
-    counts["rows_processed"] += len(manifest["image_artist_assignments"])
-    counts["rows_processed"] += len(manifest["image_tag_associations"])
-    counts["rows_processed"] += len(manifest["series_pages"])
-    counts["rows_processed"] += len(manifest["image_posts"])
-    if not dry_run:
-        manifest_path(images_root).write_text(json.dumps(manifest, indent=2))
-
-    return counts

backend/app/services/migrators/ml_queue.py

@@ -1,21 +0,0 @@
-"""Queue every migrated image_record with no embedding for ML re-processing."""
-from __future__ import annotations
-
-from sqlalchemy import select
-from sqlalchemy.ext.asyncio import AsyncSession
-
-from ...models import ImageRecord
-
-
-async def queue_all_unprocessed_async(db: AsyncSession) -> int:
-    """Find every ImageRecord with siglip_embedding IS NULL, fire
-    tag_and_embed.delay(id) for each. Returns count queued.
-    """
-    from ...tasks.ml import tag_and_embed
-
-    rows = (await db.execute(
-        select(ImageRecord.id).where(ImageRecord.siglip_embedding.is_(None))
-    )).scalars().all()
-    for image_id in rows:
-        tag_and_embed.delay(image_id)
-    return len(rows)

backend/app/services/migrators/tag_apply.py

@@ -1,368 +0,0 @@
-"""Apply the IR tag manifest after FC's filesystem scan.
-
-Reads /images/_migration_state/ir_tag_manifest.json and joins each entry
-to an ImageRecord row by sha256 (which exists after the operator runs
-FC's filesystem scan over the mounted IR images dir).
-
-- image_artist_assignments → ImageRecord.artist_id (find_or_create Artist by slug).
-- image_tag_associations  → image_tag insert (idempotent).
-- series_pages            → series_page insert (idempotent on image_id unique).
-- image_posts (schema v2) → Source + Post + ImageProvenance restore.
-
-Unmatched sha256s are logged into the result's `unmatched` list so the
-Celery task can drop them into MigrationRun.metadata for the operator
-to inspect.
-"""
-from __future__ import annotations
-
-import json
-from datetime import datetime
-from pathlib import Path
-
-from sqlalchemy import select
-from sqlalchemy.ext.asyncio import AsyncSession
-
-from ...models import (
-    Artist,
-    ImageProvenance,
-    ImageRecord,
-    Post,
-    SeriesPage,
-    Source,
-    Tag,
-    TagKind,
-    image_tag,
-)
-from ...utils.slug import slugify
-from .ir_ingest import manifest_path
-
-# Per-platform artist-profile URL — used as Source.url when restoring
-# IR PostMetadata into FC. Must cover every platform that
-# backend/app/services/extension_service.py:_PLATFORM_PATTERNS
-# recognizes; an entry missing here silently drops ALL PostMetadata for
-# that platform during phase 4 (operator hit this 2026-05-25:
-# DeviantArt + Pixiv posts in the IR migration produced empty
-# ImageProvenance because they fell through this table).
-#
-# Pixiv caveat: the real profile URL takes a numeric user_id
-# (https://www.pixiv.net/users/12345), but IR's PostMetadata.artist
-# stores the display name not the id. We use the slugified name here
-# so we preserve the artist→post→image linkage; the resulting Source.url
-# won't resolve in a browser and the operator may want to manually fix
-# it via Settings → Subscriptions once the migration lands.
-_PLATFORM_PROFILE_URL = {
-    "patreon":       "https://www.patreon.com/{slug}",
-    "subscribestar": "https://www.subscribestar.com/{slug}",
-    "hentaifoundry": "https://www.hentai-foundry.com/user/{slug}",
-    "deviantart":    "https://www.deviantart.com/{slug}",
-    "pixiv":         "https://www.pixiv.net/users/{slug}",
-}
-
-
-def _profile_url(platform: str, artist_slug: str) -> str | None:
-    fmt = _PLATFORM_PROFILE_URL.get(platform)
-    return fmt.format(slug=artist_slug) if fmt else None
-
-
-async def _find_or_create_source(
-    db: AsyncSession, *, artist_id: int, platform: str, url: str, dry_run: bool,
-) -> int | None:
-    existing = (await db.execute(
-        select(Source.id).where(
-            Source.artist_id == artist_id,
-            Source.platform == platform,
-            Source.url == url,
-        )
-    )).scalar_one_or_none()
-    if existing is not None:
-        return existing
-    if dry_run:
-        return None
-    s = Source(artist_id=artist_id, platform=platform, url=url, enabled=False)
-    db.add(s)
-    await db.flush()
-    return s.id
-
-
-async def _find_or_create_post(
-    db: AsyncSession, *,
-    source_id: int, external_post_id: str,
-    title: str | None, description: str | None, post_url: str | None,
-    post_date_iso: str | None, attachment_count: int, dry_run: bool,
-) -> int | None:
-    existing = (await db.execute(
-        select(Post.id).where(
-            Post.source_id == source_id,
-            Post.external_post_id == external_post_id,
-        )
-    )).scalar_one_or_none()
-    if existing is not None:
-        return existing
-    if dry_run:
-        return None
-    post_date = None
-    if post_date_iso:
-        post_date = datetime.fromisoformat(post_date_iso)
-    p = Post(
-        source_id=source_id,
-        external_post_id=external_post_id,
-        post_title=title,
-        description=description,
-        post_url=post_url,
-        post_date=post_date,
-        attachment_count=attachment_count,
-        raw_metadata={"migrated_from": "imagerepo"},
-    )
-    db.add(p)
-    await db.flush()
-    return p.id
-
-
-async def _ensure_provenance(
-    db: AsyncSession, *,
-    image_id: int, post_id: int, source_id: int, dry_run: bool,
-) -> bool:
-    """Returns True if a new ImageProvenance row was inserted.
-
-    Also sets ImageRecord.primary_post_id to this post if the image
-    doesn't already have one — preserves any primary_post_id already
-    assigned at download time by the importer (don't clobber). This is
-    the linkage gallery_service.py uses to surface Post.post_date as
-    the image's effective date for sort/group/jump/neighbor nav.
-    """
-    existing = (await db.execute(
-        select(ImageProvenance.id).where(
-            ImageProvenance.image_record_id == image_id,
-            ImageProvenance.post_id == post_id,
-            ImageProvenance.source_id == source_id,
-        )
-    )).scalar_one_or_none()
-
-    # Whether-or-not the provenance row already exists, ensure the
-    # image's primary_post_id is set so the gallery date-coalesce works.
-    # Idempotent: only writes when currently NULL.
-    if not dry_run:
-        await db.execute(
-            ImageRecord.__table__.update()
-            .where(ImageRecord.id == image_id)
-            .where(ImageRecord.primary_post_id.is_(None))
-            .values(primary_post_id=post_id)
-        )
-
-    if existing is not None:
-        return False
-    if dry_run:
-        return True
-    db.add(ImageProvenance(
-        image_record_id=image_id, post_id=post_id, source_id=source_id,
-    ))
-    await db.flush()
-    return True
-
-
-def _zero_counts() -> dict:
-    return {
-        "rows_processed": 0, "rows_inserted": 0, "rows_skipped": 0,
-        "files_copied": 0, "bytes_copied": 0, "conflicts": 0,
-    }
-
-
-async def _ensure_artist_id(
-    db: AsyncSession, artist_name: str, dry_run: bool,
-) -> int | None:
-    if not artist_name or not artist_name.strip():
-        return None
-    slug = slugify(artist_name)
-    existing = (await db.execute(
-        select(Artist).where(Artist.slug == slug)
-    )).scalar_one_or_none()
-    if existing is not None:
-        return existing.id
-    if dry_run:
-        return None
-    a = Artist(name=artist_name, slug=slug, is_subscription=False)
-    db.add(a)
-    await db.flush()
-    return a.id
-
-
-async def _resolve_tag_id(
-    db: AsyncSession, tag_name: str, tag_kind: str,
-) -> int | None:
-    try:
-        kind = TagKind(tag_kind)
-    except ValueError:
-        kind = TagKind.general
-    row = (await db.execute(
-        select(Tag.id).where(Tag.name == tag_name, Tag.kind == kind)
-    )).scalar_one_or_none()
-    return row
-
-
-async def _sha_to_image_id(db: AsyncSession, sha: str) -> int | None:
-    return (await db.execute(
-        select(ImageRecord.id).where(ImageRecord.sha256 == sha)
-    )).scalar_one_or_none()
-
-
-async def apply_async(
-    db: AsyncSession,
-    *,
-    images_root: Path | None = None,
-    dry_run: bool = False,
-) -> dict:
-    """Apply the manifest. Returns counts + an `unmatched` list of sha256s."""
-    mf_path = manifest_path(images_root)
-    if not mf_path.exists():
-        raise FileNotFoundError(f"no IR tag manifest at {mf_path}")
-
-    manifest = json.loads(mf_path.read_text())
-    counts = _zero_counts()
-    unmatched: list[dict] = []
-
-    # 1. Artist assignments.
-    for entry in manifest.get("image_artist_assignments", []):
-        counts["rows_processed"] += 1
-        img_id = await _sha_to_image_id(db, entry["sha256"])
-        if img_id is None:
-            unmatched.append({"kind": "artist", **entry})
-            counts["rows_skipped"] += 1
-            continue
-        aid = await _ensure_artist_id(db, entry["artist_name"], dry_run)
-        if aid is None:
-            counts["rows_skipped"] += 1
-            continue
-        if dry_run:
-            counts["rows_inserted"] += 1
-            continue
-        img = await db.get(ImageRecord, img_id)
-        if img is not None and img.artist_id != aid:
-            img.artist_id = aid
-            counts["rows_inserted"] += 1
-        else:
-            counts["rows_skipped"] += 1
-
-    # 2. Tag associations.
-    for entry in manifest.get("image_tag_associations", []):
-        counts["rows_processed"] += 1
-        img_id = await _sha_to_image_id(db, entry["sha256"])
-        if img_id is None:
-            unmatched.append({"kind": "tag", **entry})
-            counts["rows_skipped"] += 1
-            continue
-        tag_id = await _resolve_tag_id(
-            db, entry["tag_name"], entry.get("tag_kind") or "general",
-        )
-        if tag_id is None:
-            counts["rows_skipped"] += 1
-            continue
-        # Skip if association already exists.
-        already = (await db.execute(
-            select(image_tag.c.image_record_id).where(
-                image_tag.c.image_record_id == img_id,
-                image_tag.c.tag_id == tag_id,
-            )
-        )).first()
-        if already is not None:
-            counts["rows_skipped"] += 1
-            continue
-        if dry_run:
-            counts["rows_inserted"] += 1
-            continue
-        await db.execute(image_tag.insert().values(
-            image_record_id=img_id, tag_id=tag_id, source="manual",
-        ))
-        counts["rows_inserted"] += 1
-
-    # 3. Series pages.
-    for entry in manifest.get("series_pages", []):
-        counts["rows_processed"] += 1
-        img_id = await _sha_to_image_id(db, entry["sha256"])
-        if img_id is None:
-            unmatched.append({"kind": "series", **entry})
-            counts["rows_skipped"] += 1
-            continue
-        series_tag_id = await _resolve_tag_id(db, entry["series_tag_name"], "series")
-        if series_tag_id is None:
-            counts["rows_skipped"] += 1
-            continue
-        existing = (await db.execute(
-            select(SeriesPage).where(SeriesPage.image_id == img_id)
-        )).scalar_one_or_none()
-        if existing is not None:
-            counts["rows_skipped"] += 1
-            continue
-        if dry_run:
-            counts["rows_inserted"] += 1
-            continue
-        db.add(SeriesPage(
-            series_tag_id=series_tag_id,
-            image_id=img_id,
-            page_number=entry["page_number"],
-        ))
-        counts["rows_inserted"] += 1
-
-    # 4. Image posts (schema v2) → Source + Post + ImageProvenance.
-    # Restores IR PostMetadata as FC's downloader-track provenance,
-    # so the modal's ProvenancePanel surfaces title/description/
-    # source URL/publish date the same way it does for live
-    # gallery-dl downloads.
-    for entry in manifest.get("image_posts", []):
-        counts["rows_processed"] += 1
-        platform = entry.get("platform")
-        artist_name = entry.get("artist")
-        if not platform or not artist_name:
-            counts["rows_skipped"] += 1
-            continue
-
-        aid = await _ensure_artist_id(db, artist_name, dry_run)
-        if aid is None:
-            counts["rows_skipped"] += 1
-            continue
-
-        url = _profile_url(platform, slugify(artist_name))
-        if url is None:
-            counts["rows_skipped"] += 1
-            continue
-
-        source_id = await _find_or_create_source(
-            db, artist_id=aid, platform=platform, url=url, dry_run=dry_run,
-        )
-        if source_id is None:
-            counts["rows_skipped"] += 1
-            continue
-
-        post_id = await _find_or_create_post(
-            db, source_id=source_id,
-            external_post_id=entry.get("post_id") or "",
-            title=entry.get("title"),
-            description=entry.get("description"),
-            post_url=entry.get("source_url"),
-            post_date_iso=entry.get("published_at"),
-            attachment_count=entry.get("attachment_count") or 0,
-            dry_run=dry_run,
-        )
-        if post_id is None:
-            counts["rows_skipped"] += 1
-            continue
-
-        for sha in entry.get("image_sha256s", []):
-            img_id = await _sha_to_image_id(db, sha)
-            if img_id is None:
-                unmatched.append({
-                    "kind": "post", "sha256": sha,
-                    "post_id": entry.get("post_id"),
-                })
-                continue
-            inserted = await _ensure_provenance(
-                db, image_id=img_id, post_id=post_id,
-                source_id=source_id, dry_run=dry_run,
-            )
-            if inserted:
-                counts["rows_inserted"] += 1
-            else:
-                counts["rows_skipped"] += 1
-
-    if not dry_run:
-        await db.commit()
-    return {"counts": counts, "unmatched": unmatched}

backend/app/services/migrators/verify.py

@@ -1,80 +0,0 @@
-"""Post-migration verification: row counts + sha256 sampling."""
-from __future__ import annotations
-
-import hashlib
-from pathlib import Path
-
-from sqlalchemy import func, select
-from sqlalchemy.ext.asyncio import AsyncSession
-
-from ...models import Artist, Credential, ImageRecord, Source, Tag
-
-
-async def verify_async(db: AsyncSession, *, expected: dict | None = None) -> dict:
-    """Return per-check status dicts. `expected` is optional row-count
-    assertions; checks default to status='ok' when no expected provided."""
-    expected = expected or {}
-    results: dict[str, dict] = {}
-
-    checks = {
-        "artist_subscriptions": (
-            select(func.count(Artist.id)).where(Artist.is_subscription.is_(True))
-        ),
-        "source_count": select(func.count(Source.id)),
-        "credential_count": select(func.count(Credential.id)),
-        "tag_count": select(func.count(Tag.id)),
-        "image_record_imported_or_downloaded": (
-            select(func.count(ImageRecord.id))
-            .where(ImageRecord.origin.in_(["imported_filesystem", "downloaded"]))
-        ),
-    }
-    for name, stmt in checks.items():
-        actual = (await db.execute(stmt)).scalar_one()
-        exp = expected.get(name)
-        status = "ok" if exp is None or exp == actual else "mismatch"
-        results[name] = {"status": status, "actual": int(actual), "expected": exp}
-    return results
-
-
-async def verify_sha256_sample(
-    db: AsyncSession, *, sample_size: int = 20,
-) -> dict:
-    """Sample N image_records; verify file exists + sha256 matches."""
-    rows = (await db.execute(
-        select(ImageRecord.id, ImageRecord.path, ImageRecord.sha256)
-        .order_by(func.random()).limit(sample_size)
-    )).all()
-
-    matched = 0
-    mismatched = 0
-    missing = 0
-    samples: list[dict] = []
-    for img_id, path, expected_sha in rows:
-        p = Path(path)
-        # Sync stdlib filesystem ops are intentional: this verify pass runs
-        # inside a Celery task under asyncio.run; no other awaitables compete
-        # for the loop. Same pattern as download_service.py.
-        if not p.exists():  # noqa: ASYNC240
-            missing += 1
-            samples.append({"id": img_id, "path": path, "result": "missing"})
-            continue
-        h = hashlib.sha256()
-        with p.open("rb") as f:  # noqa: ASYNC230
-            for chunk in iter(lambda: f.read(65536), b""):
-                h.update(chunk)
-        if h.hexdigest() == expected_sha:
-            matched += 1
-            samples.append({"id": img_id, "result": "ok"})
-        else:
-            mismatched += 1
-            samples.append({
-                "id": img_id, "path": path, "result": "mismatch",
-                "expected_sha": expected_sha, "actual_sha": h.hexdigest(),
-            })
-    return {
-        "sample_size": len(rows),
-        "matched": matched,
-        "mismatched": mismatched,
-        "missing": missing,
-        "samples": samples,
-    }

backend/app/services/ml/suggestions.py

@@ -48,11 +48,11 @@ class SuggestionService:
         ).scalar_one()
 
     def _threshold_for(self, s: MLSettings, category: str) -> float:
-        # 'artist' intentionally absent (FC-2d-vii-c) — falls through to
-        # the 1.01 "never surfaces" default like any unsurfaced category.
+        # 'artist' (FC-2d-vii-c) and 'copyright' (2026-06-01) retired;
+        # both fall through to the 1.01 "never surfaces" default like any
+        # unsurfaced category.
         return {
             "character": s.suggestion_threshold_character,
-            "copyright": s.suggestion_threshold_copyright,
             "general": s.suggestion_threshold_general,
         }.get(category, 1.01)
 

backend/app/services/ml/tagger.py

@@ -38,10 +38,13 @@ STORE_FLOOR = float(os.environ.get("TAGGER_STORE_FLOOR", "0.05"))
 
 # The categories FC-2b surfaces in the UI. Others (meta/rating/year) are
 # still stored but the suggestion service filters them out.
-# FC-2d-vii-c: 'artist' retired — artist identity is acquisition-derived
-# (image_record.artist_id), never ML-inferred. Raw predictions are still
-# stored at STORE_FLOOR but artist never surfaces.
-SURFACED_CATEGORIES = {"character", "copyright", "general"}
+# 'artist' retired in FC-2d-vii-c — artist identity is acquisition-derived
+# (image_record.artist_id), never ML-inferred. 'copyright' retired
+# 2026-06-01 — operator doesn't use the copyright tag-kind; fandom is
+# this app's franchise/series concept (per TagsView.vue's doc comment).
+# Raw predictions for both categories still get stored at STORE_FLOOR but
+# don't surface in suggestions.
+SURFACED_CATEGORIES = {"character", "general"}
 
 # ImageNet preprocessing constants (per Camie v2 onnx_inference.py).
 _IMAGENET_MEAN = np.array([0.485, 0.456, 0.406], dtype=np.float32)

backend/app/services/platforms/base.py

@@ -96,10 +96,12 @@ def str_field(v) -> str | None:
 # Shared gallery-dl invocation defaults. Embedded in each platform's
 # default_config (with platform-specific overrides) so per-platform
 # choices stay explicit.
+# Note: the gallery-dl `skip` value (tick "exit:20" vs backfill True) is
+# NOT here — it's derived from Source.backfill_runs_remaining at download
+# time. See plan #544 / gallery_dl.TICK_SKIP_VALUE,BACKFILL_SKIP_VALUE.
 GD_DEFAULTS = {
     "sleep": 3.0,
     "sleep_request": 1.5,
-    "skip_existing": True,
     "save_metadata": True,
     "timeout": 3600,
 }

backend/app/services/post_feed_service.py

@@ -56,38 +56,67 @@ class PostFeedService:
         artist_id: int | None = None,
         platform: str | None = None,
         limit: int = 24,
+        direction: str = "older",
     ) -> dict:
+        """Paginate the feed from `cursor`. direction='older' walks back in
+        time (default, infinite-scroll down); direction='newer' walks forward
+        (scroll up in an anchored view). Items are always returned in feed
+        (descending) order; `next_cursor` points to the far edge in the
+        requested direction (null when exhausted)."""
         if limit < 1 or limit > 100:
             raise ValueError("limit must be between 1 and 100")
+        if direction not in ("older", "newer"):
+            raise ValueError("direction must be 'older' or 'newer'")
 
         sort_key = _sort_key()
+        # Artist via the denormalized Post.artist_id (alembic 0030);
+        # Source via LEFT JOIN since post.source_id can now be NULL for
+        # filesystem-imported posts with no live subscription. A
+        # platform= filter implicitly excludes NULL-source posts (they
+        # have no platform); an artist_id= filter still surfaces them
+        # because Post.artist_id is always set.
         stmt = (
             select(Post, Artist, Source)
-            .join(Source, Post.source_id == Source.id)
-            .join(Artist, Source.artist_id == Artist.id)
+            .join(Artist, Post.artist_id == Artist.id)
+            .outerjoin(Source, Post.source_id == Source.id)
         )
         if artist_id is not None:
-            stmt = stmt.where(Source.artist_id == artist_id)
+            stmt = stmt.where(Post.artist_id == artist_id)
         if platform is not None:
             stmt = stmt.where(Source.platform == platform)
         if cursor:
             cur_ts, cur_id = decode_cursor(cursor)
-            stmt = stmt.where(
-                or_(
+            if direction == "older":
+                stmt = stmt.where(or_(
                     sort_key < cur_ts,
                     and_(sort_key == cur_ts, Post.id < cur_id),
-                )
-            )
+                ))
+            else:
+                stmt = stmt.where(or_(
+                    sort_key > cur_ts,
+                    and_(sort_key == cur_ts, Post.id > cur_id),
+                ))
 
-        stmt = stmt.order_by(sort_key.desc(), Post.id.desc()).limit(limit + 1)
+        if direction == "older":
+            stmt = stmt.order_by(sort_key.desc(), Post.id.desc())
+        else:
+            stmt = stmt.order_by(sort_key.asc(), Post.id.asc())
+        stmt = stmt.limit(limit + 1)
         rows = (await self.session.execute(stmt)).all()
 
+        has_more = len(rows) > limit
+        rows = rows[:limit]
+        if direction == "newer":
+            # Fetched ascending (closest-newer first); flip to feed order.
+            rows = list(reversed(rows))
+
         next_cursor: str | None = None
-        if len(rows) > limit:
-            last_post, _, _ = rows[limit - 1]
-            last_key = last_post.post_date or last_post.downloaded_at
-            next_cursor = encode_cursor(last_key, last_post.id)
-            rows = rows[:limit]
+        if has_more and rows:
+            # Far edge in the travel direction: oldest row going older,
+            # newest row going newer (rows is descending for display).
+            edge_post = rows[-1][0] if direction == "older" else rows[0][0]
+            edge_key = edge_post.post_date or edge_post.downloaded_at
+            next_cursor = encode_cursor(edge_key, edge_post.id)
 
         post_ids = [p.id for p, _, _ in rows]
         thumbs_map = await self._thumbnails_for(post_ids)
@@ -99,11 +128,54 @@ class PostFeedService:
         ]
         return {"items": items, "next_cursor": next_cursor}
 
+    async def around(
+        self,
+        *,
+        post_id: int,
+        artist_id: int | None = None,
+        platform: str | None = None,
+        limit: int = 12,
+    ) -> dict | None:
+        """A window centered on `post_id`: up to `limit` newer posts + the
+        post + up to `limit` older posts, in feed (descending) order, with a
+        cursor for each end. Returns None if the post doesn't exist."""
+        anchor = (await self.session.execute(
+            select(Post, Artist, Source)
+            .join(Artist, Post.artist_id == Artist.id)
+            .outerjoin(Source, Post.source_id == Source.id)
+            .where(Post.id == post_id)
+        )).one_or_none()
+        if anchor is None:
+            return None
+        anchor_post, anchor_artist, anchor_source = anchor
+        anchor_key = anchor_post.post_date or anchor_post.downloaded_at
+        anchor_cursor = encode_cursor(anchor_key, anchor_post.id)
+
+        older = await self.scroll(
+            cursor=anchor_cursor, artist_id=artist_id, platform=platform,
+            limit=limit, direction="older",
+        )
+        newer = await self.scroll(
+            cursor=anchor_cursor, artist_id=artist_id, platform=platform,
+            limit=limit, direction="newer",
+        )
+        thumbs_map = await self._thumbnails_for([anchor_post.id])
+        atts_map = await self._attachments_for([anchor_post.id])
+        anchor_item = self._to_dict(
+            anchor_post, anchor_artist, anchor_source, thumbs_map, atts_map,
+        )
+        return {
+            "items": newer["items"] + [anchor_item] + older["items"],
+            "cursor_older": older["next_cursor"],
+            "cursor_newer": newer["next_cursor"],
+            "anchor_id": anchor_post.id,
+        }
+
     async def get_post(self, post_id: int) -> dict | None:
         row = (await self.session.execute(
             select(Post, Artist, Source)
-            .join(Source, Post.source_id == Source.id)
-            .join(Artist, Source.artist_id == Artist.id)
+            .join(Artist, Post.artist_id == Artist.id)
+            .outerjoin(Source, Post.source_id == Source.id)
             .where(Post.id == post_id)
         )).one_or_none()
         if row is None:
@@ -141,6 +213,7 @@ class PostFeedService:
                 ImageRecord.primary_post_id,
                 ImageRecord.sha256,
                 ImageRecord.mime,
+                ImageRecord.thumbnail_path,
                 func.row_number().over(
                     partition_by=ImageRecord.primary_post_id,
                     order_by=ImageRecord.id.asc(),
@@ -154,18 +227,18 @@ class PostFeedService:
         )
         stmt = select(
             ranked.c.id, ranked.c.primary_post_id,
-            ranked.c.sha256, ranked.c.mime, ranked.c.total,
+            ranked.c.sha256, ranked.c.mime, ranked.c.thumbnail_path, ranked.c.total,
         )
         if limit is not None:
             stmt = stmt.where(ranked.c.rn <= limit)
         rows = (await self.session.execute(stmt)).all()
 
         out: dict[int, dict] = {pid: {"thumbs": [], "more": 0} for pid in post_ids}
-        for img_id, pid, sha, mime, total in rows:
+        for img_id, pid, sha, mime, tp, total in rows:
             entry = out.setdefault(pid, {"thumbs": [], "more": 0})
             entry["thumbs"].append({
                 "image_id": img_id,
-                "thumbnail_url": thumbnail_url(sha, mime),
+                "thumbnail_url": thumbnail_url(tp, sha, mime),
                 "mime": mime,
             })
             # `total` is constant per partition; overflow = total - THUMBNAIL_LIMIT.
@@ -193,7 +266,7 @@ class PostFeedService:
         return out
 
     def _to_dict(
-        self, post: Post, artist: Artist, source: Source,
+        self, post: Post, artist: Artist, source: Source | None,
         thumbs_map: dict, atts_map: dict,
     ) -> dict:
         plain_full = html_to_plain(post.description) if post.description else None
@@ -202,6 +275,9 @@ class PostFeedService:
         else:
             description_plain, truncated = truncate_at_word(plain_full, DESCRIPTION_LIMIT)
         thumbs_entry = thumbs_map.get(post.id, {"thumbs": [], "more": 0})
+        # `source` is null for filesystem-imported posts with no live
+        # subscription (alembic 0030). Frontend renders that as a
+        # "filesystem import" affordance instead of a platform chip.
         return {
             "id": post.id,
             "external_post_id": post.external_post_id,
@@ -212,7 +288,10 @@ class PostFeedService:
             "description_plain": description_plain,
             "description_truncated": truncated,
             "artist": {"id": artist.id, "name": artist.name, "slug": artist.slug},
-            "source": {"id": source.id, "platform": source.platform},
+            "source": (
+                {"id": source.id, "platform": source.platform}
+                if source is not None else None
+            ),
             "thumbnails": thumbs_entry["thumbs"],
             "thumbnails_more": thumbs_entry["more"],
             "attachments": atts_map.get(post.id, []),

backend/app/services/provenance_service.py

@@ -70,11 +70,15 @@ class ProvenanceService:
         rec = await self.session.get(ImageRecord, image_id)
         if rec is None:
             return None
+        # Artist via Post.artist_id (alembic 0030); Source via LEFT JOIN
+        # since both Post.source_id and ImageProvenance.source_id can be
+        # NULL for filesystem-imported content. Frontend renders source=
+        # null as "filesystem import."
         stmt = (
             select(ImageProvenance, Post, Source, Artist)
             .join(Post, Post.id == ImageProvenance.post_id)
-            .join(Source, Source.id == ImageProvenance.source_id)
-            .join(Artist, Artist.id == Source.artist_id)
+            .join(Artist, Artist.id == Post.artist_id)
+            .outerjoin(Source, Source.id == ImageProvenance.source_id)
             .where(ImageProvenance.image_record_id == image_id)
             .order_by(ImageProvenance.captured_at.asc(),
                       ImageProvenance.id.asc())
@@ -90,7 +94,7 @@ class ProvenanceService:
                     "captured_at": ip.captured_at.isoformat()
                     if ip.captured_at else None,
                     "post": _post_dict(post),
-                    "source": _source_dict(src),
+                    "source": _source_dict(src) if src is not None else None,
                     "artist": _artist_dict(art),
                 }
                 for ip, post, src, art in rows
@@ -99,10 +103,12 @@ class ProvenanceService:
         }
 
     async def for_post(self, post_id: int) -> dict | None:
+        # Same LEFT JOIN to Source — get_post must succeed for a
+        # NULL-source post.
         stmt = (
             select(Post, Source, Artist)
-            .join(Source, Source.id == Post.source_id)
-            .join(Artist, Artist.id == Source.artist_id)
+            .join(Artist, Artist.id == Post.artist_id)
+            .outerjoin(Source, Source.id == Post.source_id)
             .where(Post.id == post_id)
         )
         row = (await self.session.execute(stmt)).first()
@@ -111,7 +117,7 @@ class ProvenanceService:
         post, src, art = row
         return {
             "post": _post_dict(post),
-            "source": _source_dict(src),
+            "source": _source_dict(src) if src is not None else None,
             "artist": _artist_dict(art),
             "attachments": await self._attachments_for_posts([post.id]),
         }

backend/app/services/refetch_service.py

@@ -86,7 +86,7 @@ def attempt_refetch(
     if src is None:
         return {"status": "no_source"}
 
-    # Remove the bad copy so gallery-dl (skip_existing) re-fetches it on
+    # Remove the bad copy so gallery-dl's archive-skip re-fetches it on
     # the source re-check instead of skipping the still-present corrupt
     # file.
     try:

backend/app/services/scheduler_service.py

@@ -9,15 +9,33 @@ from __future__ import annotations
 from datetime import UTC, datetime, timedelta
 
 from sqlalchemy import select
+from sqlalchemy.dialects.postgresql import insert as pg_insert
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy.orm import selectinload
 
-from ..models import Artist, ImportSettings, Source
+from ..models import AppSetting, Artist, ImportSettings, Source
 
 MIN_INTERVAL_SECONDS = 60
 MAX_INTERVAL_SECONDS = 86400
 MAX_BACKOFF_EXPONENT = 6
 
+# AppSetting key stamped every time the Beat tick fires (see scan.py). The
+# tick runs every 60s; the UI flags the scheduler as stalled if the last
+# stamp is older than a few minutes.
+SCHEDULER_LAST_TICK_KEY = "scheduler_last_tick_at"
+
+# AppSetting key prefix for per-platform rate-limit cooldowns. When a
+# download surfaces ErrorType.RATE_LIMITED, every other source on the same
+# platform is deferred for PLATFORM_RATE_LIMIT_COOLDOWN_SECONDS so the next
+# scan tick doesn't fire a burst of due same-platform sources back into the
+# same limit. Per-source consecutive_failures backoff still applies on top
+# of this — but this is PREVENTIVE (kills the same-tick burst from N due
+# sources hammering the platform at once), while consecutive_failures is
+# REACTIVE (slows the offender down over many cycles). Operator-confirmed
+# 2026-05-30.
+PLATFORM_COOLDOWN_KEY_PREFIX = "platform_cooldown:"
+PLATFORM_RATE_LIMIT_COOLDOWN_SECONDS = 900  # 15 min
+
 
 def compute_effective_interval(
     source: Source, artist: Artist, settings: ImportSettings,
@@ -40,10 +58,76 @@ def compute_effective_interval(
     return max(MIN_INTERVAL_SECONDS, min(MAX_INTERVAL_SECONDS, raw))
 
 
+async def set_platform_cooldown(
+    session: AsyncSession, platform: str,
+    seconds: int = PLATFORM_RATE_LIMIT_COOLDOWN_SECONDS,
+) -> None:
+    """Stamp a cooldown expiry on the given platform so select_due_sources
+    skips every source on that platform until it expires.
+
+    Called when a download surfaces ErrorType.RATE_LIMITED so the other
+    sources on the same platform don't all retry into the same rate limit.
+    Caller is responsible for committing the session.
+
+    Uses INSERT...ON CONFLICT DO UPDATE so two concurrent workers hitting
+    the same platform's rate limit don't race: a SELECT-then-INSERT pattern
+    would let the loser's whole transaction (including the source-health
+    update + event finalize) roll back on a unique-violation, stranding
+    that event. Atomic upsert avoids that.
+    """
+    now = datetime.now(UTC)
+    expires_at = (now + timedelta(seconds=seconds)).isoformat()
+    key = f"{PLATFORM_COOLDOWN_KEY_PREFIX}{platform}"
+    stmt = pg_insert(AppSetting.__table__).values(
+        key=key, value=expires_at, updated_at=now,
+    ).on_conflict_do_update(
+        index_elements=["key"],
+        set_={"value": expires_at, "updated_at": now},
+    )
+    await session.execute(stmt)
+
+
+async def active_platform_cooldowns(session: AsyncSession) -> dict[str, datetime]:
+    """Return {platform: expires_at} for platforms whose cooldown is still
+    in the future. Expired rows are ignored (a future maintenance sweep can
+    delete them; they don't affect routing decisions on their own).
+
+    Exposed beyond scheduler_service so the manual check endpoint
+    (`/api/sources/<id>/check`) can defer bulk retries that would bowl
+    into the same rate limit the cooldown is preventing.
+    """
+    rows = (await session.execute(
+        select(AppSetting.key, AppSetting.value)
+        .where(AppSetting.key.startswith(PLATFORM_COOLDOWN_KEY_PREFIX))
+    )).all()
+    if not rows:
+        return {}
+    now = datetime.now(UTC)
+    active: dict[str, datetime] = {}
+    for key, value in rows:
+        try:
+            expires_at = datetime.fromisoformat(value)
+        except (ValueError, TypeError):
+            continue
+        if expires_at > now:
+            active[key[len(PLATFORM_COOLDOWN_KEY_PREFIX):]] = expires_at
+    return active
+
+
 async def select_due_sources(session: AsyncSession) -> list[Source]:
     """Sources where (enabled, artist.auto_check) and now >= last_checked_at + effective_interval.
 
-    Never-checked sources (last_checked_at IS NULL) are always due.
+    Never-checked sources (last_checked_at IS NULL) are always due. Sources
+    whose platform is currently in a rate-limit cooldown are excluded — the
+    cooldown is the preventive half of the burst-prevention pair (per-source
+    consecutive_failures backoff handles the offending source itself).
+
+    Ordering: last_checked_at ASC NULLS FIRST, then id. Never-checked
+    sources go first, then the longest-since-checked, so the most overdue
+    sources hit Celery's FIFO download queue first. Anti-starvation: if
+    queue throughput ever falls below the tick rate, a freshly-rerun source
+    can't keep cutting in line ahead of one that hasn't been checked at all.
+    Operator-confirmed 2026-05-30.
     """
     rows = (await session.execute(
         select(Source)
@@ -51,15 +135,17 @@ async def select_due_sources(session: AsyncSession) -> list[Source]:
         .join(Artist, Source.artist_id == Artist.id)
         .where(Source.enabled.is_(True))
         .where(Artist.auto_check.is_(True))
+        .order_by(Source.last_checked_at.asc().nulls_first(), Source.id)
     )).scalars().all()
 
-    settings = (await session.execute(
-        select(ImportSettings).where(ImportSettings.id == 1)
-    )).scalar_one()
+    cooldowns = await active_platform_cooldowns(session)
+    settings = await ImportSettings.load(session)
 
     now = datetime.now(UTC)
     due: list[Source] = []
     for s in rows:
+        if s.platform in cooldowns:
+            continue
         interval = compute_effective_interval(s, s.artist, settings)
         if s.last_checked_at is None:
             due.append(s)
@@ -78,3 +164,65 @@ def compute_next_check_at(
         return None
     interval = compute_effective_interval(source, artist, settings)
     return source.last_checked_at + timedelta(seconds=interval)
+
+
+async def record_tick(session: AsyncSession) -> None:
+    """Stamp the current time on the SCHEDULER_LAST_TICK_KEY AppSetting.
+
+    Called once per Beat tick so the UI can prove the scheduler is alive.
+    Commits its own write so the stamp survives even if the rest of the
+    tick errors out.
+    """
+    now_iso = datetime.now(UTC).isoformat()
+    row = (await session.execute(
+        select(AppSetting).where(AppSetting.key == SCHEDULER_LAST_TICK_KEY)
+    )).scalar_one_or_none()
+    if row is None:
+        session.add(AppSetting(key=SCHEDULER_LAST_TICK_KEY, value=now_iso))
+    else:
+        row.value = now_iso
+    await session.commit()
+
+
+async def scheduler_status(session: AsyncSession) -> dict:
+    """Summarise scheduler health for the dashboard.
+
+    Returns last_tick_at (when Beat last fired), next_due_at (earliest
+    upcoming scheduled check across enabled auto-check sources), due_now
+    (how many are due right now), and auto_sources (total under schedule).
+    """
+    last_tick_at = (await session.execute(
+        select(AppSetting.value).where(AppSetting.key == SCHEDULER_LAST_TICK_KEY)
+    )).scalar_one_or_none()
+
+    rows = (await session.execute(
+        select(Source)
+        .options(selectinload(Source.artist))
+        .join(Artist, Source.artist_id == Artist.id)
+        .where(Source.enabled.is_(True))
+        .where(Artist.auto_check.is_(True))
+    )).scalars().all()
+    settings = await ImportSettings.load(session)
+
+    now = datetime.now(UTC)
+    due_now = 0
+    next_due_at: datetime | None = None
+    for s in rows:
+        if s.last_checked_at is None:
+            due_now += 1
+            continue
+        nca = compute_next_check_at(s, s.artist, settings)
+        if nca is None or nca <= now:
+            due_now += 1
+        elif next_due_at is None or nca < next_due_at:
+            next_due_at = nca
+
+    cooldowns = await active_platform_cooldowns(session)
+
+    return {
+        "last_tick_at": last_tick_at,
+        "next_due_at": next_due_at.isoformat() if next_due_at else None,
+        "due_now": due_now,
+        "auto_sources": len(rows),
+        "platform_cooldowns": {p: dt.isoformat() for p, dt in cooldowns.items()},
+    }

backend/app/services/series_service.py

@@ -63,6 +63,7 @@ class SeriesService:
                     ImageRecord.sha256,
                     ImageRecord.mime,
                     ImageRecord.path,
+                    ImageRecord.thumbnail_path,
                 )
                 .join(ImageRecord, ImageRecord.id == SeriesPage.image_id)
                 .where(SeriesPage.series_tag_id == series_tag_id)
@@ -75,7 +76,7 @@ class SeriesService:
                 {
                     "image_id": r.image_id,
                     "page_number": r.page_number,
-                    "thumbnail_url": thumbnail_url(r.sha256, r.mime),
+                    "thumbnail_url": thumbnail_url(r.thumbnail_path, r.sha256, r.mime),
                     "image_url": f"/images/{r.path.split('/images/', 1)[-1]}",
                 }
                 for r in rows

backend/app/services/showcase_service.py

@@ -34,7 +34,7 @@ class ShowcaseService:
                 "mime": r.mime,
                 "width": r.width,
                 "height": r.height,
-                "thumbnail_url": thumbnail_url(r.sha256, r.mime),
+                "thumbnail_url": thumbnail_url(r.thumbnail_path, r.sha256, r.mime),
             }
             for r in rows
         ]

backend/app/services/source_service.py

@@ -62,6 +62,7 @@ class SourceRecord:
     check_interval_override: int | None
     consecutive_failures: int
     next_check_at: str | None
+    backfill_runs_remaining: int
 
     def to_dict(self) -> dict:
         return {
@@ -78,6 +79,7 @@ class SourceRecord:
             "check_interval_override": self.check_interval_override,
             "consecutive_failures": self.consecutive_failures,
             "next_check_at": self.next_check_at,
+            "backfill_runs_remaining": self.backfill_runs_remaining,
         }
 
 
@@ -85,6 +87,11 @@ class SourceRecord:
 
 _EDITABLE = {"enabled", "url", "config_overrides", "check_interval_override", "platform"}
 
+# Plan #544 follow-up: newly created enabled sources pre-arm backfill so
+# their first N polls walk gallery-dl's full post history with the longer
+# timeout (matches the manual "Deep scan" button's default).
+_NEW_SOURCE_BACKFILL_RUNS = 3
+
 
 class SourceService:
     def __init__(self, session: AsyncSession):
@@ -120,9 +127,7 @@ class SourceService:
         return config
 
     async def _load_settings(self) -> ImportSettings:
-        return (await self.session.execute(
-            select(ImportSettings).where(ImportSettings.id == 1)
-        )).scalar_one()
+        return await ImportSettings.load(self.session)
 
     def _build_record(
         self, source: Source, artist: Artist, settings: ImportSettings,
@@ -142,6 +147,7 @@ class SourceService:
             check_interval_override=source.check_interval_override,
             consecutive_failures=source.consecutive_failures or 0,
             next_check_at=nxt.isoformat() if nxt else None,
+            backfill_runs_remaining=source.backfill_runs_remaining or 0,
         )
 
     async def _row_to_record(self, source: Source) -> SourceRecord:
@@ -151,14 +157,27 @@ class SourceService:
         settings = await self._load_settings()
         return self._build_record(source, artist, settings)
 
-    async def list(self, artist_id: int | None = None) -> list[SourceRecord]:
-        stmt = (
-            select(Source, Artist)
-            .join(Artist, Artist.id == Source.artist_id)
-            .order_by(Artist.name.asc(), Source.id.asc())
-        )
+    async def list(
+        self, artist_id: int | None = None, failing: bool = False,
+        include_synthetic: bool = False,
+    ) -> list[SourceRecord]:
+        stmt = select(Source, Artist).join(Artist, Artist.id == Source.artist_id)
         if artist_id is not None:
             stmt = stmt.where(Source.artist_id == artist_id)
+        if not include_synthetic:
+            # Pre-alembic-0030 sidecar synthetic anchors
+            # have url='sidecar:<platform>:<slug>' and exist only to give
+            # imported Posts a NOT-NULL Source FK. They aren't pollable
+            # feeds; the Subscriptions UI used to render them as phantom
+            # subscriptions. Hide by default.
+            stmt = stmt.where(~Source.url.like("sidecar:%"))
+        if failing:
+            # Worst-first so the rollup card surfaces the loudest failures.
+            stmt = stmt.where(Source.consecutive_failures > 0).order_by(
+                Source.consecutive_failures.desc(), Artist.name.asc(),
+            )
+        else:
+            stmt = stmt.order_by(Artist.name.asc(), Source.id.asc())
         rows = (await self.session.execute(stmt)).all()
         settings = await self._load_settings()
         return [self._build_record(s, a, settings) for s, a in rows]
@@ -190,10 +209,21 @@ class SourceService:
             select(func.count(Source.id)).where(Source.artist_id == artist_id)
         )).scalar_one()
 
+        # Plan #544 follow-up: a freshly added subscription has no archive
+        # yet, so the first few polls would walk the full post history in
+        # tick mode and trip exit:20 after ~20 contiguous archive hits —
+        # except there are none yet, so tick mode would walk forever and
+        # blow the wall-clock cap. Pre-arm backfill so the initial syncs
+        # use the longer timeout + skip:True walk. Tick mode resumes once
+        # the budget is spent or the queue drains.
+        # Disabled sources (incl. sidecar synthetics, url='sidecar:...')
+        # are never polled, so leave their counter at 0.
+        backfill_runs = _NEW_SOURCE_BACKFILL_RUNS if enabled else 0
         source = Source(
             artist_id=artist_id, platform=platform, url=url,
             enabled=enabled, config_overrides=config_overrides,
             check_interval_override=check_interval_override,
+            backfill_runs_remaining=backfill_runs,
         )
         self.session.add(source)
         try:
@@ -253,6 +283,25 @@ class SourceService:
         await self.session.commit()
         return await self._row_to_record(source)
 
+    async def set_backfill_runs(
+        self, source_id: int, runs: int,
+    ) -> SourceRecord:
+        """Plan #544: arm a source for backfill mode. The next `runs`
+        download runs will use gallery-dl's full-walk config (skip: True
+        + 30-min timeout) instead of the catch-up default. Runs must be
+        1..10 — bigger is rejected to keep the operator from accidentally
+        setting a runaway budget."""
+        if not isinstance(runs, int) or runs < 1 or runs > 10:
+            raise ValueError("runs must be an integer in [1, 10]")
+        source = (await self.session.execute(
+            select(Source).where(Source.id == source_id)
+        )).scalar_one_or_none()
+        if source is None:
+            raise LookupError(f"source id={source_id} not found")
+        source.backfill_runs_remaining = runs
+        await self.session.commit()
+        return await self._row_to_record(source)
+
     async def delete(self, source_id: int) -> None:
         source = (await self.session.execute(
             select(Source).where(Source.id == source_id)

backend/app/services/tag_directory_service.py

@@ -115,12 +115,17 @@ class TagDirectoryService:
             .subquery()
         )
         stmt = (
-            select(sub.c.tag_id, ImageRecord.sha256, ImageRecord.mime)
+            select(
+                sub.c.tag_id,
+                ImageRecord.sha256,
+                ImageRecord.mime,
+                ImageRecord.thumbnail_path,
+            )
             .join(ImageRecord, ImageRecord.id == sub.c.image_record_id)
             .where(sub.c.rn <= 3)
             .order_by(sub.c.tag_id, sub.c.rn)
         )
         out: dict[int, list[str]] = {}
-        for tag_id, sha, mime in (await self.session.execute(stmt)).all():
-            out.setdefault(tag_id, []).append(thumbnail_url(sha, mime))
+        for tag_id, sha, mime, tp in (await self.session.execute(stmt)).all():
+            out.setdefault(tag_id, []).append(thumbnail_url(tp, sha, mime))
         return out

backend/app/tasks/_async_session.py

@@ -0,0 +1,21 @@
+"""Per-invocation async session factory for Celery task modules.
+
+Async engine connections are bound to the event loop. Each Celery task
+runs its async body under a fresh ``asyncio.run()`` loop, so it needs its
+own engine created (and disposed) within that loop — a process-wide async
+engine would reuse loop-bound connections across tasks and raise "attached
+to a different loop". So unlike the process-wide sync engine in
+``_sync_engine.py``, this returns a fresh engine per call; the caller
+disposes it (``await engine.dispose()``) when its loop ends.
+"""
+
+from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
+
+from ..config import get_config
+
+
+def async_session_factory():
+    """Return ``(sessionmaker, engine)`` bound to a fresh async engine."""
+    cfg = get_config()
+    engine = create_async_engine(cfg.database_url, future=True, pool_pre_ping=True)
+    return async_sessionmaker(engine, class_=AsyncSession, expire_on_commit=False), engine

backend/app/tasks/backup.py

@@ -246,9 +246,7 @@ def prune_backups() -> dict:
     SessionLocal = _sync_session_factory()
     counts = {"db_deleted": 0, "images_deleted": 0, "files_unlinked": 0}
     with SessionLocal() as session:
-        s = session.execute(
-            select(ImportSettings).where(ImportSettings.id == 1)
-        ).scalar_one()
+        s = ImportSettings.load_sync(session)
         for kind, keep in (
             ("db", s.backup_db_keep_last_n),
             ("images", s.backup_images_keep_last_n),
@@ -286,9 +284,7 @@ def backup_db_nightly() -> dict:
     either {'skipped': '<reason>'} or {'dispatched': '<task_id>'}."""
     SessionLocal = _sync_session_factory()
     with SessionLocal() as session:
-        s = session.execute(
-            select(ImportSettings).where(ImportSettings.id == 1)
-        ).scalar_one()
+        s = ImportSettings.load_sync(session)
         nightly_enabled = s.backup_db_nightly_enabled
         configured_hour = s.backup_db_nightly_hour_utc
     if not nightly_enabled:

backend/app/tasks/download.py

@@ -3,12 +3,9 @@
 import asyncio
 from pathlib import Path
 
-from sqlalchemy import select
 from sqlalchemy.exc import DBAPIError, OperationalError
-from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
 
 from ..celery_app import celery
-from ..config import get_config
 from ..models import ImportSettings
 from ..services.credential_crypto import CredentialCrypto
 from ..services.credential_service import CredentialService
@@ -16,18 +13,13 @@ from ..services.download_service import DownloadService
 from ..services.gallery_dl import GalleryDLService
 from ..services.importer import Importer
 from ..services.thumbnailer import Thumbnailer
+from ._async_session import async_session_factory
 from .import_file import _sync_session_factory
 
 IMAGES_ROOT = Path("/images")
 _KEY_PATH = IMAGES_ROOT / "secrets" / "credential_key.b64"
 
 
-def _async_session_factory():
-    cfg = get_config()
-    engine = create_async_engine(cfg.database_url, future=True, pool_pre_ping=True)
-    return async_sessionmaker(engine, class_=AsyncSession, expire_on_commit=False), engine
-
-
 @celery.task(
     name="backend.app.tasks.download.download_source",
     bind=True,
@@ -44,13 +36,11 @@ def download_source(self, source_id: int) -> int:
     """Returns the DownloadEvent.id."""
 
     async def _run():
-        async_factory, async_engine = _async_session_factory()
+        async_factory, async_engine = async_session_factory()
         SyncFactory = _sync_session_factory()
         try:
             with SyncFactory() as sync_session:
-                settings = sync_session.execute(
-                    select(ImportSettings).where(ImportSettings.id == 1)
-                ).scalar_one()
+                settings = ImportSettings.load_sync(sync_session)
                 rate_limit = settings.download_rate_limit_seconds
                 validate_files = settings.download_validate_files
 
@@ -64,9 +54,7 @@ def download_source(self, source_id: int) -> int:
             async with async_factory() as async_session:
                 cred_service = CredentialService(async_session, crypto)
                 with SyncFactory() as sync_session:
-                    sync_settings = sync_session.execute(
-                        select(ImportSettings).where(ImportSettings.id == 1)
-                    ).scalar_one()
+                    sync_settings = ImportSettings.load_sync(sync_session)
                     importer = Importer(
                         session=sync_session,
                         images_root=IMAGES_ROOT,

backend/app/tasks/import_file.py

@@ -167,9 +167,7 @@ def enqueue_import(task_id: int, task_type: str) -> None:
 
 def _do_import(session, task, import_task_id: int) -> dict:
     """Actual work, called from inside the resilience wrapper."""
-    settings = session.execute(
-        select(ImportSettings).where(ImportSettings.id == 1)
-    ).scalar_one()
+    settings = ImportSettings.load_sync(session)
     import_root = Path(settings.import_scan_path)
     batch = session.get(ImportBatch, task.batch_id)
     deep = bool(batch and batch.scan_mode == "deep")

backend/app/tasks/maintenance.py

@@ -10,7 +10,14 @@ from PIL import Image
 from sqlalchemy import and_, delete, or_, select, update
 
 from ..celery_app import celery
-from ..models import DownloadEvent, ImageRecord, ImportSettings, ImportTask, TaskRun
+from ..models import (
+    DownloadEvent,
+    ImageRecord,
+    ImportSettings,
+    ImportTask,
+    Source,
+    TaskRun,
+)
 from ..utils.phash import compute_phash
 from ._sync_engine import sync_session_factory as _sync_session_factory
 
@@ -34,6 +41,13 @@ ARCHIVE_STUCK_THRESHOLD_MINUTES = 40
 # flip to terminal 'failed' and never enter this loop.
 MAX_RECOVERY_ATTEMPTS = 3
 ORPHAN_PENDING_THRESHOLD_MINUTES = 30
+
+# DownloadEvent (pending|running) recovery threshold. download_source has
+# time_limit=1200s (20 min); 30 min is 10 min past that, so a legitimately-
+# running task is never killed by the sweep. Operator-confirmed 2026-05-29
+# after 43 sources stranded at "last check never" by the in-flight guard.
+DOWNLOAD_STALL_THRESHOLD_MINUTES = 30
+
 OLD_TASK_DAYS = 7
 PHASH_PAGE = 500
 VERIFY_PAGE = 200
@@ -448,6 +462,65 @@ def verify_integrity() -> int:
     return total
 
 
+@celery.task(name="backend.app.tasks.maintenance.recover_stalled_download_events")
+def recover_stalled_download_events() -> int:
+    """Recover DownloadEvent rows stuck pending/running past the worker hard kill.
+
+    The scan tick (scheduler_service.select_due_sources →
+    tasks.scan._tick_due_sources_async) inserts DownloadEvent(status='pending')
+    and fires download_source.delay(). If that task dies before finalizing the
+    event — worker OOM/SIGKILL, lost task, or a gallery-dl that didn't unwind
+    on the 1200s hard time_limit — the event stays in-flight forever. The next
+    tick then skips that source because of the in-flight guard (scan.py:168)
+    and Source.last_checked_at never updates; the operator sees "last check
+    never" in the Subscriptions health column, permanently.
+
+    This sweep flips matching events to 'error', stamps each affected Source's
+    last_checked_at + last_error and bumps consecutive_failures (once per
+    source, not per event — backoff is exponential on that count so an N-event
+    bump would inflate the next interval by 2^N for no reason). The source
+    becomes re-queueable on the next tick and the health dot goes amber.
+
+    Operator-confirmed 2026-05-29 (43-row strand pile in production).
+    """
+    SessionLocal = _sync_session_factory()
+    now = datetime.now(UTC)
+    cutoff = now - timedelta(minutes=DOWNLOAD_STALL_THRESHOLD_MINUTES)
+    msg = "stranded by recovery sweep (no terminal status after time_limit)"
+    with SessionLocal() as session:
+        # UPDATE...RETURNING the source_ids in one round trip — keeps us off
+        # the psycopg 65535-param ceiling that SELECT-then-UPDATE-WHERE-IN
+        # would hit on a large strand pile.
+        result = session.execute(
+            update(DownloadEvent)
+            .where(DownloadEvent.status.in_(["pending", "running"]))
+            .where(DownloadEvent.started_at < cutoff)
+            .values(status="error", finished_at=now, error=msg)
+            .returning(DownloadEvent.source_id)
+        )
+        returned = result.all()
+        if not returned:
+            session.commit()
+            return 0
+        events_recovered = len(returned)
+        source_ids = list({row.source_id for row in returned})
+        session.execute(
+            update(Source)
+            .where(Source.id.in_(source_ids))
+            .values(
+                consecutive_failures=Source.consecutive_failures + 1,
+                last_error=msg,
+                last_checked_at=now,
+            )
+        )
+        session.commit()
+        log.info(
+            "recover_stalled_download_events: recovered %d events across %d sources",
+            events_recovered, len(source_ids),
+        )
+        return events_recovered
+
+
 @celery.task(name="backend.app.tasks.maintenance.cleanup_old_download_events")
 def cleanup_old_download_events() -> int:
     """FC-3d: delete terminal DownloadEvent rows older than the configured
@@ -460,9 +533,7 @@ def cleanup_old_download_events() -> int:
     """
     SessionLocal = _sync_session_factory()
     with SessionLocal() as session:
-        settings = session.execute(
-            select(ImportSettings).where(ImportSettings.id == 1)
-        ).scalar_one()
+        settings = ImportSettings.load_sync(session)
         retention_days = settings.download_event_retention_days
         cutoff = datetime.now(UTC) - timedelta(days=retention_days)
         result = session.execute(

backend/app/tasks/migration.py

@@ -1,175 +0,0 @@
-"""FC-5 run_migration Celery task.
-
-Dispatches to the right migrator based on `kind`. Updates MigrationRun
-row's status/counts/finished_at as it runs. Failures set status='error'
-with the error message preserved.
-
-kinds: gs_ingest, ir_ingest, tag_apply, ml_queue, verify, cleanup
-(backup + rollback retired 2026-05-24 → see /api/system/backup/*)
-"""
-from __future__ import annotations
-
-import asyncio
-import logging
-from datetime import UTC, datetime
-from pathlib import Path
-
-from sqlalchemy import select
-from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
-
-from ..celery_app import celery
-from ..config import get_config
-from ..models import MigrationRun
-from ..services.credential_crypto import CredentialCrypto
-from ..services.migrators import cleanup as cleanup_mod
-from ..services.migrators import gs_ingest, ir_ingest, ml_queue, tag_apply, verify
-
-log = logging.getLogger(__name__)
-
-IMAGES_ROOT = Path("/images")
-_KEY_PATH = IMAGES_ROOT / "secrets" / "credential_key.b64"
-
-
-def _async_session_factory():
-    cfg = get_config()
-    engine = create_async_engine(cfg.database_url, future=True, pool_pre_ping=True)
-    return async_sessionmaker(engine, class_=AsyncSession, expire_on_commit=False), engine
-
-
-async def _update_run(
-    db: AsyncSession, run_id: int, *,
-    status: str | None = None, counts: dict | None = None,
-    error: str | None = None, finished_at: datetime | None = None,
-    metadata_patch: dict | None = None,
-) -> None:
-    run = (await db.execute(
-        select(MigrationRun).where(MigrationRun.id == run_id)
-    )).scalar_one()
-    if status is not None:
-        run.status = status
-    if counts is not None:
-        run.counts = counts
-    if error is not None:
-        run.error = error
-    if finished_at is not None:
-        run.finished_at = finished_at
-    if metadata_patch:
-        run.metadata_ = {**(run.metadata_ or {}), **metadata_patch}
-    await db.commit()
-
-
-async def _run_async(run_id: int, kind: str, params: dict) -> dict:
-    factory, engine = _async_session_factory()
-    try:
-        async with factory() as db:
-            await _update_run(db, run_id, status="running")
-            try:
-                if kind in ("backup", "rollback"):
-                    raise ValueError(
-                        f"kind {kind!r} retired in FC-3h; "
-                        "use /api/system/backup/* instead"
-                    )
-
-                elif kind == "gs_ingest":
-                    fc_crypto = CredentialCrypto(_KEY_PATH)
-                    counts = await gs_ingest.migrate_async(
-                        db, data=params["data"],
-                        fc_crypto=fc_crypto,
-                        dry_run=params.get("dry_run", False),
-                    )
-                    await _update_run(
-                        db, run_id, status="ok", counts=counts,
-                        finished_at=datetime.now(UTC),
-                    )
-                    return counts
-
-                elif kind == "ir_ingest":
-                    counts = await ir_ingest.migrate_async(
-                        db, data=params["data"],
-                        images_root=IMAGES_ROOT,
-                        dry_run=params.get("dry_run", False),
-                    )
-                    await _update_run(
-                        db, run_id, status="ok", counts=counts,
-                        finished_at=datetime.now(UTC),
-                    )
-                    return counts
-
-                elif kind == "tag_apply":
-                    result = await tag_apply.apply_async(
-                        db, images_root=IMAGES_ROOT,
-                        dry_run=params.get("dry_run", False),
-                    )
-                    await _update_run(
-                        db, run_id, status="ok",
-                        counts=result["counts"],
-                        finished_at=datetime.now(UTC),
-                        metadata_patch={"unmatched": result["unmatched"]},
-                    )
-                    return result
-
-                elif kind == "ml_queue":
-                    count = await ml_queue.queue_all_unprocessed_async(db)
-                    await _update_run(
-                        db, run_id, status="ok",
-                        counts={"rows_processed": count, "rows_inserted": 0,
-                                "rows_skipped": 0, "files_copied": 0,
-                                "bytes_copied": 0, "conflicts": 0},
-                        finished_at=datetime.now(UTC),
-                    )
-                    return {"queued": count}
-
-                elif kind == "verify":
-                    checks = await verify.verify_async(db, expected=params.get("expected"))
-                    sample = await verify.verify_sha256_sample(
-                        db, sample_size=params.get("sample_size", 20),
-                    )
-                    await _update_run(
-                        db, run_id, status="ok",
-                        counts={"rows_processed": sample["sample_size"],
-                                "rows_inserted": 0, "rows_skipped": 0,
-                                "files_copied": 0, "bytes_copied": 0,
-                                "conflicts": sample["mismatched"] + sample["missing"]},
-                        finished_at=datetime.now(UTC),
-                        metadata_patch={"checks": checks, "sample": sample},
-                    )
-                    return {"checks": checks, "sample": sample}
-
-                elif kind == "cleanup":
-                    slug = params.get("slug")
-                    if not slug:
-                        raise ValueError("cleanup requires params.slug")
-                    result = await cleanup_mod.cleanup_artist_async(
-                        db, slug=slug, images_root=IMAGES_ROOT,
-                        dry_run=params.get("dry_run", False),
-                        source_path_prefix=params.get("source_path_prefix"),
-                    )
-                    await _update_run(
-                        db, run_id, status="ok",
-                        counts=result["counts"],
-                        finished_at=datetime.now(UTC),
-                        metadata_patch={
-                            "artist": result["artist"],
-                            "summary": result["summary"],
-                        },
-                    )
-                    return result
-
-                else:
-                    raise ValueError(f"unknown kind: {kind}")
-
-            except Exception as exc:
-                log.exception("migration kind=%s failed", kind)
-                await _update_run(
-                    db, run_id, status="error", error=str(exc),
-                    finished_at=datetime.now(UTC),
-                )
-                raise
-    finally:
-        await engine.dispose()
-
-
-@celery.task(name="backend.app.tasks.migration.run_migration", bind=True, acks_late=True)
-def run_migration(self, run_id: int, kind: str, params: dict) -> dict:
-    """FC-5: dispatch a migration kind. Updates MigrationRun row as it goes."""
-    return asyncio.run(_run_async(run_id, kind, params))

backend/app/tasks/scan.py

@@ -12,13 +12,12 @@ from datetime import UTC, datetime
 from pathlib import Path
 
 from sqlalchemy import select
-from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
 
 from ..celery_app import celery
-from ..config import get_config
 from ..models import DownloadEvent, ImportBatch, ImportSettings, ImportTask
 from ..services.archive_extractor import is_archive
-from ..services.scheduler_service import select_due_sources
+from ..services.scheduler_service import record_tick, select_due_sources
+from ._async_session import async_session_factory
 from ._sync_engine import sync_session_factory as _sync_session_factory
 
 
@@ -45,9 +44,7 @@ def scan_directory(self, triggered_by: str = "manual",
     batch id."""
     SessionLocal = _sync_session_factory()
     with SessionLocal() as session:
-        settings = session.execute(
-            select(ImportSettings).where(ImportSettings.id == 1)
-        ).scalar_one()
+        settings = ImportSettings.load_sync(session)
         import_root = Path(settings.import_scan_path)
 
         batch = ImportBatch(
@@ -141,16 +138,12 @@ def scan_directory(self, triggered_by: str = "manual",
 # --- FC-3d: periodic source-check tick ------------------------------------
 
 
-def _async_session_factory():
-    cfg = get_config()
-    engine = create_async_engine(cfg.database_url, future=True, pool_pre_ping=True)
-    return async_sessionmaker(engine, class_=AsyncSession, expire_on_commit=False), engine
-
-
 async def _tick_due_sources_async() -> dict:
-    factory, engine = _async_session_factory()
+    factory, engine = async_session_factory()
     try:
         async with factory() as session:
+            # Prove the scheduler is alive even on empty ticks (UI reads this).
+            await record_tick(session)
             due = await select_due_sources(session)
             if not due:
                 return {

backend/app/tasks/thumbnail.py

@@ -20,14 +20,32 @@ IMAGES_ROOT = Path("/images")
 THUMB_MAGIC_JPEG = b"\xff\xd8\xff"
 THUMB_MAGIC_PNG = b"\x89PNG\r\n\x1a\n"
 
+# Minimum file size for a thumbnail to count as valid. Anything smaller
+# is almost certainly truncated/corrupt — a legitimate 400×400 JPEG@85
+# bottoms out around 2KB even on a solid-color image; 400×400 PNG starts
+# around 1KB. 256 bytes is well below any real thumbnail and well above
+# header-only corrupt files (~8-12 bytes). Operator-flagged 2026-06-01:
+# header-only corrupt files were silently passing the magic-byte check
+# and backfill counted them as "ok" — so broken-image tiles in the UI
+# never got regenerated even after running backfill.
+MIN_THUMB_BYTES = 256
+
 
 def _thumb_is_valid(path: Path) -> bool:
-    """Return True iff `path` exists and starts with a JPEG or PNG magic header.
+    """Return True iff `path` exists, starts with a JPEG or PNG magic
+    header, AND is at least MIN_THUMB_BYTES on disk.
 
-    The on-disk thumbnail format is set by services/thumbnailer.py — JPEG for
-    opaque sources, PNG for alpha sources. Anything else (missing file, OSError,
-    truncated, wrong magic) is invalid.
+    The on-disk thumbnail format is set by services/thumbnailer.py — JPEG
+    for opaque sources, PNG for alpha sources. Anything else (missing
+    file, OSError, truncated below the size floor, wrong magic) is
+    invalid and gets re-enqueued.
     """
+    try:
+        size = path.stat().st_size
+    except OSError:
+        return False
+    if size < MIN_THUMB_BYTES:
+        return False
     try:
         with path.open("rb") as f:
             head = f.read(12)
@@ -42,6 +60,59 @@ def _thumb_is_valid(path: Path) -> bool:
     return False
 
 
+def _run_backfill_scan() -> dict:
+    """Synchronous scan logic shared by the Celery task and the API
+    endpoint. Returns {enqueued, ok, regenerated, scanned}.
+
+    Operator-flagged 2026-06-01: the original task was fire-and-forget,
+    so the admin UI couldn't show what backfill actually found —
+    operator saw \"Enqueued.\" with no counts and assumed nothing was
+    happening. Now the API runs this synchronously and returns the
+    real numbers; the periodic Celery task wraps it too."""
+    from sqlalchemy import select, update
+
+    SessionLocal = _sync_session_factory()
+    enqueued = 0
+    ok = 0
+    regenerated = 0
+    scanned = 0
+    last_id = 0
+    with SessionLocal() as session:
+        while True:
+            rows = session.execute(
+                select(ImageRecord.id, ImageRecord.thumbnail_path)
+                .where(ImageRecord.id > last_id)
+                .order_by(ImageRecord.id.asc())
+                .limit(500)
+            ).all()
+            if not rows:
+                break
+            scanned += len(rows)
+            for image_id, thumb_path in rows:
+                if thumb_path is None:
+                    generate_thumbnail.delay(image_id)
+                    enqueued += 1
+                elif _thumb_is_valid(Path(thumb_path)):
+                    ok += 1
+                else:
+                    session.execute(
+                        update(ImageRecord)
+                        .where(ImageRecord.id == image_id)
+                        .values(thumbnail_path=None)
+                    )
+                    generate_thumbnail.delay(image_id)
+                    enqueued += 1
+                    regenerated += 1
+            session.commit()
+            last_id = rows[-1][0]
+    return {
+        "scanned": scanned,
+        "enqueued": enqueued,
+        "ok": ok,
+        "regenerated": regenerated,
+    }
+
+
 @celery.task(
     name="backend.app.tasks.thumbnail.generate_thumbnail",
     bind=True,
@@ -84,48 +155,15 @@ def backfill_thumbnails(self) -> dict:
     """Scan ImageRecord and enqueue generate_thumbnail for rows whose
     thumbnail is missing, gone from disk, or has wrong magic bytes.
 
-    Keyset paginates by id ASC, page size 500. NULLs out thumbnail_path for
-    rows that point at a missing or corrupt file before enqueueing — keeps
-    the DB self-consistent on partial runs and makes re-runs safe.
+    Keyset paginates by id ASC, page size 500. NULLs out thumbnail_path
+    for rows that point at a missing or corrupt file before enqueueing —
+    keeps the DB self-consistent on partial runs and makes re-runs safe.
 
-    Returns {"enqueued": N, "ok": M, "regenerated": K} where:
-      - enqueued = total generate_thumbnail.delay() calls
-      - ok       = rows whose existing thumbnail file is valid (skipped)
-      - regenerated = subset of enqueued that had a non-NULL thumbnail_path
-                      cleared (i.e. missing + corrupt)
+    Returns {scanned, enqueued, ok, regenerated} where:
+      - scanned    = total rows examined
+      - enqueued   = total generate_thumbnail.delay() calls
+      - ok         = rows whose existing thumbnail file is valid (skipped)
+      - regenerated = subset of enqueued that had a non-NULL
+                      thumbnail_path cleared (i.e. missing + corrupt)
     """
-    from sqlalchemy import select, update
-
-    SessionLocal = _sync_session_factory()
-    enqueued = 0
-    ok = 0
-    regenerated = 0
-    last_id = 0
-    with SessionLocal() as session:
-        while True:
-            rows = session.execute(
-                select(ImageRecord.id, ImageRecord.thumbnail_path)
-                .where(ImageRecord.id > last_id)
-                .order_by(ImageRecord.id.asc())
-                .limit(500)
-            ).all()
-            if not rows:
-                break
-            for image_id, thumb_path in rows:
-                if thumb_path is None:
-                    generate_thumbnail.delay(image_id)
-                    enqueued += 1
-                elif _thumb_is_valid(Path(thumb_path)):
-                    ok += 1
-                else:
-                    session.execute(
-                        update(ImageRecord)
-                        .where(ImageRecord.id == image_id)
-                        .values(thumbnail_path=None)
-                    )
-                    generate_thumbnail.delay(image_id)
-                    enqueued += 1
-                    regenerated += 1
-            session.commit()
-            last_id = rows[-1][0]
-    return {"enqueued": enqueued, "ok": ok, "regenerated": regenerated}
+    return _run_backfill_scan()

backend/app/utils/_archive_probe_runner.py

@@ -0,0 +1,33 @@
+"""Subprocess entrypoint for safe_probe.probe_archive — see safe_probe.py.
+
+probe_archive spawns this via subprocess (not multiprocessing.Process)
+because Celery's prefork worker pool runs tasks in DAEMON processes and
+Python's multiprocessing forbids daemon processes from spawning children
+("AssertionError: daemonic processes are not allowed to have children",
+operator-flagged 2026-05-30 — every archive import failed at task
+startup). subprocess has no such restriction; we still get crash-
+isolation because a probe segfault/OOM exits non-zero rather than
+killing the worker.
+
+Prints a single JSON line on stdout: {"status": "ok"|"error",
+"detail": "..."?}. Exit code 0 for clean outcomes; non-zero exit
+(signal / OOM-kill / unhandled exception) is the poison-pill signature
+the parent maps to ProbeResult(crashed=True).
+"""
+import json
+import sys
+
+from .safe_probe import _run_probe
+
+
+def main() -> int:
+    if len(sys.argv) != 2:
+        print(json.dumps({"status": "error", "detail": "usage: <path>"}))
+        return 2
+    status, detail = _run_probe(sys.argv[1])
+    print(json.dumps({"status": status, "detail": detail}))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

backend/app/utils/safe_probe.py

@@ -28,8 +28,8 @@ Operator-requested 2026-05-28 (Layer 3).
 """
 
 import json
-import multiprocessing as mp
 import subprocess
+import sys
 from dataclasses import dataclass
 from pathlib import Path
 
@@ -40,6 +40,13 @@ ARCHIVE_PROBE_TIMEOUT_SECONDS = 120
 # art-pack archives while stopping a few-KB zip that expands to TB).
 MAX_ARCHIVE_UNCOMPRESSED_BYTES = 4 * 1024 * 1024 * 1024
 
+# Repo root for the subprocess cwd so `python -m backend.app.utils.*`
+# resolves regardless of where Celery / pytest started. backend/app/utils
+# = parents[0]; backend/app = parents[1]; backend = parents[2]; repo root
+# = parents[3].
+_REPO_ROOT = Path(__file__).resolve().parents[3]
+_PROBE_RUNNER_MODULE = "backend.app.utils._archive_probe_runner"
+
 
 @dataclass(frozen=True)
 class ProbeResult:
@@ -91,54 +98,68 @@ def probe_video(path: Path, *, timeout: float = VIDEO_PROBE_TIMEOUT_SECONDS) ->
 
 
 def probe_archive(path: Path, *, timeout: float = ARCHIVE_PROBE_TIMEOUT_SECONDS) -> ProbeResult:
-    """Bomb-size guard + isolated integrity test for an archive."""
-    ctx = mp.get_context("spawn")
-    q = ctx.Queue()
-    proc = ctx.Process(target=_archive_probe_target, args=(str(path), q))
-    proc.start()
-    proc.join(timeout)
-    if proc.is_alive():
-        proc.terminate()
-        proc.join(5)
+    """Bomb-size guard + isolated integrity test for an archive.
+
+    Runs via subprocess (not multiprocessing.Process) because Celery's
+    prefork worker pool is daemon-mode and Python's multiprocessing
+    forbids daemon processes from spawning children ("AssertionError:
+    daemonic processes are not allowed to have children"). subprocess
+    has no such restriction and still gives the crash isolation: a probe
+    segfault/OOM exits non-zero rather than killing the worker.
+    """
+    try:
+        result = subprocess.run(
+            [sys.executable, "-m", _PROBE_RUNNER_MODULE, str(path)],
+            capture_output=True, text=True, timeout=timeout,
+            cwd=str(_REPO_ROOT),
+        )
+    except subprocess.TimeoutExpired:
         return ProbeResult(ok=False, crashed=True, reason="archive probe timed out")
-    if proc.exitcode != 0:
-        # Negative exitcode = killed by signal (segfault); positive =
-        # the child os._exit'd or was OOM-killed. Either way the file
-        # hard-crashed the probe — the poison-pill signature.
+    if result.returncode != 0:
+        # Negative = killed by signal (segfault); positive = unhandled
+        # exception or OOM-kill. Either way: poison-pill signature.
         return ProbeResult(
             ok=False, crashed=True,
-            reason=f"archive probe crashed (exit {proc.exitcode})",
+            reason=f"archive probe crashed (exit {result.returncode})",
         )
+    last_line = result.stdout.strip().splitlines()[-1:] or [""]
     try:
-        outcome = q.get(timeout=5)
-    except Exception:  # noqa: BLE001 — empty queue / broken pipe
-        return ProbeResult(ok=False, crashed=True, reason="archive probe produced no result")
-    status, detail = outcome
-    if status == "ok":
+        outcome = json.loads(last_line[0])
+    except json.JSONDecodeError as exc:
+        return ProbeResult(
+            ok=False, crashed=True,
+            reason=f"archive probe produced no parseable result: {exc}",
+        )
+    if outcome.get("status") == "ok":
         return ProbeResult(ok=True)
-    return ProbeResult(ok=False, crashed=False, reason=detail)
+    return ProbeResult(
+        ok=False, crashed=False,
+        reason=outcome.get("detail") or "archive probe rejected",
+    )
 
 
-def _archive_probe_target(path_str: str, q) -> None:
-    """Runs in the spawned child. Reads member sizes (bomb guard) then
-    runs the format's integrity test. Puts ('ok', None) or
-    ('error', reason). A crash/OOM here never reaches the queue — the
-    parent reads the non-zero exit code instead."""
+def _run_probe(path_str: str) -> tuple[str, str | None]:
+    """Pure-Python body of the archive probe — bomb-guard + integrity test.
+
+    Returns ('ok', None) or ('error', reason). Caught exceptions become
+    clean 'error' rejections; uncaught crashes in the subprocess become
+    non-zero exit codes (poison-pill signature) handled by probe_archive.
+
+    Exposed at the module level so the subprocess runner and tests both
+    call the same code path.
+    """
     path = Path(path_str)
     ext = path.suffix.lower()
     try:
         total, test_bad = _inspect_archive(path, ext)
     except Exception as exc:  # noqa: BLE001 — clean rejection
-        q.put(("error", f"{type(exc).__name__}: {exc}"))
-        return
+        return ("error", f"{type(exc).__name__}: {exc}")
     if total is not None and total > MAX_ARCHIVE_UNCOMPRESSED_BYTES:
         gib = total / (1024 ** 3)
-        q.put(("error", f"uncompressed size {gib:.1f} GiB exceeds the bomb-guard cap"))
-        return
+        return ("error", f"uncompressed size {gib:.1f} GiB exceeds the bomb-guard cap")
     if test_bad is not None:
-        q.put(("error", f"integrity test failed at member {test_bad!r}"))
-        return
-    q.put(("ok", None))
+        return ("error", f"integrity test failed at member {test_bad!r}")
+    return ("ok", None)
 
 
 def _inspect_archive(path: Path, ext: str):

extension/background/background.js

@@ -259,6 +259,29 @@ browser.runtime.onMessage.addListener(async (msg) => {
         return { error: e.message };
       }
 
+    case 'PROBE_SOURCE':
+      try {
+        return await api.probeSource(msg.url);
+      } catch (e) {
+        return { error: e.message };
+      }
+
+    case 'OPEN_ARTIST_PAGE': {
+      // apiUrl is configured with the /api suffix (see
+      // options/options.html placeholder); the SPA artist route is
+      // /artist/:slug, served from the same origin. Strip /api so the
+      // browser-level URL hits the Vue router, not the JSON API.
+      const base = (api.baseUrl || '').replace(/\/+$/, '').replace(/\/api$/, '');
+      const slug = encodeURIComponent(msg.slug || '');
+      if (!base || !slug) return { error: 'apiUrl or slug missing' };
+      try {
+        await browser.tabs.create({ url: `${base}/artist/${slug}` });
+        return { success: true };
+      } catch (e) {
+        return { error: e.message };
+      }
+    }
+
     default:
       return { error: `Unknown message type: ${msg.type}` };
   }

extension/content/content-script.css

@@ -5,11 +5,26 @@
   background: rgb(20, 23, 26); color: rgb(244, 186, 122);
   font: 500 14px/1.2 system-ui, sans-serif;
   box-shadow: 0 4px 16px rgba(0, 0, 0, 0.4); cursor: pointer;
-  transition: transform 100ms ease;
+  transition: transform 100ms ease, background 150ms ease, color 150ms ease;
 }
 .fc-add-source-btn:hover { transform: translateY(-1px); }
 .fc-add-source-btn:disabled { opacity: 0.6; cursor: wait; }
 
+/* state colors map to the FC palette: parchment-on-slate base,
+   accent-orange for new, sage for already-subscribed, amber-warning for
+   artist-exists-but-source-missing. All readable on the dark base. */
+.fc-add-source-btn--new {
+  background: rgb(20, 23, 26); color: rgb(244, 186, 122);
+}
+.fc-add-source-btn--artist-match {
+  background: rgb(28, 23, 16); color: rgb(255, 200, 120);
+  border: 1px solid rgb(180, 130, 60);
+}
+.fc-add-source-btn--source-match {
+  background: rgb(18, 28, 20); color: rgb(140, 220, 160);
+  border: 1px solid rgb(80, 160, 100);
+}
+
 .fc-toast {
   all: revert;
   position: fixed; bottom: 84px; right: 24px; z-index: 2147483647;

extension/content/content-script.js

@@ -2,6 +2,10 @@
   if (window.__fc_addsource_injected) return;
   window.__fc_addsource_injected = true;
 
+  // Cached probe result for the current URL so click-handlers know which
+  // action to dispatch without round-tripping again.
+  let currentProbe = null;
+
   evaluate();
 
   const reEval = () => evaluate();
@@ -9,38 +13,116 @@
   const origPush = history.pushState;
   history.pushState = function () { origPush.apply(this, arguments); reEval(); };
 
-  function evaluate() {
-    const platform = getPlatformFromUrl(window.location.href);
-    const onArtist = platform && isArtistPage(window.location.href, platform);
-    let btn = document.getElementById('fc-add-source-btn');
-    if (onArtist && !btn) injectButton();
-    else if (!onArtist && btn) btn.remove();
+  async function evaluate() {
+    const url = window.location.href;
+    const platform = getPlatformFromUrl(url);
+    const onArtist = platform && isArtistPage(url, platform);
+    const btn = document.getElementById('fc-add-source-btn');
+    if (!onArtist) {
+      if (btn) btn.remove();
+      currentProbe = null;
+      return;
+    }
+    // On artist pages, ask the backend what state the URL is in BEFORE
+    // injecting the button — so the chip can render the right state on
+    // first paint instead of flashing the generic "Add" copy and
+    // updating afterwards.
+    let probe;
+    try {
+      probe = await browser.runtime.sendMessage({ type: 'PROBE_SOURCE', url });
+    } catch (e) {
+      probe = { error: e?.message || 'probe failed' };
+    }
+    currentProbe = probe;
+    if (probe?.state === 'unknown_platform') {
+      if (btn) btn.remove();
+      return;
+    }
+    renderButton(probe);
   }
 
-  function injectButton() {
-    const btn = document.createElement('button');
-    btn.id = 'fc-add-source-btn';
+  function renderButton(probe) {
+    let btn = document.getElementById('fc-add-source-btn');
+    if (!btn) {
+      btn = document.createElement('button');
+      btn.id = 'fc-add-source-btn';
+      btn.addEventListener('click', onClick);
+      document.body.appendChild(btn);
+    }
+    // Reset state classes so re-renders (SPA navigation) don't stack.
     btn.className = 'fc-add-source-btn';
-    btn.textContent = '+ Add to FabledCurator';
-    btn.addEventListener('click', onClick);
-    document.body.appendChild(btn);
+    btn.classList.add(`fc-add-source-btn--${stateModifier(probe)}`);
+    btn.textContent = labelFor(probe);
+    btn.disabled = false;
+  }
+
+  function stateModifier(probe) {
+    if (!probe || probe.error) return 'new';
+    return ({
+      source_match: 'source-match',
+      artist_match: 'artist-match',
+      new: 'new',
+    })[probe.state] || 'new';
+  }
+
+  function labelFor(probe) {
+    if (!probe || probe.error) return '+ Add to FabledCurator';
+    const platformName = platformDisplayName(probe.platform);
+    const artistName = probe.artist?.name;
+    switch (probe.state) {
+      case 'source_match':
+        return `✓ In FabledCurator · ${platformName}`;
+      case 'artist_match':
+        return `+ Add ${platformName} source to ${artistName || 'artist'}`;
+      case 'new':
+      default:
+        return '+ Add to FabledCurator';
+    }
+  }
+
+  function platformDisplayName(key) {
+    return PLATFORMS[key]?.name || key || '';
   }
 
   async function onClick() {
     const btn = document.getElementById('fc-add-source-btn');
+    if (!btn) return;
     btn.disabled = true;
     const original = btn.textContent;
+    const probe = currentProbe;
+
+    if (probe?.state === 'source_match') {
+      btn.textContent = 'Opening…';
+      try {
+        const r = await browser.runtime.sendMessage({
+          type: 'OPEN_ARTIST_PAGE',
+          slug: probe.artist?.slug,
+        });
+        if (r?.error) showToast(`Error: ${r.error}`, 'error');
+      } catch (e) {
+        showToast(`Error: ${e.message}`, 'error');
+      } finally {
+        btn.disabled = false;
+        btn.textContent = original;
+      }
+      return;
+    }
+
     btn.textContent = 'Adding…';
     try {
       const r = await browser.runtime.sendMessage({
         type: 'ADD_AS_SOURCE',
         url: window.location.href,
       });
-      if (r.error) {
+      if (r?.error) {
         showToast(`Error: ${r.error}`, 'error');
       } else {
         const verb = r.created_source ? 'Added' : 'Already a source for';
         showToast(`${verb} ${r.artist?.name || 'artist'} (${r.source?.platform || ''})`, 'success');
+        // Re-probe so the chip flips green without waiting for the next
+        // navigation.
+        evaluate();
+        return;
       }
     } catch (e) {
       showToast(`Error: ${e.message}`, 'error');

extension/lib/api.js

@@ -83,6 +83,12 @@ class FabledCuratorAPI {
   quickAddSource(url) {
     return this.request('POST', '/extension/quick-add-source', { url });
   }
+  probeSource(url) {
+    // Read-only existence check. Drives the content-script chip's
+    // color/copy BEFORE the operator clicks Add.
+    const qs = new URLSearchParams({ url }).toString();
+    return this.request('GET', `/extension/probe?${qs}`);
+  }
 
   // Connection test = the cheapest read with auth.
   testConnection() {

extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "FabledCurator",
-  "version": "1.0.5",
+  "version": "1.0.6",
   "description": "Export cookies from supported platforms to FabledCurator and add creators as sources in one click.",
 
   "browser_specific_settings": {

extension/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fabledcurator-extension",
-  "version": "1.0.5",
+  "version": "1.0.6",
   "private": true,
   "description": "Firefox extension for FabledCurator",
   "scripts": {

frontend/package.json

@@ -26,6 +26,8 @@
     "vue-tsc": "^2.0.0",
     "vite-plugin-vuetify": "^2.0.0",
     "sass": "^1.71.0",
-    "vitest": "^2.1.0"
+    "vitest": "^2.1.0",
+    "@vue/test-utils": "^2.4.0",
+    "happy-dom": "^15.0.0"
   }
 }

frontend/src/components/PipelineStatusChip.vue

@@ -0,0 +1,146 @@
+<template>
+  <v-menu location="bottom start" :close-on-content-click="false">
+    <template #activator="{ props }">
+      <button
+        v-bind="props" type="button"
+        class="fc-pulse" :class="`fc-pulse--${schedHealth}`"
+        :aria-label="`pipeline: ${running} running, ${queued} queued, ${failing} failing`"
+      >
+        <span class="fc-pulse__dot" />
+        <span v-if="running" class="fc-pulse__stat">
+          <v-icon size="13">mdi-progress-download</v-icon>{{ running }}
+        </span>
+        <span v-if="queued" class="fc-pulse__stat">
+          <v-icon size="13">mdi-tray-full</v-icon>{{ queued }}
+        </span>
+        <span v-if="failing" class="fc-pulse__stat fc-pulse__stat--err">
+          <v-icon size="13">mdi-alert-circle</v-icon>{{ failing }}
+        </span>
+        <span v-if="!running && !queued && !failing" class="fc-pulse__idle">idle</span>
+      </button>
+    </template>
+
+    <v-card min-width="300" class="fc-pulse__panel pa-3">
+      <div class="fc-pulse__row">
+        <span class="fc-pulse__rowdot" :class="`fc-pulse--${schedHealth}`" />
+        <strong>Scheduler</strong>
+        <v-spacer />
+        <span class="fc-pulse__muted">{{ schedLabel }}</span>
+      </div>
+
+      <div class="fc-pulse__sec">
+        <div class="fc-pulse__sechead">Queues</div>
+        <div v-if="busyQueues.length === 0" class="fc-pulse__muted">All idle</div>
+        <div v-for="q in busyQueues" :key="q.name" class="fc-pulse__qrow">
+          <span>{{ q.name }}</span><v-spacer /><strong>{{ q.depth }}</strong>
+        </div>
+      </div>
+
+      <div class="fc-pulse__sec fc-pulse__grid">
+        <div><span class="fc-pulse__muted">Running</span><div class="fc-pulse__big">{{ running }}</div></div>
+        <div><span class="fc-pulse__muted">Queued</span><div class="fc-pulse__big">{{ queued }}</div></div>
+        <div>
+          <span class="fc-pulse__muted">Failures 24h</span>
+          <div class="fc-pulse__big" :class="{ 'fc-pulse__big--err': failing }">{{ failing }}</div>
+        </div>
+      </div>
+
+      <RouterLink
+        class="fc-pulse__link"
+        :to="{ path: '/subscriptions', query: { tab: 'downloads' } }"
+      >Open downloads →</RouterLink>
+    </v-card>
+  </v-menu>
+</template>
+
+<script setup>
+import { computed, onMounted, onUnmounted } from 'vue'
+
+import { useSystemActivityStore } from '../stores/systemActivity.js'
+import { formatRelative } from '../utils/date.js'
+
+const store = useSystemActivityStore()
+
+// Beat ticks every 60s; flag the scheduler stale past ~3 min.
+const STALE_MS = 180_000
+const summary = computed(() => store.summary)
+const running = computed(() => summary.value?.running ?? 0)
+const queued = computed(() => summary.value?.queued_total ?? 0)
+const failing = computed(() => summary.value?.failing ?? 0)
+
+const schedHealth = computed(() => {
+  const t = summary.value?.scheduler?.last_tick_at
+  if (!t) return 'unknown'
+  return (Date.now() - new Date(t).getTime()) <= STALE_MS ? 'ok' : 'stale'
+})
+const schedLabel = computed(() => {
+  const s = summary.value?.scheduler
+  if (!s) return '—'
+  const ran = formatRelative(s.last_tick_at, { nullText: 'never' })
+  if (s.due_now > 0) return `ran ${ran} · ${s.due_now} due`
+  return `ran ${ran}`
+})
+const busyQueues = computed(() => {
+  const q = summary.value?.queues || {}
+  return Object.entries(q)
+    .filter(([, depth]) => typeof depth === 'number' && depth > 0)
+    .map(([name, depth]) => ({ name, depth }))
+})
+
+const POLL_MS = 8000
+let timer = null
+onMounted(() => {
+  store.loadSummary()
+  timer = setInterval(() => {
+    if (!document.hidden) store.loadSummary()
+  }, POLL_MS)
+})
+onUnmounted(() => { if (timer) clearInterval(timer) })
+</script>
+
+<style scoped>
+.fc-pulse {
+  display: inline-flex; align-items: center; gap: 6px;
+  padding: 3px 8px; border-radius: 999px;
+  background: rgb(var(--v-theme-on-surface) / 0.08);
+  color: rgb(var(--v-theme-on-surface));
+  font-size: 0.78rem; font-variant-numeric: tabular-nums;
+  cursor: pointer; border: 0;
+}
+.fc-pulse:hover { background: rgb(var(--v-theme-on-surface) / 0.16); }
+.fc-pulse__dot {
+  width: 8px; height: 8px; border-radius: 50%; flex: 0 0 auto;
+  background: rgb(var(--v-theme-on-surface-variant));
+}
+.fc-pulse--ok .fc-pulse__dot,
+.fc-pulse--ok.fc-pulse__rowdot { background: rgb(var(--v-theme-success)); }
+.fc-pulse--stale .fc-pulse__dot,
+.fc-pulse--stale.fc-pulse__rowdot { background: rgb(var(--v-theme-error)); }
+.fc-pulse__stat { display: inline-flex; align-items: center; gap: 2px; }
+.fc-pulse__stat--err { color: rgb(var(--v-theme-error)); }
+.fc-pulse__idle {
+  text-transform: uppercase; letter-spacing: 0.06em;
+  color: rgb(var(--v-theme-on-surface-variant)); font-size: 0.68rem;
+}
+
+.fc-pulse__panel { background: rgb(var(--v-theme-surface)); }
+.fc-pulse__row { display: flex; align-items: center; gap: 8px; }
+.fc-pulse__rowdot {
+  width: 9px; height: 9px; border-radius: 50%;
+  background: rgb(var(--v-theme-on-surface-variant));
+}
+.fc-pulse__muted { color: rgb(var(--v-theme-on-surface-variant)); font-size: 0.8rem; }
+.fc-pulse__sec { margin-top: 12px; }
+.fc-pulse__sechead {
+  font-size: 0.72rem; text-transform: uppercase; letter-spacing: 0.05em;
+  color: rgb(var(--v-theme-on-surface-variant)); margin-bottom: 4px;
+}
+.fc-pulse__qrow { display: flex; align-items: center; font-size: 0.85rem; padding: 2px 0; }
+.fc-pulse__grid { display: flex; gap: 16px; }
+.fc-pulse__big { font-size: 1.3rem; font-weight: 700; font-variant-numeric: tabular-nums; }
+.fc-pulse__big--err { color: rgb(var(--v-theme-error)); }
+.fc-pulse__link {
+  display: inline-block; margin-top: 14px;
+  color: rgb(var(--v-theme-accent)); text-decoration: none; font-size: 0.85rem;
+}
+</style>

frontend/src/components/TopNav.vue

@@ -8,6 +8,7 @@
       <span class="fc-health" :title="health.label">
         <v-icon size="x-small" :color="health.color">{{ health.icon }}</v-icon>
       </span>
+      <PipelineStatusChip />
     </div>
 
     <nav class="fc-links">
@@ -29,6 +30,7 @@
 import { computed, onMounted } from 'vue'
 import router, { FRONT_DOOR } from '../router.js'
 import { useSystemStore } from '../stores/system.js'
+import PipelineStatusChip from './PipelineStatusChip.vue'
 
 const system = useSystemStore()
 onMounted(() => system.refreshHealth())

frontend/src/components/artist/ArtistHeader.vue

@@ -35,6 +35,7 @@
 
 <script setup>
 import { computed } from 'vue'
+import { formatLocalDate } from '../../utils/date.js'
 
 const props = defineProps({
   name:        { type: String, required: true },
@@ -52,7 +53,7 @@ const stats = computed(() => {
     parts.push(`${props.imageCount} image${props.imageCount === 1 ? '' : 's'}`)
   }
   if (props.lastAdded) {
-    parts.push(`last added ${props.lastAdded.slice(0, 10)}`)
+    parts.push(`last added ${formatLocalDate(props.lastAdded)}`)
   }
   return parts.join(' · ')
 })

frontend/src/components/artist/ArtistPostsTab.vue

@@ -28,10 +28,11 @@
 </template>
 
 <script setup>
-import { onMounted, onUnmounted, ref, watch } from 'vue'
+import { onMounted, ref, watch } from 'vue'
 import { RouterLink } from 'vue-router'
 
 import { usePostsStore } from '../../stores/posts.js'
+import { useInfiniteScroll } from '../../composables/useInfiniteScroll.js'
 import PostCard from '../posts/PostCard.vue'
 
 const props = defineProps({
@@ -42,7 +43,6 @@ defineEmits(['switch-tab'])
 
 const store = usePostsStore()
 const sentinel = ref(null)
-let observer = null
 
 async function reload () {
   await store.loadInitial({ artist_id: props.artistId, platform: null })
@@ -50,19 +50,9 @@ async function reload () {
 
 watch(() => props.artistId, reload)
 
-onMounted(async () => {
-  await reload()
-  observer = new IntersectionObserver((entries) => {
-    if (entries.some(e => e.isIntersecting)) {
-      store.loadMore()
-    }
-  }, { rootMargin: '400px 0px' })
-  if (sentinel.value) observer.observe(sentinel.value)
-})
+useInfiniteScroll(sentinel, () => store.loadMore(), { rootMargin: '400px 0px' })
 
-onUnmounted(() => {
-  if (observer) observer.disconnect()
-})
+onMounted(reload)
 </script>
 
 <style scoped>

frontend/src/components/cleanup/MinDimensionCard.vue

@@ -62,6 +62,7 @@
 </template>
 
 <script setup>
+import { toast } from '../../utils/toast.js'
 import { onMounted, ref } from 'vue'
 
 import DestructiveConfirmModal from '../modal/DestructiveConfirmModal.vue'
@@ -94,7 +95,7 @@ async function onPreview() {
   try {
     preview.value = await store.previewMinDim(minW.value, minH.value)
   } catch (e) {
-    window.__fcToast?.({ text: `Preview failed: ${e.message}`, type: 'error' })
+    toast({ text: `Preview failed: ${e.message}`, type: 'error' })
   } finally {
     busy.value = false
   }
@@ -108,12 +109,12 @@ function onDeleteClick() {
 async function onConfirmedDelete(token) {
   try {
     const res = await store.deleteMinDim(minW.value, minH.value, token)
-    window.__fcToast?.({
+    toast({
       text: `Deleted ${res.deleted} image(s)`, type: 'success',
     })
     preview.value = null
   } catch (e) {
-    window.__fcToast?.({ text: `Delete failed: ${e.message}`, type: 'error' })
+    toast({ text: `Delete failed: ${e.message}`, type: 'error' })
   }
 }
 </script>

frontend/src/components/cleanup/SingleColorAuditCard.vue

@@ -93,6 +93,7 @@
 </template>
 
 <script setup>
+import { toast } from '../../utils/toast.js'
 import { onMounted, onUnmounted, ref } from 'vue'
 
 import DestructiveConfirmModal from '../modal/DestructiveConfirmModal.vue'
@@ -124,7 +125,7 @@ function startPoll(id) {
       if (fresh.status !== 'running') stopPoll()
     } catch (e) {
       stopPoll()
-      window.__fcToast?.({ text: `Audit poll failed: ${e.message}`, type: 'error' })
+      toast({ text: `Audit poll failed: ${e.message}`, type: 'error' })
     }
   }, 5000)
 }
@@ -142,7 +143,7 @@ async function onStart() {
     audit.value = await store.getAudit(res.audit_id)
     startPoll(res.audit_id)
   } catch (e) {
-    window.__fcToast?.({ text: `Scan start failed: ${e.message}`, type: 'error' })
+    toast({ text: `Scan start failed: ${e.message}`, type: 'error' })
   } finally {
     busy.value = false
   }
@@ -155,7 +156,7 @@ async function onCancel() {
     audit.value = await store.getAudit(audit.value.id)
     stopPoll()
   } catch (e) {
-    window.__fcToast?.({ text: `Cancel failed: ${e.message}`, type: 'error' })
+    toast({ text: `Cancel failed: ${e.message}`, type: 'error' })
   }
 }
 
@@ -167,12 +168,12 @@ function onApplyClick() {
 async function onConfirmedApply(token) {
   try {
     const res = await store.applyAudit(audit.value.id, token)
-    window.__fcToast?.({
+    toast({
       text: `Deleted ${res.deleted} image(s)`, type: 'success',
     })
     audit.value = await store.getAudit(audit.value.id)
   } catch (e) {
-    window.__fcToast?.({ text: `Apply failed: ${e.message}`, type: 'error' })
+    toast({ text: `Apply failed: ${e.message}`, type: 'error' })
   }
 }
 </script>

frontend/src/components/cleanup/TransparencyAuditCard.vue

@@ -80,6 +80,7 @@
 </template>
 
 <script setup>
+import { toast } from '../../utils/toast.js'
 import { onMounted, onUnmounted, ref } from 'vue'
 
 import DestructiveConfirmModal from '../modal/DestructiveConfirmModal.vue'
@@ -109,7 +110,7 @@ function startPoll(id) {
       if (fresh.status !== 'running') stopPoll()
     } catch (e) {
       stopPoll()
-      window.__fcToast?.({ text: `Audit poll failed: ${e.message}`, type: 'error' })
+      toast({ text: `Audit poll failed: ${e.message}`, type: 'error' })
     }
   }, 5000)
 }
@@ -125,7 +126,7 @@ async function onStart() {
     audit.value = await store.getAudit(res.audit_id)
     startPoll(res.audit_id)
   } catch (e) {
-    window.__fcToast?.({ text: `Scan start failed: ${e.message}`, type: 'error' })
+    toast({ text: `Scan start failed: ${e.message}`, type: 'error' })
   } finally {
     busy.value = false
   }
@@ -138,7 +139,7 @@ async function onCancel() {
     audit.value = await store.getAudit(audit.value.id)
     stopPoll()
   } catch (e) {
-    window.__fcToast?.({ text: `Cancel failed: ${e.message}`, type: 'error' })
+    toast({ text: `Cancel failed: ${e.message}`, type: 'error' })
   }
 }
 
@@ -150,12 +151,12 @@ function onApplyClick() {
 async function onConfirmedApply(token) {
   try {
     const res = await store.applyAudit(audit.value.id, token)
-    window.__fcToast?.({
+    toast({
       text: `Deleted ${res.deleted} image(s)`, type: 'success',
     })
     audit.value = await store.getAudit(audit.value.id)
   } catch (e) {
-    window.__fcToast?.({ text: `Apply failed: ${e.message}`, type: 'error' })
+    toast({ text: `Apply failed: ${e.message}`, type: 'error' })
   }
 }
 </script>

frontend/src/components/common/ErrorDetailModal.vue

@@ -33,6 +33,7 @@
 </template>
 
 <script setup>
+import { toast } from '../../utils/toast.js'
 import { computed, ref, watch } from 'vue'
 
 import { copyText } from '../../utils/clipboard.js'
@@ -119,7 +120,7 @@ async function onCopy () {
     if (copiedTimer) clearTimeout(copiedTimer)
     copiedTimer = setTimeout(() => { copied.value = false }, 1500)
   } catch (e) {
-    window.__fcToast?.({ text: `Copy failed: ${e.message}`, type: 'error' })
+    toast({ text: `Copy failed: ${e.message}`, type: 'error' })
   }
 }
 </script>

frontend/src/components/credentials/ExtensionKeyBar.vue

@@ -26,6 +26,7 @@
 </template>
 
 <script setup>
+import { toast } from '../../utils/toast.js'
 import { onMounted, ref } from 'vue'
 import { useCredentialsStore } from '../../stores/credentials.js'
 import { copyText } from '../../utils/clipboard.js'
@@ -39,9 +40,9 @@ async function copyKey() {
   if (!store.extensionKey) return
   try {
     await copyText(store.extensionKey)
-    globalThis.window?.__fcToast?.({ text: 'Copied', type: 'success' })
+    toast({ text: 'Copied', type: 'success' })
   } catch {
-    globalThis.window?.__fcToast?.({ text: 'Copy failed', type: 'error' })
+    toast({ text: 'Copy failed', type: 'error' })
   }
 }
 
@@ -50,7 +51,7 @@ function confirmRotate() { showRotateConfirm.value = true }
 async function doRotate() {
   showRotateConfirm.value = false
   await store.rotateKey()
-  globalThis.window?.__fcToast?.({ text: 'Key rotated', type: 'success' })
+  toast({ text: 'Key rotated', type: 'success' })
 }
 </script>
 

frontend/src/components/credentials/PlatformCredentialRow.vue

@@ -32,6 +32,8 @@
 </template>
 
 <script setup>
+import { formatLocalDate } from '../../utils/date.js'
+
 defineProps({
   platform: { type: Object, required: true },
   credential: { type: Object, default: null },
@@ -39,8 +41,7 @@ defineProps({
 defineEmits(['replace', 'remove'])
 
 function fmtDate(iso) {
-  if (!iso) return '—'
-  return iso.slice(0, 10)
+  return iso ? formatLocalDate(iso) : '—'
 }
 </script>
 

frontend/src/components/discovery/MasonryGrid.vue

@@ -30,8 +30,9 @@
 </template>
 
 <script setup>
-import { ref, computed, onMounted, onUnmounted, watch } from 'vue'
+import { ref, computed } from 'vue'
 import { usePolyMasonry } from '../../composables/usePolyMasonry.js'
+import { useInfiniteScroll } from '../../composables/useInfiniteScroll.js'
 
 const props = defineProps({
   items: { type: Array, default: () => [] },
@@ -78,20 +79,18 @@ function aspectStyle(item) {
   return { aspectRatio: `${w} / ${h}` }
 }
 
-let observer = null
-function attachObserver() {
-  if (observer) observer.disconnect()
-  if (!sentinelEl.value) return
-  observer = new IntersectionObserver(([entry]) => {
-    if (entry.isIntersecting && props.hasMore && !props.loading) {
-      emit('load-more')
-    }
-  }, { rootMargin: '600px' })
-  observer.observe(sentinelEl.value)
-}
-watch(sentinelEl, attachObserver)
-onMounted(attachObserver)
-onUnmounted(() => observer && observer.disconnect())
+// Larger rootMargin than the composable default (600px) because the
+// sentinel sits at the BOTTOM of the masonry container, whose height is
+// the MAX of the column heights. A single tall image (long manga page,
+// panorama) in one column pushes the sentinel way past the visible
+// bottom of the SHORTER columns — the user reads the short-column
+// bottoms long before the sentinel comes into view, and load-more
+// fires too late. 2400px ≈ 2-3 screen-heights of pre-emptive trigger,
+// comfortably covering typical tall-image heights. Operator-flagged
+// 2026-05-30.
+useInfiniteScroll(sentinelEl, () => {
+  if (props.hasMore && !props.loading) emit('load-more')
+}, { rootMargin: '2400px' })
 </script>
 
 <style scoped>
@@ -100,32 +99,54 @@ onUnmounted(() => observer && observer.disconnect())
 .fc-masonry__item {
   display: block; padding: 0; border: 0; background: none;
   cursor: pointer; width: 100%;
+  overflow: hidden; border-radius: 4px;
 }
 .fc-masonry__item img {
-  width: 100%; height: auto; display: block; border-radius: 4px;
+  width: 100%; height: auto; display: block;
   background: rgb(var(--v-theme-surface-light));
+  /* IR-parity hover: zoom + brighten the thumbnail (style.css ~1772). */
+  transition: transform 0.3s ease, filter 0.3s ease;
+}
+.fc-masonry__item:hover img {
+  transform: scale(1.03);
+  filter: brightness(1.1);
 }
 .fc-masonry__sentinel {
   display: flex; justify-content: center; padding: 32px 0; min-height: 60px;
 }
 .fc-masonry__end { text-align: center; padding: 32px 0; }
 
-/* IR-parity stagger fade-in for showcase entry / shuffle. 60ms between
-   items, 250ms each — matches IR's `itemFadeIn` keyframe (style.css
-   ~line 1834). Honors prefers-reduced-motion. */
+/* Cascade entry: each tile flips up out of a backward tilt and settles
+   into place, one at a time — more pronounced than a plain fade so the
+   showcase reads as an "experience" (operator-flagged 2026-05-28). The
+   `both` fill holds the hidden/tilted 0% state until each tile's staggered
+   turn; the cubic-bezier overshoots slightly past flat then settles.
+   Honors prefers-reduced-motion. Tunables: tilt (-28deg), stagger (70ms),
+   duration (0.6s). */
 @keyframes fc-masonry-item-in {
-  from { opacity: 0; transform: translateY(12px); }
-  to   { opacity: 1; transform: translateY(0); }
+  0% {
+    opacity: 0;
+    transform: perspective(1000px) rotateX(-28deg) translateY(26px) scale(0.95);
+  }
+  55% { opacity: 1; }
+  100% {
+    opacity: 1;
+    transform: perspective(1000px) rotateX(0deg) translateY(0) scale(1);
+  }
 }
 .fc-masonry__item--anim {
-  animation: fc-masonry-item-in 0.25s ease forwards;
-  animation-delay: calc(var(--stagger-index, 0) * 60ms);
-  opacity: 0;
+  transform-origin: center top;
+  backface-visibility: hidden;
+  animation: fc-masonry-item-in 0.6s cubic-bezier(0.34, 1.45, 0.64, 1) both;
+  animation-delay: calc(var(--stagger-index, 0) * 70ms);
 }
 @media (prefers-reduced-motion: reduce) {
   .fc-masonry__item--anim {
     animation: none;
     opacity: 1;
+    transform: none;
   }
+  .fc-masonry__item img { transition: none; }
+  .fc-masonry__item:hover img { transform: none; }
 }
 </style>

frontend/src/components/downloads/DownloadDetailModal.vue

@@ -7,7 +7,7 @@
       </v-card-title>
       <v-card-text>
         <p class="text-caption" style="opacity: 0.75">
-          {{ event.started_at }} → {{ event.finished_at || '(running)' }}
+          {{ formatDateTime(event.started_at) }} → {{ event.finished_at ? formatDateTime(event.finished_at) : '(running)' }}
           ({{ fmtDuration(event.summary?.duration_seconds) }})
         </p>
 
@@ -35,20 +35,53 @@
           </ul>
         </template>
 
+        <template v-if="event.error">
+          <div class="fc-dl-blockhead mt-4">
+            <h3 class="text-subtitle-2">Error</h3>
+            <v-btn
+              size="x-small" variant="text" prepend-icon="mdi-content-copy"
+              @click="onCopy('Error', event.error)"
+            >Copy</v-btn>
+          </div>
+          <pre class="fc-dl-pre">{{ event.error }}</pre>
+        </template>
+
         <template v-if="errorsWarnings">
-          <h3 class="text-subtitle-2 mt-4">Errors &amp; warnings</h3>
+          <div class="fc-dl-blockhead mt-4">
+            <h3 class="text-subtitle-2">Errors &amp; warnings</h3>
+            <v-btn
+              size="x-small" variant="text" prepend-icon="mdi-content-copy"
+              @click="onCopy('Errors & warnings', errorsWarnings)"
+            >Copy</v-btn>
+          </div>
           <pre class="fc-dl-pre">{{ errorsWarnings }}</pre>
         </template>
 
         <v-expansion-panels class="mt-4">
           <v-expansion-panel>
-            <v-expansion-panel-title>Raw stdout</v-expansion-panel-title>
+            <v-expansion-panel-title>
+              <span>Raw stdout</span>
+              <v-spacer />
+              <v-btn
+                size="x-small" variant="text" prepend-icon="mdi-content-copy"
+                class="me-2"
+                @click.stop="onCopy('stdout', event.metadata?.stdout || '')"
+              >Copy</v-btn>
+            </v-expansion-panel-title>
             <v-expansion-panel-text>
               <pre class="fc-dl-pre">{{ event.metadata?.stdout || '(empty)' }}</pre>
             </v-expansion-panel-text>
           </v-expansion-panel>
           <v-expansion-panel>
-            <v-expansion-panel-title>Raw stderr</v-expansion-panel-title>
+            <v-expansion-panel-title>
+              <span>Raw stderr</span>
+              <v-spacer />
+              <v-btn
+                size="x-small" variant="text" prepend-icon="mdi-content-copy"
+                class="me-2"
+                @click.stop="onCopy('stderr', event.metadata?.stderr || '')"
+              >Copy</v-btn>
+            </v-expansion-panel-title>
             <v-expansion-panel-text>
               <pre class="fc-dl-pre">{{ event.metadata?.stderr || '(empty)' }}</pre>
             </v-expansion-panel-text>
@@ -56,6 +89,10 @@
         </v-expansion-panels>
       </v-card-text>
       <v-card-actions>
+        <v-btn
+          variant="text" prepend-icon="mdi-content-copy"
+          @click="onCopy('All diagnostics', allDiagnostics)"
+        >Copy all diagnostics</v-btn>
         <v-spacer />
         <v-btn variant="text" @click="onClose(false)">Close</v-btn>
       </v-card-actions>
@@ -64,8 +101,12 @@
 </template>
 
 <script setup>
+import { toast } from '../../utils/toast.js'
 import { computed } from 'vue'
 
+import { copyText } from '../../utils/clipboard.js'
+import { formatDateTime } from '../../utils/date.js'
+
 const props = defineProps({ event: { type: Object, default: null } })
 const emit = defineEmits(['close'])
 
@@ -74,6 +115,32 @@ const summary = computed(() => props.event?.metadata?.import_summary || {})
 const quarantinedPaths = computed(() => props.event?.metadata?.quarantined_paths || [])
 const errorsWarnings = computed(() => props.event?.metadata?.stderr_errors_warnings || '')
 
+// One combined block for "research the issue elsewhere" — header line +
+// error + full stdout/stderr. Built lazily from the current event.
+const allDiagnostics = computed(() => {
+  const e = props.event
+  if (!e) return ''
+  const md = e.metadata || {}
+  return [
+    `event #${e.id} · ${e.platform || '—'} · ${e.artist_name || '—'}`,
+    `status: ${e.status}`,
+    `started: ${e.started_at}  finished: ${e.finished_at || '(running)'}`,
+    e.error ? `\n--- error ---\n${e.error}` : '',
+    errorsWarnings.value ? `\n--- errors & warnings ---\n${errorsWarnings.value}` : '',
+    `\n--- stdout ---\n${md.stdout || '(empty)'}`,
+    `\n--- stderr ---\n${md.stderr || '(empty)'}`,
+  ].filter(Boolean).join('\n')
+})
+
+async function onCopy(label, text) {
+  try {
+    await copyText(text || '')
+    toast({ text: `${label} copied`, type: 'success' })
+  } catch (e) {
+    toast({ text: `Copy failed: ${e.message}`, type: 'error' })
+  }
+}
+
 const statusColor = computed(() => ({
   ok: 'success', error: 'error', running: 'info',
   pending: 'secondary', skipped: 'warning',
@@ -114,4 +181,8 @@ function onClose() {
   word-break: break-all;
 }
 .fc-dl-quar { padding-left: 1.5rem; font-size: 0.85rem; }
+.fc-dl-blockhead {
+  display: flex; align-items: center; justify-content: space-between;
+  gap: 0.5rem;
+}
 </style>

frontend/src/components/downloads/DownloadEventRow.vue

@@ -86,11 +86,14 @@
 </template>
 
 <script setup>
+import { toast } from '../../utils/toast.js'
 import { computed, ref } from 'vue'
 import { RouterLink } from 'vue-router'
 
 import PlatformChip from '../subscriptions/PlatformChip.vue'
 import { useSourcesStore } from '../../stores/sources.js'
+import { downloadStatusColor, downloadStatusIcon, downloadStatusLabel } from '../../utils/downloadStatus.js'
+import { formatDateTime } from '../../utils/date.js'
 
 const props = defineProps({ event: { type: Object, required: true } })
 defineEmits(['open'])
@@ -98,21 +101,12 @@ defineEmits(['open'])
 const sourcesStore = useSourcesStore()
 const retrying = ref(false)
 
-const _STATUS = {
-  ok:      { color: 'success', icon: 'mdi-check-circle',    label: 'Completed' },
-  error:   { color: 'error',   icon: 'mdi-alert-circle',    label: 'Failed' },
-  running: { color: 'info',    icon: 'mdi-progress-clock',  label: 'Running' },
-  pending: { color: 'grey',    icon: 'mdi-clock-outline',   label: 'Queued' },
-  skipped: { color: 'warning', icon: 'mdi-skip-next',       label: 'Skipped' },
-}
-const statusColor = computed(() => _STATUS[props.event.status]?.color || 'grey')
-const statusIcon = computed(() => _STATUS[props.event.status]?.icon || 'mdi-help-circle')
-const statusLabel = computed(() => _STATUS[props.event.status]?.label || props.event.status)
+const statusColor = computed(() => downloadStatusColor(props.event.status))
+const statusIcon = computed(() => downloadStatusIcon(props.event.status))
+const statusLabel = computed(() => downloadStatusLabel(props.event.status))
 
 function fmtTime(iso) {
-  if (!iso) return '—'
-  // 2026-05-27 23:36 — second granularity is in the row's title attr
-  return iso.slice(0, 16).replace('T', ' ')
+  return iso ? formatDateTime(iso) : '—'
 }
 function fmtDuration(sec) {
   if (sec == null) return '—'
@@ -131,12 +125,12 @@ async function onRetry() {
   retrying.value = true
   try {
     await sourcesStore.checkNow(props.event.source_id)
-    globalThis.window?.__fcToast?.({
+    toast({
       text: `Source check re-queued`, type: 'success',
     })
   } catch (e) {
     const isInFlight = !!e?.body?.download_event_id
-    globalThis.window?.__fcToast?.({
+    toast({
       text: isInFlight ? 'Already running' : `Retry failed: ${e?.detail || e?.message || e}`,
       type: isInFlight ? 'info' : 'error',
     })

frontend/src/components/gallery/GalleryGrid.vue

@@ -32,8 +32,9 @@
 </template>
 
 <script setup>
-import { onMounted, onUnmounted, ref, watch } from 'vue'
+import { ref } from 'vue'
 import { useGalleryStore } from '../../stores/gallery.js'
+import { useInfiniteScroll } from '../../composables/useInfiniteScroll.js'
 import GalleryItem from './GalleryItem.vue'
 
 defineEmits(['open'])
@@ -41,22 +42,9 @@ defineEmits(['open'])
 const store = useGalleryStore()
 const sentinelEl = ref(null)
 
-let observer = null
-
-function attachObserver() {
-  if (observer) observer.disconnect()
-  if (!sentinelEl.value) return
-  observer = new IntersectionObserver(([entry]) => {
-    if (entry.isIntersecting && store.hasMore && !store.loading) {
-      store.loadMore()
-    }
-  }, { rootMargin: '600px' })
-  observer.observe(sentinelEl.value)
-}
-
-watch(sentinelEl, attachObserver)
-onMounted(() => attachObserver())
-onUnmounted(() => observer && observer.disconnect())
+useInfiniteScroll(sentinelEl, () => {
+  if (store.hasMore && !store.loading) store.loadMore()
+})
 
 function dateHeaderId(group) { return `fc-month-${group.year}-${group.month}` }
 

frontend/src/components/modal/AliasPickerDialog.vue

@@ -48,10 +48,11 @@ function onSearch(q) {
     if (!query) { results.value = []; return }
     loading.value = true
     try {
-      // Scope the autocomplete to the prediction's category where it maps
-      // to a tag kind. 'copyright' has no tag kind; search unscoped there.
-      const kind = ['artist', 'character'].includes(props.category)
-        ? props.category : null
+      // Scope the autocomplete to the prediction's category where it
+      // maps to a tag kind. Only 'character' surfaces as both a
+      // suggestion category and a tag kind now ('artist' + 'copyright'
+      // retired); other categories search unscoped.
+      const kind = props.category === 'character' ? 'character' : null
       const params = { q: query, limit: 20 }
       if (kind) params.kind = kind
       results.value = await api.get('/api/tags/autocomplete', { params })

frontend/src/components/modal/ImageViewer.vue

@@ -92,7 +92,16 @@ let prevBodyOverflow = null
 // own keystrokes.
 function onKeyDown(ev) {
   if (ev.key === 'Escape') {
-    if (isTextEntry(ev.target)) return
+    // Escape closes the modal even from inside a text input — that's
+    // the universal "get me out of here" expectation, and the
+    // autofocused tag-entry field would otherwise trap focus with no
+    // visible escape (operator-flagged 2026-06-01). EXCEPTION: when a
+    // nested Vuetify overlay is open (v-menu autocomplete dropdown,
+    // FandomPicker v-dialog, per-suggestion 3-dot menu), let that
+    // overlay's own Esc handling fire instead of closing the whole
+    // modal mid-interaction. Vuetify marks open overlays with
+    // `.v-overlay--active`.
+    if (document.querySelector('.v-overlay--active')) return
     ev.preventDefault()
     emit('close')
   } else if (ev.key === 'ArrowLeft') {

frontend/src/components/modal/ProvenancePanel.vue

@@ -10,17 +10,30 @@
       density="compact"
     >{{ state.error }}</v-alert>
 
-    <template v-else>
+    <!-- Cards scroll independently of the section title + attachments
+         below them. Cap at ~2.5 cards visible (operator-asked 2026-06-01:
+         keeps the Tags section anchored below at a consistent position;
+         the half-visible third card hints there's more). -->
+    <div v-else class="fc-prov__cards">
       <article
         v-for="e in state.entries" :key="e.provenance_id" class="fc-prov__card"
       >
         <div class="fc-prov__head">
-          <span class="fc-prov__platform">{{ e.source.platform }}</span>
+          <!-- Posts with no live subscription have source=null (alembic
+               0030); render an explicit "filesystem import" affordance
+               instead of a platform chip. -->
+          <span class="fc-prov__platform">
+            {{ e.source?.platform ?? 'filesystem import' }}
+          </span>
           <span v-if="postDate(e)" class="fc-prov__date">{{ postDate(e) }}</span>
         </div>
-        <div class="fc-prov__post">
-          {{ e.post.title || `Post ${e.post.external_post_id}` }}
-        </div>
+        <button
+          type="button" class="fc-prov__post"
+          :title="`Open ${postTitle(e)} in the posts feed for ${e.artist.name}`"
+          @click="openPost(e.post.id, e.artist.id)"
+        >
+          {{ postTitle(e) }}
+        </button>
         <div class="fc-prov__meta">
           <RouterLink :to="`/artist/${e.artist.slug}`">
             by {{ e.artist.name }}
@@ -29,17 +42,13 @@
             · {{ e.post.attachment_count }} files
           </span>
         </div>
-        <div class="fc-prov__actions">
+        <div v-if="e.post.description_html" class="fc-prov__actions">
           <a
-            v-if="e.post.url" :href="e.post.url"
-            target="_blank" rel="noopener noreferrer"
-          >↗ View original post</a>
-          <a href="#" @click.prevent="openPost(e.post.id)">
-            View images from this post
-          </a>
+            href="#" @click.prevent="toggleDesc(e.provenance_id)"
+          >{{ expanded[e.provenance_id] ? 'Hide description ▴' : 'Show description ▾' }}</a>
         </div>
         <div
-          v-if="e.post.description_html"
+          v-if="e.post.description_html && expanded[e.provenance_id]"
           class="fc-prov__desc" v-html="e.post.description_html"
         />
       </article>
@@ -58,7 +67,7 @@
           </RouterLink>
         </div>
       </article>
-    </template>
+    </div>
 
     <div v-if="attachments.length" class="fc-prov__attach">
       <h4 class="fc-prov__attach-title">Attachments</h4>
@@ -74,16 +83,27 @@
 </template>
 
 <script setup>
-import { computed, watch } from 'vue'
+import { computed, reactive, watch } from 'vue'
 import { useRouter } from 'vue-router'
 import { useModalStore } from '../../stores/modal.js'
 import { useProvenanceStore } from '../../stores/provenance.js'
 import { formatPostDate } from '../../utils/date.js'
+import { toPlainText } from '../../utils/htmlSanitize.js'
 
 const modal = useModalStore()
 const prov = useProvenanceStore()
 const router = useRouter()
 
+// Per-post description collapse state (keyed by provenance_id). Default
+// collapsed so multiple posts don't each eat ~180px of the panel — the
+// operator flagged the descriptions consuming a lot of real estate
+// 2026-05-28. Reset when the viewed image changes.
+const expanded = reactive({})
+function toggleDesc(id) { expanded[id] = !expanded[id] }
+watch(() => modal.currentImageId, () => {
+  for (const k of Object.keys(expanded)) delete expanded[k]
+})
+
 watch(
   () => modal.currentImageId,
   (id) => { if (id != null) prov.loadForImage(id) },
@@ -120,9 +140,22 @@ const show = computed(() => {
 const attachments = computed(() => state.value?.attachments || [])
 
 function postDate(e) { return formatPostDate(e.post.date) }
+function postTitle(e) {
+  // Titles can arrive as stored HTML (e.g. "<strong>…</strong>"); render
+  // as plain text (the CSS makes it bold).
+  return toPlainText(e.post.title) || `Post ${e.post.external_post_id}`
+}
 
-function openPost(postId) {
-  router.push({ path: '/gallery', query: { post_id: postId } })
+function openPost(postId, artistId) {
+  // Land on the post in the posts feed (in context), not the gallery
+  // image grid. Scope the feed to this artist so the user lands in
+  // that creator's stream, not the global one — operator-flagged
+  // 2026-06-01. PostsView reads `artist_id` from the query string
+  // (PostsView.vue line ~92) and filters via post_feed_service.
+  router.push({
+    path: '/posts',
+    query: { post_id: postId, artist_id: artistId },
+  })
   modal.close()
 }
 </script>
@@ -135,6 +168,18 @@ function openPost(postId) {
   color: rgb(var(--v-theme-on-surface));
   margin-bottom: 12px;
 }
+.fc-prov__cards {
+  /* 2.5 cards-worth at the typical collapsed card height (~108px each
+     incl. 10px gap). Slightly under to ensure the third card's bottom
+     edge is clipped — the visual cue that there's more below. */
+  max-height: 270px;
+  overflow-y: auto;
+  /* Hairline scrollbar that doesn't compete with content. */
+  scrollbar-width: thin;
+  scrollbar-color: rgb(var(--v-theme-surface-light)) transparent;
+  /* Pad-right so the scrollbar gutter doesn't squeeze card borders. */
+  padding-right: 4px;
+}
 .fc-prov__card {
   border: 1px solid rgb(var(--v-theme-surface-light));
   border-radius: 6px; padding: 10px 12px; margin-bottom: 10px;
@@ -145,8 +190,21 @@ function openPost(postId) {
   text-transform: lowercase;
 }
 .fc-prov__post {
-  font-weight: 600; margin: 4px 0;
-  color: rgb(var(--v-theme-on-surface));
+  /* Clickable title — opens the post in the artist-scoped feed
+     (operator-flagged 2026-06-01: title IS the primary action, the
+     prior "View post" link was redundant). Styled as a button-link:
+     accent color, underline on hover, focus ring for keyboard nav. */
+  display: block; width: 100%; text-align: left;
+  background: none; border: none; padding: 0;
+  font: inherit; font-weight: 700;
+  margin: 4px 0;
+  color: rgb(var(--v-theme-accent));
+  cursor: pointer;
+}
+.fc-prov__post:hover { text-decoration: underline; }
+.fc-prov__post:focus-visible {
+  outline: 2px solid rgb(var(--v-theme-accent));
+  outline-offset: 2px; border-radius: 3px;
 }
 .fc-prov__meta {
   font-size: 13px; color: rgb(var(--v-theme-on-surface-variant));

frontend/src/components/modal/SuggestionItem.vue

@@ -1,19 +1,33 @@
 <template>
+  <!-- Chip-card row: visible border + hover/focus state unifies the
+       name, score, and action buttons as one "object" (operator-asked
+       2026-06-01). The row itself is informational; the explicit
+       Accept button + 3-dot menu are the action affordances. -->
   <div class="fc-suggestion">
     <span class="fc-suggestion__name">
       {{ suggestion.display_name }}
       <span v-if="suggestion.creates_new_tag" class="fc-suggestion__new"
-        title="No matching tag yet — accepting creates it">＋new</span>
+        title="No matching tag yet — accepting creates it">+ new</span>
     </span>
     <span class="fc-suggestion__score">{{ scorePct }}</span>
     <v-btn
-      icon="mdi-plus" size="x-small" variant="text" color="accent"
+      class="fc-suggestion__accept"
+      size="small" variant="tonal" color="accent"
+      density="compact" rounded="pill"
       :aria-label="`Accept ${suggestion.display_name}`"
       @click="$emit('accept', suggestion)"
-    />
+    >
+      Accept
+    </v-btn>
     <v-menu>
       <template #activator="{ props }">
-        <v-btn icon="mdi-dots-vertical" size="x-small" variant="text" v-bind="props" />
+        <v-btn
+          class="fc-suggestion__menu"
+          icon="mdi-dots-vertical" size="small"
+          variant="outlined" density="compact"
+          :aria-label="`More actions for ${suggestion.display_name}`"
+          v-bind="props"
+        />
       </template>
       <v-list density="compact">
         <v-list-item @click="$emit('alias', suggestion)">
@@ -38,17 +52,45 @@ const scorePct = computed(() => `${Math.round(props.suggestion.score * 100)}%`)
 
 <style scoped>
 .fc-suggestion {
-  display: flex; align-items: center; gap: 6px;
-  padding: 2px 0;
+  display: flex; align-items: center; gap: 8px;
+  padding: 6px 10px; margin-bottom: 4px;
+  background: rgb(var(--v-theme-surface));
+  border: 1px solid rgb(var(--v-theme-surface-light));
+  border-radius: 6px;
+  transition: background 120ms ease, border-color 120ms ease;
+}
+.fc-suggestion:hover {
+  background: rgb(var(--v-theme-surface-light));
+  border-color: rgb(var(--v-theme-accent), 0.4);
+}
+.fc-suggestion__name {
+  flex: 1; min-width: 0;
+  font-size: 14px;
+  color: rgb(var(--v-theme-on-surface));
+  overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
 }
-.fc-suggestion__name { flex: 1; min-width: 0; }
 .fc-suggestion__new {
-  font-size: 10px; color: rgb(var(--v-theme-accent));
-  margin-left: 4px;
+  display: inline-block;
+  font-size: 10px; font-weight: 600;
+  color: rgb(var(--v-theme-accent));
+  background: rgba(var(--v-theme-accent), 0.12);
+  border: 1px solid rgb(var(--v-theme-accent), 0.4);
+  padding: 1px 6px; border-radius: 999px;
+  margin-left: 6px;
+  text-transform: uppercase; letter-spacing: 0.04em;
 }
 .fc-suggestion__score {
+  flex: 0 0 auto; min-width: 38px; text-align: right;
   font-size: 11px;
   color: rgb(var(--v-theme-on-surface-variant, var(--v-theme-on-surface)));
   font-family: 'JetBrains Mono', monospace;
 }
+/* Vuetify's compact density doesn't shrink the tonal button enough
+   for a tight row; clamp the min-width so Accept stays compact. */
+.fc-suggestion__accept :deep(.v-btn__content) {
+  font-size: 12px; letter-spacing: 0.02em;
+}
+.fc-suggestion__menu {
+  flex: 0 0 auto;
+}
 </style>

frontend/src/components/modal/SuggestionsPanel.vue

@@ -22,7 +22,7 @@
       <SuggestionsCategoryGroup
         v-if="store.byCategory.general && store.byCategory.general.length"
         label="General" :items="store.byCategory.general"
-        collapsible :default-open="false"
+        collapsible :default-open="true"
         @accept="onAccept" @alias="onAlias" @dismiss="store.dismiss"
       />
     </template>
@@ -38,15 +38,21 @@
 </template>
 
 <script setup>
+import { toast } from '../../utils/toast.js'
 import { computed, ref, watch } from 'vue'
 import { useSuggestionsStore, CATEGORY_LABELS } from '../../stores/suggestions.js'
+import { useModalStore } from '../../stores/modal.js'
 import SuggestionsCategoryGroup from './SuggestionsCategoryGroup.vue'
 import AliasPickerDialog from './AliasPickerDialog.vue'
 
 const props = defineProps({ imageId: { type: Number, required: true } })
 const store = useSuggestionsStore()
+const modal = useModalStore()
 
-const peopleCats = ['artist', 'character', 'copyright']
+// 'artist' (FC-2d-vii-c) and 'copyright' (2026-06-01) retired as
+// suggestion categories. Only 'character' remains as a people-style
+// category alongside the general bucket.
+const peopleCats = ['character']
 function labelFor(c) { return CATEGORY_LABELS[c] || c }
 
 const isEmpty = computed(() =>
@@ -55,9 +61,20 @@ const isEmpty = computed(() =>
 
 watch(() => props.imageId, (id) => { if (id != null) store.load(id) }, { immediate: true })
 
+// After a successful accept/alias-accept, refresh the modal's current
+// tag list so TagPanel's chip rail reflects the newly-attached tag.
+// Operator-flagged 2026-06-01: the suggestion store dropped the
+// suggestion (correct) but didn't propagate the new tag back into the
+// modal store, so the chip rail looked unchanged even though the
+// backend had recorded the application. Mirrors the addExistingTag /
+// createAndAdd flows which already call reloadTags() after applying.
 async function onAccept(s) {
-  try { await store.accept(s) }
-  catch (e) { window.__fcToast?.({ text: `Accept failed: ${e.message}`, type: 'error' }) }
+  try {
+    await store.accept(s)
+    await modal.reloadTags()
+  } catch (e) {
+    toast({ text: `Accept failed: ${e.message}`, type: 'error' })
+  }
 }
 
 const aliasDialog = ref(false)
@@ -67,8 +84,9 @@ async function onAliasConfirm(canonicalTagId) {
   try {
     await store.aliasAccept(aliasTarget.value, canonicalTagId)
     aliasDialog.value = false
+    await modal.reloadTags()
   } catch (e) {
-    window.__fcToast?.({ text: `Alias failed: ${e.message}`, type: 'error' })
+    toast({ text: `Alias failed: ${e.message}`, type: 'error' })
   }
 }
 </script>

frontend/src/components/modal/TagAutocomplete.vue

@@ -1,6 +1,7 @@
 <template>
   <div class="fc-tag-autocomplete">
     <v-text-field
+      ref="inputRef"
       v-model="query"
       placeholder="Add tag (or kind:name — character/fandom/series)"
       density="compact" hide-details
@@ -52,13 +53,21 @@
 </template>
 
 <script setup>
-import { computed, ref, watch } from 'vue'
+import { computed, nextTick, onMounted, ref, watch } from 'vue'
 import { useTagStore } from '../../stores/tags.js'
 import FandomPicker from './FandomPicker.vue'
 
 const emit = defineEmits(['pick-existing', 'pick-new', 'cancel'])
 const store = useTagStore()
 
+// Autofocus on modal open so the operator can type the moment the view
+// modal renders, no extra click required (operator-asked 2026-06-01).
+// Vuetify's v-text-field exposes .focus() on the component instance;
+// nextTick waits for the modal's mount to finish so the inner <input>
+// element exists.
+const inputRef = ref(null)
+onMounted(() => { nextTick(() => inputRef.value?.focus?.()) })
+
 // Single text input; no kind dropdown. Client-side mirror of the
 // backend's parse_kind_prefix lives below — kept in sync with
 // KNOWN_KINDS in backend/app/utils/tag_prefix.py. The backend is the

frontend/src/components/posts/PostCard.vue

@@ -7,7 +7,12 @@
     @keydown.enter="onCardClick"
   >
     <div class="fc-post-card__head">
-      <v-chip size="x-small" variant="tonal">{{ post.source.platform }}</v-chip>
+      <!-- Posts with no live subscription have source=null (alembic
+           0030); show a "filesystem import" affordance instead of a
+           platform chip. -->
+      <v-chip size="x-small" variant="tonal">
+        {{ post.source?.platform ?? 'filesystem import' }}
+      </v-chip>
       <RouterLink
         :to="{ name: 'artist', params: { slug: post.artist.slug } }"
         class="fc-post-card__artist"
@@ -25,7 +30,7 @@
         v-if="post.post_url"
         :href="post.post_url" target="_blank" rel="noopener"
         icon="mdi-open-in-new" size="x-small" variant="text"
-        :aria-label="`open original post on ${post.source.platform}`"
+        :aria-label="`open original post on ${post.source?.platform ?? 'web'}`"
         @click.stop
       />
       <v-btn
@@ -56,8 +61,8 @@
       </div>
 
       <div class="fc-post-card__text">
-        <h3 v-if="post.post_title" class="fc-post-card__title">
-          {{ post.post_title }}
+        <h3 v-if="plainTitle" class="fc-post-card__title">
+          {{ plainTitle }}
         </h3>
         <h3 v-else class="fc-post-card__title fc-post-card__title--missing">
           Post {{ post.external_post_id }}
@@ -80,8 +85,8 @@
     <!-- Expanded body: title, full mosaic, full sanitized HTML description,
          attachments. Lazy-loaded detail via getPostFull. -->
     <div v-else class="fc-post-card__expanded">
-      <h2 v-if="post.post_title" class="fc-post-card__title-full">
-        {{ post.post_title }}
+      <h2 v-if="plainTitle" class="fc-post-card__title-full">
+        {{ plainTitle }}
       </h2>
       <h2 v-else class="fc-post-card__title-full fc-post-card__title--missing">
         Post {{ post.external_post_id }}
@@ -125,7 +130,7 @@ import { computed, ref } from 'vue'
 import { RouterLink } from 'vue-router'
 
 import { usePostsStore } from '../../stores/posts.js'
-import { sanitizeHtml } from '../../utils/htmlSanitize.js'
+import { sanitizeHtml, toPlainText } from '../../utils/htmlSanitize.js'
 import PostEmptyThumbs from './PostEmptyThumbs.vue'
 import PostImageGrid from './PostImageGrid.vue'
 
@@ -149,6 +154,10 @@ const merged = computed(() => detail.value || props.post)
 const images = computed(() => merged.value.thumbnails || [])
 const attachments = computed(() => merged.value.attachments || [])
 
+// Titles can arrive as stored HTML (e.g. "<strong>…</strong>"); render as
+// plain text — the CSS makes the title bold.
+const plainTitle = computed(() => toPlainText(props.post.post_title))
+
 // Compact-view hero+rail derived from the feed-shape (capped 6).
 const hero = computed(() => props.post.thumbnails?.[0])
 const rail = computed(() => (props.post.thumbnails || []).slice(1, 4))
@@ -312,7 +321,7 @@ function formatBytes (n) {
 
 .fc-post-card__title {
   font-family: 'Fraunces', Georgia, serif;
-  font-size: 18px; font-weight: 500;
+  font-size: 18px; font-weight: 700;
   margin: 0 0 8px 0;
   color: rgb(var(--v-theme-on-surface));
   display: -webkit-box;
@@ -369,7 +378,7 @@ function formatBytes (n) {
 .fc-post-card__title-full {
   font-family: 'Fraunces', Georgia, serif;
   font-size: 22px;
-  font-weight: 500;
+  font-weight: 700;
   margin: 0;
   color: rgb(var(--v-theme-on-surface));
 }

frontend/src/components/settings/BackupRunsTable.vue

@@ -59,6 +59,8 @@
 </template>
 
 <script setup>
+import { formatRelative as fmtRelative } from '../../utils/date.js'
+
 defineProps({ runs: { type: Array, default: () => [] } })
 defineEmits(['restore', 'delete', 'tag'])
 
@@ -92,13 +94,7 @@ function formatBytes(b) {
   return `${v.toFixed(i === 0 ? 0 : 1)} ${units[i]}`
 }
 function formatRelative(iso) {
-  if (!iso) return '—'
-  const then = new Date(iso).getTime()
-  const diff = Math.max(0, (Date.now() - then) / 1000)
-  if (diff < 60) return `${Math.floor(diff)}s ago`
-  if (diff < 3600) return `${Math.floor(diff / 60)}m ago`
-  if (diff < 86400) return `${Math.floor(diff / 3600)}h ago`
-  return `${Math.floor(diff / 86400)}d ago`
+  return fmtRelative(iso, { nullText: '—' })
 }
 </script>
 

frontend/src/components/settings/BrowserExtensionCard.vue

@@ -108,6 +108,7 @@
 </template>
 
 <script setup>
+import { toast } from '../../utils/toast.js'
 import { computed, onMounted, ref } from 'vue'
 import { useApi } from '../../composables/useApi.js'
 import { copyText } from '../../utils/clipboard.js'
@@ -147,7 +148,7 @@ async function loadKey() {
     apiKey.value = key
   } catch (e) {
     apiKey.value = ''
-    window.__fcToast?.({
+    toast({
       text: `Failed to load extension API key: ${e.message}`,
       type: 'error',
     })
@@ -160,9 +161,9 @@ async function rotateKey() {
     const { key } = await api.post('/api/settings/extension_api_key/rotate')
     apiKey.value = key
     keyShown.value = true
-    window.__fcToast?.({ text: 'Extension API key rotated.', type: 'success' })
+    toast({ text: 'Extension API key rotated.', type: 'success' })
   } catch (e) {
-    window.__fcToast?.({
+    toast({
       text: `Rotate failed: ${e.message}`,
       type: 'error',
     })
@@ -174,9 +175,9 @@ async function rotateKey() {
 async function copy(text, label) {
   try {
     await copyText(text)
-    window.__fcToast?.({ text: `${label} copied.`, type: 'success' })
+    toast({ text: `${label} copied.`, type: 'success' })
   } catch (e) {
-    window.__fcToast?.({ text: `Copy failed: ${e.message}`, type: 'error' })
+    toast({ text: `Copy failed: ${e.message}`, type: 'error' })
   }
 }
 </script>